Ensuring That ClientIP Headers Are Valid

Configuring Security 5-19

5.9 Running webcached with Root Privilege

On UNIX, you must configure webcached to run with root privilege in the following cases: ■ Privileged port numbers less than 1024 are being used for Oracle Web Cache listening ports. ■ There are more than 1,024 file descriptors being used for connections to Oracle Web Cache. ■ The current opmnctl user does not match the configured process identity user in the Process Identity page Properties Process Identity of Oracle Web Cache Manager. This section contains the following topics: ■ Section 5.9.1, Configuring Process Identity ■ Section 5.9.2, Configuring Root Privilege for Privileged Ports and More than 1,024 File Descriptors ■ Section 5.9.3, Configuring Root Privilege for the Current User ■ Section 5.9.4, Reverting Permissions Back to Installation State

5.9.1 Configuring Process Identity

By default, the user that performed the installation is the owner of Oracle Web Cache processes. This user can execute opmnctl commands. Users that belong to the same group ID of the user that performed installation can also execute opmnctl commands. If the current opmnctl user does not match the configured user in the Process Identity page of Oracle Web Cache Manager, the Oracle Web Cache webcached executable must run as root. If the webcached executable is not able to run as root, error events are reported to the event log file, and Oracle Web Cache fails to start. To change the user ID and group ID for the Oracle Web Cache processes on UNIX:

1. From Oracle Web Cache Manager, in the navigator frame, select Properties

Process Identity . See Section 2.7.2 . The Process Identity page appears.

2. Select the cache for which you want to modify settings, and then click Change

IDs. The Change Process Identity dialog box appears.

3. Enter the new user in the User ID field and the group ID of the user in the Group

ID field.

4. Click Submit.

5. Use the webcache_setuser.sh script as follows to change file and directory ownership: webcache_setuser.sh setidentity user_ID where user_ID is the user you specified in the User ID field of the Process Identity page. The setidentity command changes the ownership of the following files and directories to the new user ID: ■ webcache.xml configuration file in: 5-20 Oracle Fusion Middleware Administrators Guide for Oracle Web Cache UNIX ORACLE_INSTANCEinstance_nameconfigWebCachewebcache_name Windows ORACLE_INSTANCE\instance_name\config\WebCache\webcache_name ■ Event and access log files in: UNIX ORACLE_INSTANCEdiagnosticslogsWebCachewebcache_name Windows ORACLE_INSTANCE\diagnostics\logs\WebCache\webcache_name 6. Restart Oracle Web Cache using opmnctl. See Section 2.13.1 .

5.9.2 Configuring Root Privilege for Privileged Ports and More than 1,024 File Descriptors

For a configuration with privileged ports or to increase the file descriptor limit for Oracle Web Cache, you have two options: ■ Raise the limit for the particular user that is running Oracle Web Cache. Oracle recommends this mechanism. Refer to operating-system documentation for further information about raising the limit for a user. ■ Use the setroot command of webcache_setuser.sh to provide Oracle Web Cache with root privilege without requiring changing the process identity settings Every time you upgrade Oracle Web Cache or apply a patch, the Oracle Web Cache binaries are relinked implicitly. Therefore, you must rerun the setroot command, as specified in the following procedure. To use the setroot command of webcache_setuser.sh: 1. From ORACLE_HOMEwebcachebin, execute: webcache_setuser.sh setroot user_ID where user_ID is the user that performed installation. See Section 5.10 for further information about the webcache_setuser.sh script. 2. Log out of the computer, and re-login as the user that installed Oracle Application Server. 3. Restart Oracle Web Cache using opmnctl. See Section 2.13.1 .

5.9.3 Configuring Root Privilege for the Current User

For a configuration in which the current user does not match the configured user settings, change the process identity of the Oracle Web Cache processes and use the setidentity command of webcache_setuser.sh to provide Oracle Web Cache with root privilege: 1. Change the process identity of the Oracle Web Cache processes. Oracle recommends running Oracle Web Cache using a restricted user. See Section 5.9.1 for instructions on setting the group ID and user ID to establish process identity. 2. Use the webcache_setuser.sh script as follows to run Oracle Web Cache as a different user and add set-user ID permission to the webcached executable: webcache_setuser.sh setidentity user_ID where user_ID is the user ID you specified in Step 2. See Section 5.10 for further information about the webcache_setuser.sh script. 3. Log out of the computer, and re-login as the user you configured in Step 2.