summaryrefslogtreecommitdiff
path: root/etc/security
AgeCommit message (Collapse)Author
2003-11-19Provide a workaround for PR bin/12900.jhawk
When /dev is an fdesc, and /dev/tty is stat()ed without a controlling tty, a "Device not configured" error is returned. Filter mtree's stderr to ignore this error. If fdesc is fixed to not behave in this fashion, this workaround can be removed; bin/12900 should remain open until that time.
2003-11-18In check_varmail (mailbox ownership/permissions check):jhawk
Make ls -A explicit, to help n debugging when not run as root (-A is implied when ls is run as root) Ignore dotfiles, as they are not mailboxes (e.g. .jhawk.pop)
2003-11-18XXX: note pairwise cascaded test inversion in permit_star.jhawk
Add checkyesno check_homes_permit_usergroups to allow group writability when the groupname matches the username. Defaults to off.
2003-10-01Suppress output when running security.local if it produces no output.jhawk
/etc/security should produce no output (and thus suppress the report) when nothing is wrong. While we're here, use printf instead of two echos, like the rest of the script.
2003-02-21Use $diff_options when running diff in /etc/security.jhawk
Default diff_options to -u, for unified-format context diffs, because context is essential to a useful evaluation of differences. This represents a behavior change. Implements change-request PR security/17247 from Takahiro Kambe <taca@sky.yamashina.kyoto.jp>.
2003-02-13Under check_mtree, invoke mtree with -L if check_mtree_follow_symlinks is set.jhawk
Apparently mtree -L is imperfect, but it is far better than the lack thereof if symlinks are involved reaching files mtree verifies.
2003-02-13Add some flexibility to /etc/security, by way of security.conf options:jhawk
check_passwd_nowarn_shells Don't warn about these non-/etc/shells shells check_passwd_nowarn_users Don't warn about these users check_passwd_permit_star Don't warn about "*" in the $2 field Behavior change: check_passwd_nowarn_shells defaults to /sbin/nologin and /usr/libexec/uucp/uucico, so that it will not warn about the default master.passwd. The rationale here is that an administrator who chooses to permit these warnable conditions should not be warned about them day after day, yet should not be forced to disable check_passwd entirely. check_passwd_permit_star is primarily of interest to sites who use *'d entries for Kerberos or ssh logins, despite the fact that we permit "*ssh" (etc.) for this purpose (legacy).
2003-01-06writable, not writeable.wiz
2002-08-20Added .k5login to the list of files that are checked in each user'selric
home directory. Addresses PR: security/18000
2002-06-18md5/bcrypt password starts with $[12], so use ^ in regexitojun
2002-06-18recognize md5/bcrypt password. noted by: Eric Jacoboni <jaco@teaser.fr>itojun
2002-06-10The check_rootdotfiles section mucks with the PATH setting, butatatat
never puts it back properly. As such, jobs run later that expect there to be a path will lose badly (eg, run lintpkgsrc -i from security.local). Let's just re-export the PATH.
2002-05-21Support shell metacharacters (`*', '?', '[') in /etc/changelist lines,lukem
including checks for "backups that exist when actual file is deleted", a la the existing mechanism used for "/etc/ifconfig.*" ... "/etc/rc.d/*" checks. This resolves [security/15798] from Bob Kemp <bob@allegory.demon.co.uk>.
2001-12-18Add nullfs to the list of file system types to skip during the "big finds".lukem
Fix from Alan Barrett in [misc/14957].
2001-11-09remove blank lines from the lists of files to backup_and_difflukem
2001-10-18add -dgq to check_pkgs ls(1). suggested by @@@lukem
2001-10-18Add -T option to ls(1) when -l option is specified.taca
This fixes none-changed files under ${backup_dir}/pkgs as bellow: ====== /var/backups/pkgs diffs (OLD < > NEW) ====== 159c159 < -rw-r--r-- 1 root wheel 528 Apr 19 01:11 ja-less-332/+CONTENTS --- > -rw-r--r-- 1 root wheel 528 Apr 19 2001 ja-less-332/+CONTENTS
2001-10-15Use "nodiff" instead of "nomail" for the tag which is used to excludelukem
files from having the changes diff generated. Suggested by Michael Graff.
2001-10-14minor optimisation suggested by christoslukem
2001-10-13A few more changes, from more discussions with Andrew Brown.lukem
- Resurrect /etc/changelist, even if it's an "empty" file by default, because it's easier to use than /etc/mtree/special.local for adding a couple of simple files. Back by popular demand (hi @@@! :-) - Add /etc/rc.d/* to the list of "dynamic" files; this notices changes in user-added scripts - Only calculate the mtree -I nomail list once, and re-use - Use "cat foo | while read file" instead of "for file in `cat foo`" ; handles whitespace better...
2001-10-12Major overhaul, with help from Andrew Brown <atatat@netbsd.org>.lukem
Features: - Add a bunch of stuff to /etc/mtree/special to enable removal of /etc/changelist: - files which we want to monitor for changes but don't want to see the diffs of (master.passwd, ssh_host_key, ...) are tagged with "nomail" - files which we don't want to monitor are tagged with "exclude" (such as netgroup.db, kvm.db, ...) - monitor /etc/mtree/special.local, /root/.ssh/* - remove /etc/changelist, and a bunch of XXX comments - use mtree(8)'s -D, -I, and -E to generate lists of files to actually do the changelist stuff on. - support /etc/mtree/special.local as an optional user-provided version of /etc/mtree/special (effectively, an enhanced /etc/changelist) - Add code to monitor: /etc/ifconfig.* /etc/raid*.conf /etc/rc.conf.d/* including support for these files being added and removed at will. - If /sbin/fdisk exists, backup the output of "fdisk $disk" for all the active disk drives as part of $check_disklabels - Check permissions on: ~/.ssh/* ~/.shosts Details: - Reorder initialisation of defaults - Remove special case for /etc/master.passwd "monitor but don't email diffs" with general case for other similar files. - Keep all `autogenerated' files (such as disklabel.*, setuid.current, ...) in "$backup_dir/work", to minimise name clashes. - Add migrate_file(old, new) to do the hard work of migrating files from the old `top level' /var/backups mechanism to the `full path' mechanism recently added. Use this appropriately. - Add backup_and_diff(file, printdiffs), to the hard work of backing-up and diff-ing files. - Cleanup use of shell redirects - /bin/sh supports ~root globbing, so use it. - Improve umask checking; use awk regex rather than awk math
2001-10-05minor whitespace fixlukem
2001-10-03replace "pkg_dbdir" with "pkgdb_dir", to be consistent with "backup_dir"lukem
2001-10-03Since we store the output of ls for use later, make sure that we have TZ=UTC.cjs
(Otherwise time zone changes cause us to believe that files have changed when they have not.)
2001-10-03- clean up a couple of commentslukem
- reformat some awk blocks - replace "sed 1d | awk '...'" with "awk 'NR==1 {next;} ...'"
2001-10-01Add a chunk of code to check the installed pkgs list by making a listatatat
of all installed pkgs and their +CONTENTS and +REQUIRED_BY files (if they have one) and handling this file along with all the other CHANGELIST stuff. Greg Woods gets points for coming up with the idea. Luke Mewburn asked me to do it, and provided lots of criticism along the way.
2001-09-24remove acd (non existant), add ld (for hw raid logical drives)lukem
2001-09-23add raid, remove cd drives and floppy drives from the nightly diskperry
permissions checks. note: This whole thing needs to be rototilled. And yes, I'm volunteering to do it.
2001-09-23Update the password sanity checking thusly:perry
1) If a password entry is of the form \*[A-z-]+, do not complain that the account is off but has a valid password. Thus you can do passwords like *ssh to indicate ssh only logins. We should come up with a standard scheme for what various *keywords mean. Note that if the field length is 13, 20 or 34 you'll still get bitched at. This code should be cleaned up. (So should the password scheme.) 2) If the entry is for "toor", don't complain that the account is off but has a valid shell. We ship with toor:*:, there is no point in complaining about it. Part of the campaign against spurious security warning output.
2001-09-22run mtree on the special file using the new -l option, so it will notperry
complain about things like files set 444 instead of 644. part of the campaign against spurious output in the nightly security run.
2001-08-26Remove rz/tz support for pmax, switch to MI SCSI.simonb
2001-06-18use mktemp(1) to create temporary directories, and ensure that cleanup trapslukem
are setup asap.
2001-06-14use symbolic signal names instead of numberslukem
2001-05-10When backing files listed in /etc/changelist, instead of truncatingatatat
to the basename of the file, use the whole path with $backup_dir prepended, in effect mirrorring the directory tree. This eliminates the possibility of a name collision. Closes pr bin/12727.
2001-05-10Allow embedded hyphens in user names (and group names), just not as theatatat
first or last character.
2001-04-04Provide the capability of storing backups via RCS instead of just aatatat
"current" and a "last" (which is useless if you wanna know what you changed last week). Set the default to on.
2001-03-15Run skeyaudit (only) from /etc/daily instead of /etc/security, else there'shubertf
some risk that the users don't get warned if an admin turns off running /etc/security (by putting run_security=no into daily.conf). Fixes PR 12267.
2001-03-12Allow md5 passwords of length 34 as passwordsatatat
2001-02-11Introduce max_grouplen - this determines the maximum permitted lengthjdolecek
of group names, similarily to max_loginlen
2001-01-09Add a new variable 'backup_dir', which can be used to change the backupabs
directory from /var/backup (useful for those of us who have a separate /var and would like to have our backup disklabels on the root filesystem). Default behaviour unchanged. backup_dir being unset is taken as /var/backup.
2000-10-07use ${foo##*/} instead of `basename $foo`. as suggested (with minor variation)lukem
by Toru Nishimura <nisimura@itc.aist-nara.ac.jp>
2000-09-10PR/10982: kilbi@rad.rwth-aachen.de: Don't confuse printf with usernameschristos
that start with -.
2000-07-02Fix pr9320: improve umask checking for root's dotfiles.sommerfeld
Now even notices bogus umasks like 044
2000-05-26We may as well allow local additions to /etc/security, since it gets donead
for the other periodic checks.
2000-05-05check /etc/mail/aliases on check_aliases.itojun
/etc/aliases will be checked as well, if exists (for backward compatibility).
2000-04-24Add skeyaudit to /etc/security (with a variable to disable) per PR 5871fair
2000-01-15Use cat -f to avoid denial of service attacks by people who make .rhostschristos
files fifos.
1999-09-05We already had logic not to try to grab the disklabels of md's andperry
fd's -- add cd's to the list.
1999-07-22Use standard variable "$0" for the whole line instead of the non-standard,hubertf
undocumented "$LINE". Submitted in PR 7041 by Greg A. Woods <woods@weird.com>
1999-04-23Get rid of old-style chown operands.kleink