Re: a questions about putting a process under it's own group and user

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sat, Jul 14, 2007 at 04:11:28PM -0500, Scott Berry wrote:
> Hello guys and gals,
> 
> I just downloaded the teamspeak server and it recommends that it not
> be ran under root.  So I chowned and chgrped all the files and put
> it under my group and user's home directory called teamspeak.  Is
> this enough to ensure it runs under the right user and group or is
> ther more involved if so can some one help to ensure it runs under
> the teamspeak user please?

That's marginally better, but you can do much, much better. You have
conflated two concepts, file ownership and the user under which a
process executes. I suspect your teamspeak process is still running as
root. If so, your precaution is likely useless.

Instead create a new user, say "teamspeak:teamspeak" (System->
Administration-> Users and Groups). Don't give it a password or a home
directory, and change its shell to /sbin/nologin. Do give it its own
private group.

Having done that, change the ownership of the files for it back to
root:root, and make the files the teamspeak process has to read
readable but not writable by others. Any files it has to write (log
files, e.g.) should be owned and writable by teamspeak:teamspeak. The
idea is to minimize the damage a malicious attacker can do by denying
the process every possible privilege.

"man chown" and "man chmod" are your friends.

If teamspeak is designed to be run as a daemon, there should be a
script to place into /etc/rc.d/init.d. do so, then run:

chkconfig --add teamspeak

then:

service teamspeak start

Of course, this discussion ignores selinux issues entirely.

-- 

Charles Curley                  /"\    ASCII Ribbon Campaign
Looking for fine software       \ /    Respect for open standards
and/or writing?                  X     No HTML/RTF in email
http://www.charlescurley.com    / \    No M$ Word docs in email

Key fingerprint = CE5C 6645 A45A 64E4 94C0  809C FFF6 4C48 4ECD DFDB

Attachment: pgpgrkTMAG9vd.pgp
Description: PGP signature

-- 
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [Fedora Magazine]     [Fedora News]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Maintainers]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [Fedora Fonts]     [ATA RAID]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [SSH]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Tux]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Asterisk PBX]     [Fedora Sparc]     [Fedora Universal Network Connector]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux