Security - eXist: A NoSQL Database and Application Development Platform - page 176

• $EXIST_HOME/tools/jetty/tmp (configured in $EXIST_HOME/tools/jetty/etc/
jetty.xml )
• $EXIST_HOME/tools/jetty/work (configured in $EXIST_HOME/tools/jetty/etc/
webdefault.xml )
In addition, the personal group will need read and write access to the folder contain‐
ing the .pid file if you are using the service wrapper (see $EXIST_HOME/tools/wrap‐
per/bin/exist.sh ) and the temporary folder used by your system's JVM (this varies
depending on the JVM vendor, the version, and the operating system).
Depending on which operating system you installed eXist on, there are slightly differ‐
ent approaches to configuring eXist to run under an unprivileged account. We will
assume that you have created the unprivileged account and set the permissions on
the $EXIST_HOME folder and its contents correctly.
Linux platforms
The recommended way to run eXist as a service (system daemon) on Linux is using
the Java Service Wrapper shipped in $EXIST_HOME/tools/wrapper and discussed in
“Windows Linux and Other Unix” on page 407 . If you are not taking that approach, we
will assume that you know enough about Linux to complete the configuration your‐
self. If you are using the Java Service Wrapper, then you simply need to change the
file $EXIST_HOME/tools/wrapper/bin/exist.sh by uncommenting the following line
in that file and setting it to your unprivileged account (replace existsrv with the cor‐
rect user):
RUN_AS_USER= existsrv
You will also need to ensure that this user has execute access on $EXIST_HOME/
tools/wrapper/bin/exist.sh , as this will be called when the system service is started. It is
also worth remembering that when installing the Java Service Wrapper, you must
perform this as a user who has root access, either through sudo or directly, as the
wrapper will install files into /etc .
Solaris platforms
eXist ships with support for the Solaris SMF (Service Management Framework); see
“Solaris” on page 406 . The documentation provided in the $EXIST_HOME/tools/
Solaris/README.txt file explains in detail how you can trivially configure the user
account and group that eXist runs under.
Windows platforms
Providing that you opted to install eXist as a service during installation, you are
already running eXist using the Java Service Wrapper integrated with Windows Serv‐
ices. If you did not install eXist as a service, you can do this by either using the appro‐