howto prevent starting server with root?

[lhffan]

BASIC INFO
Server OS: Specific version. ex: Debian Lennon 64-bit
Processor: Intel® Core™ i7 CPU X 980 @ 3.33GHz
Ram: 12GB
Game(s): DODS, TFT2, CSS
Start Up Command: startline="taskset -c 5 ./srcds_run -debug -game cstrike +ip xx.xx.xxx.xxx +hostport 27015 +map de_dust +maxplayers 11 +fps_max 0 -autoupdate"
Admin Mods: none

How do i prevent my server to be started with root. As for now i have to monitor them daily. Because if the server dies the root account restarts the server.

[Terrorkarotte]

Code:

#!/bin/bash

if [ `id` = 0 ]; then exit 0; fi

[lhffan]

Then the server will not start at all. It´s is possible tu choose user that starts the server?

[Terrorkarotte]

Thats the point of the code. Force admins that do not care about security to reconsider their behaviour. Also it should remind the rest if the made a small mistake.
Login as normal user and do everything with that.
Chmod 777 using root for the most stuff and so on are really bad ideas.

[lhffan]

Have added your code to my startup script and also done

chown -R user /home/userdir


What more to think about?

[BehaartesEtwas]

no, that piece of code will actually prevent the server from starting if the script is running as root. I think this is not what you want. You will want to use the command sudo to run the server as a different user. Just place at the beginning of the line actually starting the server:

Code:

sudo -u user

where "user" is the name of the user to run the server as.

[Terrorkarotte]

Which will need the package "sudo". With nearly all systems "su" is installed by default:
su -c "command in here" user

[lhffan]

-u not found

[BehaartesEtwas]

(09-07-2010, 08:03 PM)Terrorkarotte Wrote:  Which will need the package "sudo". With nearly all systems "su" is installed

you are right. sudo only has advantages if you want normal users to start gameservers as different users without entering a password...

Quote:su "command in here" user

isn't that the other way round?

Code:

su user command

@lhffan: what do you exactly mean? can you post both the command and the whole error message?

[Terrorkarotte]

(09-08-2010, 03:36 AM)BehaartesEtwas Wrote:  

Quote:su -c "command in here" user

isn't that the other way round?

Code:

su user command

As far as I remember the manpage tells to use su -c "command in here" user

[lhffan]

(09-08-2010, 03:36 AM)BehaartesEtwas Wrote:  @lhffan: what do you exactly mean? can you post both the command and the whole error message?

sudo -u user

Gives me error:

Code:

admin:~# sudo -u cssserver                                                    
usage: sudo -h | -K | -k | -L | -l | -V | -v                                    
usage: sudo [-bEHPS] [-p prompt] [-u username|#uid] [VAR=value]                
            {-i | -s | <command>}                                              
usage: sudo -e [-S] [-p prompt] [-u username|#uid] file ...

[lhffan]

I cant just add
su - cssserver

to my scripts that starts the servers?

Without parameters?

Will the system not then ask for passw if i run the file in as a cronjob under user cssserver?