Init scripts invoking script on a user's directory -- not working (Ubuntu 18.04)

Question

I want to automatically start email tunnels and socks proxy at boot time. I have an /etc/init.d/email-tunnels script that invokes another script under my home directory. It won't work at boot time, it won't work if I execute sudo service email-tunnels start, but it does work if I just run it, sudo /etc/init.d/email-tunnels start. BTW, I have an identical setup on another machine (Debian 8), and it works like a charm on that one.

These are the details (of the Ubuntu 18 setup, the one that is not working):

[···]$ ls -lh /etc/init.d/email-tunnels 
-rwxr-xr-x 1 root root 602 Aug 28 10:21 /etc/init.d/email-tunnels
[···]$

The contents is (including some debugging echos):

[···]$ cat /etc/init.d/email-tunnels 
#! /bin/sh

### BEGIN INIT INFO
# Provides:     email_tunnels
# Required-Start:   $all
# Required-Stop:    $remote_fs $syslog
# Default-Start:    2 3
# Default-Stop:     0 1 6
# Short-Description:    E-mail and HTTP tunnels over SSH
### END INIT INFO

echo "email-tunnels invoked at `date`" >> /tmp/email-tunnels.log

touch /var/lock/email-tunnels

case "$1" in
  start)
    echo "email-tunnels executing 'start' at `date`" >> /tmp/email-tunnels.log
    su -c "/home/cal/bin/email.sh &" cal
    ;;
  stop)
    ;;
  *)
    echo "Usage: /etc/init/email-tunnels {start|stop}"
    exit 1
    ;;
esac

exit 0

And then, my script on my home directory:

[···]$ ls -lh /home/cal/bin/email.sh 
-rwxr-xr-x 1 cal cal 410 Aug 28 10:09 /home/cal/bin/email.sh
[···]$ 

And its contents:

[···]$ cat /home/cal/bin/email.sh 
#!/bin/bash

echo "email.sh executed at `date`" >> /tmp/email.log
sleep 30

while [ "1" == "1" ]
do
    echo "email.sh about to execute ssh at `date`" >> /tmp/email.log
    ssh -N -D5080 -Llocalhost:10110:xx.xx.xx.xx:110 -Llocalhost:10025:xx.xx.xx.xx:25 [email protected]
    sleep 120
done

The tunnels user on my target (server) machine does have the PK authentication properly configured, so that I can ssh-connect without any user interaction (without having to supply a password).

Any ideas why it's not working? From the debugging output, I see that the init.d script (email-tunnels) is executed (I see the output at /tmp/email-tunnels.log), but not the /home/cal/bin/email.sh --- when I manually run /etc/init.d/email-tunnels start, then I do see the /tmp/email.log debugging output, and for that matter the tunnels work after I ran it.

Answer 1

You are using Ubuntu Linux, an operating system that has been a systemd operating system since 2016 and was an Upstart operating system for a decade before that, since 2006. van Smoorenburg rc scripts are not the way, especially for new stuff.

And especially in this case. This is almost a candidate for the House of Horror. On your system a generated service unit is running a process to interpret a script, that forks a process to run su (abusing that to drop privileges), that forks a process to run a shell, that forks a process to interpret another script, that runs an infinite loop Poor Man's Dæmon Supervisor that repeatedly forks ssh.

And all this just to do what a service manager can do anyway: run a specific program as a specific user and restart it every time that it exits.

Learn journalctl -b for reading the logs, and build upon this fairly simple basis:

# /etc/systemd/system/email_tunnels.service
[Unit]
Description=E-mail and HTTP tunnels over SSH
Documentation=https://unix.stackexchange.com/a/465353/5132

[Service]
User=cal
Type=simple
ExecStart=/usr/bin/ssh -N -D5080 -Llocalhost:10110:xx.xx.xx.xx:110 -Llocalhost:10025:xx.xx.xx.xx:25 [email protected]
RestartSec=120

[Install]
WantedBy=multi-user.target

Then you merely need to ensure that this service is run after your home directory, containing your SSH identity files, is available. Of course, with some setups this is only the case after you have logged in and your home directory has been auto-mounted, decrypted, and whatnot. In which case you might as well not set up a system-level service at all and instead run this as a user service under your per-user instance of systemd, which is started at your first login:

# /home/cal/.config/systemd/user/email_tunnels.service
[Unit]
Description=E-mail and HTTP tunnels over SSH
Documentation=https://unix.stackexchange.com/a/465353/5132

[Service]
Type=simple
ExecStart=/usr/bin/ssh -N -D5080 -Llocalhost:10110:xx.xx.xx.xx:110 -Llocalhost:10025:xx.xx.xx.xx:25 tunnel[email protected]
RestartSec=120

[Install]
WantedBy=default.target

Use the --user option to systemctl to control such a per-user service, of course.

Further reading

• https://unix.stackexchange.com/a/200281/5132
• Jonathan de Boyne Pollard (2015). The systemd House of Horror. Frequently Given Answers.
• https://unix.stackexchange.com/a/408848/5132
• Jonathan de Boyne Pollard (2014). Don't abuse su for dropping user privileges. Frequently Given Answers.
• https://unix.stackexchange.com/a/233581/5132
• Why can't systemd service access user's home dir, but works after service restart?