1.\" $NetBSD: security.conf.5,v 1.15 2001/10/01 03:02:34 atatat Exp $ 2.\" 3.\" Copyright (c) 1996 Matthew R. Green 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. The name of the author may not be used to endorse or promote products 15.\" derived from this software without specific prior written permission. 16.\" 17.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 22.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 23.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 24.\" AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 25.\" OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27.\" SUCH DAMAGE. 28.\" 29.Dd September 30, 2001 30.Dt SECURITY.CONF 5 31.Os 32.Sh NAME 33.Nm security.conf 34.Nd daily security check configuration file 35.Sh DESCRIPTION 36The 37.Nm 38file specifies which of the standard 39.Pa /etc/security 40services are performed. The 41.Pa /etc/security 42script is run, by default, every night from 43.Pa /etc/daily , 44on a 45.Nx 46system, if configured do to so from 47.Pa /etc/daily.conf . 48.Pp 49The variables described below can be set to "NO" to disable the test: 50.Bl -tag -width check_network 51.It Sy check_passwd 52This checks the 53.Pa /etc/master.passwd 54file for inconsistancies. 55.It Sy check_group 56This checks the 57.Pa /etc/group 58file for inconsistancies. 59.It Sy check_rootdotfiles 60This checks the root users startup files for sane settings of $PATH 61and umask. This test is not fail safe and any warning generated from 62this should be checked for correctness. 63.It Sy check_ftpusers 64This checks that the correct users are in the 65.Pa /etc/ftpusers 66file. 67.It Sy check_aliases 68This checks for security problems in the 69.Pa /etc/mail/aliases 70file. 71For backward compatibility, 72.Pa /etc/aliases 73will be checked as well if exists. 74.It Sy check_rhosts 75This checks for system and user rhosts files with "+" in them. 76.It Sy check_homes 77This checks that home directories are owned by the correct user. 78.It Sy check_varmail 79This checks that the correct user owns mail in 80.Pa /var/mail , 81and that the mail box has the right permissions. 82.It Sy check_nfs 83This checks that the 84.Pa /etc/exports 85file does not export filesystems to the world. 86.It Sy check_devices 87This checks for changes to devices and setuid files. 88.It Sy check_mtree 89This runs 90.Xr mtree 8 91to ensure that the system is installed correctly. 92.It Sy check_disklabels 93Backup text copies of the disklabels of available disk drives into 94.Pa /var/backups/disklabel.XXX , 95and display any differences in those and the previous copies 96as per 97.Sy check_changelist 98below. 99.It Sy check_pkgs 100This stores a list of all installed pkgs into 101.Pa /var/backups/pkgs 102and checks it for any changes. 103.It Sy check_changelist 104This updates the list of files in 105.Pa /etc/changelist 106and their backups in 107.Pa /var/backups/file.current 108and 109.Pa /var/backups/file.backup , 110and displays any differences found. 111.El 112.Pp 113The variables described below can be set to modify the tests: 114.Bl -tag -width check_network 115.It Sy max_grouplen 116If 117.Sy check_group 118is enabled, this determines the maximum permitted length of group names. 119.It Sy max_loginlen 120If 121.Sy check_passwd 122is enabled, this determines the maximum permitted length of login names. 123.It Sy backup_dir 124Change the backup directory from 125.Pa /var/backup . 126.It Sy pkg_dbdir 127Change the pkg database directory from 128.Pa /var/db/pkg 129when 130.Sy check_pkgs 131is enabled. 132.It Sy backup_uses_rcs 133Use 134.Xr rcs 1 135for maintaining backup copies of files noted in 136.Sy check_devices , 137.Sy check_disklabels , 138.Sy check_pkgs , 139and 140.Sy check_changelist 141instead of just keeping a current copy and a backup copy. 142.El 143.Sh FILES 144.Bl -tag -width /etc/security.local -compact 145.It Pa /etc/security 146daily security check script 147.It Pa /etc/security.conf 148daily security check configuration 149.It Pa /etc/security.local 150local site additions to 151.Pa /etc/security 152.El 153.Sh SEE ALSO 154.Xr daily.conf 5 155.Sh HISTORY 156The 157.Nm 158file appeared in 159.Nx 1.3 . 160The 161.Sy check_disklabels 162functionality was added in 163.Nx 1.4 . 164The 165.Sy backup_uses_rcs 166and 167.Sy check_pkgs 168features were added in 169.Nx 1.6 . 170