Community Packages

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#47579 - [letsencrypt] should not require running as root

Attached to Project: Community Packages
Opened by Jamin Collins (jamincollins) - Thursday, 31 December 2015, 17:28 GMT
Last edited by Bruno Pagani (ArchangeGabriel) - Tuesday, 26 December 2017, 13:13 GMT
Task Type Feature Request
Category Packages
Status Closed
Assigned To Felix Yan (felixonmars)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:
After installation, letsencrypt can not be run as a normal user. This appears to be due to permissions on the log and configuration directories:
$ ls -ld /var/log/letsencrypt
drwx------ 2 root root 4096 Dec 15 19:52 /var/log/letsencrypt
$ ls -ld /etc/letsencrypt/
drwxr-xr-x 2 root root 4096 Dec 15 19:52 /etc/letsencrypt/

While many of the actions performed by letsencrypt require root access (automated script installation and such), not all of them do. Specifically, the documented option "certonly --manual" (https://letsencrypt.readthedocs.org/en/latest/using.html#manual). It should be possible to run letsencrypt as a normal (admin) user in these circumstances.

Additional info:
* letsencrypt 0.1.1-1


Steps to reproduce:
* install letsencrypt
* run letsencrypt as a normal user:

$ letsencrypt
An unexpected error occurred:
IOError: [Errno 13] Permission denied: '/var/log/letsencrypt/letsencrypt.log'
Please see the logfile 'letsencrypt.log' for more details.

This task depends upon

Closed by  Bruno Pagani (ArchangeGabriel)
Tuesday, 26 December 2017, 13:13 GMT
Reason for closing:  Won't implement
Additional comments about closing:  Use certbot-user from the AUR or just use another Let’s Encrypt client.

Certbot is not fully designed for that purpose.
Comment by Jamin Collins (jamincollins) - Thursday, 31 December 2015, 17:28 GMT
The attached script appears to remedy the issue for me.
   fix-letsencrypt-permissions (0.4 KiB)
Comment by Felix Yan (felixonmars) - Friday, 01 January 2016, 05:12 GMT
Quoting from upstream:

"...it is theoretically possible to run without root privileges, but for most users who want to avoid running an ACME client as root, either letsencrypt-nosudo or simp_le are more appropriate choices."
Comment by Bruno Pagani (ArchangeGabriel) - Tuesday, 10 January 2017, 21:47 GMT
I’ve added https://aur.archlinux.org/packages/certbot-user/ to the AUR for that purpose (supports webroot for sure and probably manual too). I plan to add optional systemd units to manage some remaining details like certs and keys permissions in order for this to be run automatically (for now I run certbot manually and a script as root after that to fix perms).

But I agree with Felix that this is not suited for the default package, because then it wouldn’t work as intended by upstream.

Loading...