1.\" $NetBSD: security.conf.5,v 1.4 1998/08/25 13:50:45 lukem Exp $ 2.\" 3.\" Copyright (c) 1996 Matthew R. Green 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. The name of the author may not be used to endorse or promote products 15.\" derived from this software without specific prior written permission. 16.\" 17.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 22.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 23.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 24.\" AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 25.\" OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27.\" SUCH DAMAGE. 28.\" 29.Dd August 25, 1998 30.Dt SECURITY.CONF 5 31.Os NetBSD 1.3 32.Sh NAME 33.Nm security.conf 34.Nd daily security check configuration file 35.Sh DESCRIPTION 36The 37.Nm 38file specifies which of the standard 39.Pa /etc/security 40services are performed. The 41.Pa /etc/security 42script is run, by default, every night from 43.Pa /etc/daily , 44on a 45.Nx 46system, if configured do to so from 47.Pa /etc/daily.conf . 48.Pp 49The variables described below can be set to "NO" to disable the test: 50.Bl -tag -width check_network 51.It Sy check_passwd 52This checks the 53.Pa /etc/master.passwd 54file for inconsistancies. 55.It Sy check_group 56This checks the 57.Pa /etc/group 58file for inconsistancies. 59.It Sy check_rootdotfiles 60This checks the root users startup files for sane settings of $PATH 61and umask. This test is not fail safe and any warning generated from 62this should be checked for correctness. 63.It Sy check_ftpusers 64This checks that the correct users are in the 65.Pa /etc/ftpusers 66file. 67.It Sy check_aliases 68This checks for security problems in the 69.Pa /etc/aliases 70file. 71.It Sy check_rhosts 72This checks for system and user rhosts files with "+" in them. 73.It Sy check_homes 74This checks that home directories are owned by the correct user. 75.It Sy check_varmail 76This checks that the correct user owns mail in 77.Pa /var/mail , 78and that the mail box has the right permissions. 79.It Sy check_nfs 80This checks that the 81.Pa /etc/exports 82file does not export filesystems to the world. 83.It Sy check_devices 84This checks for changes to devices and setuid files. 85.It Sy check_mtree 86This runs 87.Xr mtree 8 88to ensure that the system is installed correctly. 89.It Sy check_disklabels 90Backup text copies of the disklabels of available disk drives into 91.Pa /var/backups/disklabel.XXX , 92and display any differences in those and the previous copies 93as per 94.Sy check_changelist 95below. 96.It Sy check_changelist 97This updates the list of files in 98.Pa /etc/changelist 99and their backups in 100.Pa /var/backups/file.current 101and 102.Pa /var/backups/file.backup , 103and displays any differences found. 104.El 105.Pp 106.Sh FILES 107.Pa /etc/security 108.Pa /etc/security.conf 109.Sh SEE ALSO 110.Xr daily.conf 5 111.Sh HISTORY 112The 113.Nm 114file appeared in 115.Nx 1.3 . 116The 117.Sy check_disklabels 118functionality was added in 119.Nx 1.4 . 120