search

bbaugher / apache_zookeeper

Chef cookbook for Apache Zookeeper
MIT License
9 stars 22 forks source link

zookeeper as system user #25

Closed dcode closed 9 years ago

dcode commented 9 years ago

I see that you're creating a group and user for zookeeper, which is ideal, but I think it should be a system user and denied typical user attributes (home dir and full shell). I would expect something like the following:

user node["zookeeper"]["user"] do
  comment "Zookeeper service account"
  gid node["zookeeper"]["group"]
  shell "/bin/false"  # Deny normal shell access
  system true
  home ["zookeeper"]["base_directory"] # maybe dataDir?
  manage_home => false
end

I'm not a Zookeeper expert by any stretch, but the above would give a more typical *nix setup for a system account. See http://unix.stackexchange.com/questions/101313/what-are-the-dangers-of-creating-a-normal-user-with-uid-500 for a related discussion. I didn't edit and submit a pull request b/c I'm not that familiar with zookeeper.

dcode commented 9 years ago

I just noticed the bash profile script. I think the environment variables should go in the init script directly and can be overridden in /etc/default/zookeeper (if using Debian semantics, which is what your init script suggests).

dcode commented 9 years ago

Added the "system" property, which was really the whole point. :)

bbaugher commented 9 years ago

Fixed by #26