Linux: Impersonating Users

NOTE: This page was created to generalize the technique of impersonating a system account that has no defined shell, and no known password. Specifically, it was documented as a means to add functionality to a Jenkins build server (where the jenkins account has a disabled shell).

Solution

If you come across a software package on a Linux host that runs with a system account (one without a known password or defined shell), here are ways to do things as a system account user.

The above check in /etc/passwd will indicate what shell is defined for the Jenkins user.

Normally, it will be set to: /bin/false.
This means that the user's shell is disabled.

Obviously the above screenshot indicates the jenkins shell is: /bin/bash.
But, this was set as a permanent fix, that could have been a drastic solution, and not totally necessary, since we've learned since then.

Here are a couple of things we can do, when we must install things for the jenkins user (that will execute them).

1. Temporarily switch to Another User (if it has no defined shell).

If the login shell is /bin/false or /user/sbin/nologin, you won't be able to use su jenkins directly.
Instead, you can run either of these:

sudo -u jenkins -s --shell /bin/bash

Or:

sudo -u jenkins bash

This gives you a shell as jenkins.

2. Permanent Change (If You Want to Allow Logins)

If you want to enable login for the jenkins user, you can change its shell to /bin/bash:

sudo usermod -s /bin/bash jenkins

Now, you can switch users normally with:
sudo su jenkins

Or (if running as root):
su - jenkins

3. Running a Specific Command as the Jenkins User

If you only need to run a single command as jenkins, you can use:

sudo su jenkins <command>

For example:

sudo -u jenkins whoami

Or:

sudo -u jenkins ssh-keygen -t rsa -b 4096 -f /var/lib/jenkins/.ssh/id_rsa

Examples

Here are examples of how to use the above technique to impersonate a user.

Installing SSH Keys

sudo -u jenkins mkdir -p /var/lib/jenkins/.ssh
sudo -u jenkins chmod 700 /var/lib/jenkins/.ssh
sudo -u jenkins ssh-keygen -t rsa -b 4096 -f /var/lib/jenkins/.ssh/id_rsa

Configuring Git for a Jenkins User

sudo -u jenkins git config --global user.name "Jenkins CI"
sudo -u jenkins git config --global user.email "jenkins@example.com"

Getting Environment Variables for a User

sudo -u jenkins env