adam/znc
1
0 Fork 0
mirror of https://github.com/znc/znc.git synced 2026-11-03 02:42:21 +01:00
Code Issues 362 Packages Projects Releases Wiki Activity

znc.pem uses permissions from umask #246

New Issue
Closed
opened 2026-10-05 04:07:31 +02:00 by adam · 2 comments
adam commented 2026-10-05 04:07:31 +02:00
Owner
Copy link
Copy source

The PEM file created when generating one with znc --makeconf uses potentially unsafe permissions. On many systems, the default permissions are 644 or 664 (Ubuntu). This can lead to key compromise on shared systems like shell boxes.

Proposed fix: Ensure znc.pem is chmod 600.

The PEM file created when generating one with znc --makeconf uses potentially unsafe permissions. On many systems, the default permissions are 644 or 664 (Ubuntu). This can lead to key compromise on shared systems like shell boxes. Proposed fix: Ensure znc.pem is chmod 600. <!-- github-sync-id:16195456 -->
adam closed this issue 2026-10-05 04:07:31 +02:00
adam commented 2026-10-05 04:07:32 +02:00
Author
Owner
Copy link
Copy source

root@vps6431:# znc --makepem
[ ok ] Writing Pem file [/root/.znc/znc.pem]...
root@vps6431:# stat .znc/znc.pem
File: ‘.znc/znc.pem’
Size: 2993 Blocks: 8 IO Block: 4096 regular file
Device: ca01h/51713d Inode: 1753104 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2013-07-01 01:16:29.000000000 +0000
Modify: 2013-07-01 01:16:29.000000000 +0000
Change: 2013-07-01 01:16:29.000000000 +0000
Birth: -
root@vps6431:~#

root@vps6431:~# znc --makepem [ ok ] Writing Pem file [/root/.znc/znc.pem]... root@vps6431:~# stat .znc/znc.pem File: ‘.znc/znc.pem’ Size: 2993 Blocks: 8 IO Block: 4096 regular file Device: ca01h/51713d Inode: 1753104 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2013-07-01 01:16:29.000000000 +0000 Modify: 2013-07-01 01:16:29.000000000 +0000 Change: 2013-07-01 01:16:29.000000000 +0000 Birth: - root@vps6431:~# <!-- github-comment-id:20259338 -->
adam commented 2026-10-05 04:07:32 +02:00
Author
Owner
Copy link
Copy source

It's already fixed for the file itself. Use git or 1.2a version
And even in 1.0, .znc directory itself is 700 by default, which stops world to read znc.pem

It's already fixed for the file itself. Use git or 1.2a version And even in 1.0, .znc directory itself is 700 by default, which stops world to read znc.pem <!-- github-comment-id:20262441 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/znc#246