How to run OWASP ZAP as a systemd service

OWASP ZAP can be run as a daemon process (i.e. headless) by specifying the -daemon flag when OWASP ZAP is started up. For example:

$ zap.sh -daemon

However we can go a bit further and add it as a systemd service. I have only tested this on Kali Linux 2020.4 thus far.

This post won’t cover how to install ZAP and it is assumed that it is already installed on your Linux OS.

For this we need to do the following:

1. Create an user for ZAP as we don’t want to run it as root
2. Create the zaproxy.service file for systemd
3. Add or update script for starting up ZAP in daemon mode (i.e. headless mode)

1. Creating an user

This should be simple enough. You can use any user, but I prefer to user the zaproxy user specified as follow:

$ sudo useradd -m -d /home/zaproxy -s /bin/false zaproxy

This will create a user with a new home directory at /home/zaproxy and has no login shell assigned to it, which is typical for a user that only runs an application in the background.

2. Create the zaproxy.service file for systemd

Those that are familiar with systemd can use their own preference, but for me the following works good.

[Unit]
Description=OWASP ZAP
After=multi-user.target
Conflicts=getty@tty1.service

[Service]
Type=simple
User=zaproxy
WorkingDirectory=/home/zaproxy/
ExecStart=/usr/bin/zaproxy
StandardInput=tty-force

[Install]
WantedBy=multi-user.target

The above file you can save as zaproxy.service and then copy over to /etc/systemd/system/. For Kali (Debian-based) this is the systemd directory where it will pick up the config. For other distro’s this may differ.

In the above file there are some assumptions being made, such as that there is a shell script already created at /usr/bin/zaproxy. This is also the file you are going to edit in the next step. Before we edit that file it is necessary to run the following command to load the zaproxy.service script

$ sudo systemctl daemon-reload

If successful it will print out nothing in the the terminal.

3. Add or update script for starting up ZAP in daemon mode or headless mode

Now we are going to add or edit the script at /usr/bin/zaproxy as follows:

#!/bin/sh

cd /usr/share/zaproxy/
exec ./zap.sh -daemon

In this script the terminal is changing the directory to the installation directory of ZAP, in this case /usr/share/zaproxy/ and then execute the zap.sh file. The only requirement for the systemd service to run is to append the -daemon switch to the zap.sh. Otherwise ZAP would fail to startup. There is a bunch of switches to use which can be found here

Now with all this being put in place you should do the following to get ZAP running:

$ sudo systemctl start zaproxy

Check the status if it has started up successfully (it should look similar):

$ sudo systemctl status zaproxy
zaproxy.service - OWASP ZAP
     Loaded: loaded (/etc/systemd/system/zaproxy.service; enabled; vendor preset: disabled)
     Active: active (running) since Sun 2021-04-04 14:09:21 SAST; 35s ago
   Main PID: 20087 (java)
      Tasks: 22 (limit: 2300)
     Memory: 213.3M
     CGroup: /system.slice/zaproxy.service
             └─20087 java -Xmx497m -jar /usr/share/zaproxy/zap-2.10.0.jar -daemon

Apr 04 14:09:21 kali systemd[1]: Started OWASP ZAP.

Now you can still access OWASP ZAP via its built-in API while it is managed as a systemd process.

At this time you can use https://github.com/Grunny/zap-cli as a CLI tool to interact with ZAP’s API

Enjoy!