0

The user (33) is not able to read the web.{crt,key} files. Do I have to give permission all through the links or is there a clever way to do this?

# ll /mnt/efs/cert
total 20
-rw-r--r-- 1 33 tape 1237 Oct  9 14:30 dag.crt
-rw-r--r-- 1 33 tape 1704 Oct  9 14:30 dag.pem
drwxr-xr-x 2 33 tape 6144 Dec  7  2018 ldap
lrwxrwxrwx 1 33 tape   74 Oct 14 12:13 web.crt -> /etc/letsencrypt/live/domain/fullchain.pem
lrwxrwxrwx 1 33 tape   72 Oct 14 12:13 web.key -> /etc/letsencrypt/live/domain/privkey.pem
# ll /etc/letsencrypt/live/domain/
total 4
lrwxrwxrwx 1 root root  62 Oct 14 12:01 cert.pem -> ../../archive/domain/cert1.pem
lrwxrwxrwx 1 root root  63 Oct 14 12:01 chain.pem -> ../../archive/domain/chain1.pem
lrwxrwxrwx 1 root root  67 Oct 14 12:01 fullchain.pem -> ../../archive/domain/fullchain1.pem
lrwxrwxrwx 1 root root  65 Oct 14 12:01 privkey.pem -> ../../archive/domain/privkey1.pem
-rw-r--r-- 1 root root 692 Oct 14 12:01 README
# ll /etc/letsencrypt/archive/domain/
total 16
-rw-r--r-- 1 root root 1972 Oct 14 12:01 cert1.pem
-rw-r--r-- 1 root root 1647 Oct 14 12:01 chain1.pem
-rw-r--r-- 1 root root 3619 Oct 14 12:01 fullchain1.pem
-rw------- 1 root root 1708 Oct 14 12:01 privkey1.pem
  • Permissions and ownership on symbolic links do not matter and are ignored. – AlexP Oct 14 '19 at 14:10
1

I wanted to add a comment, but as 50 reputation points are needed to comment.

As per my information, The access permissions of end file to which all links are pointing, does matter as it is the file you are trying to access. As access permission of privkey1.pem in /etc/letsencrypt/archive/domain/ does not allow read access for any users other than root, so it is inaccessible by any user other than root.

You should change its permission to '644' to give read access to other users.

chmod 0644 /etc/letsencrypt/archive/domain/privkey1.pem

|improve this answer|||||
0

First it is necessary to check that the user (33) belongs to the typing group. If the tape group does not exist then it should be created.

To display the users belonging to the typed group you can use the following command:

sudo groups tape

To add the user (33) to the typing group, you can use the following command

sudo gpasswd -a $(getent passwd 33|cut -d: -f1) type

Then to make each file accessible for reading and writing you can use the following command:

for d in /mnt/efs/cert /etc/letsencrypt/live/domain/ /etc/letsencrypt/archive/domain/; for f in $(ls $d);do chmod g+rw $f;done ;done
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.