Software Infrastructure : Installation Notes

This page last changed on Nov 03, 2007 by kgomes.

I had already setup Alfresco 1.3 before writing up these installation instructions. 1.3 had some issues and so I upgraded to 2.0 and included those installation instructions here. I first setup a test installation on the machine prey to make sure it could do all we wanted it to. I originally wrote these instructions for the install on prey and then updated them as I installed on oceana (production server).

In order to install Alfresco, I needed Java and a database installed. On the original installation, I used a database on Solstice (MSSQL) as this was our institutional database server. One of Alfresco's big draw back was its performance and I suspect it might have had something to do with a remote database. For that reason, I installed Alfresco so it was a completely local installation using MySQL as the database server. Prey is a Itanium II server running RedHat Enterprise 4. Oceana is an AMD Opteron box running RHE4.

Test Machine Installation Difference

I also setup a test machine to help Alan Lash have something to develop against and for me to test somethings like using MS SQL Server instead of my SQL. I will write notes where the instructions differ. I setup the test machine on ssdsdevpc.shore.mbari.org which is an HP desktop machine running Fedora Core 7.

I downloaded and installed BEA's JRockit JVM to use for this installation. (J2SE 5)
I downloaded Alfresco 2.0 (tomcat version) from alfresco.org (the tar.gz file and moved it to /opt)
Test Machine Installation Difference

On the test machine, I installed Alfresco 2.1 tomcat version

MySQL was already installed in RHE4 so I was good there (MySQL version 5.0.27). I simply turned on the mysql service.

Test Machine Installation Difference

I.S. was hoping to get Alfresco to run against the institutes MS SQL Server for support reasons so on the test machine, I used a database named 'Alfresco' on our database server solstice.shore.mbari.org. Neil created the database for me and the user DB_Collaboration was used to access it.

At first there is no root password on mysql, so I changed it using the 'mysql' utility like so (Note the password was removed here.):

[root@prey ~]# mysql
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 5 to server version: 5.0.27-standard

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> use mysql;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> UPDATE user SET password=PASSWORD('*******') WHERE User='root' and Host='localhost';
Query OK, 1 row affected (0.02 sec)
Rows matched: 1  Changed: 1  Warnings: 0

mysql> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.00 sec)

mysql>

Now I enabled root access from my desktop so I could use the MySQL Admin GUI like so:

mysql> GRANT USAGE ON *.* TO 'root'@'skagit.shore.mbari.org' IDENTIFIED BY '********';
Query OK, 0 rows affected (0.00 sec)

mysql>

BTW, PHP 5.1.4 was already installed (this is optional for Alfresco)
Test Machine Installation Difference

Fedora core 7 had 5.2.2 installed
I cd'd to the /opt directory and gunzipped the alfreco tar.gz file
I created a directory for alfresco as the tar.gz file does not have a base directory. I created a directory called alfresco-2.0
Test Machine Installation Difference

I named the directory alfresco-2.1
I then moved the tar into the alfresco-2.0 directory
Test Machine Installation Difference

alfreso-2.1 directory
I cd'd into that directory and untarred it.
In order to setup the DB on the mysql server, I cd'd to the /opt/alfresco-2.0/extras/databases/mysql directory and started up 'mysql -u root -p' and ran
```
mysql> source db_setup.sql
Query OK, 1 row affected (0.01 sec)

Query OK, 0 rows affected (0.00 sec)

Query OK, 0 rows affected (0.00 sec)

mysql> 
```
The database is now created and the appropriate permissions are given to a user name 'alfresco' with password 'alfresco'. That should be fine for now.

I did the optional OpenOffice install by visting openoffice.org and downloading verion 2.2 for linux.

This may not always be the case, but I had a previous install of OpenOffice which I wanted to remove first
1. I first ran 'rpm -qa | grep openoffice > rmlist' which gave me a list of all rpms with openoffice in them.
2. I looked over the list to make sure I really wanted to remove everything in that list (I did) and then ran 'rpm -e `cat rmlist`'
I kept the download in my home directory as this will be an RPM based install
I unzipped the download
I untarred the download (this created an OOF680_m14_native_packed-1_en-US.9134 directory)
I cd'd into the new directory and then into the RPMS directory
I already had java installed, so I moved the jre-6-linux-i596.rpm out of this directory
I then installed the OpenOffice core by running 'rpm -Uvh --prefix /opt/openoffice-2.2/ *.rpm'
It said I was missing two dependencies (libgnomevfs and libgconf), but they look like they are located in /usr/lib64. Since I think I have them, I ran the previous command with --nodeps appended to skip dependency checking
I then cd'd into the desktop-integration directory and executed
1. rpm -Uvh openoffice.org-redhat-menus-2.2-9119.noarch.rpm
Now run /opt/openoffice-2.2/program/soffice to get the GUI interface which will allow you to register soffice (run this as the user that will be running alfresco/soffice)
Exit OpenOffice
Run OpenOffice in headless mode to make sure it runs. Before you run OpenOffice in headless mode you may have to actually install Xvfb so you can run from the command line (I leave that to you to figure out).
1. /usr/bin/Xvfb -fp /usr/share/X11/fonts/misc :1 -screen 0 800x600x16 &
2. /opt/openoffice-2.2/program/soffice "-accept=socket,host=localhost,port=8100;urp;StarOffice.ServiceManager" -nologo -headless -
  display :1
Cntl-C out of soffice (assuming it ran)

Now cd to /opt/alfresco-2.0 and rename the zstart_oo.sh to start_oo.sh and edit so that it looks like the following:

#!/bin/sh
# ---------------------------------------------------------------------------
# Start script for the OpenOffice transform service
# ---------------------------------------------------------------------------
export DISPLAY=:1
echo "Starting Xvfb..."
`/usr/bin/Xvfb -fp /usr/share/X11/fonts/misc :1 -screen 0 800x600x16` &

echo "Starting OpenOffice service..."

# Comment or uncomment the appropriate location using #
# Assumes OpenOffice is installed in /opt
/opt/openoffice-2.2/program/soffice "-accept=socket,host=localhost,port=8100;urp;StarOffice.ServiceManager" -nologo -headless -nofirststartwizard -display :1 &

Test Machine Installation Difference

This was a bit different in FC7. In order to get Xvfb installed I used "Add/Remove Software" to install it. OpenOffice was already installed so I just had to find the soffice command location. The command to get Xvfb running was also a bit different. I had to create a ascii file called /etc/xvfb-auth.cfg that only had one line in it that read 'localhost'. Then the command to start Xvfb was 'Xvfb :1 -auth /etc/xvfb-auth.cfg'. Then I could start soffice the same way. I changed the start_oo.sh file to reflect those commands.

In order to make sure Alfresco was using the MySQL installation, I removed the following files from the /opt/alfresco-2.0/tomcat/shared/classes/alfresco/extenstion directory:
```
custom-db-and-data-context.xml
custom-db-connection.properties
custom-hibernate-dialect.properties
```
Test Machine Installation Difference

Did not do this

Now before running, I want to make sure the configuration points to the right location where the data will be stored and the database connections.

I created a directory /data/alfresco-2.0 to house the data
Test Machine Installation Difference

/data/alfresco-2.1
I cd'd to /opt/alfresco-2.0/tomcat/shared/classes/alfresco/extensions
I copied the custom-repository-context.xml.sample to custom-repository-context.xml
Test Machine Installation Difference

This file already existed and was no different from the sample, so I skipped this step
I copied the custom-repository.properties.sample to custom-repository.properties

I edited the custom-repository.properties file:

Test Machine Installation Difference

This file already existed and so copied the original to custom-repository.properties.orig and edited the existing one.

Set the dir.root=/data/alfresco-2.0/data
Uncommented the db.* properties and left as is (that is the way I set them up)
Test Machine Installation Difference

I changed them to work with the MS SQL Server login so they looked like:
db.username=DB_Collaboration
db.password=********
db.pool.initial=10
db.pool.max=100
I commented out the two HSQL connection lines

Uncommented the two MySQL connection lines and changed the driver to 'com.mysql.jdbc.Driver'

Test Machine Installation Difference

Left the MySQL lines commented out, but uncommented the SQLServer lines and changed them to
db.driver=net.sourceforge.jtds.jdbc.Driver
db.url=jdbc:jtds:sqlserver://solstice.shore.mbari.org/Alfresco;domain=SHORE;user=DB_Collaboration;password=******

I also added the following lines at the end of the file to connect up to the external mail server

# 
# The external email server properties
#
mail.host=mail.shore.mbari.org
mail.port=25
mail.username=
mail.password=

Saved the file

I copied custom-hibernate-dialect.properties.sample to custom-hibernate-dialect.properties
Test Machine Installation Difference

Already existed, so backuped up to .orig and edited to comment out the HSQL and uncomment the SQLServer one.

I edited the custom-hibernate-dialect.properties file and uncommented the MySQL Dialect line

Test Machine Installation Difference

The downloaded alfresco already has the MySQL driver jar in the install, but since I am using SQLServer, I downloaded the jtds driver from the internet and installed the jtds-X.X.X.jar file in the /opt/alfresco-2.1/tomcat/common/lib to make it available to alfresco.

I then cd'd back to the /opt/alfresco-2.0 directory and edited the alfresco.sh script and change the APPSERVER to point to the correct directory of /opt/alfresco-2.0. I also added the following line after the line that stated 'killall soffice.bin':
killall Xvfb. That ensured the Xvfb process was killed when alfresco was shutdown.

Test Machine Installation Difference

Set it to /opt/alfresco-2.1/tomcat for the test machine

In the tomcat version of alfresco, the actual alfresco deployment is in a .war file in the tomcat/webapps directory. If the server has been started, the .war gets expanded into a directory and you could make changes to the files there, but if the war file was ever "touched" again, it would redeploy those file and overwrite your changes. That is why it is best to make the changes in the .war file so they are permanent

Test Machine Installation Difference

For the test machine, I wasn't too worried about details, so I skipped the next 15 or so steps (picks up again at configuring for MBARI LDAP below.

Copy the /opt/alfresco-2.0/tomcat/webapps/alfresco.war file to your home directory
cd to your home directory and make another copy so you will have the original (something like alfresco.war.orig)
Now I created a new directory called 'scratch' and moved the war there so that it was a clean directory for expansion. I moved the alfresco.war file to that directory, cd'd to it and then ran 'jar -xvf alfresco.war'. This expands the contents of the war file (like tar).
I also wanted to change the "Company Home" that seems to be everywhere.
1. Edited ./WEB-INF/classes/alfresco/messages/webclient.properties and changed company_home from 'Company Home' to 'MBARI'
2. Edited ./WEB-INF/classes/alfresco/messages/webclient_en_US.properties and changed company_home from 'Company Home' to 'MBARI'
3. I edited ./WEB-INF/classes/alfresco/messages/bootstrap-spaces.properties and changed the first two lines to read
```
spaces.company_home.name=MBARI
spaces.company_home.description=The root space for MBARI
```
4. Edited ./WEB-INF/classes/alfresco/messages/bootstrap-spaces_en_US.properties and made the same changes as the previous step
  
  This took a bit to find all these, and to be honest, I am not sure which one actually made the change on the GUI, but I suspect it was the _en_US ones.
When users are imported via LDAP, user spaces get created automatically. In order to put them where I wanted them to go (instead of right in the Company Home), I edited the ./WEB-INF/classes/alfresco/authentication-services-context.xml file. In the file there is a bean with an name of personalHomeFolderProvider. There is a property name 'path' and I added
```
/${spaces.user_homes.childname}
```
to the end to try to get them to create the user spaces there instead of in the Company Home.
I wanted to change the logo that is used. I attached the replacement logo here. Copy this to ./images/logo and overwrite the one that is there.

In order to setup SSL for the application (will do that later), edit ./WEB-INF/web.xml and add the following

   <!-- Added this security constraint to allow for SSL protection -->
   <security-constraint>
      <web-resource-collection>
         <web-resource-name>Login Pages</web-resource-name>
         <url-pattern>/*</url-pattern>
      </web-resource-collection>
      <user-data-constraint>
         <transport-guarantee>CONFIDENTIAL</transport-guarantee>
      </user-data-constraint>
   </security-constraint>

In order to configure CIFS server, I edited the file ./WEB-INF/classes/alfresco/file-servers.xml

I added 'domain="SHORE' to the <host ...> tag.
I made sure the domain broadcast submask was 255.255.255.255

I uncommented the WINS section and changed it to

      <WINS>
         <primary>134.89.10.32</primary>
         <secondary>134.89.12.87</secondary>
      </WINS>

I deleted the enterprise authenticator and replaced it with this:

 	<config evaluator="string-compare" condition="Filesystem Security">
 	    <authenticator type="passthru">
 	        <Server>blizzard.shore.mbari.org</Server>
                <Domain>shore</Domain>
 	    </authenticator>
 	</config>

OK, this is a total HACK and needed to be done due to the wonderful world of open source. In Internet Explorer with SSL turned on, you would get a dialog pop-up that stated the secure server was trying to serve non-secure content. This was due to the Alfresco Community logo being served from http://www.alfresco.com. Only IE did this and you can work around it on the client end by doing the following:
1. Startup IE.
2. Go to Tools->Internet Options ...
3. Click on Security tab
4. Click on "Trusted Sites" zone
5. Click on Sites button
6. Make sure check box for "Require Server verification (https for all sites in this zone" is unchecked 7. Type in "http://www.alfresco.com" into the "Add this website to the zone:" text field and click Add.
7. Click on close
8. Make sure "Trusted Sites" is still selected.
9. Click on "Custom Level..." under Security level for this zone.
10. Scroll down till you find the option that says "Display Mixed Content" and select "Enable"
11. Click on OK
12. Click on the "Local Intranet" zone.
13. Click on "Custom Level..." under Security level for this zone.
14. Scroll down till you find the option that says "Display Mixed Content" and select "Enable"
15. Click on OK
16. Click on OK to close Internet Options dialog.

Now there are a couple of reasons why this is bad, but the main one is that if you are trying to reach this from outside the firewall, you will have to change those settings for the Internet Zone (I think) which is bad. Plus every user will have to do this. To get around this, I had to:

Take this logo image and save it to ./images/logo directory.

This next step can either be very easy or very complicated. You can try downloading this jar file and copying it to ./WEB-INF/lib. If when you start up Alfresco you get some exceptions that look like they are related to a class called PageTag, you will have to do it the hard way:

Now you have to actually check out the subversion source code from Alfresco. I am assuming you know how to do that. By the way, you will need ant and java installed to do this. The SVN URL for the repository is svn://www.alfresco.org/alfresco.

Once it is checked out find the PageTag.java file (should be in HEAD/root/projects/web-client/source/java/org/alfresco/web/ui/repo/tag directory) and edit:

Change the line

   private final static String ALF_LOGO  = "http://www.alfresco.com/images/alfresco_community_horiz20.gif";

to:

   private final static String ALF_LOGO  = "/alfresco/images/logo/alfresco_community_horiz20.gif";

Save the file.

If you run this next step on the machine where the application is installed and have a TOMCAT_HOME environment variable defined, it will try to deploy everything to your Tomcat installation. The best thing to do is build this on a separate machine.

Open a command prompt in the HEAD/root directory and type "ant build-tomcat". After a long wait, the build will actually fail if you don't have a TOMCAT_HOME defined in your environment.
Once the build has failed you will need to create a new jar file called a0.jar with only the PageTag.class file in it.
Copy the a0.jar file to the ./WEB-INF/lib directory.

That takes care of all the changes to the WAR file. We can now put it back into .war form.
You should still have a alfresco.war file in the directory where you ran the jar -xvf command. Delete or move that file out as you will be recreating it.
While you are in the directory you expanded the war file in, run
1. jar cvfm alfresco.war META-INF/MANIFEST.MF .
You should now have an alfresco.war file in the directory. Move that back to the alfreco install and overwrite the existing one.
1. mv alfresco.war /opt/alfresco-2.0/tomcat/webapps

Most users like the details view, so I set the default to that by editing /opt/alfresco.2.0/tomcat/shared/classes/alfresco/extensions/web-client-config-custom.xml and added:

<!-- MBARI Custom: Added this to change the default view to details -->
<config evaluator="string-compare" condition="Views">
      <!-- the views available in the client -->
      <views>
         <!-- default values for the views available in the client -->
         <view-defaults>
            <browse>
               <!-- allowable values: list|details|icons -->
               <view>details</view>
               <page-size>
                  <list>20</list>
                  <details>20</details>
                  <icons>20</icons>
               </page-size>
            </browse>
         </view-defaults>
      </views>
</config>

Now in order to use MBARI accounts, I needed to configure LDAP.

In the older version of Alfresco, I actually used NTLM to manage logins, but currently 2.0's NTLM for ActiveDirectory is broken. The supposedly have fixed it in the Enterprise version, but it has not made it to the Community edition yet. That is OK, as I will just use LDAP to authenticate.

I cd'd to the /opt/alfresco-2.0/tomcat/shared/classes/alfresco/extensions directory
I then copied the ldap-authentication-context.xml.sample to ldap-authentication-context.xml and edited to match our ActiveDirectory setup. I have attached the file to this WIKI pages instead of detailing out all the changes. The file is here
We wanted to be able to make sure we could have collaborator accounts that were not MBARI LDAP accounts so that we could have Alfresco users that had not permissions at all on the MBARI network. In order to do this, I used the Alfresco native user service and chained the authentication together with the MBARI LDAP. In order to do this, I copied the chaining-authentication-context.xml.sample to chaining-authentication-context.xml. I then edited the file to make the appropriate changes (I have also attached the changed config file here for downloading):
1. The first change was to the first bean declaration's id from authenticationServiceImpl to authenticationService.
2. In the same bean declaration, I changed the first authentication services reference from authenticationServiceImplJAAS to authenticationServiceImplLDAP
3. I then changed the JAAS bean declaration to point to the ldap declaration by changing the bean id from authenticationServiceImplJAAS to authenticationServiceImplLDAP
4. There are two properties in this bean and I had to change them to point to the LDAP configuration (these changes actually reference the services defined in the ldap-authentication-context.xml configuration file).
  1. Change the authenticationDao property's value from authenticationDaoJAAS to authenticationDaoLDAP
  2. Change the authenticationComponent property from authenticationComponentImplJAAS to authenticationComponentImplLDAP

In order to grant certain accounts admin privs, I created a new custom-authority-services-context.xml in the same directory as the ldap-authentication-context.xml file and added

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>
<beans>
    <bean id="authorityService" class="org.alfresco.repo.security.authority.AuthorityServiceImpl">
        <property name="authenticationComponent">
            <ref bean="authenticationComponent" />
        </property>
        <property name="personService">
            <ref bean="personService" />
        </property>
        <property name="nodeService">
            <ref bean="nodeService" />
        </property>
        <property name="authorityDAO">
            <ref bean="authorityDAO" />
        </property>
        <property name="permissionServiceSPI">
            <ref bean="permissionServiceImpl" />
        </property>
        <property name="adminUsers">
            <set>
    			<value>kgomes</value>
    			<value>admin</value>
    			<value>administrator</value>
    		</set>
        </property>
    </bean>
</beans>

In the same directory, I edited the file-servers-custom.xml file and added a new config section

 	<!-- Allow guest access to file systems -->
 	<config evaluator="string-compare" condition="Filesystem Security">
 	 
 	<authenticator type="passthru">
 	    <Server>blizzard.shore.mbari.org</Server>
            <Domain>shore</Domain>
 	</authenticator>
 	 
 	</config>

Now, it is time to setup the server so we can login over SSL.

Test Machine Installation Difference

Did not setup SSL for the test machine

In a shell run the keytool and answer the questions as shown (note the first and last name must be the fully qualified host name where alfresco will be run)

kgomes$ sudo keytool -genkey -alias tomcat -keyalg RSA
Enter keystore password:  alfresco
What is your first and last name?
  [Unknown]:  skana.shore.mbari.org
What is the name of your organizational unit?
  [Unknown]:  MBARI
What is the name of your organization?
  [Unknown]:  Monterey Bay Aquarium Research Institute
What is the name of your City or Locality?
  [Unknown]:  Moss Landing
What is the name of your State or Province?
  [Unknown]:  CA
What is the two-letter country code for this unit?
  [Unknown]:  US
Is CN=mbari.org, OU=MBARI, O=Monterey Bay Aquarium Research Institute, L=Moss Landing, ST=CA, C=US correct?
  [no]:  yes

Enter key password for <tomcat>
        (RETURN if same as keystore password):

This will generate a .keystore file in your home directory.

Now edit the /opt/alfresco.2.0/tomcat/conf/server.xml. Locate the <Connector> element with port of 8443 and uncomment that section. Also add the keystorePass="alfresco" phrase. It should look like

    <!-- Define a SSL HTTP/1.1 Connector on port 8443 -->
    <Connector port="8443" maxHttpHeaderSize="8192"
               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
               enableLookups="false" disableUploadTimeout="true"
               acceptCount="100" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" keystorePass="alfresco"/>

I then started alfreso with './alfresco.sh start'

This takes a couple minutes as it has to first build the DB and all the indexes and such.

Wait 5 minutes

After you start up Alfresco with LDAP turned on, it takes 5 minutes before it will import users and groups from Active Directory, so go get a cup of coffee.
Then I can go to the web interface at http://oceana.shore.mbari.org:8080/alfresco and login as your MBARI username.
TODO: Make sure startup/shutdown script in /etc/init.d is working correctly
I.S. then setup backup regime to do incremental backups nightly and full backups weekly
TODO: Verify I know where the MySQL files are and that we can restore them correctly. Also turn on binary logs and use a test machine to learn (and document here) how to restore from backup.

IMPORTANT

For some strange reason, the Alfresco stack would seem to crash after 20-30 days of operation with some very cryptic errors. I found some entries in the forums about changing the ulimit value in linux. So I issued a 'ulimit -n 4096' and then restart Alfresco. I haven't seen that problem since.

Attachments:

ldap-authentication-context.xml (text/xml)

AlfrescoLogo32.png (image/png)

alfresco_community_horiz20.gif (image/gif)

a0.jar (application/octet-stream)

chaining-authentication-context.xml (text/xml)

Document generated by Confluence on Feb 04, 2026 09:02