[Bug 986014] Re: config file perms too permissive

[Jamie Strandboge]

Thanks for taking the time to report this bug and helping to make Ubuntu
better. Since the package referred to in this bug is in universe or
multiverse, it is community maintained. If you are able, I suggest
coordinating with Debian and posting a debdiff for this issue. When a
debdiff is available, members of the security team will review it and
publish the package. See the following link for more information:
https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures.

** Visibility changed to: Public

** Changed in: proftpd-dfsg (Ubuntu)
       Status: New => Triaged

-- 
You received this bug notification because you are a member of ProFTPD
Maintainance Team, which is subscribed to proftpd-dfsg in Ubuntu.
https://bugs.launchpad.net/bugs/986014

Title:
  config file perms too permissive

Status in “proftpd-dfsg” package in Ubuntu:
  Triaged

Bug description:
  all files under /etc/proftpd have world-read permissions (644), but
  some files may contain sensitive password info, i.e. sql login
  password stored in sql.conf

  fix: config files containing passwords should be 640 (or even 600)
  assuming root/root ownership

  
  12.04 LTS final beta
  proftpd-basic 1.3.4a-1

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/proftpd-dfsg/+bug/986014/+subscriptions