3 ms·
Requiring the script to be run as root is a design decision, and I highly doubt it will be changed. They use the fact that the script is able to bind a privileg
by ryan-c 11y ago
Requiring the script to be run as root is a design decision, and I highly doubt it will be changed. They use the fact that the script is able to bind a privileged port (80) to prove it's being run as root so that chaos does not ensue in shared hosting environments.
- Avernar 11y agoYet their diagram shows that putting a signed file in the webroot of your domain is what's needed to prove you own the domain.
- zaroth 11y agoI would agree the level of automation which the tool currently exerts (and the potential for resultant chaos) is definitely a good reason to require root privs by design. I'm sure that they do not feel like the level of automation imposed by the tool is somehow a necessary component of the validation before they will generate a certificate. Certainly, there is no cryptographic value, because their tool doesn't do anything special, so there's no proof or requirement you actually run this particular tool. On their side they make the request for the validation file on the domain root on port 80, but the particular machine being controlled may be, in turn, replying to a request on a higher port. The pair of bash scripts I would want to use each simply create a file in the CWD, so they cannot possibly cause chaos, and therefore I think most would agree can be shipped without imposing (artificially or not) a sudo requirement.