security revision 1.28
1 #!/bin/sh - 2 # 3 # $NetBSD: security,v 1.28 1997/09/18 05:16:19 lukem Exp $ 4 # from: @(#)security 8.1 (Berkeley) 6/9/93 5 # 6 7 PATH=/sbin:/usr/sbin:/bin:/usr/bin 8 9 umask 077 10 11 if [ -s /etc/security.conf ]; then 12 . /etc/security.conf 13 fi 14 15 SECUREDIR=/tmp/_securedir.$$ 16 if ! mkdir $SECUREDIR; then 17 echo can not create $SECUREDIR. 18 exit 1 19 fi 20 21 if ! cd $SECUREDIR; then 22 echo can not chdir to $SECUREDIR. 23 exit 1 24 fi 25 26 ERR=secure1.$$ 27 TMP1=secure2.$$ 28 TMP2=secure3.$$ 29 MPBYUID=secure4.$$ 30 MPPATH=secure5.$$ 31 LIST=secure6.$$ 32 OUTPUT=secure7.$$ 33 34 trap '/bin/rm -rf $SECUREDIR ; exit 0' 0 2 3 35 36 MP=/etc/master.passwd 37 38 # these is used several times. 39 awk -F: '{ print $1 " " $3 }' $MP | sort -k2n > $MPBYUID 40 awk -F: '{ print $1 " " $9 }' $MP | sort -k2 > $MPPATH 41 42 # Check the master password file syntax. 43 if [ "$check_passwd" = YES ]; then 44 awk ' 45 BEGIN { 46 while ( getline < "/etc/shells" > 0 ) { 47 if ($LINE ~ /^\#/ || $LINE ~ /^$/ ) 48 continue; 49 shells[$1]++; 50 } 51 FS=":"; 52 } 53 54 { 55 if ($0 ~ /^[ ]*$/) { 56 printf "Line %d is a blank line.\n", NR; 57 next; 58 } 59 if (NF != 10) 60 printf "Line %d has the wrong number of fields.\n", NR; 61 if ($1 !~ /^[A-Za-z0-9]*$/) 62 printf "Login %s has non-alphanumeric characters.\n", 63 $1; 64 if (length($1) > 8) 65 printf "Login %s has more than 8 characters.\n", $1; 66 if ($2 == "") 67 printf "Login %s has no password.\n", $1; 68 if (length($2) != 13 && $2 != "") { 69 if ($10 == "" || shells[$10]) 70 printf "Login %s is off but still has a valid shell (%s)\n", 71 $1, $10; 72 } else if (! shells[$10]) 73 printf "Login %s does not have a valid shell (%s)\n", 74 $1, $10; 75 if ($3 == 0 && $1 != "root" && $1 != "toor") 76 printf "Login %s has a user id of 0.\n", $1; 77 if ($3 < 0) 78 printf "Login %s has a negative user id.\n", $1; 79 if ($4 < 0) 80 printf "Login %s has a negative group id.\n", $1; 81 }' < $MP > $OUTPUT 82 if [ -s $OUTPUT ] ; then 83 printf "\nChecking the $MP file:\n" 84 cat $OUTPUT 85 fi 86 87 awk -F: '{ print $1 }' $MP | sort | uniq -d > $OUTPUT 88 if [ -s $OUTPUT ] ; then 89 printf "\n$MP has duplicate user names.\n" 90 column $OUTPUT 91 fi 92 93 < $MPBYUID uniq -d -f 1 | awk '{ print $2 }' > $TMP2 94 if [ -s $TMP2 ] ; then 95 printf "\n$MP has duplicate user id's.\n" 96 while read uid; do 97 grep -w $uid $MPBYUID 98 done < $TMP2 | column 99 fi 100 fi 101 102 # Backup the master password file; a special case, the normal backup 103 # mechanisms also print out file differences and we don't want to do 104 # that because this file has encrypted passwords in it. 105 CUR=/var/backups/`basename $MP`.current 106 BACK=/var/backups/`basename $MP`.backup 107 if [ -s $CUR ] ; then 108 if cmp -s $CUR $MP; then 109 : 110 else 111 cp -p $CUR $BACK 112 cp -p $MP $CUR 113 chown root.wheel $CUR 114 fi 115 else 116 cp -p $MP $CUR 117 chown root.wheel $CUR 118 fi 119 120 # Check the group file syntax. 121 if [ "$check_group" = YES ]; then 122 GRP=/etc/group 123 awk -F: '{ 124 if ($0 ~ /^[ ]*$/) { 125 printf "Line %d is a blank line.\n", NR; 126 next; 127 } 128 if (NF != 4) 129 printf "Line %d has the wrong number of fields.\n", NR; 130 if ($1 !~ /^[A-za-z0-9]*$/) 131 printf "Group %s has non-alphanumeric characters.\n", 132 $1; 133 if (length($1) > 8) 134 printf "Group %s has more than 8 characters.\n", $1; 135 if ($3 !~ /[0-9]*/) 136 printf "Login %s has a negative group id.\n", $1; 137 }' < $GRP > $OUTPUT 138 if [ -s $OUTPUT ] ; then 139 printf "\nChecking the $GRP file:\n" 140 cat $OUTPUT 141 fi 142 143 awk -F: '{ print $1 }' $GRP | sort | uniq -d > $OUTPUT 144 if [ -s $OUTPUT ] ; then 145 printf "\n$GRP has duplicate group names.\n" 146 column $OUTPUT 147 fi 148 fi 149 150 # Check for root paths, umask values in startup files. 151 # The check for the root paths is problematical -- it's likely to fail 152 # in other environments. Once the shells have been modified to warn 153 # of '.' in the path, the path tests should go away. 154 if [ "$check_rootdotfiles" = YES ]; then 155 > $OUTPUT 156 rhome=`csh -fc "echo ~root"` 157 umaskset=no 158 list="/etc/csh.cshrc /etc/csh.login ${rhome}/.cshrc ${rhome}/.login" 159 for i in $list ; do 160 if [ -f $i ] ; then 161 if egrep umask $i > /dev/null ; then 162 umaskset=yes 163 fi 164 egrep umask $i | 165 awk '$2 % 100 < 20 \ 166 { print "\tRoot umask is group writeable" } 167 $2 % 10 < 2 \ 168 { print "\tRoot umask is other writeable" }' \ 169 >> $OUTPUT 170 SAVE_PATH=$PATH 171 unset PATH 172 /bin/csh -f -s << end-of-csh > /dev/null 2>&1 173 source $i 174 /bin/ls -ldgT \$path > $TMP1 175 end-of-csh 176 PATH=$SAVE_PATH 177 awk '{ 178 if ($10 ~ /^\.$/) { 179 print "\tThe root path includes ."; 180 next; 181 } 182 } 183 $1 ~ /^d....w/ \ 184 { print "\tRoot path directory " $10 " is group writeable." } \ 185 $1 ~ /^d.......w/ \ 186 { print "\tRoot path directory " $10 " is other writeable." }' \ 187 < $TMP1 >> $OUTPUT 188 fi 189 done 190 if [ $umaskset = "no" -o -s $OUTPUT ] ; then 191 printf "\nChecking root csh paths, umask values:\n$list\n\n" 192 if [ -s $OUTPUT ]; then 193 cat $OUTPUT 194 fi 195 if [ $umaskset = "no" ] ; then 196 printf "\tRoot csh startup files do not set the umask.\n" 197 fi 198 fi 199 200 > $OUTPUT 201 rhome=/root 202 umaskset=no 203 list="/etc/profile ${rhome}/.profile" 204 for i in $list; do 205 if [ -f $i ] ; then 206 if egrep umask $i > /dev/null ; then 207 umaskset=yes 208 fi 209 egrep umask $i | 210 awk '$2 % 100 < 20 \ 211 { print "\tRoot umask is group writeable" } \ 212 $2 % 10 < 2 \ 213 { print "\tRoot umask is other writeable" }' \ 214 >> $OUTPUT 215 SAVE_PATH=$PATH 216 unset PATH 217 /bin/sh << end-of-sh > /dev/null 2>&1 218 . $i 219 list=\`echo \$PATH | /usr/bin/sed -e \ 220 's/^:/.:/;s/:$/:./;s/::/:.:/g;s/:/ /g'\` 221 /bin/ls -ldgT \$list > $TMP1 222 end-of-sh 223 PATH=$SAVE_PATH 224 awk '{ 225 if ($10 ~ /^\.$/) { 226 print "\tThe root path includes ."; 227 next; 228 } 229 } 230 $1 ~ /^d....w/ \ 231 { print "\tRoot path directory " $10 " is group writeable." } \ 232 $1 ~ /^d.......w/ \ 233 { print "\tRoot path directory " $10 " is other writeable." }' \ 234 < $TMP1 >> $OUTPUT 235 236 fi 237 done 238 if [ $umaskset = "no" -o -s $OUTPUT ] ; then 239 printf "\nChecking root sh paths, umask values:\n$list\n" 240 if [ -s $OUTPUT ]; then 241 cat $OUTPUT 242 fi 243 if [ $umaskset = "no" ] ; then 244 printf "\tRoot sh startup files do not set the umask.\n" 245 fi 246 fi 247 fi 248 249 # Root and uucp should both be in /etc/ftpusers. 250 # XXX This should be updated to support the new format... 251 if [ "$check_ftpusers" = YES ]; then 252 > $OUTPUT 253 list="uucp "`awk '$2 == 0 { print $1 }' $MPBYUID` 254 for i in $list; do 255 if ! egrep "^$i$" /etc/ftpusers > /dev/null ; then 256 printf "\t$i is not present\n" \ >> $OUTPUT 257 fi 258 done 259 if [ -s $OUTPUT ]; then 260 printf "\nChecking the /etc/ftpusers configuration:\n" 261 cat $OUTPUT 262 fi 263 fi 264 265 # Uudecode should not be in the /etc/aliases file. 266 if [ "$check_aliases" = YES ]; then 267 if egrep '^[^#]*(uudecode|decode).*\|' /etc/aliases; then 268 printf "\nEntry for uudecode in /etc/aliases file.\n" 269 fi 270 fi 271 272 # Files that should not have + signs. 273 if [ "$check_rhosts" = YES ]; then 274 list="/etc/hosts.equiv /etc/hosts.lpd" 275 for f in $list ; do 276 if [ -f $f ] && egrep '\+' $f > /dev/null ; then 277 printf "\nPlus sign in $f file.\n" 278 fi 279 done 280 281 # Check for special users with .rhosts files. Only root and toor should 282 # have .rhosts files. Also, .rhosts files should not have plus signs. 283 awk -F: '$1 != "root" && $1 != "toor" && \ 284 ($3 < 100 || $1 == "ftp" || $1 == "uucp") \ 285 { print $1 " " $9 }' $MP | 286 sort -k2 | 287 while read uid homedir; do 288 if [ -f ${homedir}/.rhosts ] ; then 289 rhost=`ls -ldgT ${homedir}/.rhosts` 290 printf "$uid: $rhost\n" 291 fi 292 done > $OUTPUT 293 if [ -s $OUTPUT ] ; then 294 printf "\nChecking for special users with .rhosts files.\n" 295 cat $OUTPUT 296 fi 297 298 while read uid homedir; do 299 if [ -f ${homedir}/.rhosts ] && \ 300 egrep '\+' ${homedir}/.rhosts > /dev/null ; then 301 printf "$uid: + in .rhosts file.\n" 302 fi 303 done < $MPPATH > $OUTPUT 304 if [ -s $OUTPUT ] ; then 305 printf "\nChecking .rhosts files syntax.\n" 306 cat $OUTPUT 307 fi 308 fi 309 310 # Check home directories. Directories should not be owned by someone else 311 # or writeable. 312 if [ "$check_homes" = YES ]; then 313 while read uid homedir; do 314 if [ -d ${homedir}/ ] ; then 315 file=`ls -ldgT ${homedir}` 316 printf "$uid $file\n" 317 fi 318 done < $MPPATH | 319 awk '$1 != $4 && $4 != "root" \ 320 { print "user " $1 " home directory is owned by " $4 } 321 $2 ~ /^-....w/ \ 322 { print "user " $1 " home directory is group writeable" } 323 $2 ~ /^-.......w/ \ 324 { print "user " $1 " home directory is other writeable" }' \ 325 > $OUTPUT 326 if [ -s $OUTPUT ] ; then 327 printf "\nChecking home directories.\n" 328 cat $OUTPUT 329 fi 330 331 # Files that should not be owned by someone else or readable. 332 list=".Xauthority .netrc" 333 while read uid homedir; do 334 for f in $list ; do 335 file=${homedir}/${f} 336 if [ -f $file ] ; then 337 printf "$uid $f `ls -ldgT $file`\n" 338 fi 339 done 340 done < $MPPATH | 341 awk '$1 != $5 && $5 != "root" \ 342 { print "user " $1 " " $2 " file is owned by " $5 } 343 $3 ~ /^-...r/ \ 344 { print "user " $1 " " $2 " file is group readable" } 345 $3 ~ /^-......r/ \ 346 { print "user " $1 " " $2 " file is other readable" } 347 $3 ~ /^-....w/ \ 348 { print "user " $1 " " $2 " file is group writeable" } 349 $3 ~ /^-.......w/ \ 350 { print "user " $1 " " $2 " file is other writeable" }' \ 351 > $OUTPUT 352 353 # Files that should not be owned by someone else or writeable. 354 list=".bash_history .bash_login .bash_logout .bash_profile .bashrc \ 355 .cshrc .emacs .exrc .forward .history .klogin .login .logout \ 356 .profile .qmail .rc_history .rhosts .tcshrc .twmrc .xinitrc \ 357 .xsession" 358 while read uid homedir; do 359 for f in $list ; do 360 file=${homedir}/${f} 361 if [ -f $file ] ; then 362 printf "$uid $f `ls -ldgT $file`\n" 363 fi 364 done 365 done < $MPPATH | 366 awk '$1 != $5 && $5 != "root" \ 367 { print "user " $1 " " $2 " file is owned by " $5 } 368 $3 ~ /^-....w/ \ 369 { print "user " $1 " " $2 " file is group writeable" } 370 $3 ~ /^-.......w/ \ 371 { print "user " $1 " " $2 " file is other writeable" }' \ 372 >> $OUTPUT 373 if [ -s $OUTPUT ] ; then 374 printf "\nChecking dot files.\n" 375 cat $OUTPUT 376 fi 377 fi 378 379 # Mailboxes should be owned by user and unreadable. 380 if [ "$check_varmail" = YES ]; then 381 ls -l /var/mail | sed 1d | \ 382 awk '$3 != $9 \ 383 { print "user " $9 " mailbox is owned by " $3 } 384 $1 != "-rw-------" \ 385 { print "user " $9 " mailbox is " $1 ", group " $4 }' > $OUTPUT 386 if [ -s $OUTPUT ] ; then 387 printf "\nChecking mailbox ownership.\n" 388 cat $OUTPUT 389 fi 390 fi 391 392 if [ "$check_nfs" = YES ]; then 393 if [ -f /etc/exports ]; then 394 # File systems should not be globally exported. 395 awk '{ 396 # ignore comments and blank lines 397 if ($LINE ~ /^\#/ || $LINE ~ /^$/ ) 398 next; 399 400 readonly = 0; 401 for (i = 2; i <= NF; ++i) { 402 if ($i ~ /-ro/) 403 readonly = 1; 404 else if ($i !~ /^-/) 405 next; 406 } 407 if (readonly) 408 print "File system " $1 " globally exported, read-only." 409 else 410 print "File system " $1 " globally exported, read-write." 411 }' < /etc/exports > $OUTPUT 412 if [ -s $OUTPUT ] ; then 413 printf "\nChecking for globally exported file systems.\n" 414 cat $OUTPUT 415 fi 416 fi 417 fi 418 419 # Display any changes in setuid files and devices. 420 if [ "$check_devices" = YES ]; then 421 > $ERR 422 (find / \( ! -fstype local -o -fstype fdesc -o -fstype kernfs \ 423 -o -fstype procfs \) -a -prune -o \ 424 \( \( -perm -u+s -a ! -type d \) -o \ 425 \( -perm -g+s -a ! -type d \) -o \ 426 -type b -o -type c \) -print0 | \ 427 xargs -0 ls -ldgTq | sort +9 > $LIST) 2> $OUTPUT 428 429 # Display any errors that occurred during system file walk. 430 if [ -s $OUTPUT ] ; then 431 printf "Setuid/device find errors:\n" >> $ERR 432 cat $OUTPUT >> $ERR 433 printf "\n" >> $ERR 434 fi 435 436 # Display any changes in the setuid file list. 437 egrep -v '^[bc]' $LIST > $TMP1 438 if [ -s $TMP1 ] ; then 439 # Check to make sure uudecode isn't setuid. 440 if grep -w uudecode $TMP1 > /dev/null ; then 441 printf "\nUudecode is setuid.\n" >> $ERR 442 fi 443 444 CUR=/var/backups/setuid.current 445 BACK=/var/backups/setuid.backup 446 447 if [ -s $CUR ] ; then 448 if cmp -s $CUR $TMP1 ; then 449 : 450 else 451 > $TMP2 452 join -110 -210 -v2 $CUR $TMP1 > $OUTPUT 453 if [ -s $OUTPUT ] ; then 454 printf "Setuid additions:\n" >> $ERR 455 tee -a $TMP2 < $OUTPUT >> $ERR 456 printf "\n" >> $ERR 457 fi 458 459 join -110 -210 -v1 $CUR $TMP1 > $OUTPUT 460 if [ -s $OUTPUT ] ; then 461 printf "Setuid deletions:\n" >> $ERR 462 tee -a $TMP2 < $OUTPUT >> $ERR 463 printf "\n" >> $ERR 464 fi 465 466 sort -k10 $TMP2 $CUR $TMP1 | \ 467 sed -e 's/[ ][ ]*/ /g' | \ 468 uniq -u > $OUTPUT 469 if [ -s $OUTPUT ] ; then 470 printf "Setuid changes:\n" >> $ERR 471 column -t $OUTPUT >> $ERR 472 printf "\n" >> $ERR 473 fi 474 475 cp $CUR $BACK 476 cp $TMP1 $CUR 477 fi 478 else 479 printf "Setuid additions:\n" >> $ERR 480 column -t $TMP1 >> $ERR 481 printf "\n" >> $ERR 482 cp $TMP1 $CUR 483 fi 484 fi 485 486 # Check for block and character disk devices that are readable or 487 # writeable or not owned by root.operator. 488 >$TMP1 489 DISKLIST="acd ccd cd ch fd hk hp mcd md ra rb rd rl rx rz \ 490 sd se ss tz uk up vnd wd xd xy" 491 # DISKLIST="$DISKLIST ct mt st wt" 492 for i in $DISKLIST; do 493 egrep "^b.*/${i}[0-9][0-9]*[a-p]$" $LIST >> $TMP1 494 egrep "^c.*/r${i}[0-9][0-9]*[a-p]$" $LIST >> $TMP1 495 done 496 497 awk '$3 != "root" || $4 != "operator" || $1 !~ /.rw-r-----/ \ 498 { printf "Disk %s is user %s, group %s, permissions %s.\n", \ 499 $11, $3, $4, $1; }' < $TMP1 > $OUTPUT 500 if [ -s $OUTPUT ] ; then 501 printf "\nChecking disk ownership and permissions.\n" >> $ERR 502 cat $OUTPUT >> $ERR 503 printf "\n" >> $ERR 504 fi 505 506 # Display any changes in the device file list. 507 egrep '^[bc]' $LIST | sort -k11 > $TMP1 508 if [ -s $TMP1 ] ; then 509 CUR=/var/backups/device.current 510 BACK=/var/backups/device.backup 511 512 if [ -s $CUR ] ; then 513 if cmp -s $CUR $TMP1 ; then 514 : 515 else 516 > $TMP2 517 join -111 -211 -v2 $CUR $TMP1 > $OUTPUT 518 if [ -s $OUTPUT ] ; then 519 printf "Device additions:\n" >> $ERR 520 tee -a $TMP2 < $OUTPUT >> $ERR 521 printf "\n" >> $ERR 522 fi 523 524 join -111 -211 -v1 $CUR $TMP1 > $OUTPUT 525 if [ -s $OUTPUT ] ; then 526 printf "Device deletions:\n" >> $ERR 527 tee -a $TMP2 < $OUTPUT >> $ERR 528 printf "\n" >> $ERR 529 fi 530 531 # Report any block device change. Ignore 532 # character devices, only the name is 533 # significant. 534 cat $TMP2 $CUR $TMP1 | \ 535 sed -e '/^c/d' | \ 536 sort -k11 | \ 537 sed -e 's/[ ][ ]*/ /g' | \ 538 uniq -u > $OUTPUT 539 if [ -s $OUTPUT ] ; then 540 printf "Block device changes:\n" >> $ERR 541 column -t $OUTPUT >> $ERR 542 printf "\n" >> $ERR 543 fi 544 545 cp $CUR $BACK 546 cp $TMP1 $CUR 547 fi 548 else 549 printf "Device additions:\n" >> $ERR 550 column -t $TMP1 >> $ERR 551 printf "\n" >> $ERR 552 cp $TMP1 $CUR >> $ERR 553 fi 554 fi 555 if [ -s $ERR ] ; then 556 printf "\nChecking setuid files and devices:\n" 557 cat $ERR 558 printf "\n" 559 fi 560 fi 561 562 # Check special files. 563 # Check system binaries. 564 # 565 # Create the mtree tree specifications using: 566 # 567 # mtree -cx -pDIR -kcksum,gid,mode,nlink,size,link,time,uid > DIR.secure 568 # chown root.wheel DIR.secure 569 # chmod 600 DIR.secure 570 # 571 # Note, this is not complete protection against Trojan horsed binaries, as 572 # the hacker can modify the tree specification to match the replaced binary. 573 # For details on really protecting yourself against modified binaries, see 574 # the mtree(8) manual page. 575 if [ "$check_mtree" = YES ]; then 576 mtree -e -p / -f /etc/mtree/special > $OUTPUT 577 if [ -s $OUTPUT ]; then 578 printf "\nChecking special files and directories.\n" 579 cat $OUTPUT 580 fi 581 582 > $OUTPUT 583 for file in /etc/mtree/*.secure; do 584 [ $file = '/etc/mtree/*.secure' ] && continue 585 tree=`sed -n -e '3s/.* //p' -e 3q $file` 586 mtree -f $file -p $tree > $TMP1 587 if [ -s $TMP1 ]; then 588 printf "\nChecking $tree:\n" >> $OUTPUT 589 cat $TMP1 >> $OUTPUT 590 fi 591 done 592 if [ -s $OUTPUT ]; then 593 printf "\nChecking system binaries:\n" 594 cat $OUTPUT 595 fi 596 fi 597 598 # List of files that get backed up and checked for any modifications. Each 599 # file is expected to have two backups, /var/backups/file.{current,backup}. 600 # Any changes cause the files to rotate. 601 if [ "$check_changelist" = YES ] && [ -s /etc/changelist ] ; then 602 for file in `egrep -v "^#|$MP" /etc/changelist`; do 603 CUR=/var/backups/`basename $file`.current 604 BACK=/var/backups/`basename $file`.backup 605 if [ -s $file ]; then 606 if [ -s $CUR ] ; then 607 diff $CUR $file > $OUTPUT 608 if [ -s $OUTPUT ] ; then 609 printf "\n======\n%s diffs (OLD < > NEW)\n======\n" $file 610 cat $OUTPUT 611 cp -p $CUR $BACK 612 cp -p $file $CUR 613 chown root.wheel $CUR $BACK 614 fi 615 else 616 cp -p $file $CUR 617 chown root.wheel $CUR 618 fi 619 fi 620 done 621 fi 622
Indexes created Wed Oct 01 13:09:50 GMT 2025