...
PhixFlow supports all of the major server operating systems, UNIX, Linux and Windows. The information in this section describes users, file structures and permissions for typical Linux and Microsoft Windows installations however the requirements/principles remain the same for the other operating systems.
Linux/UNIX
Users & Groups
To support secure and auditable access, the following groups and users should be created:
Group: cviewphixflow | This group is the primary group for all PhixFlow users below (cviewphixflow, individual and tomcat) |
Group: oinstall | This is the standard name for the Oracle install group. Users cview phixflow and tomcat should be members of this group. |
User: cviewphixflow | This user owns the PhixFlow directory (‘/opt/phixflow’) and will be used to perform certain maintenance tasks. This user should be able to
This user should not be able to:
|
Individual Support Users | These represent individuals who will perform support and maintenance tasks on PhixFlow. These users should be able to
These users should not be able to:
At the administrator’s discretion, the cview phixflow user and individual support users may be combined into a single user. |
User: tomcat | The tomcat user will be used to run the Apache Tomcat web server, and will own all files directly used by the web server. This user should be able to
This user should not be able to
|
Notes | 1. | If on Linux: increase the per-user limit on open files for the tomcat user to 4096. To do this edit /etc/security/limits.conf and add the following line: tomcat hard nofile 4095 |
| 2. | Set umask 22 for the tomcat user and umask 2 for user cview phixflow and individual support users. |
| 3. | Add the oracle user to the cview phixflow group – this will allow oracle to write data pump files into the PhixFlow directory |
File System
The following directories should be set up within the application installations and data partition.
Directory | Owner | Owner rights | Group rights | Other rights |
$app/phixflow | cviewphixflow | rwx | rwS | --- |
$app/phixflow/data | cviewphixflow | rwx | rwS | --- |
$app/phixflow/data/import | cviewphixflow | rwx | rwS | --- |
$app/phixflow/data/export | cviewphixflow | rwx | rwS | --- |
$app/phixflow/data/archive | cviewphixflow | rwx | rwS | --- |
$app/phixflow/data/restore | cviewphixflow | rwx | rwS | --- |
$app/phixflow/data/templates | cviewphixflow | rwx | rwS | --- |
$app/phixflow/data/plugins | cviewphixflow | rwx | rwS | --- |
$app/phixflow/data/temp | cviewphixflow | rwx | rwS | --- |
$app/phixflow/dbexport | cviewphixflow | rwx | rwS | --- |
$app/phixflow/release | cviewphixflow | rwx | rwS | --- |
$app/phixflow/temp | cviewphixflow | rwx | rwS | --- |
$app/tomcat | tomcat | rwx | r-x | --- |
...
Notes | 1. | /opt/phixflow and all directories beneath it have the group id bit set in order to ensure that all directories and files under /opt/phixflow can be read and written by any PhixFlow support user and by tomcat |
| 2. | /opt/tomcat and all directories beneath it have the group permissions set to read-only so that only the tomcat user can write or modify files under /opt/tomcat |
WINDOWS
Users & Groups
By default, both the database and web app server run under the local SYSTEM account so there is no need to set up any additional users or groups for running the applications however user accounts should be set up for installation and support purposes.
...
Individual Support Users | These represent individuals who will install PhixFlow and perform support and maintenance tasks on PhixFlow. These users should have local administrator rights on the server and should be able to:
At the administrator’s discretion, a single support user ‘cview’ ‘phixflow’ user may be set up however we recommend setting up individual accounts. |
File System
The following directories should be set up within the application installations and file data partition.
...