New User Concept for ePages 6 on Unix 6.12.2
Created: 6.0.7; Updated: 6.0.7

Two new user were created to improve farther the security of epges. Their rights are maximal limited. The application and the web server processes runs under these new users. Because of the limitation of the access rights external users can't access the system using processes.

Table of Contents

1 Existing users

ep_appl, ep_web, ep_db
All user and file rights remain the same as they are in general. ep_appl keep the priority right to install patches or to start services. ep_db and the Sybase directory aren't changed.

2 New users - ePages Run-Users

eprunapp
user to run application server processes
eprunweb
user to run web server processes
The acces rights of these users are limited as much as possible:

eprunapp is part of the groups epages and ep_web, ep_runweb is part of group ep_web.

That grants all necessary rights to read. The files in cartridges, Perl etc.are not owned by the Run-Users. Therefore these users can't changed the files. Read-Only for the file owner is not necessary.

The environment variables EPAGES_APPUSER and EPAGES_WEBUSER contain the names of the users and are set by patch / installtion in /etc/default/epages6:

Names and user-IDs can be freely chosen for eprunapp und eprunweb. Defaults:

  EPAGES_APPUSER=eprunapp
  EPAGES_WEBUSER=eprunweb

The former status can be set by defining:

  EPAGES_APPUSER=ep_appl
  EPAGES_WEBUSER=ep_web

2.1 eprunweb

Rights to write are not necessary for eprunweb Apache/logs. The process is started by root.

eprunweb can write into $EPAGES_LOG and $EPAGES_SHARED/Monitor because the group ep_web is allowed to write there.

Necessary Changes

External web server are not affected by these changes.

2.2 eprunapp

Beside ep_appl eprunapp is created now. ep_appl is used for starting processes via command prompt furthermore like:

  cd $EPAGES_CARTRIDGES/DE_EPAGES
  perl Makefile.PL
  make reinstall

eprunapp should not used for that.

All access right remain so far except for $EPAGES_SHARED.

2.3 $EPAGES_SHARED

eprunapp just has read access within the directories if access right weren't changed.

  chown -R eprunapp ASPool.db DataCache.conf EbayCategories.db
  chmod -R 775 ASPool.db DataCache.conf EbayCategories.db
  setfacl -L -m u:ep_appl:rwx ASPool.db DataCache.conf EbayCategories.db

  chown -R eprunapp Log
  setfacl -RdL -m u:ep_appl:rwx Log
  setfacl -RL -m u:ep_appl:rwx Log

  Access rights remain the same.

  chown -R eprunapp Static Stores WebRoot
  setfacl -RdL -m u:ep_appl:rwx Log
  setfacl -RL -m u:ep_appl:rwx Log

The processes can take a lot of time on large installations. (Maybe the processes can crash because of inode-caching) Workaround for this:

  1. adduser eprunapp (ID wie ep_appl)
  2. set a new ID for ep_appl
  3. set permissions (but not for Static, Stores, WebRoot)
If eprunapp is the new owner ep_appl gets all ACL rights.

Necessary changes:

3 Effects on patch process

Patching is quite the same as befor: either start it as root or as ep_appl (if ACLs are used). The file access rights will be changed during the patch process. The patch from 6.0.6 or lower up to 6.0.7 or higher can only performed by root because new user are created.

4 Effects on partner cartridges

The change of access rights doesn't have any influence on partner cartridges.


Copyright ePages Software GmbH 2012