1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
|
#
# $OpenBSD: daily,v 1.60 2009/05/11 22:27:22 schwarze Exp $
# From: @(#)daily 8.2 (Berkeley) 1/25/94
#
umask 022
PATH=/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin
PARTOUT=/var/log/daily.part
MAINOUT=/var/log/daily.out
install -o 0 -g 0 -m 600 /dev/null $PARTOUT
install -o 0 -g 0 -m 600 -b /dev/null $MAINOUT
start_part() {
TITLE=$1
exec > $PARTOUT 2>&1
}
end_part() {
exec >> $MAINOUT 2>&1
test -s $PARTOUT || return
echo ""
echo "$TITLE"
cat $PARTOUT
}
next_part() {
end_part
start_part "$1"
}
run_script() {
f=/etc/$1
test -e $f || return
if [ `stat -f '%Sp%u' $f | cut -b1,6,9,11-` != '---0' ]; then
echo "$f has insecure permissions, skipping:"
ls -l $f
return
fi
. $f
}
start_part "Running daily.local:"
run_script "daily.local"
next_part "Removing scratch and junk files:"
if [ -d /tmp -a ! -L /tmp ]; then
cd /tmp && {
find -x . \
\( -path './ssh-*' -o -path ./.X11-unix -o -path ./.ICE-unix \) \
-prune -o -type f -atime +3 -execdir rm -f -- {} \;
find -x . -type d -mtime +1 ! -path ./vi.recover ! -path ./.X11-unix \
! -path ./.ICE-unix ! -name . -execdir rmdir -- {} \; >/dev/null 2>&1; }
fi
if [ -d /var/tmp -a ! -L /var/tmp ]; then
cd /var/tmp && {
find -x . \
\( -path './ssh-*' -o -path ./.X11-unix -o -path ./.ICE-unix \) \
-prune -o ! -type d -atime +7 -execdir rm -f -- {} \;
find -x . -type d -mtime +1 ! -path ./vi.recover ! -path ./.X11-unix \
! -path ./.ICE-unix ! -name . -execdir rmdir -- {} \; >/dev/null 2>&1; }
fi
# Additional junk directory cleanup would go like this:
#if [ -d /scratch -a ! -L /scratch ]; then
# cd /scratch && {
# find . ! -name . -atime +1 -execdir rm -f -- {} \;
# find . ! -name . -type d -mtime +1 -execdir rmdir -- {} \; \
# >/dev/null 2>&1; }
#fi
if [ -d /var/rwho -a ! -L /var/rwho ] ; then
cd /var/rwho && {
find . ! -name . -mtime +7 -execdir rm -f -- {} \; ; }
fi
if [ -d /var/msgs -a ! -L /var/msgs ]; then
msgs -c
fi
next_part "Purging accounting records:"
if [ -f /var/account/acct ]; then
mv -f /var/account/acct.2 /var/account/acct.3
mv -f /var/account/acct.1 /var/account/acct.2
mv -f /var/account/acct.0 /var/account/acct.1
cp -f /var/account/acct /var/account/acct.0
sa -sq
fi
# If ROOTBACKUP is set to 1 in the environment, and
# if filesystem named /altroot is type ffs, on /dev/* and mounted "xx",
# use it as a backup root filesystem to be updated daily.
next_part "Backing up root filesystem:"
[ "X$ROOTBACKUP" = X1 ] && {
rootdev=`df -n / | awk '/^\/dev\// { print substr($1, 6) }'`
rootbak=`awk '$2 == "/altroot" && $1 ~ /^\/dev\// && $3 == "ffs" && \
$4 ~ /xx/ \
{ print substr($1, 6) }' < /etc/fstab`
[ X$rootdev != X -a X$rootbak != X -a X$rootdev != X$rootbak ] && {
next_part "Backing up root=/dev/r$rootdev to /dev/r$rootbak:"
sync
dd if=/dev/r$rootdev of=/dev/r$rootbak bs=16b seek=1 skip=1 \
conv=noerror
fsck -y /dev/r$rootbak
}
}
next_part "Checking system status:"
if [ "X$VERBOSESTATUS" != X0 ]; then
sysctl -n kern.version
uptime
echo ""
echo "disks:"
df -kl
echo ""
dump W
fi
# The first two regular expressions handle sendmail, the third postfix.
# When the queue is empty, exim -bp keeps silent.
next_part "mail:"
mailq | grep -v -e "^/var/spool/mqueue is empty$" \
-e "^[[:blank:]]*Total requests: 0$" \
-e "^Mail queue is empty$"
next_part "network:"
if [ "X$VERBOSESTATUS" != X0 ]; then
netstat -ivn
t=/var/rwho/*
if [ "$t" != '/var/rwho/*' ]; then
echo ""
ruptime
fi
fi
next_part "Running calendar in the background:"
if [ "X$CALENDAR" != X0 -a \
\( -d /var/yp/`domainname` -o ! -d /var/yp/binding \) ]; then
calendar -a &
fi
# If CHECKFILESYSTEMS is set to 1 in the environment, run fsck
# with the no-write flag.
next_part "Checking filesystems:"
[ "X$CHECKFILESYSTEMS" = X1 ] && {
fsck -n | grep -v '^\*\* Phase'
}
next_part "Running rdist:"
if [ -f /etc/Distfile ]; then
if [ -d /var/log/rdist ]; then
logf=`date +%Y.%b.%e`
rdist -f /etc/Distfile 2>&1 | tee /var/log/rdist/$logf
else
rdist -f /etc/Distfile
fi
fi
end_part
[ -s $MAINOUT ] && mail -s "`hostname` daily output" root < $MAINOUT
MAINOUT=/var/log/security.out
install -o 0 -g 0 -m 600 -b /dev/null $MAINOUT
start_part "Running /etc/security:"
run_script "security"
end_part
rm -f $PARTOUT
[ -s $MAINOUT ] && mail -s "`hostname` daily insecurity output" root < $MAINOUT
|
