Bad OpenVPN roadwarrior certificate permissions

[DavidePrincipi]

It is possible for any system user to obtain openvpn roadwarrior access even if not authorized.

Under /var/lib/nethserver/certs/, the .p12 files containing the private key used to establish an openvpn roadwarrior tunnel are world readable.

Steps to reproduce

• As root, In Cockpit Applications > VPN > OVPN roadwarrior > Add account, create a VPN access key
• Log in as a normal user with SFTP or SSH access and run: ls -l /var/lib/nethserver/certs/*.p12

Expected behavior

The .p12 files must not be readable by system users. Each of them is a key to access the internal network with a VPN. The admin can download and/or send .p12 files to authorized users.

Actual behavior

The world readable bit allows any system user to connect through a VPN.

Components

nethserver-openvpn-1.9.0-1.ns7.noarch

See also

https://community.nethserver.org/t/sftp-chroot-is-needed/14229

---

Thanks to Flatspin for raising the issue!

[nethbot]

in 7.7.1908/testing:

• nethserver-openvpn-1.9.0-1.1.g421c2d0.ns7.noarch.rpm x86_64 armhfp aarch64

[DavidePrincipi]

QA notes

We must test against UI regessions. Both Cockpit and Nethgui. The latter could be affected above all.

[gsanchietti]

Before the update:

sftp> get /var/lib/nethserver/certs/aaa.p12
Fetching /var/lib/nethserver/certs/aaa.p12 to aaa.p12
/var/lib/nethserver/certs/aaa.p12      

After the update:

sftp> get /var/lib/nethserver/certs/aaa.p12
File "/var/lib/nethserver/certs/aaa.p12" not found.

The file can be downloaded both from NethGUI and Cockpit.

[nethbot]

in 7.7.1908/updates:

• nethserver-openvpn-1.9.1-1.ns7.noarch.rpm x86_64 armhfp aarch64