I'm trying to set up the Hashicorp Vault Agent as a systemd service. I can manually run that agent with the user vault.
Note, perhaps that's important: here's the /etc/passwd for that user :
vault:x:994:989::/home/vault:/bin/false
So I need to do sudo su -s /bin/bash vault
to get a vault session.
With that in mind, I can do the vault agent -config=<pathToConfig>
and it works.
Now here the /usr/lib/systemd/system/vault-agent.service
I've set up :
[Unit]
Description="HashiCorp Vault - A tool for managing secrets"
Documentation=https://www.vaultproject.io/docs/
Requires=network-online.target
After=network-online.target
ConditionFileNotEmpty=/etc/vault.d/vault.hcl
[Service]
User=vault
Group=vault
ProtectSystem=full
ProtectHome=read-only
PrivateTmp=yes
PrivateDevices=yes
SecureBits=keep-caps
AmbientCapabilities=CAP_IPC_LOCK
Capabilities=CAP_IPC_LOCK+ep
CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
NoNewPrivileges=yes
ExecStart=/bin/vault agent -non-interactive -config=/etc/vault.d/agent-config-prod.hcl
ExecReload=/bin/kill --signal HUP $MAINPID
KillMode=process
KillSignal=SIGINT
Restart=no
RestartSec=5
TimeoutStopSec=30
StartLimitIntervalSec=60
StartLimitBurst=3
LimitNOFILE=65536
[Install]
WantedBy=multi-user.target
This is a service conf I've found multiple times.
But I always get the same issue: Error storing PID: could not open pid file: open ./pidfile: permission denied
I tried to replace the ExecStart= by /bin/whoami, just to be sure, yes, it's indeed vault. Permission and location of that ./pidfile (default install location):
/etc/vault.d/pidfile
drwxr-xr-x. 108 root root 8192 May 15 16:32 etc
drwxr-xr-x 3 vault vault 113 May 15 17:43 vault.d
-rwxrwxrwx 1 vault vault 0 May 15 17:48 pidfile #not default permission, but I am desesperate.
I am really suspicous about the sudo su -s /bin/bash vault
command that, perhaps, grants the vault user more privileges. If so, how to incorporate it into my service?
I ran systemctl reload daemon everytime and SELinux is disable.
ps: if someone has a great link about how to set up a systemd for the vault AGENT (not as root), I'll take it.
EDIT :
about the sudo -s /bin/bash vault
$ sudo -s /bin/bash vault
/bin/vault: cannot execute binary file
$ su -s /bin/bash vault
Password: (and I have no password or I don't know it)
So that's why I'm using the full sudo su -s /bin/bash vault
command.
su
is an older command that does the same job assudo
but slightly different. There is (should be) no benefit to running them both together. If you want a root command prompt you can dosudo -i
. To run your above command you can simply dosudo vault
. I suspect the actual issue is the use of./pidfile
where./
is a relative path meaning "current directory". Systemd runs commands in it's own environment and the "current directory" may not be what you expect. Perhaps there is a way to tell vault where you want to store the pidfile with an absolute path?sudo -u vault vault
where "-u vault" tells sudo to switch to the "vault" user to run the command instead of the root user. To get a command prompt as the user vault you can dosudo -i -u vault
.pid_file
in the Vault Agent configuration? If the configured location is within thevault
user's home directory, then the issue is likely thesystemd
optionProtectHome=read-only
.Error storing PID: could not open pid file: open /etc/vault.d/pidfile: read-only file system
which is, indeed, a but more clear, but still confusing since I have no issue running manually the command as a vault user or even editing files as vault in the exact same location where the pidfile is.sudo -s /bin/bash vault
command. Also, I've tried toExecStart=bin/sudo su -s /bin/bash vault -c "<command>"
to have the same permissions but it did not like that :sudo: effective uid is not 0, is /bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?