Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to have httpd fail a configtest if a SSLCertificateKeyFile value exists, and points to a file with any permissions other than the minimum necessary for reading the key? I have httpd running as root initially, and switching to a different user after startup. The private key file should be owned by root with group root and permissions 400. Anything more permissive should cause a warning or startup failure.

The ssh client has behavior similar to this; if you try to use a private key whose permissions are too open, it fails.

share|improve this question
While this is a valid concern, I think ssh and Apache Httpd have two different user bases: ssh can be for any user (including without many admin skills), whereas httpd typically has only one instance and is under the control of the machine's admin. Its private key tends to be in the machine's config (/etc) rather than each user's directory. Some Linux distributions (e.g. Debian) have /etc/ssl/private/ in mode 710, owned by root:ssl-certs, which is rather sensible as a starting point. – Bruno Dec 19 '11 at 22:42

Depends how big is your shop. If it is a requirement, you can patch apache to have this and may be try to add it upstream. Keep the patched apache in a local repository and distribute it to the local servers.

You can also change the apache startup scripts to check the configuration and extract the filenames that have the SSL keys and do a check on their permission.

3rd option would be to create an systemtap script that checks when apache tries to open the keys logs an error and kills apache.

4th option - use inotify and check when the keys are read, check if they are opened by apache daemon, log an error, then kill apache.

share|improve this answer

It might be simpler to just deploy a cron job like this:

1 * * * * chown -R root:root /etc/apache/keys; chmod -R 400 /etc/apache/keys/*

Apache will always start without errors (unless you have just changed the permissions on the SSL files) and even if someone changes the permissions while Apache is running they will be changed back within the hour. That job is low impact enough you could even have it run every minute on a production system with no concerns.

If you deploy your SSL keys with Puppet (or similar), you can also configure Puppet to enforce the ownership and permissions for those files. Of course, then you have to deal with the keys being stored in Puppet.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.