# Chef services user

**URL:** <https://discourse.chef.io/t/chef-services-user/1803>\
**Category:** Chef Infra (archive)\
**Created:** [April 7, 2011, 8:24pm UTC](https://discourse.chef.io/t/chef-services-user/1803 "2011-04-07T20:24:13Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mark\_Rechler](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@Mark\_Rechler](https://discourse.chef.io/u/Mark_Rechler)\
**Post date:** [April 7, 2011, 8:24pm UTC](https://discourse.chef.io/t/chef-services-user/1803/1 "2011-04-07T20:24:13Z")

</div>

I have just freshly installed chef on centos 5.4 via gems. After running the  
server bootstrap I found the webui to be unresponsive(ie. can’t login) when  
running as the chef user. When running the webui as root however, everything  
works normally. Is there a way to actually have the webui run as chef? Also if  
not, do all chef related services need to run as root?

Thanks,  
Mark

---

<div class="post-metadata">

**Author:** ![kallistec](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kallistec/32/23_2.png) [@kallistec](https://discourse.chef.io/u/kallistec)\
**Post date:** [April 7, 2011, 9:03pm UTC](https://discourse.chef.io/t/chef-services-user/1803/2 "2011-04-07T21:03:20Z")

</div>

On Thursday, April 7, 2011 at 1:24 PM, [mrechler@brightcove.com](mailto:mrechler@brightcove.com) wrote:  
I have just freshly installed chef on centos 5.4 via gems. After running the

> server bootstrap I found the webui to be unresponsive(ie. can't login) when  
> running as the chef user. When running the webui as root however, everything  
> works normally. Is there a way to actually have the webui run as chef? Also if  
> not, do all chef related services need to run as root?
> 
> Thanks,  
> Mark  
> The webui is stateless and doesn't need to do anything with the underlying system. Perhaps you could include the error message from the webui's logs?

I imagine the webui server is unable to read the /etc/chef/webui.pem key when you're running as non-root, so chmod/chowning that file should resolve the issue.

HTH,

--  
Dan DeLeo

---

<div class="post-metadata">

**Author:** ![Mark\_Rechler](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@Mark\_Rechler](https://discourse.chef.io/u/Mark_Rechler)\
**Post date:** [April 7, 2011, 9:14pm UTC](https://discourse.chef.io/t/chef-services-user/1803/3 "2011-04-07T21:14:43Z")

</div>

Hi Dan,

Appreciate the help. I have tried changing the permissions and even  
ownership (chef:root) for the pem files (webui and validation) to be very  
liberal (a+rw) which did not help. The following is the only thing that  
really appears in the logs (no errors):

merb : chef-server-webui : worker (port 4040) ~

## merb : chef-server-webui : worker (port 4040) ~ Started request handling: Thu Apr 07 14:07:53 -0700 2011 merb : chef-server-webui : worker (port 4040) ~ Params: {"name"=\>"admin", "action"=\>"login\_exec", "controller"=\>"users", "password"=\>"[FILTERED]", "form\_submit"=\>"login"} merb : chef-server-webui : worker (port 4040) ~ {:dispatch\_time=\>0.034691, :action\_time=\>0.033662, :after\_filters\_time=\>2.9e-05, :before\_filters\_time=\>5.8e-05} merb : chef-server-webui : worker (port 4040) ~

merb : chef-server (api) : worker (port 4000) ~

merb : chef-server (api) : worker (port 4000) ~ Started request handling:  
Thu Apr 07 14:07:53 -0700 2011  
merb : chef-server (api) : worker (port 4000) ~ Params: {"format"=\>nil,  
"action"=\>"show", "id"=\>"admin", "controller"=\>"users"}  
merb : chef-server (api) : worker (port 4000) ~ {:action\_time=\>0.013155,  
:after\_filters\_time=\>2.6e-05, :before\_filters\_time=\>0.007762,  
:dispatch\_time=\>0.013818}  
merb : chef-server (api) : worker (port 4000) ~

Thanks again,  
Mark

On Thu, Apr 7, 2011 at 5:03 PM, Daniel DeLeo [dan@kallistec.com](mailto:dan@kallistec.com) wrote:

> On Thursday, April 7, 2011 at 1:24 PM, [mrechler@brightcove.com](mailto:mrechler@brightcove.com) wrote:
> 
> I have just freshly installed chef on centos 5.4 via gems. After running  
> the  
> server bootstrap I found the webui to be unresponsive(ie. can't login) when  
> running as the chef user. When running the webui as root however,  
> everything  
> works normally. Is there a way to actually have the webui run as chef? Also  
> if  
> not, do all chef related services need to run as root?
> 
> Thanks,  
> Mark
> 
> The webui is stateless and doesn't need to do anything with the underlying  
> system. Perhaps you could include the error message from the webui's logs?
> 
> I imagine the webui server is unable to read the /etc/chef/webui.pem key  
> when you're running as non-root, so chmod/chowning that file should resolve  
> the issue.
> 
> HTH,
> 
> --  
> Dan DeLeo

---

<div class="post-metadata">

**Author:** ![kallistec](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kallistec/32/23_2.png) [@kallistec](https://discourse.chef.io/u/kallistec)\
**Post date:** [April 8, 2011, 2:48pm UTC](https://discourse.chef.io/t/chef-services-user/1803/4 "2011-04-08T14:48:29Z")

</div>

On Thursday, April 7, 2011 at 2:14 PM, Mark Rechler wrote:  
Hi Dan,

> Appreciate the help. I have tried changing the permissions and even ownership (chef:root) for the pem files (webui and validation) to be very liberal (a+rw) which did not help. The following is the only thing that really appears in the logs (no errors):
> 
> merb : chef-server-webui : worker (port 4040) ~
> 
> ## merb : chef-server-webui : worker (port 4040) ~ Started request handling: Thu Apr 07 14:07:53 -0700 2011 merb : chef-server-webui : worker (port 4040) ~ Params: {"name"=\>"admin", "action"=\>"login\_exec", "controller"=\>"users", "password"=\>"[FILTERED]", "form\_submit"=\>"login"} merb : chef-server-webui : worker (port 4040) ~ {:dispatch\_time=\>0.034691, :action\_time=\>0.033662, :after\_filters\_time=\>2.9e-05, :before\_filters\_time=\>5.8e-05} merb : chef-server-webui : worker (port 4040) ~
> 
> merb : chef-server (api) : worker (port 4000) ~
> 
> merb : chef-server (api) : worker (port 4000) ~ Started request handling: Thu Apr 07 14:07:53 -0700 2011  
> merb : chef-server (api) : worker (port 4000) ~ Params: {"format"=\>nil, "action"=\>"show", "id"=\>"admin", "controller"=\>"users"}  
> merb : chef-server (api) : worker (port 4000) ~ {:action\_time=\>0.013155, :after\_filters\_time=\>2.6e-05, :before\_filters\_time=\>0.007762, :dispatch\_time=\>0.013818}  
> merb : chef-server (api) : worker (port 4000) ~
> 
> Thanks again,  
> Mark

Try running both servers with debug logging to see if you get more info out of them. Perhaps your configuration file can only be read by root?

--  
Dan DeLeo

---

<div class="post-metadata">

**Author:** ![Mark\_Rechler](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@Mark\_Rechler](https://discourse.chef.io/u/Mark_Rechler)\
**Post date:** [April 8, 2011, 2:59pm UTC](https://discourse.chef.io/t/chef-services-user/1803/5 "2011-04-08T14:59:39Z")

</div>

You read my mind, after running the server and webui in dev mode as the chef  
user, I found:  
FATAL: Failed to access  
/usr/lib/ruby/gems/1.8/gems/chef-server-api-0.9.14/log/merb.4000.pid,  
permission denied.

Changing the ownership of all the chef related gem dirs fixed everything.

Thanks,  
Mark

On Fri, Apr 8, 2011 at 10:48 AM, Daniel DeLeo [dan@kallistec.com](mailto:dan@kallistec.com) wrote:

> On Thursday, April 7, 2011 at 2:14 PM, Mark Rechler wrote:
> 
> Hi Dan,
> 
> Appreciate the help. I have tried changing the permissions and even  
> ownership (chef:root) for the pem files (webui and validation) to be very  
> liberal (a+rw) which did not help. The following is the only thing that  
> really appears in the logs (no errors):
> 
> merb : chef-server-webui : worker (port 4040) ~
> 
> merb : chef-server-webui : worker (port 4040) ~ Started request handling:  
> Thu Apr 07 14:07:53 -0700 2011  
> merb : chef-server-webui : worker (port 4040) ~ Params: {"name"=\>"admin",  
> "action"=\>"login\_exec", "controller"=\>"users", "password"=\>"[FILTERED]",  
> "form\_submit"=\>"login"}  
> merb : chef-server-webui : worker (port 4040) ~ {:dispatch\_time=\>0.034691,  
> :action\_time=\>0.033662, :after\_filters\_time=\>2.9e-05,  
> :before\_filters\_time=\>5.8e-05}  
> merb : chef-server-webui : worker (port 4040) ~
> 
> * * *
> 
> merb : chef-server (api) : worker (port 4000) ~
> 
> merb : chef-server (api) : worker (port 4000) ~ Started request handling:  
> Thu Apr 07 14:07:53 -0700 2011  
> merb : chef-server (api) : worker (port 4000) ~ Params: {"format"=\>nil,  
> "action"=\>"show", "id"=\>"admin", "controller"=\>"users"}  
> merb : chef-server (api) : worker (port 4000) ~ {:action\_time=\>0.013155,  
> :after\_filters\_time=\>2.6e-05, :before\_filters\_time=\>0.007762,  
> :dispatch\_time=\>0.013818}  
> merb : chef-server (api) : worker (port 4000) ~
> 
> Thanks again,  
> Mark
> 
> Try running both servers with debug logging to see if you get more info out  
> of them. Perhaps your configuration file can only be read by root?
> 
> --  
> Dan DeLeo

---

<div class="post-metadata">

**Author:** ![kallistec](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/kallistec/32/23_2.png) [@kallistec](https://discourse.chef.io/u/kallistec)\
**Post date:** [April 8, 2011, 3:03pm UTC](https://discourse.chef.io/t/chef-services-user/1803/6 "2011-04-08T15:03:37Z")

</div>

On Friday, April 8, 2011 at 7:59 AM, Mark Rechler wrote:  
You read my mind, after running the server and webui in dev mode as the chef user, I found:

> FATAL: Failed to access /usr/lib/ruby/gems/1.8/gems/chef-server-api-0.9.14/log/merb.4000.pid, permission denied.
> 
> Changing the ownership of all the chef related gem dirs fixed everything.
> 
> Thanks,  
> Mark

Wow, we shouldn't be sticking any pidfiles there by default. Can you file a bug for this? [tickets.opscode.com](http://tickets.opscode.com)

Thanks,

--  
Dan DeLeo

On Fri, Apr 8, 2011 at 10:48 AM, Daniel DeLeo [dan@kallistec.com](mailto:dan@kallistec.com) wrote:

> > On Thursday, April 7, 2011 at 2:14 PM, Mark Rechler wrote:
> > 
> > > Hi Dan,
> > > 
> > > Appreciate the help. I have tried changing the permissions and even ownership (chef:root) for the pem files (webui and validation) to be very liberal (a+rw) which did not help. The following is the only thing that really appears in the logs (no errors):
> > > 
> > > merb : chef-server-webui : worker (port 4040) ~
> > > 
> > > ## merb : chef-server-webui : worker (port 4040) ~ Started request handling: Thu Apr 07 14:07:53 -0700 2011 merb : chef-server-webui : worker (port 4040) ~ Params: {"name"=\>"admin", "action"=\>"login\_exec", "controller"=\>"users", "password"=\>"[FILTERED]", "form\_submit"=\>"login"} merb : chef-server-webui : worker (port 4040) ~ {:dispatch\_time=\>0.034691, :action\_time=\>0.033662, :after\_filters\_time=\>2.9e-05, :before\_filters\_time=\>5.8e-05} merb : chef-server-webui : worker (port 4040) ~
> > > 
> > > merb : chef-server (api) : worker (port 4000) ~
> > > 
> > > merb : chef-server (api) : worker (port 4000) ~ Started request handling: Thu Apr 07 14:07:53 -0700 2011  
> > > merb : chef-server (api) : worker (port 4000) ~ Params: {"format"=\>nil, "action"=\>"show", "id"=\>"admin", "controller"=\>"users"}  
> > > merb : chef-server (api) : worker (port 4000) ~ {:action\_time=\>0.013155, :after\_filters\_time=\>2.6e-05, :before\_filters\_time=\>0.007762, :dispatch\_time=\>0.013818}  
> > > merb : chef-server (api) : worker (port 4000) ~
> > > 
> > > Thanks again,  
> > > Mark
> > 
> > Try running both servers with debug logging to see if you get more info out of them. Perhaps your configuration file can only be read by root?
> > 
> > --  
> > Dan DeLeo

---

<div class="post-metadata">

**Author:** ![Mark\_Rechler](https://avatars.discourse-cdn.com/v4/letter/m/e56c9b/32.png) [@Mark\_Rechler](https://discourse.chef.io/u/Mark_Rechler)\
**Post date:** [April 8, 2011, 3:29pm UTC](https://discourse.chef.io/t/chef-services-user/1803/7 "2011-04-08T15:29:45Z")

</div>

Hi Dan,

I have filed CHEF-2199. Appreciate the help.

Thanks,  
Mark

On Fri, Apr 8, 2011 at 11:03 AM, Daniel DeLeo [dan@kallistec.com](mailto:dan@kallistec.com) wrote:

> On Friday, April 8, 2011 at 7:59 AM, Mark Rechler wrote:
> 
> You read my mind, after running the server and webui in dev mode as the  
> chef user, I found:  
> FATAL: Failed to access  
> /usr/lib/ruby/gems/1.8/gems/chef-server-api-0.9.14/log/merb.4000.pid,  
> permission denied.
> 
> Changing the ownership of all the chef related gem dirs fixed everything.
> 
> Thanks,  
> Mark
> 
> Wow, we shouldn't be sticking any pidfiles there by default. Can you file a  
> bug for this? [tickets.opscode.com](http://tickets.opscode.com)
> 
> Thanks,
> 
> --  
> Dan DeLeo
> 
> On Fri, Apr 8, 2011 at 10:48 AM, Daniel DeLeo [dan@kallistec.com](mailto:dan@kallistec.com) wrote:
> 
> On Thursday, April 7, 2011 at 2:14 PM, Mark Rechler wrote:
> 
> Hi Dan,
> 
> Appreciate the help. I have tried changing the permissions and even  
> ownership (chef:root) for the pem files (webui and validation) to be very  
> liberal (a+rw) which did not help. The following is the only thing that  
> really appears in the logs (no errors):
> 
> merb : chef-server-webui : worker (port 4040) ~
> 
> merb : chef-server-webui : worker (port 4040) ~ Started request handling:  
> Thu Apr 07 14:07:53 -0700 2011  
> merb : chef-server-webui : worker (port 4040) ~ Params: {"name"=\>"admin",  
> "action"=\>"login\_exec", "controller"=\>"users", "password"=\>"[FILTERED]",  
> "form\_submit"=\>"login"}  
> merb : chef-server-webui : worker (port 4040) ~ {:dispatch\_time=\>0.034691,  
> :action\_time=\>0.033662, :after\_filters\_time=\>2.9e-05,  
> :before\_filters\_time=\>5.8e-05}  
> merb : chef-server-webui : worker (port 4040) ~
> 
> * * *
> 
> merb : chef-server (api) : worker (port 4000) ~
> 
> merb : chef-server (api) : worker (port 4000) ~ Started request handling:  
> Thu Apr 07 14:07:53 -0700 2011  
> merb : chef-server (api) : worker (port 4000) ~ Params: {"format"=\>nil,  
> "action"=\>"show", "id"=\>"admin", "controller"=\>"users"}  
> merb : chef-server (api) : worker (port 4000) ~ {:action\_time=\>0.013155,  
> :after\_filters\_time=\>2.6e-05, :before\_filters\_time=\>0.007762,  
> :dispatch\_time=\>0.013818}  
> merb : chef-server (api) : worker (port 4000) ~
> 
> Thanks again,  
> Mark
> 
> Try running both servers with debug logging to see if you get more info out  
> of them. Perhaps your configuration file can only be read by root?
> 
> --  
> Dan DeLeo