.\"	$NetBSD: security.conf.5,v 1.16 2001/10/15 08:53:28 lukem Exp $
.\"
.\" Copyright (c) 1996 Matthew R. Green
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\" 3. The name of the author may not be used to endorse or promote products
.\"    derived from this software without specific prior written permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
.\" AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
.\" OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.Dd October 15, 2001
.Dt SECURITY.CONF 5
.Os
.Sh NAME
.Nm security.conf
.Nd daily security check configuration file
.Sh DESCRIPTION
The
.Nm
file specifies which of the standard
.Pa /etc/security
services are performed.  The
.Pa /etc/security
script is run, by default, every night from
.Pa /etc/daily ,
on a
.Nx
system, if configured do to so from
.Pa /etc/daily.conf .
.Pp
The variables described below can be set to "NO" to disable the test:
.Bl -tag -width check_network
.It Sy check_passwd
This checks the
.Pa /etc/master.passwd
file for inconsistancies.
.It Sy check_group
This checks the
.Pa /etc/group
file for inconsistancies.
.It Sy check_rootdotfiles
This checks the root users startup files for sane settings of $PATH
and umask.  This test is not fail safe and any warning generated from
this should be checked for correctness.
.It Sy check_ftpusers
This checks that the correct users are in the
.Pa /etc/ftpusers
file.
.It Sy check_aliases
This checks for security problems in the
.Pa /etc/mail/aliases
file.
For backward compatibility,
.Pa /etc/aliases
will be checked as well if exists.
.It Sy check_rhosts
This checks for system and user rhosts files with "+" in them.
.It Sy check_homes
This checks that home directories are owned by the correct user,
and have appropriate permissions.
.It Sy check_varmail
This checks that the correct user owns mail in
.Pa /var/mail ,
and that the mail box has the right permissions.
.It Sy check_nfs
This checks that the
.Pa /etc/exports
file does not export filesystems to the world.
.It Sy check_devices
This checks for changes to devices and setuid files.
.It Sy check_mtree
This runs
.Xr mtree 8
to ensure that the system is installed correctly.
The following configuration files are checked:
.Bl -tag -width 4n
.It Pa /etc/mtree/special
Default files to check.
.It Pa /etc/mtree/special.local
Local site additions.
.It Pa /etc/mtree/DIR.secure
Specification for the directory
.Pa DIR .
.El
.It Sy check_disklabels
Backup text copies of the disklabels of available disk drives into
.Pa /var/backups/work/disklabel.XXX ,
and display any differences in those and the previous copies
as per
.Sy check_changelist
below.
If
.Xr fdisk 8
is available on the current platform, the output of
.Pa /sbin/fdisk
for each available disk drive is stored in
.Pa /var/backups/work/fdisk.XXX ,
and any differences displayed as per the disklabels.
.It Sy check_pkgs
This stores a list of all installed pkgs into
.Pa /var/backups/work/pkgs
and checks it for any changes.
.It Sy check_changelist
This determines a list of files from the contents of
.Pa /etc/changelist ,
and the output of
.Ic mtree -D
for
.Pa /etc/mtree/special
and
.Pa /etc/mtree/special.local .
For each file in the list it compares the files with their backups in
.Pa /var/backups/file.current
and
.Pa /var/backups/file.backup ,
and displays any differences found.
The following
.Xr mtree 8
.Sy tags
modify how files are determined from
.Pa /etc/mtree/special
and
.Pa /etc/mtree/special.local :
.Bl -tag -width exclude -offset indent
.It exclude
The entry is ignored; no backups are made and the differences are not
displayed.
This includes dynamic or binary files such as
.Pa /var/run/utmp .
.It nodiff
The entry is backed up but the differences are not displayed because
the contents of the file are sensitive.
This includes files such as
.Pa /etc/master.passwd .
.El
.El
.Pp
The variables described below can be set to modify the tests:
.Bl -tag -width check_network
.It Sy max_grouplen
If
.Sy check_group
is enabled, this determines the maximum permitted length of group names.
.It Sy max_loginlen
If
.Sy check_passwd
is enabled, this determines the maximum permitted length of login names.
.It Sy backup_dir
Change the backup directory from
.Pa /var/backup .
.It Sy pkgdb_dir
Change the pkg database directory from
.Pa /var/db/pkg
when
.Sy check_pkgs
is enabled.
.It Sy backup_uses_rcs
Use
.Xr rcs 1
for maintaining backup copies of files noted in
.Sy check_devices ,
.Sy check_disklabels ,
.Sy check_pkgs ,
and
.Sy check_changelist
instead of just keeping a current copy and a backup copy.
.El
.Sh FILES
.Bl -tag -width /etc/security.local -compact
.It Pa /etc/security
daily security check script
.It Pa /etc/security.conf
daily security check configuration
.It Pa /etc/security.local
local site additions to
.Pa /etc/security
.El
.Sh SEE ALSO
.Xr daily.conf 5
.Sh HISTORY
The
.Nm
file appeared in
.Nx 1.3 .
The
.Sy check_disklabels
functionality was added in
.Nx 1.4 .
The
.Sy backup_uses_rcs
and
.Sy check_pkgs
features were added in
.Nx 1.6 .