## External Command File Permissions

Introduction

One of the most common problems people have seems to be with setting proper permissions for the external command file. You need to set the proper permission on the /usr/local/netsaint/var/rw directory (or whatever the path portion of the command_file directive in your main configuration file is set to). I'll show you how to do this. Note: You must be root in order to do some of these steps...

Users and Groups

First, find the user that your web server process is running as. On many systems this is the user nobody, although it will vary depending on what OS/distribution you are running. You'll also need to know what user Netsaint is effectively running as - this is specified with the netsaint_user variable in the main config file.

Next, create a new group called 'nscmd'. On RedHat Linux you can use the following command to add a new group (other systems may differ):

/usr/sbin/groupadd nscmd

Next, add the web server user (nobody) and the NetSaint user (netsaint) to the newly created group with the following commands:

/usr/sbin/usermod -G nscmd netsaint
/usr/sbin/usermod -G nscmd nobody

Creating the directory

Next, create the directory where the command file should be stored. By default, this is /usr/local/netsaint/var/rw, although it can be changed by modifying the path specified in thecommand_file directory.

mkdir /usr/local/netsaint/var/rw

Setting directory permissions

Next, change the ownership of the directory that will be used to hold the command file...

chown netsaint.nscmd /usr/local/netsaint/var/rw

Make sure the NetSaint user has full permissions on the directory...

chmod u+rwx /usr/local/netsaint/var/rw

Make sure the group we created has read and write permissions on the directory.

chmod g+rw /usr/local/netsaint/var/rw

In order to force newly created files in the directory to inherit the group permissions from the directory, we need to enable the group sticky bit on the directory...

chmod g+s /usr/local/netsaint/var/rw

Verifying the permissions

Check the permissions on the rw/ subdirectory by running 'ls -al /usr/local/netsaint/var'. You should see something similiar to the following:

    drwxrws---   2 netsaint nscmd     1024 Aug 11 16:30 rw

Note that the user netsaint is the owner of the directory and the group nscmd is the group owner of the directory. The netsaint user has rwx permissions and group nscmd has rw permissions on the directory. Also, note that the group sticky bit is enabled. That's what we want...

Notes...

If you supplied the --with-command-grp=somegroup option when running the configure script, you can create the directory to hold the command file and set the proper permissions automatically by running 'make install-commandmode'.