Alfresco file system security on Windows

[gerryr]

When I installed Alfresco on a Windows 2008 R2 server I ran into an error while using the Easy Install.

The PostgreSQL installation would fail complaining about permissions on C:\Alfresco.

The solution was to add Modify and Write permissions for Users to C:\Alfresco as suggested by other postings.

But what about post installation?  Are those Modify and Write permissions for Users still necessary for PostgreSQL?

Right now any User would be able to directly modify, write and delete things under C:\Alfresco.

[gerryr]

Big security hole here.

No one knows how to run Alfresco without granting Write and Modify rights to Users on the raw content store?

Is it safe to remove the Write and Modify permissions for Users that was added during installation?  Or is that going to crash Alfresco?

[bisana]

Hi Gerry,
Do not know much about windows, but I have great experience in rolling out/mentoring organization and people for Document Management and other enterprise solutions. Based on it I would like to give my feedback and advice:-
Use Linux as OS, if you are serious with your document management system.It is stable no issues I faced so far for last 4 years of my DM implementation.
Other than stablilty and security there is flexiblity in taking backup and doing restoration test, by automated. I am doing this(http://addons.alfresco.com/addons/backup-restore-scripts), because of I am using Linux I am spending less time in managing it.
My advice try Linux and be secure
thanks
Joseph John

[gerryr]

Yes, I am quite familiar with Unix and Linux for past 20 years.

If this was my own system I would probably lean toward Linux but this is a client's system.  So you use what the client infrastructure already has in place.

[mrogers]

As long as the account running alfresco itself can access the content store then there's no problem locking out other users.  In fact that would be preferred.


You will need to make sure alfresco runs as a particular user,  (e.g. Alfresco) perhaps by running alfresco as a service then you can give just user 'alfresco' access to the content store.