SECURITY.CONF(5)

NAME
security.conf - daily security check configuration file

DESCRIPTION
The security.conf file specifies which of the standard /etc/security services are performed. The /etc/security script is run, by default, every night from /etc/daily, on a NetBSD system, if configured do to so from /etc/daily.conf.

The variables described below can be set to "NO" to disable the test:

check_passwd
    This checks the /etc/master.passwd file for inconsistancies.

check_group
    This checks the /etc/group file for inconsistancies.

check_rootdotfiles
    This checks the root users startup files for sane settings of $PATH and umask. This test is not fail safe and any warning generated from this should be checked for correctness.

check_ftpusers
    This checks that the correct users are in the /etc/ftpusers file.

check_aliases
    This checks for security problems in the /etc/aliases file.

check_rhosts
    This checks for system and user rhosts files with "+" in them.

check_homes
    This checks that home directories are owned by the correct user.

check_varmail
    This checks that the correct user owns mail in /var/mail, and that the mail box has the right permissions.

check_nfs
    This checks that the /etc/exports file does not export filesystems to the world.

check_devices
    This checks for changes to devices and setuid files.

check_mtree
    This runs mtree(8) to ensure that the system is installed correctly.

check_disklabels
    Backup text copies of the disklabels of available disk drives into /var/backups/disklabel.XXX, and display any differences in those and the previous copies as per check_changelist below.

check_changelist
    This updates the list of files in /etc/changelist and their backups in /var/backups/file.current and /var/backups/file.backup, and displays any differences found.

The variables described below can be set to modify the tests:

max_loginlen
    If check_passwd is enabled, this determines the maximum permitted length of login names.

FILES
/etc/security /etc/security.conf

SEE ALSO
daily.conf(5)

HISTORY
The security.conf file appeared in NetBSD 1.3. The check_disklabels functionality was added in NetBSD 1.4.