Re: acme-client: add challenge hook to support dns-01

2024-02-26 Thread Chaz Kettleson
On Tue, Feb 20, 2024 at 10:32:11PM +0100, Christopher Zimmermann wrote: > Hi, > > this diff adds a challenge hook to acme-client. This hook can be used to > fulfill challenges. For example by putting the requested files onto a remote > http server (http-01 challenge) or by modifying dns records (d

Re: acme-client: add challenge hook to support dns-01

2024-02-25 Thread Christopher Zimmermann
Hi, thanks for your input Stuart. On Sun, Feb 25, 2024 at 11:27:33AM +, Stuart Henderson wrote: On 2024/02/24 21:44, Christopher Zimmermann wrote: Keep it simple, there's no need to handle every way to do things here. TLS-ALPN-01 […] doesn't seem very useful for acme-client to support. t

Re: acme-client: add challenge hook to support dns-01

2024-02-25 Thread Stuart Henderson
On 2024/02/21 17:38, Florian Obser wrote: > | I implemented the uacme api since I find that less ugly. It should be > | trivial to transmogrify it with a shell one-liner to support > | dehydrated. and is particular nice to use because it doesn't have the awful sha256 generation done in sh... > Ho

Re: acme-client: add challenge hook to support dns-01

2024-02-24 Thread Theo de Raadt
Christopher Zimmermann wrote: > Thanks for your feedback guys. I tried to improve the interface by > calling the hook for each challenge challenge individually and send > information from acme-client via environment variables, which are > checked against a restrictive alphabet. This makes droppin

Re: acme-client: add challenge hook to support dns-01

2024-02-24 Thread Theo de Raadt
> populated by the acme-client hook and cleared after authorization. > nsd can reload zonefiles on SIGHUP. Sending the signal requires privs. What's the plan?

Re: acme-client: add challenge hook to support dns-01

2024-02-24 Thread Christopher Zimmermann
Thanks for your feedback guys. I tried to improve the interface by calling the hook for each challenge challenge individually and send information from acme-client via environment variables, which are checked against a restrictive alphabet. This makes dropping privileges easier and passing rand

Re: acme-client: add challenge hook to support dns-01

2024-02-22 Thread Christopher Zimmermann
On February 20, 2024 11:45:26 PM GMT+01:00, Evan Silberman wrote: > >Any example hook included should probably only use tools found in base, so it >shouldn’t depend on curl. I thought so, too. And it would be easy enough to replace curl by base ftp. But base ftp needs the URL (and therefore

Re: acme-client: add challenge hook to support dns-01

2024-02-21 Thread Florian Obser
On 2024-02-21 09:03 +01, Florian Obser wrote: > On 2024-02-20 22:32 +01, Christopher Zimmermann wrote: >> Hi, >> >> this diff adds a challenge hook to acme-client. This hook can be used >> to fulfill challenges. For example by putting the requested files onto >> a remote http server (http-01 chal

Re: acme-client: add challenge hook to support dns-01

2024-02-21 Thread Theo de Raadt
Florian Obser wrote: > On 2024-02-20 22:32 +01, Christopher Zimmermann wrote: > > Hi, > > > > this diff adds a challenge hook to acme-client. This hook can be used > > to fulfill challenges. For example by putting the requested files onto > > a remote http server (http-01 challenge) or by modify

Re: acme-client: add challenge hook to support dns-01

2024-02-21 Thread Florian Obser
On 2024-02-20 22:32 +01, Christopher Zimmermann wrote: > Hi, > > this diff adds a challenge hook to acme-client. This hook can be used > to fulfill challenges. For example by putting the requested files onto > a remote http server (http-01 challenge) or by modifying dns records > (dns-01 challenge

Re: acme-client: add challenge hook to support dns-01

2024-02-20 Thread Evan Silberman
> On Feb 20, 2024, at 1:34 PM, Christopher Zimmermann > wrote: > > Hi, > > this diff adds a challenge hook to acme-client. This hook can be used to > fulfill challenges. For example by putting the requested files onto a remote > http server (http-01 challenge) or by modifying dns records