So I have a script, which at it's heart runs
apachectl -t -D DUMP_VHOSTS to get a list of all the vhosts on a particular machine. It then greps the response from that, and produces a json blob of machine parseable information about the configuration of vhosts on a machine.
This will be run as a non-privileges user, as it simply an analysis of what is, not a privileged attempt to change anything.
However, on debian, non-privileged users, quite rightly can't read anything in
/etc/ssl/private, so I get:-
AH00526: Syntax error on line 27 of /etc/apache2/sitesenabled/ssl_proxy.conf: SSLCertificateKeyFile: file '/etc/ssl/private/ssl-cert-snakeoil.key' does not exist or is empty
This issue is discussed at Apache: SSLCertificateKeyFile: file does not exist or is empty
However, I don't want the user running the script to access the key file or otherwise test the config, I simply want apache to tell me about what vhosts are defined.
On the server that's specifically throwing this error, I don't even use SSL, so it's complaining about a key which doesn't even relate to a VHOST, but I can see that it might, but it seems apache can't be told just to carry on, and ignore SSL modules or anything.
Any ideas how to do that, beyond parsing the apache configs directly?
So it seems on examination, that what apachectl is doing when it DUMP(s)_VHOSTS, is not quite as stupid as thought. It's essentially validating the config file, which is to say, checking that files specified, do exist. It's not, trying to read the contents of the file. Hence the caller doesn't need read permission on the file, just read permission on the directory containing the file.