Skip to content

Document and check ssl file permissions for non-root misp-nginx #491

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ostefano merged 3 commits into from
Nov 2, 2026
Merged

Document and check ssl file permissions for non-root misp-nginx #491

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cdc2488
docs(nginx): document ssl file permissions for non-root misp-nginx
gotshell Nov 1, 2026
aec6ca9
fix(nginx): fail with a clear error if ssl files are not readable
gotshell Nov 1, 2026
c9d42c8
fix(nginx): reference the unreadable file in the permission hint
gotshell Nov 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -391,6 +391,8 @@ This improves security and scalability of the front-facing NGINX server but lead

**TLS/SSL:** The existing `./ssl` volume mount from `misp-core` is moved to the `misp-nginx` container, so existing certificates keep working.

**Permissions:** `misp-nginx` runs as a non-root user (uid/gid `101`) and mounts `./ssl` read-only, so `cert.pem` and `key.pem` must be readable by that user. If `key.pem` is owned by `root` with mode `600`, HTTPS will not work. Grant read access with `chgrp 101 ssl/key.pem && chmod 640 ssl/key.pem` or, since gid `101` may already belong to an unrelated group on the host (e.g. `ssh_keys` on RHEL), with an ACL: `setfacl -m u:101:r ssl/key.pem`.

**Certificates:** SSL is disabled if certificates are missing, but you can generate self-signed certificates with the following command: `mkdir -p ./ssl/ && openssl req -x509 -subj '/CN=localhost' -nodes -newkey rsa:4096 -keyout ssl/key.pem -out ssl/cert.pem -days 365 -addext "subjectAltName = DNS:localhost, IP:127.0.0.1, IP:::1"`

**GPG key delivery:** `gpg.asc` is now served via `misp-nginx`, which proxies the request through to `misp-core` (PHP-FPM) rather than serving a static file from the webroot path.
Expand Down
9 changes: 9 additions & 0 deletions nginx/files/04-ssl.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,15 @@ if [ ! -f "/etc/nginx/certs/cert.pem" ] || [ ! -f "/etc/nginx/certs/key.pem" ];
exit 0
fi

# ensure certificates are readable by the user running nginx
for f in /etc/nginx/certs/cert.pem /etc/nginx/certs/key.pem; do
if [ ! -r "$f" ]; then
echo "ERROR: $f exists but is not readable by uid $(id -u) / gid $(id -g)." >&2
echo "ERROR: Fix the permissions on the host, e.g. 'chgrp $(id -g) ssl/$(basename "$f") && chmod 640 ssl/$(basename "$f")'." >&2
exit 1
fi
done

# build redirect config if the BASE_URL is set
if [ -n "$BASE_URL" ]; then
cat >> "$REDIRECT_CONF" <<EOF
Expand Down