aws / aws/amazon-ssm-agent

ssm-agent user should be a "system" user in Linux

Open
#455 1 comment 8 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.2k
Forks
357
PR merge metrics
No merged PRs in 30d

Description

In order to prevent UID conflicts when you have multiple instances that share a network filesystem (e.g. NFS) ssm-agent should create the ssm-user in the SYS_UID_MIN-SYS_UID_MAX range as defined in /etc/login.defs.

Use case: I have a multi-user system that shares NFS (EFS) storage. NFS requires that UIDs match for file/directory access. Users are created on an ad-hoc basis using scripts where a script checks a master list for the next available UID and then sets up accounts on the NFS client instances. However if the ssm-agent login has been invoked for the first time on the instance it will take the next available user ID and therefore cause UID conflicts when I attempt to add another user to that system.

#124 suggests pre-creating the ssm account and /etc/sudoers.d entry. While that could work it requires additional setup/overhead for installing the ssm-agent which is otherwise pretty simple.

Please consider either setting up the ssm-user as a "system" user or else provide another way to pre-specify the UID / GID for that account.

Contributor guide

Open the contributing guide

Research direction

Start by locating the Linux path that creates ssm-user and compare its UID/GID handling with SYS_UID_MIN-SYS_UID_MAX in /etc/login.defs. Decide whether system-user creation or configurable UID/GID is in scope, then verify that first login avoids NFS UID conflicts without requiring a pre-created account or /etc/sudoers.d setup.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
operating-systems
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.