New User Concept for ePages 6 on Unix | → 6.17.48 | Created: 6.0.7; Updated: 6.14.0 |
Two new user were created to improve farther the security of epges. Their rights are maximal limited. The application and the web server processes runs under these new users. Because of the limitation of the access rights external users can't access the system using processes.
Table of Contents |
That grants all necessary rights to read. The files in cartridges, Perl etc.are not owned by the Run-Users. Therefore these users can't changed the files. Read-Only for the file owner is not necessary.
The environment variables EPAGES_APPUSER and EPAGES_WEBUSER contain the names of the users and are set by patch / installtion in /etc/default/epages6:
EPAGES_APPUSER=eprunapp EPAGES_WEBUSER=eprunweb
The former status can be set by defining:
EPAGES_APPUSER=ep_appl EPAGES_WEBUSER=ep_web
Rights to write are not necessary for eprunweb Apache/logs. The process is started by root.
eprunweb can write into $EPAGES_LOG and $EPAGES_SHARED/Monitor because the group ep_web is allowed to write there.
Necessary Changes
Beside ep_appl eprunapp is created now. ep_appl is used for starting processes via command prompt furthermore like:
cd $EPAGES_CARTRIDGES/DE_EPAGES perl Makefile.PL make reinstall
eprunapp should not used for that.
All access right remain so far except for $EPAGES_SHARED.
eprunapp just has read access within the directories if access right weren't changed.
chown -R eprunapp ASPool.db DataCache.conf EbayCategories.db chmod -R 775 ASPool.db DataCache.conf EbayCategories.db
chown -R eprunapp Log
Access rights remain the same.
chown -R eprunapp Static Stores WebRoot
The processes can take a lot of time on large installations. (Maybe the processes can crash because of inode-caching) Workaround for this:
Patching is quite the same as before. The file access rights will be changed during the patch process. The patch can only performed by root.
The change of access rights doesn't have any influence on partner cartridges.