SAS EXTERNAL ACCOUNTS

[Achraf_Ougdal]

Hello,

I'm sorry if my question is a bit trivial :
Can the SAS installer account and the sas spawned account be the same ? Or I should use different users for each account ?

I already found that the spawned & the first user account should be different but what about the installer & the spawned.

Thank you.

[gwootton · Accepted solution]

These should be different, user processes run as the spawned account.

[PaulHomes]

As @gwootton says they should be different accounts. To add some security context, the SAS installer account (e.g. sas) is the owner of the installed software and deployments and can therefore make changes to them. The SAS Spawned Servers account (e.g. sassrv) is the process owner for spawned processes for shared services like the SAS Stored Process Server and SAS Pooled Workspace Server. If one were to use the same account for sas and sassrv then you have the possibility that an unprivileged user could author a stored process which when executed could make changes to the installed SAS software, configuration files and running SAS server processes. For example, among many other things, they could write a stored process to make themselves a unrestricted user by writing to the adminUsers.txt file (owned by the SAS Installer) and restarting the SAS Metadata Server.

[Achraf_Ougdal]

So if I'm getting it right, they should be different accounts for security purposes. But during the installation process it won't have an impact on (installation error for example).

[PaulHomes]

I can't say I have ever tried the install with them as the same external account, so cannot say whether it would cause any installation errors. I would recommend against it regardless, as the work to undo it after installation would be more effort than creating an extra account in the first place.

[Achraf_Ougdal]

I understand, thank you so much for your help. I really appreciate it 🙏🙏

[AhmedAl_Attar]

Hi @Achraf_Ougdal 

Not sure if you have seen/read this before SAS® 9.4 Intelligence Platform: Installation and Configuration Guide, Second Edition 

If you had not read it already, I would highly recommend making the time to do that.

Hope this helps 

[Kurt_Bremser]

During the installation phase, you only need the installer account. But as soon as you start the configuration phase, the external accounts must be there, and you clearly need them to be separate, for (IMO very obvious) security reasons.

Out of experience, I have done my SAS setups in two separate, discrete stages: install and configuration. That way a problem during configuration (where problems are much more likely) does not cause a complete rollback of the installation.