1

The title might not be explanatory enough but I couldn't find any better way to formulate it. I will be running a server for office use. It will host applications on tomcat. 2 differents people would be deploying the application they are working on (office policy, all developers should be familiar with it).

I know there is ACL module at HDD level but I think it would be an overkill to do that for this purpose. Beside its usage is not so clear to me as I would want to use it in a a way where I could list allowed actions like listed below , allowed for an user or group as opposed to listing the users/groups who are allowed for a particular resource/script etc.

I would like to create a group which would be giving a particular set of privileges such as:

  • create a folder in /opt/tomcat*/webapps * there could be different instances
  • start/stop/restart a particular tomcat servive example service tomcat-1 start
  • start/stop/reload/restart apache2 for reverse proxy purpose
  • edit /etc/apache2/sites-available for reverse proxy purpose
  • activate/deactivate sites using a2ensite or a2dissite

How can I achieve that in Ubuntu?

Thanks in advance

EDIT:

Thanks to bacon, I got some going. But I looks like there are few kinks. I created the users user1, user2, user3 and added them to the group deployers. All tomcat instances created with tomcat-user are inside /opt/tomcat7/ so I changed the user ownership of the folder to tomcat7 and the group owner ship to deployers and chmod to 775. I have made a copy of /etc/init.d/tomcat7 to suit each of my instances and added them to update-rc.d. with visudo I have created DEPLOYERS Cmnd_Alias and configured it as shown below:

Cmnd_Alias    DEPLOYERS= /etc/init.d/tomcat_instance_1,/etc/init.d/tomcat_instance_2,/sbin/sh,/usr/bin/service
%deployers    ALL=(ALL) DEPLOYERS

I have logged in with user1 credentials and I still can't run /etc/init.d/tomcat_instance_1 start because it says "You need root privileges ...".

I thought the Command Alias would take care of that. Can anyone shed the light thanks?

1 Answer 1

2

This is a nice tutorial for adding users to a group If you give that groups rights to the folder than that should solve your first problem and your fourth problem.

I would solve the rights for stating and stopping Apache and Tomcat by giving limited sudo rights for specific commands. This can be done using sudo visudo to edit the /etc/sudoers file. A nice tutorial can be found here.

I'm not sure about your fifth question but I'm guessing one of the above solutions apply's

3
  • pretty interesting, thank you for the post, I will digest and revert. Feb 24, 2014 at 17:56
  • I have tried couple of things regarding the links you shared. Seems am still not good to go. Kindly check in your free time. Thanks Mar 3, 2014 at 9:43
  • @black sensei Sorry for the delay, 2 things 1)dit you prepend sudo to your command. I think your still supposed to. 2) your probably supposed to add the exact command: /etc/init.d/tomcat_instance_1 start
    – bacon
    Apr 7, 2014 at 21:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .