From 15639f5b1aa607ccb4fec1a41643a3b916e0e44a Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Thu, 29 Jun 2017 10:48:35 +0200 Subject: webserver: refuse to follow symlink when serving ACME challenge responses. --- Changelog | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'Changelog') diff --git a/Changelog b/Changelog index 59d5153..9b13c44 100644 --- a/Changelog +++ b/Changelog @@ -4,7 +4,7 @@ lacme (0.3) upstream; lacme-certs.conf.d"), import the default section of files read earlier. + new-cert: create certificate files atomically. + webserver: allow listening to multiple addresses (useful when - dual-stack IPv4/IPv6 is not supported). Listen to a UNIX-domain + dual IPv4/IPv6 stack is not supported). Listen to a UNIX-domain socket by default . + webserver: don't install temporary iptables by default. Hosts without a public HTTP daemon listening on port 80 need to set the @@ -21,6 +21,11 @@ lacme (0.3) upstream; - new-cert: mark the basicConstraints (CA:FALSE) and keyUsage x509v3 extensions as critical in the CSR, following upstream fix of Boulder's issue #565. + - webserver: refuse to follow symlink when serving ACME challenge + responses. When dropping privileges to a dedicated UID + (recommended) only the ACME client could write to its current + directory anyway, so following symlinks was not a serious + vulnerability. -- Guilhem Moulin Sun, 19 Feb 2017 13:08:41 +0100 -- cgit v1.2.3 From a528bcffe2480245185a3b8d6e6c51307635a4ea Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Thu, 29 Jun 2017 10:52:01 +0200 Subject: lacme(1), lacme-accountd(1): fix version number. --- Changelog | 2 ++ lacme | 2 +- lacme-accountd | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) (limited to 'Changelog') diff --git a/Changelog b/Changelog index 9b13c44..1fd6762 100644 --- a/Changelog +++ b/Changelog @@ -26,6 +26,8 @@ lacme (0.3) upstream; (recommended) only the ACME client could write to its current directory anyway, so following symlinks was not a serious vulnerability. + - lacme(1), lacme-accountd(1): fix version number shown with + --version. -- Guilhem Moulin Sun, 19 Feb 2017 13:08:41 +0100 diff --git a/lacme b/lacme index 7adc972..1065e67 100755 --- a/lacme +++ b/lacme @@ -21,7 +21,7 @@ use strict; use warnings; -our $VERSION = '0.0.1'; +our $VERSION = '0.3'; my $NAME = 'lacme'; use Errno 'EINTR'; diff --git a/lacme-accountd b/lacme-accountd index 00d6ccd..547af59 100755 --- a/lacme-accountd +++ b/lacme-accountd @@ -22,7 +22,7 @@ use strict; use warnings; -our $VERSION = '0.0.1'; +our $VERSION = '0.3'; my $PROTOCOL_VERSION = 1; my $NAME = 'lacme-accountd'; -- cgit v1.2.3 From 7c7e01fa8d8623145078cc352c3617ad43ebe326 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Thu, 29 Jun 2017 10:52:01 +0200 Subject: Remove potential race when creating ACME challenge response files. --- Changelog | 2 ++ client | 18 +++++++++++------- 2 files changed, 13 insertions(+), 7 deletions(-) (limited to 'Changelog') diff --git a/Changelog b/Changelog index 1fd6762..5252fd2 100644 --- a/Changelog +++ b/Changelog @@ -28,6 +28,8 @@ lacme (0.3) upstream; vulnerability. - lacme(1), lacme-accountd(1): fix version number shown with --version. + - client: remove potential race when creating ACME challenge response + files. -- Guilhem Moulin Sun, 19 Feb 2017 13:08:41 +0100 diff --git a/client b/client index cd94ed8..333ae3b 100755 --- a/client +++ b/client @@ -44,10 +44,13 @@ use warnings; my $PROTOCOL_VERSION = 1; -use LWP::UserAgent (); +use Errno 'EEXIST'; +use Fcntl qw/O_CREAT O_EXCL O_WRONLY/; +use Digest::SHA qw/sha256 sha256_hex/; use MIME::Base64 qw/encode_base64 encode_base64url/; + +use LWP::UserAgent (); use JSON (); -use Digest::SHA qw/sha256 sha256_hex/; use Config::Tiny (); @@ -266,18 +269,19 @@ elsif ($COMMAND eq 'new-cert') { @{request_json_decode($r)->{challenges} // []}; die "Missing 'http-01' challenge in server response" unless defined $challenge; die "Invalid challenge token ".($challenge->{token} // '')."\n" + # ensure we don't write outside the cwd unless ($challenge->{token} // '') =~ /\A[A-Za-z0-9_\-]+\z/; my $keyAuthorization = $challenge->{token}.'.'.$JWK_thumbprint; # serve $keyAuthorization at http://$domain/.well-known/acme-challenge/$challenge->{token} - if (-e $challenge->{token}) { - print STDERR "WARNING: File exists: $challenge->{token}\n"; - } - else { - open my $fh, '>', $challenge->{token} or die "Can't open $challenge->{token}: $!"; + if (sysopen(my $fh, $challenge->{token}, O_CREAT|O_EXCL|O_WRONLY, 0644)) { $fh->print($keyAuthorization); $fh->close() or die "Can't close: $!"; + } elsif ($! == EEXIST) { + print STDERR "WARNING: File exists: $challenge->{token}\n"; + } else { + die "Can't open $challenge->{token}: $!"; } $r = acme($challenge->{uri}, { -- cgit v1.2.3 From 96dc4add445c5a48632bef6f8a4f0440c70f03d0 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Thu, 29 Jun 2017 22:23:38 +0200 Subject: Provide apache2 configuration snippet. --- Changelog | 2 +- config/apache2.conf | 12 ++++++++++++ config/nginx.conf | 2 +- 3 files changed, 14 insertions(+), 2 deletions(-) create mode 100644 config/apache2.conf (limited to 'Changelog') diff --git a/Changelog b/Changelog index 5252fd2..0674c4a 100644 --- a/Changelog +++ b/Changelog @@ -12,7 +12,7 @@ lacme (0.3) upstream; 'iptables' option to Yes. + Change 'min-days' default from 10 to 21, to avoid expiration notices from Let's Encrypt when auto-renewal is done by a cronjob. - + Provide nginx configuration snippet. + + Provide nginx and apache2 configuration snippets. - Ensure lacme's config file descriptor is not passed to the accountd or webserver components. - new-cert: sort section names if not passed explicitely. diff --git a/config/apache2.conf b/config/apache2.conf new file mode 100644 index 0000000..20927fa --- /dev/null +++ b/config/apache2.conf @@ -0,0 +1,12 @@ +# Use Apache2 to serve ACME requests by passing them over to a +# locally-bound lacme webserver component. +# +# This file needs to be sourced to the server directives (at least the +# non-ssl one) of each virtual host requiring authorization. + + + ProxyPass unix:///var/run/lacme.socket|http://127.0.0.1/.well-known/acme-challenge/ + Order allow,deny + Allow from all + + diff --git a/config/nginx.conf b/config/nginx.conf index e4ceb0c..6753ff9 100644 --- a/config/nginx.conf +++ b/config/nginx.conf @@ -1,4 +1,4 @@ -# Use nginx to serve ACME requests; either directly, or by passing them +# Use Nginx to serve ACME requests; either directly, or by passing them # over to a locally-bound lacme webserver component. # # This file needs to be sourced to the server directives (at least the -- cgit v1.2.3