plugins icon indicating copy to clipboard operation
plugins copied to clipboard

sysutils/nut -/usr/local/etc/nut/upsd.users is world readable

Open doktornotor opened this issue 2 years ago • 0 comments

Important notices Before you add a new report, we ask you kindly to acknowledge the following:

  • [x] I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
  • [x] I have searched the existing issues, open and closed, and I'm convinced that mine is new.
  • [x] The title contains the plugin to which this issue belongs

Describe the bug

I do not think these are proper permissions for something that contains plaintext passwords.

# ls -l /usr/local/etc/nut/upsd.users
-rw-r--r--  1 root  wheel  208 Dec 12 15:25 /usr/local/etc/nut/upsd.users

To Reproduce Steps to reproduce the behavior:

  1. Install sysutils/os-nut
  2. Configure 'General Settings - Nut Account Settings' and Save

Expected behavior File not world readable.

Relevant log files /var/log/system/latest.log

/var/log/system/system_20231211.log:2951:<28>1 2023-12-11T09:57:29+01:00 gw.example.com upsd 45973 - [meta sequenceId="384"] /usr/local/etc/nut/upsd.users is world readable
/var/log/system/system_20231211.log:2961:<13>1 2023-12-11T09:57:29+01:00 gw.example.com kernel - - [meta sequenceId="394"] <118>/usr/local/etc/nut/upsd.users is world readable

Environment Software version used and hardware type if relevant. e.g.:

OPNsense 23.7.9 (amd64). nut-2.8.1_2 os-nut-1.8.1_2

doktornotor avatar Dec 12 '23 14:12 doktornotor