Skip to content
Browse

/errors/wireguard/configuration-file-is-world-accessible

Warning: `/etc/wireguard/wg0.conf' is world accessible

The commands on this page have not been executed by our verification runner yet.updated
tool
WireGuard
exit code
0
versions
wireguard-tools 1.0
os
linux

Warning: `/etc/wireguard/wg0.conf' is world accessible is printed by wg-quick when both the configuration file and the directory that contains it grant some permission to "other" users. The file holds the interface's private key, so other local users may have been able to read it. It is only a warning: wg-quick continues and the tunnel comes up. Fix it with chmod 600 /etc/wireguard/wg0.conf and chmod 700 /etc/wireguard.

Which cause applies

  • Editor or copy defaults. stat -c '%a' /etc/wireguard/wg0.conf prints 644 (or 664): the file was written with the usual umask 022. Common after creating the file with an editor or cp from a home directory.
  • Directory opened up. stat -c '%a' /etc/wireguard prints 755. Only root needs to enter it, so 700 is enough; a 755 usually comes from a plain mkdir or a configuration management run.
  • Provisioning tools and archives. Files written by Ansible, Puppet or tar keep the mode given in the task or archive. If the warning comes back after every deployment, set mode: "0600" (or the tool's equivalent) in the task, not by hand.

What wg-quick checks

In src/wg-quick/linux.bash, parse_options() takes the octal mode of the file and of its directory with stat -c '0%#a', combines them with a bitwise AND, and masks the "other" bits (0007). It prints the warning to standard error when the result is not zero, so the warning appears only when both the file and its directory give some permission to other users. The check does not change the exit status.

bash
stat -c '%a %U:%G %n' /etc/wireguard /etc/wireguard/wg0.conf
chmod 700 /etc/wireguard
chmod 600 /etc/wireguard/wg0.conf
chown root:root /etc/wireguard/wg0.conf

Run them as root. Fixing either the file or the directory silences the warning, but set both, so that a later change to one of them does not expose the key again.

Confirm the fix

Run wg-quick down wg0 and wg-quick up wg0 again (or systemctl restart wg-quick@wg0). The warning line is gone when either the file or the directory no longer grants permissions to "other"; stat should show 600 for the file and 700 for the directory. The interface itself behaved the same before and after, since the check never changed the outcome.

Create files private from the start

bash
umask 077
wg genkey | tee /etc/wireguard/wg0.key | wg pubkey > /etc/wireguard/wg0.pub

With umask 077 in that shell, new files are created as 600 and directories as 700, so the key never exists with wider permissions, even briefly.

FAQ

Does this warning stop the tunnel from coming up?

No. wg-quick prints it to standard error and carries on, so the exit status and the interface are the same as without it. It is a security warning, not a configuration error.

Why does the warning show a different path from the one I typed?

wg-quick resolves the configuration path first (readlink -f on Linux), so a symlink is reported and checked at its real location. Fix the permissions of the target file and its directory.

Do the BSD and macOS versions of wg-quick check this too?

Yes. The darwin, freebsd and openbsd scripts run the same test with stat -f instead of stat -c and print the same warning.

Sources

Related pages

commands · wireguardwg genkey | tee privatekey | wg pubkey > publickey: generate WireGuard keyswg genkey | tee privatekey | wg pubkey > publickey creates a WireGuard key pair. Set umask 077 first, and add a pre-shared key with wg genpsk if needed.errors · wireguardwg-quick: `wg0' already existswg-quick up found the wg0 interface already present, often started by the wg-quick@wg0 service. Run wg-quick down first, or restart the systemd unit instead.config · wireguardWireGuard PersistentKeepalive = 25: keep a tunnel open behind NATPersistentKeepalive = 25 sends a WireGuard packet every 25 seconds so NAT keeps the tunnel reachable. Set it on the peer behind NAT; servers rarely need it.errors · wireguardwg-quick: resolvconf: command not foundwg-quick runs resolvconf for the DNS = line and fails when it is missing. Install openresolv or a resolvconf command, or drop DNS and use resolvectl in PostUp.