1.\" $NetBSD: security.conf.5,v 1.12 2001/03/15 02:23:48 hubertf Exp $ 2.\" 3.\" Copyright (c) 1996 Matthew R. Green 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. The name of the author may not be used to endorse or promote products 15.\" derived from this software without specific prior written permission. 16.\" 17.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 22.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 23.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 24.\" AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 25.\" OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27.\" SUCH DAMAGE. 28.\" 29.Dd August 25, 1998 30.Dt SECURITY.CONF 5 31.Os 32.Sh NAME 33.Nm security.conf 34.Nd daily security check configuration file 35.Sh DESCRIPTION 36The 37.Nm 38file specifies which of the standard 39.Pa /etc/security 40services are performed. The 41.Pa /etc/security 42script is run, by default, every night from 43.Pa /etc/daily , 44on a 45.Nx 46system, if configured do to so from 47.Pa /etc/daily.conf . 48.Pp 49The variables described below can be set to "NO" to disable the test: 50.Bl -tag -width check_network 51.It Sy check_passwd 52This checks the 53.Pa /etc/master.passwd 54file for inconsistancies. 55.It Sy check_group 56This checks the 57.Pa /etc/group 58file for inconsistancies. 59.It Sy check_rootdotfiles 60This checks the root users startup files for sane settings of $PATH 61and umask. This test is not fail safe and any warning generated from 62this should be checked for correctness. 63.It Sy check_ftpusers 64This checks that the correct users are in the 65.Pa /etc/ftpusers 66file. 67.It Sy check_aliases 68This checks for security problems in the 69.Pa /etc/mail/aliases 70file. 71For backward compatibility, 72.Pa /etc/aliases 73will be checked as well if exists. 74.It Sy check_rhosts 75This checks for system and user rhosts files with "+" in them. 76.It Sy check_homes 77This checks that home directories are owned by the correct user. 78.It Sy check_varmail 79This checks that the correct user owns mail in 80.Pa /var/mail , 81and that the mail box has the right permissions. 82.It Sy check_nfs 83This checks that the 84.Pa /etc/exports 85file does not export filesystems to the world. 86.It Sy check_devices 87This checks for changes to devices and setuid files. 88.It Sy check_mtree 89This runs 90.Xr mtree 8 91to ensure that the system is installed correctly. 92.It Sy check_disklabels 93Backup text copies of the disklabels of available disk drives into 94.Pa /var/backups/disklabel.XXX , 95and display any differences in those and the previous copies 96as per 97.Sy check_changelist 98below. 99.It Sy check_changelist 100This updates the list of files in 101.Pa /etc/changelist 102and their backups in 103.Pa /var/backups/file.current 104and 105.Pa /var/backups/file.backup , 106and displays any differences found. 107.El 108.Pp 109The variables described below can be set to modify the tests: 110.Bl -tag -width check_network 111.It Sy max_grouplen 112If 113.Sy check_group 114is enabled, this determines the maximum permitted length of group names. 115.It Sy max_loginlen 116If 117.Sy check_passwd 118is enabled, this determines the maximum permitted length of login names. 119.It Sy backup_dir 120Change the backup directory from 121.Pa /var/backup . 122.El 123.Pp 124.Sh FILES 125.Bl -tag -width /etc/security.local -compact 126.It Pa /etc/security 127daily security check script 128.It Pa /etc/security.conf 129daily security check configuration 130.It Pa /etc/security.local 131local site additions to 132.Pa /etc/security 133.El 134.Sh SEE ALSO 135.Xr daily.conf 5 136.Sh HISTORY 137The 138.Nm 139file appeared in 140.Nx 1.3 . 141The 142.Sy check_disklabels 143functionality was added in 144.Nx 1.4 . 145