Unable to start service, auth could not identify password for

Question

Im trying to start a linux service, however im getting the below issue when im trying to start the service. Please help with a solution of how to fix this issue

The user Test_user is set with ALL=(ALL) ALL in sudoers file

Nov 17 11:20:24 systemd[1]: Starting wso2am-4.2.0.service... 
Nov 17 11:20:24 wso2am-4.1.0[171210]: Starting the WSO2 Server ... 
Nov 17 11:20:24 su[171211]: pam_unix(su:auth): auth could not identify
password for [Test_user] Nov 17 11:20:26 su[171211]: FAILED SU (to
Test_user) root on none Nov 17 11:20:27 wso2am-4.1.0[171210]:
Password: Password: su: Authentication failure Nov 17 11:20:27
systemd[1]: wso2am-4.2.0.service: Control process exited, code=exited
status=1 Nov 17 11:20:27  systemd[1]: wso2am-4.2.0.service: Failed
with result 'exit-code'.

The script contains:

#! /bin/sh 
export JAVA_HOME="/usr/lib/jvm/java-11-openjdk-11.0.18.0.10-2.el8_7.x86_64"
startcmd='/var/wso2am-4.1.0/bin/api-manager.sh start > /dev/null &'
restartcmd='/var/wso2am-4.1.0/bin/api-manager.sh restart > /dev/null &' 
stopcmd='/var/wso2am-4.1.0/bin/api-manager.sh stop > /dev/null &'

case "$1" in 
    start)    
        echo "Starting the WSO2 Server ..."    
        su -c "${startcmd}" Test_user 
        ;; 
    restart)
        echo "Re-starting the WSO2 Server ..."    
        su -c "${restartcmd}" Test_user 
        ;; 
    stop)
        echo "Stopping the WSO2 Server ..."    
        su -c "${stopcmd}" Test_user 
        ;;
    *)    
        echo "Usage: $0 {start|stop|restart}" 
        exit 1 
esac

Answer 1

I suspect you have something like this:

[Unit]
Description="WS02 Server"

[Service]
User=Test_user
ExecStart=sudo /usr/local/bin/wso2am-4.1.0

There are a few things wrong with this:

1. sudo is meant to be interactive. It is intended to verify that you're a person, and not a script.
2. You are setting User=, but then using sudo to change that to root, undoing the User= part of it.

Here's what you can do:

1. Simple, but not graceful: Add :NOPASSWD to /etc/sudoers. I don't recommend this because you're going against sudo's design

Test_user  ALL=(ALL) NOPASSWD: ALL

2. Do not set User=. In my assumption above, you are using Test_user, but immediately switching back to root with sudo. Test_user isn't running that process anymore. In this case, there is no point in Test_user and you're better off with:

[Service]
ExecStart=/usr/local/bin/wso2am-4.1.0

3. I think it's more likely that my assumption above is wrong and you're only trying to elevate something specific. Maybe you call a script as Test_user and then only one small command in that script needs to be elevated. In that case, pull it out and give it elevated privileges in ExecStartPre= with the + prefix:

| Service                      | Script                     |
|------------------------------|----------------------------|
| [Service]                    | #!/bin/bash                |
| User=Test_user               | sudo wso2am-4.1.0 update   |
| ExecStart=/path/to/script    | wso2am-4.1.0 run           |

becomes

[Service]
User=Test_user
ExecStartPre=+/usr/bin/wso2am4.1.0 update
ExecStart=/usr/bin/wso2am4.1.0 run

Answer 2

My other answer is appropriate in a general case where you could have sudo or su in your script. You've added details of what the script actually has, so here is a more tailored answer:

The script you have added only does a few things:

1. Sets $JAVA_HOME
2. Forwards start, stop, restart commands to an apt-manager.sh as a specific user
3. Logs what it's doing.

This looks like it was made to run with an older init system, but this isn't necessary anymore with systemd. It lets you set your environment (export), and handles log (echo), user (su), start/stop/restart (case), silencing (>/dev/null) and forking (&) for you in the service file directly. Forget about that script and make a service that does the same thing, but properly.

[Service]
Type=forking
User=Test_user
ExecStart=/var/wso2am-4.1.0/bin/api-manager.sh start
ExecStop=/var/wso2am-4.1.0/bin/api-manager.sh stop
Environment=JAVA_HOME=/usr/lib/jvm/java-11-openjdk-11.0.18.0.10-2.el8_7.x86_64

The only difference is systemctl restart will run the ExecStop= then ExecStart=. There is no ExecRestart= so I haven't added it to your service. If apt-manager.sh restart reloads its configuration instead of a simple stop/start, then you can add ExecReload=/var/wso2am-4.1.0/bin/api-manager.sh restart.

Depending on what's in api-manager.sh, you might also be able to remove that script and simply start whatever process it launches itself. You can probably remove that too, and run as a Type=simple service.