How to install Subsonic as a non-root user on Ubuntu 10.04

Tutorials, tips and tricks.

Moderator: moderators

How to install Subsonic as a non-root user on Ubuntu 10.04

Postby OM NOM NOM » Mon Jan 03, 2011 1:53 am

NOTE:These instructions were compiled from several sources and tweaked/updated by me where needed. Thanks to Zachary Lund from Lundscape.com, Baaldemon and Sean P. Keown from the Subsonic forums, The Apache Tomcat FAQ and of course Andre, all of whom did the really heavy lifting :-)
Reference: http://blog.lundscape.com/2009/05/insta ... ment-11745

Since I'm somewhat of a novice, I used the Ubuntu Desktop edition and set it up as a server. I installed Nomachine's NX Server to get remote access to the GUI when I needed it. Http://www.nomcahine.com . You'll need to also install openSSH from the repositories to get NX to work.


Why would I want to go through the trouble of doing this when I can just download and install the .deb file from Subsonic?

Because by default the .deb file will install as root, which is a significant security risk if you are going to enable external access to the server. Using this method will install Apache/Subsonic as an unprivileged user, limiting the ability of an attacker to compromise your system. It is also recommended to use port-forwarding on your router from a non-standard port to port 8080 (or whatever port you set up, default is 8080) internally on your Tomcat/Subsonic server.

What's the advantage of using the Apache Tomcat version in the Ubuntu repositories rather than downloading and installing it directly from Apache.org?

Security and convenience. Since you can install it from the repositories in Synaptic the initial setup is much easier. But most importantly it creates a user called tomcat6 and runs under that rather than root, which makes things a lot more secure. However if you are experienced Tomcat user and would rather use the traditional install that'll certainly work too.

What is Apache's Tomcat anyway?
Tomcat is a free, open source web server specifically designed to run Java-based applications like Subsonic.
More info can be found at:
http://tomcat.apache.org/

1. Install the necessary Java packages, Tomcat, and Lame:

apt-get install java-common sun-java6-bin sun-java6-jdk sun-java6-jre
apt-get install tomcat6
apt-get install lame

2. Stop Tomcat before changing the Tomcat configuration and installing the Subsonic web application.

/etc/init.d/tomcat6 stop

NOTE: in the Ubuntu repo version of tomcat6 this should be turned off by default, making this next step unnecessary. You may just want to check /etc/init.d/tomcat6 to make sure. If not, the steps below should correct it.

cd /etc/init.d/
mv tomcat6 tomcat6.bak
sed "s/TOMCAT6_SECURITY=yes/TOMCAT6_SECURITY=no/" tomcat6.bak > tomcat6
chmod +x tomcat6
rm tomcat6.bak

3. Download and extract the Subsonic 4.2 WAR file:

http://sourceforge.net/projects/subsoni ... p/download

4. Go to the directory where you downloaded the file. (in this case my Firefox Downloads folder):

cd /home/user/Downloads

5. Unzip and move subsonic.war into the webapps directory:

unzip subsonic-4.2-war.zip -d subsonic
mv subsonic/subsonic.war /var/lib/tomcat6/webapps/

6. Subsonic expects certain directories to exist. The following creates those directories and sets the permissions.

mkdir /var/subsonic
mkdir /var/subsonic/playlists
mkdir /var/subsonic/transcode
chown -R tomcat6:nogroup /var/subsonic

7. Subsonic uses Lame to transcode/compress mp3s for streaming. The next two lines make Lame available to Subsonic:

cd /var/subsonic/transcode
ln -s /usr/bin/lame lame

8. Now start Tomcat again:
/etc/init.d/tomcat6 start

Subsonic should now be running and available at http://localhost:8080/subsonic/. The port might vary depending on the installation of Tomcat. Log in. You can change the password by clicking on “Settings” and then “Users” and then selecting the admin account.

How do I override the default home page loaded by Tomcat?

If you are using port forwarding for external access to your Subsonic server, you'll want your Subsonic login page to come up as the default “index” page rather than a subdirectory from the root URL in order for forwarding to work properly. Here's how.

From:
http://wiki.apache.org/tomcat/HowTo#How ... _Tomcat.3F

After successfully installing Tomcat, you usually test it by loading http://localhost:8080 . The contents of that page are compiled into the index_jsp servlet. The page even warns against modifying the index.jsp files for this reason. Luckily, it is quite easy to override that page. Inside $TOMCAT_HOME/conf/web.xml there is a section called <welcome-file-list> and it looks like this:
<welcome-file-list>
<welcome-file>index.html</welcome-file>
<welcome-file>index.htm</welcome-file>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
The default servlet attempts to load the index.* files in the order listed. You may easily override the index.jsp file by creating an index.html file at $TOMCAT_HOME/webapps/ROOT. It's somewhat common for that file to contain a new static home page or a redirect to a servlet's main page. A redirect would look like:
<html>

<head>
<meta http-equiv="refresh" content="0;URL=http://mydomain.com/some/path/to/servlet/homepage/">
</head>

<body>
</body>

</html>
This change takes effect immediately and does not require a restart of Tomcat.
User avatar
OM NOM NOM
 
Posts: 11
Joined: Fri Mar 26, 2010 4:02 pm

Alternate Method

Postby courtarro » Tue Jan 04, 2011 4:40 pm

Since I didn't want to custom install Tomcat on my machine, but prefer to use the standard Debian install package as much as possible, I followed these steps to get Subsonic installed as a non-root user:

Install Subsonic normally using the .deb file, and configure to your liking. I put all the Subsonic stuff into one directory: /var/subsonic; this makes it easier to indicate who owns what.

First, sudo as root and shut down the Subsonic server:

Code: Select all
sudo su
/etc/init.d/subsonic stop


Add a new user for Subsonic into audio:

Code: Select all
adduser --system --no-create-home --group audio subsonic


(If you don't plan to use jukebox mode, you can leave out the "--group audio" part to leave Subsonic in nogroup). Change the owner of the Subsonic home directory, as well as its temp directory (use your own paths, if necessary). Leave the transcode and Jetty stuff unwriteable.

Code: Select all
chown -R subsonic:nogroup /tmp/subsonic
chown -R subsonic:nogroup /var/subsonic
chown -R root:root /var/subsonic/transcode
chown -R root:root /var/subsonic/jetty/*/webapp


You may also need to do this with your Podcast and Playlist folders, depending on their locations.

Now everything that Subsonic needs to write should be writable to its user. Edit the Subsonic startup script (usually /usr/share/subsonic/subsonic.sh) and add sudo -u subsonic before the Java call. It should end up looking like this:

Code: Select all
sudo -u subsonic ${JAVA} -Xmx${SUBSONIC_MAX_MEMORY}m \


Now restart Subsonic:

Code: Select all
/etc/init.d/subsonic start


Check that Subsonic is running and confirm that it is running under the "subsonic" user, not root.

Code: Select all
ps -Af | grep subsonic


I am listing these steps by memory based on what I did to get my system up and running. I may have forgotten a step. If you have problems, check /var/subsonic/subsonic_sh.log for errors. In my opinion, this should be what the Debian package does by default.

Edit: Leave Jetty and transcode owned by root, put Subsonic into audio group, as per stozher's suggestion. Fixed reference to Jetty number that changes in each release (now '*').
Last edited by courtarro on Mon Feb 14, 2011 9:42 pm, edited 4 times in total.
courtarro
 
Posts: 10
Joined: Sun Feb 07, 2010 3:36 pm

Postby stozher » Tue Jan 04, 2011 5:30 pm

:idea: +++ courtarro

Code: Select all
chown -R root:root /var/subsonic/jetty/1944/webapp
chown -R root:root /var/subsonic/transcode

Add group audio to subsonic user (needed for jukebox mode)...

:!: Remove from tutorial (this is a SS Jetty cache etc.):

Code: Select all
chown -R root:root /var/subsonic/jetty/1944/jsp
http://music.stozher.com:8080/login.view?user=guest&password=
User avatar
stozher
 
Posts: 313
Joined: Tue Nov 16, 2010 10:56 am
Location: Sofia, Bulgaria

Re: How to install Subsonic as a non-root user on Ubuntu 10.

Postby cnliberal » Mon Dec 12, 2011 10:39 pm

I'm running Ubuntu 11.10 x64 headless and I tried the ideas in this thread. Everytime I started the subsonic process, every file/folder in the /var/subsonic directory changed ownership to root:root. What is going on here? I'm pretty confused. Thanks!
cnliberal
 
Posts: 66
Joined: Fri Nov 19, 2010 12:52 am
Location: Castle Rock, CO, USA

Re: How to install Subsonic as a non-root user on Ubuntu 10.

Postby joris » Thu Jan 12, 2012 10:13 am

cnliberal wrote:I'm running Ubuntu 11.10 x64 headless and I tried the ideas in this thread. Everytime I started the subsonic process, every file/folder in the /var/subsonic directory changed ownership to root:root. What is going on here? I'm pretty confused. Thanks!


Had the same issue here. I found out that (at least in ubuntu) you can change the user in /etc/default/subsonic Than it works. No need to edit /usr/share/subsonic/subsonic.sh Make sure that you change the permissions on /etc/default/subsonic file to the subsonic user.

And that you change the user on /tmp/subsonic and /var/subsonic

Stozher: Care to explain why /var/subsonic/jetty/1944/webapp & /var/subsonic/transcode should be owned by root? I accidently chowned these to my subsonic user and subsonic seems to work... Am I just lucky?
User avatar
joris
 
Posts: 24
Joined: Sun Jan 08, 2012 4:05 pm

Re: How to install Subsonic as a non-root user on Ubuntu 10.

Postby stozher » Fri Jan 13, 2012 9:20 pm

joris wrote:Stozher: Care to explain why /var/subsonic/jetty/1944/webapp & /var/subsonic/transcode should be owned by root? I accidently chowned these to my subsonic user and subsonic seems to work... Am I just lucky?


For security reason! This is a Subsonic Jetty server files. User don't need to change those files. Prevent hacking server from SS user account...
Last edited by stozher on Fri Jan 13, 2012 9:33 pm, edited 1 time in total.
http://music.stozher.com:8080/login.view?user=guest&password=
User avatar
stozher
 
Posts: 313
Joined: Tue Nov 16, 2010 10:56 am
Location: Sofia, Bulgaria

Re: How to install Subsonic as a non-root user on Ubuntu 10.

Postby cnliberal » Fri Jan 13, 2012 9:30 pm

Please forgive me if I'm wrong, but isn't making root owner a worse idea than making the folders/files owned by a limited permissions user/service account? (And it's a serious question).
cnliberal
 
Posts: 66
Joined: Fri Nov 19, 2010 12:52 am
Location: Castle Rock, CO, USA

Re: How to install Subsonic as a non-root user on Ubuntu 10.

Postby stozher » Fri Jan 13, 2012 9:45 pm

If you chowned Jetty files to subsonic:nogroup this allow SS public user (subsonic:nogroup) to change those files and compromise your server.

subsonic.sh started server as subsonic:nogroup
Code: Select all
sudo -u subsonic ...

See above courtarro "Alternate Method"...
http://music.stozher.com:8080/login.view?user=guest&password=
User avatar
stozher
 
Posts: 313
Joined: Tue Nov 16, 2010 10:56 am
Location: Sofia, Bulgaria

Re: How to install Subsonic as a non-root user on Ubuntu 10.

Postby joris » Fri Jan 13, 2012 10:23 pm

Thanks for clearing this up stozher!

Code: Select all
chown -R root:root /var/subsonic/jetty/1944/jsp


Sorry I am probably an idiot, but I am confused should I do this or not....
User avatar
joris
 
Posts: 24
Joined: Sun Jan 08, 2012 4:05 pm

Re: How to install Subsonic as a non-root user on Ubuntu 10.

Postby cnliberal » Fri Jan 13, 2012 10:33 pm

stozher wrote:If you chowned Jetty files to subsonic:nogroup this allow SS public user (subsonic:nogroup) to change those files and compromise your server.

subsonic.sh started server as subsonic:nogroup
Code: Select all
sudo -u subsonic ...

See above courtarro "Alternate Method"...


Yes, but they'll only be able to compromise the Subsonic install, not the entire server. There should be a service account created to run the actual service. Then a separate web user.
cnliberal
 
Posts: 66
Joined: Fri Nov 19, 2010 12:52 am
Location: Castle Rock, CO, USA

Re: How to install Subsonic as a non-root user on Ubuntu 10.

Postby stozher » Sat Jan 14, 2012 12:02 am

Joris, chown to root (server work without this but security is a less)...

Code: Select all
chown -R root:root /var/subsonic/transcode
chown -R root:root /var/subsonic/jetty/*/webapp

... and start Subsonic as non-privileged user subsonic:nogroup.
http://music.stozher.com:8080/login.view?user=guest&password=
User avatar
stozher
 
Posts: 313
Joined: Tue Nov 16, 2010 10:56 am
Location: Sofia, Bulgaria

Re: How to install Subsonic as a non-root user on Ubuntu 10.

Postby spookybathtub » Fri Apr 27, 2012 9:53 pm

I just came across this guide. It's been so long that I don't remember how I installed subsonic. But looking at ps, I see subsonic is running under my account, and java is running as root. Is that still a security problem?
spookybathtub
 
Posts: 110
Joined: Thu Oct 07, 2010 7:13 am

Re: How to install Subsonic as a non-root user on Ubuntu 10.

Postby yoni5002 » Mon Apr 30, 2012 8:13 pm

spookybathtub wrote:I just came across this guide. It's been so long that I don't remember how I installed subsonic. But looking at ps, I see subsonic is running under my account, and java is running as root. Is that still a security problem?

I believe you should ensure that all processes are running under "subsonic" credentials and not as root.

I have successfully ran it for a while now and decided to post in my blog about it. Perhaps it helps others. Check it here:

http://unlockforus.com/installing-subso ... lucid-lynx

If you follow that guide you will get Subsonic up and running in 5 minutes as non root. Recommendations to improve the guide are always welcome.
yoni5002
 
Posts: 5
Joined: Thu Jan 20, 2011 9:36 am

Re: How to install Subsonic as a non-root user on Ubuntu 10.

Postby jakap » Wed Aug 15, 2012 11:31 pm

+1337 for the tutorial of yoni5002!

I would consider all other methods as at least strange. Yoni's tutorial is exactly how it should be done!

As of adding "sudo" to a script which came in via a .deb package is clearly not considered "clean", it's more of a quick-hack and you will end up with a parent process, that will still run as root. Also this will probably be broken on any upgrade via dpkg / .deb.

I repeat: better use this tutorial on all debian based systems, it rocks!
http://unlockforus.com/installing-subsonic-music-streamer-in-ubuntu-server-10-04-lts-lucid-lynx-2
jakap
 
Posts: 1
Joined: Wed Aug 15, 2012 11:19 pm

Re: How to install Subsonic as a non-root user on Ubuntu 10.

Postby alienbob » Mon Sep 10, 2012 8:24 pm

yoni5002 wrote:
spookybathtub wrote:I just came across this guide. It's been so long that I don't remember how I installed subsonic. But looking at ps, I see subsonic is running under my account, and java is running as root. Is that still a security problem?

I believe you should ensure that all processes are running under "subsonic" credentials and not as root.

I have successfully ran it for a while now and decided to post in my blog about it. Perhaps it helps others. Check it here:

http://unlockforus.com/installing-subso ... lucid-lynx

If you follow that guide you will get Subsonic up and running in 5 minutes as non root. Recommendations to improve the guide are always welcome.


Works for me! :D
alienbob
 
Posts: 6
Joined: Sun Sep 02, 2012 7:22 pm

Next

Return to Tutorials

Who is online

Users browsing this forum: No registered users and 13 guests