mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 05:40:11 +01:00

Bernhard Reiter 2905a30cc0

* Improve nginx setup to transfer auth information to the fcgiwrap
 backend.
 * Add instructions for creating client certs for testing.
 * Add debug output to see if and which client cert has been used when
   calling the csaf_provider.go .

2022-02-15 18:20:24 +01:00

2.2 KiB

Raw Blame History

Setup provider

The provider is meant to run as an CGI program in an nginx enviroment.

The following instructions are for an Debian 11 server setup.

apt-get install nginx fcgiwrap
cp /usr/share/doc/fcgiwrap/examples/nginx.conf /etc/nginx/fcgiwrap.conf
systemctl status fcgiwrap.service
systemctl status fcgiwrap.socket
systemctl is-enabled fcgiwrap.service
systemctl is-enabled fcgiwrap.socket

cd /var/www
chgrp -R www-data .
chmod -R g+w .

Content of /etc/nginx/fcgiwrap.conf

# Include this file on your nginx.conf to support debian cgi-bin scripts using
# fcgiwrap
location /cgi-bin/ {
  # Disable gzip (it makes scripts feel slower since they have to complete
  # before getting gzipped)
  gzip off;

  # Set the root to /usr/lib (inside this location this means that we are
  # giving access to the files under /usr/lib/cgi-bin)
  root  /usr/lib;

  # Fastcgi socket
  fastcgi_pass  unix:/var/run/fcgiwrap.socket;

  # Fastcgi parameters, include the standard ones
  include /etc/nginx/fastcgi_params;

  fastcgi_split_path_info ^(.+\.go)(.*)$;

  # Adjust non standard parameters (SCRIPT_FILENAME)
  fastcgi_param SCRIPT_FILENAME  /usr/lib$fastcgi_script_name;

  fastcgi_param PATH_INFO $fastcgi_path_info;
  fastcgi_param CSAF_CONFIG /usr/lib/csaf/config.toml;

  fastcgi_param SSL_CLIENT_VERIFY $ssl_client_verify;
  fastcgi_param SSL_CLIENT_S_DN $ssl_client_s_dn;
  fastcgi_param SSL_CLIENT_I_DN $ssl_client_i_dn;
}

Add to /etc/nginx/sites-enabled/default:

server {

    root /usr/share/nginx/html;

    location / {
        # Other config
        # ... 

        # For atomic directory switches
        disable_symlinks off;

        # directory listings
        autoindex on;
    }

    # enable CGI

    include fcgiwrap.conf;
}

Place the binary under /usr/lib/cgi-bin/csaf_provider.go. Make sure /usr/lib/cgi-bin/ exists.

Create configuration file under /usr/lib/csaf/config.toml:

# upload_signature = true
# key = "/usr/lib/csaf/public.asc"
key = "/usr/lib/csaf/private.asc"
#tlps = ["green", "red"]
domain = "http://192.168.56.102"
#no_passphrase = true

with suitable replacements.

Create the folders:

curl http://192.168.56.102/cgi-bin/csaf_provider.go/create

2.2 KiB Raw Blame History

Setup provider

2.2 KiB

Raw Blame History