0

I have an Apache server that serves a web application through https with a certificate. I also have a Node.js back-end/API which handles all the applications requests.

The traffic from Apache to the client is secure, but at the moment the traffic from the client to my back-end is not. I'd like to change this by also using https for my Node.js API, using the same certificate as suggested in: this question.

To do this I made a group certs and edited the nodeapi.service file in sytemd so that it belongs to that group. I also added the user running the node.js service to that group:

groups nodeuser
nodeuser : nodeuser sudo certs

Then I changed the permissions of the files so that the group can access them:

-rw-rwx--- 1 600 certs 1931 Nov 20 15:13 certificate.crt
-rw-rwx--- 1 600 certs 1704 Nov 20 15:12 certificate.key

I hoped this would work but node crashes:

Error: EACCES: permission denied, open './cert/certificate.key'

What could I have missed?

migrated from security.stackexchange.com Nov 29 '17 at 12:58

This question came from our site for information security professionals.

  • try to 'login' as the user you want the service to run under. than see if you can access the file (or propably why you can not). I suspect permissions on directory. – LvB Nov 27 '17 at 14:49
  • the permissions on the folder are: drw-r----- 2 root certs 4096 Nov 20 15:14 cert – NG. Nov 27 '17 at 14:59
  • 2
    Folders are executed ... in order for the group to be able to traverse the directory, the permissions need to be at least 550 ... the execute bits active for the owner and the group... like this: dr-xr-x--- – RubberStamp Nov 27 '17 at 15:31
  • what @RubberStamp says. to troverse (see what is inside) you need the x permission on the directory. – LvB Nov 27 '17 at 15:33
  • It seems like the two services are on the same host. Why would you need to use TLS on a connection on the loopback adapter? This doesn’t add much security. Also, having the node user being able to sudo (presumably without a password) will be to the amusement of someone pwning your node application. – Tobi Nary Nov 27 '17 at 15:46
0

The comment by RubberStamp is the answer. The group certs had no execute permission on the folder so it could not look inside. Setting the permission of the folder to at least 550 worked.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.