SECURITY(8)             OpenBSD System Manager's Manual            SECURITY(8)

NNAAMMEE
     sseeccuurriittyy - periodic system security check

SSYYNNOOPPSSIISS
     //eettcc//sseeccuurriittyy

DDEESSCCRRIIPPTTIIOONN
     sseeccuurriittyy is a command script that examines the system for some signs of
     security weaknesses.  It is only a security aid and does not offer com-
     plete protection.  The sseeccuurriittyy script is normally run from the
     _/_e_t_c_/_d_a_i_l_y script, which sends mails to root on a daily basis.

     The sseeccuurriittyy script carries out the following list of simple checks:

     ++oo   Check the master passwd(5) and group(5) files for syntax, empty pass-
         words, partially closed accounts, suspicious UIDs, suspicious GIDs,
         and duplicate entries.

     ++oo   Check root's home directory and login environment for insecure per-
         missions, suspicious paths, and umask commands in the dotfiles.

     ++oo   Check that root and uucp are in _/_e_t_c_/_f_t_p_u_s_e_r_s.

     ++oo   Check for suspicious commands in _/_e_t_c_/_m_a_i_l_/_a_l_i_a_s_e_s.

     ++oo   Check for insecurities in various trust files such as
         _/_e_t_c_/_h_o_s_t_s_._e_q_u_i_v, _/_e_t_c_/_s_h_o_s_t_s_._e_q_u_i_v, and _/_e_t_c_/_h_o_s_t_s_._l_p_d.

     ++oo   Check user _._r_h_o_s_t_s and _._s_h_o_s_t_s files for open access.

     ++oo   Check user home directory permissions.

     ++oo   Check many user dotfile permissions.

     ++oo   Check user mailbox permissions.

     ++oo   Check NFS exports(5) file for global export entries.

     ++oo   Check for changes in setuid/setgid files and devices.

     ++oo   Check disk ownership and permissions.

     ++oo   Check for changes in the device file list.

     ++oo   Check for permssion changes in special files and system binaries
         listed in _/_e_t_c_/_m_t_r_e_e_/_s_p_e_c_i_a_l and _/_e_t_c_/_m_t_r_e_e_/_*_._s_e_c_u_r_e. NNoottee:: This is
         not complete protection against Trojan horsed binaries, as the mis-
         creant can modify the tree specification to match the replaced bina-
         ry.  For details on really protecting yourself against modified bina-
         ries, see mtree(8).

     ++oo   Check for content changes in those files specified by
         _/_e_t_c_/_c_h_a_n_g_e_l_i_s_t.

     The intent of the sseeccuurriittyy script is to point out some obvious holes to
     the system administrator.

FFIILLEESS
     /etc/daily
     /etc/mtree
     /etc/changelist
     /var/backups

SSEEEE AALLSSOO
     mtree(8)

BBUUGGSS
     The name of this script may provide a false sense of sseeccuurriittyy.

     There are perhaps an infinite number of ways the system can be compro-
     mised without this script noticing.

OpenBSD 2.9                      July 1, 2000                                2
