Security: VestaCP Certificate world readable

[my816797]

Hi,

Don't know if this is the right place, but I just found a security issue in the default install of VestaCP.

The SSL certificate (cert + key) for the control-panel are stored (on Ubuntu anyway) in:
/usr/local/vesta/ssl/

The files present are certificate.crt and certificate.key. Default they look like this:

Code: Select all

4.0K -rw-r--r-- 1 root root 1.9K Apr 23 14:27 /usr/local/vesta/ssl/certificate.crt
4.0K -rw-r--r-- 1 root root 1.7K Apr 23 14:27 /usr/local/vesta/ssl/certificate.key

User + Other users have READ permissions (644 !!) so any shared hosting user can fetch your certificate with a little script like:

Code: Select all

echo `ls /usr/local/vesta/ssl/certificate.key`;
echo `cat /usr/local/vesta/ssl/certificate.key`;

These files should be chmodded to 400 (r--) to prevent shared hosting users stealing your certificate, right?

[skid]

Thank you Wietse. We will this in next release.

[demlasjr]

chmod 400 is not good, without chown the file. Otherwise, exim can't read the file !