1.\" $NetBSD: security.conf.5,v 1.33 2008/05/29 14:51:25 mrg Exp $ 2.\" 3.\" Copyright (c) 1996 Matthew R. Green 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 15.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 19.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 20.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 21.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 22.\" AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 23.\" OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25.\" SUCH DAMAGE. 26.\" 27.Dd May 29, 2006 28.Dt SECURITY.CONF 5 29.Os 30.Sh NAME 31.Nm security.conf 32.Nd daily security check configuration file 33.Sh DESCRIPTION 34The 35.Nm 36file specifies which of the standard 37.Pa /etc/security 38services are performed. 39The 40.Pa /etc/security 41script is run, by default, every night from 42.Pa /etc/daily , 43on a 44.Nx 45system, if configured do to so from 46.Pa /etc/daily.conf . 47.Pp 48The variables described below can be set to "NO" to disable the test: 49.Bl -tag -width check_network 50.It Sy check_passwd 51This checks the 52.Pa /etc/master.passwd 53file for inconsistencies. 54.It Sy check_group 55This checks the 56.Pa /etc/group 57file for inconsistencies. 58.It Sy check_rootdotfiles 59This checks the root users startup files for sane settings of $PATH 60and umask. 61This test is not fail safe and any warning generated from 62this should be checked for correctness. 63.It Sy check_ftpusers 64This checks that the correct users are in the 65.Pa /etc/ftpusers 66file. 67.It Sy check_aliases 68This checks for security problems in the 69.Pa /etc/mail/aliases 70file. 71For backward compatibility, 72.Pa /etc/aliases 73will be checked as well if exists. 74.It Sy check_rhosts 75This checks for system and user rhosts files with "+" in them. 76.It Sy check_homes 77This checks that home directories are owned by the correct user, 78and have appropriate permissions. 79.It Sy check_varmail 80This checks that the correct user owns mail in 81.Pa /var/mail , 82and that the mail box has the right permissions. 83.It Sy check_nfs 84This checks that the 85.Pa /etc/exports 86file does not export filesystems to the world. 87.It Sy check_devices 88This checks for changes to devices and setuid files. 89.It Sy check_mtree 90This runs 91.Xr mtree 8 92to ensure that the system is installed correctly. 93The following configuration files are checked: 94.Bl -tag -width 4n 95.It Pa /etc/mtree/special 96Default files to check. 97.It Pa /etc/mtree/special.local 98Local site additions and overrides. 99.It Pa /etc/mtree/DIR.secure 100Specification for the directory 101.Pa DIR . 102.El 103.It Sy check_disklabels 104Backup text copies of the disklabels of available disk drives into 105.Pa /var/backups/work/disklabel.XXX , 106and display any differences in those and the previous copies 107as per 108.Sy check_changelist 109below. 110If 111.Xr fdisk 8 112is available on the current platform, the output of 113.Pa /sbin/fdisk 114for each available disk drive is stored in 115.Pa /var/backups/work/fdisk.XXX , 116and any differences displayed as per the disklabels. 117.It Sy check_pkgs 118This stores a list of all installed pkgs into 119.Pa /var/backups/work/pkgs 120and checks it for any changes. 121.It Sy check_changelist 122This determines a list of files from the contents of 123.Pa /etc/changelist , 124and the output of 125.Ic mtree -D 126for 127.Pa /etc/mtree/special 128and 129.Pa /etc/mtree/special.local . 130For each file in the list it compares the files with their backups in 131.Pa /var/backups/file.current 132and 133.Pa /var/backups/file.backup , 134and displays any differences found. 135The following 136.Xr mtree 8 137.Sy tags 138modify how files are determined from 139.Pa /etc/mtree/special 140and 141.Pa /etc/mtree/special.local : 142.Bl -tag -width exclude -offset indent 143.It exclude 144The entry is ignored; no backups are made and the differences are not 145displayed. 146This includes dynamic or binary files such as 147.Pa /var/run/utmp . 148.It nodiff 149The entry is backed up but the differences are not displayed because 150the contents of the file are sensitive. 151This includes files such as 152.Pa /etc/master.passwd . 153.El 154.El 155.Pp 156The variables described below can be set to modify the tests: 157.Bl -tag -width check_network 158.It Sy check_homes_permit_usergroups 159During the 160.Sy check_homes 161phase, allow the checked files to be group-writable if the group name is 162the same as the username. 163.It Sy check_devices_ignore_fstypes 164Lists filesystem types to ignore during the 165.Sy check_devices 166phase. 167Prefixing the type with a 168.Sq \&! 169inverts the match. 170For example, 171.Ql procfs !local 172will ignore 173.Ql procfs 174type filesystems and filesystems that are not 175.Ql local . 176.It Sy check_devices_ignore_paths 177Lists pathnames to ignore during the 178.Sy check_devices 179phase. 180Prefixing the path with a 181.Sq \&! 182inverts the match. 183For example, 184.Ql /tftp 185will ignore paths under 186.Pa /tftp 187while 188.Ql !/home 189will ignore paths that are not under 190.Pa /home . 191.It Sy check_mtree_follow_symlinks 192During the 193.Sy check_mtree 194phase, instruct mtree to follow symbolic links. 195Please note, this may cause the 196.Sy check_mtree 197phase to report errors for entries for these symbolic links (i.e. of 198type=link in the mtree specification) as they will always appear to be plain 199files for the purposes of the check. 200.Pa /etc/mtree/special.local 201may be used to override the checks for the affected links. 202.It Sy check_passwd_nowarn_shells 203If 204.Sy check_passwd 205is enabled, most warnings will be suppressed for entries whose shells 206are listed in this space-separated list. 207This is of particular value when those shells are not in 208.Pa /etc/shells . 209.It Sy check_passwd_nowarn_users 210If 211.Sy check_passwd 212is enabled, suppress warnings for these users. 213.It Sy check_passwd_permit_nonalpha 214If 215.Sy check_passwd 216is enabled, do not warn about login names which use non-alphanumeric 217characters. 218.It Sy check_passwd_permit_star 219If 220.Sy check_passwd 221is enabled, do not warn about password fields set to 222.Dq * . 223Note that the use of password fields such as 224.Dq *ssh 225is encouraged, instead. 226.It Sy max_grouplen 227If 228.Sy check_group 229is enabled, this determines the maximum permitted length of group names. 230.It Sy max_loginlen 231If 232.Sy check_passwd 233is enabled, this determines the maximum permitted length of login names. 234.It Sy backup_dir 235Change the backup directory from 236.Pa /var/backup . 237.It Sy diff_options 238Specify the options passed to 239.Xr diff 1 240when it is invoked to show changes made to system files. 241Defaults to 242.Dq -u , 243for unified-format context-diffs. 244.It Sy pkgdb_dir 245Change the pkg database directory from 246.Pa /var/db/pkg 247when 248.Sy check_pkgs 249is enabled. 250.It Sy backup_uses_rcs 251Use 252.Xr rcs 1 253for maintaining backup copies of files noted in 254.Sy check_devices , 255.Sy check_disklabels , 256.Sy check_pkgs , 257and 258.Sy check_changelist 259instead of just keeping a current copy and a backup copy. 260.El 261.Sh FILES 262.Bl -tag -width /etc/defaults/security.conf -compact 263.It Pa /etc/defaults/security.conf 264defaults for /etc/security.conf 265.It Pa /etc/security 266daily security check script 267.It Pa /etc/security.conf 268daily security check configuration 269.It Pa /etc/security.local 270local site additions to 271.Pa /etc/security 272.El 273.Sh SEE ALSO 274.Xr daily.conf 5 275.Sh HISTORY 276The 277.Nm 278file appeared in 279.Nx 1.3 . 280The 281.Sy check_disklabels 282functionality was added in 283.Nx 1.4 . 284The 285.Sy backup_uses_rcs 286and 287.Sy check_pkgs 288features were added in 289.Nx 1.6 . 290.Sy diff_options 291appeared in 292.Nx 2.0 ; 293prior to that, traditional-format (context free) diffs were generated. 294