rustdesk / rustdesk/rustdesk-server
Private key on Ubuntu is created as world-readable file
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 10.4k
- Forks
- 2.6k
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
The private key of the hbbs server is created as world-readable file.
Describe the environment
Debian package on Ubuntu 20.04, version 1.1.14
How to Reproduce the bug
Steps to reproduce the behavior:
- Install the package.
- The file /var/lib/rustdesk-server/id_ed25519 is now readable by any user on the system, i.e. it has mode 0644.
Expected behavior
The private key should only be readable by the user the servers are running as, i.e. it should have mode 0600 and owned by the correct user.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the Debian package installation that creates /var/lib/rustdesk-server/id_ed25519, then inspect how its owner and permissions are assigned. Reproduce the installation on Ubuntu 20.04 and verify that the private key is owned by the server user and has mode 0600.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- debian, rust, ubuntu
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 52/100