Last night, someone ran chmod 777 on the till files so that "it works". Now every account can read the till's settings, also the card key.

Fix it:

• The owner of everything in /srv/till is till. The group is staff.
• You must be in staff.
• /srv/till: owner and group can go in, nobody else (750).
• /srv/till/till.conf: owner changes it, group reads it, nobody else (640).
• /srv/till/reports: owner and group can add files, nobody else (770).