This is how you modify an Alfresco installation to run as non-root.

  1. Enable IP forwarding: 
    echo 1 > /proc/sys/net/ipv4/ip_forward
        Also, in the /etc/sysctl.conf, make sure ip forwarding is enabled: 
    net.ipv4.ip_forward = 1





  2. Place the following in fileservers-custom.xml: 
    <config evaluator="string-compare" condition="CIFS Server">
	<serverEnable enabled="true"/>
	<tcpipSMB port="1445" platforms="linux"/>
	<sessionTimeout="30" />
	<netBIOSSMB sessionPort="1139" namePort="1137" datagramPort="1138" platforms="linux"/>
</config>



  3. Set up iptables redirects: 
    iptables -t nat -A PREROUTING -p tcp --dport 445 -j REDIRECT --to-ports 1445
iptables -t nat -A PREROUTING -p tcp --dport 139 -j REDIRECT --to-ports 1139
iptables -t nat -A PREROUTING -p udp --dport 137 -j REDIRECT --to-ports 1137
iptables -t nat -A PREROUTING -p udp --dport 138 -j REDIRECT --to-ports 1138



  4. Change ownership on the alfresco.pid file to repos: 
    chown repos:repos /var/run/alfresco.pid



  5. Make sure the path through /home/www/apache/modules/* is readable/executable by repos


  6. Change ownership and permissions on /sbin/mount.cifs to enable mounting CIFS by repos: 

    chown root:repos /sbin/mount.cifs
chmod 4750 /sbin/mount.cifs



  7. Add the following line to /etc/fstab: 
    //localhost/avm  /home/repos/mnt/this-avm	cifs	user,noauto	0 0



  8. In the /etc/security/limits.conf file, add the following lines: 
    repos		soft	nofile		8192
repos		hard	nofile		8192





    For the deployment scripts (for the -mitmods version only):


  9. Note that the deploy scripts need to be updated to use the 1445 port for CIFS (since local traffic is not forwarded). Also, the mount point for CIFS needs to be under /home/repos, not /mnt. For whatever reason, we need to use "mount.cifs" directly instead of "mount", which always requires you to be root whether the SUID bit is there or not. Finally, the sharename must be "//localhost/avm" to match the fstab entry. Here are the relevant changes in the script: 
    export MOUNT_POINT=~/mnt/this-avm
# instead of /mnt/this-avm

umount -t cifs //localhost/avm ${MOUNT_POINT}/
# instead of //${HOSTNAME}/avm

mount.cifs //localhost/avm ${MOUNT_POINT}/ -o port=1445,user=${DEPLOY_ALFRESCO_USER}%${DEPLOY_ALFRESCO_PASSWORD}
# "mount.cifs" instead of "mount -t cifs"; "localhost" instead of "${HOSTNAME}"; "port=1445" instead of default behavior (445)


  10.  On the remote (linux) server, identify or create a remote user with write access to the desired deployment destination path.  Ensure that the root account on the Alfresco server can ssh as this user to the remote server without being prompted for a password.  If this is not already set up, you should do the following:
    * On the Alfresco server as *repos*, run "ssh-keygen -t dsa" and accept the default location.  Also, leave the passphrase blank (maybe not the best advice but I want to ensure that the script will not be prompted for a password)
    * Copy the generated public key file (~/.ssh/id_dsa.pub) to the remote server (e.g., "scp ~/.ssh/id_dsa.pub REMOTESERVER:")
    * Log into the remote (assumed linux) server as the remote user.  (If the user doesn't exist, first log in as root and create the account with "adduser USERNAME")
    * If it does not exist, create the remote user's .ssh directory and make sure its permissions are properly set. ("mkdir ~/.ssh" and "chmod 700 ~/.ssh")
    * Append the generated public key file you copied to the end of .ssh/authorized_keys, and make sure its permissions are properly set.  ("cat id_dsa.pub >> ~/.ssh/authorized_keys" and "chmod 600 ~/.ssh/authorized_keys")
    * Remove the generated public key file from the remote server ("rm id_dsa.pub")

    Example: 
    adduser deploy_bot    ###note, this is the WEB SERVER "deploy_bot" account, not the ALFRESCO "deploy_bot" account |
mkdir /home/deploy_bot/.ssh; |
chown deploy_bot /home/deploy_bot/.ssh |
chmod 700 /home/deploy_bot/.ssh; |
cat \~/id_dsa.pub >> /home/deploy_bot/.ssh/authorized_keys |
chown deploy_bot /home/deploy_bot/.ssh/authorized_keys |
chmod 600 /home/deploy_bot/.ssh/authorized_keys |
rm \~/id_dsa.pub |
chmod a+rx /home/www |
chmod a+rx /home/www/sash-server |
chmod a+rx /home/www/sash-server/servers/ |
chmod a+rx /home/www/sash-server/servers/alumni/ |
chown deploy_bot /home/www/sash-server/servers/alumni/webapps |
chown deploy_bot /home/www/sash-server/servers/alumni/webapps/ROOT |
    * Log out of the remote server
    * Test by logging into the Alfresco server as *repos* and running "ssh -l USERNAME REMOTESERVER".  If you get in as the remote user without being prompted for a password, congratulations.   Note: in this step, accept the host key.  This stores the host key in known_hosts and is actually important, since you don't want the deployment script to be prompted to accept or not accept the host key.


  • No labels