Clustering Config for DMZ Server Migration

The details of the Database is stored in the

DataBase.xml

Which is located in:

ROOT/WEB-INF/xml/

Hope this helps

@notverypc is right...DataBase.xml is where you specify.

Are you running your MySQL instance on a separate server or on your production JSS?

Whichever one, You will need to drop into MySQL command line, setup a user for MySQL for your DMZ instance and grant permission to the database. The commands are specified in the installation guide, but you will want to run your grant command for ‘<yourdbuser>>@<<ipaddressofyourmysqlinstance>’ in addition to the one you already ran For your production database

And make sure that you Database.xml file has the correct Database name and server details as the internal.

You may also want to look at "securing the jss" KB

@kerouak has some good info too...I would recommend a quick review of this article, in that it keeps it all easy.

https://www.jamf.com/jamf-nation/articles/174/installing-a-jss-web-application-in-the-dmz

Hi all, thanks for your responses.

@blackholemac , our DB is on our internal server. Our DMZ server has the web app disabled, and is only used for user-initiated enrollment. Does the DMZ server need a "GRANT ALL on db.*", even though it's limited access?

Thanks again!

@tomgluver

Settings for your DMZ mac here:

GRANT INSERT, SELECT, UPDATE, DELETE, LOCK TABLES ON <database>.* TO ‘username>’@’<hostname’ IDENTIFIED BY ‘<password>’;

It doesn’t necessarily need a “grant all” but it does need the ability to “modify” the database. I use the term “modify” loosely because that may well be a permission key and I don’t want to confuse the word with what is actually needed.

You will need the ability to “create” and “change” records given that you are allowing enrollment at a minimum.

http://dev.mysql.com/doc/refman/5.7/en/privileges-provided.html

The link above lists the actual syntax of permissions you can grant with MySQL 5.7...I would pay a friendly call to Jamf to confirm what is formally required for the limited DMZ instance to function. Most Jamf documentation does a “grant all.”

I'ts as I said earlier....

mysql -u root -p

Mysql> GRANT INSERT, SELECT, UPDATE, DELETE, LOCK TABLES ON <your database>.* TO ‘<dmz username>’@’<dmz ip address>’ IDENTIFIED BY ‘<password>’;

That's exactly the command you need to run on the Database. Been doin this for years in clustered env.