XRAY: Running Xray as a Custom User

Introduction 
By default, JFrog Xray runs under the built-in xray user, which may not align with organizational security best practices or compliance requirements. Some environments require services to run under custom, tightly controlled service accounts rather than default users. This article explains how to securely run Xray using a custom, non-root user, ensuring proper permissions, configuration updates, and service validation without impacting functionality or service health.

This article will walk you through configuring JFrog Xray to run as a custom user instead of the xray user. It will cover the steps required to create a dedicated service account, update Xray configuration files, adjust file ownership, and verify that all Xray microservices are running successfully under the new user.


Resolution 
Running Xray as a custom user improves system security and aligns with custom practices.
The process involves stopping the Xray service, creating a custom user and group, updating configuration settings, changing directory ownership, and verifying the service status after restart.

Step-by-Step Instructions
Step 1: Stop Services and Create a Custom User
Stop the Xray service and create a dedicated user and group for running Xray.

# Stop Xray service
systemctl stop xray.service

# Create group and user
groupadd xraycust
useradd -g xraycust -m -s /bin/bash xraycust

# Add postgres user to the Xray group
usermod -aG xraycust postgres

Step 2: Modify System Configuration
Update the system.yaml file to define the custom user and group that Xray should run under.

shared:
  database:
    password: password
  rabbitMq:
    password: password
    autoStop: true
    url: "amqp://localhost:5672/"
  jfrogUrl: http//artifactory:url
  security:
    joinKey: joinkey
  node:
    ip: node.ip.address
    user: xraycust
    group: xraycust

Ensure the user and group values match the custom account created in Step 

Step 3: Change Ownership of Xray Directories
Grant the new user ownership of all Xray-related directories to ensure proper access.

chown -R xraycust:xraycust /var/opt/jfrog/xray
chown -R xraycust:xraycust /opt/jfrog/xray/app
chown -R xraycust:xraycust /opt/jfrog/xray/var

Step 4: Restart and Verify the Service
Terminate any remaining processes running under the previous user, then start Xray and verify it is running under the new account.

# Kill any remaining Xray processes
pkill -u xray

# Start Xray
systemctl start xray

# Verify Xray is running as the custom user
ps -ef | grep xraycust

 

Step 5: Validate from the UI

• Log in to the Xray UI
• Navigate to Administration > Monitoring > Service Status
• Confirm that the node and all microservices are reported as Healthy

 

Conclusion 
This article demonstrated how to run JFrog Xray under a custom, non-root user by replacing the default xray user with a dedicated service account. The process included creating a custom user, updating configuration files, adjusting file ownership, and verifying service health after the change.
Running Xray under a custom user enhances system security, supports compliance requirements, and aligns with industry best practices.