1

I'm currently trying to share and use my wildcard certificate from letsencrypt with NFS, but the servers who are supposed to use it, cannot do so.

To my Setup: I have 3 VM's (in future maybe 4) running. One is a Reverse-proxy, that receives all http and https traffic and redirects them to my Mail server and my Kanboard. My mailserver runs with iRedMail.

My problem is that I fail to deploy the certificate on both, the Kanboard and the iRedMail server. Kanboard (APACHE2) tells me this:

SSLCertificateFile: file '/mnt/letsencrypt/live/domain.com/fullchain.pem' does not exist or is empty

and iRedMail (NGINX) this:

nginx: [emerg] BIO_new_file("/etc/ssl/certs/iRedMail.crt") failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/etc/ssl/certs/iRedMail.crt'

Since I dont want this post to drag to long, I created some pastebins with my configs, and things I have done. Reverse-proxy, iRedMail, Kanboard : All will be accessible for 6 months.

HTTPS access for domain.com (meaning Reverse-Proxy) works without a problem.

Output for sudo ls -l /etc/letsencrypt/ (live)

drwxrwxrwx 3 administrator root 4096 Feb 13 16:25 live

All 3 Servers run Ubuntu 1804 Server and the user "administrator" uses the same credentials.

If you need anymore information, feel free to ask. Edits

  1. Outputs for namei -lx /path/to/private/key
7
  • What output do you get for namei -lx /path/to/private/key on each server? – muru Feb 17 '20 at 9:47
  • 1
    DId you run the above daemons as root? Did you use no_root_squash on NFS server? – Romeo Ninov Feb 17 '20 at 11:13
  • Hello, thanks for the quick replies. @muru I added a link to a pastebin with all outputs to the original post. @Romeo - I run the systemctl start commands with sudo if you mean this. And I did not use the use no_root_squash in my export config file. Please correct me if I am on the wrong track. – Zockerjonny Feb 17 '20 at 11:35
  • @Zockerjonny if you didn't use no_root_squash, the default root_squash takes effect, so access as root from the client is treated as from access from some other user on the server. As you can see in the namei output, at least some directories are only accessibly by root. – muru Feb 18 '20 at 1:42
  • @muru adding the root_squash enabled both servers to use the Certificate. Thanks! – Zockerjonny Feb 18 '20 at 7:05
0

Because the daemons in list run as root (mail and web listen on port <1024) and those daemons try to read from NFS they will have problem because usually NFS shares are done w/o option no_root_squash. The idea is NFS map local (on client) root user as anonymous user with ID not 0. And local root user will have no access to NFS shared files and directories with restricted permissions only for root. So the OP can resolve this issue using two ways:

  1. change permissions of files and directories so world can read the files.

or

  1. add no_root_squash to the NFS share (and restart NFS server)
0

Thanks to @muru and @RomeoNinov I was able to use the certificates with a small adjustment to my NFS-Server. Since my Pastebins are limited to 6 months I'll post my config here.

I am still using NFS to share my Certificates across the Network

sudo nano /etc/exports opens my config and in the last line I used the following before /etc/letsencrypt IP-OF-REVERSE-PROXY (rw,sync,no_subtree_check) I simply added no_root_squash at the end (rw,sync,no_subtree_check,no_root_squash).

After a restart of all servers I checked if the services were running - they did. I went into the browser and checked the local-IPs to have a look at the certificates, all were correct.
I also edited /etc/hosts.allow and /etc/hosts.deny after reading no_root_squash to limit the access to my NFS-share allowing the 3 servers to access my share, allowing my Admin-PC remote access via SFTP and SSH and denying everything else. Hosts.allow NFS

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.