Comments (7)
The directory /tmp/certificates exists and it has write permission for the
shellinabox group.
Original comment by [email protected]
on 12 Jul 2009 at 6:39
from shellinabox.
The Debian package already starts the daemon for you and if it can find the
"openssl"
binary, it stores self-signed certificates in "/var/lib/shellinabox".
If you don't want the daemon to be started automatically, you will need to
disable it
in "/etc/default/shellinabox". But then you need to figure out how to correctly
set
it up yourselves, so I don't recommend that approach for most users.
If you then decide to start it manually, you have to make sure that the
certificate
directory has the right permissions. By default, shellinabox will drop
privileges to
become "nobody". So, if the directory isn't accessible by "nobody", shellinabox
won't
be able to serve encrypted connections. And that's most likely the problem you
are
seeing.
Of course, changing the directory to be owned by "nobody" would be a bad idea.
Anybody who can become "nobody", would then be able to read your private keys.
Instead, you should create a dedicated user for the shellinabox daemon. And
that's
what the Debian package does for you. You will notice that after installing the
package you have a "shellinabox" user. And that "/var/lib/shellinabox" is owned
by
"shellinabox".
You then also need to make sure you that you pass the right command line flags
to
switch to this user.
In other words, if you use the default settings that the package configures
after a
"dpkg -i", and if "openssl" is available in "/usr/bin", things should work out
of the
box. Just point your browser to "http://localhost:4200/".
If that doesn't work, that would be a bug. But I'd need to know more details to
figure out how your system is different from other Debian machines.
Original comment by [email protected]
on 12 Jul 2009 at 6:49
- Changed state: Invalid
from shellinabox.
I've also tried running SIAB with the same command line arguments mentioned on
the
man page:
" shellinaboxd -c certificates -g shellinaboxd
If the certificates directory exists and is writable by the shellinaboxd
group, self-signed SSL certificates will be generated in this directory.
Running
this command as root allows any user on the system to log in at http://
localhost:4200/. Sessions will automatically be promoted to SSL/TLS."
The shellinaboxd group doesn't exist (I don't know if that's a typo in the man
page,
or a problem with the Debian package). So I used -g shellinabox (that's the
group
name created by the installer).
Then if I point the browser to http://localhost:4200/ I can login wihtout any
problems. However, the session is never promoted to SSL/TLS (or at least the
browser
doesn't show any visual cues about that, like the URL changing to https or a
warning
about a self-signed certificate).
Original comment by [email protected]
on 12 Jul 2009 at 7:03
from shellinabox.
Just to discard permission related problems, I've run chmod 777
/tmp/certificates,
but I still get the same behaviour (i.e., http access works OK, but session
doesn't
get promoted to SSL).
Also, openssl is installed:
ii openssl 0.9.8c-4etch5
and the openssl command is available under /usr/bin
I'd be happy to provide any additional information required in order to
diagnose
this problem.
Original comment by [email protected]
on 12 Jul 2009 at 7:10
from shellinabox.
Thank you for pointing out the misleading example in the manual page. I'll
update that.
In the meantime, do you have Google Talk enabled? If so, that might be the
easiest
way to debug this issue, if you have a few minutes time.
Original comment by [email protected]
on 12 Jul 2009 at 7:20
from shellinabox.
Installing SIAB on a virtual machine running Lenny seems to work. I say "seems"
because I get a certificate.pem file under /tmp/certificates as soon as I run
shellinaboxd -c /tmp/certificates -g shellinabox (on the Etch box, that file
isn't
created when issuing the same command).
Howevever, when I access http://lennyhost:4200, then connection gets redirected
to
https, and then Firefox gives this message: "Firefox can't connect securely to
lennyhost because the site uses a security protocol which isn't enabled" (I'm
not
quite soure about what that really means).
The certificate.pem file has a 0 byte length, so I guess that something must be
wrong:
-r-------- 1 nobody shellinabox 0 2009-07-12 16:23 certificate.pem
Original comment by [email protected]
on 12 Jul 2009 at 7:29
from shellinabox.
If i create the certificate manually under /var/lib/shellinabox by running
openssl
req -x509 -nodes -days 7300 -newkey rsa:1024 -out certificate.pem -subj '/
CN=localhost/', and then run SIAB using the same command that is used by the
script
on init.d (/usr/bin/shellinaboxd -q --background=/var/run/shellinaboxd.pid -c
/var/
lib/shellinabox -p 4200 -u shellinabox -g shellinabox --no-beep), the behavior
is
still the same (http works fine, https doesn't).
ls /var/lib/shellinabox -l
-rwxrwxrwx 1 shellinabox shellinabox 790 2009-07-12 17:25 certificate.pem
-rwxrwxrwx 1 shellinabox shellinabox 887 2009-07-12 17:25 privkey.pem
I'll try to run SIAB on an official Debian Lenny LiveCD and see what happens.
Original comment by [email protected]
on 12 Jul 2009 at 8:37
from shellinabox.
Related Issues (20)
- Not working with windows RT HOT 2
- Stunnel with shellinabox
- New (unofficial) Release:
- ear
- There doesn't seem to be a way to disable SSL 3.0 protocol HOT 3
- Unable to get audible beep
- gethostbyname_r some errors on AIX 6.1
- cant access shellinabox with ie HOT 1
- ERR_SSL_VERSION_OR_CIPHER_MISMATCH HOT 1
- Browser loops on connectivity problems
- How to run few commands before startup? HOT 1
- Delay after typing in shellinabox HOT 2
- How to pass credentials to SSH command
- "-" key does not work in firefox HOT 3
- Decouple vt100.js from main project
- shellinaboxd: unrecognized service HOT 3
- Copy paste not working as expected HOT 1
- how to open and interact with shellinabox in a custom html page
- Prompt behind horizontal scroll bar
- migration to github or bitbucket ? HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from shellinabox.