secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-28 21:17:36 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix(secubox-toolbox): mitmproxy-ca.pem perms 0600 → 0640 (crash-loop fix) (ref #496)

Browse Source 
User reported : 'fait sur iphone et android mais plus rien sur wireguard'
— R3 surf totally dead after CA regen.

Diagnostic :
  systemctl status secubox-toolbox-mitm-wg
  → restart_counter = 191 in 60 min (crash-loop)
  → PermissionError: [Errno 13] Permission denied:
    '/etc/secubox/toolbox/ca-wg/mitmproxy-ca.pem'

Root cause :
  Combined key+cert file was 0600 root:secubox-toolbox.
  mitm-wg.service runs as User=secubox-toolbox, which can't read 0600
  even with matching group (owner bit only). mitm crashes on startup.

Fix :
  chmod 0640 root:secubox-toolbox

  Group rw matches existing pattern in this dir :
    mitmproxy-ca-cert.pem  0644 (world-readable public cert, fine)
    mitmproxy-ca-cert.cer  0644 (DER public cert, fine)
    mitmproxy-ca.pem       0640 (PRIVATE key inside, group-read only)

Live fix already applied. mitm-wg now running clean (NRestarts=0),
addons loaded, transparent proxy listening on 10.99.1.1:8081.
This commit is contained in:
CyberMind-FR 2026-06-05 15:50:59 +02:00
parent ba7144a342
commit 3ba9e4adda
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
packages/secubox-toolbox/sbin/secubox-toolbox-wg-provision
View File

@ -123,7 +123,10 @@ CNF
# Combined key+cert for mitm (mitmproxy-ca.pem)
cat _key.pem _cert.pem > mitmproxy-ca.pem
chmod 0600 mitmproxy-ca.pem
# 0640 (not 0600) : mitm-wg.service runs as secubox-toolbox group and
# needs to read the combined key+cert. 0600 → PermissionError →
# service crash-loops (~190 restarts in 5 min if undetected).
chmod 0640 mitmproxy-ca.pem
chown root:secubox-toolbox mitmproxy-ca.pem
# Public cert only (what we serve via /wg/ca.pem)