search

emqxarchive / emqx-packages

EMQ X RPM/DEB Packages
https://www.emqx.io
5 stars 9 forks source link

The debian package is running as root user #1

Closed swarno closed 7 years ago

swarno commented 7 years ago

Hi Team

When I install the emqtt debian package in an Ubuntu 14.04 machine, the emqttd service runs as root. This raises some security concerns over the usage of debian package. As mentioned in the startup (init.d) script the emqtt deamon should run as emqtt user which was created for running emqtt. Please have a look. start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --user emqtt --exec $ERTS_PATH/run_erl

Also the .erlang.cookie file has only root access permission. Is that intended behavior?

root_emqtt

swarno commented 7 years ago

Please try it on a fresh Ubuntu 14.04 machine.