Fix incorrect permissions for key files.

Fixes #5300

diff --git a/pki/icinga2-build-ca.cmake b/pki/icinga2-build-ca.cmake
index 1ac4eec24e9da82caa847becf00545051c91b64d..ce8c9e6607b79f74b4c9ded13b5a07ff6ca6d835 100644 (file)
--- a/pki/icinga2-build-ca.cmake
+++ b/pki/icinga2-build-ca.cmake
@@ -19,4 +19,5 @@ cp $ICINGA2PKIDIR/vars $ICINGA_CA/
 source $ICINGA_CA/vars
 
 KEY_DIR=$ICINGA_CA openssl req -config $ICINGA2PKIDIR/openssl.cnf -new -newkey rsa:4096 -x509 -days 3650 -keyform PEM -keyout $ICINGA_CA/ca.key -outform PEM -out $ICINGA_CA/ca.crt && \
+       chmod 600 $ICINGA_CA/ca.key && \
        echo -e "\n\tIf you want to change the default settings for server certificates check out \"$ICINGA_CA/vars\".\n"

diff --git a/pki/icinga2-build-key.cmake b/pki/icinga2-build-key.cmake
index 6d0bbdd3f0d41d9cfaf4ac236eb7251c2003f5bc..972640f3f9d6251ee883fec51db296e694041355 100644 (file)
--- a/pki/icinga2-build-key.cmake
+++ b/pki/icinga2-build-key.cmake
@@ -28,5 +28,6 @@ fi
 
 REQ_COMMON_NAME="$name" KEY_DIR="$ICINGA_CA" openssl req -config $ICINGA2PKIDIR/openssl.cnf -new -newkey rsa:4096 -keyform PEM -keyout $ICINGA_CA/$name.key -outform PEM -out $ICINGA_CA/$name.csr -nodes && \
        openssl x509 -days "$REQ_DAYS" -CA $ICINGA_CA/ca.crt -CAkey $ICINGA_CA/ca.key -req -in $ICINGA_CA/$name.csr -outform PEM -out $ICINGA_CA/$name.tmp -CAserial $ICINGA_CA/serial && \
+       chmod 600 $ICINGA_CA/$name.key && \
        openssl x509 -in $ICINGA_CA/$name.tmp -text >  $ICINGA_CA/$name.crt && \
        rm -f $ICINGA_CA/$name.csr $ICINGA_CA/$name.tmp