HowTos/Tomcat
Running Tomcat as a non-root user
For security reasons, it is preferrable to run Tomcat as a non-root user. In fact, most tomcat packages that come with OS distributions do it this way.
For Scalix this poses a few problems because the RES web application (which is part of the Scalix Admin Console system) needs to execute Scalix admin commands ("om-commands"), some of which must be executed with superuser/root privileges.
Scalix 10.0.0 and later therefore allow the use of sudo to limit root access to the commands in question.
Follow these steps:
1. On each machine running RES, install the sudo package that comes with your Linux distribution of choice.
2. Setup a /etc/sudoers file that has the following line (Note: This must be on a single line in the file):
<user> <hostname> NOPASSWD: /opt/scalix/bin/*,/opt/scalix/diag/*, /bin/rpm,/usr/bin/dpkg,/bin/tail,/bin/df
where <user> is the name of the Unix user under which tomcat runs and <hostname> is your Scalix server hostname.
3. Add the following parameter to /etc/opt/scalix/res/config/res.properties:
res.sudo.command.mode=true
Note: As of Scalix 10.0.1, the sample entry in the config file is wrong; this reads res.commands.sudo.mode=true and is incorrect. The correct entry is as per above.
4. Restart Tomcat
All access to Scalix commands will be logged by sudo through syslog.