Search code examples
ubuntudnssystemd

Ubuntu 18.04: Running a service under a domain account


I am having an issue that seems most closely related to this one, but while that poster achieved resolution the same things are not helping on my system:

https://unix.stackexchange.com/questions/420881/how-can-i-run-a-systemd-service-under-an-active-directory-account

-and-

systemd error "failed to start service: unit service is not loaded properly: exec format error"

My Ubuntu machine is joined to our domain, and I can "id john.doe" and get a valid lookup from AD. I do not have to specify the domain because in my /etc/sssd/sssd.conf file I have "use_fully_qualified_names = False".

I have tried both true and false and neither of them seem to give me a means of resolution.

First, I edit my .service file and set

[Unit]
Description=servicex
After=network.target

[Service]
ExecStart=/v/runsvc.sh
User=john
WorkingDirectory=/v
KillMode=process
KillSignal=SIGTERM
TimeoutStopSec=5min

[Install]
WantedBy=multi-user.target

Then

 systemctl daemon-reload
 systemctl start servicex.service

The service starts.

I then edit my service file and change the user to john.doe. Save the file, reload the daemon, and start the service. I get

Failed to start servicex.service: Unit servicex.service is not loaded properly: Exec format error.
See system logs and 'systemctl status servicex.service' for details.
Failed: failed to start servicex.service

systemctl status servicex.service returns:

● servicex.service - servicex
   Loaded: error (Reason: Exec format error)
   Active: inactive (dead) since Thu 2020-01-09 13:34:47 UTC; 15s ago
  Process: 5060 ExecStart=/v/runsvc.sh (code=exited, status=0/SUCCESS)
 Main PID: 5060 (code=exited, status=0/SUCCESS)

journalctl -u servicex.service does not show any new entries

journalctl does not show any new entries.

Is this a permissions issue, owner issue?

Going through each of the folders of the service by doing "ll -R" shows (typical excerpt):

drwxr-xr-x 2 john.doe domain users  4096 Jun 15  2016 ./
drwxr-xr-x 8 john.doe domain users  4096 Jun 15  2016 ../
-rw-r--r-- 1 john.doe domain users 29597 Jun 15  2016 CHANGES.md
-rw-r--r-- 1 john.doe domain users  1092 Jun 15  2016 LICENSE

This is typical of all of the files in that sub-folder tree.

How can I run this service as the domain user?


Solution

  • I have found the issue and a work-around. Please feel free to post better solutions if there are any.

    The issue here is that the domain user has a "." in the middle of it. "john.doe". After trying out putting bogus values in the user field I noticed that I started getting a different error message specifically saying that the account was bad.

    There had to be some reason why using "john.doe" did not give me the same messages as using "johnbogus". In fact, "john.bogus" and "john.doe" return the same error, but "johnbogus" and "john.doe" return different error messages.

    On this basis I assumed that the service user field is not being parsed correctly. So I requested an account for our domain with no "." in it. That account installs and works perfectly.

    I'll consider an additional answer a better answer if someone finds a means of quoting, or escaping "john.doe" so that it will work properly. I tried merely putting double quote marks around it ", but that had no effect.