<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">On Mar 25, 2015, at 1:47 PM, Emilien Kia <<a href="mailto:kiae.dev@gmail.com">kiae.dev@gmail.com</a>> wrote:<br><div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">What I will do is to move ssl initializing after usering and forking, than add key file right checking where ssl was initialized before (before forking).<br></div><div style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">As keys should be owned by nut user, this would not be a problem.<br></div><div style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">And moving this code, independently of SSL implementation (OpenSSL or NSS) should work. And will not add more code implementation dependent.<br></div><div style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br></div><div style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Charles, Arnaud ? Ok with that ?<br></div></blockquote></div><div><br></div><div>It is disappointing that NSS cannot easily handle forking - I typically set up Apache+OpenSSL to read the key before dropping root privileges, and it would be nice if NUT could do something similar.</div><div><br></div><div>But it sounds complicated (I briefly looked at the osdir mailing list thread), and with keys stored in memory either way, you might as well initialize after forking.</div><br><div>
<span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px;"><div>-- </div><div>Charles Lepple</div><div>clepple@gmail</div><div><br></div></span><br class="Apple-interchange-newline">
</div>
<br></body></html>