diff --git a/DEBIAN/postinst b/DEBIAN/postinst
index 929c7e6..3f1ee2d 100755
--- a/DEBIAN/postinst
+++ b/DEBIAN/postinst
@@ -6,4 +6,9 @@ set -e
 
 db_get alice-auth/ldap-bind-password
 
-sed -i "s/ldap_default_authtok =.*/ldap_default_authtok = $RET/" /etc/sssd/sssd.conf
+SSSD_CONFIG=/etc/sssd/sssd.conf
+
+sed -i "s/ldap_default_authtok =.*/ldap_default_authtok = $RET/" $SSSD_CONFIG
+
+chmod 600 $SSSD_CONFIG
+chown root:root $SSSD_CONFIG