Alfresco Administrator Notes

Links

• biostats.app.vumc.org (biostats-app.gslb.vumc.org [160.129.29.77])
• biostats.mc.vanderbilt.edu ([160.129.28.251])

• https://biostats.app.vumc.org
• https://biostats.mc.vanderbilt.edu

Alfresco User Notes

Internal name is biostats.emp.vumc.io (ssh port 37212)

Alfresco

Alfresco is a free/libre enterprise content management system for Microsoft Windows and Unix-like operating systems. The Alfresco Community Edition is free software, LGPL licensed open source and open standards. See http://www.alfresco.com/.

Frequently asked questions (faq)

• Where is the main configuration file? /opt/alfresco-4.2.f/tomcat/shared/classes/alfresco-global.properties Most configuration settings are made in this file. There are a few exceptions but I don't have an exhaustive list.
• Where can I find Alfresco documentation?
  • Alfresco Community Edition 5.1 Documentation
  • Alfresco Community 4.2 Documentation
  • Alfresco's YouTube channel - A number of videos produced by Alfresco. Some don't apply to our installation (we are running the "community" version), but most are applicable.
  • There is some helpful information in the Indiana University knowledge base: https://kb.iu.edu/search?q=alfresco&s=15
• folders vs spaces vs sites?
  • A more complete discussion of "spaces": http://wiki.alfresco.com/wiki/Space. I find helpful the notion of spaces as "smart or rich folders".
• How do I stop/start/restart/restart/get status of Alfresco?
  • sudo /opt/alfresco-4.2.f/alfresco.sh stop
  • sudo /opt/alfresco-4.2.f/alfresco.sh start
  • sudo /opt/alfresco-4.2.f/alfresco.sh restart
  • sudo /opt/alfresco-4.2.f/alfresco.sh status
• Disable the Guest user?
  • added line alfresco.authentication.allowGuestLogin=false to file /opt/alfresco-4.2.f/tomcat/shared/classes/alfresco-global.properties

To Do / Wish List / Problems

• Libreoffice editing is not working in 5.1.g. Is this related: https://community.alfresco.com/thread/209303-document-preview-problem-was-fixed-by-changing-libreoffices-ctlsh-to-libreofficectlsh ?
• Version aspect setting in personal space does not seem to stick when a new version of some file is uploaded via webdav. When tried this on a Site, versioning worked well to the extent that version numbers are bumped when I modify the file through webdav. I can revert to old versions but I don't see any opportunity to add a comment describing a change, or to list what changes were made.
  • I wonder if there is a way to “reach back” and change the meta-data on an earlier version (to add comments for a change made outside of Alfresco, say). I’ll check on that.
  • Not having versioning in personal files is not awful since most applications will use Sites.
  • Being able to somehow track changes might be more valuable.
• Ah, Internet Explorer 11; there's the trouble. I have recently discovered that Alfresco Community is not compatible with this version of IE. I will be working on a fix to Alfresco. In the meantime, Firefox or Chrome will be needed.
• backup and restore procedures Done 9/18/2104.
  • See https://github.com/toniblyx/alfresco-backup-and-recovery-tool for an idea.
  • also http://blyx.com/2013/12/11/essential-commands-for-alfresco-bart/
• direct the URL to alfresco?
• Need to make site https so Windows will be happy to edit documents with Word, etc.
• a permanent server install, e.g. biostat.mc.vanderbilt.edu/alfresco Done.
• libreoffice (for previewing documents; probably done as an addon) Done.
• Script or something to stop and restart libreoffice 10 minutes (say) after alfresco starts. Needed to fix libreoffice runaway condition.
• LDAP (while allowing also external users) Done. Vanderbilt LDAP is checked first. If that fails then the authentication is attempted against local user list.
• CIFS (see the impressive video on youtube - better than file share as allows version control etc.; but also see ftp method below)
• Install https://addons.alfresco.com/addons/unzip-share-action-zip
• Set up a raid config on the server Done.
• Google Docs integration has problems with spreadsheet files. Fix requires downloading and installing new "AMP" (Alfresco Module Package) files. Here is a video about installing AMP files: https://www.youtube.com/watch?v=EbNDEp1KG1g Done.
• Addons to consider:
  • https://addons.alfresco.com/addons/alfresco-etherpad-integration
  • http://addons.alfresco.com/addons/edit-online-libreoffice-openoffice Done.
  • http://addons.alfresco.com/addons/libreoffice-online-edit-module
• How to customize the Alfresco Share login page

Notes

Interesting Links

• http://biostats.mc.vanderbilt.edu:8080/alfresco/service/api/server
• http://biostats.mc.vanderbilt.edu:8080/alfresco/cmisatom

Changes

• 6/28/2016 : I changed the session time out from 30 to 60. This should take effect tonight when the service is stopped and restarted for backup. Change made in: /opt/alfresco-4.2.f/tomcat/conf/web.xml

Backup and Restore

The alfresco servers local hostname is biostats.emp.vumc.io.

The storage space for the alfresco backup is //i10file.vumc.org/biostatistics/alfrescobackup. This is VUMC NAS space.

This is mounted on the alfresco server at /home/biostat/alfrescobackup/backup. See /etc/fstab.

There us a cron job running as root that executes the backup script /home/biostat/alfrescobackup/alfrescobackup.sh.

Restore Notes

We tested the backup by making a restore to a system that was not already running Alfresco.

• Make a .tar.gz file of the backup (//i10file.vumc.org/biostatistics/alfrescobackup)
• copy the .tar.gz file to the new server
• expand the .tar.gz file into the /opt directory

cd /opt
sudo tar -xzf 20140917-161329.tar.gz

• create a postgres user with the correct password

 sudo useradd postgres
 sudo passwd postgres

• in the /opt/alfresco-4.2.f directory tree set the ownership to postgres.root for the postgres directories

sudo chown -R postgres.root /opt/alfresco-4.2.f/postgresql/
sudo chown -R postgres.root /opt/alfresco-4.2.f/alf_data/postgresql/

• start alfresco

sudo /opt/alfresco-4.2.f/alfresco.sh start

• Test
• If moving to another machine:
  • Get new static IP address
  • Reassign biostats.mc.vanderbilt to new IP address
  • Apply for Secure Relay for Servers (SRFS) so Alfresco can send email (see http://it.vanderbilt.edu/security/vulnerability-management/srfs/)
  • Apply for Active Directory Domain Services so Alfresco can authenticate using vunetid and epassword (see http://it.vanderbilt.edu/security/security-design-ops/identity-operations/active-directory-domain-services.php)

Performance issues

• in /opt/alfresco-4.2.f/tomcat/scripts/ctl.sh set export JAVA_OPTS="...-Xmx4096m... (in 2 places)
• To see global configuration file: cat /opt/alfresco-4.2.f/tomcat/shared/classes/alfresco-global.properties
• We are seeing periods where 200% of CPU is being consumed.
• I made a change to /opt/alfresco-4.2.f/libreoffice/program/sofficerc. Changed "Logo=1" to "Logo=0". These is some indication that despite the "-nologo" option on the command that starts libreoffice headless, it is still trying to put up the logo. This change supposedly fixes that.
• I also saw a note that says that libreoffice misbehaves if started in the wrong order when the system boots. It is recommended to stop and restart libreoffice 10 minutes or more after the system is rebooted or alfresco is restarted sudo /opt/alfresco-4.2.f/libreoffice/scripts/libreoffice_ctl.sh restart). I restarted it by hand and it seems to help. I haven't automated this yet. It would be nice to know what the correct order is, but I don't.

Authentication issues

We need to check if the person we are inviting to something already has an account. I so, make sure we are not inviting them with the “…Add External Users” link.

A winkle to look out for is that we have a “hybrid” authentication scheme. Authentication is attempted in the following order:

1. The username and password are checked against the Alfresco server’s database. If a match is found then the user is authenticated. Otherwise…
2. The username and password are checked against the Vanderbilt Active directory.

Note that one can have a username in the local database AND in the active directory. This is how we handle non-Vanderbilt users. It is not a technical problem but might be confusing.

Right now, when inviting a Vanderbilt person, I think the thing to do is to make sure they have logged on Alfresco BEFORE making the invitation. You would have to send them a “pre-invitation” email. That way they can be invited as an existing user and no confusion arises. Plus they get to use their vunetid and epassword and don’t have to remember another set of credentials.

On the other hand, we should probably leave well enough alone for the people who are already registered and using Alfresco.

What I need to do is make the active directory searchable from Alfresco so that Vanderbilt people show up when one does a “Search for People” on the invitation screen, regardless of whether or not they have ever logged on before. But I haven’t figured out how to do that yet. I only recently came to understand the authentication flow.

Email links

• Secure Relay for Servers (SRFS) (outgoing email)

Accessing Alfresco Directory Tree With Your File System or File Manager (Linux)

webdav

• sudo apt-get install davfs2
• sudo chmod u+s /sbin/mount.davfs
• Put the following in /etc/fstab
http://biostats.mc.vanderbilt.edu:8080/alfresco/webdav     /alfresco davfs rw,user,noauto 0 0
• sudo mkdir /alfresco
• sudo chown uid.uid /alfresco [insert your userid]
• mkdir ~/.davfs2/
• Edit ~/.davfs2/secrets to add the line http://biostats.mc.vanderbilt.edu:8080/alfresco/webdav alfrescouserid yourpassword
• chmod 0600 ~/.davfs2/secrets
• mount /alfresco
• Go to /alfresco
• If you are storing large data files on alfresco and want to be able to load them very fast after the first time they are loaded in a session, use a large davfs2 cache by editing ~/.davfs2/davfs2.conf and including a line such as cache_size 100. This will allow a 100MB cache.
• The android Total Commander app and its webdav plugin work well for accessing Alfresco folders via webdav. Specified server name biostats.mc.vanderbilt.edu:8080/alfresco/webdav/User Homes/myalfrescoID

You may see the error "/sbin/mount.davfs: program is not setuid root" when you try to mount /alfresco. This is because the mount program requires root privileges. Execute the command sudo dpkg-reconfigure davfs2 to change that behavior.

Access Alfresco Directory Tree from Windows 7

• How to map an Alfresco space to a Windows drive letter (PDF)
• Client WebDAV

ftp

Have your file manager (nemo is one that works very well for this) connect to server ftp://biostats.mc.vanderbilt.edu:8021
You can past in whole directories to copy from your local file system into an alfresco site. Also try using this URL: ftp://id:pw@biostats.mc.vanderbilt.edu/alfresco/User%20Homes/yourafrescoID.

A sample fpt session on a Windows computer: click here

Small device apps

There is an exceptional android app for Alfresco - not just for the cloud version but for customized servers like ours. Specify server name (hostname) biostats.mc.vanderbilt.edu and for now uncheck HTTPS. Port is 8080. Leave service url as \alfresco. There is also an Alfresco repository browser app in android which I suppose is read-only. See also: Alfresco Wiki.

Drag and drop

A linux file manager can drag a .docx file into a new alfresco folder. very quickly. Such a file can be edited with google docs - works like a charm

Setup Conventions

• There are two areas to chose between when creating content: sites and user-specific file repositories. Our current thinking of what distinguishes the two is:
  • A site represents a long-term project with well-defined project team members. You can also have a site for a general methodologic area such as "R Programming" although the wiki is perhaps better for that. Sites can have their own discussion board and top-level wiki page to describe the team and activities.
  • A user's file repository typically crosses project boundaries or contains general-purpose files for administrative and other activities (e.g., "To-Do" lists) and personal tips and hints (e.g., programming tips not documented well enough to share with other users)
• Site naming: site names, when pooled over all users, must be unique and the names should be descriptive. It is not wise to use a generic site name that might overlap with the name another user may wish to create in the future.
• We need to determine the appropriate level for a site. Suppose that a statistician is working in a large collaborative area related to a Division within a School of Medicine Department. Should there be a site for that Division or should each project or lead investigator constitute a site?
• Current thinking is that a site be defined as a "big" project. For example, for collaborations a site would pertain to a defined group of investigators working on related research/grants/papers. A department or division containing many such investigator groups would have multiple site. There may be some benefit to having a department/division prefix to the site names, e.g., Cardiology:Atrial Fibrillation. Or we should develop a fixed set of prefixes so that we can easily find all sites related to a division, department, or center, e.g. sites related to Cardiovascular Medicine could be named "CV: Atrial Fibrillation", "CV: Left Ventricular Assist Devices" and sites related to VICC could have prefixes of VICC, Ca, or CC.

How to setup Alfresco with Nginx as the front-end web server

Example steps to update AMPs

These are the steps described in the video mentioned above about installing AMP files: https://www.youtube.com/watch?v=EbNDEp1KG1g. These steps are for updating the Google Integration amps to a newer version.

#
# Stop the server
#
sudo ./alfresco.sh stop
#
# Set path to alfresco installation main directory.
#
cd /opt/alfresco-4.2.f/
#
# Look and see what is in the amp directories
#
ls -la amps
ls -la amps_share/
#
#
echo download the amp files
#
# Run the mmt tool to list what amps are installed in the
# alfresco.war file.
#
sudo /opt/alfresco-4.2.f/java/bin/java -jar ./bin/alfresco-mmt.jar list tomcat/webapps/alfresco.war
sudo /opt/alfresco-4.2.f/java/bin/java -jar ./bin/alfresco-mmt.jar list tomcat/webapps/share.war
#
# Copy the repo amp into the amps folder
#
cp ~/Download/alfresco-googledocs-repo-2.0.7-18com.amp ./amps/
#
# Copy the share amp into the amps_share folder.
#
sudo cp ~/Download/alfresco-googledocs-share-2.0.7-18com.amp ./amps_share/
#
# Delete older version of new amps.
#
sudo rm ./amps/alfresco-googledocs-repo-0.0.0-0com.amp
sudo rm ./amps_share/alfresco-googledocs-share-0.0.0-0com.amp
#
# Run the "apply amps" script.
#
sudo bin/apply_amps.sh
#
# war file have been amped so start the server.
#
sudo ./alfresco.sh start

Rodgers, Bradley A 10:02 AM
Dale, I am looking into your issue with your biostat server not being able to send emails. Do you know the IP address of the server?
Plummer, Dale 10:02 AM
just a sec
biostats.mc.vanderbilt.edu 160.129.74.237
Rodgers, Bradley A 10:05 AM
has email ever worked on this server?
Plummer, Dale 10:06 AM
not using SRFS.  The application can send authenticated email via smtpauth.
Rodgers, Bradley A 10:06 AM
ok. Well I see the problem.
for some reason it dropped off the SRFS Relay
I have added it back
so you should be able to use it to send emails just like the other servers in your environment.
Plummer, Dale 10:08 AM
That's great.  I try it later today when I get a chance.  Thanks for your help.