Question for linux admins

[PaulStat]

Ok so I have a number of Spring Boot based micro services which I am to run/deploy on an RHEL 7 server. Each micro service has it's own local user it will run as and is split into directories such as

/app/services/appa
/app/services/appb
/app/services/appc

Each services local user corresponds to the service name, so you have users appa, appb, appc.

Each micro service start script clones a git repository for app config, grabbing the environment specific (dev, uat, prod) config and placing it in the respective service directory. It also curls the apps executable jar from Artifactory. The script then changes the permissions of all config/jars to 755 and changes the owner/group to that specific local user, then the JVM is launched using the relevant local user.

There is a 1:1 mapping between process and micro service.

Now in order to do the above the user who runs the script (infrastructure support team) must have sudo access. An example noddy script (start/stop scripts exist in the location of the service directory so /app/services/appa for example)

USER=appa

sudo git clone http://somewhere/config.git

sudo mv -v config/$env/configa .

sudo rm -rf config 

sudo curl http://somwhere/appa.jar -o appa.jar

sudo chmod 755 *
sudo chown appa:appa *

sudo -S su - $USER -c "java -jar appa.jar &"

And given the processes are a 1:1 mapping between user and process the equivalent stop script would be as simple as

sudo pkill -u appa

Now ISP are saying "you have a lot of sudos", given that the alternative is that they "sudo su - appa" prior to running the start script, I can't see the issue?

Also using my approach

1. They don't need to know which user to switch to before running the script
2. They don't have to switch back to their privileged account afterwards.

 

[PaulStat]

So the infrastructure support team run the above quoted script as their own user which has access to sudo to root during the script?

I don't think they sudo to root, but they do have sudo privileges.

So your choices would be:
1. As stated strip at the sudo commands and run as the appa user after switching to it.
2. Strip out the sudo commands and call the entire script as root via sudo (making sure that the script can only be edited by root)

The difference being that currently (as written above) and with option 2 the script steps are being run as root not the appa user and in option 1 they would be being run as the appa user.

Option 2 wouldn't be an option as the JVM has to run as apps for example. I think my main query is why would they want to strip out the sudos and go with option 1? Is there some security risk? Using a script like the one I have above they wouldn't need to know which user they have to su to before running the script?

 

[PaulStat]

Right ok thanks that makes it a lot clearer