topic Re: Content Store filesystem Permissions in Alfresco Archive

Content Store filesystem Permissions

high — Sat, 20 Nov 2010 16:39:52 GMT

I am concerned about the default world-readable filesytstem permissions on the contentstore. I have searched the forums and find nothing on this issue.I have installed Alfresco Community 3.3g. It is my first experience with Alfresco. I installed a few weeks ago on Redhat 5 (latest version with up

Re: Content Store filesystem Permissions

mrogers — Sat, 20 Nov 2010 17:07:44 GMT

You should be able to set the permissions such that only the account that runs alfresco and your backup software has access to the content store.

However make sure you don't touch the lucene indexes while Alfresco is running.

Re: Content Store filesystem Permissions

high — Sat, 20 Nov 2010 17:31:08 GMT

mrogers,

Thank you for the prompt reply.

I tried as you suggested and, indeed, by stopping tomcat before changing the permissions, then restarting tomcat, I was able to get alfreso to run properly after resetting permissions with:

cd /var/lib/alfresco/alf_data/contentstore
chmod -R go-rwx *

Howewer, when I uploaded a file through alfresco so that the file would make its way into the contentstore, I checked permissions again and that new file had the same open permissions as before:

cd /var/lib/alfresco/alf_data/contentstore
find . -type f -not -perm u=rw,g=,o= -exec ls -ld "{}" \;
-rw-r–r– 1 tomcat tomcat 1150 Nov 20 09:21 ./contentstore/2010/11/20/9/21/199dbb03-bda8-40d7-87a3-e148c5f1bde4.bin

So, I suppose the only way to address this going forward is with a cron job (shutdown tomcat, reset permissions, startup tomcat) or is there a more elegant alfresco way to do it, say with a (tomcat or lucene?) configuration parameter?

–Brian

Re: Content Store filesystem Permissions

high — Sat, 20 Nov 2010 17:51:40 GMT

I found that I must set the umask for tomcat in it's startup script:

I put this: umask 066

near the top of : /usr/sbin/tomcat6

And restarted tomcat. This fixed the problem. I will have to remember to do this with each upgrade of tomcat. I do not see any configuration parameter in tomcat's configuration file for this.

References:
http://www.mail-archive.com/tomcat-user@jakarta.apache.org/msg120526.html
http://serverfault.com/questions/152936/how-to-set-default-umask-for-tomcat-webdav-servlet