--generate-keys creates world readable private key (SYN-671)

[matrixbot]

... and hence so does the debian package.

Submitted by @​matthew:matrix.org

(Imported from https://matrix.org/jira/browse/SYN-671)

[matrixbot]

My quick fix is something like this:

#!/bin/bash
USER="matrix-synapse"
GROUP="matrix-synapse"

PRIVKEYFILE=/etc/matrix-synapse/homeserver.tls.key
SIGNKEYFILE=/etc/matrix-synapse/homeserver.signing.key

if ! getent group $GROUP >/dev/null; then
  addgroup --quiet --system $GROUP
fi

if ! getent group $GROUP | cut -d : -f 4 | grep $USER > /dev/null; then
    addgroup $USER $GROUP
fi

if [ -f $PRIVKEYFILE ]; then 
    chgrp $GROUP $PRIVKEYFILE
    chmod 640 $PRIVKEYFILE
fi

if [ -f $SIGNKEYFILE ]; then 
    chgrp $GROUP $SIGNKEYFILE
    chmod 640 $SIGNKEYFILE
fi

The key files get created by the init script using --generate-config if they don't exist. If there were an easy way to get tls_private_key_path and signing_key_path from the synapse.config module then the key permissions could be checked on every start.

-- Billiam Crashkopf

[richvdh]

This is easily fixed by adding a mode argument to the open() calls (https://github.com/matrix-org/synapse/blob/v1.75.0/synapse/config/key.py#L266, https://github.com/matrix-org/synapse/blob/v1.75.0/synapse/config/key.py#L277).