Harden config perms and key derivation

Write generated configs 0600, treat new keys as raw AES-256, keep
PBKDF2 for unprefixed material, and cache derivation at startup.

pkg/config/config_test.go

@@ -7,6 +7,8 @@ import (
 	"strings"
 	"testing"
 	"time"
+
+	"teleport/pkg/encryption"
 )
 
 func TestLoadConfig(t *testing.T) {
@@ -585,3 +587,61 @@ func TestGenerateExampleConfigUsesLoopback(t *testing.T) {
 		t.Fatalf("generated client local listen %q", got)
 	}
 }
+
+func TestGenerateExampleConfigMode0600(t *testing.T) {
+	tempDir := t.TempDir()
+	configFile := filepath.Join(tempDir, "server.yaml")
+	if err := GenerateExampleConfig(configFile); err != nil {
+		t.Fatal(err)
+	}
+	st, err := os.Stat(configFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if st.Mode().Perm() != 0o600 {
+		t.Fatalf("generated config mode %04o want 0600", st.Mode().Perm())
+	}
+	cfg, err := LoadConfig(configFile)
+	if err != nil {
+		t.Fatalf("reload generated config: %v", err)
+	}
+	if !encryption.IsRawKey(cfg.EncryptionKey) {
+		t.Fatalf("generated encryption_key is not raw: %q", cfg.EncryptionKey[:min(8, len(cfg.EncryptionKey))])
+	}
+	key, err := encryption.ResolveKey(cfg.EncryptionKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(key) != 32 {
+		t.Fatalf("resolved key len %d", len(key))
+	}
+}
+
+func TestApplyTCPKeepAlive(t *testing.T) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ln.Close()
+	errCh := make(chan error, 1)
+	go func() {
+		c, err := ln.Accept()
+		if err != nil {
+			errCh <- err
+			return
+		}
+		defer c.Close()
+		ApplyTCPKeepAlive(c, true)
+		errCh <- nil
+	}()
+	conn, err := net.Dial("tcp", ln.Addr().String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	ApplyTCPKeepAlive(conn, true)
+	ApplyTCPKeepAlive(conn, false)
+	if err := <-errCh; err != nil {
+		t.Fatal(err)
+	}
+}