3

I have a service level account to run my webserver, and this user is setup with /sbin/nologin.

Normally when you add a user to a group you must logout and login to use the new group permissions.

I'd like to add this user to another group to extend some of its permissions but since my webserver user never logs in, when or how will the user gain access to the new group permissions?

  • Which operating system? If Linux - which distribution? What webserver? Apache httpd? – Nils Jun 23 '12 at 20:21
  • @Nils - Running CentOS 6 and nginx for the webserver – ProfessionalAmateur Jun 24 '12 at 18:02
3

The process's groups are set by the program that changes from root to the target user before executing the process's program. When a user logs in, the program that changes the user is the login program (login, su, sshd, …) and the process's program is the user's shell. For a daemon run under system user, the program that changes the user can be su or some other tool such as Debian's start-stop-daemon. For example, start-stop-daemon always adds the supplemental groups to the process. The user-changing program must have logic to set both the primary group from the user database and the supplemental group from the group database.

1

With CentOS 6 nscd might be running. If you did not change the group ownership by a hig-level-command (like usermod) you have to make sure to run grpconv so /etc/gshadow gets updated as well. If nscd is running add nscd -i group to invalidate the local group cache. If you changed the primary GID run nscd -i passwd.

Check the result with id -a $ACCOUNT.

After that - restart your service.

0

I suggest su - ; /etc/init.d/NAME stop; /etc/init.d/NAME start;

"/etc/init.d/NAME restart" might be not enough.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.