Configuring Apache without changing User and Group

Instructions for installing EPrints on Red Hat based or Debian based Linux operating systems advises that you reconfigure Apache's configuration to set the Apache User and Group to eprints tather than apache (for Red Hat based Linux) or www-data (for Debian based Linux, where these are defined as APACHE_RUN_USER and APACHE_RUN_GROUP). It is not absolutely necessary to do this but if you choose not to change this the alternative configuration is more complex and may still lead to certain EPrints functionality not working as expected if at all if yor repository has certain plugins installed or uses particular bespoke configuration.

If you choose to not configure eprints as the Apache User and Group you need to perform the following steps instead. If you want to make these changes to an existing EPrints repository, it is sytrongly recommend that you do this on a pre-production test system first, so you can fix any snags.

1. Add the eprints user to the apache or www-data group, (depending on the Linux OS you are running).

usermod -a -G apache eprints
usermod -a -G www-data eprints

2. Add the apache or www-data user, (depending on the Linux OS you are running), to the eprints group.

usermod -a -G eprints apache
usermod -a -G eprints www-data

3. Ensure that all the files and directories have the same permissions for the group as for the user. If you are just starting you installation of EPrints this can be achieved with one of the following command depending on whether you want other users to have read access to EPrints code, configuration and data. Choose the former if you don't want other users to have read access

chmod 2770 /opt/eprints3
chmod 2775 /opt/eprints3

If you already have an EPrints repository changing the permission is slightly trickier. In theory, it should suffice to add just group write permissions to all files and directories. (This may take some time if you have a lot of items in your archive).

chmod -R g+w /opt/eprints3

However, depending on how your permissions are current set, this may not be sufficient and therefore is not recommended to follow these instructions allowing you to retain the original Apache User and Group, unless you have a good understanding of Linux filesystem permissions and how to use Apache's error logs to debug any issues that may result from the change.

4. If you previously configured to use eprints as the Apache User and Group, change these back to their original values (e.g. apache in ,tt> /etc/httpd/conf/httpd.conf for Red Hat based Linux and www-data in /etc/apache2/envvars for Debian based Linux).

5. Check you Apache configuration is still valid and then restart Apache. (Use apache2ctl rather than apachectl for Debian based Linux).

apachectl configtest
apachectl restart

6. Particularly if you are changing an existing EPrints repository rather than creating a new one, thoroughly test all functionality for your repository. In particular any functionality that interacts with other applications or services. E.g.

• Logging into your repository, particularly if you don't use local authentication (e.g. you use LDAP, Shibboleth, etc.)
• Creating new eprint records.
• Uploading and downloading documents.
• Check that abstract pages update are changing eprint records.
• Check browse view menus update after running epadmin refresh_views
• Searching for items. Particularly those newly added since following these instructions.
• Adding/editing phrases in the phrase editor.
• Starting and stopping the EPrints Indexer.
• Sending a test email.
• Any bespoke plugins/functionality you have added to your EPrints repository.

If everything is working as expected, then you are done. If you hit an problems, trying using Apache's error logs to debug and fix the files with incorrect permissions. If some functionality is still broken, then you may want to revert. It should be sufficient to just change the Apache User and Group and group back to eprints and restart Apache.