Root Access

What exactly can you NOT do with Interwoven (TeamSite, Templating, and OpenDeploy), if you do NOT have root/Administrator access?

In other words, if the system admins don't want to give up the root password or allow anything to run as root -- what are the items that just won't work?

David M. Doggette
Certified Interwoven Consultant

Find more posts tagged with

Comments

Adam Stoller

Are you referring to *installation* or *using from a client machine* ?

Installatio:TeamSite: Root access required - no way around it.

Installation OpenDeploy: I believe it is required (writes some files under /etc) - but can then be configured to run as non-root afterwards (551 SP2 provides a CLT for this I believe). If running as non-root there are limitations on things like chown/chgrp type activities as part of a deployment.

Using TeamSite or OpenDeploy as a client should not require root access (there might be some exceptions, but I cannot think of any right now).

There are a number of installations that happen on the client side on a Windows machine that require the ability to modify registry settings - so having administrative (if not Administrator) access is generally required for the installation - after that, you should not need administrative abilities to use the software.

Does that help?

--fish
(Interwoven, Curriculum Development)

Migrateduser

I'm talking about the day to day operating of Interwoven, not the installation. It is my understanding that some services or operations need to run as root. Trying to figure out what to tell an **** group that doesn't want to allow root access to be compromised.

David M. Doggette
Certified Interwoven Consultant

Migrateduser

If you are talking about content contribution, you can work without problems without having root access. If you're talking from a developer point of view, then probably you will have a hard time changing the configuration files, such as iw.cfg, roles, templating.cfg, etc... not to mention that you won't be able to do very much unix administration (create groups and/or users)..... does this help??

Migrateduser

I've also found that it's nice to set some scripts up to run as root (setuid) when they attempt to globally modify attributes of directories/files, if you like to do that sort of thing. That way you don't have to worry about permissions.

Dave Smith
Sr. Software Engineer
Nike, Inc.
(503) 671-4238
DavidH.Smith@nike.com

tvaughan

I'm in the same situation where my USAs are completely unwilling to give up root, even though I've proven pretty capable of fixing their problems.

Interwoven starts up as root, so if you want to bounce the server, or make any chown's or chmod's, you're SOL. As a compromise, I had my USAs set up a sudoers file and add me to it. To give you and idea of how far down the root-road I go, here's my list of sudo rights:


    (root) NOPASSWD: /etc/init.d/iw.deploy
    (root) NOPASSWD: /usr/bin/* */usr/j2se /
    (root) NOPASSWD: /etc/init.d/iwtcboot
    (root) NOPASSWD: /etc/init.d/iwod
    (root) NOPASSWD: /usr/bin/* */teamsite/iw-home/private/ bin/*
    (root) NOPASSWD: /usr/bin/* */iwmnt*
    (root) NOPASSWD: /usr/bin/* */web*
    (root) NOPASSWD: /web
    (root) NOPASSWD: /usr/bin/* */teamsite*
    (root) NOPASSWD: /usr /sbin/snoop
    (root) NOPASSWD: /usr/bin/vi /etc/iw.cfg
    (root) NOPASSWD: /etc/iwreset
    (root) NOPASSWD: /etc/init.d/iw.server
    (root) NOPASSWD: /tea msite/iw-home/bin/iwreset
    (root) NOPASSWD: /teamsite/iw-home/bin/*
    (root) NOPASSWD: /etc/rc3.d/S101webserver_adm
    (root) NOPASSWD: /etc/rc2.d/K101webserver_hq1unx63
    (root) NOPASSWD: /etc/rc2.d/K101webserver_adm
    (root) NOPASSWD: /etc/rc2.d/K1 01webserver_teamsite5.0.1
    (root) NOPASSWD: /etc/rc3.d/S101webserver_hq1unx63
    (root) NOPASSWD: /etc/rc3.d/S101web server_teamsite5.0.1
    (root) NOPASSWD: /etc/rc3.d/S16iw.server
    (root) NOPASSWD: /etc/rc3.d/S80iw.deploy
    (root) NOPASSWD: /etc/rc3 .d/S99iw.local
    (root) NOPASSWD: /web/prod/wwwadmin/https-teamsite5.0.1/restart
    (root) NOPASSWD: /usr/bin/* */opt/ NewAtlanta/ServletExecNSAPI*

Tom