7.5. Running the Agent as a Non-Root User
To access some resource information, the agent must have root access to the resource itself. However, for security, many administrators do not want to run the agent process as root.
On Red Hat Enterprise Linux, it is possible to grant access to the agent to specific resources while running the agent as a non-root user. This is done by setting local access control rules to the local directories or files for the resource.
Note
This example sets ACLs for a PostgreSQL database; the directories and files to specify in the setfacl command will vary depending on the resource type.
- Log into the system as root.
- Make sure that the acl package is installed on the system.
# rpm -q acl acl-2.2.39-6.el5
Theacloption must be applied to the filesystem. This can be done by editing the/etc/fstabfile or using tune2fs. For example:# vim /etc/fstab LABEL=/ / ext3 defaults
,acl1 1 ...Then re-mount the filesystem.# mount -o remount /
- Optionally, create a system user to use for the agent.
useradd jbosson-agent
- For PostgreSQL, the agent needs to be able to access the
postgresql.conffile. Open the PostgreSQL directory:# cd /var/lib/pgsql
- Grant read and write access to the
postgresql.conffile to the agent user. For example:# setfacl -m u:jbosson-agent:rw $PGDATA/postgresql.conf
- Then, grant access to the
data/directory to the agent user. For example:# setfacl -m u:jbosson-agent:x $PGDATA
- Check that the new ACLs were added properly using the getfacl command:
# getfacl . # file: . # owner: postgres # group: postgres user::rwx user:jbosson-agent:--x group::--- mask::--x other::---
