Granting a nonroot-owned systemd service sufficient 'usage' permissions on letsencrypt's SSL key/cert pair
up vote
0
down vote
favorite
Unrealircd is not allowed access to ssl key/cert pair, ircd-owned systemd service unit fails miserably. The files are managed by lets-encrypt's certbot and root-owned:
-rw-r--r-- 1 root root 3.5K Dec 8 10:40 fullchain1.pem
-rw------- 1 root root 1.7K Dec 8 10:40 privkey1.pem
If the ownership and/or permissions of key/cert are altered the systemd unit starts fine. What is the most sensible and prefereable way of proceeding?
permissions systemd letsencrypt ownership certbot
asked 2 days ago
soocki
358
add a comment |
up vote
0
down vote
favorite
Unrealircd is not allowed access to ssl key/cert pair, ircd-owned systemd service unit fails miserably. The files are managed by lets-encrypt's certbot and root-owned:
-rw-r--r-- 1 root root 3.5K Dec 8 10:40 fullchain1.pem
-rw------- 1 root root 1.7K Dec 8 10:40 privkey1.pem
If the ownership and/or permissions of key/cert are altered the systemd unit starts fine. What is the most sensible and prefereable way of proceeding?
permissions systemd letsencrypt ownership certbot
asked 2 days ago
soocki
358
1
How did you install Unrealirc ? Was it compiled from source? Which user is running the server process? ... Usually it is not advisable to alter the permissions on the private key for any cryptographic protocol. When I compiled Unrealirc from source, it generated self-signed keys and put them inunrealircd/conf/ssl... so you might try creating a symbolic link in that directory to your LetsEncrypt key and cert.
– RubberStamp
yesterday
That was the first thing I did actually (symbolic link'em). The package came pre-compiled from the official repositories. Systemdserviceruns underircduser and that seems to be the problem accessing the files.
– soocki
20 hours ago
Well... I'm not sure if there are any chroot options... However other server programs like apache, for example, read the private key before the chroot operation. This way the process is run by an unpriviledged user but TLS still functions... The recommendation from the documentation for unrealirc is to run as a unpriviledged user... which is correct. So, the easiest way to go forward is probably to create a group and add the ircd user, change permissions. However, this is not ideal and will probably revert with each new key set.
– RubberStamp
18 hours ago
And of course... Here are the instructions for using LetsEncrypt with Unrealirc
– RubberStamp
17 hours ago
Nice find :) Pretty relevant. It suggests copying the files and changing their ownership to theircduser, which was the second thing I did but it did not feel right. It feels like a nasty workaround and I thought a better way should be in order but perhaps I am wrong or maybe there is we just not aware of it.
– soocki
10 hours ago
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
Unrealircd is not allowed access to ssl key/cert pair, ircd-owned systemd service unit fails miserably. The files are managed by lets-encrypt's certbot and root-owned:
-rw-r--r-- 1 root root 3.5K Dec 8 10:40 fullchain1.pem
-rw------- 1 root root 1.7K Dec 8 10:40 privkey1.pem
If the ownership and/or permissions of key/cert are altered the systemd unit starts fine. What is the most sensible and prefereable way of proceeding?
permissions systemd letsencrypt ownership certbot
asked 2 days ago
soocki
358
Unrealircd is not allowed access to ssl key/cert pair, ircd-owned systemd service unit fails miserably. The files are managed by lets-encrypt's certbot and root-owned:
-rw-r--r-- 1 root root 3.5K Dec 8 10:40 fullchain1.pem
-rw------- 1 root root 1.7K Dec 8 10:40 privkey1.pem
If the ownership and/or permissions of key/cert are altered the systemd unit starts fine. What is the most sensible and prefereable way of proceeding?
permissions systemd letsencrypt ownership certbot
permissions systemd letsencrypt ownership certbot
asked 2 days ago
soocki
358
asked 2 days ago
soocki
358
edited 18 hours ago
asked 2 days ago
soocki
358
asked 2 days ago
soocki
358
asked 2 days ago
soocki
358
358
1
How did you install Unrealirc ? Was it compiled from source? Which user is running the server process? ... Usually it is not advisable to alter the permissions on the private key for any cryptographic protocol. When I compiled Unrealirc from source, it generated self-signed keys and put them inunrealircd/conf/ssl... so you might try creating a symbolic link in that directory to your LetsEncrypt key and cert.
– RubberStamp
yesterday
That was the first thing I did actually (symbolic link'em). The package came pre-compiled from the official repositories. Systemdserviceruns underircduser and that seems to be the problem accessing the files.
– soocki
20 hours ago
Well... I'm not sure if there are any chroot options... However other server programs like apache, for example, read the private key before the chroot operation. This way the process is run by an unpriviledged user but TLS still functions... The recommendation from the documentation for unrealirc is to run as a unpriviledged user... which is correct. So, the easiest way to go forward is probably to create a group and add the ircd user, change permissions. However, this is not ideal and will probably revert with each new key set.
– RubberStamp
18 hours ago
And of course... Here are the instructions for using LetsEncrypt with Unrealirc
– RubberStamp
17 hours ago
Nice find :) Pretty relevant. It suggests copying the files and changing their ownership to theircduser, which was the second thing I did but it did not feel right. It feels like a nasty workaround and I thought a better way should be in order but perhaps I am wrong or maybe there is we just not aware of it.
– soocki
10 hours ago
add a comment |
1
How did you install Unrealirc ? Was it compiled from source? Which user is running the server process? ... Usually it is not advisable to alter the permissions on the private key for any cryptographic protocol. When I compiled Unrealirc from source, it generated self-signed keys and put them inunrealircd/conf/ssl... so you might try creating a symbolic link in that directory to your LetsEncrypt key and cert.
– RubberStamp
yesterday
That was the first thing I did actually (symbolic link'em). The package came pre-compiled from the official repositories. Systemdserviceruns underircduser and that seems to be the problem accessing the files.
– soocki
20 hours ago
Well... I'm not sure if there are any chroot options... However other server programs like apache, for example, read the private key before the chroot operation. This way the process is run by an unpriviledged user but TLS still functions... The recommendation from the documentation for unrealirc is to run as a unpriviledged user... which is correct. So, the easiest way to go forward is probably to create a group and add the ircd user, change permissions. However, this is not ideal and will probably revert with each new key set.
– RubberStamp
18 hours ago
And of course... Here are the instructions for using LetsEncrypt with Unrealirc
– RubberStamp
17 hours ago
Nice find :) Pretty relevant. It suggests copying the files and changing their ownership to theircduser, which was the second thing I did but it did not feel right. It feels like a nasty workaround and I thought a better way should be in order but perhaps I am wrong or maybe there is we just not aware of it.
– soocki
10 hours ago
1
1
How did you install Unrealirc ? Was it compiled from source? Which user is running the server process? ... Usually it is not advisable to alter the permissions on the private key for any cryptographic protocol. When I compiled Unrealirc from source, it generated self-signed keys and put them in
unrealircd/conf/ssl ... so you might try creating a symbolic link in that directory to your LetsEncrypt key and cert.– RubberStamp
yesterday
How did you install Unrealirc ? Was it compiled from source? Which user is running the server process? ... Usually it is not advisable to alter the permissions on the private key for any cryptographic protocol. When I compiled Unrealirc from source, it generated self-signed keys and put them in
unrealircd/conf/ssl ... so you might try creating a symbolic link in that directory to your LetsEncrypt key and cert.– RubberStamp
yesterday
That was the first thing I did actually (symbolic link'em). The package came pre-compiled from the official repositories. Systemd
service runs under ircd user and that seems to be the problem accessing the files.– soocki
20 hours ago
That was the first thing I did actually (symbolic link'em). The package came pre-compiled from the official repositories. Systemd
service runs under ircd user and that seems to be the problem accessing the files.– soocki
20 hours ago
Well... I'm not sure if there are any chroot options... However other server programs like apache, for example, read the private key before the chroot operation. This way the process is run by an unpriviledged user but TLS still functions... The recommendation from the documentation for unrealirc is to run as a unpriviledged user... which is correct. So, the easiest way to go forward is probably to create a group and add the ircd user, change permissions. However, this is not ideal and will probably revert with each new key set.
– RubberStamp
18 hours ago
Well... I'm not sure if there are any chroot options... However other server programs like apache, for example, read the private key before the chroot operation. This way the process is run by an unpriviledged user but TLS still functions... The recommendation from the documentation for unrealirc is to run as a unpriviledged user... which is correct. So, the easiest way to go forward is probably to create a group and add the ircd user, change permissions. However, this is not ideal and will probably revert with each new key set.
– RubberStamp
18 hours ago
And of course... Here are the instructions for using LetsEncrypt with Unrealirc
– RubberStamp
17 hours ago
And of course... Here are the instructions for using LetsEncrypt with Unrealirc
– RubberStamp
17 hours ago
Nice find :) Pretty relevant. It suggests copying the files and changing their ownership to the
ircd user, which was the second thing I did but it did not feel right. It feels like a nasty workaround and I thought a better way should be in order but perhaps I am wrong or maybe there is we just not aware of it.– soocki
10 hours ago
Nice find :) Pretty relevant. It suggests copying the files and changing their ownership to the
ircd user, which was the second thing I did but it did not feel right. It feels like a nasty workaround and I thought a better way should be in order but perhaps I am wrong or maybe there is we just not aware of it.– soocki
10 hours ago
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
draft saved
draft discarded
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f486765%2fgranting-a-nonroot-owned-systemd-service-sufficient-usage-permissions-on-letse%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
How did you install Unrealirc ? Was it compiled from source? Which user is running the server process? ... Usually it is not advisable to alter the permissions on the private key for any cryptographic protocol. When I compiled Unrealirc from source, it generated self-signed keys and put them in
unrealircd/conf/ssl... so you might try creating a symbolic link in that directory to your LetsEncrypt key and cert.– RubberStamp
yesterday
That was the first thing I did actually (symbolic link'em). The package came pre-compiled from the official repositories. Systemd
serviceruns underircduser and that seems to be the problem accessing the files.– soocki
20 hours ago
Well... I'm not sure if there are any chroot options... However other server programs like apache, for example, read the private key before the chroot operation. This way the process is run by an unpriviledged user but TLS still functions... The recommendation from the documentation for unrealirc is to run as a unpriviledged user... which is correct. So, the easiest way to go forward is probably to create a group and add the ircd user, change permissions. However, this is not ideal and will probably revert with each new key set.
– RubberStamp
18 hours ago
And of course... Here are the instructions for using LetsEncrypt with Unrealirc
– RubberStamp
17 hours ago
Nice find :) Pretty relevant. It suggests copying the files and changing their ownership to the
ircduser, which was the second thing I did but it did not feel right. It feels like a nasty workaround and I thought a better way should be in order but perhaps I am wrong or maybe there is we just not aware of it.– soocki
10 hours ago