From 3ba9e4adda9ee09f9940c9530fe3c6f34320a798 Mon Sep 17 00:00:00 2001 From: CyberMind-FR Date: Fri, 5 Jun 2026 15:50:59 +0200 Subject: [PATCH] =?UTF-8?q?fix(secubox-toolbox):=20mitmproxy-ca.pem=20perm?= =?UTF-8?q?s=200600=20=E2=86=92=200640=20(crash-loop=20fix)=20(ref=20#496)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit User reported : 'fait sur iphone et android mais plus rien sur wireguard' — R3 surf totally dead after CA regen. Diagnostic : systemctl status secubox-toolbox-mitm-wg → restart_counter = 191 in 60 min (crash-loop) → PermissionError: [Errno 13] Permission denied: '/etc/secubox/toolbox/ca-wg/mitmproxy-ca.pem' Root cause : Combined key+cert file was 0600 root:secubox-toolbox. mitm-wg.service runs as User=secubox-toolbox, which can't read 0600 even with matching group (owner bit only). mitm crashes on startup. Fix : chmod 0640 root:secubox-toolbox Group rw matches existing pattern in this dir : mitmproxy-ca-cert.pem 0644 (world-readable public cert, fine) mitmproxy-ca-cert.cer 0644 (DER public cert, fine) mitmproxy-ca.pem 0640 (PRIVATE key inside, group-read only) Live fix already applied. mitm-wg now running clean (NRestarts=0), addons loaded, transparent proxy listening on 10.99.1.1:8081. --- packages/secubox-toolbox/sbin/secubox-toolbox-wg-provision | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/packages/secubox-toolbox/sbin/secubox-toolbox-wg-provision b/packages/secubox-toolbox/sbin/secubox-toolbox-wg-provision index c0f99530..57b8e278 100755 --- a/packages/secubox-toolbox/sbin/secubox-toolbox-wg-provision +++ b/packages/secubox-toolbox/sbin/secubox-toolbox-wg-provision @@ -123,7 +123,10 @@ CNF # Combined key+cert for mitm (mitmproxy-ca.pem) cat _key.pem _cert.pem > mitmproxy-ca.pem - chmod 0600 mitmproxy-ca.pem + # 0640 (not 0600) : mitm-wg.service runs as secubox-toolbox group and + # needs to read the combined key+cert. 0600 → PermissionError → + # service crash-loops (~190 restarts in 5 min if undetected). + chmod 0640 mitmproxy-ca.pem chown root:secubox-toolbox mitmproxy-ca.pem # Public cert only (what we serve via /wg/ca.pem)