From cdc248864965b0ef64cd502cb1387de44d8e5be8 Mon Sep 17 00:00:00 2001 From: gotshell <53199443+gotshell@users.noreply.github.com> Date: Sun, 1 Nov 2026 11:34:06 +0100 Subject: [PATCH 1/3] docs(nginx): document ssl file permissions for non-root misp-nginx misp-nginx runs as uid/gid 101 with ./ssl mounted read-only, so a key.pem owned by root with mode 600 cannot be read and HTTPS does not work. Refs #488. --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 37c9ff01..51a1323d 100644 --- a/README.md +++ b/README.md @@ -391,6 +391,8 @@ This improves security and scalability of the front-facing NGINX server but lead **TLS/SSL:** The existing `./ssl` volume mount from `misp-core` is moved to the `misp-nginx` container, so existing certificates keep working. +**Permissions:** `misp-nginx` runs as a non-root user (uid/gid `101`) and mounts `./ssl` read-only, so `cert.pem` and `key.pem` must be readable by that user. If `key.pem` is owned by `root` with mode `600`, HTTPS will not work. Grant read access with `chgrp 101 ssl/key.pem && chmod 640 ssl/key.pem` or, since gid `101` may already belong to an unrelated group on the host (e.g. `ssh_keys` on RHEL), with an ACL: `setfacl -m u:101:r ssl/key.pem`. + **Certificates:** SSL is disabled if certificates are missing, but you can generate self-signed certificates with the following command: `mkdir -p ./ssl/ && openssl req -x509 -subj '/CN=localhost' -nodes -newkey rsa:4096 -keyout ssl/key.pem -out ssl/cert.pem -days 365 -addext "subjectAltName = DNS:localhost, IP:127.0.0.1, IP:::1"` **GPG key delivery:** `gpg.asc` is now served via `misp-nginx`, which proxies the request through to `misp-core` (PHP-FPM) rather than serving a static file from the webroot path. From aec6ca9549aa70576b464e124659ec7e83d7facb Mon Sep 17 00:00:00 2001 From: gotshell <53199443+gotshell@users.noreply.github.com> Date: Sun, 1 Nov 2026 11:35:18 +0100 Subject: [PATCH 2/3] fix(nginx): fail with a clear error if ssl files are not readable 04-ssl.sh only checked that cert.pem and key.pem exist (-f). If they exist but are not readable by the nginx user, the SSL config was generated anyway and nginx failed later on. Check readability (-r) and exit with an explicit error message instead. Refs #488. --- nginx/files/04-ssl.sh | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/nginx/files/04-ssl.sh b/nginx/files/04-ssl.sh index 288e1ddf..87386218 100755 --- a/nginx/files/04-ssl.sh +++ b/nginx/files/04-ssl.sh @@ -13,6 +13,15 @@ if [ ! -f "/etc/nginx/certs/cert.pem" ] || [ ! -f "/etc/nginx/certs/key.pem" ]; exit 0 fi +# ensure certificates are readable by the user running nginx +for f in /etc/nginx/certs/cert.pem /etc/nginx/certs/key.pem; do + if [ ! -r "$f" ]; then + echo "ERROR: $f exists but is not readable by uid $(id -u) / gid $(id -g)." >&2 + echo "ERROR: Fix the permissions on the host, e.g. 'chgrp $(id -g) ssl/key.pem && chmod 640 ssl/key.pem'." >&2 + exit 1 + fi +done + # build redirect config if the BASE_URL is set if [ -n "$BASE_URL" ]; then cat >> "$REDIRECT_CONF" < Date: Sun, 1 Nov 2026 11:52:58 +0100 Subject: [PATCH 3/3] fix(nginx): reference the unreadable file in the permission hint The hint always suggested fixing ssl/key.pem, even when cert.pem was the unreadable file. Use the name of the file that failed the check. Refs #488. --- nginx/files/04-ssl.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nginx/files/04-ssl.sh b/nginx/files/04-ssl.sh index 87386218..edd84bfe 100755 --- a/nginx/files/04-ssl.sh +++ b/nginx/files/04-ssl.sh @@ -17,7 +17,7 @@ fi for f in /etc/nginx/certs/cert.pem /etc/nginx/certs/key.pem; do if [ ! -r "$f" ]; then echo "ERROR: $f exists but is not readable by uid $(id -u) / gid $(id -g)." >&2 - echo "ERROR: Fix the permissions on the host, e.g. 'chgrp $(id -g) ssl/key.pem && chmod 640 ssl/key.pem'." >&2 + echo "ERROR: Fix the permissions on the host, e.g. 'chgrp $(id -g) ssl/$(basename "$f") && chmod 640 ssl/$(basename "$f")'." >&2 exit 1 fi done