Arch Linux

SwissGeorge

Member

Registered: 2017-05-03

Posts: 16

apache ssl SSLPassPhraseDialog

hi

starting apache / httpd in systemd environment force to drill security holes in the system.

SSLPassPhraseDialog     builtin

keys can not be protected any more by a passphrase. first i started httpd manualy to make sure everything is working properly. and it did.

i so tried

#SSLPassPhraseDialog        "exec:/etc/httpd/MyAnswer"
#SSLPassPhraseDialog        "|/etc/httpd/MyAnswer"

MyAnswer is a most simple sh-script

echo "password"

all of these versions did not work. apache just stops without any messages or log entries. kernel shows

open("/etc/ssl/service/Http.key", O_RDONLY) = 10
fstat(10, {st_mode=S_IFREG|0600, st_size=1766, ...}) = 0
read(10, "-----BEGIN RSA PRIVATE KEY-----\n"..., 4096) = 1766
close(10)                               = 0

well, i so ended up in removing passphrase from the key. it also works great.

question: is this the path concerning security: back to the future? does any have a working configuration with SSLPassPhraseDialog for systemd integration?

qinohe

Member

From: Netherlands

Registered: 2012-06-20

Posts: 1,601

Re: apache ssl SSLPassPhraseDialog

You think it's a good idea to store a password in plain txt on your server?, it's not.
My advice is you may want to revice your workflow a bit creating certificates. Store your keys without a pasword and set some sane permissions say root 400, store them in a safe place which probably is not the server.
If this concerns a local server which is only used by you it don't matter all that much, though if someone has access to that machine...,  better safe than sorry.
Btw. I have never used SSLPassPhraseDialog.

SwissGeorge

Member

Registered: 2017-05-03

Posts: 16

Re: apache ssl SSLPassPhraseDialog

hi

You think it's a good idea to store a password in plain txt on your server?

well no, not until now. i was using the builtin - changed run-level and had to type in the passphrase. passphrases never were stored on the machine it self. was not fully automatic therefore. only five people were able to start critical applications.

yea - safety is always a matter of point of view. no responsabilities - no concequences - no risk.
yea - safety - what is it? confidentialiy or availability? might be both together.

Store your keys without a pasword and set some sane permissions say root 400, store them in a safe place which probably is not the server.

i was willing to give a try. but run into problems setting SSLCertificateKeyFile. furthermore apache was asking me for read access.

sorry i posted this question. looks like it's hurting.

thank you for answering anyway. i have to look for a solution without systemd for critical applications.

have fun guy's