Running EPAS as a Custom User

Tony Smith
Tony Smith
  • Updated

Install EPAS

Install EPAS, once the repository has been setup as per the usual documentation.

[root@rhel8-epas-test system]# dnf install edb-as14-server 
Updating Subscription Management repositories.
Last metadata expiration check: 0:01:38 ago on Tue 04 Apr 2023 05:10:34 EDT.
Dependencies resolved.

==============================================================================================================================================================================================================================================
 Package                                                              Architecture                                 Version                                                Repository                                                     Size
==============================================================================================================================================================================================================================================
Installing:
 edb-as14-server                                                      x86_64                                       14.6.0-1.rhel8                                         enterprisedb-enterprise                                       9.8 k
Installing dependencies:
 edb-as14-pgagent                                                     x86_64                                       4.2.2-1.rhel8                                          enterprisedb-enterprise                                       134 k
 edb-as14-server-client                                               x86_64                                       14.6.0-1.rhel8                                         enterprisedb-enterprise                                       1.4 M
 edb-as14-server-cloneschema                                          x86_64                                       1.16-1.rhel8                                           enterprisedb-enterprise                                        26 k
 edb-as14-server-contrib                                              x86_64                                       14.6.0-1.rhel8                                         enterprisedb-enterprise                                       726 k
 edb-as14-server-core                                                 x86_64                                       14.6.0-1.rhel8                                         enterprisedb-enterprise                                       6.1 M
 edb-as14-server-devel                                                x86_64                                       14.6.0-1.rhel8                                         enterprisedb-enterprise                                       2.9 M
 edb-as14-server-docs                                                 x86_64                                       14.6.0-1.rhel8                                         enterprisedb-enterprise                                        18 k
 edb-as14-server-indexadvisor                                         x86_64                                       14.6.0-1.rhel8                                         enterprisedb-enterprise                                        72 k
 edb-as14-server-libs                                                 x86_64                                       14.6.0-1.rhel8                                         enterprisedb-enterprise                                       646 k
 edb-as14-server-llvmjit                                              x86_64                                       14.6.0-1.rhel8                                         enterprisedb-enterprise                                        12 M
 edb-as14-server-parallel-clone                                       x86_64                                       1.9-1.rhel8                                            enterprisedb-enterprise                                        95 k
 edb-as14-server-pldebugger                                           x86_64                                       1.1-1.rhel8                                            enterprisedb-enterprise                                        93 k
 edb-as14-server-plperl                                               x86_64                                       14.6.0-1.rhel8                                         enterprisedb-enterprise                                        70 k
 edb-as14-server-plpython3                                            x86_64                                       14.6.0-1.rhel8                                         enterprisedb-enterprise                                       102 k
 edb-as14-server-pltcl                                                x86_64                                       14.6.0-1.rhel8                                         enterprisedb-enterprise                                        43 k
 edb-as14-server-sqlprofiler                                          x86_64                                       4.1-1.el8                                              enterprisedb-enterprise                                        92 k
 edb-as14-server-sqlprotect                                           x86_64                                       14.6.0-1.rhel8                                         enterprisedb-enterprise                                       109 k
 edb-as14-server-sslutils                                             x86_64                                       1.3-1.rhel8                                            enterprisedb-enterprise                                        48 k
 edb-llvm                                                             x86_64                                       9.0.1-5.rhel8                                          enterprisedb-enterprise                                       4.3 M

Transaction Summary
==============================================================================================================================================================================================================================================
Install  20 Packages

Total download size: 29 M
Installed size: 100 M
Is this ok [y/N]: 

Setup the Linux environment to manage the EPAS Clusters

Create a system user that will run and own the EPAS cluster (replace XXXXXX here with the actual password you want to use for the user):

useradd  -d /var/lib/dbowner -m -U -u 302 dbowner && echo "dbowner:XXXXXX" | chpasswd

Now switch user to dbowner:

su - dbowner

Create base version folder, using as14 here as an example

mkdir as14

Initialise the cluster:

/usr/edb/as14/bin/initdb -D /var/lib/dbowner/as14/data

Start the cluster:

[dbowner@rhel8-epas-test ~]$ /usr/edb/as14/bin/pg_ctl -D /var/lib/dbowner/as14/data start
waiting for server to start....2023-04-04 03:44:53 EDT LOG:  redirecting log output to logging collector process
2023-04-04 03:44:53 EDT HINT:  Future log output will appear in directory "log".
 done
server started
[dbowner@rhel8-epas-test ~]$ /usr/edb/as14/bin/psql -d postgres
psql (14.6.0, server 14.6.0)
Type "help" for help.

dbowner=# \l
                                    List of databases
   Name    |  Owner   | Encoding |  Collate   |   Ctype    | ICU |   Access privileges   
-----------+----------+----------+------------+------------+-----+-----------------------
 edb       | dbowner | UTF8     | en_GB.utf8 | en_GB.utf8 |     | 
 postgres  | dbowner | UTF8     | en_GB.utf8 | en_GB.utf8 |     | 
 template0 | dbowner | UTF8     | en_GB.utf8 | en_GB.utf8 |     | =c/dbowner          +
           |          |          |            |            |     | dbowner=CTc/dbowner
 template1 | dbowner | UTF8     | en_GB.utf8 | en_GB.utf8 |     | =c/dbowner          +
           |          |          |            |            |     | dbowner=CTc/dbowner
(4 rows)

dbowner=# 

This confirms that you now have a cluster, running as the dbowner system user, with uid=302. If you wish to manage the stop and start via systemd service scripts, then carry out the following additional steps as root.

Setting Up Systemd configuration

cd /usr/lib/systemd/system/
cp edb-as-14.service dbowner_epas14.service

Edit dbowner_epas14.service and change the following settings:

  1. User
  2. Group
  3. Environment=PGDATA
  4. PIDFile

For the example shown above, the service file contents should be .

# It's not recommended to modify this file in-place, because it will be
# overwritten during package upgrades.  It is recommended to use systemd
# "built-in" feature "systemctl edit edb-as-14" which will automatically
# create override.conf file inside /etc/systemd/system/edb-as-14.service.d
# directory. For example, the contents of this file should look like:
# [Service]
# Environment=PGDATA=/var/lib/edb/as14/data-new
# This will override the unit's default
# Look at systemd.unit(5) manual page for more info.

# Note: changing PGDATA will typically require adjusting SELinux
# configuration as well.

[Unit]
Description=EDB dbowner Advanced Server 14
After=syslog.target network.target

[Service]
Type=notify

User=dbowner
Group=dbowner

# Location of database directory
Environment=PGDATA=/var/lib/dbowner/as14/data
PIDFile=/var/lib/dbowner/as14/data/postmaster.pid

# Where to send early-startup messages from the server (before the logging
# options of postgresql.conf take effect)
# This is normally controlled by the global default set by systemd
# StandardOutput=syslog

# Disable OOM kill on the postmaster
OOMScoreAdjust=-1000

ExecStartPre=/usr/edb/as14/bin/edb-as-14-check-db-dir ${PGDATA}
ExecStart=/usr/edb/as14/bin/edb-postmaster -D ${PGDATA}
ExecReload=/bin/kill -HUP $MAINPID
KillMode=mixed
KillSignal=SIGINT

# Give a reasonable amount of time for the server to start up/shut down
TimeoutSec=300

[Install]
WantedBy=multi-user.target

Note that here we can ignore the warning comment that begins "It's not recommended to modify this file in-place." as this is a new file that will not be managed by any packaging.

Now see if the cluster can be started and status checked using systemctl:

[root@rhel8-epas-test system]# systemctl start dbowner_epas14
[root@rhel8-epas-test system]# systemctl status dbowner_epas14
● dbowner_epas14.service - EDB dbowner Advanced Server 14
   Loaded: loaded (/usr/lib/systemd/system/dbowner_epas14.service; disabled; vendor preset: disabled)
   Active: active (running) since Tue 2023-04-04 03:53:19 EDT; 6s ago
  Process: 2935 ExecStartPre=/usr/edb/as14/bin/edb-as-14-check-db-dir ${PGDATA} (code=exited, status=0/SUCCESS)
 Main PID: 2941 (edb-postmaster)
    Tasks: 9 (limit: 49323)
   Memory: 68.8M
   CGroup: /system.slice/dbowner_epas14.service
           ├─2941 /usr/edb/as14/bin/edb-postmaster -D /var/lib/dbowner/as14/data
           ├─2942 dbowner: logger 
           ├─2944 dbowner: checkpointer 
           ├─2945 dbowner: background writer 
           ├─2946 dbowner: walwriter 
           ├─2947 dbowner: autovacuum launcher 
           ├─2948 dbowner: stats collector 
           ├─2949 dbowner: dbms_aq launcher 
           └─2950 dbowner: logical replication launcher 

Apr 04 03:53:19 rhel8-epas-test systemd[1]: Starting EDB dbowner Advanced Server 14...
Apr 04 03:53:19 rhel8-epas-test edb-postmaster[2941]: 2023-04-04 03:53:19 EDT LOG:  redirecting log output to logging collector process
Apr 04 03:53:19 rhel8-epas-test edb-postmaster[2941]: 2023-04-04 03:53:19 EDT HINT:  Future log output will appear in directory "log".
Apr 04 03:53:19 rhel8-epas-test systemd[1]: Started EDB dbowner Advanced Server 14.
[root@rhel8-epas-test system]# 

You can double check the ownership of the processes:

[root@rhel8-epas-test system]# ps -ef|grep 'postgres\|edb'
root        3040       1  0 03:55 ?        00:00:00 gpg-agent --homedir /var/cache/PackageKit/8.6/metadata/enterprisedb-enterprise-8-x86_64.tmp/gpgdir --use-standard-socket --daemon
root        3061       1  0 03:55 ?        00:00:00 gpg-agent --homedir /var/cache/PackageKit/8.6/metadata/enterprisedb-enterprise-noarch-8-x86_64.tmp/gpgdir --use-standard-socket --daemon
root        3082       1  0 03:55 ?        00:00:00 gpg-agent --homedir /var/cache/PackageKit/8.6/metadata/enterprisedb-enterprise-source-8-x86_64.tmp/gpgdir --use-standard-socket --daemon
dbowner     6929       1  0 05:32 ?        00:00:00 /usr/edb/as14/bin/edb-postmaster -D /var/lib/dbowner/as14/data
dbowner     6930    6929  0 05:32 ?        00:00:00 postgres: logger 
dbowner     6932    6929  0 05:32 ?        00:00:00 postgres: checkpointer 
dbowner     6933    6929  0 05:32 ?        00:00:00 postgres: background writer 
dbowner     6934    6929  0 05:32 ?        00:00:00 postgres: walwriter 
dbowner     6935    6929  0 05:32 ?        00:00:00 postgres: autovacuum launcher 
dbowner     6936    6929  0 05:32 ?        00:00:00 postgres: stats collector 
dbowner     6937    6929  0 05:32 ?        00:00:00 postgres: dbms_aq launcher 
dbowner     6938    6929  0 05:32 ?        00:00:00 postgres: logical replication launcher 

Now that we have a working systemd service script we can enable it so that the server is automatically start at host boot time:

[root@rhel8-epas-test system]# systemctl enable dbowner_epas14

Disable the enterprisedb Linux account

We wouldn't recommend removing the enterprisedb linux account, as upon re-installs or updates the account may get recreated, it would make more sense to simply disable the account. As root:

[root@rhel8-epas-test system]# usermod -L -e 1 enterprisedb -s /sbin/nologin

This locks the account, and sets the shell to nologin as well. So, even if you su from root you can't log in as enterprisedb

[root@rhel8-epas-test system]# su - enterprisedb
This account is currently not available.
[root@rhel8-epas-test system]# 

Conclusion

You can create as many Linux users and systemd services as you like, meaning a dedicated user may only be able to manage their own cluster configurations, whilst using the same binaries as the other users.

Related to

Was this article helpful?

0 out of 0 found this helpful