Forum OpenACS Development: Reference Platforms and Supported Platforms

• Reference Platform: An "official" platform that is fully documented, supported, and reproducable. This should include the platforms that most of the core contributors use.
• Supported Platform: A platform that someone, somewhere, has working and is committed to maintaining documentation for.
• Unsupported Platform: everything else?

I have documented a reference platform comprising Red Hat 8.0, PostGreSQL 7.2.3, and OpenACS 4.5 (and a bunch of other details like qmail, daemontools, etc), server root in /web/openacs-dev; log files in /var/log/aolserver; control files in /usr/local/aolserver, etc. For 4.6.x I'm planning Red Hat 8.0, PostGreSQL 7.2.3, OpenACS 4.6.x; and eventually I'll get an Oracle version together. I have pointers to docs for Mac OS X and VMWare (thanks!) which I plan to incorporate. The last version of the docs was Debian. What other platforms do people propose?

Here's what I think goes into a reference platform. what am I missing?

• A list of all software, including
  • Version number
  • licensing information
  • where to get it
• file paths for everything
• All of the config files
• all of the necessary accounts
• documentation on how to reproduce it

What is the clearest name for the example instance in the documentation? Current docs use either openacs-4 or birdnotes. I used openacs-dev because it goes with openacs-pre and openacs-prod, but it doesn't have much meaning by itself. Can we get new proposal/consensus for the default instance name?

Your /web directory is on its own partition; my /var directory is on its own partition. I don't see either as obviously more right, except that /var/log is pretty standard in unix. Opinions?

The 4.6 docs say that "For security and compatibility reasons [using /web for the web root and running AOLserver as the nsadmin user] is no longer recommended." What are the security and compatibility reasons, and which user should you run aolserver as now? Something doesn't feel right about putting web roots in /home/joeuser/web, at least not for production sites.

If 9i can hit 4.6.2 that would be utterly fantastic, of course, other than the fact that I may feel compelled to upgrade my Oracle server from RH 6.2 and 8.1.6 and installing Oracle just gives me bad vibes ... :)

I changed the AOLserver installation instructions based on advice from Pascal Scheffers in this thread.

I'm no security expert, but here's my understanding of the issue:

1. AOLserver is running as nsadmin
2. Someone finds an exploit in OpenACS or AOLserver, giving them access to the filesystem.
3. Since they have nsadmin privs, they can alter the nsd binaries.
4. They kill the server which usually causes an automatic restart
5. nsd initially starts off with root privs, so the new binary can do whatever it wants on your system

Now this can be fixed simply by making the nsd binary unwritable by nsadmin. But Pascal advised me that giving the webserver any more privs than it needs is a security risk, so I changed the docs to show AOLserver running as 'nobody', like Apache does. I mentioned these changes in this thread and, not hearing any dissenting opinions, went ahead.

I moved the serverroot from /web to /home/joeuser/web because I was advised (can't remember from whom) that it was more FHS compatible. This easily allows 2 users on my machine to have completely separate OpenACS installations that the other user can't access. I don't think there's any problem with putting a production site in /home/joeuser/web. I do it 😊

• a dedicated, nologin user for each instance.
• Each instance has a directory in /web/instance-name which is only readable by the user
• All instance-specific config files, including (instance-name.tcl, ssl subdir (ssl instructions, including generating self-signed certs, are being integrated into the install doc, by the way), analog config, daemontools subdir), go in /web/instance-name/etc

• The user under which a process runs should not have write access to the nsd binary, for security
• Different instances of OpenACS on one machine should each run under a different user, and should not be able to access each other's files, for security for multi-hosted setups
• All of the config files (nsd config file, ssl certificates, analog config file, daemontools directory) should be together, for ease of backup and version control
• The site content (the five directories in site root, plus a recent database backup file) should be backed up in sync with each other and with matching config files
• The error and traffic logs should go in a seperate location so that they can be on their own partition (this begs the question: how does aolserver behave when there is no space on the log partition?)

It seems to me that we can satisfy all of this by doing this (basically Jun's setup):

/web/sitename
             /etc
             /log
             /tcl
             /packages
             /content-repository-content-files
             /www
             /bin
             /database-backup

All of this secured so that only a dedicated "sitename" user, under whose authority the instance ran, had access.

/etc is for config files, including any subdirs that aolserver demands (I too remember nsopenssl failing if it didn't have a particular subdirectory relative to the binary's location - that may require an ugly workaround).

Do we need to move the database data files, too? I don't think so; the backup files are more useful for recovery, so those should go into our tree, but (at least in PostGreSQL) the data directory has restrictive permissions. By the way - since we don't use passwords, how are we authenticating? How are we securing the postgresql install?

Standards seem to only work when people start using them, and since some of the heavy Linux distros are buying in it would be great to be able to take advantage of common file arrangements.

talli

New aolserver-4.0b2 gentoo package available.

Please see my discussion of the way my package implements a similar strategy re: LSB/FSH and security as does apache in gentoo linux.

My opinion on /web etc.: up to the admin. Aolserver probably belongs in /home/aolserver, but your web root can be in a) /home/aolserver/web/instance or in b) /usr/local/aolserver/instance or in c) /web/instance... I'll probably stick with a) or c). =) --Chris

However, I think you have one mistake in your "Version Compatibility Matrix". You list AOLserver 3.5.5 as "Verified" for OpenaCS 4.6.2 and 4.6.3, but AFAIK no stock AOLserver 3.5.x version include the ArsDigita-derived character set support required by OpenACS 4.x

I remember when the character support was discussed on the AOLserver list and on openacs.org, and AOLserver team's decision was to skip the work necessary to add it into any AOLserver 3.5.x point release, and instead to put it into 4.0 (which they did). So unless somebody changed their mind about that, I don't see how AOLserver 3.5.5 could be fully "verified" for use with OpenACS 4.6.x. There might be a patched version of 3.5.x around somewhere that has the necessary character set support, though.