To Run the Directory Server as a Non-Root User

On UNIX, MFDS can run as a non-root user on a port number equal or greater than 1024. When running MFDS as a non-root user you must consider the following:

• Ensure that the mfds32 process has appropriate file permissions for:
  • Its initial configuration file.
  • The repository files.
  • The Journal.
  • Programs it executes, for example, casstart.
• All regions started from the MFDS user interface will run under the default user ID specified on the Options page, if there is one; or under the same user ID as mfds32 if no default user ID is configured. So you must either start your regions from the command line or ensure that this account (the default user ID or the mfds32 user ID) also has all the necessary permissions for resources used by Enterprise Server and Enterprise Server-hosted applications.
• Check UNIX resource limits (ulimit command) for the account, and ensure that MFDS and any child processes will not be killed if they exceed CPU time limits or resource restrictions.

You can use the CCITCP2_PORT environment variable to bind to a non-standard port, but this option should be used with caution, as some programs depend on Directory Server using the default port (86). If you do set CCITCP2_PORT, ensure it is set in the environment for Enterprise Server regions and COBOL programs which use the directory server.

From Enterprise Server 6.0, if MFDS is run as the root user, and a default user ID is configured for it on the Options page, then after binding to the port MFDS will change its process user ID to the specified user ID (dropping root privileges). The above considerations also apply if a default user ID is configured for MFDS. See Syntax for specifying a default user ID in mfds for more information.