To clarify which permissions I had to set and how they are applied I post an example configuration.
Assume '/usr/bin/jrtmt' is run by user 'user1' in administrator group 'cucm' on a linux machine 'pc'.
user1@pc:~$ grep "cucm:" /etc/group
cucm:x:1007:user1,user2,user3
So I setup the access rights as following (complete file list for '/opt/cisco/jrtmt' is attached):
user1@pc:~$ ls -ld /opt/cisco/jrtmt
drwxrwxr-x 13 root cucm 4096 Jan 1 11:00 /opt/cisco/jrtmt
user1@pc:~$ ls -l /opt/cisco/jrtmt/SFTPServerList.xml*
-rw-r--r-- 1 user1 cucm 283 Jan 1 11:00 /opt/cisco/jrtmt/SFTPServerList.xml
-rw-r--r-- 1 user1 cucm 0 Jan 1 11:00 /opt/cisco/jrtmt/SFTPServerList.xmllock.bin
Real Time Monitoring Tool was running so there existed a lock file. The directory '/opt/cisco/jrtmt' is owned by user 'root'. Group is 'cucm' that has read, write and access permission.
File 'SFTPServerList.xml' is owned by 'user1' and has been assigned to group 'cucm' while only owner has write permissions. This way the other users cannot accidentally add a new task as they will get the above message 'The file SFTPServerList.xml is used by other RTMT client!'. I suppose if write permissions are granted to the group all the group's administrators can configure a SFTP download.
The attached list 'stat-jrtmt.txt' has been generated by the following statement:
find /opt/cisco/jrtmt -exec /bin/bash -c 'f="{}"; echo "$( stat -c "%a %A %U:%G" "${f}" ) ${f}"' \; >stat-jrtmt.txt
To adapt permissions to match the above values type:
chown -c root:cucm /opt/cisco/jrtmt
# use symbolic representation
chmod -c u=rwx,g=rwx,o=rx /opt/cisco/jrtmt
# use octal mode
chmod -c 775 /opt/cisco/jrtmt
# check changes
ls -l /opt/cisco/jrtmt
Option '-c' ('--changes') means "like verbose but report only when a change is made". For example it will be reported:
user1@pc:~$ chmod -c 775 /opt/cisco/jrtmt
mode of ‘/opt/cisco/jrtmt’ changed from 0770 (rwxrwx---) to 0775 (rwxrwxr-x)
File 'SFTPServerList.xml' contains preselection data for SFTP configuration. Let me introduce our setup:
- a server list (in RTMT field is named 'Host IP Address'): '123.12.123.12' is the destination ip address where Cisco UCM copies the download files
- a username list (in RTMT field is named 'User Name'): we download call detail records (cdr) and audit logs to the home directory of some low-privileged users
- a directory list (in RTMT field is named 'Download Directory Path'): each download has its own directory so scheduled downloads can be checked and obsole copies can be removed easily
- if daily cdr download fails for some reason it is automatically recovered with a weekly download
- this has been decided as failed tasks are not repeatedly triggered at a future date by Cisco UCM and with RTMT you cannot configure an offset daily schedule task (schedule wizard just provides a field 'Collect Files generated in the last')
<SFTP>
<ServerList>
<Server>
123.12.123.12
</Server>
</ServerList>
<UserNameList>
<UserName>
cucm-cdr
</UserName>
<UserName>
cucm-audit
</UserName>
</UserNameList>
<DirList>
<Dir>
audit
</Dir>
<Dir>
cdr-daily
</Dir>
<Dir>
cdr-weekly
</Dir>
</DirList>
</SFTP>
