1.\" $NetBSD: security.conf.5,v 1.37 2010/02/05 17:23:47 wiz Exp $ 2.\" 3.\" Copyright (c) 1996 Matthew R. Green 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 15.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 19.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 20.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 21.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 22.\" AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 23.\" OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25.\" SUCH DAMAGE. 26.\" 27.Dd February 5, 2010 28.Dt SECURITY.CONF 5 29.Os 30.Sh NAME 31.Nm security.conf 32.Nd daily security check configuration file 33.Sh DESCRIPTION 34The 35.Nm 36file specifies which of the standard 37.Pa /etc/security 38services are performed. 39The 40.Pa /etc/security 41script is run, by default, every night from 42.Pa /etc/daily , 43on a 44.Nx 45system, if configured do to so from 46.Pa /etc/daily.conf . 47.Pp 48The variables described below can be set to "NO" to disable the test: 49.Bl -tag -width check_pkg_vulnerabilities 50.It Sy check_passwd 51This checks the 52.Pa /etc/master.passwd 53file for inconsistencies. 54.It Sy check_group 55This checks the 56.Pa /etc/group 57file for inconsistencies. 58.It Sy check_rootdotfiles 59This checks the root users startup files for sane settings of $PATH 60and umask. 61This test is not fail safe and any warning generated from 62this should be checked for correctness. 63.It Sy check_ftpusers 64This checks that the correct users are in the 65.Pa /etc/ftpusers 66file. 67.It Sy check_aliases 68This checks for security problems in the 69.Pa /etc/mail/aliases 70file. 71For backward compatibility, 72.Pa /etc/aliases 73will be checked as well if exists. 74.It Sy check_rhosts 75This checks for system and user rhosts files with "+" in them. 76.It Sy check_homes 77This checks that home directories are owned by the correct user, 78and have appropriate permissions. 79.It Sy check_varmail 80This checks that the correct user owns mail in 81.Pa /var/mail , 82and that the mail box has the right permissions. 83.It Sy check_nfs 84This checks that the 85.Pa /etc/exports 86file does not export filesystems to the world. 87.It Sy check_devices 88This checks for changes to devices and setuid files. 89.It Sy check_mtree 90This runs 91.Xr mtree 8 92to ensure that the system is installed correctly. 93The following configuration files are checked: 94.Bl -tag -width 4n 95.It Pa /etc/mtree/special 96Default files to check. 97.It Pa /etc/mtree/special.local 98Local site additions and overrides. 99.It Pa /etc/mtree/DIR.secure 100Specification for the directory 101.Pa DIR . 102.El 103.It Sy check_disklabels 104Backup text copies of the disklabels of available disk drives into 105.Pa /var/backups/work/disklabel.XXX , 106and display any differences in those and the previous copies 107as per 108.Sy check_changelist 109below. 110If 111.Xr fdisk 8 112is available on the current platform, the output of 113.Pa /sbin/fdisk 114for each available disk drive is stored in 115.Pa /var/backups/work/fdisk.XXX , 116and any differences displayed as per the disklabels. 117.It Sy check_pkgs 118This stores a list of all installed pkgs into 119.Pa /var/backups/work/pkgs 120and checks it for any changes. 121.It Sy check_changelist 122This determines a list of files from the contents of 123.Pa /etc/changelist , 124and the output of 125.Ic mtree -D 126for 127.Pa /etc/mtree/special 128and 129.Pa /etc/mtree/special.local . 130For each file in the list it compares the files with their backups in 131.Pa /var/backups/file.current 132and 133.Pa /var/backups/file.backup , 134and displays any differences found. 135The following 136.Xr mtree 8 137.Sy tags 138modify how files are determined from 139.Pa /etc/mtree/special 140and 141.Pa /etc/mtree/special.local : 142.Bl -tag -width exclude -offset indent 143.It exclude 144The entry is ignored; no backups are made and the differences are not 145displayed. 146This includes dynamic or binary files such as 147.Pa /var/run/utmp . 148.It nodiff 149The entry is backed up but the differences are not displayed because 150the contents of the file are sensitive. 151This includes files such as 152.Pa /etc/master.passwd . 153.El 154.It Sy check_pkg_vulnerabilities 155Checks the currently installed packages against a database of known 156vulnerabilities and reports those that are vulnerable. 157Check the 158.Sy fetch_pkg_vulnerabilities 159setting in 160.Xr daily.conf 5 161to keep the database up to date. 162.It Sy check_pkg_signatures 163Checks the digital signature of all files installed by packages against 164the expected values stored in the packages database. 165.El 166.Pp 167The variables described below can be set to modify the tests: 168.Bl -tag -width check_network 169.It Sy check_homes_permit_usergroups 170During the 171.Sy check_homes 172phase, allow the checked files to be group-writable if the group name is 173the same as the username. 174.It Sy check_devices_ignore_fstypes 175Lists filesystem types to ignore during the 176.Sy check_devices 177phase. 178Prefixing the type with a 179.Sq \&! 180inverts the match. 181For example, 182.Ql procfs !local 183will ignore 184.Ql procfs 185type filesystems and filesystems that are not 186.Ql local . 187.It Sy check_devices_ignore_paths 188Lists pathnames to ignore during the 189.Sy check_devices 190phase. 191Prefixing the path with a 192.Sq \&! 193inverts the match. 194For example, 195.Ql /tftp 196will ignore paths under 197.Pa /tftp 198while 199.Ql !/home 200will ignore paths that are not under 201.Pa /home . 202.It Sy check_mtree_follow_symlinks 203During the 204.Sy check_mtree 205phase, instruct mtree to follow symbolic links. 206Please note, this may cause the 207.Sy check_mtree 208phase to report errors for entries for these symbolic links (i.e. of 209type=link in the mtree specification) as they will always appear to be plain 210files for the purposes of the check. 211.Pa /etc/mtree/special.local 212may be used to override the checks for the affected links. 213.It Sy check_passwd_nowarn_shells 214If 215.Sy check_passwd 216is enabled, most warnings will be suppressed for entries whose shells 217are listed in this space-separated list. 218This is of particular value when those shells are not in 219.Pa /etc/shells . 220.It Sy check_passwd_nowarn_users 221If 222.Sy check_passwd 223is enabled, suppress warnings for these users. 224.It Sy check_passwd_permit_nonalpha 225If 226.Sy check_passwd 227is enabled, do not warn about login names which use non-alphanumeric 228characters. 229.It Sy check_passwd_permit_star 230If 231.Sy check_passwd 232is enabled, do not warn about password fields set to 233.Dq * . 234Note that the use of password fields such as 235.Dq *ssh 236is encouraged, instead. 237.It Sy max_grouplen 238If 239.Sy check_group 240is enabled, this determines the maximum permitted length of group names. 241.It Sy max_loginlen 242If 243.Sy check_passwd 244is enabled, this determines the maximum permitted length of login names. 245.It Sy backup_dir 246Change the backup directory from 247.Pa /var/backup . 248.It Sy diff_options 249Specify the options passed to 250.Xr diff 1 251when it is invoked to show changes made to system files. 252Defaults to 253.Dq -u , 254for unified-format context-diffs. 255.It Sy pkgdb_dir 256.Em DEPRECATED . 257Please set 258.Dv PKGDB_DIR 259in 260.Xr pkg_install.conf 5 261instead. 262.Pp 263If defined, points to the location of the packages database. 264Defaults to 265.Pa /var/db/pkg . 266.It Sy backup_uses_rcs 267Use 268.Xr rcs 1 269for maintaining backup copies of files noted in 270.Sy check_devices , 271.Sy check_disklabels , 272.Sy check_pkgs , 273and 274.Sy check_changelist 275instead of just keeping a current copy and a backup copy. 276.El 277.Sh FILES 278.Bl -tag -width /etc/defaults/security.conf -compact 279.It Pa /etc/defaults/security.conf 280defaults for /etc/security.conf 281.It Pa /etc/security 282daily security check script 283.It Pa /etc/security.conf 284daily security check configuration 285.It Pa /etc/security.local 286local site additions to 287.Pa /etc/security 288.El 289.Sh SEE ALSO 290.Xr daily.conf 5 291.Sh HISTORY 292The 293.Nm 294file appeared in 295.Nx 1.3 . 296The 297.Sy check_disklabels 298functionality was added in 299.Nx 1.4 . 300The 301.Sy backup_uses_rcs 302and 303.Sy check_pkgs 304features were added in 305.Nx 1.6 . 306.Sy diff_options 307appeared in 308.Nx 2.0 ; 309prior to that, traditional-format (context free) diffs were generated. 310