Annotation of src/etc/security, Revision 1.50
1.1 deraadt 1: #!/bin/sh -
2: #
1.50 ! pvalchev 3: # $OpenBSD: security,v 1.49 2001/10/01 16:52:18 jakob Exp $
1.13 millert 4: # from: @(#)security 8.1 (Berkeley) 6/9/93
1.1 deraadt 5: #
1.13 millert 6:
1.1 deraadt 7: PATH=/sbin:/usr/sbin:/bin:/usr/bin
8:
9: umask 077
10:
1.50 ! pvalchev 11: DIR=`mktemp -d /tmp/_secure.XXXXXX` || exit 1
1.7 deraadt 12: ERR=$DIR/_secure1
13: TMP1=$DIR/_secure2
14: TMP2=$DIR/_secure3
15: TMP3=$DIR/_secure4
16: LIST=$DIR/_secure5
17: OUTPUT=$DIR/_secure6
1.8 deraadt 18:
1.25 deraadt 19: trap 'rm -rf $DIR; exit 1' 0 1 2 3 13 15
1.1 deraadt 20:
21: # Check the master password file syntax.
22: MP=/etc/master.passwd
23: awk -F: '{
24: if ($0 ~ /^[ ]*$/) {
25: printf("Line %d is a blank line.\n", NR);
26: next;
27: }
28: if (NF != 10)
1.32 espie 29: printf("Line %d has the wrong number of fields:\n%s\n", NR, $0);
1.15 millert 30: if ($1 ~ /^[+-]/)
1.2 deraadt 31: next;
32: if ($1 == "")
1.32 espie 33: printf("Line %d has an empty login field:\n%s\n", NR, $0);
1.2 deraadt 34: else if ($1 !~ /^[A-Za-z0-9][A-Za-z0-9_-]*$/)
1.1 deraadt 35: printf("Login %s has non-alphanumeric characters.\n", $1);
1.48 brad 36: if (length($1) > 31)
37: printf("Login %s has more than 31 characters.\n", $1);
1.1 deraadt 38: if ($2 == "")
39: printf("Login %s has no password.\n", $1);
1.23 deraadt 40: if ($2 != "" && length($2) != 13 && ($10 ~ /.*sh$/ || $10 == "") &&
41: ($2 !~ /^\$[0-9a-f]+\$/) && ($2 != "skey")) {
1.26 millert 42: if (system("test -s /etc/skeykeys && grep -q \"^"$1" \" /etc/skeykeys") == 0)
1.23 deraadt 43: printf("Login %s is off but still has a valid shell and an entry in /etc/skeykeys.\n", $1);
44: if (system("test -d "$9" -a ! -r "$9"") == 0)
1.40 hugh 45: printf("Login %s is off but still has valid shell and home directory is unreadable\n\t by root; cannot check for existence of alternate access files.\n", $1);
1.23 deraadt 46: else if (system("for file in .ssh .rhosts .shosts .klogin; do if test -e "$9"/$file; then if ((ls -ld "$9"/$file | cut -b 2-10 | grep -q r) && (test ! -O "$9"/$file)) ; then exit 1; fi; fi; done"))
47: printf("Login %s is off but still has a valid shell and alternate access files in\n\t home directory are still readable.\n",$1);
48: }
1.9 deraadt 49: if ($3 == 0 && $1 != "root")
1.36 aaron 50: printf("Login %s has a user ID of 0.\n", $1);
1.1 deraadt 51: if ($3 < 0)
1.36 aaron 52: printf("Login %s has a negative user ID.\n", $1);
1.1 deraadt 53: if ($4 < 0)
1.36 aaron 54: printf("Login %s has a negative group ID.\n", $1);
1.1 deraadt 55: }' < $MP > $OUTPUT
56: if [ -s $OUTPUT ] ; then
1.41 millert 57: echo "\nChecking the ${MP} file:"
1.1 deraadt 58: cat $OUTPUT
59: fi
60:
61: awk -F: '{ print $1 }' $MP | sort | uniq -d > $OUTPUT
62: if [ -s $OUTPUT ] ; then
1.41 millert 63: echo "\n${MP} has duplicate user names."
1.1 deraadt 64: column $OUTPUT
65: fi
66:
1.47 millert 67: awk -F: '/^[^\+]/ { print $1 " " $3 }' $MP | sort -n +1 | tee $TMP1 |
1.1 deraadt 68: uniq -d -f 1 | awk '{ print $2 }' > $TMP2
69: if [ -s $TMP2 ] ; then
1.41 millert 70: echo "\n${MP} has duplicate user ID's."
1.1 deraadt 71: while read uid; do
72: grep -w $uid $TMP1
73: done < $TMP2 | column
74: fi
75:
76: # Backup the master password file; a special case, the normal backup
77: # mechanisms also print out file differences and we don't want to do
78: # that because this file has encrypted passwords in it.
1.2 deraadt 79: if [ ! -d /var/backups ] ; then
80: mkdir /var/backups
1.31 deraadt 81: chmod 700 /var/backups
1.2 deraadt 82: fi
1.1 deraadt 83: CUR=/var/backups/`basename $MP`.current
84: BACK=/var/backups/`basename $MP`.backup
85: if [ -s $CUR ] ; then
86: if cmp -s $CUR $MP; then
87: :
88: else
89: cp -p $CUR $BACK
90: cp -p $MP $CUR
91: chown root.wheel $CUR
92: fi
93: else
94: cp -p $MP $CUR
95: chown root.wheel $CUR
96: fi
97:
98: # Check the group file syntax.
99: GRP=/etc/group
100: awk -F: '{
101: if ($0 ~ /^[ ]*$/) {
102: printf("Line %d is a blank line.\n", NR);
103: next;
104: }
1.2 deraadt 105: if ($1 ~ /^[+-].*$/)
106: next;
1.1 deraadt 107: if (NF != 4)
1.32 espie 108: printf("Line %d has the wrong number of fields:\n%s\n", NR, $0);
1.13 millert 109: if ($1 !~ /^[A-za-z0-9][A-za-z0-9_-]*$/)
1.1 deraadt 110: printf("Group %s has non-alphanumeric characters.\n", $1);
1.48 brad 111: if (length($1) > 31)
112: printf("Group %s has more than 31 characters.\n", $1);
1.1 deraadt 113: if ($3 !~ /[0-9]*/)
1.36 aaron 114: printf("Login %s has a negative group ID.\n", $1);
1.1 deraadt 115: }' < $GRP > $OUTPUT
116: if [ -s $OUTPUT ] ; then
1.41 millert 117: echo "\nChecking the ${GRP} file:"
1.1 deraadt 118: cat $OUTPUT
119: fi
120:
121: awk -F: '{ print $1 }' $GRP | sort | uniq -d > $OUTPUT
122: if [ -s $OUTPUT ] ; then
1.41 millert 123: echo "\n${GRP} has duplicate group names."
1.1 deraadt 124: column $OUTPUT
125: fi
126:
127: # Check for root paths, umask values in startup files.
128: # The check for the root paths is problematical -- it's likely to fail
129: # in other environments. Once the shells have been modified to warn
130: # of '.' in the path, the path tests should go away.
131: > $OUTPUT
132: rhome=/root
133: umaskset=no
134: list="/etc/csh.cshrc /etc/csh.login ${rhome}/.cshrc ${rhome}/.login"
135: for i in $list ; do
1.15 millert 136: if [ -s $i ] ; then
1.1 deraadt 137: if egrep umask $i > /dev/null ; then
138: umaskset=yes
139: fi
140: egrep umask $i |
141: awk '$2 % 100 < 20 \
142: { print "Root umask is group writeable" }
143: $2 % 10 < 2 \
144: { print "Root umask is other writeable" }' >> $OUTPUT
1.21 deraadt 145: SAVE_PATH=$PATH
146: unset PATH
1.1 deraadt 147: /bin/csh -f -s << end-of-csh > /dev/null 2>&1
148: source $i
1.29 marc 149: if (\$?path) then
150: /bin/ls -ldgT \$path > $TMP1
151: else
152: cat /dev/null > $TMP1
153: endif
1.1 deraadt 154: end-of-csh
1.21 deraadt 155: PATH=$SAVE_PATH
1.1 deraadt 156: awk '{
157: if ($10 ~ /^\.$/) {
158: print "The root path includes .";
159: next;
160: }
161: }
162: $1 ~ /^d....w/ \
163: { print "Root path directory " $10 " is group writeable." } \
164: $1 ~ /^d.......w/ \
165: { print "Root path directory " $10 " is other writeable." }' \
166: < $TMP1 >> $OUTPUT
167: fi
168: done
169: if [ $umaskset = "no" -o -s $OUTPUT ] ; then
1.41 millert 170: echo "\nChecking root csh paths, umask values:\n${list}"
1.13 millert 171: if [ -s $OUTPUT ] ; then
1.1 deraadt 172: cat $OUTPUT
173: fi
174: if [ $umaskset = "no" ] ; then
1.41 millert 175: echo "\nRoot csh startup files do not set the umask."
1.1 deraadt 176: fi
177: fi
178:
179: > $OUTPUT
1.29 marc 180: > $TMP2
1.1 deraadt 181: rhome=/root
182: umaskset=no
1.20 millert 183: list="/etc/profile ${rhome}/.profile"
1.1 deraadt 184: for i in $list; do
1.15 millert 185: if [ -s $i ] ; then
1.1 deraadt 186: if egrep umask $i > /dev/null ; then
187: umaskset=yes
188: fi
189: egrep umask $i |
190: awk '$2 % 100 < 20 \
191: { print "Root umask is group writeable" } \
192: $2 % 10 < 2 \
193: { print "Root umask is other writeable" }' >> $OUTPUT
1.21 deraadt 194: SAVE_PATH=$PATH
1.29 marc 195: SAVE_ENV=$ENV
196: unset PATH ENV
1.1 deraadt 197: /bin/sh << end-of-sh > /dev/null 2>&1
198: . $i
1.29 marc 199: if [ X"\$PATH" != "X" ]; then
200: list=\`echo \$PATH | /usr/bin/sed -e 's/:/ /g'\`
201: /bin/ls -ldgT \$list > $TMP1
202: else
203: > $TMP1
204: fi
205: echo \$ENV >> $TMP2
1.1 deraadt 206: end-of-sh
1.21 deraadt 207: PATH=$SAVE_PATH
1.29 marc 208: ENV=$SAVE_ENV
1.1 deraadt 209: awk '{
210: if ($10 ~ /^\.$/) {
211: print "The root path includes .";
212: next;
213: }
214: }
215: $1 ~ /^d....w/ \
216: { print "Root path directory " $10 " is group writeable." } \
217: $1 ~ /^d.......w/ \
218: { print "Root path directory " $10 " is other writeable." }' \
219: < $TMP1 >> $OUTPUT
220:
221: fi
222: done
223: if [ $umaskset = "no" -o -s $OUTPUT ] ; then
1.41 millert 224: echo "\nChecking root sh paths, umask values:\n${list}"
1.13 millert 225: if [ -s $OUTPUT ] ; then
1.1 deraadt 226: cat $OUTPUT
227: fi
228: if [ $umaskset = "no" ] ; then
1.41 millert 229: echo "\nRoot sh startup files do not set the umask."
1.1 deraadt 230: fi
231: fi
232:
1.27 marc 233: # A good .kshrc will not have a umask or path, that being set in .profile
234: # check anyway.
235: > $OUTPUT
236: rhome=/root
1.29 marc 237: list="/etc/ksh.kshrc `cat $TMP2`"
238: (cd $rhome
239: for i in $list; do
1.27 marc 240: if [ -s $i ] ; then
241: egrep umask $i |
242: awk '$2 % 100 < 20 \
243: { print "Root umask is group writeable" } \
244: $2 % 10 < 2 \
245: { print "Root umask is other writeable" }' >> $OUTPUT
246: if egrep PATH= $i > /dev/null ; then
247: SAVE_PATH=$PATH
248: unset PATH
249: /bin/ksh << end-of-sh > /dev/null 2>&1
250: . $i
1.29 marc 251: if [ X"\$PATH" != "X" ]; then
252: list=\`echo \$PATH | /usr/bin/sed -e 's/:/ /g'\`
253: /bin/ls -ldgT \$list > $TMP1
254: else
255: > $TMP1
256: fi
1.27 marc 257: end-of-sh
258: PATH=$SAVE_PATH
259: awk '{
260: if ($10 ~ /^\.$/) {
261: print "The root path includes .";
262: next;
263: }
264: }
265: $1 ~ /^d....w/ \
266: { print "Root path directory " $10 " is group writeable." } \
267: $1 ~ /^d.......w/ \
268: { print "Root path directory " $10 " is other writeable." }' \
269: < $TMP1 >> $OUTPUT
270: fi
271:
272: fi
1.29 marc 273: done
274: )
1.27 marc 275: if [ -s $OUTPUT ] ; then
1.41 millert 276: echo "\nChecking root ksh paths, umask values:\n${list}"
1.27 marc 277: cat $OUTPUT
278: fi
279:
1.1 deraadt 280: # Root and uucp should both be in /etc/ftpusers.
281: if egrep root /etc/ftpusers > /dev/null ; then
282: :
283: else
1.41 millert 284: echo "\nRoot not listed in /etc/ftpusers file."
1.1 deraadt 285: fi
286: if egrep uucp /etc/ftpusers > /dev/null ; then
287: :
288: else
1.41 millert 289: echo "\nUucp not listed in /etc/ftpusers file."
1.1 deraadt 290: fi
291:
1.35 millert 292: # Uudecode should not be in the /etc/mail/aliases file.
293: if egrep 'uudecode|decode' /etc/mail/aliases; then
1.41 millert 294: echo "\nThere is an entry for uudecode in the /etc/mail/aliases file."
1.1 deraadt 295: fi
296:
297: # Files that should not have + signs.
1.2 deraadt 298: list="/etc/hosts.equiv /etc/shosts.equiv /etc/hosts.lpd"
1.1 deraadt 299: for f in $list ; do
1.6 millert 300: if [ -s $f ] ; then
1.2 deraadt 301: awk '{
1.13 millert 302: if ($0 ~ /^\+@.*$/)
1.2 deraadt 303: next;
1.13 millert 304: if ($0 ~ /^\+.*$/)
1.2 deraadt 305: printf("\nPlus sign in %s file.\n", FILENAME);
306: }' $f
1.1 deraadt 307: fi
308: done
309:
1.13 millert 310: # Check for special users with .rhosts/.shosts files. Only root
311: # should have .rhosts/.shosts files. Also, .rhosts/.shosts
312: # files should not have plus signs.
1.14 millert 313: awk -F: '$1 != "root" && $1 !~ /^[+-]/ && \
1.1 deraadt 314: ($3 < 100 || $1 == "ftp" || $1 == "uucp") \
315: { print $1 " " $6 }' /etc/passwd |
316: while read uid homedir; do
1.2 deraadt 317: for j in .rhosts .shosts; do
1.14 millert 318: # Root owned .rhosts/.shosts files are ok.
1.15 millert 319: if [ -s ${homedir}/$j -a ! -O ${homedir}/$j ] ; then
1.2 deraadt 320: rhost=`ls -ldgT ${homedir}/$j`
1.41 millert 321: echo "${uid}: ${rhost}"
1.2 deraadt 322: fi
323: done
1.1 deraadt 324: done > $OUTPUT
325: if [ -s $OUTPUT ] ; then
1.41 millert 326: echo "\nChecking for special users with .rhosts/.shosts files."
1.1 deraadt 327: cat $OUTPUT
328: fi
329:
1.14 millert 330: awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \
1.1 deraadt 331: while read uid homedir; do
1.2 deraadt 332: for j in .rhosts .shosts; do
1.13 millert 333: if [ -s ${homedir}/$j ] ; then
1.2 deraadt 334: awk '{
335: if ($0 ~ /^+@.*$/ )
336: next;
1.4 deraadt 337: if ($0 ~ /^\+[ ]*$/ )
1.2 deraadt 338: printf("%s has + sign in it.\n",
1.13 millert 339: FILENAME);
1.2 deraadt 340: }' ${homedir}/$j
341: fi
342: done
1.1 deraadt 343: done > $OUTPUT
344: if [ -s $OUTPUT ] ; then
1.41 millert 345: echo "\nChecking .rhosts/.shosts files syntax."
1.1 deraadt 346: cat $OUTPUT
347: fi
348:
349: # Check home directories. Directories should not be owned by someone else
350: # or writeable.
1.14 millert 351: awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \
1.1 deraadt 352: while read uid homedir; do
353: if [ -d ${homedir}/ ] ; then
354: file=`ls -ldgT ${homedir}`
1.41 millert 355: echo "${uid} ${file}"
1.1 deraadt 356: fi
357: done |
358: awk '$1 != $4 && $4 != "root" \
359: { print "user " $1 " home directory is owned by " $4 }
360: $2 ~ /^-....w/ \
361: { print "user " $1 " home directory is group writeable" }
362: $2 ~ /^-.......w/ \
363: { print "user " $1 " home directory is other writeable" }' > $OUTPUT
364: if [ -s $OUTPUT ] ; then
1.41 millert 365: echo "\nChecking home directories."
1.1 deraadt 366: cat $OUTPUT
367: fi
368:
369: # Files that should not be owned by someone else or readable.
1.43 todd 370: list=".netrc .rhosts .gnupg/secring.gpg .gnupg/random_seed \
1.45 millert 371: .pgp/secring.pgp .shosts .ssh/identity .ssh/id_dsa .ssh/id_rsa"
1.14 millert 372: awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \
1.1 deraadt 373: while read uid homedir; do
374: for f in $list ; do
375: file=${homedir}/${f}
376: if [ -f $file ] ; then
1.41 millert 377: echo "${uid} ${f} `ls -ldgT ${file}`"
1.1 deraadt 378: fi
379: done
380: done |
381: awk '$1 != $5 && $5 != "root" \
382: { print "user " $1 " " $2 " file is owned by " $5 }
1.13 millert 383: $3 ~ /^-...r/ \
384: { print "user " $1 " " $2 " file is group readable" }
1.1 deraadt 385: $3 ~ /^-......r/ \
386: { print "user " $1 " " $2 " file is other readable" }
387: $3 ~ /^-....w/ \
388: { print "user " $1 " " $2 " file is group writeable" }
389: $3 ~ /^-.......w/ \
390: { print "user " $1 " " $2 " file is other writeable" }' > $OUTPUT
391:
392: # Files that should not be owned by someone else or writeable.
1.28 todd 393: list=".bashrc .bash_profile .bash_login .bash_logout .cshrc \
394: .emacs .exrc .forward .fvwmrc .inputrc .klogin .kshrc .login \
395: .logout .nexrc .profile .screenrc .ssh .ssh/config \
1.45 millert 396: .ssh/authorized_keys .ssh/authorized_keys2 .ssh/environment \
397: .ssh/known_hosts .ssh/rc .tcshrc .twmrc .xsession .xinitrc \
398: .Xdefaults .Xauthority"
1.14 millert 399: awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \
1.1 deraadt 400: while read uid homedir; do
401: for f in $list ; do
402: file=${homedir}/${f}
403: if [ -f $file ] ; then
1.41 millert 404: echo "${uid} ${f} `ls -ldgT ${file}`"
1.1 deraadt 405: fi
406: done
407: done |
408: awk '$1 != $5 && $5 != "root" \
409: { print "user " $1 " " $2 " file is owned by " $5 }
410: $3 ~ /^-....w/ \
411: { print "user " $1 " " $2 " file is group writeable" }
412: $3 ~ /^-.......w/ \
413: { print "user " $1 " " $2 " file is other writeable" }' >> $OUTPUT
414: if [ -s $OUTPUT ] ; then
1.41 millert 415: echo "\nChecking dot files."
1.1 deraadt 416: cat $OUTPUT
417: fi
418:
419: # Mailboxes should be owned by user and unreadable.
420: ls -l /var/mail | sed 1d | \
421: awk '$3 != $9 \
422: { print "user " $9 " mailbox is owned by " $3 }
423: $1 != "-rw-------" \
424: { print "user " $9 " mailbox is " $1 ", group " $4 }' > $OUTPUT
425: if [ -s $OUTPUT ] ; then
1.41 millert 426: echo "\nChecking mailbox ownership."
1.1 deraadt 427: cat $OUTPUT
428: fi
429:
1.13 millert 430: # File systems should not be globally exported.
431: if [ -s /etc/exports ] ; then
432: awk '{
1.19 flipk 433: if (($1 ~ /^#/) || ($1 ~ /^$/))
1.1 deraadt 434: next;
1.13 millert 435: readonly = 0;
436: for (i = 2; i <= NF; ++i) {
1.19 flipk 437: if ($i ~ /^-ro$/)
1.13 millert 438: readonly = 1;
439: else if ($i !~ /^-/)
440: next;
441: }
442: if (readonly)
443: print "File system " $1 " globally exported, read-only."
444: else
445: print "File system " $1 " globally exported, read-write."
446: }' < /etc/exports > $OUTPUT
447: if [ -s $OUTPUT ] ; then
1.41 millert 448: echo "\nChecking for globally exported file systems."
1.13 millert 449: cat $OUTPUT
450: fi
1.1 deraadt 451: fi
452:
1.5 deraadt 453: # Display any changes in setuid/setgid files and devices.
454: pending="\nChecking setuid/setgid files and devices:\n"
1.1 deraadt 455: (find / \( ! -fstype local -o -fstype fdesc -o -fstype kernfs \
1.13 millert 456: -o -fstype procfs \) -a -prune -o \
457: -type f -a \( -perm -u+s -o -perm -g+s \) -print0 -o \
1.30 millert 458: ! -type d -a ! -type f -a ! -type l -a ! -type s -a ! -type p \
459: -print0 | xargs -0 ls -ldgT | sort +9 > $LIST) 2> $OUTPUT
1.1 deraadt 460:
461: # Display any errors that occurred during system file walk.
462: if [ -s $OUTPUT ] ; then
1.41 millert 463: echo "${pending}Setuid/device find errors:"
1.2 deraadt 464: pending=
1.1 deraadt 465: cat $OUTPUT
1.41 millert 466: echo ""
1.1 deraadt 467: fi
468:
1.12 millert 469: # Display any changes in the setuid/setgid file list.
1.13 millert 470: egrep -v '^[bc]' $LIST > $TMP1
1.1 deraadt 471: if [ -s $TMP1 ] ; then
472: # Check to make sure uudecode isn't setuid.
473: if grep -w uudecode $TMP1 > /dev/null ; then
1.41 millert 474: echo "${pending}\nUudecode is setuid."
1.2 deraadt 475: pending=
1.1 deraadt 476: fi
477:
478: CUR=/var/backups/setuid.current
479: BACK=/var/backups/setuid.backup
480:
481: if [ -s $CUR ] ; then
482: if cmp -s $CUR $TMP1 ; then
483: :
484: else
485: > $TMP2
1.13 millert 486: join -110 -210 -v2 $CUR $TMP1 > $OUTPUT
1.1 deraadt 487: if [ -s $OUTPUT ] ; then
1.41 millert 488: echo "${pending}Setuid additions:"
1.2 deraadt 489: pending=
1.1 deraadt 490: tee -a $TMP2 < $OUTPUT
1.41 millert 491: echo ""
1.1 deraadt 492: fi
493:
1.13 millert 494: join -110 -210 -v1 $CUR $TMP1 > $OUTPUT
1.1 deraadt 495: if [ -s $OUTPUT ] ; then
1.41 millert 496: echo "${pending}Setuid deletions:"
1.2 deraadt 497: pending=
1.1 deraadt 498: tee -a $TMP2 < $OUTPUT
1.41 millert 499: echo ""
1.1 deraadt 500: fi
501:
1.13 millert 502: sort +9 $TMP2 $CUR $TMP1 | \
1.1 deraadt 503: sed -e 's/[ ][ ]*/ /g' | uniq -u > $OUTPUT
504: if [ -s $OUTPUT ] ; then
1.41 millert 505: echo "${pending}Setuid changes:"
1.2 deraadt 506: pending=
1.1 deraadt 507: column -t $OUTPUT
1.41 millert 508: echo ""
1.1 deraadt 509: fi
510:
511: cp $CUR $BACK
512: cp $TMP1 $CUR
513: fi
514: else
1.41 millert 515: echo "${pending}Setuid additions:"
1.2 deraadt 516: pending=
1.1 deraadt 517: column -t $TMP1
1.41 millert 518: echo ""
1.1 deraadt 519: cp $TMP1 $CUR
520: fi
521: fi
522:
523: # Check for block and character disk devices that are readable or writeable
524: # or not owned by root.operator.
525: >$TMP1
1.13 millert 526: DISKLIST="ccd dk fd hd hk hp jb kra ra rb rd rl rx rz sd up vnd wd xd"
1.1 deraadt 527: for i in $DISKLIST; do
1.33 millert 528: egrep "^b.*/${i}[0-9][0-9]*[B-H]?[a-p]$" $LIST >> $TMP1
529: egrep "^c.*/r${i}[0-9][0-9]*[B-H]?[a-p]$" $LIST >> $TMP1
1.1 deraadt 530: done
531:
532: awk '$3 != "root" || $4 != "operator" || $1 !~ /.rw-r-----/ \
533: { printf("Disk %s is user %s, group %s, permissions %s.\n", \
534: $11, $3, $4, $1); }' < $TMP1 > $OUTPUT
535: if [ -s $OUTPUT ] ; then
1.41 millert 536: echo "\nChecking disk ownership and permissions."
1.1 deraadt 537: cat $OUTPUT
1.41 millert 538: echo ""
1.1 deraadt 539: fi
540:
541: # Display any changes in the device file list.
542: egrep '^[bc]' $LIST | sort +10 > $TMP1
543: if [ -s $TMP1 ] ; then
544: CUR=/var/backups/device.current
545: BACK=/var/backups/device.backup
546:
547: if [ -s $CUR ] ; then
548: if cmp -s $CUR $TMP1 ; then
549: :
550: else
551: > $TMP2
552: join -111 -211 -v2 $CUR $TMP1 > $OUTPUT
553: if [ -s $OUTPUT ] ; then
1.41 millert 554: echo "Device additions:"
1.1 deraadt 555: tee -a $TMP2 < $OUTPUT
1.41 millert 556: echo ""
1.1 deraadt 557: fi
558:
559: join -111 -211 -v1 $CUR $TMP1 > $OUTPUT
560: if [ -s $OUTPUT ] ; then
1.41 millert 561: echo "Device deletions:"
1.1 deraadt 562: tee -a $TMP2 < $OUTPUT
1.41 millert 563: echo ""
1.1 deraadt 564: fi
565:
566: # Report any block device change. Ignore character
567: # devices, only the name is significant.
568: cat $TMP2 $CUR $TMP1 | \
569: sed -e '/^c/d' | \
570: sort +10 | \
571: sed -e 's/[ ][ ]*/ /g' | \
572: uniq -u > $OUTPUT
573: if [ -s $OUTPUT ] ; then
1.41 millert 574: echo "Block device changes:"
1.1 deraadt 575: column -t $OUTPUT
1.41 millert 576: echo ""
1.1 deraadt 577: fi
578:
579: cp $CUR $BACK
580: cp $TMP1 $CUR
581: fi
582: else
1.41 millert 583: echo "Device additions:"
1.1 deraadt 584: column -t $TMP1
1.41 millert 585: echo ""
1.1 deraadt 586: cp $TMP1 $CUR
587: fi
588: fi
589:
590: # Check special files.
591: # Check system binaries.
592: #
593: # Create the mtree tree specifications using:
594: #
595: # mtree -cx -pDIR -kcksum,gid,mode,nlink,size,link,time,uid > DIR.secure
1.2 deraadt 596: # chown root.wheel DIR.secure
597: # chmod 600 DIR.secure
1.1 deraadt 598: #
599: # Note, this is not complete protection against Trojan horsed binaries, as
600: # the hacker can modify the tree specification to match the replaced binary.
601: # For details on really protecting yourself against modified binaries, see
602: # the mtree(8) manual page.
1.13 millert 603: if [ -d /etc/mtree ] ; then
1.2 deraadt 604: cd /etc/mtree
1.49 jakob 605: mtree -e -l -p / -f /etc/mtree/special > $OUTPUT
1.1 deraadt 606: if [ -s $OUTPUT ] ; then
1.41 millert 607: echo "\nChecking special files and directories."
608: echo "Output format is:\n\tfilename:"
609: echo "\t\tcriteria (shouldbe, reallyis)"
1.1 deraadt 610: cat $OUTPUT
611: fi
612:
613: > $OUTPUT
614: for file in *.secure; do
1.2 deraadt 615: [ $file = '*.secure' ] && continue
1.1 deraadt 616: tree=`sed -n -e '3s/.* //p' -e 3q $file`
617: mtree -f $file -p $tree > $TMP1
1.13 millert 618: if [ -s $TMP1 ] ; then
1.41 millert 619: echo "\nChecking ${tree}:" >> $OUTPUT
1.1 deraadt 620: cat $TMP1 >> $OUTPUT
621: fi
622: done
623: if [ -s $OUTPUT ] ; then
1.41 millert 624: echo "\nChecking system binaries:"
1.1 deraadt 625: cat $OUTPUT
626: fi
1.2 deraadt 627: else
628: echo /etc/mtree is missing
1.1 deraadt 629: fi
630:
631: # List of files that get backed up and checked for any modifications. Each
632: # file is expected to have two backups, /var/backups/file.{current,backup}.
633: # Any changes cause the files to rotate.
1.37 todd 634: _fnchg() {
635: echo "$1" | sed 's/^\///;s/\//_/g'
636: }
1.1 deraadt 637: if [ -s /etc/changelist ] ; then
1.46 millert 638: for file in `egrep -v "^(#|\+|$MP)" /etc/changelist`; do
1.37 todd 639: CUR=/var/backups/$(_fnchg "$file").current
640: BACK=/var/backups/$(_fnchg "$file").backup
641: if [ -s $file -a ! -d $file ] ; then
1.1 deraadt 642: if [ -s $CUR ] ; then
1.42 marc 643: diff -u $CUR $file > $OUTPUT
1.1 deraadt 644: if [ -s $OUTPUT ] ; then
1.42 marc 645: echo "\n======\n${file} diffs (-OLD +NEW)\n======"
1.1 deraadt 646: cat $OUTPUT
647: cp -p $CUR $BACK
648: cp -p $file $CUR
649: chown root.wheel $CUR $BACK
650: fi
651: else
652: cp -p $file $CUR
653: chown root.wheel $CUR
1.46 millert 654: fi
655: fi
656: done
657: for file in `egrep "^\+" /etc/changelist`; do
658: file="${file#+}"
659: CUR=/var/backups/$(_fnchg "$file").current.md5
660: BACK=/var/backups/$(_fnchg "$file").backup.md5
661: if [ -s $file -a ! -d $file ] ; then
662: MD5_NEW=`md5 $file | sed 's/^.* //'`
663: if [ -s $CUR ] ; then
664: MD5_OLD="`cat $CUR`"
665: if [ "$MD5_NEW" != "$MD5_OLD" ]; then
666: echo "\n======\n${file} MD5 checksums\n======"
667: echo "OLD: $MD5_OLD"
668: echo "NEW: $MD5_NEW"
669: cp -p $CUR $BACK
670: echo $MD5_NEW > $CUR
671: chown root.wheel $CUR $BACK
672: chmod 600 $CUR
673: fi
674: else
675: echo $MD5_NEW > $CUR
676: chown root.wheel $CUR
677: chmod 600 $CUR
1.1 deraadt 678: fi
679: fi
680: done
681: fi
![[BACK]](/icons/back.gif){kind=icon}
Return to security CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / etc