1

I am setting up a shared folder between several users on a Amazon AMI (details at the bottom). I am trying to get the folder shared with one user in particular which isnt working.

My idea was to create a user group called "repository" which I would add the users to. I ran the following commands:

sudo groupadd repository
sudo usermod -a -G repository jenkins
sudo usermod -a -G repository ec2-user

sudo mkdir /repository
sudo chown jenkins:repository /repository

sudo chmod 770 /repository

now at this point I would expect the jenkins user would have no troubles making a directory in this folder. However it doesnt seem to be working.

sudo runuser -l jenkins -c "mkdir /repository/hello"

doesnt make a directory. Trying the ec2-user which is also part of the "repository" group.

sudo runuser -l ec2-user -c "mkdir /repository/hello"

makes a directory successfully. Double checking using groups jenkins and groups ec2-user verifies that the both users are part of the "repository" group.

Where am I going wrong? Is the jenkins user being a service account the problem?


The jenkins account in question is for a Jenkins webserver and the user can be changed but I would like to keep it the same.

Heres the os details:

>cat /etc/*-release
NAME="Amazon Linux AMI"
VERSION="2015.03"
ID="amzn"
ID_LIKE="rhel fedora"
VERSION_ID="2015.03"
PRETTY_NAME="Amazon Linux AMI 2015.03"
ANSI_COLOR="0;33"
CPE_NAME="cpe:/o:amazon:linux:2015.03:ga"
HOME_URL="http://aws.amazon.com/amazon-linux-ami/"
Amazon Linux AMI release 2015.03

Found a solution but dont know why it works After some more poking around I ended up changing the shell for the jenkins user from /bin/false to /sbin/nologin and everything worked fine after. Could anyone explain why using /bin/false would have caused this?

So in /etc/passwd

from: jenkins:x:498:498:Jenkins Continuous Integration Server:/var/lib/jenkins:/bin/false

to: jenkins:x:498:498:Jenkins Continuous Integration Server:/var/lib/jenkins:/sbin/nologin

ug_
  • 111
  • 4
  • They're similar but they don't act the exact same. Nologin politely exits where false outright terminates the login – Michael Bailey Aug 26 '15 at 06:17
  • @MichaelBailey I still dont understand how the user could do somethings but not others with `/bin/false` set. For instance I was able to run commands on behalf of the `jenkins` user inside `~jenkins` but not outside of it. For instance `runuser -l jenkins -c "mkdir ~/hello"` would work fine but not `runuser -l jenkins -c "mkdir /repository/hello"` – ug_ Aug 26 '15 at 06:21

0 Answers0