Permissions

Granting process permissions

• All processes should be run as a non-root user. The user should only have write permissions to data directories, configuration files, and log directories.
• If not using PID files, use the grep patterns in subsequent controls to identify the four processes.

  Commands and sample outputs for the .PID files are given below:

  ls *.pid

  activemq.pid  cmdline2.pid  noapp.pid  ops.pid

  cat cmdline2.pid

  4670

  ps -ef | grep 4670

  <user_install>     4670     1  0 Mar26 ? 
  00:00:05 /install_dir/jdk/bin/java -Xms128m 
  -Xmx512m -Dcom.ibm.jsse2.sp800-131=off -DcmdlineProps2=
  /installdir/properties/CmdLine2server.properties -jar 
  install_dir/client/cmdline2/CLA2Client.jar 51152
  <user_install>    22740 20499  0 06:08 pts/2    
  00:00:00 grep 4670

Defining user controls

• Run time user can be different from the install user. This ensures that the binaries are protected from unauthorized changes at runtime.
• Take due care while giving appropriate write permissions. There are some directories and files where runtime write access is required. Some deployment specific functionality may dynamically create or delete file system trees or files. When deployment-specific value-added processing is introduced to the system, you must evaluate the logic to ensure basic security rules are followed.
• Setting appropriate permissions:
  By default, only the application owner is given permissions to read/write on all files and directories.

  chmod -R u=rw,g=r,o= install_dir

  Granting permissions to users and groups to access directories.

  chmod -R ug+X install_dir

  Granting permissions to users and groups to write files to the application root. (PID files and dump files are generated here).

  chmod -R g+w install_dir

  Allowing owner to execute all scripts.

  find /install_dir/ -name ""*.sh"" 
  -exec chmod u+x {} \;

  Adding execution permissions to the binaries/scripts

  chmod -R ug+x install_dir/bin/*sh
  chmod -R ug+x install_dir/noapp/bin/*sh
  chmod -R ug+x install_dir/jdk/bin
  chmod -R ug+x install_dir/jdk/jre/bin
  chmod -R g+w install_dir/tmp/*

  Granting write access to properties that are modified through the Sterling B2B Integrator UI.

  chmod -R g+w install_dir/properties/tuning.*

  Creating empty system_overrides.properties if it does not already exist.

  touch -a install_dir/
  properties/system_overrides
  chmod -R g+w install_dir/
  properties/system_overrides.properties
  chmod -R g+w install_dir/
  properties/tuning.properties
  chmod -R g+w install_dir/
  properties/tuningPreviousSettings.properties

  Granting write access to logs

  chmod -R g+w install_dir/logs

  Granting write access to dump files

  chmod g+w install_dir/noapp/bin

  Moving the default locations for data to a location outside the Sterling B2B Integrator install_dir directory (Recommended)

  chmod -R g+w install_dir/arc_data
  chmod -R g+w install_dir/documents
  chmod -R g+w install_dir/ediinbound
  chmod -R g+w install_dir/edioutbound
  chmod -R g+w install_dir/

Running Sterling B2B Integrator as a Windows service

In a Windows environment, Sterling B2B Integrator installs and runs as a Windows service. By default, it runs as the local system user. This should be changed to a dedicated Active Directory user account.

Granting permissions

Enabling CLA2Client.jar

• Verify if the LAUNCH_CLA2_SERVER=true parameter is available in the sandbox.cfg file. If present, the CLA2 server will be started on the local server when Sterling B2B Integrator starts.

  grep LAUNCH_CLA2_SERVER install_dir/
  install/properties/sandbox.cfg

  LAUNCH_CLA2_SERVER=true

• Related documentation: Command Line Adapter 2 Upgrade Impacts (5.2.4.1_2 or higher)

Using ActiveMQ

activeMQ credentials.propertes

• The install_dir/activemq/conf/credentials.properties and credentials.properties.in files contain the ActiveMQ server user name and password. These default user name and password should be replaced with appropriate values.
• After changing the default values, the new values must be propagated to all other ActiveMQ configuration files. The username and password fields should not contain the default values.

  cat install_dir/credentials.properties
  activemq.username=jmsadmin
  activemq.password=password

Audit logging

• Events are generated each time a resource is created, updated, or deleted. The events are stored in the ADMIN_AUDIT table.
• This table should be writable only to the application's DB user and must not be writable to other database users.