1.\" $NetBSD: security.conf.5,v 1.40 2013/11/06 19:37:06 spz Exp $ 2.\" 3.\" Copyright (c) 1996 Matthew R. Green 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 15.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 19.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 20.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 21.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 22.\" AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 23.\" OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25.\" SUCH DAMAGE. 26.\" 27.Dd April 5, 2012 28.Dt SECURITY.CONF 5 29.Os 30.Sh NAME 31.Nm security.conf 32.Nd daily security check configuration file 33.Sh DESCRIPTION 34The 35.Nm 36file specifies which of the standard 37.Pa /etc/security 38services are performed. 39The 40.Pa /etc/security 41script is run, by default, every night from 42.Pa /etc/daily , 43on a 44.Nx 45system, if configured do to so from 46.Pa /etc/daily.conf . 47.Pp 48The variables described below can be set to "NO" to disable the test: 49.Bl -tag -width check_pkg_vulnerabilities 50.It Sy check_passwd 51This checks the 52.Pa /etc/master.passwd 53file for inconsistencies. 54.It Sy check_group 55This checks the 56.Pa /etc/group 57file for inconsistencies. 58.It Sy check_rootdotfiles 59This checks the root users startup files for sane settings of $PATH 60and umask. 61This test is not fail safe and any warning generated from 62this should be checked for correctness. 63.It Sy check_ftpusers 64This checks that the correct users are in the 65.Pa /etc/ftpusers 66file. 67.It Sy check_aliases 68This checks for security problems in the 69.Pa /etc/mail/aliases 70file. 71For backward compatibility, 72.Pa /etc/aliases 73will be checked as well if exists. 74.It Sy check_rhosts 75This checks for system and user rhosts files with "+" in them. 76.It Sy check_homes 77This checks that home directories are owned by the correct user, 78and have appropriate permissions. 79.It Sy check_varmail 80This checks that the correct user owns mail in 81.Pa /var/mail , 82and that the mail box has the right permissions. 83.It Sy check_nfs 84This checks that the 85.Pa /etc/exports 86file does not export filesystems to the world. 87.It Sy check_devices 88This checks for changes to devices and setuid files. 89.It Sy check_mtree 90This runs 91.Xr mtree 8 92to ensure that the system is installed correctly. 93The following configuration files are checked: 94.Bl -tag -width 4n 95.It Pa /etc/mtree/special 96Default files to check. 97.It Pa /etc/mtree/special.local 98Local site additions and overrides. 99.It Pa /etc/mtree/DIR.secure 100Specification for the directory 101.Pa DIR . 102.El 103.It Sy check_disklabels 104Backup text copies of the disklabels of available disk drives into 105.Pa /var/backups/work/disklabel.XXX , 106and display any differences in those and the previous copies 107as per 108.Sy check_changelist 109below. 110If 111.Xr fdisk 8 112is available on the current platform, the output of 113.Pa /sbin/fdisk 114for each available disk drive is stored in 115.Pa /var/backups/work/fdisk.XXX , 116and any differences displayed as per the disklabels. 117.It Sy check_pkgs 118This stores a list of all installed pkgs into 119.Pa /var/backups/work/pkgs 120and checks it for any changes. 121.It Sy check_changelist 122This determines a list of files from the contents of 123.Pa /etc/changelist , 124and the output of 125.Ic mtree -D 126for 127.Pa /etc/mtree/special 128and 129.Pa /etc/mtree/special.local . 130For each file in the list it compares the files with their backups in 131.Pa /var/backups/file.current 132and 133.Pa /var/backups/file.backup , 134and displays any differences found. 135The following 136.Xr mtree 8 137.Sy tags 138modify how files are determined from 139.Pa /etc/mtree/special 140and 141.Pa /etc/mtree/special.local : 142.Bl -tag -width exclude -offset indent 143.It exclude 144The entry is ignored; no backups are made and the differences are not 145displayed. 146This includes dynamic or binary files such as 147.Pa /var/run/utmp . 148.It nodiff 149The entry is backed up but the differences are not displayed because 150the contents of the file are sensitive. 151This includes files such as 152.Pa /etc/master.passwd . 153.El 154.It Sy check_pkg_vulnerabilities 155Checks the currently installed packages against a database of known 156vulnerabilities and reports those that are vulnerable. 157Check the 158.Sy fetch_pkg_vulnerabilities 159setting in 160.Xr daily.conf 5 161to keep the database up to date. 162.It Sy check_pkg_signatures 163Checks the digital signature of all files installed by packages against 164the expected values stored in the packages database. 165.El 166.Pp 167The variables described below can be set to modify the tests: 168.Bl -tag -width check_network 169.It Sy check_homes_permit_usergroups 170During the 171.Sy check_homes 172phase, allow the checked files to be group-writable if the group name is 173the same as the username. 174.It Sy check_homes_permit_other_owner 175During the 176.Sy check_homes 177phase, allow the home directory and files of the listed users to be owned 178by a different user. 179.It Sy check_devices_ignore_fstypes 180Lists filesystem types to ignore during the 181.Sy check_devices 182phase. 183Prefixing the type with a 184.Sq \&! 185inverts the match. 186For example, 187.Ql procfs !local 188will ignore 189.Ql procfs 190type filesystems and filesystems that are not 191.Ql local . 192.It Sy check_devices_ignore_paths 193Lists pathnames to ignore during the 194.Sy check_devices 195phase. 196Prefixing the path with a 197.Sq \&! 198inverts the match. 199For example, 200.Ql /tftp 201will ignore paths under 202.Pa /tftp 203while 204.Ql !/home 205will ignore paths that are not under 206.Pa /home . 207.It Sy check_mtree_follow_symlinks 208During the 209.Sy check_mtree 210phase, instruct mtree to follow symbolic links. 211Please note, this may cause the 212.Sy check_mtree 213phase to report errors for entries for these symbolic links (i.e. of 214type=link in the mtree specification) as they will always appear to be plain 215files for the purposes of the check. 216.Pa /etc/mtree/special.local 217may be used to override the checks for the affected links. 218.It Sy check_passwd_nowarn_shells 219If 220.Sy check_passwd 221is enabled, most warnings will be suppressed for entries whose shells 222are listed in this space-separated list. 223This is of particular value when those shells are not in 224.Pa /etc/shells . 225.It Sy check_passwd_nowarn_users 226If 227.Sy check_passwd 228is enabled, suppress warnings for these users. 229.It Sy check_passwd_permit_dups 230If 231.Sy check_passwd 232is enabled, do not warn about duplicate uids for the listed login names. 233.It Sy check_passwd_permit_nonalpha 234If 235.Sy check_passwd 236is enabled, do not warn about login names which use non-alphanumeric 237characters. 238.It Sy check_passwd_permit_star 239If 240.Sy check_passwd 241is enabled, do not warn about password fields set to 242.Dq * . 243Note that the use of password fields such as 244.Dq *ssh 245is encouraged, instead. 246.It Sy max_grouplen 247If 248.Sy check_group 249is enabled, this determines the maximum permitted length of group names. 250.It Sy max_loginlen 251If 252.Sy check_passwd 253is enabled, this determines the maximum permitted length of login names. 254.It Sy backup_dir 255Change the backup directory from 256.Pa /var/backup . 257.It Sy diff_options 258Specify the options passed to 259.Xr diff 1 260when it is invoked to show changes made to system files. 261Defaults to 262.Dq -u , 263for unified-format context-diffs. 264.It Sy pkgdb_dir 265.Em DEPRECATED . 266Please set 267.Dv PKGDB_DIR 268in 269.Xr pkg_install.conf 5 270instead. 271.Pp 272If defined, points to the location of the packages database. 273Defaults to 274.Pa /var/db/pkg . 275.It Sy backup_uses_rcs 276Use 277.Xr rcs 1 278for maintaining backup copies of files noted in 279.Sy check_devices , 280.Sy check_disklabels , 281.Sy check_pkgs , 282and 283.Sy check_changelist 284instead of just keeping a current copy and a backup copy. 285.El 286.Sh FILES 287.Bl -tag -width /etc/defaults/security.conf -compact 288.It Pa /etc/defaults/security.conf 289defaults for /etc/security.conf 290.It Pa /etc/security 291daily security check script 292.It Pa /etc/security.conf 293daily security check configuration 294.It Pa /etc/security.local 295local site additions to 296.Pa /etc/security 297.El 298.Sh SEE ALSO 299.Xr daily.conf 5 300.Sh HISTORY 301The 302.Nm 303file appeared in 304.Nx 1.3 . 305The 306.Sy check_disklabels 307functionality was added in 308.Nx 1.4 . 309The 310.Sy backup_uses_rcs 311and 312.Sy check_pkgs 313features were added in 314.Nx 1.6 . 315.Sy diff_options 316appeared in 317.Nx 2.0 ; 318prior to that, traditional-format (context free) diffs were generated. 319