Group ssl-cert

[DrRosental]

Hi there,

I'm wondering how to use the certificates in /etc/ssl/froxlor-custom for other things like a websocket server.

I recogniced that the directory /etc/ssl/froxlor-custom is owned by root:ssl-cert but unfortunately the certificates are owned by root:root and so it seems that I cannot read them from other users - even if I add them to the group ssl-cert.

This may be a simple question about rights but I'm not aware of a solution ...

What can I do?

Thanks!

[d00p]

Basically, yes, you can of course use them where and for what you like. They're just files. Permission is something different. Froxlor synchronizes the certificate to its database. So maybe you can with whatever script you have, query the database and create the files where you need them and with whatever permission you want

[DrRosental]

Thanks for your help! Hmmm, okay but this looks like a lot of overhead compared to the idea that froxlor could just create the files like root:ssl-cert, doesn't it? Just a guess: wasn't it the intention to create them like that? I mean since the directory froxlor-custom is owned like that? In my eyes this would be a powerful feature working out of the box like: just add your user to the group "ssl-cert" and you are ready to reuse the (automatically updated) certificates, yay! ... ?

Edit: or simply a new group like "froxlor-cert"

[d00p]

The intension is that the Webserver can use them and usually certificates have very restricted permissions, especially private keys. You can always set a custom Webserver reload-command in the settings that does an Apache reload and a desired chown if needed.

[DrRosental]

Thanks again! I tried that and entered

"/etc/init.d/apache2 reload && chown root:USER /etc/ssl/froxlor-custom/my.domain.tld.*"

to be as restrictive as possible. However, forcing the master cronjob only gives:

SECURITY CHECK FAILED!
The execute string '/etc/init.d/apache2 reload \&\& chown root:USER /etc/ssl/froxlor-custom/my.domain.tld.\*' is a possible security risk!

In fact, it seems that it doesn't process the (second) command at all (but the command is okay if I do it manually).

Edit: Solved by doing this

[d00p]

Exactly what I meant, you need to create a custom bash script to specify as reload command