How to create limited user accounts in Linux

Question

I want to create a user account for each of the key programs installed on my debian server. For example, for the following programs:

Tomcat Nginx Supervisor PostgreSQL

This seems to be recommended based on my reading online. However, I want to restrict these user accounts as much as possible, so that they dont have a shell login, dont have access to the other programs and are as limited as possible but still functional.

Would anyone mind telling me how this could be achieved? My reading so far suggests this:

echo "/usr/sbin/nologin" >> /etc/shells useradd -s /usr/sbin/nologin tomcat

But I think there may be a more complete way of doing it.

EDIT: I'm using debian squeeze

Answer 1

Which distro are you running? Good distros already set up their install scripts for such packages to create users specific to daemons that can benefit from running as a separate user. Some packages share a user where they need to cooperatively read/write on various files. But in all cases they tend to have nologin as their login shell, which is appropriate.

Answer 2

I don't no whether it will help you or not just see this .

I want to restrict these user accounts as much as possible, so that they dont have a shell login

For this before creating user account just edit the /etc/default/useradd file

This

  1 # useradd defaults file
  2 GROUP=100
  3 HOME=/home
  4 INACTIVE=-1
  5 EXPIRE=
  6 SHELL=/bin/bash
  7 SKEL=/etc/skel
  8 CREATE_MAIL_SPOOL=yes

To This

  1 # useradd defaults file
  2 GROUP=100
  3 HOME=/home
  4 INACTIVE=-1
  5 EXPIRE=
  6 SHELL=/bin/nologin
  7 SKEL=/etc/skel
  8 CREATE_MAIL_SPOOL=yes

After changing this if you create a user account, for all those accounts it is not possible to login to system

That is because of this

user:x:1017:1017::/home/user:/bin/nologin -----> /etc/passwd file entry

see here

[max@localhost ~]$ su - user
Password: 
su: /bin/nologin: No such file or directory
[max@localhost ~]$ 

you can get this by editing /etc/passwd file directly no need to edit /etc/default/useradd

file if user's are less

just change last filed

This

user:x:1017:1017::/home/user:/bin/bash

To this

user:x:1017:1017::/home/user:/bin/nologin