security revision 1.48
1 #!/bin/sh - 2 # 3 # $NetBSD: security,v 1.48 2001/01/09 17:30:29 abs Exp $ 4 # from: @(#)security 8.1 (Berkeley) 6/9/93 5 # 6 7 PATH=/sbin:/usr/sbin:/bin:/usr/bin 8 9 if [ -f /etc/rc.subr ]; then 10 . /etc/rc.subr 11 else 12 echo "Can't read /etc/rc.subr; aborting." 13 exit 1; 14 fi 15 16 umask 077 17 18 if [ -s /etc/security.conf ]; then 19 . /etc/security.conf 20 fi 21 22 SECUREDIR=/tmp/_securedir.$$ 23 if ! mkdir $SECUREDIR; then 24 echo can not create $SECUREDIR. 25 exit 1 26 fi 27 28 if ! cd $SECUREDIR; then 29 echo can not chdir to $SECUREDIR. 30 exit 1 31 fi 32 33 if [ -z "$max_loginlen" ];then 34 max_loginlen=8 35 fi 36 37 ERR=secure1.$$ 38 TMP1=secure2.$$ 39 TMP2=secure3.$$ 40 MPBYUID=secure4.$$ 41 MPBYPATH=secure5.$$ 42 LIST=secure6.$$ 43 OUTPUT=secure7.$$ 44 LABELS=secure8.$$ 45 46 trap '/bin/rm -rf $SECUREDIR ; exit 0' 0 2 3 47 48 # Handle backup_dir not being set in .conf file 49 backup_dir=${backup_dir:-/var/backups} 50 51 MP=/etc/master.passwd 52 53 # these is used several times. 54 awk -F: '!/^+/ { print $1 " " $3 }' $MP | sort -k2n > $MPBYUID 55 awk -F: '{ print $1 " " $9 }' $MP | sort -k2 > $MPBYPATH 56 57 # Check the master password file syntax. 58 # 59 if checkyesno check_passwd; then 60 awk -v "len=$max_loginlen" ' 61 BEGIN { 62 while ( getline < "/etc/shells" > 0 ) { 63 if ($0 ~ /^\#/ || $0 ~ /^$/ ) 64 continue; 65 shells[$1]++; 66 } 67 FS=":"; 68 } 69 70 { 71 if ($0 ~ /^[ ]*$/) { 72 printf "Line %d is a blank line.\n", NR; 73 next; 74 } 75 if (NF != 10 && ($1 != "+" || NF != 1)) 76 printf "Line %d has the wrong number of fields.\n", NR; 77 if ($1 == "+" ) { 78 if (NF != 1 && $3 == 0) 79 printf "Line %d includes entries with uid 0.\n", NR; 80 next; 81 } 82 if ($1 !~ /^[A-Za-z0-9]*$/) 83 printf "Login %s has non-alphanumeric characters.\n", 84 $1; 85 if (length($1) > len) 86 printf "Login %s has more than "len" characters.\n", $1; 87 if ($2 == "") 88 printf "Login %s has no password.\n", $1; 89 if (length($2) != 13 && length($2) != 20 && $2 != "") { 90 if ($10 == "" || shells[$10]) 91 printf "Login %s is off but still has a valid shell (%s)\n", 92 $1, $10; 93 } else if (! shells[$10]) 94 printf "Login %s does not have a valid shell (%s)\n", 95 $1, $10; 96 if ($3 == 0 && $1 != "root" && $1 != "toor") 97 printf "Login %s has a user id of 0.\n", $1; 98 if ($3 < 0) 99 printf "Login %s has a negative user id.\n", $1; 100 if ($4 < 0) 101 printf "Login %s has a negative group id.\n", $1; 102 }' < $MP > $OUTPUT 103 if [ -s $OUTPUT ] ; then 104 printf "\nChecking the $MP file:\n" 105 cat $OUTPUT 106 fi 107 108 awk -F: '{ print $1 }' $MP | sort | uniq -d > $OUTPUT 109 if [ -s $OUTPUT ] ; then 110 printf "\n$MP has duplicate user names.\n" 111 column $OUTPUT 112 fi 113 114 # To not exclude 'toor', a standard duplicate root account, from the duplicate 115 # account test, uncomment the line below (without egrep in it)and comment 116 # out the line (with egrep in it) below it. 117 # 118 # < $MPBYUID uniq -d -f 1 | awk '{ print $2 }' > $TMP2 119 < $MPBYUID egrep -v '^toor ' | uniq -d -f 1 | awk '{ print $2 }' > $TMP2 120 if [ -s $TMP2 ] ; then 121 printf "\n$MP has duplicate user id's.\n" 122 while read uid; do 123 grep -w $uid $MPBYUID 124 done < $TMP2 | column 125 fi 126 fi 127 128 # Backup the master password file; a special case, the normal backup 129 # mechanisms also print out file differences and we don't want to do 130 # that because this file has encrypted passwords in it. 131 # 132 CUR=$backup_dir/${MP##*/}.current 133 BACK=$backup_dir/${MP##*/}.backup 134 if [ -s $CUR ] ; then 135 if cmp -s $CUR $MP; then 136 : 137 else 138 cp -p $CUR $BACK 139 cp -p $MP $CUR 140 chown root:wheel $CUR 141 fi 142 else 143 cp -p $MP $CUR 144 chown root:wheel $CUR 145 fi 146 147 # Check the group file syntax. 148 # 149 if checkyesno check_group; then 150 GRP=/etc/group 151 awk -F: '{ 152 if ($0 ~ /^[ ]*$/) { 153 printf "Line %d is a blank line.\n", NR; 154 next; 155 } 156 if (NF != 4 && ($1 != "+" || NF != 1)) 157 printf "Line %d has the wrong number of fields.\n", NR; 158 if ($1 == "+" ) { 159 next; 160 } 161 if ($1 !~ /^[A-za-z0-9]*$/) 162 printf "Group %s has non-alphanumeric characters.\n", 163 $1; 164 if (length($1) > 8) 165 printf "Group %s has more than 8 characters.\n", $1; 166 if ($3 !~ /[0-9]*/) 167 printf "Login %s has a negative group id.\n", $1; 168 }' < $GRP > $OUTPUT 169 if [ -s $OUTPUT ] ; then 170 printf "\nChecking the $GRP file:\n" 171 cat $OUTPUT 172 fi 173 174 awk -F: '{ print $1 }' $GRP | sort | uniq -d > $OUTPUT 175 if [ -s $OUTPUT ] ; then 176 printf "\n$GRP has duplicate group names.\n" 177 column $OUTPUT 178 fi 179 fi 180 181 # Check for root paths, umask values in startup files. 182 # The check for the root paths is problematical -- it's likely to fail 183 # in other environments. Once the shells have been modified to warn 184 # of '.' in the path, the path tests should go away. 185 # 186 if checkyesno check_rootdotfiles; then 187 > $OUTPUT 188 rhome=`csh -fc "echo ~root"` 189 umaskset=no 190 list="/etc/csh.cshrc /etc/csh.login ${rhome}/.cshrc ${rhome}/.login" 191 for i in $list ; do 192 if [ -f $i ] ; then 193 if egrep '^[ \t]*umask[ \t]+[0-7]+' $i > /dev/null ; then 194 umaskset=yes 195 fi 196 # double check the umask value itself; ensure that both the 197 # 020 and 002 bits are set. 198 # we handle this in decimal initially to extract the digits, 199 # and then extract the `2' bit of each digit. 200 # this is made especially painful because 201 # bitwise operations were left out of awk. 202 egrep '^[ \t]*umask[ \t]+[0-7]+' $i | 203 awk '{ g= ($2 % 100) - ($2 % 10); 204 g /= 10; 205 g = g % 4; 206 g -= g % 2; 207 if (g != 2) { print "\tRoot umask is group writeable" } 208 o = ($2 % 10); 209 o = o % 4; 210 o -= o % 2; 211 if (o != 2) { print "\tRoot umask is other writeable" } }' | 212 sort -u >> $OUTPUT 213 SAVE_PATH=$PATH 214 unset PATH 215 /bin/csh -f -s << end-of-csh > /dev/null 2>&1 216 source $i 217 /bin/ls -ldgT \$path > $TMP1 218 end-of-csh 219 PATH=$SAVE_PATH 220 awk '{ 221 if ($10 ~ /^\.$/) { 222 print "\tThe root path includes ."; 223 next; 224 } 225 } 226 $1 ~ /^d....w/ \ 227 { print "\tRoot path directory " $10 " is group writeable." } \ 228 $1 ~ /^d.......w/ \ 229 { print "\tRoot path directory " $10 " is other writeable." }' \ 230 < $TMP1 >> $OUTPUT 231 fi 232 done 233 if [ $umaskset = "no" -o -s $OUTPUT ] ; then 234 printf "\nChecking root csh paths, umask values:\n$list\n\n" 235 if [ -s $OUTPUT ]; then 236 cat $OUTPUT 237 fi 238 if [ $umaskset = "no" ] ; then 239 printf "\tRoot csh startup files do not set the umask.\n" 240 fi 241 fi 242 243 > $OUTPUT 244 rhome=/root 245 umaskset=no 246 list="/etc/profile ${rhome}/.profile" 247 for i in $list; do 248 if [ -f $i ] ; then 249 if egrep umask $i > /dev/null ; then 250 umaskset=yes 251 fi 252 egrep umask $i | 253 awk '$2 % 100 < 20 \ 254 { print "\tRoot umask is group writeable" } \ 255 $2 % 10 < 2 \ 256 { print "\tRoot umask is other writeable" }' \ 257 >> $OUTPUT 258 SAVE_PATH=$PATH 259 unset PATH 260 /bin/sh << end-of-sh > /dev/null 2>&1 261 . $i 262 list=\`echo \$PATH | /usr/bin/sed -e \ 263 's/^:/.:/;s/:$/:./;s/::/:.:/g;s/:/ /g'\` 264 /bin/ls -ldgT \$list > $TMP1 265 end-of-sh 266 PATH=$SAVE_PATH 267 awk '{ 268 if ($10 ~ /^\.$/) { 269 print "\tThe root path includes ."; 270 next; 271 } 272 } 273 $1 ~ /^d....w/ \ 274 { print "\tRoot path directory " $10 " is group writeable." } \ 275 $1 ~ /^d.......w/ \ 276 { print "\tRoot path directory " $10 " is other writeable." }' \ 277 < $TMP1 >> $OUTPUT 278 279 fi 280 done 281 if [ $umaskset = "no" -o -s $OUTPUT ] ; then 282 printf "\nChecking root sh paths, umask values:\n$list\n" 283 if [ -s $OUTPUT ]; then 284 cat $OUTPUT 285 fi 286 if [ $umaskset = "no" ] ; then 287 printf "\tRoot sh startup files do not set the umask.\n" 288 fi 289 fi 290 fi 291 292 # Root and uucp should both be in /etc/ftpusers. 293 # 294 if checkyesno check_ftpusers; then 295 > $OUTPUT 296 list="uucp "`awk '$2 == 0 { print $1 }' $MPBYUID` 297 for i in $list; do 298 if /usr/libexec/ftpd -C $i ; then 299 printf "\t$i is not denied\n" >> $OUTPUT 300 fi 301 done 302 if [ -s $OUTPUT ]; then 303 printf "\nChecking the /etc/ftpusers configuration:\n" 304 cat $OUTPUT 305 fi 306 fi 307 308 # Uudecode should not be in the /etc/mail/aliases file. 309 # 310 if checkyesno check_aliases; then 311 for f in /etc/mail/aliases /etc/aliases; do 312 if [ -f $f ] && egrep '^[^#]*(uudecode|decode).*\|' $f; then 313 printf "\nEntry for uudecode in $f file.\n" 314 fi 315 done 316 fi 317 318 # Files that should not have + signs. 319 # 320 if checkyesno check_rhosts; then 321 list="/etc/hosts.equiv /etc/hosts.lpd" 322 for f in $list ; do 323 if [ -f $f ] && egrep '\+' $f > /dev/null ; then 324 printf "\nPlus sign in $f file.\n" 325 fi 326 done 327 328 # Check for special users with .rhosts files. Only root and toor should 329 # have .rhosts files. Also, .rhosts files should not have plus signs. 330 awk -F: '$1 != "root" && $1 != "toor" && \ 331 ($3 < 100 || $1 == "ftp" || $1 == "uucp") \ 332 { print $1 " " $9 }' $MP | 333 sort -k2 | 334 while read uid homedir; do 335 if [ -f ${homedir}/.rhosts ] ; then 336 rhost=`ls -ldgT ${homedir}/.rhosts` 337 printf -- "$uid: $rhost\n" 338 fi 339 done > $OUTPUT 340 if [ -s $OUTPUT ] ; then 341 printf "\nChecking for special users with .rhosts files.\n" 342 cat $OUTPUT 343 fi 344 345 while read uid homedir; do 346 if [ -f ${homedir}/.rhosts -a -r ${homedir}/.rhosts ] && \ 347 cat -f ${homedir}/.rhosts | egrep '\+' > /dev/null ; then 348 printf -- "$uid: + in .rhosts file.\n" 349 fi 350 done < $MPBYPATH > $OUTPUT 351 if [ -s $OUTPUT ] ; then 352 printf "\nChecking .rhosts files syntax.\n" 353 cat $OUTPUT 354 fi 355 fi 356 357 # Check home directories. Directories should not be owned by someone else 358 # or writeable. 359 # 360 if checkyesno check_homes; then 361 while read uid homedir; do 362 if [ -d ${homedir}/ ] ; then 363 file=`ls -ldgT ${homedir}` 364 printf -- "$uid $file\n" 365 fi 366 done < $MPBYPATH | 367 awk '$1 != $4 && $4 != "root" \ 368 { print "user " $1 " home directory is owned by " $4 } 369 $2 ~ /^-....w/ \ 370 { print "user " $1 " home directory is group writeable" } 371 $2 ~ /^-.......w/ \ 372 { print "user " $1 " home directory is other writeable" }' \ 373 > $OUTPUT 374 if [ -s $OUTPUT ] ; then 375 printf "\nChecking home directories.\n" 376 cat $OUTPUT 377 fi 378 379 # Files that should not be owned by someone else or readable. 380 list=".Xauthority .netrc" 381 while read uid homedir; do 382 for f in $list ; do 383 file=${homedir}/${f} 384 if [ -f $file ] ; then 385 printf -- "$uid $f `ls -ldgT $file`\n" 386 fi 387 done 388 done < $MPBYPATH | 389 awk '$1 != $5 && $5 != "root" \ 390 { print "user " $1 " " $2 " file is owned by " $5 } 391 $3 ~ /^-...r/ \ 392 { print "user " $1 " " $2 " file is group readable" } 393 $3 ~ /^-......r/ \ 394 { print "user " $1 " " $2 " file is other readable" } 395 $3 ~ /^-....w/ \ 396 { print "user " $1 " " $2 " file is group writeable" } 397 $3 ~ /^-.......w/ \ 398 { print "user " $1 " " $2 " file is other writeable" }' \ 399 > $OUTPUT 400 401 # Files that should not be owned by someone else or writeable. 402 list=".bash_history .bash_login .bash_logout .bash_profile .bashrc \ 403 .cshrc .emacs .exrc .forward .history .klogin .login .logout \ 404 .profile .qmail .rc_history .rhosts .tcshrc .twmrc .xinitrc \ 405 .xsession" 406 while read uid homedir; do 407 for f in $list ; do 408 file=${homedir}/${f} 409 if [ -f $file ] ; then 410 printf -- "$uid $f `ls -ldgT $file`\n" 411 fi 412 done 413 done < $MPBYPATH | 414 awk '$1 != $5 && $5 != "root" \ 415 { print "user " $1 " " $2 " file is owned by " $5 } 416 $3 ~ /^-....w/ \ 417 { print "user " $1 " " $2 " file is group writeable" } 418 $3 ~ /^-.......w/ \ 419 { print "user " $1 " " $2 " file is other writeable" }' \ 420 >> $OUTPUT 421 if [ -s $OUTPUT ] ; then 422 printf "\nChecking dot files.\n" 423 cat $OUTPUT 424 fi 425 fi 426 427 # Mailboxes should be owned by user and unreadable. 428 # 429 if checkyesno check_varmail; then 430 ls -l /var/mail | sed 1d | \ 431 awk '$3 != $9 \ 432 { print "user " $9 " mailbox is owned by " $3 } 433 $1 != "-rw-------" \ 434 { print "user " $9 " mailbox is " $1 ", group " $4 }' > $OUTPUT 435 if [ -s $OUTPUT ] ; then 436 printf "\nChecking mailbox ownership.\n" 437 cat $OUTPUT 438 fi 439 fi 440 441 # NFS exports shouldn't be globally exported 442 # 443 if checkyesno check_nfs && [ -f /etc/exports ]; then 444 awk '{ 445 # ignore comments and blank lines 446 if ($0 ~ /^\#/ || $0 ~ /^$/ ) 447 next; 448 449 readonly = 0; 450 for (i = 2; i <= NF; ++i) { 451 if ($i ~ /-ro/) 452 readonly = 1; 453 else if ($i !~ /^-/) 454 next; 455 } 456 if (readonly) 457 print "File system " $1 " globally exported, read-only." 458 else 459 print "File system " $1 " globally exported, read-write." 460 }' < /etc/exports > $OUTPUT 461 if [ -s $OUTPUT ] ; then 462 printf "\nChecking for globally exported file systems.\n" 463 cat $OUTPUT 464 fi 465 fi 466 467 # Display any changes in setuid files and devices. 468 # 469 if checkyesno check_devices; then 470 > $ERR 471 (find / \( ! -fstype local -o -fstype fdesc -o -fstype kernfs \ 472 -o -fstype procfs \) -a -prune -o \ 473 \( \( -perm -u+s -a ! -type d \) -o \ 474 \( -perm -g+s -a ! -type d \) -o \ 475 -type b -o -type c \) -print0 | \ 476 xargs -0 ls -ldgTq | sort +9 > $LIST) 2> $OUTPUT 477 478 # Display any errors that occurred during system file walk. 479 if [ -s $OUTPUT ] ; then 480 printf "Setuid/device find errors:\n" >> $ERR 481 cat $OUTPUT >> $ERR 482 printf "\n" >> $ERR 483 fi 484 485 # Display any changes in the setuid file list. 486 egrep -v '^[bc]' $LIST > $TMP1 487 if [ -s $TMP1 ] ; then 488 # Check to make sure uudecode isn't setuid. 489 if grep -w uudecode $TMP1 > /dev/null ; then 490 printf "\nUudecode is setuid.\n" >> $ERR 491 fi 492 493 CUR=$backup_dir/setuid.current 494 BACK=$backup_dir/setuid.backup 495 496 if [ -s $CUR ] ; then 497 if cmp -s $CUR $TMP1 ; then 498 : 499 else 500 > $TMP2 501 join -110 -210 -v2 $CUR $TMP1 > $OUTPUT 502 if [ -s $OUTPUT ] ; then 503 printf "Setuid additions:\n" >> $ERR 504 tee -a $TMP2 < $OUTPUT >> $ERR 505 printf "\n" >> $ERR 506 fi 507 508 join -110 -210 -v1 $CUR $TMP1 > $OUTPUT 509 if [ -s $OUTPUT ] ; then 510 printf "Setuid deletions:\n" >> $ERR 511 tee -a $TMP2 < $OUTPUT >> $ERR 512 printf "\n" >> $ERR 513 fi 514 515 sort -k10 $TMP2 $CUR $TMP1 | \ 516 sed -e 's/[ ][ ]*/ /g' | \ 517 uniq -u > $OUTPUT 518 if [ -s $OUTPUT ] ; then 519 printf "Setuid changes:\n" >> $ERR 520 column -t $OUTPUT >> $ERR 521 printf "\n" >> $ERR 522 fi 523 524 cp $CUR $BACK 525 cp $TMP1 $CUR 526 fi 527 else 528 printf "Setuid additions:\n" >> $ERR 529 column -t $TMP1 >> $ERR 530 printf "\n" >> $ERR 531 cp $TMP1 $CUR 532 fi 533 fi 534 535 # Check for block and character disk devices that are readable or 536 # writeable or not owned by root.operator. 537 >$TMP1 538 DISKLIST="acd ccd cd ch fd hk hp mcd md ra rb rd rl rx rz \ 539 sd se ss tz uk up vnd wd xd xy" 540 # DISKLIST="$DISKLIST ct mt st wt" 541 for i in $DISKLIST; do 542 egrep "^b.*/${i}[0-9][0-9]*[a-p]$" $LIST >> $TMP1 543 egrep "^c.*/r${i}[0-9][0-9]*[a-p]$" $LIST >> $TMP1 544 done 545 546 awk '$3 != "root" || $4 != "operator" || $1 !~ /.rw-r-----/ \ 547 { printf "Disk %s is user %s, group %s, permissions %s.\n", \ 548 $11, $3, $4, $1; }' < $TMP1 > $OUTPUT 549 if [ -s $OUTPUT ] ; then 550 printf "\nChecking disk ownership and permissions.\n" >> $ERR 551 cat $OUTPUT >> $ERR 552 printf "\n" >> $ERR 553 fi 554 555 # Display any changes in the device file list. 556 egrep '^[bc]' $LIST | sort -k11 > $TMP1 557 if [ -s $TMP1 ] ; then 558 CUR=$backup_dir/device.current 559 BACK=$backup_dir/device.backup 560 561 if [ -s $CUR ] ; then 562 if cmp -s $CUR $TMP1 ; then 563 : 564 else 565 > $TMP2 566 join -111 -211 -v2 $CUR $TMP1 > $OUTPUT 567 if [ -s $OUTPUT ] ; then 568 printf "Device additions:\n" >> $ERR 569 tee -a $TMP2 < $OUTPUT >> $ERR 570 printf "\n" >> $ERR 571 fi 572 573 join -111 -211 -v1 $CUR $TMP1 > $OUTPUT 574 if [ -s $OUTPUT ] ; then 575 printf "Device deletions:\n" >> $ERR 576 tee -a $TMP2 < $OUTPUT >> $ERR 577 printf "\n" >> $ERR 578 fi 579 580 # Report any block device change. Ignore 581 # character devices, only the name is 582 # significant. 583 cat $TMP2 $CUR $TMP1 | \ 584 sed -e '/^c/d' | \ 585 sort -k11 | \ 586 sed -e 's/[ ][ ]*/ /g' | \ 587 uniq -u > $OUTPUT 588 if [ -s $OUTPUT ] ; then 589 printf "Block device changes:\n" >> $ERR 590 column -t $OUTPUT >> $ERR 591 printf "\n" >> $ERR 592 fi 593 594 cp $CUR $BACK 595 cp $TMP1 $CUR 596 fi 597 else 598 printf "Device additions:\n" >> $ERR 599 column -t $TMP1 >> $ERR 600 printf "\n" >> $ERR 601 cp $TMP1 $CUR >> $ERR 602 fi 603 fi 604 if [ -s $ERR ] ; then 605 printf "\nChecking setuid files and devices:\n" 606 cat $ERR 607 printf "\n" 608 fi 609 fi 610 611 # Check special files. 612 # Check system binaries. 613 # 614 # Create the mtree tree specifications using: 615 # 616 # mtree -cx -pDIR -kcksum,gid,mode,nlink,size,link,time,uid > DIR.secure 617 # chown root:wheel DIR.secure 618 # chmod 600 DIR.secure 619 # 620 # Note, this is not complete protection against Trojan horsed binaries, as 621 # the hacker can modify the tree specification to match the replaced binary. 622 # For details on really protecting yourself against modified binaries, see 623 # the mtree(8) manual page. 624 # 625 if checkyesno check_mtree; then 626 mtree -e -p / -f /etc/mtree/special > $OUTPUT 627 if [ -s $OUTPUT ]; then 628 printf "\nChecking special files and directories.\n" 629 cat $OUTPUT 630 fi 631 632 > $OUTPUT 633 for file in /etc/mtree/*.secure; do 634 [ $file = '/etc/mtree/*.secure' ] && continue 635 tree=`sed -n -e '3s/.* //p' -e 3q $file` 636 mtree -f $file -p $tree > $TMP1 637 if [ -s $TMP1 ]; then 638 printf "\nChecking $tree:\n" >> $OUTPUT 639 cat $TMP1 >> $OUTPUT 640 fi 641 done 642 if [ -s $OUTPUT ]; then 643 printf "\nChecking system binaries:\n" 644 cat $OUTPUT 645 fi 646 fi 647 648 CHANGELIST="" 649 650 # Backup disklabels of available disks 651 # 652 if checkyesno check_disklabels; then 653 # generate list of old disklabels and remove them 654 ls -1d $backup_dir/disklabel.* 2>/dev/null | 655 egrep -v '\.(backup|current)$' > $LABELS 656 xargs rm < $LABELS 657 658 disks=`iostat -x | sed 1d | awk '$1 !~ /^[cfm]d/ { print $1; }'` 659 for i in $disks; do 660 dlf="$backup_dir/disklabel.$i" 661 disklabel $i > $dlf 2>/dev/null 662 done 663 664 # append list of new disklabels, sort list 665 ls -1d $backup_dir/disklabel.* 2>/dev/null | 666 egrep -v '\.(backup|current)$' >> $LABELS 667 sort -u -o $LABELS $LABELS 668 CHANGELIST=$LABELS 669 fi 670 671 # List of files that get backed up and checked for any modifications. Each 672 # file is expected to have two backups, $backup_dir/file.{current,backup}. 673 # Any changes cause the files to rotate. 674 # 675 if checkyesno check_changelist && [ -s /etc/changelist ] ; then 676 CHANGELIST="/etc/changelist $CHANGELIST" 677 fi 678 679 if [ -n "$CHANGELIST" ]; then 680 for file in `egrep -hv "^#|$MP" $CHANGELIST`; do 681 CUR=$backup_dir/${file##*/}.current 682 BACK=$backup_dir/${file##*/}.backup 683 if [ -f $file ]; then 684 if [ -f $CUR ] ; then 685 diff $CUR $file > $OUTPUT 686 if [ -s $OUTPUT ] ; then 687 printf "\n======\n%s diffs (OLD < > NEW)\n======\n" $file 688 cat $OUTPUT 689 mv -f $CUR $BACK 690 cp -p $file $CUR 691 chown root:wheel $CUR 692 fi 693 else 694 printf "\n======\n%s added\n======\n" $file 695 diff /dev/null $file 696 cp -p $file $CUR 697 chown root:wheel $CUR 698 fi 699 else 700 if [ -f $CUR ]; then 701 printf "\n======\n%s removed\n======\n" $file 702 diff $CUR /dev/null 703 mv -f $CUR $BACK 704 fi 705 fi 706 done 707 fi 708 709 # run skeyaudit to inform users of ready to expire S/Keys 710 # 711 if checkyesno run_skeyaudit; then 712 skeyaudit 713 fi 714 715 if [ -f /etc/security.local ]; then 716 echo "" 717 echo "Running /etc/security.local:" 718 . /etc/security.local 719 fi 720
Indexes created Tue Sep 30 20:09:53 GMT 2025