<feed xmlns='http://www.w3.org/2005/Atom'>
<title>lacme/debian/lacme.postrm, branch debian/0.8.4-1</title>
<subtitle>Small ACME client written with process isolation and minimal privileges in mind</subtitle>
<link rel='alternate' type='text/html' href='http://git.guilhem.org/lacme/'/>
<entry>
<title>d/lacme.postrm: Don't delete system users on purge.</title>
<updated>2021-02-22T19:37:57+00:00</updated>
<author>
<name>Guilhem Moulin</name>
<email>guilhem@debian.org</email>
</author>
<published>2021-02-22T19:37:57+00:00</published>
<link rel='alternate' type='text/html' href='http://git.guilhem.org/lacme/commit/?id=3d1bc4f299d693b3b3d2bc77387f866bbfc14dd9'/>
<id>3d1bc4f299d693b3b3d2bc77387f866bbfc14dd9</id>
<content type='text'>
_lacme-www shouldn't own any file or directories, but there might be
files on disk owned by _lacme-client when 'challenge-directory' is used.

See https://wiki.debian.org/AccountHandlingInMaintainerScripts#Reasons_for_not_deleting_accounts .
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
_lacme-www shouldn't own any file or directories, but there might be
files on disk owned by _lacme-client when 'challenge-directory' is used.

See https://wiki.debian.org/AccountHandlingInMaintainerScripts#Reasons_for_not_deleting_accounts .
</pre>
</div>
</content>
</entry>
<entry>
<title>Use dedicated system users for internal components.</title>
<updated>2021-02-22T02:31:12+00:00</updated>
<author>
<name>Guilhem Moulin</name>
<email>guilhem@debian.org</email>
</author>
<published>2021-02-14T23:32:29+00:00</published>
<link rel='alternate' type='text/html' href='http://git.guilhem.org/lacme/commit/?id=a321c90db4a6d323f1a9bc06c4d861cee8868664'/>
<id>a321c90db4a6d323f1a9bc06c4d861cee8868664</id>
<content type='text'>
  * The internal webserver now runs as a dedicated system user _lacme-www
    (and group nogroup) instead of www-data:www-data.  This is configurable
    in the [webserver] section of the lacme(8) configuration file.
  * The internal ACME client now runs as a dedicated system user _lacme-client
    (and group nogroup) instead of nobody:nogroup.  This is configurable in
    the [client] section of the lacme(8) configuration file.
  * The _lacme-www and _lacme-client system users are created automatically by
    lacme.postinst (hence a new Depends: adduser), and deleted on purge.  (So
    make sure not to chown any file to these internal users.)
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
  * The internal webserver now runs as a dedicated system user _lacme-www
    (and group nogroup) instead of www-data:www-data.  This is configurable
    in the [webserver] section of the lacme(8) configuration file.
  * The internal ACME client now runs as a dedicated system user _lacme-client
    (and group nogroup) instead of nobody:nogroup.  This is configurable in
    the [client] section of the lacme(8) configuration file.
  * The _lacme-www and _lacme-client system users are created automatically by
    lacme.postinst (hence a new Depends: adduser), and deleted on purge.  (So
    make sure not to chown any file to these internal users.)
</pre>
</div>
</content>
</entry>
</feed>
