Keepalived scripts and how to run them as non root user

What happens is the following: Keepalived triggers the command pidof nginx every second. If the command was successful (command exit code 0), the weight is added to the local priority. In a VRRP cluster it may be that suddenly Nginx is stopped on the current master node. In this case the chk_nginx script will fail and remove the 3 points from the local weight - the VRRP backup node, where Nginx is still running, now likely has a higher priority and the VRRP failover is initiated.

Running the VRRP scripts as non-root user

Interestingly these vrrp_scripts run (by default) as root user. There are certainly situations when this is required, but simply checking a process, such as Nginx, to be running as root, is not needed and does not make sense from a security point of view:

ck@nginx1:~$ pidof nginx
30991 30990 30989 30988 30987 30986 30985 30984 24805

So why are these vrrp_scripts run as root user by default, when even the keepalived man page says this could be dangerous:

There are significant security implications if scripts are executed with root privileges, especially if the scripts themselves are modifiable or replaceable by a non root user.

Actually the default setting is to not run the scripts as root, as one can read in the man page:

By default the scripts will be executed by user keepalived_script if that user exists, or if not by root, but for each script the user/group under which it is to be executed can be specified.

Fun fact: This user "keepalived_script" is not created by the keepalived packages. At least not in Ubuntu and Debian (both tested as of this writing). Due to this fact, Keepalived is failing back to the root user, as described in the man page.

One possibility would be to create a local user "keepalived_script" - but then all the scripts would run under that user and, depending on the defined commands and their needed permissions, this might break the health check.

Another possibility is to define another default script_user inside the Keepalived global_defs:

global_defs {
  router_id nginx1        # my own hostname
  script_user nagios      # run all scripts as nagios user
}

And yet another possibility is to define a user on a per script basis (as mentioned in the quote above):

vrrp_script chk_nginx {
  script "pidof nginx"
  interval 1       # check every second
  weight 3         # add 3 points of prio if OK
  user nagios      # run this particular script as nagios user
}

In the above example, the existing script "chk_nginx" was modified and a user option was added. This means that for this particular health check, the user nagios will be used. All the other scripts continue to use the default user.

Certainly a much better (secure) approach for triggering vrrp scripts.

Anti Spam Question: John Lennon, Paul McCartney, George Harrison and Ringo Starr were members of which band? (full correct name)