esmtpd.pem has wrong permissions

[dusanv]

Binary package hint: courier-mta

After a fresh install of courier-mta-ssl 0.63.0-2.1ubuntu1 on Ubuntu 10.04.2 LTS, I found that /etc/courier/esmtpd.pem is world and group readable. As per Courier documentation (http://www.courier-mta.org/install.html), this file should be owned by the Courier effective uid and not group or world readable.

[Clint Byrum (clint-fewbar)]

Hi dusanv, thanks for taking the time to file this bug report and help us make Ubuntu better.

Agreed that this file should be created without world read set.

I've forwarded the bug to Debian, as soon as I get a bug # I will post it here.

Marking Confirmed until that bug # arrives.

[Clint Byrum (clint-fewbar)]

This stems from an issue reported in Ubuntu and Debian here:

https://launchpad.net/bugs/730253

http://bugs.debian.org/621042

With gnutls, the mkesmtpdcert script takes great pains to make sure
esmtpd.key has permissions of 0600, and the same for the .cert file.

But then it creates esmtpd.pem file like this:

cat esmtpd.key esmtpd.cert >esmtpd.pem

This gives it whatever the default umask of the system is, meaning
usually the file will be created wold readable.

The attached patch gives it 0600 before putting sensitive data into it.