From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 6B89A1FF15E for ; Fri, 23 Aug 2024 11:11:59 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 9203DD0A7; Fri, 23 Aug 2024 11:12:21 +0200 (CEST) From: Gabriel Goller To: pbs-devel@lists.proxmox.com Date: Fri, 23 Aug 2024 11:12:15 +0200 Message-Id: <20240823091215.124453-1-g.goller@proxmox.com> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.043 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record T_SCC_BODY_TEXT_LINE -0.01 - URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [proxmox-backup-proxy.rs, proxmox.com] Subject: [pbs-devel] [PATCH proxmox-backup] proxy: check permissions on proxy.key and proxy.pem files X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox Backup Server development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pbs-devel-bounces@lists.proxmox.com Sender: "pbs-devel" Check the owner and permission of the proxy.key and proxy.pem files. This avoids openssl's unhelpful error message and prints a nicer one. Motivation: https://forum.proxmox.com/threads/proxmox-backup-tailscale-proxmox-backup-proxy-service-wont-boot.153204 Signed-off-by: Gabriel Goller --- Note: not sure about the correct permissions, we currently default to 640, but maybe a minimum of 400 is enough? src/bin/proxmox-backup-proxy.rs | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/src/bin/proxmox-backup-proxy.rs b/src/bin/proxmox-backup-proxy.rs index 041f3aff999c..544196b8bc5d 100644 --- a/src/bin/proxmox-backup-proxy.rs +++ b/src/bin/proxmox-backup-proxy.rs @@ -367,6 +367,30 @@ async fn run() -> Result<(), Error> { Ok(()) } +/// Check permissions and owner of passed path. +fn check_permissions>(path: T, file_mode: u32) -> Result<(), Error> { + match nix::sys::stat::stat(path.as_ref()) { + Ok(stat) => { + if stat.st_uid != u32::from(pbs_config::backup_user()?.uid) + || stat.st_gid != u32::from(pbs_config::backup_group()?.gid) + || stat.st_mode & 0o770 < file_mode + { + bail!( + "file {:?} has wrong permissions - check if it's owned by {}:{} and has {} permissions", + path.as_ref(), + pbs_config::backup_user()?.uid, + pbs_config::backup_group()?.gid, + file_mode + ); + } + } + Err(err) => { + bail!("unable to open file {:?} - {err}", path.as_ref(),); + } + } + Ok(()) +} + fn make_tls_acceptor() -> Result { let key_path = configdir!("/proxy.key"); let cert_path = configdir!("/proxy.pem"); @@ -375,6 +399,9 @@ fn make_tls_acceptor() -> Result { let ciphers_tls_1_3 = config.ciphers_tls_1_3; let ciphers_tls_1_2 = config.ciphers_tls_1_2; + check_permissions(key_path, 0o640)?; + check_permissions(cert_path, 0o640)?; + let mut acceptor = proxmox_rest_server::connection::TlsAcceptorBuilder::new() .certificate_paths_pem(key_path, cert_path); -- 2.39.2 _______________________________________________ pbs-devel mailing list pbs-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel