Service Manager Access

• each service has a unique pseudo-user with home directory /services/svcname

• service managers log in as themselves and su to the service pseudo-user (special PAM module)

• service software runs as pseudo-user whenever possible (web-based services use suEXEC)

• when service software must run as root, tools like sudo provide necessary access