Error after include *.conf

[kerog]

Hi,
I try to include /etc/keydb/conf.d/.conf files and after start keydb server I received Fatal error, can't open config file '/etc/keydb/conf.d/.conf': No such file or directory

I am using latest deb package for debian 10 (keydb-cli 6.2.2)

https://github.com/EQ-Alpha/KeyDB/blob/d591df1529a561587a0ed7d37fbb3aa46c9943c0/pkg/deb/conf/keydb.conf#L44

[benschermel]

Hi @kerog ,

Please ensure you make the location known to the service file (/lib/systemd/system/keydb-server.service). ie add the line ReadWriteDirectories=-/etc/keydb/conf.d/*conf

You will also need to ensure that keydb user/group owns these: ie. sudo chown -R keydb:keydb /etc/keydb/conf.d.

You will then want to sudo systemctl daemon-reload then restart the keydb service

[benschermel]

Closing this issue for now as this should resolve it. If you have any additional questions please reply in this thread and copy me.

[kerog]

@benschermel Hi, your solution is not working.

[benschermel]

Hi @kerog ,

The above update worked for me on Debian10 installation with default KeyDB package installed via these instructions

Are you able to elaborate on what is not working? What is the output of /var/log/keydb/keydb-server.log? What changes have you made to the default config?

[kerog]

Hi @benschermel ,
I attach current log
keydb-server.log.txt
and conf file.
keydb.conf.txt
At the end of file there is 3 lines (
last is not working
previous 2 works, when they are uncommentated)

[benschermel]

Hi @kerog

Thanks, I see your issue and can recreate. Debian service does not seem to like wildcards (ie allowing service to search content of a directory). I tried modifying CapabilityBoundingSet=CAP_DAC_READ_SEARCH but did not seem to permit still. It is possible if we get this working there may be security concerns that could arise as a result.

I verified the keydb-server binary accepts wildcards on include so its not an issue with KeyDB. I verified this behavior is the same with the redis package.

I am reading up more on debian guidelines for this to see if there is a secure workaround. In the meantime you may need to just specify the additional conf files explicitly when using a service file.