RE: [Pound Mailing List] Privileges for unprivileged user to run Pound proxy server

From the pound man page: "In general, Pound does not read or write to the hard-disk. The exceptions are reading the configuration file and (possibly) the server certificate file(s) and error message(s), which are opened read-only on startup, read, and closed, and the pid file which is opened on start-up, written to and immediately closed. Following this there is no disk access whatsoever, so using a RootJail directive is only for extra security bonus points."

See the rest of the man page (man pound or <https://linux.die.net/man/8/pound>) and possibly these other sites for more details on using the RootJail option: <https://fossies.org/linux/Pound/FAQ>, <http://www.project-open.com/en/howto-pound-https-configuration>. I do not use the RootJail myself but I can tell you that the /etc/resolv.conf and /etc/hosts are for DNS resolution and the /dev/urandom is needed for OpenSSL.


-----Original Message-----
From: Philipp Reichmuth [mailto:[email protected]] 
Sent: Thursday, July 20, 2017 2:17 PM
To: [email protected]
Subject: [Pound Mailing List] Privileges for unprivileged user to run Pound proxy server

Hello

Since this is the primary source for support according to the pound homepage, I am asking the question here. After searching the internet for more than an hour, I could not find a clear answer.

I am trying to install Pound in an lxc-container on my Qnap NAS. Therefore I need to create the unprivileged user to run pound manually. Hence, I need to know what privileges this user needs, what files he needs to access with read and which with write privileges.

In case Pound is runned in a rootjail, how do the privileges of the user change? Is the rootjail the only path the user needs access in this case?

Thanks, regards
Philipp
--
To unsubscribe send an email with subject unsubscribe to [email protected]
Please contact [email protected] for questions.

--
To unsubscribe send an email with subject unsubscribe to [email protected]
Please contact [email protected] for questions.