search

mumble-voip / mumble

Mumble is an open-source, low-latency, high quality voice chat software.
https://www.mumble.info
Other
6.41k stars 1.12k forks source link

Document permissions/privilege drop for cert and key specified in ini file #1950

Open mkrautz opened 8 years ago

mkrautz commented 8 years ago

Via mumble-voip/mumble#1949

The ini file should document that if you have configured Murmur to drop privileges, that the certificate and key files should be readable by that user. (That is the current behavior -- it could also be argued that Murmur should read the certificate and key early, allowing them to be root readable only.)

janschejbal commented 8 years ago

It didn't work for me, then it suddenly started working, on Ubuntu 14.04 LTS - strace is telling me that mumble reads the certificate before dropping privileges.

A look at the code says config is read here https://github.com/mumble-voip/mumble/blob/0840dd4578029c93810cc0369b4bd23188647916/src/murmur/main.cpp#L346

privileges are dropped here https://github.com/mumble-voip/mumble/blob/0840dd4578029c93810cc0369b4bd23188647916/src/murmur/main.cpp#L385

After apt-get remove --purge mumble-server, reinstalling and restoring the mumble-server.ini, it's broken again.

/etc/defaults/mumble-server sets MURMUR_USE_CAPABILITIES=0

After running dpkg-reconfigure mumble-server and telling it to use higher priority, MURMUR_USE_CAPABILITIES=1 in /etc/defaults/mumble-server.

Can we just make MURMUR_USE_CAPABILITIES=1 the default where supported if that's not already the case in more current packages (and possibly control the priority with a separate setting if not already the case)?

The init script will pass --chuid $USER:$GROUP to start-stop-daemon if "$MURMUR_USE_CAPABILITIES" != "1".

N.B.: There don't seem to be ARM architecture packages in the custom PPA, meaning that I end up with outdated Ubuntu LTS packages on my ARM server even if I add the PPA.

dlasher commented 7 years ago

in at least 1.2.7/ubuntu/PPA - that doesn't solve it either.

Ended up creating a new group, certs, adding root/mumble-server to it, then changing the ownership/perms on the folder (/etc/letsencrypt) to the group.

Needs a better fix.

sootstone commented 7 years ago

Running into this problem as well, thanks for the tip @janschejbal, but didn't work for me :(

Agree with @dlasher editing ownership/perms is not ideal.

kkartaltepe commented 7 years ago

Still an issue with Ubuntu 16.04 packages unfortunately. Following janschejbal's recommendation you need to set MURMUR_USE_CAPABILITIES=1 in /etc/defaults/mumble-server MURMUR_USE_CAPABILITIES=1 in /etc/init.d/mumble-server why the package maintainer for Ubuntu still has this behind so many locks is beyond me.