free
/
freedomboneeee
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Ownership permissions on lockdown of letsencrypt

This commit is contained in:
Bob Mottram 2018-01-07 12:09:16 +00:00
parent f6f6b29071
commit 1cea492656
3 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/freedombone-addcert
View File

@ -239,6 +239,7 @@ function add_cert_letsencrypt {
chgrp -R ssl-cert /etc/letsencrypt chgrp -R ssl-cert /etc/letsencrypt
chmod -R 600 /etc/letsencrypt chmod -R 600 /etc/letsencrypt
chmod -R g=rX /etc/letsencrypt chmod -R g=rX /etc/letsencrypt
chown -R root:ssl-cert /etc/letsencrypt
systemctl start nginx systemctl start nginx
exit 63216 exit 63216
fi fi
@ -288,6 +289,7 @@ function add_cert_letsencrypt {
chgrp -R ssl-cert /etc/letsencrypt chgrp -R ssl-cert /etc/letsencrypt
chmod -R 600 /etc/letsencrypt chmod -R 600 /etc/letsencrypt
chmod -R g=rX /etc/letsencrypt chmod -R g=rX /etc/letsencrypt
chown -R root:ssl-cert /etc/letsencrypt
nginx_ensite ${LETSENCRYPT_HOSTNAME} nginx_ensite ${LETSENCRYPT_HOSTNAME}
systemctl start nginx systemctl start nginx

1
src/freedombone-utils-setup
View File

@ -645,6 +645,7 @@ function lockdown_permissions {
if [ -d /etc/letsencrypt ]; then if [ -d /etc/letsencrypt ]; then
chmod -R 600 /etc/letsencrypt chmod -R 600 /etc/letsencrypt
chmod -R g=rX /etc/letsencrypt chmod -R g=rX /etc/letsencrypt
chown -R root:ssl-cert /etc/letsencrypt
fi fi
chown -f root:root /etc/motd /etc/issue* chown -f root:root /etc/motd /etc/issue*
chmod -f 0444 /etc/motd /etc/issue* chmod -f 0444 /etc/motd /etc/issue*

4
tests/output.sh
View File

@ -488,7 +488,9 @@ time, are stored in the following directories by default:\n\n/lib\n/lib64\n/usr/
find -L /lib \! -user root -exec ls -l {} \; | grep -v '> /dev/null' find -L /lib \! -user root -exec ls -l {} \; | grep -v '> /dev/null'
find -L /lib64 \! -user root -exec ls -l {} \; find -L /lib64 \! -user root -exec ls -l {} \;
find -L /usr/lib \! -user root -exec ls -l {} \; find -L /usr/lib \! -user root -exec ls -l {} \;
find -L /usr/lib64 \! -user root -exec ls -l {} \; if [ -d /usr/lib64 ]; then
find -L /usr/lib64 \! -user root -exec ls -l {} \;
fi
;; ;;
V-38469) if [ "$3" = "en" ]; then V-38469) if [ "$3" = "en" ]; then
log_msg $2 'All system command files must have mode 755 or less permissive.' log_msg $2 'All system command files must have mode 755 or less permissive.'