lacme-accountd(1)

📦
version 0.8.4 · 5 versions
, in ubuntu stonking

💖 lacme-accountd — the account key manager bestie 💖

okay so quick vibe check: this is the manual page for lacme-accountd, and it lives in General Commands Manual land, section 1. She's the account key manager half of the whole lacme situation and honestly? she's serving. let's get into it 🫶

✨ NAME ✨

lacme-accountd — ACME client written with process isolation and minimal privileges in mind (account key manager) 👑

🌸 SYNOPSIS 🌸

lacme-accountd [--config=FILENAME] [--privkey=ARG] [--socket=PATH]
[--quiet]

💅 DESCRIPTION 💅

okay so lacme-accountd is literally the account key manager component of lacme(8), which is a small ACME client written with process isolation and minimal privileges in mind. and the way that nobody else in the lacme(8) fam ever needs to touch the account key? iconic. fr fr, the account key could honestly live on a whole other host, or on a smartcard, and it would still be fine 🔥

lacme-accountd binds to a UNIX-domain socket (you pick it with --socket=), and ACME clients connect to that socket to request data signatures. which means — and listen bestie, this is the important part — lacme-accountd has to be up and running first, before you can use lacme(8) to issue ACME commands. no socket, no signatures, no slay 😭

also she's not the type to ghost after one request: the process does not automatically terminate after the last signature request. instead, you send an INT or TERM signal(7) to bring the server down. like, you have to actually say goodbye 💀

and ooh, here's the cute part: you can use the UNIX-domain socket forwarding facility of OpenSSH 6.7 and later to run lacme-accountd and lacme(8) on different hosts. so you could store the account key on a machine that is not exposed to the internet — main character security energy honestly. there's an example down in the examples section, keep scrolling 🌈

✨ OPTIONS ✨

  • --config=filename — use filename as the configuration file instead of %E/lacme/lacme-accountd.conf. the value is subject to %-specifier expansion. lacme-accountd fails when --config= is used with a non-existent file, but a non-existent default location is treated as if it were an empty file. see the configuration file section below for the config options 👀
  • --privkey=value — pick the (private) account key used for signing requests. currently supported values are:
    • file:FILE, for a private key in PEM format (optionally symmetrically encrypted)
    • gpg:FILE, for a gpg(1)-encrypted private key

FILE is subject to %-specifier expansion.

the genpkey(1ssl) command can be used to generate a new private (account) key:

$ install -vm0600 /dev/null /path/to/account.key
$ openssl genpkey -algorithm RSA -out /path/to/account.key

heads up bestie: currently lacme-accountd only supports RSA account keys 🔐

  • --socket=path — use path as the UNIX-domain socket to bind to for signature requests from the ACME client. the value is subject to %-specifier expansion. lacme-accountd aborts if path exists or if its parent directory is writable by other users. Default: %t/S.lacme (so omitting --socket= therefore yields an error when lacme-accountd doesn't run as and the XDG_RUNTIME_DIR environment variable is unset or empty) 🙈
  • --stdio — read signature requests from the standard input and write signatures to the standard output, instead of using a UNIX-domain socket for communication with the ACME client. this is an internal flag and should never be used by standalone lacme-accountd instances — only for those lacme(8) spawns 👑
  • -h, --help — display a brief help and exit.
  • -q, --quiet — be quiet. 🤫
  • --debug — turn on debug mode.

🎀 CONFIGURATION FILE 🎀

when given on the command line, the --privkey=, --socket= and --quiet options take precedence over their counterpart (without leading --) in the configuration file. valid settings are:

  • privkey — see --privkey=. this setting is required when --privkey= is not specified on the command line.
  • gpg — for a gpg(1)-encrypted private account key, specify the binary gpg(1) to use, as well as some default options. Default: gpg --quiet.
  • socket — see --socket=.
  • logfile — an optional file where to log to. the value is subject to %-specifier expansion.
  • keyid — the "Key ID", as shown by `acme account`, to give the ACME client. with an empty keyid (the default) the client forwards the JSON Web Key (JWK) to the ACME server to retrieve the correct value. a non-empty value therefore saves a round-trip ✈️

a non-empty value also causes lacme-accountd to send an empty JWK, thereby revoking all account management access (status change, contact address updates etc.) from the client: any `acme account` command (or any command from lacme(8) before version 0.8.0) is bound to be rejected by the ACME server. this provides a safeguard against malicious clients 🛡️

  • quiet — be quiet. possible values: Yes/No.

🦋 %-SPECIFIERS 🦋

the value the --config=, --privkey= and --socket= CLI options (and also the privkey, socket and logfile settings from the configuration file) are subject to %-expansion for the following specifiers:

  • %C — /var/cache for the root user, and $XDG_CACHE_HOME for other users (or $HOME/.cache if the XDG_CACHE_HOME environment variable is unset or empty).
  • %E — /etc for the root user, and $XDG_CONFIG_HOME for other users (or $HOME/.config if the XDG_CONFIG_HOME environment variable is unset or empty).
  • %g — current group name.
  • %G — current group ID.
  • %h — home directory of the current user.
  • %t — /run for the root user, and $XDG_RUNTIME_DIR for other users. non-root users may only use %t when the XDG_RUNTIME_DIR environment variable is set to a non-empty value.
  • %T — $TMPDIR, or /tmp if the TMPDIR environment variable is unset or empty.
  • %u — current user name.
  • %U — current user ID.
  • %% — a literal %.

💜 EXAMPLES 💜

run lacme-accountd in a first terminal:

$ lacme-accountd --privkey=file:/path/to/account.key --socket=$XDG_RUNTIME_DIR/S.lacme

then, while lacme-accountd is running, execute locally lacme(8) in another terminal:

$ sudo lacme --socket=$XDG_RUNTIME_DIR/S.lacme newOrder

alternatively, use OpenSSH 6.7 or later to forward the socket and execute lacme(8) remotely:

$ ssh -oExitOnForwardFailure=yes -tt -R /path/to/remote.sock:$XDG_RUNTIME_DIR/S.lacme user@example.org \
    sudo lacme --socket=/path/to/remote.sock newOrder

consult the lacme(8) manual for a solution involving connecting to lacme-accountd on a dedicated remote host. doing so enables automatic renewal via crontab(5) or systemd.timer(5) ⏰

😭 BUGS AND FEEDBACK 😭

bugs or feature requests for lacme-accountd should be filed with the Debian project's bug tracker at <https://www.debian.org/Bugs/>. (yes bestie, we know, we know.)

👀 SEE ALSO 👀

lacme(8), ssh(1)

🌟 AUTHORS 🌟

Guilhem Moulin

and that's the whole page, no cap 💖 this was lacme-accountd(1), March 2016 vintage, from the General Commands Manual era, and she ate. now go start that socket before you run lacme bestie, fr fr 🎀✨
📦 where this page comes from