Every file you create is readable
The shell carries a mask that decides which permission bits a newly created file does not get, and the stock value on Debian is 0022. Under it, every file a process creates comes out readable by the owner, the group and everyone else - which is harmless for a note in a home directory and considerably less harmless for a database dump, a backup archive or an exported key. Those are usually written by a script that never considered permissions at all. Tightening the mask to 077 and running the same touch produces a file only its owner can read, with no chmod anywhere. The difference is a single line placed before the job runs, and it applies to everything that job creates rather than to the one file somebody remembered to fix afterwards.
Every file this server creates can be read by every account on it.
Not because anyone set a permission. Because nobody changed a default that was chosen decades ago.
The shell carries a mask that decides which bits a new file does not get. Ask for it, and you get the stock value.
Create a file under it, and the result is readable by the owner, by the group, and by everyone else. That is fine for a note in your home directory. It is not fine for a database dump, a backup archive, or an exported key, and those are usually written by a script that never considered it.
Tighten the mask, create another file, and the same command produces one that only its owner can read.
Two files, same directory, same command, different exposure. The difference is one line, set before the job runs.
Check the mask your backup job runs under.
#linux#security#selfhosted#devops#sysadmin
❯ Check the mask your backup job runs under.