Learning MCollective

Chapter 23. Running MCollective Without Root

It is possible and even recommended to run the MCollective server as a normal user account. The init script installed with the package can’t handle this scenario, and some agents won’t be able to complete some actions without root privileges. However, if you have a custom agent that manages an application running under a different user ID, this is the best way to ensure all actions are taken as the appropriate user.

Creating a user-specific MCollective server is as easy as this:

$ cp /etc/mcollective/server.cfg ~/.mcollective.d/server.cfg
$ echo "identify = special-application" >> ~/.mcollective.d/server.cfg
$ sed -i -e "s/var\/log/homedir\/.mcollective.d/" ~/.mcollective.d/server.cfg
$ /usr/sbin/mcollectived --pid=~/.mcollective.d/pid \
  --config=~/.mcollective.d/server.cfg

This mcollectived server will run without difficulties on the same node as the central server running as root. You can safely run dozens or even hundreds of non-root mcollectived servers on the same node.

Obviously this example does not handle every possible scenario:

• You’ll need to create a startup script for this user-specific invocation.

• You may need to edit the configuration file to point at user-specific SSL keys used for authentication (depending on which security provider you are configured to use).

I believe this is the easiest way to limit user control to actions appropriate for an account and to ensure that all actions are running under the appropriate ...