File permissions allow access to sensitive information by "others"

[Marc Deslauriers]

Simon Boldinger reported a security issue with the default freeradius permissions.

See the Debian bug report for details:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=890933

[Christian Ehrhardt  (paelzer)]

FYI - Discussion started on the Deb-Bug, we would want to stay in sync but are subscribed there to pick up what is going on.

[Andreas Hasenack (ahasenack)]

"In any case, the packaging used mode 2751 for /etc/freeradius before I
became the maintainer, so I never questioned it.

Especially seeing that upstream is in agreement, I’m all for using a
stricter permission. I’ll change the package to use 2750 going forward."

Looks like debian will change the perms

[Andreas Hasenack (ahasenack)]

In bionic we have:
ubuntu@bionic:~$ l /etc/freeradius/
ls: cannot open directory '/etc/freeradius/': Permission denied

ubuntu@bionic:~$ cat /etc/freeradius/3.0/users
cat: /etc/freeradius/3.0/users: Permission denied

ubuntu@bionic:~$ sudo ls -lah /etc/freeradius/3.0/users
lrwxrwxrwx 1 freerad freerad 27 Feb 28 06:51 /etc/freeradius/3.0/users -> mods-config/files/authorize

ubuntu@bionic:~$ sudo ls -la /etc/freeradius/3.0/mods-config/files/authorize
-rw-r----- 1 freerad freerad 7044 Feb 28 06:51 /etc/freeradius/3.0/mods-config/files/authorize
ubuntu@bionic:~$

freeradius 3.0.16+dfsg-1ubuntu3

Maybe this is related to an upgrade indeed, as was hinted elsewhere in the debian bug

[Andreas Hasenack (ahasenack)]

Debian has made the change:

 freeradius (3.0.16+dfsg-3) unstable; urgency=medium
 .
   * Change default /etc/freeradius permission from 2751 to 2750 (Closes: #890933)

[Andreas Hasenack (ahasenack)]

We should get the change in the next sync with debian

[Andreas Hasenack (ahasenack)]

This was fixed in 3.0.16+dfsg-3, which we have in cosmic as 3.0.16+dfsg-3ubuntu1.