xref: /csrg-svn/etc/security (revision 53098)

#!/bin/sh -
#
#	@(#)security	5.13 (Berkeley) 03/31/92
#
PATH=/sbin:/usr/sbin:/bin:/usr/bin

umask 22

ERR=/tmp/_secure1.$$
TMP1=/tmp/_secure2.$$
TMP2=/tmp/_secure3.$$
LIST=/tmp/_secure4.$$

trap 'rm -f $ERR $LIST $TMP1 $TMP2' 0

# Display uids of 0.
echo ""
echo "Checking for uids of 0:"
awk -F: "\$3==\"0\" {print \"user: \" \$1 \", uid: \" \$3 }" /etc/master.passwd

# Display uids without passwords.
echo ""
echo "Checking for uids without passwords:"
awk -F: "\$2==\"\" {print \"user: \" \$1 \", uid: \" \$3 }" /etc/master.passwd

# Display setuid and device changes.
echo ""
echo "Checking setuid files and devices:"
(find / ! -fstype local -a -prune -o \
    \( -perm -u+s -o -perm -g+s -o ! -type d -a ! -type f -a ! -type l \) | \
    sort | sed -e 's/^/ls -lgT /' | sh >$TMP1) 2>$ERR

# Display any errors that occurred during system file walk.
if [ -s $ERR ] ; then
	echo "Setuid/device find errors:"
	cat $ERR
	echo ""
fi

# Display any changes in the setuid file list.
egrep -v '^[bc]' $TMP1 > $LIST
if [ -s $LIST ] ; then
	CUR=/var/log/setuid.current
	BACK=/var/log/setuid.backup

	if [ -s $CUR ] ; then
		if cmp -s $CUR $LIST ; then
			:
		else
			:> $TMP1
			join -110 -210 -v2 $CUR $LIST >$TMP2
			if [ -s $TMP2 ] ; then
				echo "Setuid additions:"
				tee -a $TMP1 < $TMP2
				echo ""
			fi

			join -110 -210 -v1 $CUR $LIST >$TMP2
			if [ -s $TMP2 ] ; then
				echo "Setuid deletions:"
				tee -a $TMP1 < $TMP2
				echo ""
			fi

			sort +9 $TMP1 $CUR $LIST | \
			    sed -e 's/[	 ][	 ]*/ /g' | uniq -u >$TMP2
			if [ -s $TMP2 ] ; then
				echo "Setuid changes:"
				column $TMP2
				echo ""
			fi

			mv $CUR $BACK
			mv $LIST $CUR
		fi
	else
		echo "Setuid additions:"
		cat $LIST
		echo ""
		mv $LIST $CUR
	fi
fi

# Display any changes in the device file list.
egrep '^[bc]' $TMP1 > $LIST
if [ -s $LIST ] ; then
	CUR=/var/log/device.current
	BACK=/var/log/device.backup

	if [ -s $CUR ] ; then
		if cmp -s $CUR $LIST ; then
			:
		else
			:> $TMP1
			join -111 -211 -v2 $CUR $LIST >$TMP2
			if [ -s $TMP2 ] ; then
				echo "Device additions:"
				tee -a $TMP1 < $TMP2
				echo ""
			fi

			join -111 -211 -v1 $CUR $LIST >$TMP2
			if [ -s $TMP2 ] ; then
				echo "Device deletions:"
				tee -a $TMP1 < $TMP2
				echo ""
			fi

			sort +10 $TMP1 $CUR $LIST | \
			    sed -e 's/[	 ][	 ]*/ /g' | uniq -u >$TMP2
			if [ -s $TMP2 ] ; then
				echo "Device changes:"
				column $TMP2
				echo ""
			fi

			mv $CUR $BACK
			mv $LIST $CUR
		fi
	else
		echo "Device additions:"
		cat $LIST
		echo ""
		mv $LIST $CUR
	fi
fi
exit

# Check the system binaries.
# Create the mtree tree specifications using:
#
#	mtree -cx -pDIR -kcksum,gid,mode,nlink,size,link,time,uid > DIR.secure
#	chown bin.bin DIR.SECURE
#	chmod 444 DIR.SECURE
#
# Note, this is not complete protection against Trojan horsed binaries, as
# the hacker can modify the tree specification to match the replaced binary.
# For details on really protecting yourself against modified binaries, see
# the mtree(8) manual page.

if cd /etc/mtree; then
	echo ""
	echo "Checking system binaries:"
	for file in *.secure; do
		tree=`sed -n -e '3s/.* //p' -e 3q $file`
		echo ""
		echo "Checking $tree:"
		mtree -f $file -p $tree
	done
fi