adds missing "acl" package and secures generated configs

install "acl" pkg so we have `setfacl' cmd available
remove world read perm to protect confidential info in generated configs