Results 1 to 4 of 4

Thread: [SOLVED] security: SSL private key readable on file system

  1. #1
    florianh is offline Member
    Join Date
    Jul 2009
    Location
    Southern Germany
    Posts
    12
    Rep Power
    6

    Default [SOLVED] security: SSL private key readable on file system

    Hi all,

    we're using Release 5.0.16_GA_2921.UBUNTU8 UBUNTU8 FOSS edition and I want to install a Thawte SSL123 certificate. Generating the CSR, I've seen that the files in the directory /opt/zimbra/ssl/zimbra/commercial have very generous access rights:

    root@XYZ:/opt/zimbra/ssl/zimbra/commercial# ls -axl
    total 16
    drwxr----- 2 zimbra zimbra 4096 Jun 13 16:50 .
    drwxr----- 5 zimbra zimbra 4096 May 21 20:48 ..
    -rw-r--r-- 1 root root 704 Jul 27 11:50 commercial.csr
    -rw-r--r-- 1 root root 891 Jul 27 11:50 commercial.key

    Isn't this a security hole, or am I misunderstanding something here?

    Best regards
    Florian

  2. #2
    Rich Graves is offline Outstanding Member
    Join Date
    Jan 2007
    Location
    Minnesota
    Posts
    718
    Rep Power
    9

    Default

    Since . is only accessible to zimbra, no, it isn't.

  3. #3
    GeorgThoma is offline Starter Member
    Join Date
    Feb 2007
    Posts
    1
    Rep Power
    8

    Default

    Hello,

    one small comment / explanation for florianh.

    "rw-r--r-- 1 root root 891 Jul 27 11:50 commercial.key" means readable for all
    but "drwxr----- 5 zimbra zimbra 4096 May 21 20:48 .." means only zimbra and root can go there to read. No other user can change in that directory to read.

    kr Georg

  4. #4
    florianh is offline Member
    Join Date
    Jul 2009
    Location
    Southern Germany
    Posts
    12
    Rep Power
    6

    Default

    Oops... you're right! My fault!

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Replies: 4
    Last Post: 08-04-2008, 06:17 PM
  2. DNS Questions and Trouble Installing
    By smurraysb in forum Installation
    Replies: 22
    Last Post: 03-14-2008, 03:27 PM
  3. Zimbra Re-install
    By ppurama in forum Installation
    Replies: 8
    Last Post: 10-27-2005, 01:24 PM
  4. system failure: getDirectContext
    By avisser in forum Installation
    Replies: 3
    Last Post: 10-12-2005, 05:32 AM
  5. Cannot connect to Zimbra after installation
    By bob_p in forum Installation
    Replies: 35
    Last Post: 09-19-2005, 08:49 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •