7.5. Running the Agent as a Non-Root User

To access some resource information, the agent must have root access to the resource itself. However, for security, many administrators do not want to run the agent process as root.

On Red Hat Enterprise Linux, it is possible to grant access to the agent to specific resources while running the agent as a non-root user. This is done by setting local access control rules to the local directories or files for the resource.

Note

This example sets ACLs for a PostgreSQL database; the directories and files to specify in the setfacl command will vary depending on the resource type.

Log into the system as root.
Make sure that the acl package is installed on the system.
```
rpm -q acl
```
```
# rpm -q acl
acl-2.2.39-6.el5
```
Copy to Clipboard Toggle word wrap
The acl option must be applied to the filesystem. This can be done by editing the /etc/fstab file or using tune2fs. For example:
```
vim /etc/fstab
```
```
# vim /etc/fstab

LABEL=/           /             ext3    defaults,acl    1 1
...
```
Copy to Clipboard Toggle word wrap
Then re-mount the filesystem.
```
mount -o remount /
```
```
# mount -o remount /
```
Copy to Clipboard Toggle word wrap
Optionally, create a system user to use for the agent.
```
useradd jbosson-agent
```
```
useradd jbosson-agent
```
Copy to Clipboard Toggle word wrap
For PostgreSQL, the agent needs to be able to access the postgresql.conf file. Open the PostgreSQL directory:
```
cd /var/lib/pgsql
```
```
# cd /var/lib/pgsql
```
Copy to Clipboard Toggle word wrap
Grant read and write access to the postgresql.conf file to the agent user. For example:
```
setfacl -m u:jbosson-agent:rw $PGDATA/postgresql.conf
```
```
# setfacl -m u:jbosson-agent:rw $PGDATA/postgresql.conf
```
Copy to Clipboard Toggle word wrap
Then, grant access to the data/ directory to the agent user. For example:
```
setfacl -m u:jbosson-agent:x $PGDATA
```
```
# setfacl -m u:jbosson-agent:x $PGDATA
```
Copy to Clipboard Toggle word wrap

Check that the new ACLs were added properly using the getfacl command:

getfacl .
file: .
owner: postgres
group: postgres

# getfacl .
# file: .
# owner: postgres
# group: postgres
user::rwx
user:jbosson-agent:--x
group::---
mask::--x
other::---

Copy to Clipboard

Toggle word wrap

맨 위로 이동

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

7.5. Running the Agent as a Non-Root User

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat 소개

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links