1.\" $NetBSD: security.conf.5,v 1.32 2008/04/08 14:51:02 sborrill Exp $ 2.\" 3.\" Copyright (c) 1996 Matthew R. Green 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. The name of the author may not be used to endorse or promote products 15.\" derived from this software without specific prior written permission. 16.\" 17.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 22.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 23.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 24.\" AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 25.\" OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27.\" SUCH DAMAGE. 28.\" 29.Dd May 29, 2006 30.Dt SECURITY.CONF 5 31.Os 32.Sh NAME 33.Nm security.conf 34.Nd daily security check configuration file 35.Sh DESCRIPTION 36The 37.Nm 38file specifies which of the standard 39.Pa /etc/security 40services are performed. 41The 42.Pa /etc/security 43script is run, by default, every night from 44.Pa /etc/daily , 45on a 46.Nx 47system, if configured do to so from 48.Pa /etc/daily.conf . 49.Pp 50The variables described below can be set to "NO" to disable the test: 51.Bl -tag -width check_network 52.It Sy check_passwd 53This checks the 54.Pa /etc/master.passwd 55file for inconsistencies. 56.It Sy check_group 57This checks the 58.Pa /etc/group 59file for inconsistencies. 60.It Sy check_rootdotfiles 61This checks the root users startup files for sane settings of $PATH 62and umask. 63This test is not fail safe and any warning generated from 64this should be checked for correctness. 65.It Sy check_ftpusers 66This checks that the correct users are in the 67.Pa /etc/ftpusers 68file. 69.It Sy check_aliases 70This checks for security problems in the 71.Pa /etc/mail/aliases 72file. 73For backward compatibility, 74.Pa /etc/aliases 75will be checked as well if exists. 76.It Sy check_rhosts 77This checks for system and user rhosts files with "+" in them. 78.It Sy check_homes 79This checks that home directories are owned by the correct user, 80and have appropriate permissions. 81.It Sy check_varmail 82This checks that the correct user owns mail in 83.Pa /var/mail , 84and that the mail box has the right permissions. 85.It Sy check_nfs 86This checks that the 87.Pa /etc/exports 88file does not export filesystems to the world. 89.It Sy check_devices 90This checks for changes to devices and setuid files. 91.It Sy check_mtree 92This runs 93.Xr mtree 8 94to ensure that the system is installed correctly. 95The following configuration files are checked: 96.Bl -tag -width 4n 97.It Pa /etc/mtree/special 98Default files to check. 99.It Pa /etc/mtree/special.local 100Local site additions and overrides. 101.It Pa /etc/mtree/DIR.secure 102Specification for the directory 103.Pa DIR . 104.El 105.It Sy check_disklabels 106Backup text copies of the disklabels of available disk drives into 107.Pa /var/backups/work/disklabel.XXX , 108and display any differences in those and the previous copies 109as per 110.Sy check_changelist 111below. 112If 113.Xr fdisk 8 114is available on the current platform, the output of 115.Pa /sbin/fdisk 116for each available disk drive is stored in 117.Pa /var/backups/work/fdisk.XXX , 118and any differences displayed as per the disklabels. 119.It Sy check_pkgs 120This stores a list of all installed pkgs into 121.Pa /var/backups/work/pkgs 122and checks it for any changes. 123.It Sy check_changelist 124This determines a list of files from the contents of 125.Pa /etc/changelist , 126and the output of 127.Ic mtree -D 128for 129.Pa /etc/mtree/special 130and 131.Pa /etc/mtree/special.local . 132For each file in the list it compares the files with their backups in 133.Pa /var/backups/file.current 134and 135.Pa /var/backups/file.backup , 136and displays any differences found. 137The following 138.Xr mtree 8 139.Sy tags 140modify how files are determined from 141.Pa /etc/mtree/special 142and 143.Pa /etc/mtree/special.local : 144.Bl -tag -width exclude -offset indent 145.It exclude 146The entry is ignored; no backups are made and the differences are not 147displayed. 148This includes dynamic or binary files such as 149.Pa /var/run/utmp . 150.It nodiff 151The entry is backed up but the differences are not displayed because 152the contents of the file are sensitive. 153This includes files such as 154.Pa /etc/master.passwd . 155.El 156.El 157.Pp 158The variables described below can be set to modify the tests: 159.Bl -tag -width check_network 160.It Sy check_homes_permit_usergroups 161During the 162.Sy check_homes 163phase, allow the checked files to be group-writable if the group name is 164the same as the username. 165.It Sy check_devices_ignore_fstypes 166Lists filesystem types to ignore during the 167.Sy check_devices 168phase. 169Prefixing the type with a 170.Sq \&! 171inverts the match. 172For example, 173.Ql procfs !local 174will ignore 175.Ql procfs 176type filesystems and filesystems that are not 177.Ql local . 178.It Sy check_devices_ignore_paths 179Lists pathnames to ignore during the 180.Sy check_devices 181phase. 182Prefixing the path with a 183.Sq \&! 184inverts the match. 185For example, 186.Ql /tftp 187will ignore paths under 188.Pa /tftp 189while 190.Ql !/home 191will ignore paths that are not under 192.Pa /home . 193.It Sy check_mtree_follow_symlinks 194During the 195.Sy check_mtree 196phase, instruct mtree to follow symbolic links. 197Please note, this may cause the 198.Sy check_mtree 199phase to report errors for entries for these symbolic links (i.e. of 200type=link in the mtree specification) as they will always appear to be plain 201files for the purposes of the check. 202.Pa /etc/mtree/special.local 203may be used to override the checks for the affected links. 204.It Sy check_passwd_nowarn_shells 205If 206.Sy check_passwd 207is enabled, most warnings will be suppressed for entries whose shells 208are listed in this space-separated list. 209This is of particular value when those shells are not in 210.Pa /etc/shells . 211.It Sy check_passwd_nowarn_users 212If 213.Sy check_passwd 214is enabled, suppress warnings for these users. 215.It Sy check_passwd_permit_nonalpha 216If 217.Sy check_passwd 218is enabled, do not warn about login names which use non-alphanumeric 219characters. 220.It Sy check_passwd_permit_star 221If 222.Sy check_passwd 223is enabled, do not warn about password fields set to 224.Dq * . 225Note that the use of password fields such as 226.Dq *ssh 227is encouraged, instead. 228.It Sy max_grouplen 229If 230.Sy check_group 231is enabled, this determines the maximum permitted length of group names. 232.It Sy max_loginlen 233If 234.Sy check_passwd 235is enabled, this determines the maximum permitted length of login names. 236.It Sy backup_dir 237Change the backup directory from 238.Pa /var/backup . 239.It Sy diff_options 240Specify the options passed to 241.Xr diff 1 242when it is invoked to show changes made to system files. 243Defaults to 244.Dq -u , 245for unified-format context-diffs. 246.It Sy pkgdb_dir 247Change the pkg database directory from 248.Pa /var/db/pkg 249when 250.Sy check_pkgs 251is enabled. 252.It Sy backup_uses_rcs 253Use 254.Xr rcs 1 255for maintaining backup copies of files noted in 256.Sy check_devices , 257.Sy check_disklabels , 258.Sy check_pkgs , 259and 260.Sy check_changelist 261instead of just keeping a current copy and a backup copy. 262.El 263.Sh FILES 264.Bl -tag -width /etc/defaults/security.conf -compact 265.It Pa /etc/defaults/security.conf 266defaults for /etc/security.conf 267.It Pa /etc/security 268daily security check script 269.It Pa /etc/security.conf 270daily security check configuration 271.It Pa /etc/security.local 272local site additions to 273.Pa /etc/security 274.El 275.Sh SEE ALSO 276.Xr daily.conf 5 277.Sh HISTORY 278The 279.Nm 280file appeared in 281.Nx 1.3 . 282The 283.Sy check_disklabels 284functionality was added in 285.Nx 1.4 . 286The 287.Sy backup_uses_rcs 288and 289.Sy check_pkgs 290features were added in 291.Nx 1.6 . 292.Sy diff_options 293appeared in 294.Nx 2.0 ; 295prior to that, traditional-format (context free) diffs were generated. 296