iclaoudezinandClaude Sonnet 5.5
9ffdbfa259
- ovpmon-helper: new publish-crl command (validated copy of pki/crl.pem to /etc/openvpn/crl.pem, root:root 644); crl-verify allowlisted only for that path; CRL is refreshed on service start/restart. - Profiler: publish after gen-crl (init/revoke) and on server/configure; generator renders the published path when running unprivileged. - doas rule for publish-crl; docs and helper copy updated. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
7 lines
493 B
Plaintext
7 lines
493 B
Plaintext
permit nopass ovpmon as root cmd /usr/local/sbin/ovpmon-helper args install-config
|
|
permit nopass ovpmon as root cmd /usr/local/sbin/ovpmon-helper args publish-crl
|
|
permit nopass ovpmon as root cmd /usr/local/sbin/ovpmon-helper args service start
|
|
permit nopass ovpmon as root cmd /usr/local/sbin/ovpmon-helper args service stop
|
|
permit nopass ovpmon as root cmd /usr/local/sbin/ovpmon-helper args service restart
|
|
permit nopass ovpmon as root cmd /usr/local/sbin/ovpmon-helper args service status
|