ActiveDebianSync Security guide

• Back to ActiveDebianSync main section

This document explains how to securely configure ActiveDebianSync by running it under a dedicated Unix user.
By default, ActiveDebianSync can run as root, but doing so introduces unnecessary security risks.
It is strongly recommended to configure the daemon to run under a dedicated, restricted system user with minimal privileges.

Recommended Configuration

Create a dedicated system user

# Create the user (no shell, no accessible home directory)
sudo useradd -r -s /bin/false -d /var/lib/ActiveDebianSync -c "ActiveDebianSync Daemon" debian-sync
# Create required directories
sudo mkdir -p /var/lib/ActiveDebianSync/mirror
sudo mkdir -p /var/log/ActiveDebianSync
sudo mkdir -p /etc/ActiveDebianSync
# Set permissions
sudo chown -R debian-sync:debian-sync /var/lib/ActiveDebianSync
sudo chown -R debian-sync:debian-sync /var/log/ActiveDebianSync

Update the configuration file

Edit /etc/ActiveDebianSync/config.json and add:

{
  "run_as_user": "debian-sync",
  "run_as_group": "debian-sync",
  ...
}  

Required Permissions

The dedicated user must have:

• Read access
  /etc/ActiveDebianSync/config.json
/etc/ActiveDebianSync/server.crt (if HTTPS)
  /etc/ActiveDebianSync/server.key (if HTTPS)
   

• Write access
  /var/lib/ActiveDebianSync/mirror/
/var/log/ActiveDebianSync/sync.log
/var/log/ActiveDebianSync/access.log
/var/run/activedebiansync.pid (or alternative PID path)
   

• Network
  Ability to listen on configured HTTP/HTTPS ports
  Ports below 1024 require CAP_NET_BIND_SERVICE
   

• Handling privileged ports
  If you need to bind to ports < 1024 (80, 443), after the privilege drop:
  Option 1: Use ports > 1024 (recommended)
  {  "http_port": 8080,  "https_port": 8443 }

  Option 2: Grant CAP_NET_BIND_SERVICE
  Allow binding to ports < 1024:
  sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/activedebiansync
   (This capability must be re-applied after every binary upgrade.)

Systemd Service

The systemd service must start as root so the daemon can drop privileges internally:

[Service]
  Type=simple
  User=root
  ExecStart=/usr/local/bin/activedebiansync -config /etc/ActiveDebianSync/config.json

Do NOT set User= to debian-sync here because ActiveDebianSync handles its own user switching.