SECURITY.CONF(5)          NetBSD Programmer's Manual          SECURITY.CONF(5)

NNAAMMEE
     sseeccuurriittyy..ccoonnff - daily security check configuration file

DDEESSCCRRIIPPTTIIOONN
     The sseeccuurriittyy..ccoonnff file specifies which of the standard _/_e_t_c_/_s_e_c_u_r_i_t_y ser-
     vices are performed.  The _/_e_t_c_/_s_e_c_u_r_i_t_y script is run, by default, every
     night from _/_e_t_c_/_d_a_i_l_y, on a NetBSD system, if configured do to so from
     _/_e_t_c_/_d_a_i_l_y_._c_o_n_f.

     The variables described below can be set to "NO" to disable the test:

     cchheecckk__ppaasssswwdd   This checks the _/_e_t_c_/_m_a_s_t_e_r_._p_a_s_s_w_d file for inconsistan-
                    cies.

     cchheecckk__ggrroouupp    This checks the _/_e_t_c_/_g_r_o_u_p file for inconsistancies.

     cchheecckk__rroooottddoottffiilleess
                    This checks the root users startup files for sane settings
                    of $PATH and umask.  This test is not fail safe and any
                    warning generated from this should be checked for correct-
                    ness.

     cchheecckk__ffttppuusseerrss
                    This checks that the correct users are in the
                    _/_e_t_c_/_f_t_p_u_s_e_r_s file.

     cchheecckk__aalliiaasseess  This checks for security problems in the _/_e_t_c_/_a_l_i_a_s_e_s
                    file.

     cchheecckk__rrhhoossttss   This checks for system and user rhosts files with "+" in
                    them.

     cchheecckk__hhoommeess    This checks that home directories are owned by the correct
                    user.

     cchheecckk__vvaarrmmaaiill  This checks that the correct user owns mail in _/_v_a_r_/_m_a_i_l,
                    and that the mail box has the right permissions.

     cchheecckk__nnffss      This checks that the _/_e_t_c_/_e_x_p_o_r_t_s file does not export
                    filesystems to the world.

     cchheecckk__ddeevviicceess  This checks for changes to devices and setuid files.

     cchheecckk__mmttrreeee    This runs mtree(8) to ensure that the system is installed
                    correctly.

     cchheecckk__ddiisskkllaabbeellss
                    Backup text copies of the disklabels of available disk
                    drives into _/_v_a_r_/_b_a_c_k_u_p_s_/_d_i_s_k_l_a_b_e_l_._X_X_X, and display any
                    differences in those and the previous copies as per
                    cchheecckk__cchhaannggeelliisstt below.

     cchheecckk__cchhaannggeelliisstt
                    This updates the list of files in _/_e_t_c_/_c_h_a_n_g_e_l_i_s_t and
                    their backups in _/_v_a_r_/_b_a_c_k_u_p_s_/_f_i_l_e_._c_u_r_r_e_n_t and
                    _/_v_a_r_/_b_a_c_k_u_p_s_/_f_i_l_e_._b_a_c_k_u_p, and displays any differences
                    found.

     The variables described below can be set to modify the tests:

     mmaaxx__llooggiinnlleenn   If cchheecckk__ppaasssswwdd is enabled, this determines the maximum
                    permitted length of login names.

FFIILLEESS
     _/_e_t_c_/_s_e_c_u_r_i_t_y _/_e_t_c_/_s_e_c_u_r_i_t_y_._c_o_n_f

SSEEEE AALLSSOO
     daily.conf(5)

HHIISSTTOORRYY
     The sseeccuurriittyy..ccoonnff file appeared in NetBSD 1.3.  The cchheecckk__ddiisskkllaabbeellss
     functionality was added in NetBSD 1.4.

NetBSD 1.4                      August 25, 1998                              2
