lacme-accountd(1)

NAME
lacme-accountd - ACME client written with process isolation and minimal privileges in mind (account key manager)

SYNOPSIS
lacme-accountd [--config=FILENAME] [--privkey=ARG] [--socket=PATH] [--quiet]

DESCRIPTION
lacme-accountd is the account key manager component of lacme(8), a small ACME client written with process isolation and minimal privileges in mind. No other lacme(8) component needs access to the account key; in fact the account key could as well be stored on another host or a smartcard.

lacme-accountd binds to a UNIX-domain socket (specified with --socket=), which ACME clients can connect to in order to request data signatures. As a consequence, lacme-accountd needs to be up and running before using lacme(8) to issue ACME commands. Also, the process does not automatically terminate after the last signature request: instead, one sends an INT or TERM signal(7) to bring the server down.

Furthermore, one can use the UNIX-domain socket forwarding facility of OpenSSH 6.7 and later to run lacme-accountd and lacme(8) on different hosts. For instance one could store the account key on a machine that is not exposed to the internet. See the examples section below.

OPTIONS

--config=filename
    Use filename as configuration file instead of %E/lacme/lacme-accountd.conf. The value is subject to %-specifier expansion. lacme-accountd fails when --config= is used with a non-existent file, but a non-existent default location is treated as if it were an empty file.

    See the configuration file section below for the configuration options.

--privkey=value
    Specify the (private) account key to use for signing requests. Currently supported values are:

    •   file:FILE, for a private key in PEM format (optionally symmetrically encrypted)

    •   gpg:FILE, for a gpg(1)-encrypted private key

    FILE is subject to %-specifier expansion.

    The genpkey(1ssl) command can be used to generate a new private (account) key:

            $ install -vm0600 /dev/null /path/to/account.key
            $ openssl genpkey -algorithm RSA -out /path/to/account.key

    Currently lacme-accountd only supports RSA account keys.

--socket=path
    Use path as the UNIX-domain socket to bind to for signature requests from the ACME client. The value is subject to %-specifier expansion. lacme-accountd aborts if path exists or if its parent directory is writable by other users. Default: %t/S.lacme (omitting --socket= therefore yields an error when lacme-accountd doesn’t run as and the XDG_RUNTIME_DIR environment variable is unset or empty).

--stdio
    Read signature requests from the standard input and write signatures to the standard output, instead of using a UNIX-domain socket for communication with the ACME client. This internal flag should never be used by standalone lacme-accountd instances, only for those lacme(8) spawns.

-h, --help
    Display a brief help and exit.

-q, --quiet
    Be quiet.

--debug
    Turn on debug mode.

CONFIGURATION FILE
When given on the command line, the --privkey=, --socket= and --quiet options take precedence over their counterpart (without leading --) in the configuration file. Valid settings are:

privkey
    See --privkey=. This setting is required when --privkey= is not specified on the command line.

gpg For a gpg(1)-encrypted private account key, specify the binary gpg(1) to use, as well as some default options. Default: gpg --quiet.

socket
    See --socket=.

logfile
    An optional file where to log to. The value is subject to %-specifier expansion.

keyid
    The “Key ID”, as shown by `acme account`, to give the ACME client. With an empty keyid (the default) the client forwards the JSON Web Key (JWK) to the ACME server to retrieve the correct value. A non-empty value therefore saves a round-trip.

    A non-empty value also causes lacme-accountd to send an empty JWK, thereby revoking all account management access (status change, contact address updates etc.) from the client: any `acme account` command (or any command from lacme(8) before version 0.8.0) is bound to be rejected by the ACME server. This provides a safeguard against malicious clients.

quiet
    Be quiet. Possible values: Yes/No.

%-SPECIFIERS
The value the --config=, --privkey= and --socket= CLI options (and also the privkey, socket and logfile settings from the configuration file) are subject to %-expansion for the following specifiers.

%C | /var/cache for the root user, and $XDG_CACHE_HOME for other users (or $HOME/.cache if the XDG_CACHE_HOME environment variable is unset or empty).
%E | /etc for the root user, and $XDG_CONFIG_HOME for other users (or $HOME/.config if the XDG_CONFIG_HOME environment variable is unset or empty).
%g | Current group name.
%G | Current group ID.
%h | Home directory of the current user.
%t | /run for the root user, and $XDG_RUNTIME_DIR for other users. Non-root users may only use %t when the XDG_RUNTIME_DIR environment variable is set to a non-empty value.
%T | $TMPDIR, or /tmp if the TMPDIR environment variable is unset or empty.
%u | Current user name.
%U | Current user ID.
%% | A literal %.

EXAMPLES
Run lacme-accountd in a first terminal:

        $ lacme-accountd --privkey=file:/path/to/account.key --socket=$XDG_RUNTIME_DIR/S.lacme

Then, while lacme-accountd is running, execute locally lacme(8) in another terminal:

        $ sudo lacme --socket=$XDG_RUNTIME_DIR/S.lacme newOrder

Alternatively, use OpenSSH 6.7 or later to forward the socket and execute lacme(8) remotely:

        $ ssh -oExitOnForwardFailure=yes -tt -R /path/to/remote.sock:$XDG_RUNTIME_DIR/S.lacme user@example.org \
            sudo lacme --socket=/path/to/remote.sock newOrder

Consult the lacme(8) manual for a solution involving connecting to lacme-accountd on a dedicated remote host. Doing so enables automatic renewal via crontab(5) or systemd.timer(5).

BUGS AND FEEDBACK
Bugs or feature requests for lacme-accountd should be filed with the Debian project’s bug tracker at <https://www.debian.org/Bugs/>.

SEE ALSO
lacme(8), ssh(1)

AUTHORS
Guilhem Moulin (guilhem@fripost.org)