20. I want to keep the drivers and upsd in their own security domains. How can this be accomplished?

Using a few role accounts and a common group, you can limit access to resources such as the serial port(s) leading to the UPS hardware.

This is just an example. Change the values to suit your systems.

For my development system this yields the following /dev entries:

0 crw-------   1 nutdev   tty        4,  64 Sep  3 17:11 /dev/ttyS0
0 crw-------   1 nutdev   tty        4,  65 Sep  3 17:11 /dev/ttyS1

You may have to remove old socket or state files first if you are changing to this security scheme from an older version. The drivers will create new files with the right owners and modes.

Note that /var/state/ups is group writable since upsd will place the upsd.pid file here.

You may have to change the groups of upsd.conf and upsd.users to make them readable. These files should not be owned by nutsrv, since someone could compromise the daemon and change the config files. Instead, put nutsrv in a group ("nut" in this example), then make the files owned by root.nut, with mode 0640.

Once the config files are ready, start upsd:

# upsd -u nutsrv

Check your syslog to be sure everything’s happy, then be sure to update your startup scripts so it uses this procedure on your next boot.

If you like this, you’ll probably also find the chroot process to be useful and interesting. See security.txt for more details.