Confluence Home and Installation - owners and permissions

Question

I am running Confluence on Ubuntu Linux 14.10 and its working fine.

Confluence is running as a separate user called "confluence" and a corresponding group.

I have one folder for Confluence installation:
/usr/local/confluence/atlassian-confluence-5.7.4

This folder and all its subfolders are owned by the confluence user/group.

I have one folder for Confluence home:
/var/lib/confluence

This folder and all its subfolders are also owned by confluence user/group. This Confluence home folder is also home folder for the "confluence" user.

My questions:

1) What user should own Confluence installation folder?
2) What user should own Confluence home folder?
3) What should be the permissions on Confluence installation folder and subfolder/files?
4) What should be the permissions on Confluence home folder and subfolder/files?

I have not managed to find any detailed information on this, and I guess there are some security recommendations here? I tried e.g. to change owner of Confluence home folder to root, but then the site did not work (it was possible to start) - even if contents/permissions/owners of the contents of home folder was unchanged.

Any advice for a secure site?

Eitan Postavsky · Answer

Instead of http://en.wikipedia.org/wiki/Filesystem_Hierarchy_Standard, I find https://en.wikipedia.org/wiki/Unix_filesystem#Conventional_directory_layout to be much more illuminating.

steinrr · Answer

Thanks for your answers! These are in line with what I have done.

The reason for double checking this is that I read here:

https://confluence.atlassian.com/display/DOC/Creating+a+Dedicated+User+Account+on+the+Operating+System+to+Run+Confluence

Ensure that only the following directories can be written to by this dedicated user account (e.g. 'confluence'):

* The following subdirectories of your Confluence Installation Directory:* logs
* temp
* work

So if these folders are the only one requiring write access - why should the HOME folder be owned by the "confluence user" - as long as HOME folder has read access for the "confluence" user and those 3 folders have write access by the confluence user?

Is the documentation wrong on this point?

The same page also says:

Do not make the Confluence Installation Directory itself writeable by the dedicated user account.

Which is also not in line with the responses above.

I am confused.

rrudnicki · Answer

Hi Stein, 1) What user should own Confluence installation folder? You can use any user do you want. Just avoid root for security reasons. 2) What user should own Confluence home folder? Yes, and I also recommend you to have the owner on Confluence install folder 3) What should be the permissions on Confluence installation folder and subfolder/files? You can put in any folder that the Confluence user has permission to acces (read/write). A good start would be /opt, but if you want, you also can have a look on Filesystem Hierarchy Standard to better understand where should be the "correct" directory. http://en.wikipedia.org/wiki/Filesystem_Hierarchy_Standard 4) What should be the permissions on Confluence home folder and subfolder/files? If you create a user called "confluence", just use this two commands: chown -R confluence.confluence

chmod -R 775

For some reason you cannot run/login on Confluence, check if do you have apparmor and iptables enable. If so, disable them or create a rule allowing Confluence. Any advice for a secure site? Yes, don't run Conflunce as root, use strong passwords and ALWAYS have a backup :) . Regards, Renato Rudnicki