NAME
security
—
periodic system security
check
SYNOPSIS
/usr/libexec/security |
DESCRIPTION
security
is a command script that examines
the system for some signs of security weaknesses. It is only a security aid
and does not offer complete protection. security
is
run by daily(8), which mails any output to root on a daily basis.
The security
script carries out the
following list of simple checks:
- Check the master.passwd(5) and group(5) files for syntax, empty passwords, partially closed accounts, suspicious UIDs, suspicious GIDs, and duplicate entries.
- Check root's home directory and login environment for insecure permissions, suspicious paths, and umask commands in the dotfiles.
- Check that root and uucp are in /etc/ftpusers.
- Check for suspicious commands in /etc/mail/aliases.
- Check for insecurities in various trust files such as /etc/hosts.equiv, /etc/shosts.equiv, and /etc/hosts.lpd.
- Check user .rhosts and .shosts files for open access.
- Check user home directory permissions.
- Check many user dotfile permissions.
- Check user mailbox permissions.
- Check NFS exports(5) file for global export entries.
- Check for changes in setuid/setgid files and devices.
- Check disk ownership and permissions.
- Check for changes in the device file list.
- Check for permission changes in special files and system binaries listed
in /etc/mtree/special.
security
also provides hooks for administrators to create their own lists. These lists should be kept in /etc/mtree/ and filenames must have the suffix “.secure”. The following example shows how to create such a list, to protect the home directory of user “bob”:# mtree -cx -p /home/bob -K md5digest,type >/etc/mtree/bob.secure # chown root:wheel /etc/mtree/bob.secure # chmod 600 /etc/mtree/bob.secure
Note: These checks do not provide complete protection against Trojan horsed binaries, as the miscreant can modify the tree specification to match the replaced binary. For details on really protecting yourself against modified binaries, see mtree(8).
- Check for changes in files listed in /etc/changelist. Files being created or deleted, as well as content change in the files themselves, are reported. See changelist(5) for further details.
- Check for changes to the disklabels of mounted disks.
- Report on the installation or removal of any system package(5).
- Check hostname.if(5) file permissions.
The intent of the security
script is to
point out some obvious holes to the system administrator.
ENVIRONMENT
The following variables can be set in /etc/daily.local:
SUIDSKIP
- A whitespace-separated list of absolute paths to be skipped in setuid/setgid file checks and in device special file checks. Avoid trailing slashes.
FILES
- /etc/changelist
- /etc/daily
- /etc/mtree
- /var/backups
SEE ALSO
HISTORY
A security
shell script appeared in
4.3BSD-Reno, but most functionality only came with
4.4BSD.
AUTHORS
The present manual was written by David Leonard for
OpenBSD 2.9. Andrew Fresh and Ingo Schwarze rewrote
security
from scratch in
perl(1) for OpenBSD 5.0.
BUGS
The name of this script may provide a false sense of
security
.
There are perhaps an infinite number of ways the system can be compromised without this script noticing.