About non_root users

[Gedeon30]

I'm finishing some of my configs in the router and I have successfully installed and configured several entware apps.

Now I'm wondering if it could be a good idea to add users for those apps in order to avoid security issues and to, eventually, allow interactive (ssh) connections to perform non-critical tasks as stop/start those app and/or copy files.... things like that...

¿ Any suggestions ?

Thanks !

 

[Gedeon30]

Not a single answer ? Maybe I don't need those non_root users.

In fact I'm looking for some kind of "mini httpd" with a simple interface… like AMTM for terminal but web, to start/stop samba, minidlna, transmission, etc... So those could be invoked by non-admin users.

 

[ColinTaylor]

Not a single answer ?

You were expecting an answer in less than 5 hours? Patience is a virtue.

Maybe I don't need those non_root users.

The router is designed to be a single-user machine. Almost everything runs as the "root" account. That's why there is no useradd, userdel, usermod, groupadd, groupdel, etc. If you want a traditional multi-user server you need to look at another device.

 

[Gedeon30]

Thanks for the answer.

I just took a look and there are another non-interactive user defined like tor and nobody. That's why I asked.

In any case I'll probably take a look to the light-httpd option starting by modifying a transmission or amuled skin to add a few options.

EDIT: You are right about patience, another thing I have to work on...

 

[sfx2000]

The router is designed to be a single-user machine. Almost everything runs as the "root" account. That's why there is no useradd, userdel, usermod, groupadd, groupdel, etc. If you want a traditional multi-user server you need to look at another device.

It's not just AsusWRT - it's pretty much every linux based consumer router and device out there. Much of this Linux development is very old, and based on a very small footprint - RAM and Flash...

Not good or bad - just is... starting to be a security issue these days, and adding repo's just compounds it.

 

[Gedeon30]

It's not just AsusWRT - it's pretty much every linux based consumer router and device out there. Much of this Linux development is very old, and based on a very small footprint - RAM and Flash...

Not good or bad - just is... starting to be a security issue these days, and adding repo's just compounds it.

That's exactly my concern. My configs don't allow any wan access but for the downloaders (those torrent ports). If only could be easy to have an "entware" user, group or something like that, I'd feel a bit more comfortable. Sure a few utilities and services still could need to run as root but certainly not many of them.

 

[Quadcore]

On my router RT-AC86U, I made all possible to run these daemons as "nobody" user : mini_httpd, lighttpd, dhcpd, minidlna, mysqld, slapd (openldap), syslog-ng, transmission.
Unfortunately I've not found any way to run these services as "nobody" user : nut, xinetd.

 

[sfx2000]

On my router RT-AC86U, I made all possible to run these daemons as "nobody" user : mini_httpd, lighttpd, dhcpd, minidlna, mysqld, slapd (openldap), syslog-ng, transmission.

Be careful with the "nobody" user as treatment for this has changed over the years on the mainline distros - in your configuration, since all those daemons are running as the same user "nobody", they can still touch each other.

In mainline distro's, and also in more forward looking embedded/small linux implementations, it's best to run each daemon as it's own user, and do things accordingly.

 

[Gedeon30]

On my router RT-AC86U, I made all possible to run these daemons as "nobody" user : mini_httpd, lighttpd, dhcpd, minidlna, mysqld, slapd (openldap), syslog-ng, transmission.
Unfortunately I've not found any way to run these services as "nobody" user : nut, xinetd.

How have you configured the scripts, config files, etc... to make those daemons to run as "nobody" ?

It would help me a lot in my tests...

Thanks in advance!

 

[Quadcore]

How have you configured the scripts, config files, etc... to make those daemons to run as "nobody" ?

It would help me a lot in my tests...

Thanks in advance!

Generically I suggest the following points:
1) If daemon startup command has a parameter to run as unprivileged user (usually is "--user" or "-u"), use it.
2) If daemon startup command has not a parameter to run as unprivileged user, you need to install Entware package "daemonize" and use this package to execute the daemon with unprivileged user (user name is mandatory for "daemonize" command).
3) You need to set the proper files' owner and access rights with commands "chown" and "chmod" for all files used by the daemon.
4) Some daemons do not work due to "/dev/null" missing access rights. I simply use a "chown" command to change owner of "/dev/null" to solve this issue.
What here above is only for home goals, not for professional/enterprise targets.
If you are a home user and you have specific questions about one daemon, ask me here. Good luck.

 

[Gedeon30]

Generically I suggest the following points:
1) If daemon startup command has a parameter to run as unprivileged user (usually is "--user" or "-u"), use it.
2) If daemon startup command has not a parameter to run as unprivileged user, you need to install Entware package "daemonize" and use this package to execute the daemon with unprivileged user (user name is mandatory for "daemonize" command).
3) You need to set the proper files' owner and access rights with commands "chown" and "chmod" for all files used by the daemon.
4) Some daemons do not work due to "/dev/null" missing access rights. I simply use a "chown" command to change owner of "/dev/null" to solve this issue.
What here above is only for home goals, not for professional/enterprise targets.
If you are a home user and you have specific questions about one daemon, ask me here. Good luck.

Thanks for the info. I didn't know that utility. Granted I'll take a look at it as soon as I get the time to test it.