Annotation of src/etc/security, Revision 1.1.1.1
1.1 deraadt 1: #!/bin/sh -
2: #
3: # from: @(#)security 8.1 (Berkeley) 6/9/93
4: # $Id: security,v 1.11 1995/01/31 16:09:45 jtc Exp $
5: #
6:
7: PATH=/sbin:/usr/sbin:/bin:/usr/bin
8:
9: umask 077
10:
11: ERR=/tmp/_secure1.$$
12: TMP1=/tmp/_secure2.$$
13: TMP2=/tmp/_secure3.$$
14: TMP3=/tmp/_secure4.$$
15: LIST=/tmp/_secure5.$$
16: OUTPUT=/tmp/_secure6.$$
17:
18: trap 'rm -f $ERR $TMP1 $TMP2 $TMP3 $LIST $OUTPUT' 0
19:
20: # Check the master password file syntax.
21: MP=/etc/master.passwd
22: awk -F: '{
23: if ($0 ~ /^[ ]*$/) {
24: printf("Line %d is a blank line.\n", NR);
25: next;
26: }
27: if (NF != 10)
28: printf("Line %d has the wrong number of fields.\n", NR);
29: if ($1 !~ /^[A-Za-z0-9]*$/)
30: printf("Login %s has non-alphanumeric characters.\n", $1);
31: if (length($1) > 8)
32: printf("Login %s has more than 8 characters.\n", $1);
33: if ($2 == "")
34: printf("Login %s has no password.\n", $1);
35: if (length($2) != 13 && ($10 ~ /.*sh$/ || $10 == ""))
36: printf("Login %s is off but still has a valid shell.\n", $1);
37: if ($3 == 0 && $1 != "root" && $1 != "toor")
38: printf("Login %s has a user id of 0.\n", $1);
39: if ($3 < 0)
40: printf("Login %s has a negative user id.\n", $1);
41: if ($4 < 0)
42: printf("Login %s has a negative group id.\n", $1);
43: }' < $MP > $OUTPUT
44: if [ -s $OUTPUT ] ; then
45: printf "\nChecking the $MP file:\n"
46: cat $OUTPUT
47: fi
48:
49: awk -F: '{ print $1 }' $MP | sort | uniq -d > $OUTPUT
50: if [ -s $OUTPUT ] ; then
51: printf "\n$MP has duplicate user names.\n"
52: column $OUTPUT
53: fi
54:
55: awk -F: '{ print $1 " " $3 }' $MP | sort -n +1 | tee $TMP1 |
56: uniq -d -f 1 | awk '{ print $2 }' > $TMP2
57: if [ -s $TMP2 ] ; then
58: printf "\n$MP has duplicate user id's.\n"
59: while read uid; do
60: grep -w $uid $TMP1
61: done < $TMP2 | column
62: fi
63:
64: # Backup the master password file; a special case, the normal backup
65: # mechanisms also print out file differences and we don't want to do
66: # that because this file has encrypted passwords in it.
67: CUR=/var/backups/`basename $MP`.current
68: BACK=/var/backups/`basename $MP`.backup
69: if [ -s $CUR ] ; then
70: if cmp -s $CUR $MP; then
71: :
72: else
73: cp -p $CUR $BACK
74: cp -p $MP $CUR
75: chown root.wheel $CUR
76: fi
77: else
78: cp -p $MP $CUR
79: chown root.wheel $CUR
80: fi
81:
82: # Check the group file syntax.
83: GRP=/etc/group
84: awk -F: '{
85: if ($0 ~ /^[ ]*$/) {
86: printf("Line %d is a blank line.\n", NR);
87: next;
88: }
89: if (NF != 4)
90: printf("Line %d has the wrong number of fields.\n", NR);
91: if ($1 !~ /^[A-za-z0-9]*$/)
92: printf("Group %s has non-alphanumeric characters.\n", $1);
93: if (length($1) > 8)
94: printf("Group %s has more than 8 characters.\n", $1);
95: if ($3 !~ /[0-9]*/)
96: printf("Login %s has a negative group id.\n", $1);
97: }' < $GRP > $OUTPUT
98: if [ -s $OUTPUT ] ; then
99: printf "\nChecking the $GRP file:\n"
100: cat $OUTPUT
101: fi
102:
103: awk -F: '{ print $1 }' $GRP | sort | uniq -d > $OUTPUT
104: if [ -s $OUTPUT ] ; then
105: printf "\n$GRP has duplicate group names.\n"
106: column $OUTPUT
107: fi
108:
109: # Check for root paths, umask values in startup files.
110: # The check for the root paths is problematical -- it's likely to fail
111: # in other environments. Once the shells have been modified to warn
112: # of '.' in the path, the path tests should go away.
113: > $OUTPUT
114: rhome=/root
115: umaskset=no
116: list="/etc/csh.cshrc /etc/csh.login ${rhome}/.cshrc ${rhome}/.login"
117: for i in $list ; do
118: if [ -f $i ] ; then
119: if egrep umask $i > /dev/null ; then
120: umaskset=yes
121: fi
122: egrep umask $i |
123: awk '$2 % 100 < 20 \
124: { print "Root umask is group writeable" }
125: $2 % 10 < 2 \
126: { print "Root umask is other writeable" }' >> $OUTPUT
127: /bin/csh -f -s << end-of-csh > /dev/null 2>&1
128: unset path
129: source $i
130: /bin/ls -ldgT \$path > $TMP1
131: end-of-csh
132: awk '{
133: if ($10 ~ /^\.$/) {
134: print "The root path includes .";
135: next;
136: }
137: }
138: $1 ~ /^d....w/ \
139: { print "Root path directory " $10 " is group writeable." } \
140: $1 ~ /^d.......w/ \
141: { print "Root path directory " $10 " is other writeable." }' \
142: < $TMP1 >> $OUTPUT
143: fi
144: done
145: if [ $umaskset = "no" -o -s $OUTPUT ] ; then
146: printf "\nChecking root csh paths, umask values:\n$list\n"
147: if [ -s $OUTPUT ]; then
148: cat $OUTPUT
149: fi
150: if [ $umaskset = "no" ] ; then
151: printf "\nRoot csh startup files do not set the umask.\n"
152: fi
153: fi
154:
155: > $OUTPUT
156: rhome=/root
157: umaskset=no
158: list="${rhome}/.profile"
159: for i in $list; do
160: if [ -f $i ] ; then
161: if egrep umask $i > /dev/null ; then
162: umaskset=yes
163: fi
164: egrep umask $i |
165: awk '$2 % 100 < 20 \
166: { print "Root umask is group writeable" } \
167: $2 % 10 < 2 \
168: { print "Root umask is other writeable" }' >> $OUTPUT
169: /bin/sh << end-of-sh > /dev/null 2>&1
170: PATH=
171: . $i
172: list=\`echo \$PATH | /usr/bin/sed -e 's/:/ /g'\`
173: /bin/ls -ldgT \$list > $TMP1
174: end-of-sh
175: awk '{
176: if ($10 ~ /^\.$/) {
177: print "The root path includes .";
178: next;
179: }
180: }
181: $1 ~ /^d....w/ \
182: { print "Root path directory " $10 " is group writeable." } \
183: $1 ~ /^d.......w/ \
184: { print "Root path directory " $10 " is other writeable." }' \
185: < $TMP1 >> $OUTPUT
186:
187: fi
188: done
189: if [ $umaskset = "no" -o -s $OUTPUT ] ; then
190: printf "\nChecking root sh paths, umask values:\n$list\n"
191: if [ -s $OUTPUT ]; then
192: cat $OUTPUT
193: fi
194: if [ $umaskset = "no" ] ; then
195: printf "\nRoot sh startup files do not set the umask.\n"
196: fi
197: fi
198:
199: # Root and uucp should both be in /etc/ftpusers.
200: if egrep root /etc/ftpusers > /dev/null ; then
201: :
202: else
203: printf "\nRoot not listed in /etc/ftpusers file.\n"
204: fi
205: if egrep uucp /etc/ftpusers > /dev/null ; then
206: :
207: else
208: printf "\nUucp not listed in /etc/ftpusers file.\n"
209: fi
210:
211: # Uudecode should not be in the /etc/aliases file.
212: if egrep 'uudecode|decode' /etc/aliases; then
213: printf "\nThere is an entry for uudecode in the /etc/aliases file.\n"
214: fi
215:
216: # Files that should not have + signs.
217: list="/etc/hosts.equiv /etc/hosts.lpd"
218: for f in $list ; do
219: if egrep '\+' $f > /dev/null ; then
220: printf "\nPlus sign in $f file.\n"
221: fi
222: done
223:
224: # Check for special users with .rhosts files. Only root and toor should
225: # have a .rhosts files. Also, .rhosts files should not plus signs.
226: awk -F: '$1 != "root" && $1 != "toor" && \
227: ($3 < 100 || $1 == "ftp" || $1 == "uucp") \
228: { print $1 " " $6 }' /etc/passwd |
229: while read uid homedir; do
230: if [ -f ${homedir}/.rhosts ] ; then
231: rhost=`ls -ldgT ${homedir}/.rhosts`
232: printf "$uid: $rhost\n"
233: fi
234: done > $OUTPUT
235: if [ -s $OUTPUT ] ; then
236: printf "\nChecking for special users with .rhosts files.\n"
237: cat $OUTPUT
238: fi
239:
240: awk -F: '{ print $1 " " $6 }' /etc/passwd | \
241: while read uid homedir; do
242: if [ -f ${homedir}/.rhosts ] && \
243: egrep '\+' ${homedir}/.rhosts > /dev/null ; then
244: printf "$uid: + in .rhosts file.\n"
245: fi
246: done > $OUTPUT
247: if [ -s $OUTPUT ] ; then
248: printf "\nChecking .rhosts files syntax.\n"
249: cat $OUTPUT
250: fi
251:
252: # Check home directories. Directories should not be owned by someone else
253: # or writeable.
254: awk -F: '{ print $1 " " $6 }' /etc/passwd | \
255: while read uid homedir; do
256: if [ -d ${homedir}/ ] ; then
257: file=`ls -ldgT ${homedir}`
258: printf "$uid $file\n"
259: fi
260: done |
261: awk '$1 != $4 && $4 != "root" \
262: { print "user " $1 " home directory is owned by " $4 }
263: $2 ~ /^-....w/ \
264: { print "user " $1 " home directory is group writeable" }
265: $2 ~ /^-.......w/ \
266: { print "user " $1 " home directory is other writeable" }' > $OUTPUT
267: if [ -s $OUTPUT ] ; then
268: printf "\nChecking home directories.\n"
269: cat $OUTPUT
270: fi
271:
272: # Files that should not be owned by someone else or readable.
273: list=".netrc .rhosts"
274: awk -F: '{ print $1 " " $6 }' /etc/passwd | \
275: while read uid homedir; do
276: for f in $list ; do
277: file=${homedir}/${f}
278: if [ -f $file ] ; then
279: printf "$uid $f `ls -ldgT $file`\n"
280: fi
281: done
282: done |
283: awk '$1 != $5 && $5 != "root" \
284: { print "user " $1 " " $2 " file is owned by " $5 }
285: $3 ~ /^-...r/ \
286: { print "user " $1 " " $2 " file is group readable" }
287: $3 ~ /^-......r/ \
288: { print "user " $1 " " $2 " file is other readable" }
289: $3 ~ /^-....w/ \
290: { print "user " $1 " " $2 " file is group writeable" }
291: $3 ~ /^-.......w/ \
292: { print "user " $1 " " $2 " file is other writeable" }' > $OUTPUT
293:
294: # Files that should not be owned by someone else or writeable.
295: list=".bashrc .cshrc .emacs .exrc .forward .klogin .login .logout \
296: .profile .tcshrc"
297: awk -F: '{ print $1 " " $6 }' /etc/passwd | \
298: while read uid homedir; do
299: for f in $list ; do
300: file=${homedir}/${f}
301: if [ -f $file ] ; then
302: printf "$uid $f `ls -ldgT $file`\n"
303: fi
304: done
305: done |
306: awk '$1 != $5 && $5 != "root" \
307: { print "user " $1 " " $2 " file is owned by " $5 }
308: $3 ~ /^-....w/ \
309: { print "user " $1 " " $2 " file is group writeable" }
310: $3 ~ /^-.......w/ \
311: { print "user " $1 " " $2 " file is other writeable" }' >> $OUTPUT
312: if [ -s $OUTPUT ] ; then
313: printf "\nChecking dot files.\n"
314: cat $OUTPUT
315: fi
316:
317: # Mailboxes should be owned by user and unreadable.
318: ls -l /var/mail | sed 1d | \
319: awk '$3 != $9 \
320: { print "user " $9 " mailbox is owned by " $3 }
321: $1 != "-rw-------" \
322: { print "user " $9 " mailbox is " $1 ", group " $4 }' > $OUTPUT
323: if [ -s $OUTPUT ] ; then
324: printf "\nChecking mailbox ownership.\n"
325: cat $OUTPUT
326: fi
327:
328: # File systems should not be globally exported.
329: awk '{
330: readonly = 0;
331: for (i = 2; i <= NF; ++i) {
332: if ($i ~ /-ro/)
333: readonly = 1;
334: else if ($i !~ /^-/)
335: next;
336: }
337: if (readonly)
338: print "File system " $1 " globally exported, read-only."
339: else
340: print "File system " $1 " globally exported, read-write."
341: }' < /etc/exports > $OUTPUT
342: if [ -s $OUTPUT ] ; then
343: printf "\nChecking for globally exported file systems.\n"
344: cat $OUTPUT
345: fi
346:
347: # Display any changes in setuid files and devices.
348: printf "\nChecking setuid files and devices:\n"
349: (find / \( ! -fstype local -o -fstype fdesc -o -fstype kernfs \
350: -o -fstype procfs \) -a -prune -o \
351: \( -perm -u+s -o -perm -g+s -o ! -type d -a ! -type f -a ! -type l -a \
352: ! -type s \) | \
353: sort | sed -e 's/^/ls -ldgT /' | sh > $LIST) 2> $OUTPUT
354:
355: # Display any errors that occurred during system file walk.
356: if [ -s $OUTPUT ] ; then
357: printf "Setuid/device find errors:\n"
358: cat $OUTPUT
359: printf "\n"
360: fi
361:
362: # Display any changes in the setuid file list.
363: egrep -v '^[bc]' $LIST > $TMP1
364: if [ -s $TMP1 ] ; then
365: # Check to make sure uudecode isn't setuid.
366: if grep -w uudecode $TMP1 > /dev/null ; then
367: printf "\nUudecode is setuid.\n"
368: fi
369:
370: CUR=/var/backups/setuid.current
371: BACK=/var/backups/setuid.backup
372:
373: if [ -s $CUR ] ; then
374: if cmp -s $CUR $TMP1 ; then
375: :
376: else
377: > $TMP2
378: join -110 -210 -v2 $CUR $TMP1 > $OUTPUT
379: if [ -s $OUTPUT ] ; then
380: printf "Setuid additions:\n"
381: tee -a $TMP2 < $OUTPUT
382: printf "\n"
383: fi
384:
385: join -110 -210 -v1 $CUR $TMP1 > $OUTPUT
386: if [ -s $OUTPUT ] ; then
387: printf "Setuid deletions:\n"
388: tee -a $TMP2 < $OUTPUT
389: printf "\n"
390: fi
391:
392: sort +9 $TMP2 $CUR $TMP1 | \
393: sed -e 's/[ ][ ]*/ /g' | uniq -u > $OUTPUT
394: if [ -s $OUTPUT ] ; then
395: printf "Setuid changes:\n"
396: column -t $OUTPUT
397: printf "\n"
398: fi
399:
400: cp $CUR $BACK
401: cp $TMP1 $CUR
402: fi
403: else
404: printf "Setuid additions:\n"
405: column -t $TMP1
406: printf "\n"
407: cp $TMP1 $CUR
408: fi
409: fi
410:
411: # Check for block and character disk devices that are readable or writeable
412: # or not owned by root.operator.
413: >$TMP1
414: DISKLIST="dk fd hd hk hp jb kra ra rb rd rl rx rz sd up wd"
415: for i in $DISKLIST; do
416: egrep "^b.*/${i}[0-9][0-9]*[a-h]$" $LIST >> $TMP1
417: egrep "^c.*/r${i}[0-9][0-9]*[a-h]$" $LIST >> $TMP1
418: done
419:
420: awk '$3 != "root" || $4 != "operator" || $1 !~ /.rw-r-----/ \
421: { printf("Disk %s is user %s, group %s, permissions %s.\n", \
422: $11, $3, $4, $1); }' < $TMP1 > $OUTPUT
423: if [ -s $OUTPUT ] ; then
424: printf "\nChecking disk ownership and permissions.\n"
425: cat $OUTPUT
426: printf "\n"
427: fi
428:
429: # Display any changes in the device file list.
430: egrep '^[bc]' $LIST | sort +10 > $TMP1
431: if [ -s $TMP1 ] ; then
432: CUR=/var/backups/device.current
433: BACK=/var/backups/device.backup
434:
435: if [ -s $CUR ] ; then
436: if cmp -s $CUR $TMP1 ; then
437: :
438: else
439: > $TMP2
440: join -111 -211 -v2 $CUR $TMP1 > $OUTPUT
441: if [ -s $OUTPUT ] ; then
442: printf "Device additions:\n"
443: tee -a $TMP2 < $OUTPUT
444: printf "\n"
445: fi
446:
447: join -111 -211 -v1 $CUR $TMP1 > $OUTPUT
448: if [ -s $OUTPUT ] ; then
449: printf "Device deletions:\n"
450: tee -a $TMP2 < $OUTPUT
451: printf "\n"
452: fi
453:
454: # Report any block device change. Ignore character
455: # devices, only the name is significant.
456: cat $TMP2 $CUR $TMP1 | \
457: sed -e '/^c/d' | \
458: sort +10 | \
459: sed -e 's/[ ][ ]*/ /g' | \
460: uniq -u > $OUTPUT
461: if [ -s $OUTPUT ] ; then
462: printf "Block device changes:\n"
463: column -t $OUTPUT
464: printf "\n"
465: fi
466:
467: cp $CUR $BACK
468: cp $TMP1 $CUR
469: fi
470: else
471: printf "Device additions:\n"
472: column -t $TMP1
473: printf "\n"
474: cp $TMP1 $CUR
475: fi
476: fi
477:
478: # Check special files.
479: # Check system binaries.
480: #
481: # Create the mtree tree specifications using:
482: #
483: # mtree -cx -pDIR -kcksum,gid,mode,nlink,size,link,time,uid > DIR.secure
484: # chown root.wheel DIR.SECURE
485: # chmod 600 DIR.SECURE
486: #
487: # Note, this is not complete protection against Trojan horsed binaries, as
488: # the hacker can modify the tree specification to match the replaced binary.
489: # For details on really protecting yourself against modified binaries, see
490: # the mtree(8) manual page.
491: if cd /etc/mtree; then
492: mtree -e -p / -f /etc/mtree/special > $OUTPUT
493: if [ -s $OUTPUT ] ; then
494: printf "\nChecking special files and directories.\n"
495: cat $OUTPUT
496: fi
497:
498: > $OUTPUT
499: for file in *.secure; do
500: tree=`sed -n -e '3s/.* //p' -e 3q $file`
501: mtree -f $file -p $tree > $TMP1
502: if [ -s $TMP1 ]; then
503: printf "\nChecking $tree:\n" >> $OUTPUT
504: cat $TMP1 >> $OUTPUT
505: fi
506: done
507: if [ -s $OUTPUT ] ; then
508: printf "\nChecking system binaries:\n"
509: cat $OUTPUT
510: fi
511: fi
512:
513: # List of files that get backed up and checked for any modifications. Each
514: # file is expected to have two backups, /var/backups/file.{current,backup}.
515: # Any changes cause the files to rotate.
516: if [ -s /etc/changelist ] ; then
517: for file in `cat /etc/changelist`; do
518: CUR=/var/backups/`basename $file`.current
519: BACK=/var/backups/`basename $file`.backup
520: if [ -s $file ]; then
521: if [ -s $CUR ] ; then
522: diff $CUR $file > $OUTPUT
523: if [ -s $OUTPUT ] ; then
524: printf "\n======\n%s diffs (OLD < > NEW)\n======\n" $file
525: cat $OUTPUT
526: cp -p $CUR $BACK
527: cp -p $file $CUR
528: chown root.wheel $CUR $BACK
529: fi
530: else
531: cp -p $file $CUR
532: chown root.wheel $CUR
533: fi
534: fi
535: done
536: fi
![[BACK]](/icons/back.gif){kind=icon}
Return to security CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / etc