summaryrefslogtreecommitdiff
path: root/share/man
diff options
context:
space:
mode:
authorAaron Campbell <aaron@cvs.openbsd.org>2001-02-23 20:02:12 +0000
committerAaron Campbell <aaron@cvs.openbsd.org>2001-02-23 20:02:12 +0000
commitff0d01bf9ac9daa76d66ced36273a9da898443e7 (patch)
treef44105f1fb6e50fee21e0dec3367292cbc0195cc /share/man
parentbcb2c8c6088b0832b8ea763643704af3120b8771 (diff)
Minor fixes.
Diffstat (limited to 'share/man')
-rw-r--r--share/man/man8/security.860
1 files changed, 32 insertions, 28 deletions
diff --git a/share/man/man8/security.8 b/share/man/man8/security.8
index 156cc8b7ca7..803d58d8116 100644
--- a/share/man/man8/security.8
+++ b/share/man/man8/security.8
@@ -1,4 +1,4 @@
-.\" $OpenBSD: security.8,v 1.1 2001/01/28 03:52:44 d Exp $
+.\" $OpenBSD: security.8,v 1.2 2001/02/23 20:02:11 aaron Exp $
.Dd July 1, 2000
.Dt SECURITY 8
.Os
@@ -8,18 +8,18 @@
.Sh SYNOPSIS
.Nm /etc/security
.Sh DESCRIPTION
-.Nm security
+.Nm
is a command script that examines the system for some signs of security
weaknesses.
It is only a security aid and does not offer complete protection.
The
-.Nm security
+.Nm
script is normally run from the
.Pa /etc/daily
script, which sends mails to root on a daily basis.
.Pp
The
-.Nm security
+.Nm
script carries out the following list of simple checks:
.Bl -bullet
.It
@@ -29,42 +29,44 @@ and
.Xr group 5
files for
syntax, empty passwords, partially closed accounts,
-suspicious UIDs, GIDs and duplicate entries
+suspicious UIDs, suspicious GIDs, and duplicate entries.
.It
Check root's home directory and login environment for
-insecure permissions, suspicious paths and umask commands in the
-dotfiles
+insecure permissions, suspicious paths, and umask commands in the
+dotfiles.
.It
Check that root and uucp are in
-.Pa /etc/ftpusers
+.Pa /etc/ftpusers .
.It
Check for suspicious commands in
-.Pa /etc/mail/aliases
+.Pa /etc/mail/aliases .
.It
Check for insecurities in various trust files such as
.Pa /etc/hosts.equiv , /etc/shosts.equiv ,
and
-.Pa /etc/hosts.lpd
+.Pa /etc/hosts.lpd .
.It
Check user
-.Pa .rhosts , .shosts
-files for open access
+.Pa .rhosts
+and
+.Pa .shosts
+files for open access.
.It
-Check user home directory permissions
+Check user home directory permissions.
.It
-Check many user dotfile permissions
+Check many user dotfile permissions.
.It
-Check user mailbox permissions
+Check user mailbox permissions.
.It
Check NFS
.Xr exports 5
-file for global export entries
+file for global export entries.
.It
-Check for changes in setuid/setgid files and devices
+Check for changes in setuid/setgid files and devices.
.It
-Check disk ownership and permissions
+Check disk ownership and permissions.
.It
-Check for changes in the device file list
+Check for changes in the device file list.
.It
Check for permssion changes in special files and system binaries listed in
.Pa /etc/mtree/special
@@ -77,12 +79,21 @@ For details on really protecting yourself against modified binaries, see
.Xr mtree 8 .
.It
Check for content changes in those files specified by
-.Pa /etc/changelist
+.Pa /etc/changelist .
.El
.Pp
The intent of the
-.Nm security
+.Nm
script is to point out some obvious holes to the system administrator.
+.Sh FILES
+.Bl -tag -width /dev/changelist -compact
+.It Pa /etc/daily
+.It Pa /etc/mtree
+.It Pa /etc/changelist
+.It Pa /var/backups
+.El
+.Sh SEE ALSO
+.Xr mtree 8
.Sh BUGS
The name of this script may provide a false sense of
.Nm security .
@@ -90,10 +101,3 @@ The name of this script may provide a false sense of
.Pp
There are perhaps an infinite number of ways the system can be compromised
without this script noticing.
-.Sh FILES
-.Pa /etc/daily ,
-.Pa /etc/mtree ,
-.Pa /etc/changelist ,
-.Pa /var/backups
-.Sh SEE ALSO
-.Xr mtree 8