Skip to content

Commit 5332443

Browse files
author
Yunohost Admin
committed
merge
1 parent 4754569 commit 5332443

6 files changed

+143
-18
lines changed

‎build_system_fr.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#Création de paquet Debian
22

33
## Architecture
4-
Le système se compose de rebuildd qui est un front-end pour `pbuilder`, des chroot pbuilder pour i386, amd64, armhf et de `reprepro` pour le système de repo debian.
4+
Le système se compose de `rebuildd` qui est un front-end pour `pbuilder`, des chroot pbuilder pour i386, amd64, armhf et de `reprepro` pour le système de repo debian.
55

66
---
77

‎certificate.md

+120-5
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,126 @@
22

33
Certificates are used to certify that your server is the genuine one and not a falsified one.
44

5-
YunoHost provides a self-signed certificate.
5+
YunoHost provides a **self-signed** certificate, it means that your server guaranty the certificate validity. It's enough **for personal usage**, because you trust your own server. But this could be a problem if you want to open access to anonymous like web user for a website.
6+
Concretely users will go throw a screen like this:
67

7-
Client software (web browser, email client, XMPP client, etc) typically requires you to manually add an exception for that self-signed certificate.
8+
<img src="https://yunohost.org/images/postinstall_error.png" style="max-width:100%;border-radius: 5px;border: 1px solid rgba(0,0,0,0.15);box-shadow: 0 5px 15px rgba(0,0,0,0.35);">
89

9-
You can have a certificate signed by an authority, in which case you must upload the appropriate certificate KEY and CRT files to the following files:
10+
This screen ask to the user : **"Do you trust this server that host this website?"**
11+
It could afraid a lot of users (rightly).
12+
13+
To avoid this confusion, it's possible to get a signed certificate by a "known" authority : **Gandi**, **RapidSSL**, **StartSSL**, **CaCert**.
14+
In these cases, the point is to replace the self-signed certificate by the one that have been certified by an certificate authority, and the users won't have this warning screen anymore.
15+
16+
### Add a signed certificate by an authority
17+
18+
Get your certificate from your CA, you must get a private key, file key and a public certificate (file .crt)
19+
> Be carefull, the key file is very critical, it's strictly personal and have to be secured.
20+
21+
Copy this two files on the server, if not.
22+
23+
```bash
24+
scp CERTIFICAT.crt [email protected]:ssl.crt
25+
scp CLE.key [email protected]:ssl.key
26+
```
27+
28+
From Windows, scp can be used with putty, download [pscp](http://the.earth.li/~sgtatham/putty/latest/x86/pscp.exe)
29+
30+
```bash
31+
pscp -P 22 CERTIFICAT.crt [email protected]:ssl.crt
32+
pscp -P 22 CLE.key [email protected]:ssl.key```
33+
34+
Now the files are in the server. Open a shell on the server use [ssh](https://yunohost.org/#/ssh_fr) or locally.
35+
36+
First, create a directory for archive the certificates.
37+
38+
```bash
39+
sudo mkdir /etc/yunohost/certs/DOMAIN.TLD/ae_certs
40+
sudo mv ssl.key ssl.crt /etc/yunohost/certs/DOMAIN.TLD/ae_certs/```
41+
42+
Then go to the parent directory and go on.
43+
44+
```bash
45+
cd /etc/yunohost/certs/DOMAIN.TLD/```
46+
47+
Make a backup of the YunoHost original certificates , to be safe!
48+
49+
```bash
50+
sudo mkdir yunohost_self_signed
51+
sudo mv *.pem *.cnf yunohost_self_signed/```
52+
53+
Depends on the CA, intermediate certificates and root have to be downloaded.
54+
55+
> **StartSSL**
56+
> ```bash
57+
> sudo wget http://www.startssl.com/certs/ca.pem -O ae_certs/ca.pem
58+
> sudo wget http://www.startssl.com/certs/sub.class1.server.ca.pem -O ae_certs/intermediate_ca.pem```
59+
60+
> **Gandi**
61+
> ```bash
62+
> sudo wget https://www.gandi.net/static/CAs/GandiStandardSSLCA.pem -O ae_certs/intermediate_ca.pem```
63+
64+
> **RapidSSL**
65+
> ```bash
66+
> sudo wget https://knowledge.rapidssl.com/library/VERISIGN/INTERNATIONAL_AFFILIATES/RapidSSL/AR1548/RapidSSLCABundle.txt -O ae_certs/intermediate_ca.pem```
67+
68+
> **Cacert**
69+
> ```bash
70+
> sudo wget http://www.cacert.org/certs/root.crt -O ae_certs/ca.pem
71+
> sudo wget http://www.cacert.org/certs/class3.crt -O ae_certs/intermediate_ca.pem```
72+
73+
Intermediate certificates and root must be merged with certificates obtained to create a unified chain certificates.
74+
75+
If you use a root certificate (StartSSL) :
76+
77+
```bash
78+
cat ae_certs/ssl.crt ae_certs/intermediate_ca.pem ae_certs/ca.pem | sudo tee crt.pem```
79+
80+
If you use only an intermediate certificate.
81+
82+
```bash
83+
cat ae_certs/ssl.crt ae_certs/intermediate_ca.pem | sudo tee crt.pem```
84+
85+
The private key have to be converted in PEM format.
86+
87+
```bash
88+
sudo openssl rsa -in ae_certs/ssl.key -out key.pem -outform PEM```
89+
90+
Check certificates syntaxe, check file contents.
91+
92+
```bash
93+
cat crt.pem key.pem```
94+
95+
Certificates and private key look like this :
96+
97+
`-----BEGIN CERTIFICATE-----`
98+
`MIICVDCCAb0CAQEwDQYJKoZIhvcNAQEEBQAwdDELMAkGA1UEBhMCRlIxFTATBgNV`
99+
`BAgTDENvcnNlIGR1IFN1ZDEQMA4GA1UEBxMHQWphY2NpbzEMMAoGA1UEChMDTExC`
100+
`MREwDwYDVQQLEwhCVFMgSU5GTzEbMBkGA1UEAxMSc2VydmV1ci5idHNpbmZvLmZy`
101+
`MB4XDTA0MDIwODE2MjQyNloXDTA0MDMwOTE2MjQyNlowcTELMAkGA1UEBhMCRlIx`
102+
`FTATBgNVBAgTDENvcnNlIGR1IFN1ZDEQMA4GA1UEBxMHQWphY2NpbzEMMAoGA1UE`
103+
`ChMDTExCMREwDwYDVQQLEwhCVFMgSU5GTzEYMBYGA1UEAxMPcHJvZi5idHNpbmZv`
104+
`LmZyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDSUagxPSv3LtgDV5sygt12`
105+
`kSbN/NWP0QUiPlksOkF2NkPfwW/mf55dD1hSndlOM/5kLbSBo5ieE3TgikF0Iktj`
106+
`BWm5xSqewM5QDYzXFt031DrPX63Fvo+tCKTQoVItdEuJPMahVsXnDyYHeUURRWLW`
107+
`wc0BzEgFZGGw7wiMF6wt5QIDAQABMA0GCSqGSIb3DQEBBAUAA4GBALD640iwKPMf`
108+
`pqdYtfvmLnA7CiEuao60i/pzVJE2LIXXXbwYjNAM+7Lov+dFT+b5FcOUGqLymSG3`
109+
`kSK6OOauBHItgiGI7C87u4EJaHDvGIUxHxQQGsUM0SCIIVGK7Lwm+8e9I2X0G2GP`
110+
`9t/rrbdGzXXOCl3up99naL5XAzCIp6r5`
111+
`-----END CERTIFICATE-----`
112+
113+
At last, secure files of your certificate
114+
115+
```bash
116+
sudo chown root:metronome crt.pem key.pem
117+
sudo chmod 640 crt.pem key.pem
118+
sudo chown root:root -R ae_certs
119+
sudo chmod 600 -R ae_certs```
120+
121+
Reload Nginx configuration to take into account the new certificate.
122+
123+
```bash
124+
sudo service nginx reload```
125+
126+
Your certificate is ready to serve. You can check that every thing is correct byan external service like <a href="https://www.geocerts.com/ssl_checker" target="_blank">geocerts</a>
10127
11-
* /etc/yunohost/certs/YourCertifiedDomain/crt.pem
12-
* /etc/yunohost/certs/YourCertifiedDomain/key.pem

‎certificate_fr.md

+7-2
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ En effet, les utilisateurs devront passer par un écran de ce type :
1010
Cet écran revient à demander **« Avez-vous confiance au serveur qui héberge ce site ? »**.
1111
Cela peut effrayer vos utilisateurs (à juste titre).
1212

13-
Pour éviter cette confusion, il est possible d'obtenir un certificat signé par une autorité « connue » : **Gandi**, **RapidSSL**, **StartSSL**.
13+
Pour éviter cette confusion, il est possible d'obtenir un certificat signé par une autorité « connue » : **Gandi**, **RapidSSL**, **StartSSL**, **Cacert**.
1414
Dans ce cas, il s’agira de remplacer le certificat auto-signé par celui qui a été reconnu par une autorité de certification, et vos utilisateurs n’auront plus à passer par cet écran d’avertissement.
1515

1616
### Ajout d’un certificat signé par une autorité
@@ -65,9 +65,14 @@ En fonction de l'autorité d'enregistrement, des certificats intermédiaire et r
6565
> ```bash
6666
> sudo wget https://knowledge.rapidssl.com/library/VERISIGN/INTERNATIONAL_AFFILIATES/RapidSSL/AR1548/RapidSSLCABundle.txt -O ae_certs/intermediate_ca.pem```
6767
68+
> **Cacert**
69+
> ```bash
70+
> sudo wget http://www.cacert.org/certs/root.crt -O ae_certs/ca.pem
71+
> sudo wget http://www.cacert.org/certs/class3.crt -O ae_certs/intermediate_ca.pem```
72+
6873
Les certificats intermédiaire et root doivent être réuni avec le certificat obtenu pour créer une chaîne de certificats unifiés.
6974
70-
En cas d'utilisation d'un certificat racine (StartSSL) :
75+
En cas d'utilisation d'un certificat racine (StartSSL, Cacert) :
7176
7277
```bash
7378
cat ae_certs/ssl.crt ae_certs/intermediate_ca.pem ae_certs/ca.pem | sudo tee crt.pem```

‎diagnostic.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ If you do not see your IP address, or if there is red crosses everywhere, then y
3030

3131
---
3232

33-
### <small>3.</small> Do network ports are opened on your router ?
33+
### <small>3.</small> Are network ports opened on your router ?
3434

3535
If your DNS is well configured, and your server looks is accessible locally, you may have **network ports blocked** or not forwarded by your router.
3636
In order to verify that, try accessing your server with a client outside your local network. For example via another WiFi access point or with your mobile phone in 3G/4G.

‎docker.md

+7-4
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,8 @@ You will then be able to [postinstall](/postinstall) all this by entering the co
5454

5555
**Notice:** You may want to forward some of your container's ports, find more information or these pages:
5656

57-
* http://docs.docker.io/reference/commandline/cli/#run
58-
* http://docs.docker.io/use/port_redirection/#port-redirection
57+
* http://docs.docker.com/reference/commandline/cli/#run
58+
* http://docs.docker.com/userguide/dockerlinks/
5959

6060

6161
---
@@ -85,12 +85,15 @@ iptables -t nat -A POSTROUTING -s '<container.IP>/32' -o eth0 -j SNAT --to-sourc
8585
```bash
8686
# You will need:
8787
# * your container's ID
88-
docker ps -notrunc | grep yunohost
88+
docker ps --no-trunc | grep yunohost
8989
# * your container's PID
90-
cat /var/lib/docker/execdriver/native/<container_ID>/pid
90+
docker ps -q | xargs docker inspect --format '{{.State.Pid}}'
9191
# * `util-linux` package
9292
apt-get install util-linux || pacman -S util-linux
9393

9494
# Run the nsenter command with the right parameters
9595
nsenter --target <PID> --mount --uts --ipc --net --pid /bin/bash
96+
97+
# Otherwise, with docker
98+
docker run -t -i yunohost:init /bin/bash
9699
```

‎docker_fr.md

+7-5
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,8 @@ Cette commande lancera un conteneur sur la base de l'image `yunohost`, tag `init
5353

5454
**Remarque :** vous pourrez avoir besoin de forwarder certains ports de votre conteneur docker, pour cela consultez les pages de documentation suivantes :
5555

56-
* http://docs.docker.io/reference/commandline/cli/#run
57-
* http://docs.docker.io/use/port_redirection/#port-redirection
56+
* http://docs.docker.com/reference/commandline/cli/#run
57+
* http://docs.docker.com/userguide/dockerlinks/
5858

5959

6060
---
@@ -84,12 +84,14 @@ iptables -t nat -A POSTROUTING -s '<IP conteneur docker>/32' -o eth0 -j SNAT --t
8484
```bash
8585
# Vous avez besoin :
8686
# * de votre ID de conteneur
87-
docker ps -notrunc | grep yunohost
87+
docker ps --no-trunc | grep yunohost
8888
# * du PID de votre conteneur
89-
cat /var/lib/docker/execdriver/native/<ID_de_mon_conteneur>/pid
89+
docker ps -q | xargs docker inspect --format '{{.State.Pid}}'
9090
# du paquet `util-linux`
9191
apt-get install util-linux || pacman -S util-linux
92-
9392
# Lancez la commande nsenter avec les paramètre kivonbien©
9493
nsenter --target <PID> --mount --uts --ipc --net --pid /bin/bash
94+
95+
# Sinon, avec docker
96+
docker run -t -i yunohost:init /bin/bash
9597
```

0 commit comments

Comments
 (0)