Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
69,690 Commits 606 Branches 0 Tags 3.1 GiB
23bf98f535
Commit Graph

46 Commits

Author SHA1 Message Date
christos
b4266bbcb7 PR/10982: kilbi@rad.rwth-aachen.de: Don't confuse printf with usernames 
that start with -.
 2000-09-10 21:27:50 +00:00
sommerfeld
9928e1fe95 Fix pr9320: improve umask checking for root's dotfiles. 
Now even notices bogus umasks like 044
 2000-07-02 22:27:47 +00:00
ad
fb3a33ff99 We may as well allow local additions to /etc/security, since it gets done 
for the other periodic checks.
 2000-05-26 17:08:21 +00:00
itojun
13c8f7a2df check /etc/mail/aliases on check_aliases. 
/etc/aliases will be checked as well, if exists (for backward compatibility).
 2000-05-05 18:28:53 +00:00
fair
065c791de8 Add skeyaudit to /etc/security (with a variable to disable) per PR 5871 2000-04-24 23:46:37 +00:00
christos
e597a72d0b Use cat -f to avoid denial of service attacks by people who make .rhosts 
files fifos.
 2000-01-15 01:15:12 +00:00
perry
4220708c27 We already had logic not to try to grab the disklabels of md's and 
fd's -- add cd's to the list.
 1999-09-05 15:11:42 +00:00
hubertf
8b10c79f68 Use standard variable "$0" for the whole line instead of the non-standard, 
undocumented "$LINE".

Submitted in PR 7041 by Greg A. Woods <woods@weird.com>
 1999-07-22 00:47:50 +00:00
kleink
357a0baaf8 Get rid of old-style chown operands. 1999-04-23 08:20:28 +00:00
wrstuden
ee6f8c2579 Add a commented-out duplicate id checker which doesn't exclude toor, and 
add a comment saying how to switch it on.
 1999-03-17 19:11:05 +00:00
wrstuden
d32be9a273 Modify duplicate user id check to exclude "toor". Any other uid 0 
accounts will generate a message with that (those) account names, root, and
toor present in the list.
 1999-03-17 02:58:11 +00:00
fair
7153b55a87 Fix PR 5068 - scanning ~user/.rhosts files on NFS mounted home 
directories with -maproot=nobody on the server. The argument to be
made is that if NetBSD's root can't read these files, it shouldn't
try to check them.
 1999-03-16 06:18:17 +00:00
abs
dade5b2993 Handle + in master.passwd (From PR#4802). 
Also, handle + in group and allow max_loginlen to be configurable.
 1999-02-18 18:53:32 +00:00
tv
850ab15c3b Nix "Login %s is off but still has a valid shell" warning for 20-character 
encrypted passwords generated by the NEWSALT option to passwd(1).
 1998-09-14 19:42:42 +00:00
lukem
3a3b03bdd7 * if $check_disklabels=YES, backup and compare of disklabels of current disks. 
should detect added or removed disks as well. backup labels go in
  /var/backups/disklabel.XXX (XXX = disk name, e.g., sd0), and the
  changelist style backups have .current or .backup suffixes
* minor whitespace, formatting, and comment cleanup
 1998-08-25 13:47:29 +00:00
lukem
8f59ce8e35 include rc.subr and use appropriately 1998-01-26 12:02:43 +00:00
mycroft
dae4e5df82 Deal with files in the changelist that are added or removed. 
* When a file is removed, move its .current file to .backup.
* When a file is added, create its .current file.
* In either case, send a diff against /dev/null.
Mostly from Jim Bernard in PR 4183, with the removal case fixed.
 1997-10-08 16:13:44 +00:00
lukem
90ec96df78 - use 'ftpd -C user' to check the format of /etc/ftpusers. 
closes [security/4061]
- rename $MPPATH to $MPBYPATH, to clarify its use
 1997-09-23 14:36:56 +00:00
lukem
f09b5e36c7 - don't print "Checking setuid files and devices:" if no problems 
found (solves [security/4047])
- minor cleanup (rename a couple of variables, etc)
 1997-09-18 05:16:19 +00:00
lukem
89fa41e9da - correct use of generated temporary files. 
- clean up comments and generated output.
- clean up $SECUREDIR if SIGINT or SIGQUIT received.
- .rhosts may have to be world readable in NFS environments, so allow it to be.
- update list of disks to check for reasonable permissions
- don't show differences in /etc/master.passwd, as the encrypted strings may
  be sent. From reading comments earlier in the script, this was the intention
  anyway. Fix from Jim Bernard <jbernard@tater.mines.edu> in [security/3994].
- when checking /etc/ftpusers, skip comment lines and only match full
  usernames.
  XXX: this should be enhanced to check lines of the enhanced ftpusers format.
 1997-08-22 09:40:17 +00:00
lukem
0f26a04544 * ensure that check for '.' in root's $PATH doesn't yield a false positive. 
fix from Jim Bernard <jbernard@tater.mines.edu> in [security/3995]
* detect empty :: elements as '.' in a sh(1) path (leading :, trailing :,
  or ::)
 1997-08-19 12:08:35 +00:00
lukem
fb34424eb0 * when checking /etc/master.passwd, read in /etc/shells for a list of 
valid shells and then check each active account against that
* remove unnecessary ()s in a few printf's.
 1997-06-24 02:32:38 +00:00
lukem
ff2ea5d139 * take advantage of xargs -0 when finding devices and set?id files 
* use 'ls -q' in the above, so that characters that may cause problems
  in the output are replaced with '?'
 1997-06-24 01:16:47 +00:00
lukem
d0b6172bfe Also check /etc/profile for setting of umask. 
From Chris Jones <cjones@rupert.oscs.montana.edu> in [misc/3763]
 1997-06-23 11:59:30 +00:00
lukem
b07aea8e1c Ignore blank lines and comments in /etc/exports 
From Jaromir Dolecek <dolecek@moria.ics.muni.cz> in [misc/3691]
 1997-06-23 01:49:15 +00:00
mycroft
d8dcc6580c Don't list directories with the setuid bit set or FIFOs. 1997-04-21 17:38:39 +00:00
mycroft
df1a64b9f5 Minor cleanup. 1997-04-21 11:19:57 +00:00
mycroft
4a0848acd9 When doing security checks in user home directory, sort by home directory, to 
optimize lookups a little.
Also, add some more files to the naughty lists.
 1997-04-21 11:14:41 +00:00
mikel
cae2f3b253 make /etc/aliases check a bit more discriminating: the line must be 
uncommented, and it must contain a '|' character (forwarding to program).
 1997-04-17 07:42:07 +00:00
mycroft
814cb67087 Minor cleanup. 1997-03-10 09:45:58 +00:00
mikel
5b5eddafe2 Don't leave logs in /etc/mtree; from Andrew Wheadon in PR misc/3106. 
Also fixed some comments.
 1997-02-14 08:52:05 +00:00
mrg
a9efb63860 add configuration file for security, as security.conf. 
the file allows each action taken by security to be
turned on or off.
 1997-01-05 11:46:12 +00:00
mrg
2bc04b57a8 ignore setgid on dirs. 1996-05-22 00:51:08 +00:00
pk
1377ee0906 Several fixes from Arne H. Juul (PR#1814). 1996-01-14 00:58:25 +00:00
thorpej
0763a85671 New-style RCS ids. 1995-12-17 02:01:10 +00:00
jtc
62b86c41b9 Change .emacsrc to .emacs in list of files to be checked. 
From Mike Long, in PR #768.
 1995-01-31 16:09:45 +00:00
mycroft
3df08b7f25 Fix the fstype-based pruning algorithms. Partly suggested by John Kohl. 1994-10-18 16:52:56 +00:00
cgd
91778fe0ca update to new security script 1994-06-15 04:28:06 +00:00
cgd
7e3b99ee2b people importing trees from SunOS should be shot; add -d to ls. 1994-01-15 18:32:06 +00:00
mycroft
cb4c5af110 Find only set[gu]id files and devices, like old ncheck(1). 1993-12-15 07:07:36 +00:00
cgd
2d1f5986f3 use of xargs wasn't strictly a security hole, but could lead to fouled- 
up results.  xargs should really have an option to automatically
'quote' input.
 1993-10-27 16:59:13 +00:00
mycroft
8b6b8bad1e Use xargs(1) to avoid overflowing the argument list to ls(1). 1993-10-27 09:54:31 +00:00
cgd
8379ac2852 from FreeBSD: check for set*id devices in a way closer to the original. 
note that you can still overflow the args buffer for the ls (and it does
that on lamp), but it's better than before.
 1993-10-26 01:38:57 +00:00
mycroft
74ccbe814f Rewrite set[gu]id find command to avoid walking non-local file systems. 1993-10-19 06:13:08 +00:00
cgd
1c2ae9dcc3 updated to reflect the fact that we don't have an ncheck 1993-04-02 08:00:48 +00:00
cgd
61f282557f initial import of 386bsd-0.1 sources 1993-03-21 09:45:37 +00:00