1.\" $NetBSD: security.conf.5,v 1.16 2001/10/15 08:53:28 lukem Exp $ 2.\" 3.\" Copyright (c) 1996 Matthew R. Green 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. The name of the author may not be used to endorse or promote products 15.\" derived from this software without specific prior written permission. 16.\" 17.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 22.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 23.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 24.\" AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 25.\" OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27.\" SUCH DAMAGE. 28.\" 29.Dd October 15, 2001 30.Dt SECURITY.CONF 5 31.Os 32.Sh NAME 33.Nm security.conf 34.Nd daily security check configuration file 35.Sh DESCRIPTION 36The 37.Nm 38file specifies which of the standard 39.Pa /etc/security 40services are performed. The 41.Pa /etc/security 42script is run, by default, every night from 43.Pa /etc/daily , 44on a 45.Nx 46system, if configured do to so from 47.Pa /etc/daily.conf . 48.Pp 49The variables described below can be set to "NO" to disable the test: 50.Bl -tag -width check_network 51.It Sy check_passwd 52This checks the 53.Pa /etc/master.passwd 54file for inconsistancies. 55.It Sy check_group 56This checks the 57.Pa /etc/group 58file for inconsistancies. 59.It Sy check_rootdotfiles 60This checks the root users startup files for sane settings of $PATH 61and umask. This test is not fail safe and any warning generated from 62this should be checked for correctness. 63.It Sy check_ftpusers 64This checks that the correct users are in the 65.Pa /etc/ftpusers 66file. 67.It Sy check_aliases 68This checks for security problems in the 69.Pa /etc/mail/aliases 70file. 71For backward compatibility, 72.Pa /etc/aliases 73will be checked as well if exists. 74.It Sy check_rhosts 75This checks for system and user rhosts files with "+" in them. 76.It Sy check_homes 77This checks that home directories are owned by the correct user, 78and have appropriate permissions. 79.It Sy check_varmail 80This checks that the correct user owns mail in 81.Pa /var/mail , 82and that the mail box has the right permissions. 83.It Sy check_nfs 84This checks that the 85.Pa /etc/exports 86file does not export filesystems to the world. 87.It Sy check_devices 88This checks for changes to devices and setuid files. 89.It Sy check_mtree 90This runs 91.Xr mtree 8 92to ensure that the system is installed correctly. 93The following configuration files are checked: 94.Bl -tag -width 4n 95.It Pa /etc/mtree/special 96Default files to check. 97.It Pa /etc/mtree/special.local 98Local site additions. 99.It Pa /etc/mtree/DIR.secure 100Specification for the directory 101.Pa DIR . 102.El 103.It Sy check_disklabels 104Backup text copies of the disklabels of available disk drives into 105.Pa /var/backups/work/disklabel.XXX , 106and display any differences in those and the previous copies 107as per 108.Sy check_changelist 109below. 110If 111.Xr fdisk 8 112is available on the current platform, the output of 113.Pa /sbin/fdisk 114for each available disk drive is stored in 115.Pa /var/backups/work/fdisk.XXX , 116and any differences displayed as per the disklabels. 117.It Sy check_pkgs 118This stores a list of all installed pkgs into 119.Pa /var/backups/work/pkgs 120and checks it for any changes. 121.It Sy check_changelist 122This determines a list of files from the contents of 123.Pa /etc/changelist , 124and the output of 125.Ic mtree -D 126for 127.Pa /etc/mtree/special 128and 129.Pa /etc/mtree/special.local . 130For each file in the list it compares the files with their backups in 131.Pa /var/backups/file.current 132and 133.Pa /var/backups/file.backup , 134and displays any differences found. 135The following 136.Xr mtree 8 137.Sy tags 138modify how files are determined from 139.Pa /etc/mtree/special 140and 141.Pa /etc/mtree/special.local : 142.Bl -tag -width exclude -offset indent 143.It exclude 144The entry is ignored; no backups are made and the differences are not 145displayed. 146This includes dynamic or binary files such as 147.Pa /var/run/utmp . 148.It nodiff 149The entry is backed up but the differences are not displayed because 150the contents of the file are sensitive. 151This includes files such as 152.Pa /etc/master.passwd . 153.El 154.El 155.Pp 156The variables described below can be set to modify the tests: 157.Bl -tag -width check_network 158.It Sy max_grouplen 159If 160.Sy check_group 161is enabled, this determines the maximum permitted length of group names. 162.It Sy max_loginlen 163If 164.Sy check_passwd 165is enabled, this determines the maximum permitted length of login names. 166.It Sy backup_dir 167Change the backup directory from 168.Pa /var/backup . 169.It Sy pkgdb_dir 170Change the pkg database directory from 171.Pa /var/db/pkg 172when 173.Sy check_pkgs 174is enabled. 175.It Sy backup_uses_rcs 176Use 177.Xr rcs 1 178for maintaining backup copies of files noted in 179.Sy check_devices , 180.Sy check_disklabels , 181.Sy check_pkgs , 182and 183.Sy check_changelist 184instead of just keeping a current copy and a backup copy. 185.El 186.Sh FILES 187.Bl -tag -width /etc/security.local -compact 188.It Pa /etc/security 189daily security check script 190.It Pa /etc/security.conf 191daily security check configuration 192.It Pa /etc/security.local 193local site additions to 194.Pa /etc/security 195.El 196.Sh SEE ALSO 197.Xr daily.conf 5 198.Sh HISTORY 199The 200.Nm 201file appeared in 202.Nx 1.3 . 203The 204.Sy check_disklabels 205functionality was added in 206.Nx 1.4 . 207The 208.Sy backup_uses_rcs 209and 210.Sy check_pkgs 211features were added in 212.Nx 1.6 . 213