Understanding PS_HOME Security

Because the configuration files, by default, do not reside in PS_HOME, the PS_HOME installation can be locked down to prevent unauthorized access, by user or system process. By making the PS_HOME directory ‘Read-Only’, processes running in the domain cannot write to PS_HOME or any of the subdirectories therein. Likewise, any users with malicious intent are unable to delete or modify executable files in PS_HOME.

Securing PS_HOME involves making the directory read-only, yet making sure that the following system elements have sufficient access.

System Element	Description
Application server	Application server domains need read access to the executable and binary files of PS_HOME to process requests and run application logic.
Process Scheduler	Process Scheduler domains need read access to the executable and binary files of PS_HOME to run batch processes. Plus, keep in mind these points: The user creating a Process Scheduler domain on Windows needs read and write access to the Windows Registry. The restricted OS user needs to have full privilege access to the psreports folder (and its children). Process Scheduler and the Report Distribution agent inherit the restricted user's security settings they will need to create folders in psreports. Oracle ProcMGR (Tuxedo) should be started with the restricted OS user ID. Configure Process Scheduler with an Admin OS user for Windows. While logged into Windows with the full privilege OS user ID, create and configure the Process Scheduler domain, so that ODBC and nVision DLLs register properly.
File server/Windows workstations	The file server and/or Windows workstations running Application Designer need read-only access to PS_HOME to facilitate three-tier connections.

System Element

Description

Application server

Application server domains need read access to the executable and binary files of PS_HOME to process requests and run application logic.

Process Scheduler

Process Scheduler domains need read access to the executable and binary files of PS_HOME to run batch processes. Plus, keep in mind these points:

The user creating a Process Scheduler domain on Windows needs read and write access to the Windows Registry.
The restricted OS user needs to have full privilege access to the psreports folder (and its children). Process Scheduler and the Report Distribution agent inherit the restricted user's security settings they will need to create folders in psreports.
Oracle ProcMGR (Tuxedo) should be started with the restricted OS user ID.
Configure Process Scheduler with an Admin OS user for Windows. While logged into Windows with the full privilege OS user ID, create and configure the Process Scheduler domain, so that ODBC and nVision DLLs register properly.

File server/Windows workstations

The file server and/or Windows workstations running Application Designer need read-only access to PS_HOME to facilitate three-tier connections.

Note:

These instructions do not apply to the PS_HOME residing on the web server for PIA or the PS_HOME on the database server.

Note:

When implementing a read-only PS_HOME, consider that environment locations to which processes write files can't be in a read-only location. Settings for "temporary" directories and "output" directories should not be located within the PS_HOME directory structure. For example, the default temporary directory locations are C:\Documents and Settings\<user>.PEOPLESOFT\Local Settings\Temp (Windows) and %root%\TMP (UNIX).

Note:

All elements of your PeopleSoft implementation, such as Process Scheduler and SQR can operate within a secure PS_HOME configuration.