Jump to content
Froxlor Forum
  • 0

Group ssl-cert


DrRosental

Question

Hi there,

I'm wondering how to use the certificates in /etc/ssl/froxlor-custom for other things like a websocket server.

I recogniced that the directory /etc/ssl/froxlor-custom is owned by root:ssl-cert but unfortunately the certificates are owned by root:root and so it seems that I cannot read them from other users - even if I add them to the group ssl-cert.

This may be a simple question about rights but I'm not aware of a solution ...

What can I do?

Thanks!

Link to comment
Share on other sites

5 answers to this question

Recommended Posts

  • 0

Basically, yes, you can of course use them where and for what you like. They're just files. Permission is something different. Froxlor synchronizes the certificate to its database. So maybe you can with whatever script you have, query the database and create the files where you need them and with whatever permission you want ;)

Link to comment
Share on other sites

  • 0

Thanks for your help! :) Hmmm, okay but this looks like a lot of overhead compared to the idea that froxlor could just create the files like root:ssl-cert, doesn't it? :D Just a guess: wasn't it the intention to create them like that? I mean since the directory froxlor-custom is owned like that? In my eyes this would be a powerful feature working out of the box like: just add your user to the group "ssl-cert" and you are ready to reuse the (automatically updated) certificates, yay! :) ... ?

Edit: or simply a new group like "froxlor-cert"

Link to comment
Share on other sites

  • 0

The intension is that the Webserver can use them and usually certificates have very restricted permissions, especially private keys. You can always set a custom Webserver reload-command in the settings that does an Apache reload and a desired chown if needed.

Link to comment
Share on other sites

  • 0

Thanks again! I tried that and entered

"/etc/init.d/apache2 reload && chown root:USER /etc/ssl/froxlor-custom/my.domain.tld.*"

to be as restrictive as possible. However, forcing the master cronjob only gives:

SECURITY CHECK FAILED!
The execute string '/etc/init.d/apache2 reload \&\& chown root:USER /etc/ssl/froxlor-custom/my.domain.tld.\*' is a possible security risk!

In fact, it seems that it doesn't process the (second) command at all (but the command is okay if I do it manually).

Edit: Solved by doing this

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


×
×
  • Create New...