{"action":"created","issue":{"url":"https://api.github.com/repos/m13253/dns-over-https/issues/23","repository_url":"https://api.github.com/repos/m13253/dns-over-https","labels_url":"https://api.github.com/repos/m13253/dns-over-https/issues/23/labels{/name}","comments_url":"https://api.github.com/repos/m13253/dns-over-https/issues/23/comments","events_url":"https://api.github.com/repos/m13253/dns-over-https/issues/23/events","html_url":"https://github.com/m13253/dns-over-https/issues/23","id":363048194,"node_id":"MDU6SXNzdWUzNjMwNDgxOTQ=","number":23,"title":"doh-server not starting when key file is only readable by root","user":{"login":"josvo","id":31761359,"node_id":"MDQ6VXNlcjMxNzYxMzU5","avatar_url":"https://avatars2.githubusercontent.com/u/31761359?v=4","gravatar_id":"","url":"https://api.github.com/users/josvo","html_url":"https://github.com/josvo","followers_url":"https://api.github.com/users/josvo/followers","following_url":"https://api.github.com/users/josvo/following{/other_user}","gists_url":"https://api.github.com/users/josvo/gists{/gist_id}","starred_url":"https://api.github.com/users/josvo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/josvo/subscriptions","organizations_url":"https://api.github.com/users/josvo/orgs","repos_url":"https://api.github.com/users/josvo/repos","events_url":"https://api.github.com/users/josvo/events{/privacy}","received_events_url":"https://api.github.com/users/josvo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-09-24T08:12:01Z","updated_at":"2018-09-25T15:18:30Z","closed_at":null,"author_association":"NONE","body":"Hello\r\n\r\nIn doh-server.conf you can set a cert an key file. However, when the key file is only readable by root, the service won't start:\r\n\r\n`[root@testserver ~]# ls -l test.key`\r\n-r-------- 1 root root 1675 21. Sep 17:52 test.key\r\n\r\n`systemctl status doh-server`\r\n● doh-server.service - DNS-over-HTTPS Server\r\n   Loaded: loaded (/usr/lib/systemd/system/doh-server.service; disabled; vendor preset: disabled)\r\n   Active: activating (auto-restart) since Mon 2018-09-24 10:08:34 CEST; 949ms ago\r\n     Docs: https://github.com/m13253/dns-over-https\r\n  Process: 152070 ExecStart=/usr/local/bin/doh-server -conf /etc/dns-over-https/doh-server.conf (code=exited, status=0/SUCCESS)\r\n Main PID: 152070 (code=exited, status=0/SUCCESS)\r\n\r\nIt works when permissions are set to 444.\r\nI checked the service which drops its privileges and is then using AmbientCapabilities to bind to port 443; however I don't know how to read the file as user nobody with AmbientCapabilities."},"comment":{"url":"https://api.github.com/repos/m13253/dns-over-https/issues/comments/424386516","html_url":"https://github.com/m13253/dns-over-https/issues/23#issuecomment-424386516","issue_url":"https://api.github.com/repos/m13253/dns-over-https/issues/23","id":424386516,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNDM4NjUxNg==","user":{"login":"m13253","id":1808930,"node_id":"MDQ6VXNlcjE4MDg5MzA=","avatar_url":"https://avatars3.githubusercontent.com/u/1808930?v=4","gravatar_id":"","url":"https://api.github.com/users/m13253","html_url":"https://github.com/m13253","followers_url":"https://api.github.com/users/m13253/followers","following_url":"https://api.github.com/users/m13253/following{/other_user}","gists_url":"https://api.github.com/users/m13253/gists{/gist_id}","starred_url":"https://api.github.com/users/m13253/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/m13253/subscriptions","organizations_url":"https://api.github.com/users/m13253/orgs","repos_url":"https://api.github.com/users/m13253/repos","events_url":"https://api.github.com/users/m13253/events{/privacy}","received_events_url":"https://api.github.com/users/m13253/received_events","type":"User","site_admin":false},"created_at":"2018-09-25T15:18:30Z","updated_at":"2018-09-25T15:18:30Z","author_association":"OWNER","body":">  You are of course right with OCSP Stapling, which still would not be solved.\r\n\r\nI tried to search an easy OCSP Stapling library for Go, but come up with no good solution.\r\nActually when OCSP Stapling is available, I would certainly provide a better experience in running doh-server as standalone mode.\r\n\r\nI know Caddy (an HTTP server written in Go) has OCSP Stapling by default. Maybe I need to check their code.\r\nBut my intuition tells me it won't be so easy.\r\n\r\nAnyway I recommend running a frontend load-balancer and do HTTPS their at the moment."}}
{"actor":{"display_login":"m13253"}}