rustdesk / rustdesk/rustdesk-server-pro
Private Key World Readable by Default
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 317
- Forks
- 119
- PR merge metrics
- No merged PRs in 30d
Description
RustDesk Pro 1.5.5 set up with podman according to documentation.
On first run the "/data" folder gets created and contains
-rw-r--r--. 1 user user 892928 Apr 2 09:47 db.sqlite3
-rw-r--r--. 1 user user 32768 Apr 2 09:59 db.sqlite3-shm
-rw-r--r--. 1 user user 107152 Apr 2 09:59 db.sqlite3-wal
-rw-r--r--. 1 user user 88 Mar 31 12:37 id_ed25519
-rw-r--r--. 1 user user 44 Mar 31 12:37 id_ed25519.pub
-rw-r--r--. 1 user user 322 Mar 31 14:48 oidc_config.toml
IMHO making the private key "id_ed25519" group and world readable imposes a massive security risk.
Same goes for oidc_config.toml which contains the secret for the configured oidc provider in plain text.
I would strongly suggest setting all appropriate file permissions on each conainer start.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the container startup path used with Podman and how it creates or populates /data. Check the permissions of id_ed25519, id_ed25519.pub, and oidc_config.toml, then verify on a fresh start that private keys and OIDC secrets are no longer group- or world-readable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- shell
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100