0

For reference, this question is related to the following ones; but they do not provide the answer:

Storing RSA Private Key un-encrypted SSL password on apache2 restart

I have an Apache 2.2 server running on Windows 2003 Server. My private key files are stored unencrypted in the same folder as the Apache config files (following the Apache guidelines here: http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#removepassphrase).

The websites hosted on the server all share the same Apache instance. Apache runs under a dedicated user account, which has read access to the web folders and to the config/private key folders.

In principle, any customer should now be able to write a PHP script for reading these out, right? So it seems that this is not an ideal situation. The Apache guide says that the key files should only be readable by root. I can't do this since Apache would not be able to read them..

Is there a proper way to make these keyfiles readable to Apache without exposing them to any script running in Apache?

Community
  • 1
andreas
  • 1

2 Answers2

0

apache launches as root then spawns its process as the apache user, so it can still read the key files if they are owned as root, at that point in the start process apache will not serve files so any script a user may write wont get executed until apache has dropped its privileges into the apache user at this point the script wouldnt be able to read the files

2 simple solutions to your problem

  1. dont store the key files in the apache config directory (store them elsewhere on the server)
  2. make sure the key files are owned by root
anthonysomerset
  • 3,983
  • 2
  • 20
  • 24
0

The given answer does not apply to windows, I believe.

My sslcertificates/ folder is owned by "system". When Apache has no read access to this folder, then it won't start up. I used the sysinternals process monitor to find out what goes wrong, and it clearly shows that httpd.exe wants to read the key files (which makes sense).

Apache thus does need read access to these files!

So the question remains unanswered.

andreas
  • 1
  • If the Apache service is setup to start as an httpd user then that user will need read access to the configuration files (including SSL certs). – Chris S Apr 15 '11 at 13:03