1.\" $OpenBSD: changelist.5,v 1.9 2017/07/13 19:16:33 jmc Exp $ 2.\" 3.\" Copyright (c) 2003 Jason McIntyre <jmc@openbsd.org> 4.\" 5.\" Permission to use, copy, modify, and distribute this software for any 6.\" purpose with or without fee is hereby granted, provided that the above 7.\" copyright notice and this permission notice appear in all copies. 8.\" 9.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16.\" 17.Dd $Mdocdate: July 13 2017 $ 18.Dt CHANGELIST 5 19.Os 20.Sh NAME 21.Nm changelist 22.Nd list of backup files 23.Sh DESCRIPTION 24The 25.Pa /etc/changelist 26file is a simple text file containing the names of files to be backed up 27and checked for modification by the system security script, 28.Xr security 8 . 29It is checked daily by the 30.Pa /etc/daily 31script. 32See 33.Xr daily 8 34for further details. 35.Pp 36Each line of the file contains the name of a file, 37specified by its absolute pathname, 38one per line. 39By default, configuration files in 40.Pa /etc , 41.Pa /root , 42and 43.Pa /var 44are added during system install. 45Administrators may add additional files at their discretion. 46Shell globbing is supported in pathnames. 47.Pp 48Backup files are held in the directory 49.Pa /var/backups . 50A backup of the current version of a file is kept in this directory, marked 51.Qq current . 52When the file is altered, the old version is marked as 53.Qq backup 54and the new version becomes 55.Qq current . 56.Pp 57For example, 58the system shell database, 59.Pa /etc/shells , 60is held as 61.Pa /var/backups/etc_shells.current . 62When this file is modified, it is renamed to 63.Pa /var/backups/etc_shells.backup 64and the new version becomes 65.Pa /var/backups/etc_shells.current . 66Thereafter, these files are rotated. 67.Pp 68Diffs are mailed to the root administrator, in unified 69.Xr diff 1 70format, via 71.Xr daily 8 , 72in the following format: 73.Bd -unfilled -offset indent 74===== 75/etc/shells diffs (-OLD +NEW) 76===== 77.Ed 78.Pp 79Files in 80.Pa /etc/changelist 81beginning with a 82.Sq + 83character 84.Pq generally non-text files 85are stored as 86.Xr sha256 1 87checksums. 88Results are mailed in the following format: 89.Bd -unfilled -offset indent 90====== 91/etc/ssh/ssh_host_key SHA-256 checksums 92====== 93OLD: 94NEW: 95.Ed 96.Pp 97Lines beginning with the comment character 98.Pq Sq # , 99blank lines, 100and non-existent files are all silently ignored. 101.\" .Sh ENVIRONMENT 102.Sh FILES 103.Bl -tag -width /etc/changelist -compact 104.It Pa /etc/changelist 105Default changelist. 106.It Pa /etc/daily 107Maintenance script which runs 108.Xr security 8 . 109.It Pa /var/backups/ 110Directory containing file backups. 111.El 112.Sh SEE ALSO 113.Xr diff 1 , 114.Xr sha256 1 , 115.Xr daily 8 , 116.Xr security 8 117.Sh HISTORY 118The 119.Nm 120manual page first appeared in 121.Ox 3.5 . 122.Sh CAVEATS 123Anyone with the privileges to alter system configuration files 124could also alter the backup files in 125.Pa /var/backups . 126It is important that this directory be owned by root:wheel 127and have permissions 0700 set. 128.Pp 129Removal of the 130.Pa /etc/changelist 131file itself could cause confusion. 132.Pp 133.Nm 134cannot warn about files being added to the system, although 135.Xr security 8 136will pick up on any files listed in 137.Pa /etc/changelist 138being added or deleted. 139Removals are only noticed for files listed explicitly, 140but not for files matched by globbing. 141.Pp 142If you hose your system configuration files, 143you just might be able to find the information you need in 144.Pa /var/backups . 145This is not a CAVEAT, but we had to let you know somehow! 146