1. Is it good to have liferay community edition for internet portal? If not then why?
2. Can liferay community edition support 1500+ users with throughput(response) less than 1 second?
3. In liferay CE, for 1500+ concurrent user with throughput<1 sec , What should be h/w and configuration ?
4. we are planning to go live with liferay CE version than How can we assure it will provide best performance?

Yes, if your project do not have money to pay for EE. If you can go EE you should.



Depends on how your portal has been designed and of course hardware. That would translate average 50 - 70 page loads per second. If you pages are fully cacheble then Liferay can easily support that 50 to 70 page loads per second. If pages are dynamic then performance reduces significantly. You can also cluster your Liferay to improve performance.




Design real world performance test, with real use cases and click paths (or how do you think that users are behaving) which are modelling your expected user behavior. Tests you can create with jMeter.

We have been running CE version 6+ for a year now for public facing portal, with 4 nodes in 2 physical servers, so far it can serve about 700-1000 concurrent users OK.

The server spec is roughly like this:
Dell(TM) PowerEdge(TM) R710 Rack Mount Server
Intel (R) Xeon (R) E5645 2.40GHz, 12M Cache, 5.86 GT/s QPI, 6C
96GB Memory (12x8G, 1333MHz, Dual Ranked RDIMMs for 2 Processors
Running on JBoss AS 5

Our portal is accelerated by Akamai however, which significantly reduces our server loads by 60%.

If you are putting Liferay on the internet, it is highly recommended that you purchase the EE version.

CE is probably good enough for an intranet and possibly an extranet environment, but there tend to be too many unpatched security holes in CE to use in an internet environment.

EE subscribers get regular patch updates to address security issues, and is your best option for internet usage.

Hi David, thanks for the recommendation.

I forgot to mention, I disabled most of the default Portlets come with Liferay, except the Journal Portlets and Message board (disabling it makes Liferay not bootable).
Also, some of the known security holes, we patched it via EXT plugin.

There are some out of band security fixes for EE which cover things like javascript vulnerabilities, some connected w/ the doc library (if I remember correctly), etc.

AFAIK, some of these get released as patches in jira (if you want to take the time to find them, download them, and apply them via EXT or whatever), but they are distributed as nice easy deployable fixes for EE.

Big thanks to all of you for your reply.

What type of security thread can we face in Liferay CE version?

Well, the CE GA's typically include the patches when they come out, but between those releases there is no notification on the vulnerabilities found (EE users get emails w/ the vulnerability details and the fix information). For example, 6.0.6 GA was the last release for the 6.0 line, so there have not been any further releases there although EE has seen a number of fixpacks come out to address vulnerabilities, so you'd be totally on your own if you were using 6.0.6 and wanted to backport fixes from 6.1 to your 6.0.6 environment.

There is a new group that is supposed to be building patch releases for CE, but I don't know how much they are hooked into vulnerability identification at Liferay, whether they support previous releases (as the EE fixes typically will), etc.

Really, though, I don't want to leave you with the impression that CE is extremely vulnerable and EE is the only secure platform. Depending upon your type of organization, the kind of things you're using CE for on the internet, your skill level at disabling/removing functionality you don't plan on supporting, you may be able to have a perfectly secure CE platform.

EE just makes a lot of this easier. Some organizations (enterprises) prefer to use EE just for the support and patches and the 'warm and fuzzy' feelings they have knowing they have a contract with a vendor.

This point I cannot list any .. look the what the security team knows.

At least do not use default administrator name test at liferay

Liferay 5.2.3 had bug that that you could basically read sites web content templates and list the users. Not so funny is that many of the companies who's Liferay 5.2.3 CE project did came out long after the these where found. I bet there are still some Liferay sites open.

You can do some hardening by blocking un used features from proxy or implement filter for it.

Sometimes is good to order penetration testing to your site. These companies usually knows Liferay and application server flaws too and they will report that. That kind of report is usually good document also to learn.

Some of the known issues are listed here: http://packetstormsecurity.org/search/?q=liferay (sorry but I can not make this clickable link due to new SPAM filters)