Re: [Pound Mailing List] Privileges for unprivileged user to run Pound proxy server

Well, that helps a bit, but is still pretty confuse.

Does that mean the user to run pound only needs following privileges:
ro to /etc/pound/pound.cfg (/usr/local/etc/ is empty in the container)
ro to the zertificate pem-files
ro to /var/log/ (/var/log/messages does not exist (yet), probably cause I have not been able to start pound yet.)
rw to /var/run/pound.pid

(What I forgot in my former e-mail, inside the lx-contianer Debian 8 Jessie is running.)

Confirmation or correction would be greatly appreciated.

Regards
Philipp


> Am 20.Juli.2017 um 22:01 schrieb Wohl, Grant <GWohl-h24J5Rg4mPX/QjVuFdU/lAC/[email protected]>:
> 
> From the pound man page: "In general, Pound does not read or write to the hard-disk. The exceptions are reading the configuration file and (possibly) the server certificate file(s) and error message(s), which are opened read-only on startup, read, and closed, and the pid file which is opened on start-up, written to and immediately closed. Following this there is no disk access whatsoever, so using a RootJail directive is only for extra security bonus points."
> 
> See the rest of the man page (man pound or <https://linux.die.net/man/8/pound>) and possibly these other sites for more details on using the RootJail option: <https://fossies.org/linux/Pound/FAQ>, <http://www.project-open.com/en/howto-pound-https-configuration>. I do not use the RootJail myself but I can tell you that the /etc/resolv.conf and /etc/hosts are for DNS resolution and the /dev/urandom is needed for OpenSSL.
> 
> 
> -----Original Message-----
> From: Philipp Reichmuth [mailto:[email protected]] 
> Sent: Thursday, July 20, 2017 2:17 PM
> To: [email protected]
> Subject: [Pound Mailing List] Privileges for unprivileged user to run Pound proxy server
> 
> Hello
> 
> Since this is the primary source for support according to the pound homepage, I am asking the question here. After searching the internet for more than an hour, I could not find a clear answer.
> 
> I am trying to install Pound in an lxc-container on my Qnap NAS. Therefore I need to create the unprivileged user to run pound manually. Hence, I need to know what privileges this user needs, what files he needs to access with read and which with write privileges.
> 
> In case Pound is runned in a rootjail, how do the privileges of the user change? Is the rootjail the only path the user needs access in this case?
> 
> Thanks, regards
> Philipp
> --
> To unsubscribe send an email with subject unsubscribe to [email protected]
> Please contact [email protected] for questions.
> 
> --
> To unsubscribe send an email with subject unsubscribe to [email protected]
> Please contact [email protected] for questions.


--
To unsubscribe send an email with subject unsubscribe to [email protected]
Please contact [email protected] for questions.