Jump to content
Froxlor Forum
  • 0
DrRosental

Group ssl-cert

Question

Hi there,

I'm wondering how to use the certificates in /etc/ssl/froxlor-custom for other things like a websocket server.

I recogniced that the directory /etc/ssl/froxlor-custom is owned by root:ssl-cert but unfortunately the certificates are owned by root:root and so it seems that I cannot read them from other users - even if I add them to the group ssl-cert.

This may be a simple question about rights but I'm not aware of a solution ...

What can I do?

Thanks!

Share this post


Link to post
Share on other sites

5 answers to this question

Recommended Posts

  • 0

Basically, yes, you can of course use them where and for what you like. They're just files. Permission is something different. Froxlor synchronizes the certificate to its database. So maybe you can with whatever script you have, query the database and create the files where you need them and with whatever permission you want ;)

Share this post


Link to post
Share on other sites
  • 0

Thanks for your help! :) Hmmm, okay but this looks like a lot of overhead compared to the idea that froxlor could just create the files like root:ssl-cert, doesn't it? :D Just a guess: wasn't it the intention to create them like that? I mean since the directory froxlor-custom is owned like that? In my eyes this would be a powerful feature working out of the box like: just add your user to the group "ssl-cert" and you are ready to reuse the (automatically updated) certificates, yay! :) ... ?

Edit: or simply a new group like "froxlor-cert"

Share this post


Link to post
Share on other sites
  • 0

The intension is that the Webserver can use them and usually certificates have very restricted permissions, especially private keys. You can always set a custom Webserver reload-command in the settings that does an Apache reload and a desired chown if needed.

Share this post


Link to post
Share on other sites
  • 0

Thanks again! I tried that and entered

"/etc/init.d/apache2 reload && chown root:USER /etc/ssl/froxlor-custom/my.domain.tld.*"

to be as restrictive as possible. However, forcing the master cronjob only gives:

SECURITY CHECK FAILED!
The execute string '/etc/init.d/apache2 reload \&\& chown root:USER /etc/ssl/froxlor-custom/my.domain.tld.\*' is a possible security risk!

In fact, it seems that it doesn't process the (second) command at all (but the command is okay if I do it manually).

Edit: Solved by doing this

Share this post


Link to post
Share on other sites
  • 0

Exactly what I meant, you need to create a custom bash script to specify as reload command ;)

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×
×
  • Create New...