Annotation of src/etc/security, Revision 1.28
1.1 deraadt 1: #!/bin/sh -
2: #
1.28 ! todd 3: # $OpenBSD: security,v 1.27 1998/03/22 03:39:11 marc Exp $
1.13 millert 4: # from: @(#)security 8.1 (Berkeley) 6/9/93
1.1 deraadt 5: #
1.13 millert 6:
1.1 deraadt 7: PATH=/sbin:/usr/sbin:/bin:/usr/bin
8:
9: umask 077
10:
1.7 deraadt 11: DIR=/tmp/_secure$$
12: ERR=$DIR/_secure1
13: TMP1=$DIR/_secure2
14: TMP2=$DIR/_secure3
15: TMP3=$DIR/_secure4
16: LIST=$DIR/_secure5
17: OUTPUT=$DIR/_secure6
1.1 deraadt 18:
1.7 deraadt 19: if ! mkdir $DIR ; then
20: printf "tmp directory %s already exists, looks like:\n" $DIR
21: ls -alF $DIR
22: exit 1
23: fi
1.8 deraadt 24:
1.25 deraadt 25: trap 'rm -rf $DIR; exit 1' 0 1 2 3 13 15
1.1 deraadt 26:
27: # Check the master password file syntax.
28: MP=/etc/master.passwd
29: awk -F: '{
30: if ($0 ~ /^[ ]*$/) {
31: printf("Line %d is a blank line.\n", NR);
32: next;
33: }
34: if (NF != 10)
35: printf("Line %d has the wrong number of fields.\n", NR);
1.15 millert 36: if ($1 ~ /^[+-]/)
1.2 deraadt 37: next;
38: if ($1 == "")
1.13 millert 39: printf("Line %d has an empty login field.\n", NR);
1.2 deraadt 40: else if ($1 !~ /^[A-Za-z0-9][A-Za-z0-9_-]*$/)
1.1 deraadt 41: printf("Login %s has non-alphanumeric characters.\n", $1);
42: if (length($1) > 8)
43: printf("Login %s has more than 8 characters.\n", $1);
44: if ($2 == "")
45: printf("Login %s has no password.\n", $1);
1.23 deraadt 46: if ($2 != "" && length($2) != 13 && ($10 ~ /.*sh$/ || $10 == "") &&
47: ($2 !~ /^\$[0-9a-f]+\$/) && ($2 != "skey")) {
1.26 millert 48: if (system("test -s /etc/skeykeys && grep -q \"^"$1" \" /etc/skeykeys") == 0)
1.23 deraadt 49: printf("Login %s is off but still has a valid shell and an entry in /etc/skeykeys.\n", $1);
50: if (system("test -d "$9" -a ! -r "$9"") == 0)
51: printf("Login %s if off but still has valid shell and home directory is unreadable\n\t by root; cannot check for existance of alternate access files.\n", $1);
52: else if (system("for file in .ssh .rhosts .shosts .klogin; do if test -e "$9"/$file; then if ((ls -ld "$9"/$file | cut -b 2-10 | grep -q r) && (test ! -O "$9"/$file)) ; then exit 1; fi; fi; done"))
53: printf("Login %s is off but still has a valid shell and alternate access files in\n\t home directory are still readable.\n",$1);
54: }
1.9 deraadt 55: if ($3 == 0 && $1 != "root")
1.1 deraadt 56: printf("Login %s has a user id of 0.\n", $1);
57: if ($3 < 0)
58: printf("Login %s has a negative user id.\n", $1);
59: if ($4 < 0)
60: printf("Login %s has a negative group id.\n", $1);
61: }' < $MP > $OUTPUT
62: if [ -s $OUTPUT ] ; then
63: printf "\nChecking the $MP file:\n"
64: cat $OUTPUT
65: fi
66:
67: awk -F: '{ print $1 }' $MP | sort | uniq -d > $OUTPUT
68: if [ -s $OUTPUT ] ; then
69: printf "\n$MP has duplicate user names.\n"
70: column $OUTPUT
71: fi
72:
1.9 deraadt 73: awk -F: '{ print $1 " " $3 }' $MP | sort -n +1 | tee $TMP1 |
1.1 deraadt 74: uniq -d -f 1 | awk '{ print $2 }' > $TMP2
75: if [ -s $TMP2 ] ; then
76: printf "\n$MP has duplicate user id's.\n"
77: while read uid; do
78: grep -w $uid $TMP1
79: done < $TMP2 | column
80: fi
81:
82: # Backup the master password file; a special case, the normal backup
83: # mechanisms also print out file differences and we don't want to do
84: # that because this file has encrypted passwords in it.
1.2 deraadt 85: if [ ! -d /var/backups ] ; then
86: mkdir /var/backups
87: chmod 755 /var/backups
88: fi
1.1 deraadt 89: CUR=/var/backups/`basename $MP`.current
90: BACK=/var/backups/`basename $MP`.backup
91: if [ -s $CUR ] ; then
92: if cmp -s $CUR $MP; then
93: :
94: else
95: cp -p $CUR $BACK
96: cp -p $MP $CUR
97: chown root.wheel $CUR
98: fi
99: else
100: cp -p $MP $CUR
101: chown root.wheel $CUR
102: fi
103:
104: # Check the group file syntax.
105: GRP=/etc/group
106: awk -F: '{
107: if ($0 ~ /^[ ]*$/) {
108: printf("Line %d is a blank line.\n", NR);
109: next;
110: }
1.2 deraadt 111: if ($1 ~ /^[+-].*$/)
112: next;
1.1 deraadt 113: if (NF != 4)
114: printf("Line %d has the wrong number of fields.\n", NR);
1.13 millert 115: if ($1 !~ /^[A-za-z0-9][A-za-z0-9_-]*$/)
1.1 deraadt 116: printf("Group %s has non-alphanumeric characters.\n", $1);
117: if (length($1) > 8)
118: printf("Group %s has more than 8 characters.\n", $1);
119: if ($3 !~ /[0-9]*/)
120: printf("Login %s has a negative group id.\n", $1);
121: }' < $GRP > $OUTPUT
122: if [ -s $OUTPUT ] ; then
123: printf "\nChecking the $GRP file:\n"
124: cat $OUTPUT
125: fi
126:
127: awk -F: '{ print $1 }' $GRP | sort | uniq -d > $OUTPUT
128: if [ -s $OUTPUT ] ; then
129: printf "\n$GRP has duplicate group names.\n"
130: column $OUTPUT
131: fi
132:
133: # Check for root paths, umask values in startup files.
134: # The check for the root paths is problematical -- it's likely to fail
135: # in other environments. Once the shells have been modified to warn
136: # of '.' in the path, the path tests should go away.
137: > $OUTPUT
138: rhome=/root
139: umaskset=no
140: list="/etc/csh.cshrc /etc/csh.login ${rhome}/.cshrc ${rhome}/.login"
141: for i in $list ; do
1.15 millert 142: if [ -s $i ] ; then
1.1 deraadt 143: if egrep umask $i > /dev/null ; then
144: umaskset=yes
145: fi
146: egrep umask $i |
147: awk '$2 % 100 < 20 \
148: { print "Root umask is group writeable" }
149: $2 % 10 < 2 \
150: { print "Root umask is other writeable" }' >> $OUTPUT
1.21 deraadt 151: SAVE_PATH=$PATH
152: unset PATH
1.1 deraadt 153: /bin/csh -f -s << end-of-csh > /dev/null 2>&1
154: source $i
155: /bin/ls -ldgT \$path > $TMP1
156: end-of-csh
1.21 deraadt 157: PATH=$SAVE_PATH
1.1 deraadt 158: awk '{
159: if ($10 ~ /^\.$/) {
160: print "The root path includes .";
161: next;
162: }
163: }
164: $1 ~ /^d....w/ \
165: { print "Root path directory " $10 " is group writeable." } \
166: $1 ~ /^d.......w/ \
167: { print "Root path directory " $10 " is other writeable." }' \
168: < $TMP1 >> $OUTPUT
169: fi
170: done
171: if [ $umaskset = "no" -o -s $OUTPUT ] ; then
172: printf "\nChecking root csh paths, umask values:\n$list\n"
1.13 millert 173: if [ -s $OUTPUT ] ; then
1.1 deraadt 174: cat $OUTPUT
175: fi
176: if [ $umaskset = "no" ] ; then
177: printf "\nRoot csh startup files do not set the umask.\n"
178: fi
179: fi
180:
181: > $OUTPUT
182: rhome=/root
183: umaskset=no
1.20 millert 184: list="/etc/profile ${rhome}/.profile"
1.1 deraadt 185: for i in $list; do
1.15 millert 186: if [ -s $i ] ; then
1.1 deraadt 187: if egrep umask $i > /dev/null ; then
188: umaskset=yes
189: fi
190: egrep umask $i |
191: awk '$2 % 100 < 20 \
192: { print "Root umask is group writeable" } \
193: $2 % 10 < 2 \
194: { print "Root umask is other writeable" }' >> $OUTPUT
1.21 deraadt 195: SAVE_PATH=$PATH
196: unset PATH
1.1 deraadt 197: /bin/sh << end-of-sh > /dev/null 2>&1
198: . $i
199: list=\`echo \$PATH | /usr/bin/sed -e 's/:/ /g'\`
200: /bin/ls -ldgT \$list > $TMP1
201: end-of-sh
1.21 deraadt 202: PATH=$SAVE_PATH
1.1 deraadt 203: awk '{
204: if ($10 ~ /^\.$/) {
205: print "The root path includes .";
206: next;
207: }
208: }
209: $1 ~ /^d....w/ \
210: { print "Root path directory " $10 " is group writeable." } \
211: $1 ~ /^d.......w/ \
212: { print "Root path directory " $10 " is other writeable." }' \
213: < $TMP1 >> $OUTPUT
214:
215: fi
216: done
217: if [ $umaskset = "no" -o -s $OUTPUT ] ; then
218: printf "\nChecking root sh paths, umask values:\n$list\n"
1.13 millert 219: if [ -s $OUTPUT ] ; then
1.1 deraadt 220: cat $OUTPUT
221: fi
222: if [ $umaskset = "no" ] ; then
223: printf "\nRoot sh startup files do not set the umask.\n"
224: fi
225: fi
226:
1.27 marc 227: # A good .kshrc will not have a umask or path, that being set in .profile
228: # check anyway.
229: > $OUTPUT
230: rhome=/root
231: list="/etc/ksh.kshrc ${rhome}/.kshrc"
232: for i in $list; do
233: if [ -s $i ] ; then
234: egrep umask $i |
235: awk '$2 % 100 < 20 \
236: { print "Root umask is group writeable" } \
237: $2 % 10 < 2 \
238: { print "Root umask is other writeable" }' >> $OUTPUT
239: if egrep PATH= $i > /dev/null ; then
240: SAVE_PATH=$PATH
241: unset PATH
242: /bin/ksh << end-of-sh > /dev/null 2>&1
243: . $i
244: list=\`echo \$PATH | /usr/bin/sed -e 's/:/ /g'\`
245: /bin/ls -ldgT \$list > $TMP1
246: end-of-sh
247: PATH=$SAVE_PATH
248: awk '{
249: if ($10 ~ /^\.$/) {
250: print "The root path includes .";
251: next;
252: }
253: }
254: $1 ~ /^d....w/ \
255: { print "Root path directory " $10 " is group writeable." } \
256: $1 ~ /^d.......w/ \
257: { print "Root path directory " $10 " is other writeable." }' \
258: < $TMP1 >> $OUTPUT
259: fi
260:
261: fi
262: done
263: if [ -s $OUTPUT ] ; then
264: printf "\nChecking root ksh paths, umask values:\n$list\n"
265: cat $OUTPUT
266: fi
267:
1.1 deraadt 268: # Root and uucp should both be in /etc/ftpusers.
269: if egrep root /etc/ftpusers > /dev/null ; then
270: :
271: else
272: printf "\nRoot not listed in /etc/ftpusers file.\n"
273: fi
274: if egrep uucp /etc/ftpusers > /dev/null ; then
275: :
276: else
277: printf "\nUucp not listed in /etc/ftpusers file.\n"
278: fi
279:
280: # Uudecode should not be in the /etc/aliases file.
281: if egrep 'uudecode|decode' /etc/aliases; then
282: printf "\nThere is an entry for uudecode in the /etc/aliases file.\n"
283: fi
284:
285: # Files that should not have + signs.
1.2 deraadt 286: list="/etc/hosts.equiv /etc/shosts.equiv /etc/hosts.lpd"
1.1 deraadt 287: for f in $list ; do
1.6 millert 288: if [ -s $f ] ; then
1.2 deraadt 289: awk '{
1.13 millert 290: if ($0 ~ /^\+@.*$/)
1.2 deraadt 291: next;
1.13 millert 292: if ($0 ~ /^\+.*$/)
1.2 deraadt 293: printf("\nPlus sign in %s file.\n", FILENAME);
294: }' $f
1.1 deraadt 295: fi
296: done
297:
1.13 millert 298: # Check for special users with .rhosts/.shosts files. Only root
299: # should have .rhosts/.shosts files. Also, .rhosts/.shosts
300: # files should not have plus signs.
1.14 millert 301: awk -F: '$1 != "root" && $1 !~ /^[+-]/ && \
1.1 deraadt 302: ($3 < 100 || $1 == "ftp" || $1 == "uucp") \
303: { print $1 " " $6 }' /etc/passwd |
304: while read uid homedir; do
1.2 deraadt 305: for j in .rhosts .shosts; do
1.14 millert 306: # Root owned .rhosts/.shosts files are ok.
1.15 millert 307: if [ -s ${homedir}/$j -a ! -O ${homedir}/$j ] ; then
1.2 deraadt 308: rhost=`ls -ldgT ${homedir}/$j`
309: printf "$uid: $rhost\n"
310: fi
311: done
1.1 deraadt 312: done > $OUTPUT
313: if [ -s $OUTPUT ] ; then
1.2 deraadt 314: printf "\nChecking for special users with .rhosts/.shosts files.\n"
1.1 deraadt 315: cat $OUTPUT
316: fi
317:
1.14 millert 318: awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \
1.1 deraadt 319: while read uid homedir; do
1.2 deraadt 320: for j in .rhosts .shosts; do
1.13 millert 321: if [ -s ${homedir}/$j ] ; then
1.2 deraadt 322: awk '{
323: if ($0 ~ /^+@.*$/ )
324: next;
1.4 deraadt 325: if ($0 ~ /^\+[ ]*$/ )
1.2 deraadt 326: printf("%s has + sign in it.\n",
1.13 millert 327: FILENAME);
1.2 deraadt 328: }' ${homedir}/$j
329: fi
330: done
1.1 deraadt 331: done > $OUTPUT
332: if [ -s $OUTPUT ] ; then
1.2 deraadt 333: printf "\nChecking .rhosts/.shosts files syntax.\n"
1.1 deraadt 334: cat $OUTPUT
335: fi
336:
337: # Check home directories. Directories should not be owned by someone else
338: # or writeable.
1.14 millert 339: awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \
1.1 deraadt 340: while read uid homedir; do
341: if [ -d ${homedir}/ ] ; then
342: file=`ls -ldgT ${homedir}`
343: printf "$uid $file\n"
344: fi
345: done |
346: awk '$1 != $4 && $4 != "root" \
347: { print "user " $1 " home directory is owned by " $4 }
348: $2 ~ /^-....w/ \
349: { print "user " $1 " home directory is group writeable" }
350: $2 ~ /^-.......w/ \
351: { print "user " $1 " home directory is other writeable" }' > $OUTPUT
352: if [ -s $OUTPUT ] ; then
353: printf "\nChecking home directories.\n"
354: cat $OUTPUT
355: fi
356:
357: # Files that should not be owned by someone else or readable.
1.28 ! todd 358: list=".netrc .rhosts .pgp/secring.pgp .shosts .ssh/identity .ssh/random_seed"
1.14 millert 359: awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \
1.1 deraadt 360: while read uid homedir; do
361: for f in $list ; do
362: file=${homedir}/${f}
363: if [ -f $file ] ; then
364: printf "$uid $f `ls -ldgT $file`\n"
365: fi
366: done
367: done |
368: awk '$1 != $5 && $5 != "root" \
369: { print "user " $1 " " $2 " file is owned by " $5 }
1.13 millert 370: $3 ~ /^-...r/ \
371: { print "user " $1 " " $2 " file is group readable" }
1.1 deraadt 372: $3 ~ /^-......r/ \
373: { print "user " $1 " " $2 " file is other readable" }
374: $3 ~ /^-....w/ \
375: { print "user " $1 " " $2 " file is group writeable" }
376: $3 ~ /^-.......w/ \
377: { print "user " $1 " " $2 " file is other writeable" }' > $OUTPUT
378:
379: # Files that should not be owned by someone else or writeable.
1.28 ! todd 380: list=".bashrc .bash_profile .bash_login .bash_logout .cshrc \
! 381: .emacs .exrc .forward .fvwmrc .inputrc .klogin .kshrc .login \
! 382: .logout .nexrc .profile .screenrc .ssh .ssh/config \
! 383: .ssh/authorized_keys .ssh/environment .ssh/known_hosts .ssh/rc \
! 384: .tcshrc .twmrc .xsession .xinitrc .Xdefaults .Xauthority"
1.14 millert 385: awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \
1.1 deraadt 386: while read uid homedir; do
387: for f in $list ; do
388: file=${homedir}/${f}
389: if [ -f $file ] ; then
390: printf "$uid $f `ls -ldgT $file`\n"
391: fi
392: done
393: done |
394: awk '$1 != $5 && $5 != "root" \
395: { print "user " $1 " " $2 " file is owned by " $5 }
396: $3 ~ /^-....w/ \
397: { print "user " $1 " " $2 " file is group writeable" }
398: $3 ~ /^-.......w/ \
399: { print "user " $1 " " $2 " file is other writeable" }' >> $OUTPUT
400: if [ -s $OUTPUT ] ; then
401: printf "\nChecking dot files.\n"
402: cat $OUTPUT
403: fi
404:
405: # Mailboxes should be owned by user and unreadable.
406: ls -l /var/mail | sed 1d | \
407: awk '$3 != $9 \
408: { print "user " $9 " mailbox is owned by " $3 }
409: $1 != "-rw-------" \
410: { print "user " $9 " mailbox is " $1 ", group " $4 }' > $OUTPUT
411: if [ -s $OUTPUT ] ; then
412: printf "\nChecking mailbox ownership.\n"
413: cat $OUTPUT
414: fi
415:
1.13 millert 416: # File systems should not be globally exported.
417: if [ -s /etc/exports ] ; then
418: awk '{
1.19 flipk 419: if (($1 ~ /^#/) || ($1 ~ /^$/))
1.1 deraadt 420: next;
1.13 millert 421: readonly = 0;
422: for (i = 2; i <= NF; ++i) {
1.19 flipk 423: if ($i ~ /^-ro$/)
1.13 millert 424: readonly = 1;
425: else if ($i !~ /^-/)
426: next;
427: }
428: if (readonly)
429: print "File system " $1 " globally exported, read-only."
430: else
431: print "File system " $1 " globally exported, read-write."
432: }' < /etc/exports > $OUTPUT
433: if [ -s $OUTPUT ] ; then
434: printf "\nChecking for globally exported file systems.\n"
435: cat $OUTPUT
436: fi
1.1 deraadt 437: fi
438:
1.5 deraadt 439: # Display any changes in setuid/setgid files and devices.
440: pending="\nChecking setuid/setgid files and devices:\n"
1.1 deraadt 441: (find / \( ! -fstype local -o -fstype fdesc -o -fstype kernfs \
1.13 millert 442: -o -fstype procfs \) -a -prune -o \
443: -type f -a \( -perm -u+s -o -perm -g+s \) -print0 -o \
444: ! -type d -a ! -type f -a ! -type l -a ! -type s -print0 | \
445: xargs -0 ls -ldgT | sort +9 > $LIST) 2> $OUTPUT
1.1 deraadt 446:
447: # Display any errors that occurred during system file walk.
448: if [ -s $OUTPUT ] ; then
1.2 deraadt 449: printf "${pending}Setuid/device find errors:\n"
450: pending=
1.1 deraadt 451: cat $OUTPUT
452: printf "\n"
453: fi
454:
1.12 millert 455: # Display any changes in the setuid/setgid file list.
1.13 millert 456: egrep -v '^[bc]' $LIST > $TMP1
1.1 deraadt 457: if [ -s $TMP1 ] ; then
458: # Check to make sure uudecode isn't setuid.
459: if grep -w uudecode $TMP1 > /dev/null ; then
1.2 deraadt 460: printf "${pending}\nUudecode is setuid.\n"
461: pending=
1.1 deraadt 462: fi
463:
464: CUR=/var/backups/setuid.current
465: BACK=/var/backups/setuid.backup
466:
467: if [ -s $CUR ] ; then
468: if cmp -s $CUR $TMP1 ; then
469: :
470: else
471: > $TMP2
1.13 millert 472: join -110 -210 -v2 $CUR $TMP1 > $OUTPUT
1.1 deraadt 473: if [ -s $OUTPUT ] ; then
1.2 deraadt 474: printf "${pending}Setuid additions:\n"
475: pending=
1.1 deraadt 476: tee -a $TMP2 < $OUTPUT
477: printf "\n"
478: fi
479:
1.13 millert 480: join -110 -210 -v1 $CUR $TMP1 > $OUTPUT
1.1 deraadt 481: if [ -s $OUTPUT ] ; then
1.2 deraadt 482: printf "${pending}Setuid deletions:\n"
483: pending=
1.1 deraadt 484: tee -a $TMP2 < $OUTPUT
485: printf "\n"
486: fi
487:
1.13 millert 488: sort +9 $TMP2 $CUR $TMP1 | \
1.1 deraadt 489: sed -e 's/[ ][ ]*/ /g' | uniq -u > $OUTPUT
490: if [ -s $OUTPUT ] ; then
1.2 deraadt 491: printf "${pending}Setuid changes:\n"
492: pending=
1.1 deraadt 493: column -t $OUTPUT
494: printf "\n"
495: fi
496:
497: cp $CUR $BACK
498: cp $TMP1 $CUR
499: fi
500: else
1.2 deraadt 501: printf "${pending}Setuid additions:\n"
502: pending=
1.1 deraadt 503: column -t $TMP1
504: printf "\n"
505: cp $TMP1 $CUR
506: fi
507: fi
508:
509: # Check for block and character disk devices that are readable or writeable
510: # or not owned by root.operator.
511: >$TMP1
1.13 millert 512: DISKLIST="ccd dk fd hd hk hp jb kra ra rb rd rl rx rz sd up vnd wd xd"
1.1 deraadt 513: for i in $DISKLIST; do
1.11 tholo 514: egrep "^b.*/${i}[0-9][0-9]*[a-p]$" $LIST >> $TMP1
515: egrep "^c.*/r${i}[0-9][0-9]*[a-p]$" $LIST >> $TMP1
1.1 deraadt 516: done
517:
518: awk '$3 != "root" || $4 != "operator" || $1 !~ /.rw-r-----/ \
519: { printf("Disk %s is user %s, group %s, permissions %s.\n", \
520: $11, $3, $4, $1); }' < $TMP1 > $OUTPUT
521: if [ -s $OUTPUT ] ; then
522: printf "\nChecking disk ownership and permissions.\n"
523: cat $OUTPUT
524: printf "\n"
525: fi
526:
527: # Display any changes in the device file list.
528: egrep '^[bc]' $LIST | sort +10 > $TMP1
529: if [ -s $TMP1 ] ; then
530: CUR=/var/backups/device.current
531: BACK=/var/backups/device.backup
532:
533: if [ -s $CUR ] ; then
534: if cmp -s $CUR $TMP1 ; then
535: :
536: else
537: > $TMP2
538: join -111 -211 -v2 $CUR $TMP1 > $OUTPUT
539: if [ -s $OUTPUT ] ; then
540: printf "Device additions:\n"
541: tee -a $TMP2 < $OUTPUT
542: printf "\n"
543: fi
544:
545: join -111 -211 -v1 $CUR $TMP1 > $OUTPUT
546: if [ -s $OUTPUT ] ; then
547: printf "Device deletions:\n"
548: tee -a $TMP2 < $OUTPUT
549: printf "\n"
550: fi
551:
552: # Report any block device change. Ignore character
553: # devices, only the name is significant.
554: cat $TMP2 $CUR $TMP1 | \
555: sed -e '/^c/d' | \
556: sort +10 | \
557: sed -e 's/[ ][ ]*/ /g' | \
558: uniq -u > $OUTPUT
559: if [ -s $OUTPUT ] ; then
560: printf "Block device changes:\n"
561: column -t $OUTPUT
562: printf "\n"
563: fi
564:
565: cp $CUR $BACK
566: cp $TMP1 $CUR
567: fi
568: else
569: printf "Device additions:\n"
570: column -t $TMP1
571: printf "\n"
572: cp $TMP1 $CUR
573: fi
574: fi
575:
576: # Check special files.
577: # Check system binaries.
578: #
579: # Create the mtree tree specifications using:
580: #
581: # mtree -cx -pDIR -kcksum,gid,mode,nlink,size,link,time,uid > DIR.secure
1.2 deraadt 582: # chown root.wheel DIR.secure
583: # chmod 600 DIR.secure
1.1 deraadt 584: #
585: # Note, this is not complete protection against Trojan horsed binaries, as
586: # the hacker can modify the tree specification to match the replaced binary.
587: # For details on really protecting yourself against modified binaries, see
588: # the mtree(8) manual page.
1.13 millert 589: if [ -d /etc/mtree ] ; then
1.2 deraadt 590: cd /etc/mtree
1.1 deraadt 591: mtree -e -p / -f /etc/mtree/special > $OUTPUT
592: if [ -s $OUTPUT ] ; then
593: printf "\nChecking special files and directories.\n"
594: cat $OUTPUT
595: fi
596:
597: > $OUTPUT
598: for file in *.secure; do
1.2 deraadt 599: [ $file = '*.secure' ] && continue
1.1 deraadt 600: tree=`sed -n -e '3s/.* //p' -e 3q $file`
601: mtree -f $file -p $tree > $TMP1
1.13 millert 602: if [ -s $TMP1 ] ; then
1.1 deraadt 603: printf "\nChecking $tree:\n" >> $OUTPUT
604: cat $TMP1 >> $OUTPUT
605: fi
606: done
607: if [ -s $OUTPUT ] ; then
608: printf "\nChecking system binaries:\n"
609: cat $OUTPUT
610: fi
1.2 deraadt 611: else
612: echo /etc/mtree is missing
1.1 deraadt 613: fi
614:
615: # List of files that get backed up and checked for any modifications. Each
616: # file is expected to have two backups, /var/backups/file.{current,backup}.
617: # Any changes cause the files to rotate.
618: if [ -s /etc/changelist ] ; then
1.24 deraadt 619: for file in `egrep -v "^#|$MP" /etc/changelist`; do
1.1 deraadt 620: CUR=/var/backups/`basename $file`.current
621: BACK=/var/backups/`basename $file`.backup
1.13 millert 622: if [ -s $file ] ; then
1.1 deraadt 623: if [ -s $CUR ] ; then
624: diff $CUR $file > $OUTPUT
625: if [ -s $OUTPUT ] ; then
626: printf "\n======\n%s diffs (OLD < > NEW)\n======\n" $file
627: cat $OUTPUT
628: cp -p $CUR $BACK
629: cp -p $file $CUR
630: chown root.wheel $CUR $BACK
631: fi
632: else
633: cp -p $file $CUR
634: chown root.wheel $CUR
635: fi
636: fi
637: done
638: fi
![[BACK]](/icons/back.gif){kind=icon}
Return to security CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / etc