NetBSD/etc/defaults/security.conf
jmmv 497b5f8044 Add the fetch_pkg_vulnerabilities option to the daily script to keep the
packages vulnerability database up to date.  This will only fetch the
file from the server if it has changed since the last run.

Add the check_pkg_vulnerabilities and check_pkg_signatures options to the
security script to check that the installed packages are sane.

All of these options are enabled by default but they will only run if
there is, at least, one installed package.
2010-01-19 22:08:11 +00:00

49 lines
1.1 KiB
Plaintext

# $NetBSD: security.conf,v 1.22 2010/01/19 22:08:11 jmmv Exp $
#
# /etc/defaults/security.conf --
# default configuration of /etc/security.conf
#
# see security.conf(5) for more information.
#
# DO NOT EDIT THIS FILE DIRECTLY; IT MAY BE REPLACED DURING A SYSTEM UPGRADE.
# EDIT /etc/security.conf INSTEAD.
#
check_passwd=YES
check_group=YES
check_rootdotfiles=YES
check_ftpusers=YES
check_aliases=YES
check_rhosts=YES
check_homes=YES
check_varmail=YES
check_nfs=YES
check_devices=YES
check_mtree=YES
check_disklabels=YES
check_pkgs=YES
check_changelist=YES
check_lvm=NO
check_pkg_vulnerabilities=YES
check_pkg_signatures=YES
backup_dir=/var/backups
backup_uses_rcs=YES
diff_options=-u
pkgdb_dir=/var/db/pkg
pkg_info=/usr/sbin/pkg_info
check_homes_permit_usergroups=NO
check_devices_ignore_fstypes="!local fdesc kernfs null procfs ptyfs ntfs msdos"
check_devices_ignore_paths=""
check_mtree_follow_symlinks=NO
check_passwd_nowarn_shells="/sbin/nologin"
check_passwd_nowarn_users=""
check_passwd_permit_star=NO
check_passwd_permit_nonalpha=NO
max_loginlen=16
max_grouplen=16