Security issue with keygen.sh

Description

The keygen.sh script, installed with shibboleth sp 2.0 (into the /usr/local/etc/shibboleth directory by default) uses openssl to create a des private key put in to the file sp-key.pm. It relies on the root user's umask (default 22) instead of chmod-ing the resulting file itself, so the generated private key is world readable by default. This is a security issue, the keygen.sh script should chmod the file to 0600.

914518 rw-rr- 1 root root 1675 May 22 14:59 sp-key.pem

Environment

None

Activity

Scott Cantor 
December 17, 2010 at 2:39 PM

Closing after release.

Scott Cantor 
April 6, 2010 at 10:15 AM

Ferenc Wágner 
March 1, 2010 at 8:53 AM
(edited)

As per http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=571631, the correct solution would be using 'umask' to reduce the risk of leaking the key if the script is interrupted (cf. http://devpit.org/wiki/SSL_Certs). What do you think about this?

Scott Cantor 
May 22, 2008 at 9:09 PM

Already fixed in svn as of a few days ago.

Fixed

Details

Assignee

Reporter

Components

Fix versions

Affects versions

Created May 22, 2008 at 2:08 PM
Updated June 22, 2021 at 10:57 PM
Resolved March 1, 2010 at 9:17 AM