SECURITY(8)             OpenBSD System Manager's Manual            SECURITY(8)

NNAAMMEE
     sseeccuurriittyy - periodic system security check

SSYYNNOOPPSSIISS
     //eettcc//sseeccuurriittyy

DDEESSCCRRIIPPTTIIOONN
     sseeccuurriittyy is a command script that examines the system for some signs of
     security weaknesses.  It is only a security aid and does not offer
     complete protection.  sseeccuurriittyy is run by daily(8), which mails any output
     to root on a daily basis.

     The sseeccuurriittyy script carries out the following list of simple checks:

     oo   Check the master.passwd(5) and group(5) files for syntax, empty
         passwords, partially closed accounts, suspicious UIDs, suspicious
         GIDs, and duplicate entries.

     oo   Check root's home directory and login environment for insecure
         permissions, suspicious paths, and umask commands in the dotfiles.

     oo   Check that root and uucp are in _/_e_t_c_/_f_t_p_u_s_e_r_s.

     oo   Check for suspicious commands in _/_e_t_c_/_m_a_i_l_/_a_l_i_a_s_e_s.

     oo   Check for insecurities in various trust files such as
         _/_e_t_c_/_h_o_s_t_s_._e_q_u_i_v, _/_e_t_c_/_s_h_o_s_t_s_._e_q_u_i_v, and _/_e_t_c_/_h_o_s_t_s_._l_p_d.

     oo   Check user _._r_h_o_s_t_s and _._s_h_o_s_t_s files for open access.

     oo   Check user home directory permissions.

     oo   Check many user dotfile permissions.

     oo   Check user mailbox permissions.

     oo   Check NFS exports(5) file for global export entries.

     oo   Check for changes in setuid/setgid files and devices.

     oo   Check disk ownership and permissions.

     oo   Check for changes in the device file list.

     oo   Check for permission changes in special files and system binaries
         listed in _/_e_t_c_/_m_t_r_e_e_/_s_p_e_c_i_a_l.  sseeccuurriittyy also provides hooks for
         administrators to create their own lists.  These lists should be kept
         in _/_e_t_c_/_m_t_r_e_e_/ and filenames must have the suffix ``.secure''.  The
         following example shows how to create such a list, to protect the
         home directory of user ``bob'':

             # mtree -cx -p /home/bob -K md5digest,type >/etc/mtree/bob.secure
             # chown root:wheel /etc/mtree/bob.secure
             # chmod 600 /etc/mtree/bob.secure

         NNoottee:: These checks do not provide complete protection against Trojan
         horsed binaries, as the miscreant can modify the tree specification
         to match the replaced binary.  For details on really protecting
         yourself against modified binaries, see mtree(8).

     oo   Check for changes in files listed in _/_e_t_c_/_c_h_a_n_g_e_l_i_s_t.  Files being
         created or deleted, as well as content change in the files
         themselves, are reported.  See changelist(5) for further details.

     oo   Check for changes to the disklabels of mounted disks.

     oo   Report on the installation or removal of any system package(5).

     oo   Check hostname.if(5) file permissions.

     The intent of the sseeccuurriittyy script is to point out some obvious holes to
     the system administrator.

EENNVVIIRROONNMMEENNTT
     The following variables can be set in _/_e_t_c_/_d_a_i_l_y_._l_o_c_a_l:

     SUIDSKIP  A whitespace-separated list of absolute paths to be skipped in
               setuid/setgid file checks and in device special file checks.
               Avoid trailing slashes.

FFIILLEESS
     _/_e_t_c_/_c_h_a_n_g_e_l_i_s_t
     _/_e_t_c_/_d_a_i_l_y
     _/_e_t_c_/_m_t_r_e_e
     _/_v_a_r_/_b_a_c_k_u_p_s

SSEEEE AALLSSOO
     changelist(5), daily(8), mtree(8)

BBUUGGSS
     The name of this script may provide a false sense of sseeccuurriittyy.

     There are perhaps an infinite number of ways the system can be
     compromised without this script noticing.

OpenBSD 4.8                    December 25, 2009                   OpenBSD 4.8
