xref: /src/etc/security

#!/bin/sh -
#
#	$NetBSD: security,v 1.53 2001/05/10 14:10:15 atatat Exp $
#	from: @(#)security	8.1 (Berkeley) 6/9/93
#

PATH=/sbin:/usr/sbin:/bin:/usr/bin

if [ -f /etc/rc.subr ]; then
	. /etc/rc.subr
else
	echo "Can't read /etc/rc.subr; aborting."
	exit 1;
fi

umask 077

if [ -s /etc/security.conf ]; then
	. /etc/security.conf
fi

SECUREDIR=/tmp/_securedir.$$
if ! mkdir $SECUREDIR; then
	echo can not create $SECUREDIR.
	exit 1
fi

if ! cd $SECUREDIR; then
	echo can not chdir to $SECUREDIR.
	exit 1
fi

if [ -z "$max_loginlen" ];then
    max_loginlen=8
fi

if [ -z "$max_grouplen" ]; then
    max_grouplen=8
fi

ERR=secure1.$$
TMP1=secure2.$$
TMP2=secure3.$$
MPBYUID=secure4.$$
MPBYPATH=secure5.$$
LIST=secure6.$$
OUTPUT=secure7.$$
LABELS=secure8.$$

trap '/bin/rm -rf $SECUREDIR ; exit 0' 0 2 3

# Handle backup_dir not being set in .conf file
backup_dir=${backup_dir:-/var/backups}

MP=/etc/master.passwd

# these is used several times.
awk -F: '!/^+/ { print $1 " " $3 }' $MP | sort -k2n > $MPBYUID
awk -F: '{ print $1 " " $9 }' $MP | sort -k2 > $MPBYPATH

# Check the master password file syntax.
#
if checkyesno check_passwd; then
	awk -v "len=$max_loginlen" '
	BEGIN {
		while ( getline < "/etc/shells" > 0 ) {
			if ($0 ~ /^\#/ || $0 ~ /^$/ )
				continue;
			shells[$1]++;
		}
		FS=":";
	}

	{
		if ($0 ~ /^[	 ]*$/) {
			printf "Line %d is a blank line.\n", NR;
			next;
		}
		if (NF != 10 && ($1 != "+" || NF != 1))
			printf "Line %d has the wrong number of fields.\n", NR;
		if ($1 == "+" )  {
			if (NF != 1 && $3 == 0)
			    printf "Line %d includes entries with uid 0.\n", NR;
			next;
		}
		if ($1 !~ /^[A-Za-z0-9]([-A-Za-z0-9]*[A-Za-z0-9])*$/)
			printf "Login %s has non-alphanumeric characters.\n",
			    $1;
		if (length($1) > len)
			printf "Login %s has more than "len" characters.\n", $1;
		if ($2 == "")
			printf "Login %s has no password.\n", $1;
		if (length($2) != 13 && length($2) != 20 && length($2) != 34 && $2 != "") {
			if ($10 == "" || shells[$10])
		    printf "Login %s is off but still has a valid shell (%s)\n",
				    $1, $10;
		} else if (! shells[$10])
			printf "Login %s does not have a valid shell (%s)\n",
			    $1, $10;
		if ($3 == 0 && $1 != "root" && $1 != "toor")
			printf "Login %s has a user id of 0.\n", $1;
		if ($3 < 0)
			printf "Login %s has a negative user id.\n", $1;
		if ($4 < 0)
			printf "Login %s has a negative group id.\n", $1;
	}' < $MP > $OUTPUT
	if [ -s $OUTPUT ] ; then
		printf "\nChecking the $MP file:\n"
		cat $OUTPUT
	fi

	awk -F: '{ print $1 }' $MP | sort | uniq -d > $OUTPUT
	if [ -s $OUTPUT ] ; then
		printf "\n$MP has duplicate user names.\n"
		column $OUTPUT
	fi

# To not exclude 'toor', a standard duplicate root account, from the duplicate
# account test, uncomment the line below (without egrep in it)and comment
# out the line (with egrep in it) below it.
#
#	< $MPBYUID uniq -d -f 1 | awk '{ print $2 }' > $TMP2
	< $MPBYUID egrep -v '^toor ' | uniq -d -f 1 | awk '{ print $2 }' > $TMP2
	if [ -s $TMP2 ] ; then
		printf "\n$MP has duplicate user id's.\n"
		while read uid; do
			grep -w $uid $MPBYUID
		done < $TMP2 | column
	fi
fi

# Backup the master password file; a special case, the normal backup
# mechanisms also print out file differences and we don't want to do
# that because this file has encrypted passwords in it.
#
CUR=$backup_dir/${MP##*/}.current
BACK=$backup_dir/${MP##*/}.backup
if [ -s $CUR ] ; then
	if cmp -s $CUR $MP; then
		:
	else
		backup_file update $MP $CUR $BACK
	fi
else
	backup_file add $MP $CUR $BACK
fi

# Check the group file syntax.
#
if checkyesno check_group; then
	GRP=/etc/group
	awk -F: -v "len=$max_grouplen" '{
		if ($0 ~ /^[	 ]*$/) {
			printf "Line %d is a blank line.\n", NR;
			next;
		}
		if (NF != 4 && ($1 != "+" || NF != 1))
			printf "Line %d has the wrong number of fields.\n", NR;
		if ($1 == "+" )  {
			next;
		}
		if ($1 !~ /^[A-Za-z0-9]([-A-Za-z0-9]*[A-Za-z0-9])*$/)
			printf "Group %s has non-alphanumeric characters.\n",
			    $1;
		if (length($1) > len)
			printf "Group %s has more than "len" characters.\n", $1;
		if ($3 !~ /[0-9]*/)
			printf "Login %s has a negative group id.\n", $1;
	}' < $GRP > $OUTPUT
	if [ -s $OUTPUT ] ; then
		printf "\nChecking the $GRP file:\n"
		cat $OUTPUT
	fi

	awk -F: '{ print $1 }' $GRP | sort | uniq -d > $OUTPUT
	if [ -s $OUTPUT ] ; then
		printf "\n$GRP has duplicate group names.\n"
		column $OUTPUT
	fi
fi

# Check for root paths, umask values in startup files.
# The check for the root paths is problematical -- it's likely to fail
# in other environments.  Once the shells have been modified to warn
# of '.' in the path, the path tests should go away.
#
if checkyesno check_rootdotfiles; then
	> $OUTPUT
	rhome=`csh -fc "echo ~root"`
	umaskset=no
	list="/etc/csh.cshrc /etc/csh.login ${rhome}/.cshrc ${rhome}/.login"
	for i in $list ; do
		if [ -f $i ] ; then
			if egrep '^[ \t]*umask[ \t]+[0-7]+' $i > /dev/null ; then
				umaskset=yes
			fi
			# double check the umask value itself; ensure that both the
			# 020 and 002 bits are set.
			# we handle this in decimal initially to extract the digits,
			# and then extract the `2' bit of each digit.
			# this is made especially painful because 
			# bitwise operations were left out of awk.
			egrep '^[ \t]*umask[ \t]+[0-7]+' $i |
			awk '{ g= ($2 % 100) - ($2 % 10);
			       g /= 10;
			       g = g % 4;
			       g -= g % 2;
			       if (g != 2) { print "\tRoot umask is group writeable" }
			       o = ($2 % 10);
			       o = o % 4;
			       o -= o % 2;
			       if (o != 2) { print "\tRoot umask is other writeable" } }' |
			    sort -u >> $OUTPUT
			SAVE_PATH=$PATH
			unset PATH
			/bin/csh -f -s << end-of-csh > /dev/null 2>&1
				source $i
				/bin/ls -ldgT \$path > $TMP1
end-of-csh
			PATH=$SAVE_PATH
			awk '{
				if ($10 ~ /^\.$/) {
					print "\tThe root path includes .";
					next;
				}
			     }
			     $1 ~ /^d....w/ \
		{ print "\tRoot path directory " $10 " is group writeable." } \
			     $1 ~ /^d.......w/ \
		{ print "\tRoot path directory " $10 " is other writeable." }' \
			< $TMP1 >> $OUTPUT
		fi
	done
	if [ $umaskset = "no" -o -s $OUTPUT ] ; then
		printf "\nChecking root csh paths, umask values:\n$list\n\n"
		if [ -s $OUTPUT ]; then
			cat $OUTPUT
		fi
		if [ $umaskset = "no" ] ; then
		    printf "\tRoot csh startup files do not set the umask.\n"
		fi
	fi

	> $OUTPUT
	rhome=/root
	umaskset=no
	list="/etc/profile ${rhome}/.profile"
	for i in $list; do
		if [ -f $i ] ; then
			if egrep umask $i > /dev/null ; then
				umaskset=yes
			fi
			egrep umask $i |
			awk '$2 % 100 < 20 \
				{ print "\tRoot umask is group writeable" } \
			     $2 % 10 < 2 \
				{ print "\tRoot umask is other writeable" }' \
			    >> $OUTPUT
			SAVE_PATH=$PATH
			unset PATH
			/bin/sh << end-of-sh > /dev/null 2>&1
				. $i
				list=\`echo \$PATH | /usr/bin/sed -e \
				    's/^:/.:/;s/:$/:./;s/::/:.:/g;s/:/ /g'\`
				/bin/ls -ldgT \$list > $TMP1
end-of-sh
			PATH=$SAVE_PATH
			awk '{
				if ($10 ~ /^\.$/) {
					print "\tThe root path includes .";
					next;
				}
			     }
			     $1 ~ /^d....w/ \
		{ print "\tRoot path directory " $10 " is group writeable." } \
			     $1 ~ /^d.......w/ \
		{ print "\tRoot path directory " $10 " is other writeable." }' \
			< $TMP1 >> $OUTPUT

		fi
	done
	if [ $umaskset = "no" -o -s $OUTPUT ] ; then
		printf "\nChecking root sh paths, umask values:\n$list\n"
		if [ -s $OUTPUT ]; then
			cat $OUTPUT
		fi
		if [ $umaskset = "no" ] ; then
			printf "\tRoot sh startup files do not set the umask.\n"
		fi
	fi
fi

# Root and uucp should both be in /etc/ftpusers.
#
if checkyesno check_ftpusers; then
	> $OUTPUT
	list="uucp "`awk '$2 == 0 { print $1 }' $MPBYUID`
	for i in $list; do
		if /usr/libexec/ftpd -C $i ; then
			printf "\t$i is not denied\n" >> $OUTPUT
		fi
	done
	if [ -s $OUTPUT ]; then
		printf "\nChecking the /etc/ftpusers configuration:\n"
		cat $OUTPUT
	fi
fi

# Uudecode should not be in the /etc/mail/aliases file.
#
if checkyesno check_aliases; then
	for f in /etc/mail/aliases /etc/aliases; do
		if [ -f $f ] && egrep '^[^#]*(uudecode|decode).*\|' $f; then
			printf "\nEntry for uudecode in $f file.\n"
		fi
	done
fi

# Files that should not have + signs.
#
if checkyesno check_rhosts; then
	list="/etc/hosts.equiv /etc/hosts.lpd"
	for f in $list ; do
		if [ -f $f ] && egrep '\+' $f > /dev/null ; then
			printf "\nPlus sign in $f file.\n"
		fi
	done

	# Check for special users with .rhosts files.  Only root and toor should
	# have .rhosts files.  Also, .rhosts files should not have plus signs.
	awk -F: '$1 != "root" && $1 != "toor" && \
		($3 < 100 || $1 == "ftp" || $1 == "uucp") \
			{ print $1 " " $9 }' $MP |
	sort -k2 |
	while read uid homedir; do
		if [ -f ${homedir}/.rhosts ] ; then
			rhost=`ls -ldgT ${homedir}/.rhosts`
			printf -- "$uid: $rhost\n"
		fi
	done > $OUTPUT
	if [ -s $OUTPUT ] ; then
		printf "\nChecking for special users with .rhosts files.\n"
		cat $OUTPUT
	fi

	while read uid homedir; do
		if [ -f ${homedir}/.rhosts -a -r ${homedir}/.rhosts ] && \
		    cat -f ${homedir}/.rhosts | egrep '\+' > /dev/null ; then
			printf -- "$uid: + in .rhosts file.\n"
		fi
	done < $MPBYPATH > $OUTPUT
	if [ -s $OUTPUT ] ; then
		printf "\nChecking .rhosts files syntax.\n"
		cat $OUTPUT
	fi
fi

# Check home directories.  Directories should not be owned by someone else
# or writeable.
#
if checkyesno check_homes; then
	while read uid homedir; do
		if [ -d ${homedir}/ ] ; then
			file=`ls -ldgT ${homedir}`
			printf -- "$uid $file\n"
		fi
	done < $MPBYPATH |
	awk '$1 != $4 && $4 != "root" \
		{ print "user " $1 " home directory is owned by " $4 }
	     $2 ~ /^-....w/ \
		{ print "user " $1 " home directory is group writeable" }
	     $2 ~ /^-.......w/ \
		{ print "user " $1 " home directory is other writeable" }' \
	    > $OUTPUT
	if [ -s $OUTPUT ] ; then
		printf "\nChecking home directories.\n"
		cat $OUTPUT
	fi

	# Files that should not be owned by someone else or readable.
	list=".Xauthority .netrc"
	while read uid homedir; do
		for f in $list ; do
			file=${homedir}/${f}
			if [ -f $file ] ; then
				printf -- "$uid $f `ls -ldgT $file`\n"
			fi
		done
	done < $MPBYPATH |
	awk '$1 != $5 && $5 != "root" \
		{ print "user " $1 " " $2 " file is owned by " $5 }
	     $3 ~ /^-...r/ \
		{ print "user " $1 " " $2 " file is group readable" }
	     $3 ~ /^-......r/ \
		{ print "user " $1 " " $2 " file is other readable" }
	     $3 ~ /^-....w/ \
		{ print "user " $1 " " $2 " file is group writeable" }
	     $3 ~ /^-.......w/ \
		{ print "user " $1 " " $2 " file is other writeable" }' \
	    > $OUTPUT

	# Files that should not be owned by someone else or writeable.
	list=".bash_history .bash_login .bash_logout .bash_profile .bashrc \
	      .cshrc .emacs .exrc .forward .history .klogin .login .logout \
	      .profile .qmail .rc_history .rhosts .tcshrc .twmrc .xinitrc \
	      .xsession"
	while read uid homedir; do
		for f in $list ; do
			file=${homedir}/${f}
			if [ -f $file ] ; then
				printf -- "$uid $f `ls -ldgT $file`\n"
			fi
		done
	done < $MPBYPATH |
	awk '$1 != $5 && $5 != "root" \
		{ print "user " $1 " " $2 " file is owned by " $5 }
	     $3 ~ /^-....w/ \
		{ print "user " $1 " " $2 " file is group writeable" }
	     $3 ~ /^-.......w/ \
		{ print "user " $1 " " $2 " file is other writeable" }' \
	    >> $OUTPUT
	if [ -s $OUTPUT ] ; then
		printf "\nChecking dot files.\n"
		cat $OUTPUT
	fi
fi

# Mailboxes should be owned by user and unreadable.
#
if checkyesno check_varmail; then
	ls -l /var/mail | sed 1d | \
	awk '$3 != $9 \
		{ print "user " $9 " mailbox is owned by " $3 }
	     $1 != "-rw-------" \
		{ print "user " $9 " mailbox is " $1 ", group " $4 }' > $OUTPUT
	if [ -s $OUTPUT ] ; then
		printf "\nChecking mailbox ownership.\n"
		cat $OUTPUT
	fi
fi

# NFS exports shouldn't be globally exported
#
if checkyesno check_nfs && [ -f /etc/exports ]; then
	awk '{
		# ignore comments and blank lines
		if ($0 ~ /^\#/ || $0 ~ /^$/ )
			next;

		readonly = 0;
		for (i = 2; i <= NF; ++i) {
			if ($i ~ /-ro/)
				readonly = 1;
			else if ($i !~ /^-/)
				next;
		}
		if (readonly)
			print "File system " $1 " globally exported, read-only."
		else
			print "File system " $1 " globally exported, read-write."
	}' < /etc/exports > $OUTPUT
	if [ -s $OUTPUT ] ; then
		printf "\nChecking for globally exported file systems.\n"
		cat $OUTPUT
	fi
fi

# Display any changes in setuid files and devices.
#
if checkyesno check_devices; then
	> $ERR
	(find / \( ! -fstype local -o -fstype fdesc -o -fstype kernfs \
			-o -fstype procfs \) -a -prune -o \
	    \( \( -perm -u+s -a ! -type d \) -o \
	       \( -perm -g+s -a ! -type d \) -o \
	       -type b -o -type c \) -print0 | \
	xargs -0 ls -ldgTq | sort +9 > $LIST) 2> $OUTPUT

	# Display any errors that occurred during system file walk.
	if [ -s $OUTPUT ] ; then
		printf "Setuid/device find errors:\n" >> $ERR
		cat $OUTPUT >> $ERR
		printf "\n" >> $ERR
	fi

	# Display any changes in the setuid file list.
	egrep -v '^[bc]' $LIST > $TMP1
	if [ -s $TMP1 ] ; then
		# Check to make sure uudecode isn't setuid.
		if grep -w uudecode $TMP1 > /dev/null ; then
			printf "\nUudecode is setuid.\n" >> $ERR
		fi

		CUR=$backup_dir/setuid.current
		BACK=$backup_dir/setuid.backup

		if [ -s $CUR ] ; then
			if cmp -s $CUR $TMP1 ; then
				:
			else
				> $TMP2
				join -110 -210 -v2 $CUR $TMP1 > $OUTPUT
				if [ -s $OUTPUT ] ; then
					printf "Setuid additions:\n" >> $ERR
					tee -a $TMP2 < $OUTPUT >> $ERR
					printf "\n" >> $ERR
				fi

				join -110 -210 -v1 $CUR $TMP1 > $OUTPUT
				if [ -s $OUTPUT ] ; then
					printf "Setuid deletions:\n" >> $ERR
					tee -a $TMP2 < $OUTPUT >> $ERR
					printf "\n" >> $ERR
				fi

				sort -k10 $TMP2 $CUR $TMP1 | \
				    sed -e 's/[	 ][	 ]*/ /g' | \
				    uniq -u > $OUTPUT
				if [ -s $OUTPUT ] ; then
					printf "Setuid changes:\n" >> $ERR
					column -t $OUTPUT >> $ERR
					printf "\n" >> $ERR
				fi

				backup_file update $TMP1 $CUR $BACK
			fi
		else
			printf "Setuid additions:\n" >> $ERR
			column -t $TMP1 >> $ERR
			printf "\n" >> $ERR
			backup_file add $TMP1 $CUR $BACK
		fi
	fi

	# Check for block and character disk devices that are readable or
	# writeable or not owned by root.operator.
	>$TMP1
	DISKLIST="acd ccd cd ch fd hk hp mcd md ra rb rd rl rx rz \
	    sd se ss tz uk up vnd wd xd xy"
#	DISKLIST="$DISKLIST ct mt st wt"
	for i in $DISKLIST; do
		egrep "^b.*/${i}[0-9][0-9]*[a-p]$"  $LIST >> $TMP1
		egrep "^c.*/r${i}[0-9][0-9]*[a-p]$"  $LIST >> $TMP1
	done

	awk '$3 != "root" || $4 != "operator" || $1 !~ /.rw-r-----/ \
		{ printf "Disk %s is user %s, group %s, permissions %s.\n", \
		    $11, $3, $4, $1; }' < $TMP1 > $OUTPUT
	if [ -s $OUTPUT ] ; then
		printf "\nChecking disk ownership and permissions.\n" >> $ERR
		cat $OUTPUT >> $ERR
		printf "\n" >> $ERR
	fi

	# Display any changes in the device file list.
	egrep '^[bc]' $LIST | sort -k11 > $TMP1
	if [ -s $TMP1 ] ; then
		CUR=$backup_dir/device.current
		BACK=$backup_dir/device.backup

		if [ -s $CUR ] ; then
			if cmp -s $CUR $TMP1 ; then
				:
			else
				> $TMP2
				join -111 -211 -v2 $CUR $TMP1 > $OUTPUT
				if [ -s $OUTPUT ] ; then
					printf "Device additions:\n" >> $ERR
					tee -a $TMP2 < $OUTPUT >> $ERR
					printf "\n" >> $ERR
				fi

				join -111 -211 -v1 $CUR $TMP1 > $OUTPUT
				if [ -s $OUTPUT ] ; then
					printf "Device deletions:\n" >> $ERR
					tee -a $TMP2 < $OUTPUT >> $ERR
					printf "\n" >> $ERR
				fi

				# Report any block device change. Ignore
				# character devices, only the name is
				# significant.
				cat $TMP2 $CUR $TMP1 | \
				    sed -e '/^c/d' | \
				    sort -k11 | \
				    sed -e 's/[	 ][	 ]*/ /g' | \
				    uniq -u > $OUTPUT
				if [ -s $OUTPUT ] ; then
					printf "Block device changes:\n" >> $ERR
					column -t $OUTPUT >> $ERR
					printf "\n" >> $ERR
				fi

				backup_file update $TMP1 $CUR $BACK
			fi
		else
			printf "Device additions:\n" >> $ERR
			column -t $TMP1 >> $ERR
			printf "\n" >> $ERR
			backup_file add $TMP1 $CUR $BACK >> $ERR
		fi
	fi
	if [ -s $ERR ] ; then
		printf "\nChecking setuid files and devices:\n"
		cat $ERR
		printf "\n"
	fi
fi

# Check special files.
# Check system binaries.
#
# Create the mtree tree specifications using:
#
#	mtree -cx -pDIR -kcksum,gid,mode,nlink,size,link,time,uid > DIR.secure
#	chown root:wheel DIR.secure
#	chmod 600 DIR.secure
#
# Note, this is not complete protection against Trojan horsed binaries, as
# the hacker can modify the tree specification to match the replaced binary.
# For details on really protecting yourself against modified binaries, see
# the mtree(8) manual page.
#
if checkyesno check_mtree; then
	mtree -e -p / -f /etc/mtree/special > $OUTPUT
	if [ -s $OUTPUT ]; then
		printf "\nChecking special files and directories.\n"
		cat $OUTPUT
	fi

	> $OUTPUT
	for file in /etc/mtree/*.secure; do
		[ $file = '/etc/mtree/*.secure' ] && continue
		tree=`sed -n -e '3s/.* //p' -e 3q $file`
		mtree -f $file -p $tree > $TMP1
		if [ -s $TMP1 ]; then
			printf "\nChecking $tree:\n" >> $OUTPUT
			cat $TMP1 >> $OUTPUT
		fi
	done
	if [ -s $OUTPUT ]; then
		printf "\nChecking system binaries:\n"
		cat $OUTPUT
	fi
fi

CHANGELIST=""

# Backup disklabels of available disks
#
if checkyesno check_disklabels; then
		# generate list of old disklabels and remove them
	ls -1d $backup_dir/disklabel.* 2>/dev/null |
	    egrep -v '\.(backup|current)(,v)?$' > $LABELS
	xargs rm < $LABELS

	disks=`iostat -x | sed 1d | awk '$1 !~ /^[cfm]d/ { print $1; }'`
	for i in $disks; do
		dlf="$backup_dir/disklabel.$i"
		disklabel $i > $dlf 2>/dev/null
	done

		# append list of new disklabels, sort list
	ls -1d $backup_dir/disklabel.* 2>/dev/null |
	    egrep -v '\.(backup|current)(,v)?$' >> $LABELS
	sort -u -o $LABELS $LABELS
	CHANGELIST=$LABELS
fi

# List of files that get backed up and checked for any modifications.  Each
# file is expected to have two backups, $backup_dir/file.{current,backup}.
# Any changes cause the files to rotate.
#
if checkyesno check_changelist && [ -s /etc/changelist ] ; then
	CHANGELIST="/etc/changelist $CHANGELIST"
fi

if [ -n "$CHANGELIST" ]; then
	for file in `egrep -hv "^#|$MP" $CHANGELIST`; do
		CUR=$backup_dir/${file##*/}.current
		BACK=$backup_dir/${file##*/}.backup
		if [ -f $file ]; then
			if [ -f $CUR ] ; then
				diff $CUR $file > $OUTPUT
				if [ -s $OUTPUT ] ; then
		printf "\n======\n%s diffs (OLD < > NEW)\n======\n" $file
					cat $OUTPUT
					backup_file update $file $CUR $BACK
				fi
			else
		printf "\n======\n%s added\n======\n" $file
				diff /dev/null $file
				backup_file add $file $CUR $BACK
			fi
		else
			if [ -f $CUR ]; then
		printf "\n======\n%s removed\n======\n" $file
				diff $CUR /dev/null
				backup_file remove $file $CUR $BACK
			fi
		fi
	done
fi

if [ -f /etc/security.local ]; then
	echo ""
	echo "Running /etc/security.local:"
	. /etc/security.local
fi