SECURITY.CONF(5)          NetBSD File Formats Manual          SECURITY.CONF(5)

NNAAMMEE
     sseeccuurriittyy..ccoonnff -- daily security check configuration file

DDEESSCCRRIIPPTTIIOONN
     The sseeccuurriittyy..ccoonnff file specifies which of the standard _/_e_t_c_/_s_e_c_u_r_i_t_y ser-
     vices are performed.  The _/_e_t_c_/_s_e_c_u_r_i_t_y script is run, by default, every
     night from _/_e_t_c_/_d_a_i_l_y, on a NetBSD system, if configured do to so from
     _/_e_t_c_/_d_a_i_l_y_._c_o_n_f.

     The variables described below can be set to "NO" to disable the test:

     cchheecckk__ppaasssswwdd   This checks the _/_e_t_c_/_m_a_s_t_e_r_._p_a_s_s_w_d file for inconsisten-
                    cies.

     cchheecckk__ggrroouupp    This checks the _/_e_t_c_/_g_r_o_u_p file for inconsistencies.

     cchheecckk__rroooottddoottffiilleess
                    This checks the root users startup files for sane settings
                    of $PATH and umask.  This test is not fail safe and any
                    warning generated from this should be checked for correct-
                    ness.

     cchheecckk__ffttppuusseerrss
                    This checks that the correct users are in the
                    _/_e_t_c_/_f_t_p_u_s_e_r_s file.

     cchheecckk__aalliiaasseess  This checks for security problems in the _/_e_t_c_/_m_a_i_l_/_a_l_i_a_s_e_s
                    file.  For backward compatibility, _/_e_t_c_/_a_l_i_a_s_e_s will be
                    checked as well if exists.

     cchheecckk__rrhhoossttss   This checks for system and user rhosts files with "+" in
                    them.

     cchheecckk__hhoommeess    This checks that home directories are owned by the correct
                    user, and have appropriate permissions.

     cchheecckk__vvaarrmmaaiill  This checks that the correct user owns mail in _/_v_a_r_/_m_a_i_l,
                    and that the mail box has the right permissions.

     cchheecckk__nnffss      This checks that the _/_e_t_c_/_e_x_p_o_r_t_s file does not export
                    filesystems to the world.

     cchheecckk__ddeevviicceess  This checks for changes to devices and setuid files.

     cchheecckk__mmttrreeee    This runs mtree(8) to ensure that the system is installed
                    correctly.  The following configuration files are checked:

                    _/_e_t_c_/_m_t_r_e_e_/_s_p_e_c_i_a_l
                          Default files to check.

                    _/_e_t_c_/_m_t_r_e_e_/_s_p_e_c_i_a_l_._l_o_c_a_l
                          Local site additions.

                    _/_e_t_c_/_m_t_r_e_e_/_D_I_R_._s_e_c_u_r_e
                          Specification for the directory _D_I_R.

     cchheecckk__ddiisskkllaabbeellss
                    Backup text copies of the disklabels of available disk
                    drives into _/_v_a_r_/_b_a_c_k_u_p_s_/_w_o_r_k_/_d_i_s_k_l_a_b_e_l_._X_X_X, and display
                    any differences in those and the previous copies as per
                    cchheecckk__cchhaannggeelliisstt below.  If fdisk(8) is available on the
                    current platform, the output of _/_s_b_i_n_/_f_d_i_s_k for each
                    available disk drive is stored in
                    _/_v_a_r_/_b_a_c_k_u_p_s_/_w_o_r_k_/_f_d_i_s_k_._X_X_X, and any differences displayed
                    as per the disklabels.

     cchheecckk__ppkkggss     This stores a list of all installed pkgs into
                    _/_v_a_r_/_b_a_c_k_u_p_s_/_w_o_r_k_/_p_k_g_s and checks it for any changes.

     cchheecckk__cchhaannggeelliisstt
                    This determines a list of files from the contents of
                    _/_e_t_c_/_c_h_a_n_g_e_l_i_s_t, and the output of mmttrreeee --DD for
                    _/_e_t_c_/_m_t_r_e_e_/_s_p_e_c_i_a_l and _/_e_t_c_/_m_t_r_e_e_/_s_p_e_c_i_a_l_._l_o_c_a_l.  For each
                    file in the list it compares the files with their backups
                    in _/_v_a_r_/_b_a_c_k_u_p_s_/_f_i_l_e_._c_u_r_r_e_n_t and _/_v_a_r_/_b_a_c_k_u_p_s_/_f_i_l_e_._b_a_c_k_u_p,
                    and displays any differences found.  The following
                    mtree(8) ttaaggss modify how files are determined from
                    _/_e_t_c_/_m_t_r_e_e_/_s_p_e_c_i_a_l and _/_e_t_c_/_m_t_r_e_e_/_s_p_e_c_i_a_l_._l_o_c_a_l:

                          exclude  The entry is ignored; no backups are made
                                   and the differences are not displayed.
                                   This includes dynamic or binary files such
                                   as _/_v_a_r_/_r_u_n_/_u_t_m_p.

                          nodiff   The entry is backed up but the differences
                                   are not displayed because the contents of
                                   the file are sensitive.  This includes
                                   files such as _/_e_t_c_/_m_a_s_t_e_r_._p_a_s_s_w_d.

     The variables described below can be set to modify the tests:

     cchheecckk__hhoommeess__ppeerrmmiitt__uusseerrggrroouuppss
                    During the cchheecckk__hhoommeess phase, allow the checked files to
                    be group-writable if the group name is the same as the
                    username.

     cchheecckk__ddeevviicceess__iiggnnoorree__ffssttyyppeess
                    Lists filesystem types to ignore during the cchheecckk__ddeevviicceess
                    phase.  Prefixing the type with a `!' inverts the match.
                    For example, `procfs !local' will ignore `procfs' type
                    filesystems and filesystems that are not `local'.

     cchheecckk__ddeevviicceess__iiggnnoorree__ppaatthhss
                    Lists pathnames to ignore during the cchheecckk__ddeevviicceess phase.
                    Prefixing the path with a `!' inverts the match.  For
                    example, `/tftp' will ignore paths under _/_t_f_t_p while
                    `!/home' will ignore paths that are not under _/_h_o_m_e.

     cchheecckk__mmttrreeee__ffoollllooww__ssyymmlliinnkkss
                    During the cchheecckk__mmttrreeee phase, instruct mtree to follow
                    symbolic links.

     cchheecckk__ppaasssswwdd__nnoowwaarrnn__sshheellllss
                    If cchheecckk__ppaasssswwdd is enabled, most warnings will be sup-
                    pressed for entries whose shells are listed in this space-
                    separated list.  This is of particular value when those
                    shells are not in _/_e_t_c_/_s_h_e_l_l_s.

     cchheecckk__ppaasssswwdd__nnoowwaarrnn__uusseerrss
                    If cchheecckk__ppaasssswwdd is enabled, suppress warnings for these
                    users.

     cchheecckk__ppaasssswwdd__ppeerrmmiitt__nnoonnaallpphhaa
                    If cchheecckk__ppaasssswwdd is enabled, do not warn about login names
                    which use non-alphanumeric characters.

     cchheecckk__ppaasssswwdd__ppeerrmmiitt__ssttaarr
                    If cchheecckk__ppaasssswwdd is enabled, do not warn about password
                    fields set to ``*''.  Note that the use of password fields
                    such as ``*ssh'' is encouraged, instead.

     mmaaxx__ggrroouupplleenn   If cchheecckk__ggrroouupp is enabled, this determines the maximum
                    permitted length of group names.

     mmaaxx__llooggiinnlleenn   If cchheecckk__ppaasssswwdd is enabled, this determines the maximum
                    permitted length of login names.

     bbaacckkuupp__ddiirr     Change the backup directory from _/_v_a_r_/_b_a_c_k_u_p.

     ddiiffff__ooppttiioonnss   Specify the options passed to diff(1) when it is invoked
                    to show changes made to system files.  Defaults to ``-u'',
                    for unified-format context-diffs.

     ppkkggddbb__ddiirr      Change the pkg database directory from _/_v_a_r_/_d_b_/_p_k_g when
                    cchheecckk__ppkkggss is enabled.

     bbaacckkuupp__uusseess__rrccss
                    Use rcs(1) for maintaining backup copies of files noted in
                    cchheecckk__ddeevviicceess, cchheecckk__ddiisskkllaabbeellss, cchheecckk__ppkkggss, and
                    cchheecckk__cchhaannggeelliisstt instead of just keeping a current copy
                    and a backup copy.

FFIILLEESS
     /etc/defaults/security.conf  defaults for /etc/security.conf
     /etc/security                daily security check script
     /etc/security.conf           daily security check configuration
     /etc/security.local          local site additions to _/_e_t_c_/_s_e_c_u_r_i_t_y

SSEEEE AALLSSOO
     daily.conf(5)

HHIISSTTOORRYY
     The sseeccuurriittyy..ccoonnff file appeared in NetBSD 1.3.  The cchheecckk__ddiisskkllaabbeellss
     functionality was added in NetBSD 1.4.  The bbaacckkuupp__uusseess__rrccss and
     cchheecckk__ppkkggss features were added in NetBSD 1.6.  ddiiffff__ooppttiioonnss appeared in
     NetBSD 2.0; prior to that, traditional-format (context free) diffs were
     generated.

NetBSD 4.0                       May 29, 2006                       NetBSD 4.0
