I want to run elasticsearch as a systemd service in Amazon cloud VM. If I run it simply through command line shell it will run in background in subshell but as soon as the connection is terminated the process is killed.
So, I created a service /etc/systemd/system/multi-user.target.wants/indexstorage.service
[Unit]
Description=indexing-store
[Service]
Type=forking
ExecStart=/usr/local/elasticsearch-5.2.2/bin/elasticsearch
TimeoutSec=infinity
Restart=always
[Install]
WantedBy=multi-user.target
And copied to /etc/systemd/system/indexstorage.service.
Then as usual steps, reloaded and enabled indexstorage.service.
But when I start indexstorage.service, it asks for root password of the VM which is actually a Amazon cloud machine.
ubuntu@ip-172-21-3-18:~$ /bin/systemctl start indexstorage.service
==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ===
Authentication is required to start 'indexstorage.service'.
Authenticating as: Ubuntu (ubuntu)
Password:
polkit-agent-helper-1: pam_authenticate failed: Authentication failure
==== AUTHENTICATION FAILED ===
Failed to start indexstorage.service: Access denied
See system logs and 'systemctl status indexstorage.service' for details.
for which I don't know the password. And if run it as sudo user, it will never run because elasticsearch restricts running as sudo user for safety reasons.
ubuntu@ip-172-21-3-18:~$ sudo /bin/systemctl start indexstorage.service
Job for indexstorage.service failed because the control process exited with error code. See "systemctl status indexstorage.service" and "journalctl -xe" for details.
My current user/ groups is ubuntu:ubuntu
ubuntu@ip-172-21-3-18:~$ users
ubuntu
ubuntu@ip-172-21-3-18:~$ groups
ubuntu adm dialout cdrom floppy sudo audio dip video plugdev netdev lxd
I tried changing the /etc/sudoers too to allow access for groups ubuntu but has no effect,
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults mail_badpass
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL:ALL) ALL
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL
# See sudoers(5) for more information on "#include" directives:
#includedir /etc/sudoers.d
%ubuntu ALL=NOPASSWD: /bin/systemctl daemon-reload
%ubuntu ALL=NOPASSWD: /bin/systemctl restart indexstorage.service
%ubuntu ALL=NOPASSWD: /bin/systemctl stop indexstorage.service
%ubuntu ALL=NOPASSWD: /bin/systemctl start indexstorage.service
Or,
%ubuntu ubuntu=NOPASSWD: /bin/systemctl daemon-reload
%ubuntu ubuntu=NOPASSWD: /bin/systemctl restart indexstorage.service
%ubuntu ubuntu=NOPASSWD: /bin/systemctl stop indexstorage.service
%ubuntu ubuntu=NOPASSWD: /bin/systemctl start indexstorage.service
When I start service,
ubuntu@ip-172-21-3-18:~$ /bin/systemctl start indexstorage.service
==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ===
Authentication is required to start 'indexstorage.service'.
Authenticating as: Ubuntu (ubuntu)
Password:
My temporary solution for now is running it as a noHUP process, which will ignore hangup signals
nohup /usr/local/elasticsearch-5.2.2/bin/elasticsearch &
But question on this post is how can I run systemctl commands as a non-sudo user?
References
How could we allow non-root users to control a system.d service?
