Harden config perms and key derivation

Write generated configs 0600, treat new keys as raw AES-256, keep
PBKDF2 for unprefixed material, and cache derivation at startup.

pkg/config/config.go

@@ -1,8 +1,6 @@
 package config
 
 import (
-	"crypto/rand"
-	"encoding/hex"
 	"fmt"
 	"net"
 	"os"
@@ -609,24 +607,33 @@ func GenerateExampleConfig(filename string) error {
 		return fmt.Errorf("failed to marshal config: %v", err)
 	}
 
-	err = os.WriteFile(filename, data, 0644)
+	err = os.WriteFile(filename, data, 0o600)
 	if err != nil {
 		return fmt.Errorf("failed to write config file: %v", err)
 	}
+	if err := os.Chmod(filename, 0o600); err != nil {
+		return fmt.Errorf("failed to set config file permissions: %v", err)
+	}
 
 	fmt.Printf("Generated example configuration: %s\n", filename)
 	fmt.Printf("Edit the configuration file and run: ./teleport -config %s\n", filename)
 	return nil
 }
 
-// generateStrongEncryptionKey generates a cryptographically secure encryption key
+// generateStrongEncryptionKey generates a raw 256-bit key (raw: + 64 hex chars).
 func generateStrongEncryptionKey() (string, error) {
-	// Generate 32 random bytes (256 bits) for a strong encryption key
-	bytes := make([]byte, 32)
-	if _, err := rand.Read(bytes); err != nil {
-		return "", fmt.Errorf("failed to generate random key: %v", err)
-	}
-
-	// Convert to hexadecimal string for easy copying
-	return hex.EncodeToString(bytes), nil
+	return encryption.GenerateRawKey()
+}
+
+// ApplyTCPKeepAlive enables TCP keep-alive when enabled is true.
+func ApplyTCPKeepAlive(conn net.Conn, enabled bool) {
+	if conn == nil || !enabled {
+		return
+	}
+	tcp, ok := conn.(*net.TCPConn)
+	if !ok {
+		return
+	}
+	_ = tcp.SetKeepAlive(true)
+	_ = tcp.SetKeepAlivePeriod(30 * time.Second)
 }