JIRA Datacenter cluster SMB shared directory technical question

[Attila Süttő]

Hello!

We would like to set up a Linux-based high-availability SMB file share to function as the shared home directory for a Jira Datacenter Windows cluster. During our tests, we were only able to achieve this by referencing the path in the cluster.properties configuration file without authentication. However, this raises security concerns for us, so I would like to inquire if there is a way to specify a username and password in the Jira configuration file. I couldn't find any reliable information on this. Or, if this is not possible, what solution would you recommend? Is it necessary to integrate Active Directory into the Linux environment where the file share is running?

Thank you in advance!

Best Regards,

Attila

[Radek Dostál · Accepted solution]

I don't think it's an option, it probably would also pose significant performance problems seeing as Jira has to work with the file system quite a lot. Like a lot.

You might want to bounce this with https://support.atlassian.com/contact to be sure, but I doubt it, only ever heard of database config encryption (https://confluence.atlassian.com/adminjiraserver0903/advanced-encryption-1167688956.html) but nothing about local or shared homes as such, again, I think it would pose too great of a performance impact. Jira has to access those freely and at any point in time.

[Attila Süttő]

We would like to implement the shared file system section highlighted in the Running Jira Data Center in a Cluster article (https://confluence.atlassian.com/adminjiraserver/running-jira-data-center-in-a-cluster-993929598.html), as we are building a Data Center cluster. We want to set up a high-availability file storage system to host the following directories and data for the individual nodes: attachments, avatars/profile pictures, icons, export files, import files, plugins, cluster status, and synchronization data.

Why does this cause a performance issue if it's an official recommendation? Also, is there no way to access the recommended file share with authentication? For example, if we create a user and specify it in the cluster.properties file? From an information security perspective, it’s problematic that this area can only be offered to the system with anonymous read-write-execute permissions, meaning it can only function without authentication.

Thanks,

Attila

[Radek Dostál]

You were asking about adding authentication to access a drive. Not how to add a drive.

It's not an "anonymous read-write-execute" permissions, you can obviously keep all the data restricted to your jira user since that is the only, ahem, jira user that needs to access it. Feel free to 700 it.

[Attila Süttő]

I suspect you are referring to the service user. Our issue is that the file server and the app server don’t share a common user database. So it's important to note that the Samba server is not an AD member and uses local user authentication. Therefore, it’s only possible to connect to the share with a username if the Jira service can authenticate itself.

[Radek Dostál]

Hm, that's not a setup familiar to me, but if that is the case then it won't work. The cluster config file only expects a path and nothing else, so like said earlier, I really don't think that any kind of auth can be done there, I don't recall ever hearing about it.

[Attila Süttő]

I understand, thank you. We will then move towards an AD-integrated configuration.