---
schema_version: "1"
id: 8db8f843207b36b7e4d0864a8a28335631f5600be4318eae8406c6f8384b7c87
title: System User, sudo Privileges and systemd
collection: tableau
version: current
locale: en-gb
portal_url: https://docs.salesforce.com/tableau/current/en-gb/server-linux/security_privilege_linux.md
canonical_url: https://help.tableau.com/current/server-linux/en-gb/security_privilege_linux.htm
source_site: help.tableau.com
content_type: documentation
content_hash: 69ae7fdb2da2ce03e24a0d4e8df89f4450119a92755f0fa4a9718d8a0f872536
description: Understand system user, sudo privileges, and systemd for Tableau Server on Linux.
---
[Skip to main content](#main-content)

# System User, sudo Privileges and systemd

This topic describes system user, systemd user service and sudo privilege in the context of Tableau Server.

## Privilege separation

Following standard security best practices, Tableau Server for Linux runs processes with the least privilege possible. During installation, the unprivileged user, _tableau_, is created in a server authorised group (_tableau_).

An example user entry in the /etc/passwd file is as follows:

- `tableau:x:993:991:Tableau Server:/var/opt/tableau/tableau_server:/bin/bash`

All processes run as the unprivileged _tableau_ user. This means that if one of the Tableau Server processes (such as a process displaying vizzes to users) were compromised in some fashion, it would only be able to impact Tableau Server, not the rest of the Linux system. For this reason, you should not add the `tableau` unprivileged user to the `tsmadmin` group. The `tsmadmin` group should only contain accounts that require authorisation to access OS-related Tableau configurations.

The `tableau` user and `tsmadmin` group are created by the Tableau Server initialisation process. You can specify a different unprivileged user or TSM authorisation group during installation. For more information about system users and groups, in the context of installation and LDAP configuration, see [Identity Store](https://help.tableau.com/current/server-linux/en-gb/plan_identity_store.htm).

## _sudo_ privileges

The first version (10.5) of Tableau Server on Linux relied on sudo privileges by updating the sudoers file. Updating the sudoers file conflicts with some system management configuration best practices and security policies. Therefore, the 2018.1 version (and later) of Tableau Server no longer creates or uses a privileged user (`tsmagent`). Nor does the current version of Tableau Server update or include a Tableau-specific sudoers file.

All privileged operations now occur during package and software installation.

## systemd user service

In the 10.5 version of Tableau Server on Linux, sudo privileges were required to modify or restart the TSM services, which required systemctl commands. All TSM services were run from the normal system-wide systemd process (`process ID 1`, which runs all processes on the operating system). In this scheme, systemd process runs as root. Therefore, the 10.5 version of Tableau Server required sudo privileges.

With the current 2018.1 (and later) releases, we have removed the need for sudo privileges by making use of the systemd capability to run as a user service. The systemd user service runs as a normal user, so it does not need any special privileges once it has been enabled.

In normal use cases, you will not need to issue commands to systemd because TSM takes care of that. However, for troubleshooting scenarios, you may need to interact with the TSM services. As with the previous versions, you will issue the same systemctl commands for these scenarios. However, commands should be run as the `tableau` user, and not as root. If you specified a different unprivileged system user during Tableau Server setup, then run the commands as that user.

### Running systemctl commands

Use the following syntax example to issue request to systemd with the systemctl commands.

Start a session as the unprivileged user. The `-l` flag is critical to set environment variables properly.

`sudo su -l tableau`

Then issue commands. For example:

`systemctl --user status tabadmincontroller_0`

`systemctl --user restart tabadmincontroller_0`