Running admin server user as non-root

Question

Hi All,
I have a requirement to run admin server user as non-root. Is this possible and how to go about it.
giovi

Answer 1

Web Server traditionally runs with a process parentage something like:
Admin Server -> WatchDog -> Primordial Process -> Worker Process
The Worker Process runs with the UID specified in the configuration (nobody, webservd, etc). This is the process that is actually doing the work of being a web server.
The Primordial Process typically runs with the UID specified in teh configuration. The primordial process never handles requests. Its role is to quickly create replacement worker processes if the worker process unexpectedly terminates.
The WatchDog process typically runs with privileged (read "root") access in order to be able to bind to the privileged ports of the OS (any port below 1024). Without privileged access no bind can occur. Once the Watchdog performs the bind it creates the Primordial process, delegates ownership of the port, etc. From then on its role is to watch for unexpected termination of the Primordial process and, if needed, create a new one.
The Admin server is an optional part of the configuration. When used, it also needs to have the necessary rights to bind to the privileged ports.
So then - the only way to allow the Admin Server or the Watchdog run non-privileged and still be able to perform their jobs is to loosen the restrictions on the privileged ports themselves. On Solaris 10 you could do this with:
# usermod -K defaultpriv=basic,net_privaddr webservd
Then become webservd and start the process.
Note that the Admin Server's UID is set in admin-serv/config/server.xml (there may be a screen for this in the GUI). Look for the <user>root</user> element.