Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Restrict permissions to certificate security files #252

Closed
taylok opened this Issue Aug 1, 2018 · 2 comments

Comments

Projects
2 participants
@taylok
Copy link
Contributor

taylok commented Aug 1, 2018

The permissions on crt files within the master config directory are too open.

For example:
/etc/origin/master/ca.crt
owner: root,
group: root,
mode: 0644 desired mode: 0640

Can these be made more restrictive without breaking anything.

Also:
/etc/origin
owner: root,
group: root,
mode: 0755 desired mode: 0750

@IshentRas

This comment has been minimized.

Copy link
Owner

IshentRas commented Aug 1, 2018

@taylok
All good: Should be in the next release:

[root@centos ~]# ls -l /etc/origin -d
drwxr-x---. 4 root root 79 Aug 1 18:24 /etc/origin

[root@centos ~]# ls -l /etc/origin/master/.crt
-rw-r-----. 1 root root 1119 Jul 31 19:00 /etc/origin/master/admin.crt
-rw-r-----. 1 root root 1070 Jul 31 19:00 /etc/origin/master/ca-bundle.crt
-rw-r-----. 1 root root 1070 Jul 31 19:00 /etc/origin/master/ca.crt
-rw-r-----. 1 root root 2587 Jul 31 19:00 /etc/origin/master/etcd.server.crt
-rw-r-----. 1 root root 1895 Jul 31 19:00 /etc/origin/master/master.etcd-ca.crt
-rw-r-----. 1 root root 5840 Jul 31 19:00 /etc/origin/master/master.etcd-client.crt
-rw-r-----. 1 root root 1135 Jul 31 19:00 /etc/origin/master/master.kubelet-client.crt
-rw-r-----. 1 root root 1086 Jul 31 19:00 /etc/origin/master/master.proxy-client.crt
-rw-r-----. 1 root root 2571 Jul 31 19:00 /etc/origin/master/master.server.crt
-rw-r-----. 1 root root 1168 Jul 31 19:00 /etc/origin/master/openshift-master.crt
-rw-r-----. 1 root root 2372 Jul 31 19:01 /etc/origin/master/registry.crt
-rw-r-----. 1 root root 1115 Jul 31 19:00 /etc/origin/master/service-signer.crt
[root@centos ~]# ls -l /etc/origin/master/
.{crt,key}
-rw-r-----. 1 root root 1119 Jul 31 19:00 /etc/origin/master/admin.crt
-rw-------. 1 root root 1675 Jul 31 19:00 /etc/origin/master/admin.key
-rw-r-----. 1 root root 1070 Jul 31 19:00 /etc/origin/master/ca-bundle.crt
-rw-r-----. 1 root root 1070 Jul 31 19:00 /etc/origin/master/ca.crt
-rw-------. 1 root root 1675 Jul 31 19:00 /etc/origin/master/ca.key
-rw-r-----. 1 root root 2587 Jul 31 19:00 /etc/origin/master/etcd.server.crt
-rw-------. 1 root root 1675 Jul 31 19:00 /etc/origin/master/etcd.server.key
-rw-r-----. 1 root root 1895 Jul 31 19:00 /etc/origin/master/master.etcd-ca.crt
-rw-r-----. 1 root root 5840 Jul 31 19:00 /etc/origin/master/master.etcd-client.crt
-rw-------. 1 root root 1704 Jul 31 19:00 /etc/origin/master/master.etcd-client.key
-rw-r-----. 1 root root 1135 Jul 31 19:00 /etc/origin/master/master.kubelet-client.crt
-rw-------. 1 root root 1679 Jul 31 19:00 /etc/origin/master/master.kubelet-client.key
-rw-r-----. 1 root root 1086 Jul 31 19:00 /etc/origin/master/master.proxy-client.crt
-rw-------. 1 root root 1679 Jul 31 19:00 /etc/origin/master/master.proxy-client.key
-rw-r-----. 1 root root 2571 Jul 31 19:00 /etc/origin/master/master.server.crt
-rw-------. 1 root root 1675 Jul 31 19:00 /etc/origin/master/master.server.key
-rw-r-----. 1 root root 1168 Jul 31 19:00 /etc/origin/master/openshift-master.crt
-rw-------. 1 root root 1675 Jul 31 19:00 /etc/origin/master/openshift-master.key
-rw-r-----. 1 root root 2372 Jul 31 19:01 /etc/origin/master/registry.crt
-rw-------. 1 root root 1679 Jul 31 19:01 /etc/origin/master/registry.key
-rw-------. 1 root root 1675 Jul 31 19:00 /etc/origin/master/serviceaccounts.private.key
-rw-------. 1 root root 459 Jul 31 19:00 /etc/origin/master/serviceaccounts.public.key
-rw-r-----. 1 root root 1115 Jul 31 19:00 /etc/origin/master/service-signer.crt
-rw-------. 1 root root 1679 Jul 31 19:00 /etc/origin/master/service-signer.key

@IshentRas IshentRas self-assigned this Aug 1, 2018

@IshentRas IshentRas added this to To do in OCP 3.7 via automation Aug 1, 2018

IshentRas referenced this issue Aug 1, 2018

@IshentRas

This comment has been minimized.

Copy link
Owner

IshentRas commented Aug 1, 2018

Fixed in 55245a7

@IshentRas IshentRas closed this Aug 1, 2018

OCP 3.7 automation moved this from To do to Done Aug 1, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.