/etc/kannel/kannel.conf usually contains passwords, for the http admin
interface and SMSC communications.  The kannel package installs this
file and directory with the following permissions:

drwxr-xr-x 2 root root 4096 Jun 15 12:57 /etc/kannel
-rw-r--r-- 1 root root  536 Feb  6  2010 /etc/kannel/kannel.conf

Thus, all users and daemons of the server can read the passwords from
this file.  I'd like to protect the passwords so that only Kannel and
root can read them.  Although I can use "include=" to make Kannel read
the passwords from a separate file, that does not solve the problem
because the permissions issues shown below would then apply to that file.

If I remove the "other" access permissions from the file, like this:

drwxr-xr-x 2 root root 4096 Jun 15 12:57 /etc/kannel
-rw-r----- 1 root root  536 Feb  6  2010 /etc/kannel/kannel.conf

then bearerbox and wapbox won't start, because they run as
kannel:nogroup and therefore cannot read kannel.conf.

If I also make Kannel own the file, like this:

drwxr-xr-x 2 root   root 4096 Jun 15 12:57 /etc/kannel
-rw-r----- 1 kannel root  536 Feb  6  2010 /etc/kannel/kannel.conf

then Kannel will start OK.  However, this configuration gives Kannel
write access to /etc/kannel/kannel.conf, which violates the principle
of least privilege.

I have therefore created also a "kannel" group, made it the default
group of the "kannel" user so that Kannel runs as kannel:kannel, and
changed the permissions as follows:

drwxr-sr-x 2 root kannel 4096 Jun 15 12:57 /etc/kannel
-rw-r----- 1 root kannel  536 Feb  6  2010 /etc/kannel/kannel.conf

I would like this configuration to be made the default.
I kept the /etc/kannel directory world-readable so that I still
get tab completion for "sudo nano /etc/kannel/kannel.conf".

The same effect could also be achieved with ACLs, but I think those
would be more difficult for system administrators to understand because
ls -l does not show the full ACL and one has to use chacl -l or getfacl
instead.