[Icecast] SSL Setup

[José Luis Artuch]

Hi !
Still fighting here :)

/var/log/icecast2/error.log
...
[2017-08-08  03:05:34] INFO main/main Icecast 2.4.2 server started
[2017-08-08  03:05:34] INFO connection/get_ssl_certificate No SSL
capability ***
[2017-08-08  03:05:34] INFO yp/yp_update_thread YP update thread
started
...

What exactly does *** mean ?.

Thanks !
José Luis

El vie, 21-07-2017 a las 19:44 +0200, Marvin Scholz escribió:
> 
> On 21 Jul 2017, at 19:27, José Luis Artuch wrote:
> 
> > El vie, 21-07-2017 a las 19:07 +0200, Marvin Scholz escribió:
> > > 
> > > On 21 Jul 2017, at 18:41, José Luis Artuch wrote:
> > > 
> > > > Hello !
> > > > 
> > > > El lun, 10-07-2017 a las 09:31 +0000, Philipp Schafft escribió:
> > > > > Good morning,
> > > > > 
> > > > > 
> > > > > On Mon, 2017-07-10 at 01:25 +0000, ScanCaster wrote:
> > > > > > IceCast is one of the last services I have that doesn't
> > > > > > connect
> > > > > > securely, 
> > > > > > and I am looking to close that hole....
> > > > > > [...]
> > > > > > OK... add a port for SSL for IceCast in icecast.xml...path
> > > > > > for
> > > > > > cert
> > > > > > file 
> > > > > > in same.... no biggie
> > > > > 
> > > > > The <ssl-certificate> belongs in the <paths> section of the
> > > > > config
> > > > > file.
> > > > > (I'm not sure what you mean with 'in same', just wanted to
> > > > > make
> > > > > it
> > > > > clear.)
> > > > > 
> > > > > 
> > > > > > The key/cert needs to be in a dir and file with applicable
> > > > > > permissions 
> > > > > > for the IceCast user... no biggie..
> > > > > > 
> > > > > > chown icecastusergroup:icecastusergroup  certfile
> > > > > 
> > > > > 
> > > > > > What I am looking to confirm is that the cert file needs to
> > > > > > contain:
> > > > > > 
> > > > > > -----BEGIN RSA PRIVATE KEY-----
> > > > > > MII
> > > > > > -----END RSA PRIVATE KEY-----
> > > > > > 
> > > > > > -----BEGIN CERTIFICATE-----
> > > > > > MI
> > > > > > -----END CERTIFICATE----- 
> > > > > > 
> > > > > > Where the Cert is the file/text Comodo sends me, and the
> > > > > > key is
> > > > > > the
> > > > > > one 
> > > > > > openssl spit out earlier, 
> > > > > > 
> > > > > > Combine them up in certfile, Correct? Special order?? KEY
> > > > > > then
> > > > > > Cert, or v-
> > > > > > v? Line separating them?
> > > > > 
> > > > > The format is the OpenSSL format: key, blank line, cert
> > > > > (chain).
> > > > > echo | cat key.pem - cert.pem > combo.pem
> > > > > 
> > > > > 
> > > > > > kill -HUP pidOfIcecast
> > > > > 
> > > > > As of Icecast2 2.4.x you need to restart Icecast to reload
> > > > > the
> > > > > cert.
> > > > > There is however a fix in 2.5.x (development) which is
> > > > > hopefully
> > > > > released with the next development update.
> > > > > 
> > > > > 
> > > > > > And good????
> > > > > > 
> > > > > > One thing can the web server spit out just a text file that
> > > > > > is
> > > > > > used
> > > > > > by 
> > > > > > Comodo to verify ownership of the domain? The DNS method
> > > > > > normally 
> > > > > > fails....
> > > > > 
> > > > > Sure. Just put it into the webroot (<webroot> in <paths>).
> > > > > Icecast
> > > > > handles files in webroot according to your operating system's
> > > > > mine-
> > > > > type
> > > > > table.
> > > > > 
> > > > 
> > > > On Debian 9, in the configuration file it says:
> > > > 
> > > > <webroot>/usr/share/icecast2/web</webroot>
> > > > <ssl-certificate>/usr/share/icecast2/icecast.pem</ssl-
> > > > certificate>
> > > > 
> > > > What should be the correct path of the icecast.pem file ?.
> > > > Should it be /usr/share/icecast2/web/icecast.pem ?.
> > > 
> > > You certainly do not want to put your private key in your public
> > > webroot...
> > > 
> > 
> > Thanks Marvin. Is ok into any other directory, for example
> > /etc/icecast2/ssl ?.
> 
> I think so, yes.
> 
> > > > 
> > > > Thanks.
> > > > > 
> > > > > > ie: http://icecast.domain.invalid/somestringofletersnumbers
> > > > > > .txt
> > > > > > That they 
> > > > > > request if its dumped in the webroot stuff of Icecast? With
> > > > > > out
> > > > > > any
> > > > > > XSLT 
> > > > > > markup?
> > > > > 
> > > > > Icecast only processes XSLT files as XSLT.
> > > > > 
> > > > > 
> > > > > > So if I added a listening port on 80 for this, then took it
> > > > > > away, 
> > > > > > since I don't use that for Icecast... Icecast is on its own
> > > > > > server
> > > > > > which 
> > > > > > does not have Apache... web stuff for other things is on
> > > > > > its
> > > > > > own
> > > > > > box. I 
> > > > > > never have used the Icecast to server up anything other
> > > > > > than
> > > > > > the
> > > > > > default 
> > > > > > admin etc. stuff it does by default...
> > > > > 
> > > > > To avoid the need to run Icecast as privileged user in oder
> > > > > to
> > > > > bind
> > > > > to
> > > > > low ports (if Comodo really insists in using port 80) you can
> > > > > use
> > > > > your
> > > > > firewall to do a local redirect.
> > > > > 
> > > > > 
> > > > > Hope this is of help to you,
> > > > > 
> > > > > with best regards,
> > > > > 
> > > > > 
> > > > > _______________________________________________
> > > > > Icecast mailing list
> > > > > Icecast at xiph.org
> > > > > http://lists.xiph.org/mailman/listinfo/icecast
> > > > 
> > > > _______________________________________________
> > > > Icecast mailing list
> > > > Icecast at xiph.org
> > > > http://lists.xiph.org/mailman/listinfo/icecast
> > > 
> > > _______________________________________________
> > > Icecast mailing list
> > > Icecast at xiph.org
> > > http://lists.xiph.org/mailman/listinfo/icecast
> > 
> > _______________________________________________
> > Icecast mailing list
> > Icecast at xiph.org
> > http://lists.xiph.org/mailman/listinfo/icecast
> 
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast