1.\" $NetBSD: security.conf.5,v 1.44 2024/11/14 19:57:41 plunky Exp $ 2.\" 3.\" Copyright (c) 1996 Matthew R. Green 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 15.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 19.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 20.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 21.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 22.\" AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 23.\" OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25.\" SUCH DAMAGE. 26.\" 27.Dd December 2, 2020 28.Dt SECURITY.CONF 5 29.Os 30.Sh NAME 31.Nm security.conf 32.Nd daily security check configuration file 33.Sh DESCRIPTION 34The 35.Nm 36file specifies which of the standard 37.Pa /etc/security 38services are performed. 39The 40.Pa /etc/security 41script is run, by default, every night from 42.Pa /etc/daily , 43on a 44.Nx 45system, if configured do to so from 46.Pa /etc/daily.conf . 47.Pp 48The variables described below can be set to "NO" to disable the test: 49.Bl -tag -width check_pkg_vulnerabilities 50.It Sy check_entropy 51This checks whether the system has enough entropy 52.Pq see Xr entropy 7 . 53.It Sy check_passwd 54This checks the 55.Pa /etc/master.passwd 56file for inconsistencies. 57.It Sy check_group 58This checks the 59.Pa /etc/group 60file for inconsistencies. 61.It Sy check_rootdotfiles 62This checks the root users startup files for sane settings of $PATH 63and umask. 64This test is not fail safe and any warning generated from 65this should be checked for correctness. 66.It Sy check_ftpusers 67This checks that the correct users are in the 68.Pa /etc/ftpusers 69file. 70.It Sy check_aliases 71This checks for security problems in the 72.Pa /etc/mail/aliases 73file. 74For backward compatibility, 75.Pa /etc/aliases 76will be checked as well if exists. 77.It Sy check_rhosts 78This checks for system and user rhosts files with "+" in them. 79.It Sy check_homes 80This checks that home directories are owned by the correct user, 81and have appropriate permissions. 82.It Sy check_varmail 83This checks that the correct user owns mail in 84.Pa /var/mail , 85and that the mail box has the right permissions. 86.It Sy check_nfs 87This checks that the 88.Pa /etc/exports 89file does not export filesystems to the world. 90.It Sy check_devices 91This checks for changes to devices and setuid files. 92.It Sy check_mtree 93This runs 94.Xr mtree 8 95to ensure that the system is installed correctly. 96The following configuration files are checked: 97.Bl -tag -width 4n 98.It Pa /etc/mtree/special 99Default files to check. 100.It Pa /etc/mtree/special.local 101Local site additions and overrides. 102.It Pa /etc/mtree/DIR.secure 103Specification for the directory 104.Pa DIR . 105.El 106.It Sy check_disklabels 107Backup text copies of the disklabels of available disk drives into 108.Pa /var/backups/work/disklabel.XXX , 109and display any differences in those and the previous copies 110as per 111.Sy check_changelist 112below. 113If 114.Xr fdisk 8 115is available on the current platform, the output of 116.Pa /sbin/fdisk 117for each available disk drive is stored in 118.Pa /var/backups/work/fdisk.XXX , 119and any differences displayed as per the disklabels. 120.It Sy check_pkgs 121This stores a list of all installed pkgs into 122.Pa /var/backups/work/pkgs 123and checks it for any changes. 124.It Sy check_changelist 125This determines a list of files from the contents of 126.Pa /etc/changelist , 127and the output of 128.Ic mtree -D 129for 130.Pa /etc/mtree/special 131and 132.Pa /etc/mtree/special.local . 133For each file in the list it compares the files with their backups in 134.Pa /var/backups/file.current 135and 136.Pa /var/backups/file.backup , 137and displays any differences found. 138The following 139.Xr mtree 8 140.Sy tags 141modify how files are determined from 142.Pa /etc/mtree/special 143and 144.Pa /etc/mtree/special.local : 145.Bl -tag -width exclude -offset indent 146.It exclude 147The entry is ignored; no backups are made and the differences are not 148displayed. 149This includes dynamic or binary files such as 150.Pa /var/run/utmp . 151.It nodiff 152The entry is backed up but the differences are not displayed because 153the contents of the file are sensitive. 154This includes files such as 155.Pa /etc/master.passwd . 156.El 157.It Sy check_pkg_vulnerabilities 158Checks the currently installed packages against a database of known 159vulnerabilities and reports those that are vulnerable. 160Check the 161.Sy fetch_pkg_vulnerabilities 162setting in 163.Xr daily.conf 5 164to keep the database up to date. 165.It Sy check_pkg_signatures 166Checks the digital signature of all files installed by packages against 167the expected values stored in the packages database. 168.El 169.Pp 170The variables described below can be set to modify the tests: 171.Bl -tag -width check_network 172.It Sy check_homes_permit_usergroups 173During the 174.Sy check_homes 175phase, allow the checked files to be group-writable if the group name is 176the same as the username. 177.It Sy check_homes_permit_other_owner 178During the 179.Sy check_homes 180phase, allow the home directory and files of the listed users to be owned 181by a different user. 182.It Sy check_devices_ignore_fstypes 183Lists filesystem types to ignore during the 184.Sy check_devices 185phase. 186Prefixing the type with a 187.Sq \&! 188inverts the match. 189For example, 190.Ql procfs !local 191will ignore 192.Ql procfs 193type filesystems and filesystems that are not 194.Ql local . 195.It Sy check_devices_ignore_paths 196Lists pathnames to ignore during the 197.Sy check_devices 198phase. 199Prefixing the path with a 200.Sq \&! 201inverts the match. 202For example, 203.Ql /tftp 204will ignore paths under 205.Pa /tftp 206while 207.Ql !/home 208will ignore paths that are not under 209.Pa /home . 210.It Sy check_mtree_follow_symlinks 211During the 212.Sy check_mtree 213phase, instruct mtree to follow symbolic links. 214Please note, this may cause the 215.Sy check_mtree 216phase to report errors for entries for these symbolic links (i.e. of 217type=link in the mtree specification) as they will always appear to be plain 218files for the purposes of the check. 219.Pa /etc/mtree/special.local 220may be used to override the checks for the affected links. 221.It Sy check_passwd_nowarn_shells 222If 223.Sy check_passwd 224is enabled, most warnings will be suppressed for entries whose shells 225are listed in this space-separated list. 226This is of particular value when those shells are not in 227.Pa /etc/shells . 228.It Sy check_passwd_nowarn_users 229If 230.Sy check_passwd 231is enabled, suppress warnings for these users. 232.It Sy check_passwd_permit_dups 233If 234.Sy check_passwd 235is enabled, do not warn about duplicate uids for the listed login names. 236.It Sy check_passwd_permit_nonalpha 237If 238.Sy check_passwd 239is enabled, do not warn about login names which use non-alphanumeric 240characters. 241.It Sy check_passwd_permit_star 242If 243.Sy check_passwd 244is enabled, do not warn about password fields set to 245.Dq * . 246Note that the use of password fields such as 247.Dq *ssh 248is encouraged, instead. 249.It Sy max_grouplen 250If 251.Sy check_group 252is enabled, this determines the maximum permitted length of group names. 253.It Sy max_loginlen 254If 255.Sy check_passwd 256is enabled, this determines the maximum permitted length of login names. 257.It Sy backup_dir 258Change the backup directory from 259.Pa /var/backups . 260.It Sy diff_options 261Specify the options passed to 262.Xr diff 1 263when it is invoked to show changes made to system files. 264Defaults to 265.Dq -u , 266for unified-format context-diffs. 267.It Sy pkgdb_dir 268.Em DEPRECATED . 269Please set 270.Dv PKGDB_DIR 271in 272.Xr pkg_install.conf 5 273instead. 274.Pp 275If defined, points to the location of the packages database. 276Defaults to 277.Pa /usr/pkg/pkgdb . 278.It Sy backup_uses_rcs 279Use 280.Xr rcs 1 281for maintaining backup copies of files noted in 282.Sy check_devices , 283.Sy check_disklabels , 284.Sy check_pkgs , 285and 286.Sy check_changelist 287instead of just keeping a current copy and a backup copy. 288.It Sy random_file 289Name of the entropy seed file used at boot. 290Default is 291.Pa /var/db/entropy-file 292as used by 293.Pa /etc/rc.d/random_seed . 294Set 295.Sy random_file 296to empty to disable saving a seed every time 297.Pa /etc/security 298runs. 299.El 300.Sh FILES 301.Bl -tag -width /etc/defaults/security.conf -compact 302.It Pa /etc/defaults/security.conf 303defaults for /etc/security.conf 304.It Pa /etc/security 305daily security check script 306.It Pa /etc/security.conf 307daily security check configuration 308.It Pa /etc/security.local 309local site additions to 310.Pa /etc/security 311.El 312.Sh SEE ALSO 313.Xr daily.conf 5 314.Sh HISTORY 315The 316.Nm 317file appeared in 318.Nx 1.3 . 319The 320.Sy check_disklabels 321functionality was added in 322.Nx 1.4 . 323The 324.Sy backup_uses_rcs 325and 326.Sy check_pkgs 327features were added in 328.Nx 1.6 . 329.Sy diff_options 330appeared in 331.Nx 2.0 ; 332prior to that, traditional-format (context free) diffs were generated. 333