Added security advice to INSTALL.mir concerning readability of log files

[mir.git] / doc / INSTALL.mir

diff --git a/doc/INSTALL.mir b/doc/INSTALL.mir
index 58d747d..e2174ca 100755 (executable)
--- a/doc/INSTALL.mir
+++ b/doc/INSTALL.mir
@@ -7,7 +7,7 @@ prerequisites:
 - apache with mod_jk.so 
 - postgres 7.1.x
 - ant (a java-based make) 
-
+- jaxp-1.1 (a SAX 2.0 compliant XML parser, comes with ant >= 1.4)
 
 1. checkout the cvs
 
@@ -34,7 +34,7 @@ now customize config.properties for your needs.
         chmod 755 build.sh
 
 
-4. copy the mir/template-dist-directory to mir/template 
+4. copy the mir/templates-dist-directory to mir/templates
 
 
 5. compile
@@ -47,22 +47,54 @@ you installed the "mir" directory).
        cd /usr/share/tomcat/webapps
        ln -s Mir-install-dir Mir
 
+7. Modify your tomcat startup script and add an LD_LIBRARY_PATH variable
+that points to the WEB-INF/lib directory of your Mir install dir. (called
+"Mir"). Add something like the following at the top of tomcat.sh (tomcat.sh
+is found in the "bin/" dir. under $TOMCAT_HOME):
+    LD_LIBRARY_PATH=/path/to/Mir-install-dir/WEB-INF/lib
+
+An alternaive way to avoid this is to copy any dynamic library files 
+ending with ".so" in WEB-INF/lib to your jre/jdk lib directory (where the 
+other ".so" files live). Or, you can skip the whole thing and live without
+"native" acceleration for image manipulation
+
 
-7. create a new database 
+8. create a new database 
 the database name should be the same as in config.properties
 as user postgres: 
        createdb dbname 
 
 
-8. create base table
+9. create base table
        psql -Upostgres dbname < dbscripts/create_pg.sql
-       cat dbscript/help*.sql | psql -Upostgres dbname
+       cat dbscripts/help*.sql | psql -Upostgres dbname
+       cat dbscripts/populate*.sql | psql -Upostgres dbname
+
+10. Add the dupe prevention trigger to the database:
+       cd dbscripts/dupetrigger
+       
+       There, read INSTALL and follow the instructions.
+       
+
+11. Set permissions
+       We provide a script that sets all files' and direcories' permissions to
+       a quite reasonable state. The most important thing you have to do after
+    the invokation of this script is to ensure that the log files --
+    especially dbentity.log -- are not readable by users that could
+    compromise system security, because all passwords and the like will
+    be logged here.
+       
+       cp perms.sh-dist perms.sh
+       # Now, change the install directory and group in perms.sh
+       edit perms.sh 
+       ./perms.sh
+
+
 
-9. chmod 777 Mir/log 
 
-10. restart tomcat 
+12. restart tomcat 
 
-11. configure mod_jk 
+13. configure mod_jk 
 
 insert the following patch into /etc/apache/httpd.conf. Edit the directories
 to suit your needs.
@@ -78,7 +110,7 @@ If mod_jk.conf-auto doesn't get written or is 0 bytes in size, check your
 system for file ownership/permissions problems.
 
 
-12. Add a password to your PostgreSQL user and link it to Mir (optional)
+14. Add a password to your PostgreSQL user and link it to Mir (optional)
 
 Add a hard to guess password to the PostgreSQL user database: