Running the App Server as a user other than root

Question

We used to use iPlanet Web Server which during installation allowed you to specify which user you wanted to run the Web Server. This was very good for security. How do you do this with the App server ?
Thanks
PS We are running it on Solaris 9.

Answer 1

Application Server 7 expands on the flexibility offered in the web server.
The most basic means to define app server instances with non-root users is to create an administrative domain (basically, an admin server instance) using the user ID of interest. As you create new application server instances in the admin domain, you can assign the same user ID to the instances.
(There is an admin domain that is initially configured as part of the app server installation. If you installed the product as root, then the admin server and the initially configured app server instance are owned by root. If you do not want these instances to be owned by root, you should remove this admin domain and create a new one that is owned by a non-root user.)
For example, with the following command, I've created a new app server config (an administrative domain) containing an admin server owned by user "ckamps":
root@canteloupe-{}: asadmin create-domain sysuser ckamps adminuser admin adminpassword password adminport 5050 ckamps.domain3
Created Domain ckamps.domain3 successfully
root@canteloupe-{}:
Then I create an app server instance within this admin domain:
root@canteloupe-{}: asadmin create-instance domain ckamps.domain3 sysuser ckamps --instanceport 80 instance1
Created Instance instance1 successfully
Note the use of the "--sysuser" option to specify the user that owns both the admin domain as well as the app server instance.
You can either use root to define the admin domain and the instances (in which case you need to specify the sysuser option to force a non-root ownership) or you can use a non-root user to define the admin domain and app server instances.  In the latter case, specification of the sysuser is not required.
Since my instance is defined to listen on a privileged port, I'll need to set the "run as user" in the <instance-dir>/config/init.conf file (similar to magnus.conf in Sun ONE Web Server 6) AND ensure that I start the instance as root. Once the server instance starts up as root, it will automatically switch to the run as user.
The "User" setting below is the "run as user" specified in the admin console's "Create new instance" wizard.
<snip of init.conf>
NetsiteRoot /usr/appserver
ServerID instance3
ServerName canteloupe
PidLog /var/appserver/domains/ckamps.domain3/instance3/logs/pid
User ckamps
DNS off
</snip>
Alternatively, you can start up the newly defined admin server and create the new app server instance through the admin console.
Hope this helps,
Chris