Root privilege considerations for IBM Storage Scale management GUI

The IBM Storage Scale GUI WebSphere® Java™ process runs as a user named scalemgmt. This provides improved security because web applications running as a non-root user are less vulnerable to security threats. The scalemgmt user is set up as a system account with no login privileges.

The GUI and GUI user still need root privileges in the backend to perform the following tasks:
  • Monitoring and managing the cluster by issuing the IBM Storage Scale CLI commands.
  • Bind to the privileged ports such as 80 (http) and 443 (https) to work with the GUI.

The system automatically performs the required configuration. It does not require any configuration to be done by the user.

Enabling the scalemgmt user to monitor and manage the system through GUI

As root privileges are not available to the GUI user, the system enables the scalemgmt user to run the CLI commands through sudo. The GUI installation adds the file /etc/sudoers.d/scalemgmt_sudoers, which allows the scalemgmt user to run commands that match the wildcard /usr/lpp/mmfs/bin/mm.

During installation of the IBM Storage Scale management GUI, the following lines are appended to the /etc/sudoers file: 
## Read drop-in files from /etc/sudoers.d 
#includedir /etc/sudoers.d
Note: Do not alter these lines if you are editing the /etc/sudoers file. If these lines are removed or moved from the default location, the GUI cannot run the CLI commands as a non-root user.

Binding to the GUI privileged ports

A non-root process cannot bind privileged ports such as 80 and 443. So, the GUI process now runs on port 47443 and 47080 and uses iptables rules to forward port 443 to 47443 and 80 to 47080. The GUI is only available in the browser on port 443 through HTTPS. However, versions prior to 4.2.3 used port 80 to send events to the GUI, so to stay backwards compatible in clusters that still contain nodes with older versions, the GUI still accepts events on port 80.

To reach the GUI from outside, not only port 443 and 80 but also port 47443 and 47080 must be opened to the outside. This is because the port forwarding redirects port 443 to 47443 and 80 to 47080 before evaluating the rules of the iptables INPUT chain.

The iptables rules necessary for the port forwarding are automatically checked every time the GUI is started through the systemctl start gpfsgui command. The user does not have to configure anything manually.