View source for Running the Platform as a Non-Root User

===Running the Platform as a Non-Root User===
As a good security practice, it is recommended that the platform and the various software components that it required by the platform are run as a users other than <tt>root</tt>. This section explains what you need to do.

====memcached====

memcached accepts the command line argument <tt>–u {username}</tt>. With that argument, memcached assumes the identity of the specified user when running, after being launched by the <tt>root</tt> user. It is recommended that this username is set to <tt>nobody</tt> in the memcached startup command. For example:
:<syntaxhighlight lang="java" enclose="div">
/usr/local/bin/memcached -m 250 -p 11211 -d -u nobody
</syntaxhighlight>

Here, memcached is configured to run as a daemon using 250MB of cache, listening on port 11211, and running as the user <tt>nobody</tt>.

====MySQL====
A typical mysql installation has the mysql server running as the user <tt>mysql</tt>. You can verify that setting using the <tt>ps</tt> command:
:<syntaxhighlight lang="java" enclose="div">
ps auxwww | grep mysql
</syntaxhighlight>

====Apache httpd server====

Set the User and Group directives in <tt>httpd.conf</tt> to values other than <tt>root</tt>.

For example:
# Create a group called <tt>apache</tt> and add the user <tt>apache</tt> to that group.
# Set the values for User and Group in <tt>httpd.conf</tt> to <tt>apache</tt>

===={{BrandLabel}}====

The {{BrandLabel}} platform is based on Apache Tomcat. It can be run as a standalone AppServer or deployed behind the Apache <tt>httpd</tt> server. When run as a standalone server, the platform listens to ports 80 and 443 for <tt>http</tt> requests. To be run as a non-root user, the platform must be deployed behind Apache, and must be listening on ports > 1023 (since only the root user can bind to low-numbered ports).
:''Learn more:'' [[Installing and Configuring Apache for Use with the Platform]]

After configuring the platform and Apache to work together:
:1. Create the group <tt>tomcat</tt> and add the user <tt>tomcat</tt> to it:
::<syntaxhighlight lang="java" enclose="div">
/usr/sbin/groupadd tomcat
/usr/sbin/useradd -g tomcat -d /home/tomcat tomcat
</syntaxhighlight>

:2. Change the password for the user <tt>tomcat</tt>:
::<syntaxhighlight lang="java" enclose="div">
passwd tomcat
</syntaxhighlight>

:3. Change the ownership in the folder where the platform is installed to the user <tt>tomcat</tt>.
: &nbsp; &nbsp; For example, if the platform is installed in the folder <tt>/usr/local/longjump_app_server</tt>:
::<syntaxhighlight lang="java" enclose="div">
chown -R tomcat:tomcat /usr/local/longjump_app_server
</syntaxhighlight>

:4. Restrict permission on the configuration folder to the user <tt>tomcat</tt>:
::<syntaxhighlight lang="java" enclose="div">
chmod -R 700 /usr/local/longjump_app_server/tomcat/conf
</syntaxhighlight>

:5. If upgrading an installation in which the Documents Directory folder configured in the Service Provider Settings is 
: &nbsp; &nbsp; located in a folder other than the installation directory (the default location), then change the ownership of that
: &nbsp; &nbsp; folder to the user <tt>tomcat</tt>. For example, if the location is <tt>/var/platform_documents</tt>:
::<syntaxhighlight lang="java" enclose="div">
chown -R tomcat:tomcat /var/platform_documents
</syntaxhighlight>

:6. Ensure that the user <tt>tomcat</tt> has sufficient permissions on the Temp Directory
<blockquote><ol type="a">
<li>If the Temp directory configured in the Service Provider Settings is <tt>/tmp</tt> (the default), ensure that everyone has read and write permissions on that folder:
:<syntaxhighlight lang="java" enclose="div">
chmod –R 777  /tmp
</syntaxhighlight></li>
<li> If upgrading an installation in which the Temp Directory configured in the Service Provider Settings is not <tt>/tmp</tt>, and is used exclusively by the platform, change the ownership of the folder to the user <tt>tomcat</tt>. For example, if the location is <tt>/var/platform_tmp</tt>:
:<syntaxhighlight lang="java" enclose="div">
chown -R tomcat:tomcat /var/platform_temp
</syntaxhighlight>
</li></ol>
</blockquote>
:7. When installing {{BrandLabel}}, login as the user <tt>tomcat</tt> instead of user <tt>root</tt>. 
: &nbsp; &nbsp; That way, the ownership and permissions for the installation folders are set up properly.

:8. The platform is started using the command <tt>{appserver_files}/scripts/longjump start</tt>. 
: &nbsp; &nbsp; To allow that script to be run by the root user, modify the script <tt>{appserver_files}/scripts/longjump</tt>
: &nbsp; &nbsp;  to become user <tt>tomcat</tt> before starting the platform.
: &nbsp; &nbsp; To do that, change this line:
::<syntaxhighlight lang="java" enclose="div">
$CATALINA_HOME/bin/startup.sh
</syntaxhighlight>
: &nbsp; &nbsp; to
::<syntaxhighlight lang="java" enclose="div">
su - tomcat -c $CATALINA_HOME/bin/startup.sh
</syntaxhighlight>