search

tor2web / Tor2web

Tor2web is an HTTP proxy software that enables access to Tor Hidden Services by mean of common web browsers
https://www.tor2web.org
GNU Affero General Public License v3.0
705 stars 176 forks source link

Letsencrypt: Tor2web does not load certificates that are a symlink of a symlink in letsencrypt #269

Open fpietrosanti opened 8 years ago

fpietrosanti commented 8 years ago

Tor2web does not load certificates that are a symlink of a symlink, and this does not load proper implementation of letsencrypt in a maintainable way where all /home/tor2web/certs/ files are symlink to the /etc/letsencrypt/live/$DOMAINNAME/files.

Those get setup as: ln -s /etc/letsencrypt/live/$PUBLICHOSTNAME/privkey.pem /home/tor2web/certs/tor2web-key.pem ln -s /etc/letsencrypt/live/$PUBLICHOSTNAME/cert.pem /home/tor2web/certs/tor2web-certificate.pem ln -s /etc/letsencrypt/live/$PUBLICHOSTNAME/fullchain.pem /home/tor2web/certs/tor2web-intermediate.pem

The file on letsencrypt directory /etc/letsencrypt/live are also symlink to /etc/letsencrypt/archive/ .

The error preventing Tor2web to startup is: Tor2web Startup Failure: unexistent file (/home/tor2web/certs/tor2web-key.pem)

If i issue on Linux a cat /home/tor2web/certs/tor2web-key.pem it works properly

--- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/29581738-letsencrypt-tor2web-does-not-load-certificates-that-are-a-symlink-of-a-symlink-in-letsencrypt?utm_campaign=plugin&utm_content=tracker%2F318575&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F318575&utm_medium=issues&utm_source=github).
fpietrosanti commented 8 years ago

For some reason, even trough the file where accessibile, it's parent-parent directory was root owned with 700 permissions, and maybe tor2web is doing some kind of file access testing that trigger an access denied.

By changing the letsencrypt permissions as follow, everything worked out, but ideally tor2web shall be able access those files directly: chgrp tor2web /etc/letsencrypt/live/ chgrp tor2web /etc/letsencrypt/archive chmod g+rx /etc/letsencrypt/archive chmod g+rx /etc/letsencrypt/live

I'm wondering if the way tor2web test file access cannot be made compatibile with such restricted permissions, without changing the permissions of letsencrypt.

fpietrosanti commented 8 years ago

The fix to do is that: IF letsencrypt is installed and letsencrypt certificate is configured; then fix permissions FI