IdP 3.2 installation - conf file permissions

[John Horne]

On Thu, 2015-11-19 at 15:49 +0100, Peter Schober wrote:
> * John Horne <john.horne at plymouth.ac.uk> [2015-11-19 15:31]:
> > It seems that the '/opt/shibboleth-idp/conf' files have been 
> > installed with (Linux) permissions of 600. Checking the 3.1.2 
> > installation, those files were installed with permissions of 644.
> > 
> > I changed the files in 'conf', and within its subdirectories, to 
> > 644 permissions, and restarted the software. It came up with no 
> > errors. I could find no other obvious permission discrepancies 
> > between 3.1.2 and 3.2.
> 
> To be safe you should probaly chown all those files to root:tomcat
> (where 'tomcat' is the user the servlet container runs as) and make
> them 0640, so only the servlet container user can accsess those, and
> only read-only.
>
Thanks. Yes, I actually set the directory permissions to 750 and owned
by root:jetty. So access to the files (with 644 permissions) and owned
root:root should be safe in that case.



John.

-- 
John Horne                   Tel: +44 (0)1752 587287
Plymouth University, UK