1

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed).

The key files / certificates are located in the directory /etc/ssl. Nginx (because it has root permissions) can read these files / directory, but other services (which run in the userspace, such as IRCD-Hybrid or ZNC) can not.

How can I secure my key and certs, but at the same time allow these processes to read (not write) them?

  • You're worried that "chmod a+r" might go too far? – barrycarter Oct 19 '14 at 17:16
  • I tried, but as a user it still gives me "Permission denied"? Ownership of the files is root:root – JacksGT Oct 19 '14 at 17:31
  • Check that the directories above have "a+x" (not a+r). That lets user reads files they have permission to, but not list the directory contents. However, this may create other security issues. You could also copy the certs to another directory and tweak user apps to look there. – barrycarter Oct 19 '14 at 17:55
1

I don't think that you ever want users to have access to the servers private key. Of course, access to the public key doesn't matter.

I think that your other services should be running under non-privileged but still non-user accounts. Then you can change ownership of the keys to root:adm or something more suitable and add the service accounts to the same group. The public key can be world readable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.