Using a few role accounts and a common group, you can limit access to resources such as the serial port(s) leading to the UPS hardware.
This is just an example. Change the values to suit your systems.
For my development system this yields the following /dev entries:
0 crw------- 1 nutdev tty 4, 64 Sep 3 17:11 /dev/ttyS0 0 crw------- 1 nutdev tty 4, 65 Sep 3 17:11 /dev/ttyS1
Switch to root, then start the drivers:
# upsdrvctl -u nutdev start
The listing for /var/state/ups then looks like this:
4 drwxrwx--- 2 nutdev nut 4096 Aug 20 18:37 . 4 drwxr-xr-x 4 root root 4096 May 14 21:20 .. 4 srw-rw---- 1 nutdev nut 0 Sep 3 17:10 apcsmart-ups1 4 srw-rw---- 1 nutdev nut 0 Sep 3 17:10 blazer_ser-ups2
You may have to remove old socket or state files first if you are changing to this security scheme from an older version. The drivers will create new files with the right owners and modes.
Note that /var/state/ups
is group writable since upsd
will
place the upsd.pid
file here by default.
You may have to change the groups of upsd.conf
and upsd.users
to
make them readable to the NUT upsd
program. These files should not
be owned nor writable by nutsrv
, since someone could compromise the
daemon and change the config files. Instead, put nutsrv
in a group
(nut
in this example), then make the files owned by root.nut
, with
POSIX bits mode 0640
.
Once the config files are ready, start upsd:
:; upsd -u nutsrv
Check your syslog to be sure everything’s happy, then be sure to update your startup scripts so it uses this procedure on your next boot.
If you like this, you’ll probably also find the chroot(2) process to be useful and interesting. See security.txt for more details.