RE: Problem running OpenJMS as a non-root user on Linux

The log4j.properties file in the openjms-0.7.7-alpha-1.jar is incorrect.
There are two lines in it:
  log4j.appender.STDOUT=org.apache.log4j.FileAppender
  log4j.appender.STDOUT.File=System.out

These should be:
    log4j.appender.STDOUT=org.apache.log4j.ConsoleAppender

-Tim 
 
  _____  

From: openjms-user-admin-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
[mailto:openjms-user-admin-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org] On Behalf Of Johan
Hallgren
Sent: Friday, 2 December 2005 12:46 PM
To: [email protected]
Subject: [openjms-user] Problem running OpenJMS as a non-root user on Linux



Hi list,

I am running OpenJMS 0.7.7-alpha-1 on Debian Sarge. So far, I've been
running it as root, but thought it would be a good idea to change to run as
a non-privileged user before deploying it in production. So, I went ahead
and changed ownership of the OpenJMS directory and all its files to a
regular user and launched $OPENJMS_HOME/bin/startup.sh as that user.
However, when doing that, I get this error:

log4j:ERROR setFile(null,true) call failed.
java.io.FileNotFoundException: System.out (Permission denied)
        at java.io.FileOutputStream.openAppend(Native Method)
        at java.io.FileOutputStream.<init>(FileOutputStream.java:177)
        at java.io.FileOutputStream.<init>(FileOutputStream.java:102)
        at org.apache.log4j.FileAppender.setFile(FileAppender.java:272)
        at
org.apache.log4j.FileAppender.activateOptions(FileAppender.java:151)
        at
org.apache.log4j.config.PropertySetter.activate(PropertySetter.java:247)
        at
org.apache.log4j.config.PropertySetter.setProperties(PropertySetter.java:123
)
        at
org.apache.log4j.config.PropertySetter.setProperties(PropertySetter.java:87)
        at
org.apache.log4j.PropertyConfigurator.parseAppender(PropertyConfigurator.jav
a:645)
        at
org.apache.log4j.PropertyConfigurator.parseCategory(PropertyConfigurator.jav
a:603)
        at
org.apache.log4j.PropertyConfigurator.parseCatsAndRenderers(PropertyConfigur
ator.java:524)
        at
org.apache.log4j.PropertyConfigurator.doConfigure(PropertyConfigurator.java:
408)
        at
org.apache.log4j.PropertyConfigurator.doConfigure(PropertyConfigurator.java:
432)
        at
org.apache.log4j.helpers.OptionConverter.selectAndConfigure(OptionConverter.
java:460)
        at org.apache.log4j.LogManager.<clinit>(LogManager.java:113)
        at org.apache.log4j.Logger.getLogger(Logger.java:85)
        at
org.apache.commons.logging.impl.Log4JLogger.getLogger(Log4JLogger.java:229)
        at
org.apache.commons.logging.impl.Log4JLogger.<init>(Log4JLogger.java:65)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
Method)
        at
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAcces
sorImpl.java:39)
        at
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstruc
torAccessorImpl.java:27)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:494)
        at
org.apache.commons.logging.impl.LogFactoryImpl.newInstance(LogFactoryImpl.ja
va:529)
        at
org.apache.commons.logging.impl.LogFactoryImpl.getInstance(LogFactoryImpl.ja
va:235)
        at
org.apache.commons.logging.impl.LogFactoryImpl.getInstance(LogFactoryImpl.ja
va:209)
        at org.apache.commons.logging.LogFactory.getLog(LogFactory.java:351)
        at
org.exolab.jms.config.AttributeExpander.<clinit>(AttributeExpander.java:88)
        at
org.exolab.jms.config.ConfigurationLoader.load(ConfigurationLoader.java:97)
        at
org.exolab.jms.config.ConfigurationManager.setConfig(ConfigurationManager.ja
va:85)
        at org.exolab.jms.server.JmsServer.<init>(JmsServer.java:116)
        at org.exolab.jms.server.JmsServer.main(JmsServer.java:194)

My log4j.xml file looks like this (I tried this with a STDOUT appender, too,
and got the same error as above):

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE log4j:configuration SYSTEM "log4j.dtd">

<log4j:configuration xmlns:log4j='http://jakarta.apache.org/log4j/'>

  <appender name="openjms" class="org.apache.log4j.FileAppender">
    <param name="File" value="/var/log/openjms/openjms.log" />
    <layout class="org.apache.log4j.PatternLayout">
      <param name="ConversionPattern"
             value="%d{HH:mm:ss.SSS} %-5p [%t] - %m\n"/>
    </layout>          
  </appender>

  <category name="org.exolab">
    <priority value="DEBUG"/>
    <appender-ref ref="openjms"/>
  </category>

</log4j:configuration>

/var/log/openjms/openjms.log is owned by the user I tried running OpenJMS
as.

Are there any other changes that need to be made to get OpenJMS to run as a
non-privieged user? Or is it not possible to do that when using the HTTP
connector (which I do), or at all?

Also, on a related security note, I see that
$OPENJMS_HOME/config/openjms.policy contains this:

// grant all users all permissions. This should be modified for deployment
grant {
  permission java.security.AllPermission;
};

but I have not been able to find any information on how to change this for
production use (I do have securityEnabled=true in openjms.xml, and just use
that to authenticate users that try to send or receive messages). Are
restrictions here not yet implemented, or is there some information
available on how to modify this file for enhanced security?

Any advice would be much appreciated!

Kind regards,
Johan Hallgren