View source for Running the Platform as a Non-Root User

<includeonly>===Running the Platform as a Non-Root User===</includeonly>
As a good security practice, it is recommended that the platform and the various software components that it required by the platform are run as a users other than <tt>root</tt>. This section explains about running the platform as a non-root user. For information on creating a non-root MySQL user in Unix Common Tomcat Platform installations, see [[Creating a non-root MySQL User to Run Agile Apps]].

{{Important|The installer needs ''the same privileges as the root user'', without actually ''being'' the root.}}

====memcached====

memcached accepts the command line argument <tt>–u {username}</tt>. With that argument, memcached assumes the identity of the specified user when running, after being launched by the <tt>root</tt> user. It is recommended that this username is set to <tt>nobody</tt> in the memcached startup command. For example:
:<syntaxhighlight lang="java" enclose="div">
/usr/local/bin/memcached -m 250 -p 11211 -d -u nobody
</syntaxhighlight>

Here, memcached is configured to run as a daemon using 250MB of cache, listening on port 11211, and running as the user <tt>nobody</tt>.

====MySQL====
A typical mysql installation has the mysql server running as the user <tt>mysql</tt>. You can verify that setting using the <tt>ps</tt> command:
:<syntaxhighlight lang="java" enclose="div">
ps auxwww | grep mysql
</syntaxhighlight>

====Apache httpd server====

Set the User and Group directives in <tt>httpd.conf</tt> to values other than <tt>root</tt>.

For example:
# Create a group called <tt>apache</tt> and add the user <tt>apache</tt> to that group.
# Set the values for User and Group in <tt>httpd.conf</tt> to <tt>apache</tt>

====Platform====

The {{EnterpriseBrand}} is based on Apache Tomcat. It can be run as a standalone AppServer or deployed behind the Apache <tt>httpd</tt> server. When run as a standalone server, the platform listens to ports 80 and 443 for <tt>http</tt> requests. To be run as a non-root user, the platform must be deployed behind Apache, and must be listening on ports > 1023 (since only the root user can bind to low-numbered ports).
:''Learn more:'' [[Installing and Configuring Apache for Use with the Platform]]

When installing the {{EnterpriseBrand}}:
:1. Login as the user <tt>tomcat</tt> instead of user <tt>root</tt>. 
: &nbsp; &nbsp; That way, the ownership and permissions for the installation folders are set up properly.

After configuring the platform and Apache to work together:
:2. Create the group <tt>tomcat</tt> and add the user <tt>tomcat</tt> to it:
::<syntaxhighlight lang="java" enclose="div">
/usr/sbin/groupadd tomcat
/usr/sbin/useradd -g tomcat -d /home/tomcat tomcat
</syntaxhighlight>

:3. Change the password for the user <tt>tomcat</tt>:
::<syntaxhighlight lang="java" enclose="div">
passwd tomcat
</syntaxhighlight>

:4. Change the ownership in the folder where the platform is installed to the user <tt>tomcat</tt>.
: &nbsp; &nbsp; For example, if the installation folder is <tt>/opt/softwareag/agileapps</tt>:
::<syntaxhighlight lang="java" enclose="div">
chown -R tomcat:tomcat /opt/softwareag/agileapps
</syntaxhighlight>

:5. Restrict permission on the configuration folder to the user <tt>tomcat</tt>:
::<syntaxhighlight lang="java" enclose="div">
chmod -R 700 {agileapps}/tomcat/conf
</syntaxhighlight>

:6. Ensure that the user <tt>tomcat</tt> has sufficient permissions on the Temp Directory
<blockquote><ol type="a">
<li>If the Temp directory configured in the Service Provider Settings is <tt>/tmp</tt> (the default), ensure that everyone has read and write permissions on that folder:
:<syntaxhighlight lang="java" enclose="div">
chmod –R 777  /tmp
</syntaxhighlight></li>
<li> If upgrading an installation in which the Temp Directory configured in the Service Provider Settings is not <tt>/tmp</tt>, and is used exclusively by the platform, change the ownership of the folder to the user <tt>tomcat</tt>. For example, if the location is <tt>/var/platform_tmp</tt>:
:<syntaxhighlight lang="java" enclose="div">
chown -R tomcat:tomcat /var/platform_temp
</syntaxhighlight>
</li></ol>
</blockquote>

:7.Make it possible for the non-root user to run the startup command</tt>
: &nbsp; &nbsp;  to become user <tt>tomcat</tt> before starting the platform.
: &nbsp; &nbsp; To do that, change this line:
::<syntaxhighlight lang="java" enclose="div">
{install-dir}/profiles/IS_default/bin/startup.sh
</syntaxhighlight>
: &nbsp; &nbsp; to
::<syntaxhighlight lang="java" enclose="div">
sudo {install-dir}/profiles/IS_default/bin/startup.sh
</syntaxhighlight>
<noinclude>

[[Category:Installation]]
</noinclude>