On Fri, Nov 06, 2026 at 05:52:15PM +0100, Paolo Aglialoro wrote:
> Thanks Antoine.
>
> Actually I am reworking an old dynamic motd login script of mine that, at
> login, shows me basic
> data of that machine (e.g. uptime, ram, disk, etc) including RUNNING daemons.
>
> This is a sample (decolored) output:
>
> Welcome back: tony!
>
> Active Login: x.x.x.x Fri Nov 06 17:00:47 still logged in
> Uptime: 0d 13h 05m
> CPU Load: 0.00 last minute, 0.00 last 5min, 0.00 last 15min
> Memory Load: 91M used, 1025M cache, 5147M free (total 7908M, swap
> 0M/447M)
> Network: IP(s): 10.1.0.197 10.2.0.197 GW: 10.1.0.1
> sd0a disk: 13.8G (50%) used, 13.8G free
> RUNNING SERVICES: cron dhcpleased ftpd isc_named messagebus mountd nfsd
> nginx portmap
> postfix resolvd sensorsd slaacd sndiod sshd syslogd tftpd
> __________________________________________________
> / ------------------Online Users------------------ \
> \ tony ttyp0 Nov 6 17:00 (x.x.x.x) /
> --------------------------------------------------
> \ ,__,
> \ (oo)____
> (__) )\
> ||--|| *
>
> For an internet-exposed VM by ssh, I am not giving the basic user any doas
> right (one can only
> su to root), but at the same time I'd like to see what's running in that
> particular moment
> (which of course might be disaligned with what is enabled).
>
> Point is that "rcctl check <service>" needs no root rights, but I'd have to
> run it n-times for
> all the services in /etc/rc.d/ which is damn slow. What I cannot understand
> is why any user can
> see if one service is running but is prevented to see the list of all
> services running in that
> moment. It would be like either for security a normal user cannot query any
> service or can
> query all of them.
>
> So core question is: would this "rcctl ls started" be some security hole if
> enabled for normal
> users (but, still they can do rcctl check!) or can the policy change and be
> uniformed to the
Read what I wrote. Some scripts needs root to check.
$ /etc/rc.d/smbd check
/etc/rc.d/smbd: need root privileges
--
Antoine
