Search code examples
monitlets-encrypt

Should I change permission of pem file to 700?

I'm setting up monit to monitor vps and when I add pem file, monit said that it does not have permissions so should I change pem file permission to 700?

Solution

  • Permission 700 is not needed to .pem file since it says the .pem is executable to the owner (besides being readable and writable). Pemission 600 means just read/write to the owner.

    Your monit might be running as a different user (not the owner of the .pem file) so it has no permission. Remember that you .pem file may contain your private key and you don´t want to "others" have access to it, so open permission to others read the .pem file may be a secure breach. If you choose to go forward you can:

    • chown .pem to same user as monit run
    • make monit run as the same user that owns the .pem
    • put 650 permission to .pem file, make it same group as monit and garantee that monit is the only member of that group*
    • try use ACL

    *This solution may cause other problems if application that use .pem file checks for permissions (like ssh do).

    Ask yourself if this is really necessary.