Merge pull request bigbluebutton#688 from datenritter/security-fix

Security fix: Avoid making certificate key world-readable on renewal.
riadvice · Oct 17, 2023 · f11f57f · f11f57f
2 parents e2a3463 + 79b3777
commit f11f57f
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/bbb-install.sh b/bbb-install.sh
@@ -831,9 +831,11 @@ END
   cat > /etc/letsencrypt/renewal-hooks/deploy/haproxy <<HERE
 #!/bin/bash -e
 
+touch /etc/haproxy/certbundle.pem.new
+chmod 0640 /etc/haproxy/certbundle.pem.new
+
 { cat /etc/letsencrypt/live/$HOST/fullchain.pem; echo; cat /etc/letsencrypt/live/$HOST/privkey.pem; } > /etc/haproxy/certbundle.pem.new
 chown root:haproxy /etc/haproxy/certbundle.pem.new
-chmod 0640 /etc/haproxy/certbundle.pem.new
 mv /etc/haproxy/certbundle.pem.new /etc/haproxy/certbundle.pem
 systemctl reload haproxy
 HERE