{"action":"created","issue":{"url":"https://api.github.com/repos/certbot/certbot/issues/3108","repository_url":"https://api.github.com/repos/certbot/certbot","labels_url":"https://api.github.com/repos/certbot/certbot/issues/3108/labels{/name}","comments_url":"https://api.github.com/repos/certbot/certbot/issues/3108/comments","events_url":"https://api.github.com/repos/certbot/certbot/issues/3108/events","html_url":"https://github.com/certbot/certbot/issues/3108","id":158062459,"number":3108,"title":"Publically readable privkey.pem","user":{"login":"kousu","id":987487,"avatar_url":"https://avatars.githubusercontent.com/u/987487?v=3","gravatar_id":"","url":"https://api.github.com/users/kousu","html_url":"https://github.com/kousu","followers_url":"https://api.github.com/users/kousu/followers","following_url":"https://api.github.com/users/kousu/following{/other_user}","gists_url":"https://api.github.com/users/kousu/gists{/gist_id}","starred_url":"https://api.github.com/users/kousu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kousu/subscriptions","organizations_url":"https://api.github.com/users/kousu/orgs","repos_url":"https://api.github.com/users/kousu/repos","events_url":"https://api.github.com/users/kousu/events{/privacy}","received_events_url":"https://api.github.com/users/kousu/received_events","type":"User","site_admin":false},"labels":[{"id":273610449,"url":"https://api.github.com/repos/certbot/certbot/labels/security-low","name":"security-low","color":"e16d71","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2016-06-02T05:30:55Z","updated_at":"2016-11-27T13:56:12Z","closed_at":null,"body":"I just right now ran letsencrypt-auto and was left with a world-readable(!) privkey.pem:\n\n```\nkousu@comms:~/Software/letsencrypt$ ./letsencrypt-auto --help\nChecking for new version...\nUpgrading certbot-auto 0.6.0 to 0.7.0...\nReplacing certbot-auto...\n[sudo] password for kousu: \nSorry, try again.\n[sudo] password for kousu: \nCreating virtual environment...\nInstalling Python packages...\nInstallation succeeded.\nRequesting root privileges to run certbot...\n  /home/kousu/.local/share/letsencrypt/bin/letsencrypt --help\n\n  letsencrypt-auto [SUBCOMMAND] [options] [-d domain] [-d domain] ...\n\nCertbot can obtain and install HTTPS/TLS/SSL certificates.  By default,\nit will attempt to use a webserver both for obtaining and installing the\ncert. Major SUBCOMMANDS are:\n\n  (default) run        Obtain & install a cert in your current webserver\n  certonly             Obtain cert, but do not install it (aka \"auth\")\n  install              Install a previously obtained cert in a server\n  renew                Renew previously obtained certs that are near expiry\n  revoke               Revoke a previously obtained certificate\n  rollback             Rollback server configuration changes made during install\n  config_changes       Show changes made to server config during installation\n  plugins              Display information about installed plugins\n\nChoice of server plugins for obtaining and installing cert:\n\n  --apache          Use the Apache plugin for authentication & installation\n  --standalone      Run a standalone webserver for authentication\n  (nginx support is experimental, buggy, and not installed by default)\n  --webroot         Place files in a server's webroot folder for authentication\n\nOR use different plugins to obtain (authenticate) the cert and then install it:\n\n  --authenticator standalone --installer apache\n\nMore detailed help:\n\n  -h, --help [topic]    print this message, or detailed help on a topic;\n                        the available topics are:\n\n   all, automation, paths, security, testing, or any of the subcommands or\n   plugins (certonly, install, nginx, apache, standalone, webroot, etc)\n\nkousu@comms:~/Software/letsencrypt$ \nkousu@comms:~/Software/letsencrypt$ \nkousu@comms:~/Software/letsencrypt$ \nkousu@comms:~/Software/letsencrypt$ ./letsencrypt-auto certonly --standalone -d smalldiscontentslab.ca\nRequesting root privileges to run certbot...\n  /home/kousu/.local/share/letsencrypt/bin/letsencrypt certonly --standalone -d smalldiscontentslab.ca\n\nIMPORTANT NOTES:\n - Congratulations! Your certificate and chain have been saved at\n   /etc/letsencrypt/live/smalldiscontentslab.ca/fullchain.pem. Your\n   cert will expire on 2016-08-31. To obtain a new or tweaked version\n   of this certificate in the future, simply run letsencrypt-auto\n   again. To non-interactively renew *all* of your ceriticates, run\n   \"letsencrypt-auto renew\"\n - If you like Certbot, please consider supporting our work by:\n\n   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate\n   Donating to EFF:                    https://eff.org/donate-le\n\nkousu@comms:~/Software/letsencrypt$ ls /etc/letsencrypt/live/smalldiscontentslab.ca/\ncert.pem  chain.pem  fullchain.pem  privkey.pem\nkousu@comms:~/Software/letsencrypt$ less /etc/letsencrypt/live/smalldiscontentslab.ca/privkey.pem # this works?? wtf?\nkousu@comms:~/Software/letsencrypt$ ls -l /etc/letsencrypt/live/smalldiscontentslab.ca/privkey.pem \nlrwxrwxrwx 1 root root 49 Jun  2 01:17 /etc/letsencrypt/live/smalldiscontentslab.ca/privkey.pem -> ../../archive/smalldiscontentslab.ca/privkey1.pem\nkousu@comms:~/Software/letsencrypt$ ls -l /etc/letsencrypt/archive/smalldiscontentslab.ca/\ncert1.pem       chain1.pem      fullchain1.pem  privkey1.pem    \nkousu@comms:~/Software/letsencrypt$ ls -l /etc/letsencrypt/archive/smalldiscontentslab.ca/privkey1.pem # oh no, they didn't did they? \n-rw-r--r-- 1 root root 1708 Jun  2 01:17 /etc/letsencrypt/archive/smalldiscontentslab.ca/privkey1.pem\nkousu@comms:~/Software/letsencrypt$ \n```\n\n:/\n\nIs letsencrypt (er, certbot?) assuming that the umask is something other than what I have set? Here's more context, in case that matters:\n\n```\nkousu@comms:~/Software/letsencrypt$ ls -l /etc/letsencrypt/\ntotal 24\ndrwxr----- 3 root ssl-cert 4096 Dec  6 05:26 accounts\ndrwxr-x--- 5 root ssl-cert 4096 Jun  2 01:17 archive\ndrwxr-xr-x 2 root ssl-cert 4096 Jun  2 01:17 csr\ndrwxr----- 2 root ssl-cert 4096 Jun  2 01:17 keys\ndrwxr-x--- 5 root ssl-cert 4096 Jun  2 01:17 live\ndrwxr-xr-x 2 root ssl-cert 4096 Jun  2 01:17 renewal\nkousu@comms:~/Software/letsencrypt$ ls -l /etc/letsencrypt/archive/\ntotal 12\ndrwxr-xr-x 2 root ssl-cert 4096 May 19 12:56 comms.kousu.ca\ndrwxr-xr-x 2 root ssl-cert 4096 Feb 19 01:42 kousu.ca\ndrwxr-xr-x 2 root root     4096 Jun  2 01:17 smalldiscontentslab.ca\nkousu@comms:~/Software/letsencrypt$ ls -l /etc/letsencrypt/archive/smalldiscontentslab.ca/\ntotal 16\n-rw-r--r-- 1 root root 1818 Jun  2 01:17 cert1.pem\n-rw-r--r-- 1 root root 1647 Jun  2 01:17 chain1.pem\n-rw-r--r-- 1 root root 3465 Jun  2 01:17 fullchain1.pem\n-rw-r--r-- 1 root root 1708 Jun  2 01:17 privkey1.pem\nkousu@comms:~/Software/letsencrypt$ \n```\n"},"comment":{"url":"https://api.github.com/repos/certbot/certbot/issues/comments/263123626","html_url":"https://github.com/certbot/certbot/issues/3108#issuecomment-263123626","issue_url":"https://api.github.com/repos/certbot/certbot/issues/3108","id":263123626,"user":{"login":"ArchangeGabriel","id":490531,"avatar_url":"https://avatars.githubusercontent.com/u/490531?v=3","gravatar_id":"","url":"https://api.github.com/users/ArchangeGabriel","html_url":"https://github.com/ArchangeGabriel","followers_url":"https://api.github.com/users/ArchangeGabriel/followers","following_url":"https://api.github.com/users/ArchangeGabriel/following{/other_user}","gists_url":"https://api.github.com/users/ArchangeGabriel/gists{/gist_id}","starred_url":"https://api.github.com/users/ArchangeGabriel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ArchangeGabriel/subscriptions","organizations_url":"https://api.github.com/users/ArchangeGabriel/orgs","repos_url":"https://api.github.com/users/ArchangeGabriel/repos","events_url":"https://api.github.com/users/ArchangeGabriel/events{/privacy}","received_events_url":"https://api.github.com/users/ArchangeGabriel/received_events","type":"User","site_admin":false},"created_at":"2016-11-27T13:56:12Z","updated_at":"2016-11-27T13:56:12Z","body":"@discretepackets This is irrelevant, those files are symlinks. What matters is the permission of the files they are pointing to."}}
{"actor":{"display_login":"ArchangeGabriel"}}