topic Re: FIle security not user security in Alfresco Archive

FIle security not user security

enterpriserevie — Fri, 05 May 2006 07:34:00 GMT

Hi guys..I have been looking around for help on the security of the physical files that are loaded onto the server. Where do they get stored, is it safe from the web server instance, do they get copied when a web based request is instigated?although I can't find anything on the Wiki, I assume there

Re: FIle security not user security

kevinr — Fri, 05 May 2006 13:32:11 GMT

The physical file content is stored by default in the "alf_data" directory. The "repository.properties" file (search for it in your distribution) contains the location of the alf_data directory. By default the directory get stored as "./alf_data" which generally means it is found in the tomcat/bin directory. The reasoning for using a relative path by default is so that you can get up-and-running immediately with an Alfresco download without having to edit any files. It is suggested that you change the alf_data directory path to something more permanent for a real installation.

The files get streamed directly to the response when a web-based request is issues - this is very fast.

Cheers,

Kevin

Re: FIle security not user security

enterpriserevie — Fri, 05 May 2006 15:39:17 GMT

Thats great, thanks,

my next question, is around the error handeling, with regard the file location.

so If we set the storage directory for the files, to a safe non web facing directory, and there is a file error, such as the file isn't there, etc.. will the error passed to the web page show the full path of the storage directory?

I hope that makes sense..

Mt reasoning, is that if an organisation puts secure documents onto the system, how secure are they? even all set up under SSL, if under an error condition, it spills its guts, and gives the full path, there could be an issue!!!!!

Re: FIle security not user security

kevinr — Fri, 05 May 2006 15:50:56 GMT

The paths to the actual file content are completely hidden from any client and any user of those client. Internally the content location is referenced by ID in the DB (which of course can be on another machine which is well hidden and protected) - even this information is meaningless if it was ever displayed - which it is not. So there is no concern for the type of issue that you mention.

Thanks,

Kevin