search

linux-system-roles / certificate

Role for managing TLS/SSL certificate issuance and renewal
https://linux-system-roles.github.io/certificate/
MIT License
30 stars 21 forks source link

Add permissions to provider certmonger #133

Closed jh23453 closed 1 year ago

jh23453 commented 2 years ago

The certmonger provider supports owner/group for the files. I've tried to get a certificate for cockpit. https://100things.wzzrd.com/2021/06/10/Proper-SSL-certs-in-cockpit.html suggests using "chmod g+r" for the certificates. It might be useful to support that. I could change the owner of my certificate to cockpit-ws, but would that be a good idea? I'm unsure.

richm commented 2 years ago

@martinpitt what ownership/permissions do cockpit certs need?

martinpitt commented 2 years ago

See PR #97, the role already can specify permissions. But it's not necessary any more with recent cockpit versions (Fedora, c8s, RHEL 8.7/9.1 at least, possibly already earlier) , permissions don't matter there. Can't be more precise right now, only next week again.

jh23453 commented 2 years ago

@martinpitt Thanks for the hint to the pull request - that should work nicely. I guess I'll remove my cert and retry with "group: cockpit-ws". Did that and yes, the resulting key/cert are readable from cockpit. So technically it works like you expected. Let me see if I find some suggestion for the documentation. Just to complete, here's how I requested certificates with ipa-getcert:

ipa-getcert request --wait \
        --keyfile="${keydir}/50-certmonger.key"   --key-owner=root:cockpit-ws --key-perms=640 \
        --certfile="${certdir}/50-certmonger.crt" --cert-owner=root --cert-perms=644 \
        -N "CN=${hostname}" -D "${hostname}" -K "cockpit/${hostname}"

Thanks for the prompt feedback.

jh23453 commented 2 years ago

Please look at https://github.com/linux-system-roles/certificate/pull/134

martinpitt commented 2 years ago

But it's not necessary any more with recent cockpit versions

To be specific: This was changed in https://cockpit-project.org/blog/cockpit-257.html , which is in RHEL 8.6 and 9.0, all Fedoras, CentOS 8/9 stream, Ubuntu 22.04 LTS. Debian stable has a backport.

martinpitt commented 2 years ago

@jh23453 : If you have a recent enough cockpit, you should be able to drop all four --{cert,key}-{owner,perms} options.

Nihlus commented 1 year ago

Some services require more restrictive permissions (postgresql, for example wants 0600 permissions for the private key). It would be nice if a mode parameter could be added to the module so we could control it ourselves.