What user have I to use to enable this service on a CentOS7 machine using systemctl enable command?

Question

I am not a sysadministrator (I am a software developer), this time I have to install some agents on some CentOS machines in order to be monitored by Wazuh (a SIEM software). I have the following doubt. After a successful installation of the agent via YUM I need to enable the service related to this Wazuh agent.

Then I have to enable the wazuh-agent service performing the following command:

[adminuser@my-machine ~]$ systemctl enable wazuh-agent
==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-unit-files ===
Authentication is required to manage system service or unit files.
Multiple identities can be used for authentication:
 1.  Cloud User (centos)
 2.  adminuser
 3.  user2

The problem is that performing the command it is asking to me with what user I want to enable this service (requiring user authentication).

On this machine I have defined 3 users:

• centos: it is an user with administrative privileges that was used to perform the first access to this machine via SSH and from here it was used to create the other 2 users.
• adminuser: it is my admin user (and have SSH access). It have administrative privileges.
• user2 it is a second admin user that have not SSH access. It have administrative privileges but it is used by another person working on this machine that is not involved in this Wazuh agent activity.

So what is the best choice? I was thinking to use my personal admin user (adminuser) but I am not sure that it is the best choice.

Another doubt is: with this command I am enabling this wazuh-agent service. What happens if the machine is rebooted? After the reboot this service will automatically startup or it is needed a manual start?

Answer 1

When you run systemctl as a non-root user, systemd uses PolicyKit to check whether you can elevate your rights. Other answers have told you to use sudo, which is also a good idea, but sudo uses a completely different configuration than systemd for determining if you can elevate your rights.

The configuration for PolicyKit on CentOS for this is most likely going to be in /etc/polkit-1/rules.d/50-default.rules which would have something like this:

polkit.addAdminRule(function(action, subject) {
    return ["unix-group:wheel"];
});

This means that the account that should be able to do admin functions is a member of the “wheel” group.

Answer 2

Whichever user has elevated privileges will effect the same. That's what you mean by administrator, right? Or are they different? My default guess is they're all equal. As for reboot, enable is the command that takes care of reboots and means to start by default (as opposed to just start, which starts a service there and then).

Answer 3

systemctl enable/disable/stop/run/etc commands normally require a root account or using sudo. It's hard to understand what you really mean by "the account X has administrative privileges". In Linux there's root which can do almost everything, and you can give users access to sudo to allow them to run certain commands under root without allowing them to do everything else.

Another doubt is: with this command I am enabling this wazuh-agent service. What happens if the machine is rebooted?

systemctl enable will make the service start automatically after a reboot.

https://helpdeskgeek.com/linux-tips/hdg-explains-what-is-sudo-root-on-linux/

Answer 4

A lot of system commands in Linux require you to root access (often achieved by using sudo). Often controlling who has access to perform specific tasks is controlled by configuring sudo. This has been a long standing paradigm in Linux...

However systemd (systemctl) uses polkit to allow non-root users to perform privileged commands. It will allow root to do anything (I'm not sure if this is hard coded or just commonly configured). However you don't need to call systemctl as root if you don't want to.

When presented with a list of users as you have been, it shouldn't make much difference which you use. It will ask you for the password for the user you select, so the main difference is whether or not you know the right password.

As mentioned you can still call systemctl as root. If you have sudo access you may prefer to use:

sudo systemctl enable wazuh-agent

This will only ask for your current user's password.

---

What happens if the machine is rebooted?

That would actually depend on the service's own configuration. Most commonly yes this will just restart the service on reboot. And looking at the name, I think this one should. But please be aware that it's dependant on the specific service.