Václav Ovsík:
> How I should get rid of this session management the right way?

I have seen this systemd problem myself.

What is happening is that every time something SSHes in as user postgres,
systemd-logind is starting up a per-user instance of systemd along with with a
whole bunch of per-user socket units (and whatever else you have configured all
per-user service managers to start up); and whenever the SSH session finishes,
systemd-logind is dutifully shutting down that per-user instance.

There's no way to actually turn the per-user instance off, for accounts that
should *never* have per-user service managers.  The best that you can do is
pretty much the opposite and turn it *always on*.  You do this by telling
systemd-logind that the postgres user is a "lingering" user.  There is a
loginctl command for doing so.  Then it will start up the per-user instance of
systemd and leave it running.

(You could also remove the user@.service template outright, which removes
per-user service management for *all* user accounts, including those for real
human beings.  However, this still results in log noise, as the failed attempts
by systemd-logind to start up user@NNNN services on every SSH login will all be
logged.  In the "lingering" case, there is less log noise.)

Of course, the postgres account is most definitely an account which should never
have a per-user service manager.  So, too, are dedicated accounts for things
like (say) Nagios monitoring.

But there's no mechanism for specifying such accounts, or (conversely, and more
usefully given the general ratio of general-purpose use to role accounts) for
specifying the accounts that should have a per-user service manager and saying
that all other accounts should not.  So the best that you can do is be very
aware that everything installed and enabled in /usr/lib/systemd/user is going to
have an instance running with the user access of your postgres account, and be
very careful about what you put in there.  (The gpg-agent package has already
dumped some GPG stuff there and enabled it, notice.)

Reply via email to