When working with systemd services as a non-root user, you might encounter a perplexing situation where the system asks for authentication credentials of a different user than the one currently logged in. This behavior typically manifests like:

[bob@server ~]$ systemctl stop custom-service.service
==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ===
Authentication is required to manage system services or units.
Authenticating as: alice
Password:

This behavior stems from how systemd integrates with Polkit (formerly PolicyKit), the authorization framework in Linux. The system doesn't randomly select a user - there's always a logical reason behind the authentication prompt.

Key components involved:

• Polkit rules in /etc/polkit-1/rules.d/
• Systemd policy files in /usr/share/polkit-1/actions/
• User session information maintained by the system

Here are the most frequent reasons for this behavior:

1. Misconfigured Polkit rules
2. Incorrect systemd service file permissions
3. User session tracking issues
4. Multiple active user sessions
5. Cached credentials with unexpected ownership

First, check the active Polkit rules that might be affecting this behavior:

pkaction --verbose | grep -i systemd

To see detailed information about the authentication request:

journalctl -f

Then attempt the systemctl operation in another terminal to observe the logs.

The most reliable fix is to create a custom Polkit rule. Create a new file:

sudo nano /etc/polkit-1/rules.d/50-allow-service-management.rules

Add the following content:

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" && 
        subject.isInGroup("service-group")) {
        return polkit.Result.YES;
    }
});

Ensure the service file has proper permissions:

sudo chown root:service-group /etc/systemd/system/custom-service.service
sudo chmod 664 /etc/systemd/system/custom-service.service

Sometimes the issue stems from stale session information:

loginctl list-sessions
loginctl terminate-session [SESSION_ID]

For deeper investigation, use the D-Bus inspector:

busctl tree org.freedesktop.systemd1
busctl introspect org.freedesktop.systemd1 /org/freedesktop/systemd1

• Always specify User= in service files
• Create dedicated system groups for service management
• Regularly audit Polkit rules
• Document all service management policies

Remember to reload systemd and Polkit after making changes:

sudo systemctl daemon-reload
sudo systemctl restart polkit

---

When working with systemd services as a non-root user, you might encounter a puzzling situation where the system prompts for authentication as a different regular user instead of the currently logged-in user or root. Here's a typical scenario:

[bob@server ~]$ systemctl stop custom-service.service
==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ===
Authentication is required to manage system services or units.
Authenticating as: alice
Password:

This behavior stems from how PolicyKit (polkit) is configured on your system. The authentication rules in /etc/polkit-1/rules.d/ or /usr/share/polkit-1/rules.d/ determine which user credentials are requested when performing privileged operations.

Common causes include:

• Misconfigured polkit rules files
• Inherited rules from packages or distributions
• Local admin modifications that accidentally changed default behavior

First, examine existing rules that might affect service management:

# Check for custom rules
ls -l /etc/polkit-1/rules.d/

# View contents of a specific rule file
cat /etc/polkit-1/rules.d/50-default.rules

To fix this, create or modify a polkit rules file (e.g., 50-service-auth.rules) with proper authorization:

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units") {
        return polkit.Result.YES;
    }
});

For more granular control (allowing specific users or groups):

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.systemd1.manage-units" &&
        subject.isInGroup("admins")) {
        return polkit.Result.YES;
    }
});

If you prefer sudo-based authentication instead of PolicyKit:

# Create sudoers entry
echo "%admin ALL=(root) NOPASSWD: /bin/systemctl * custom-service.service" | sudo tee /etc/sudoers.d/custom-service

After making changes, test the behavior:

systemctl --no-pager status custom-service.service
systemctl stop custom-service.service

Check journal logs for authentication attempts:

journalctl -xe -u polkit

If issues persist:

1. Verify file permissions: ls -l /etc/polkit-1/rules.d/
2. Check for syntax errors: pkcheck --action-id org.freedesktop.systemd1.manage-units --process $$ --allow-user-interaction
3. Test with different users to isolate the problem