---
title: "HOST-SYSD-001 Custom Services Run as Root"
canonical: https://openvapt.com/checks/HOST-SYSD-001.html
html: https://openvapt.com/checks/HOST-SYSD-001.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-SYSD-001 Custom Services Run as Root

Checks whether long-running services written by the administrator run as root instead of a dedicated user.

- Domain: Server
- Severity: Medium
- Control category: Identity and Authentication
- Fix effort: medium
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L`
- CIS Controls v8: 5.2
- NIST CSF 2.0: PR.AA-01
- CWE: CWE-250
- NIST SP 800-53 Rev. 5: AC-6, CM-7
- Benchmark topic: Run services with least privilege (topic only, no benchmark text)

## Why It Matters

Application services (Node.js, Python, Java, custom daemons) are the code most exposed to attackers. If one runs as root, any bug in it gives the attacker full control of the machine instead of one unprivileged account.

## How It Detects

Reads every service unit in /etc/systemd/system (symlinks skipped) together with its drop-in files, keeps units that start a long-running process (Type is not oneshot), and flags those with no User= (or User=root) and no DynamicUser=yes.

## How to Fix

Create a dedicated account (useradd --system --no-create-home --shell /usr/sbin/nologin <app>), give it ownership of only the folders the app writes to, then add User=<app> and Group=<app> to the [Service] section (or DynamicUser=yes). Run systemctl daemon-reload and restart the service. Ports below 1024 can be allowed with AmbientCapabilities=CAP_NET_BIND_SERVICE instead of root.

## How to Verify

```
systemctl show -p User,DynamicUser <unit>  and  ps -o user= -p $(systemctl show -p MainPID --value <unit>)
```

## Learn the Theory

- [P11 Service Hardening With systemd](https://openvapt.com/academy/p11.md)

## References

- [systemd.exec(5), execution environment configuration](https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html)
- [NIST SP 800-123, Guide to General Server Security (least privilege for services)](https://csrc.nist.gov/pubs/sp/800/123/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/systemd.go

Run it: `openvapt scan --only HOST-SYSD-001`. Read it offline: `openvapt explain HOST-SYSD-001`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-SYSD-001.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.