|
11 | 11 | * |
12 | 12 | * |
13 | 13 | * IDENTIFICATION |
14 | | - * $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.3 2002/06/14 04:33:53 momjian Exp $ |
| 14 | + * $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.4 2002/06/14 04:35:02 momjian Exp $ |
15 | 15 | * |
16 | 16 | * Since the server static private key ($DataDir/server.key) |
17 | 17 | * will normally be stored unencrypted so that the database |
|
59 | 59 | * [ ] use 'random' file, read from '/dev/urandom?' |
60 | 60 | * [*] emphermal DH keys, default values |
61 | 61 | * [*] periodic renegotiation |
62 | | - * [] private key permissions |
| 62 | + * [*] private key permissions |
63 | 63 | * |
64 | 64 | * milestone 4: provide endpoint authentication (client) |
65 | 65 | * [ ] server verifies client certificates |
@@ -551,7 +551,20 @@ initialize_SSL (void) |
551 | 551 | fnbuf,SSLerrmessage()); |
552 | 552 | ExitPostmaster(1); |
553 | 553 | } |
| 554 | + |
554 | 555 | snprintf(fnbuf,sizeof(fnbuf),"%s/server.key",DataDir); |
| 556 | +if (lstat(fnbuf,&buf)==-1) |
| 557 | +{ |
| 558 | +postmaster_error("failed to stat private key file (%s): %s", |
| 559 | +fnbuf,strerror(errno)); |
| 560 | +ExitPostmaster(1); |
| 561 | +} |
| 562 | +if (!S_ISREG(buf.st_mode)|| (buf.st_mode&0077)|| |
| 563 | +buf.st_uid!=getuid()) |
| 564 | +{ |
| 565 | +postmaster_error("bad permissions on private key file (%s)",fnbuf); |
| 566 | +ExitPostmaster(1); |
| 567 | +} |
555 | 568 | if (!SSL_CTX_use_PrivateKey_file(SSL_context,fnbuf,SSL_FILETYPE_PEM)) |
556 | 569 | { |
557 | 570 | postmaster_error("failed to load private key file (%s): %s", |
|