[GH-ISSUE #82] SQLite database is world-readable by default #33

New issue

Closed

opened 2026-03-13 15:26:35 +03:00 by kerem · 2 comments

kerem commented

2026-03-13 15:26:35 +03:00

Owner

Originally created by @Ajedi32 on GitHub (May 8, 2018).
Original GitHub issue: https://github.com/acme-dns/acme-dns/issues/82

The acme-dns database contains sensitive information such as API keys, and should not be readable by other Linux users by default. However, when I run acme-dns it creates the acme-dns.db file with its permission bits set to 644.

Originally created by @Ajedi32 on GitHub (May 8, 2018). Original GitHub issue: https://github.com/acme-dns/acme-dns/issues/82 The acme-dns database contains sensitive information such as API keys, and should not be readable by other Linux users by default. However, when I run acme-dns it creates the `acme-dns.db` file with its permission bits set to 644.

kerem

2026-03-13 15:26:35 +03:00

closed this issue
added the
bug

security
labels

kerem commented

2026-03-13 15:26:59 +03:00

Author

Owner

@joohoi commented on GitHub (May 14, 2018):

This definitely is a bug, and should be fixed! Thanks for opening the issue!

@joohoi commented on GitHub (May 14, 2018): This definitely is a bug, and should be fixed! Thanks for opening the issue!

kerem commented

2026-03-13 15:27:05 +03:00

Author

Owner

@Ajedi32 commented on GitHub (Aug 3, 2018):

Worth noting this issue is somewhat mitigated by the fact that the API keys are randomly generated, 40 characters long, and hashed with Bcrypt, so a database leak is very unlikely to result in usable credentials for an attacker.

@Ajedi32 commented on GitHub (Aug 3, 2018): Worth noting this issue is somewhat mitigated by the fact that the API keys are randomly generated, 40 characters long, and hashed with Bcrypt, so a database leak is very unlikely to result in usable credentials for an attacker.

kerem referenced this issue

2026-03-13 16:13:52 +03:00

[PR #33] [MERGED] Docker instructions and configuration #252