From a966bc0797b9a9fa3d6aaa0a5a81d61257b49dc0 Mon Sep 17 00:00:00 2001 From: Liam Marshall Date: Sat, 24 Oct 2015 21:27:49 -0500 Subject: [PATCH] letsencrypt.plugins.manual: Add disclaimer about IP logging --- letsencrypt/plugins/manual.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/letsencrypt/plugins/manual.py b/letsencrypt/plugins/manual.py index f7717064b..d722b8e36 100644 --- a/letsencrypt/plugins/manual.py +++ b/letsencrypt/plugins/manual.py @@ -46,6 +46,15 @@ If you don't have HTTP server configured, you can run the following command on the target server (as root): {command} +""" + + # a disclaimer about your current IP being transmitted to Let's Encrypt's servers. + IP_DISCLAIMER = """\ +NOTE: The IP of this machine will be publicly logged as having requested this certificate. \ +If you're running letsencrypt in manual mode on a machine that is not your server, \ +please ensure you're okay with that. + +Are you OK with your IP being logged? """ # "cd /tmp/letsencrypt" makes sure user doesn't serve /root, @@ -151,6 +160,10 @@ binary for temporary key/certificate generation.""".replace("\n", "") if self._httpd.poll() is not None: raise errors.Error("Couldn't execute manual command") else: + if not zope.component.getUtility(interfaces.IDisplay).yesno( + self.IP_DISCLAIMER, "Yes", "No"): + raise errors.Error("Must agree to proceed") + self._notify_and_wait(self.MESSAGE_TEMPLATE.format( validation=validation.json_dumps(), response=response, uri=response.uri(achall.domain, achall.challb.chall),