Annotation of src/etc/daily, Revision 1.98
1.1 deraadt 1: #
1.98 ! solene 2: # $OpenBSD: daily,v 1.97 2023/03/03 16:22:57 bluhm Exp $
1.17 millert 3: # From: @(#)daily 8.2 (Berkeley) 1/25/94
1.1 deraadt 4: #
1.65 schwarze 5: # For local additions, create the file /etc/daily.local.
6: # To get section headers, use the function next_part in daily.local.
7: #
1.56 ajacouto 8: umask 022
1.47 nick 9:
1.58 schwarze 10: PARTOUT=/var/log/daily.part
11: MAINOUT=/var/log/daily.out
12: install -o 0 -g 0 -m 600 /dev/null $PARTOUT
13: install -o 0 -g 0 -m 600 -b /dev/null $MAINOUT
14:
15: start_part() {
16: TITLE=$1
17: exec > $PARTOUT 2>&1
18: }
19:
20: end_part() {
21: exec >> $MAINOUT 2>&1
22: test -s $PARTOUT || return
1.2 david 23: echo ""
1.58 schwarze 24: echo "$TITLE"
25: cat $PARTOUT
26: }
27:
28: next_part() {
29: end_part
30: start_part "$1"
31: }
1.2 david 32:
1.58 schwarze 33: run_script() {
34: f=/etc/$1
35: test -e $f || return
36: if [ `stat -f '%Sp%u' $f | cut -b1,6,9,11-` != '---0' ]; then
37: echo "$f has insecure permissions, skipping:"
38: ls -l $f
39: return
40: fi
41: . $f
1.42 pvalchev 42: }
1.16 millert 43:
1.59 schwarze 44: start_part "Running daily.local:"
1.58 schwarze 45: run_script "daily.local"
1.14 millert 46:
1.58 schwarze 47: next_part "Removing scratch and junk files:"
1.32 aaron 48: if [ -d /tmp -a ! -L /tmp ]; then
1.17 millert 49: cd /tmp && {
1.50 millert 50: find -x . \
1.67 espie 51: \( -path './ssh-*' -o -path ./.X11-unix -o -path ./.ICE-unix \
1.96 sthen 52: -o -path './tmux-*' \) -prune -o \
53: -type f -and ! -path './*.shm' -atime +7 -delete 2>/dev/null
1.49 millert 54: find -x . -type d -mtime +1 ! -path ./vi.recover ! -path ./.X11-unix \
1.84 rpe 55: ! -path ./.ICE-unix ! -name . \
1.94 millert 56: -delete >/dev/null 2>&1; }
1.17 millert 57: fi
1.1 deraadt 58:
1.3 deraadt 59: # Additional junk directory cleanup would go like this:
1.32 aaron 60: #if [ -d /scratch -a ! -L /scratch ]; then
1.3 deraadt 61: # cd /scratch && {
1.94 millert 62: # find . ! -name . -atime +1 -delete
63: # find . ! -name . -type d -mtime +1 -delete \
1.3 deraadt 64: # >/dev/null 2>&1; }
65: #fi
1.1 deraadt 66:
1.58 schwarze 67: next_part "Purging accounting records:"
1.1 deraadt 68: if [ -f /var/account/acct ]; then
1.90 bluhm 69: test -f /var/account/acct.2 && \
70: mv -f /var/account/acct.2 /var/account/acct.3
71: test -f /var/account/acct.1 && \
72: mv -f /var/account/acct.1 /var/account/acct.2
73: test -f /var/account/acct.0 && \
74: mv -f /var/account/acct.0 /var/account/acct.1
1.44 mickey 75: cp -f /var/account/acct /var/account/acct.0
1.17 millert 76: sa -sq
1.97 bluhm 77: lastcomm -f /var/account/acct.0 | grep -e ' -[A-Z]*[EMPTU]'
1.17 millert 78: fi
79:
80: # If ROOTBACKUP is set to 1 in the environment, and
1.73 krw 81: # if filesystem named /altroot is type ffs and mounted "xx",
1.17 millert 82: # use it as a backup root filesystem to be updated daily.
1.58 schwarze 83: next_part "Backing up root filesystem:"
1.64 schwarze 84: while [ "X$ROOTBACKUP" = X1 ]; do
1.74 krw 85: rootbak=`awk '$1 !~ /^#/ && $2 == "/altroot" && $3 == "ffs" && \
86: $4 ~ /xx/ { print $1 }' < /etc/fstab`
1.64 schwarze 87: if [ -z "$rootbak" ]; then
88: echo "No xx ffs /altroot device found in the fstab(5)."
89: break
90: fi
1.73 krw 91: rootbak=${rootbak#/dev/}
92: bakdisk=${rootbak%%?(.)[a-p]}
1.91 tb 93: if ! sysctl -n hw.disknames | grep -Fqw $bakdisk; then
94: echo "Backup disk '$bakdisk' not present in hw.disknames."
95: break
96: fi
1.73 krw 97: bakpart=${rootbak##$bakdisk?(.)}
1.74 krw 98: OLDIFS=$IFS
99: IFS=,
100: for d in `sysctl -n hw.disknames`; do
101: # If the provided disk name is a duid, substitute the device.
1.77 deraadt 102: if [ X$bakdisk = X${d#*:} ]; then
1.74 krw 103: bakdisk=${d%:*}
104: rootbak=$bakdisk$bakpart
105: fi
106: done
107: IFS=$OLDIFS
1.64 schwarze 108: baksize=`disklabel $bakdisk 2>/dev/null | \
109: awk -v "part=$bakpart:" '$1 == part { print $2 }'`
110: rootdev=`mount | awk '$3 == "/" && $1 ~ /^\/dev\// && $5 == "ffs" \
111: { print substr($1, 6) }'`
112: if [ -z "$rootdev" ]; then
113: echo "The root filesystem is not local or not ffs."
114: break
115: fi
116: if [ X$rootdev = X$rootbak ]; then
117: echo "The device $rootdev holds both root and /altroot."
118: break
119: fi
120: rootdisk=${rootdev%[a-p]}
121: rootpart=${rootdev#$rootdisk}
122: rootsize=`disklabel $rootdisk 2>/dev/null | \
123: awk -v "part=$rootpart:" '$1 == part { print $2 }'`
124: if [ $rootsize -gt $baksize ]; then
125: echo "Root ($rootsize) is larger than /altroot ($baksize)."
126: break
127: fi
128: next_part "Backing up root=/dev/r$rootdev to /dev/r$rootbak:"
129: sync
130: dd if=/dev/r$rootdev of=/dev/r$rootbak bs=16b seek=1 skip=1 \
131: conv=noerror
132: fsck -y /dev/r$rootbak
133: break
134: done
1.85 schwarze 135:
1.87 ajacouto 136: next_part "Services that should be running but aren't:"
1.86 ajacouto 137: rcctl ls failed
1.98 ! solene 138:
! 139: next_part "Services that are running but shouldn't:"
! 140: rcctl ls rogue
1.1 deraadt 141:
1.95 danj 142: next_part "Filesystems which need to be dumped:"
143: dump w | grep -vB1 ^Dump
1.38 millert 144:
1.58 schwarze 145: next_part "Running calendar in the background:"
146: if [ "X$CALENDAR" != X0 -a \
147: \( -d /var/yp/`domainname` -o ! -d /var/yp/binding \) ]; then
1.38 millert 148: calendar -a &
1.14 millert 149: fi
1.1 deraadt 150:
1.17 millert 151: # If CHECKFILESYSTEMS is set to 1 in the environment, run fsck
152: # with the no-write flag.
1.58 schwarze 153: next_part "Checking filesystems:"
1.17 millert 154: [ "X$CHECKFILESYSTEMS" = X1 ] && {
155: fsck -n | grep -v '^\*\* Phase'
156: }
1.1 deraadt 157:
1.58 schwarze 158: next_part "Running rdist:"
1.1 deraadt 159: if [ -f /etc/Distfile ]; then
1.17 millert 160: if [ -d /var/log/rdist ]; then
1.66 schwarze 161: rdist -f /etc/Distfile 2>&1 | tee /var/log/rdist/`date +%F`
1.17 millert 162: else
1.39 deraadt 163: rdist -f /etc/Distfile
1.17 millert 164: fi
1.1 deraadt 165: fi
166:
1.58 schwarze 167: end_part
1.61 schwarze 168: [ -s $MAINOUT ] && {
169: sysctl -n kern.version
170: uptime
171: cat $MAINOUT
172: } 2>&1 | mail -s "`hostname` daily output" root
1.58 schwarze 173:
174:
175: MAINOUT=/var/log/security.out
176: install -o 0 -g 0 -m 600 -b /dev/null $MAINOUT
177:
1.70 schwarze 178: start_part "Running security(8):"
1.71 schwarze 179: export SUIDSKIP
1.70 schwarze 180: /usr/libexec/security
1.58 schwarze 181: end_part
182: rm -f $PARTOUT
183:
184: [ -s $MAINOUT ] && mail -s "`hostname` daily insecurity output" root < $MAINOUT
![[BACK]](/icons/back.gif){kind=icon}
Return to daily CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / etc