o Reduce the number of offered security profiles, as we now have a more

  conservative default, and actually prompt specifically for inetd rather
  than handling it as a side effect of the security profile.  Update the
  help file to reflect this change.
o Rename "Fascist" to "Extreme" in the source code, to match the names
  presented to the user.
o Remove portmap and inetd from profile management.  Portmap is now
  disabled by default, but automatically turned on if a feature requires
  it (such as NFS, etc).

This is an MFC candidate for 4.4-RELEASE.

Reviewed by:	freebsd-arch@FreeBSD.org
Approved by:	re@FreeBSD.org
MFC after:	2 days

7 files changed, 36 insertions, 171 deletions

diff --git a/usr.sbin/sade/config.c b/usr.sbin/sade/config.c
index 2085691..91dc643 100644
--- a/usr.sbin/sade/config.c
+++ b/usr.sbin/sade/config.c
@@ -487,52 +487,22 @@ configSecurityProfile(dialogMenuItem *self)
     return DITEM_SUCCESS;
 }
 
-/* Use the most fascist security settings */
+/* Use the most extreme security settings */
 int
-configSecurityFascist(dialogMenuItem *self)
+configSecurityExtreme(dialogMenuItem *self)
 {
     WINDOW *w = savescr();
 
-    variable_set2("inetd_enable", "NO", 1);
-    variable_set2("portmap_enable", "NO", 1);
+    variable_set2("nfs_server_enable", "NO", 1);
     variable_set2("sendmail_enable", "NO", 1);
     variable_set2("sshd_enable", "NO", 1);
-    variable_set2("nfs_server_enable", "NO", 1);
     variable_set2("kern_securelevel_enable", "YES", 1);
     variable_set2("kern_securelevel", "2", 1);
-    /* More fascist stuff should go here */
 
     if (self)
 	msgConfirm("Extreme security settings have been selected.\n\n"
-	    "This means that all \"popular\" network services and\n"
-	    "mechanisms like inetd(8) have been DISABLED by default.\n\n"
-	    "PLEASE NOTE that this still does not save you from having\n"
-	    "to properly secure your system in other ways or exercise\n"
-	    "due diligence in your administration, this simply picks\n"
-	    "a more secure set of out-of-box defaults to start with.\n\n"
-	    "To change any of these settings later, edit /etc/rc.conf");
-
-    restorescr(w);
-    return DITEM_SUCCESS;
-}
-
-int
-configSecurityHigh(dialogMenuItem *self)
-{
-    WINDOW *w = savescr();
-
-    variable_set2("inetd_enable", "NO", 1);
-    variable_set2("sendmail_enable", "YES", 1);
-    variable_set2("sshd_enable", "YES", 1);
-    variable_set2("portmap_enable", "NO", 1);
-    variable_set2("nfs_server_enable", "NO", 1);
-    variable_set2("kern_securelevel_enable", "YES", 1);
-    variable_set2("kern_securelevel", "1", 1);
-
-    if (self)
-	msgConfirm("High security settings have been selected.\n\n"
-	    "This means that most \"popular\" network services and\n"
-	    "mechanisms like inetd(8) have been DISABLED by default.\n\n"
+	    "Sendmail, SSHd, and NFS services have been disabled, and\n"
+	    "securelevels have been enabled.\n"
 	    "PLEASE NOTE that this still does not save you from having\n"
 	    "to properly secure your system in other ways or exercise\n"
 	    "due diligence in your administration, this simply picks\n"
@@ -543,54 +513,23 @@ configSecurityHigh(dialogMenuItem *self)
     return DITEM_SUCCESS;
 }
 
-int
 configSecurityModerate(dialogMenuItem *self)
 {
     WINDOW *w = savescr();
 
-    variable_set2("inetd_enable", "YES", 1);
-    if (!variable_cmp("nfs_client_enable", "YES") ||
-	!variable_cmp("nfs_server_enable", "YES"))
-    	variable_set2("portmap_enable", "YES", 1);
-    if (!variable_cmp("nfs_server_enable", "YES"))
-	variable_set2("nfs_reserved_port_only", "YES", 1);
+    variable_set2("nfs_reserved_port_only", "YES", 1);
     variable_set2("sendmail_enable", "YES", 1);
     variable_set2("sshd_enable", "YES", 1);
     variable_set2("kern_securelevel_enable", "NO", 1);
 
     if (self)
 	msgConfirm("Moderate security settings have been selected.\n\n"
-	    "This means that most \"popular\" network services and\n"
-	    "mechanisms like inetd(8) have been enabled by default\n"
-	    "for a comfortable user experience but with possible\n"
-	    "trade-offs in system security.  If this bothers you and\n"
-	    "you know exactly what you are doing, select one of the\n"
-	    "other security profiles instead.\n\n"
-	    "To change any of these settings later, edit /etc/rc.conf");
-
-    restorescr(w);
-    return DITEM_SUCCESS;
-}
-
-int
-configSecurityLiberal(dialogMenuItem *self)
-{
-    WINDOW *w = savescr();
-
-    variable_set2("inetd_enable", "YES", 1);
-    variable_set2("portmap_enable", "YES", 1);
-    variable_set2("sendmail_enable", "YES", 1);
-    variable_set2("sshd_enable", "YES", 1);
-    variable_set2("kern_securelevel_enable", "NO", 1);
-
-    if (self)
-	msgConfirm("Liberal security settings have been selected.\n\n"
-	    "This means that most \"popular\" network services and\n"
-	    "mechanisms like inetd(8) have been enabled by default\n"
-	    "for the most comfortable user experience but with possible\n"
-	    "trade-offs in system security.  If this bothers you and\n"
-	    "you know exactly what you are doing, select one of the\n"
-	    "other security profiles instead.\n\n"
+	    "Sendmail and SSHd have been enabled, securelevels are\n"
+	    "disabled, and NFS server settings have been left intact.\n"
+            "PLEASE NOTE that this still does not save you from having\n"
+            "to properly secure your system in other ways or exercise\n"
+            "due diligence in your administration, this simply picks\n"
+            "a standard set of out-of-box defaults to start with.\n\n"
 	    "To change any of these settings later, edit /etc/rc.conf");
 
     restorescr(w);
diff --git a/usr.sbin/sade/menus.c b/usr.sbin/sade/menus.c
index 490dd13..a7e6bbe 100644
--- a/usr.sbin/sade/menus.c
+++ b/usr.sbin/sade/menus.c
@@ -1673,10 +1673,8 @@ DMenu MenuSecurityProfile = {
     "Select a canned security profile - F1 for help",
     "security",						/* help file */
     { { "X Exit",	"Exit this menu (returning to previous)", NULL, configSecurityModerate },
-      { "Low",		"Fairly wide-open (little) security.", NULL, configSecurityLiberal },
       { "Medium",	"Moderate security settings [DEFAULT].", NULL, configSecurityModerate },
-      { "High",		"Fairly safe security settings.", NULL, configSecurityHigh },
-      { "Extreme",	"Very restrictive security settings.", NULL, configSecurityFascist },
+      { "Extreme",	"Very restrictive security settings.", NULL, configSecurityExtreme },
       { NULL } },
 };
 
diff --git a/usr.sbin/sade/sade.h b/usr.sbin/sade/sade.h
index 79371e3..b473ab6 100644
--- a/usr.sbin/sade/sade.h
+++ b/usr.sbin/sade/sade.h
@@ -451,10 +451,8 @@ extern int	configInetd(dialogMenuItem *self);
 extern int	configNFSServer(dialogMenuItem *self);
 extern int	configWriteRC_conf(dialogMenuItem *self);
 extern int	configSecurityProfile(dialogMenuItem *self);
-extern int	configSecurityFascist(dialogMenuItem *self);
-extern int	configSecurityHigh(dialogMenuItem *self);
+extern int	configSecurityExtreme(dialogMenuItem *self);
 extern int	configSecurityModerate(dialogMenuItem *self);
-extern int	configSecurityLiberal(dialogMenuItem *self);
 extern int	configEtcTtys(dialogMenuItem *self);
 
 /* crc.c */
diff --git a/usr.sbin/sysinstall/config.c b/usr.sbin/sysinstall/config.c
index 2085691..91dc643 100644
--- a/usr.sbin/sysinstall/config.c
+++ b/usr.sbin/sysinstall/config.c
@@ -487,52 +487,22 @@ configSecurityProfile(dialogMenuItem *self)
     return DITEM_SUCCESS;
 }
 
-/* Use the most fascist security settings */
+/* Use the most extreme security settings */
 int
-configSecurityFascist(dialogMenuItem *self)
+configSecurityExtreme(dialogMenuItem *self)
 {
     WINDOW *w = savescr();
 
-    variable_set2("inetd_enable", "NO", 1);
-    variable_set2("portmap_enable", "NO", 1);
+    variable_set2("nfs_server_enable", "NO", 1);
     variable_set2("sendmail_enable", "NO", 1);
     variable_set2("sshd_enable", "NO", 1);
-    variable_set2("nfs_server_enable", "NO", 1);
     variable_set2("kern_securelevel_enable", "YES", 1);
     variable_set2("kern_securelevel", "2", 1);
-    /* More fascist stuff should go here */
 
     if (self)
 	msgConfirm("Extreme security settings have been selected.\n\n"
-	    "This means that all \"popular\" network services and\n"
-	    "mechanisms like inetd(8) have been DISABLED by default.\n\n"
-	    "PLEASE NOTE that this still does not save you from having\n"
-	    "to properly secure your system in other ways or exercise\n"
-	    "due diligence in your administration, this simply picks\n"
-	    "a more secure set of out-of-box defaults to start with.\n\n"
-	    "To change any of these settings later, edit /etc/rc.conf");
-
-    restorescr(w);
-    return DITEM_SUCCESS;
-}
-
-int
-configSecurityHigh(dialogMenuItem *self)
-{
-    WINDOW *w = savescr();
-
-    variable_set2("inetd_enable", "NO", 1);
-    variable_set2("sendmail_enable", "YES", 1);
-    variable_set2("sshd_enable", "YES", 1);
-    variable_set2("portmap_enable", "NO", 1);
-    variable_set2("nfs_server_enable", "NO", 1);
-    variable_set2("kern_securelevel_enable", "YES", 1);
-    variable_set2("kern_securelevel", "1", 1);
-
-    if (self)
-	msgConfirm("High security settings have been selected.\n\n"
-	    "This means that most \"popular\" network services and\n"
-	    "mechanisms like inetd(8) have been DISABLED by default.\n\n"
+	    "Sendmail, SSHd, and NFS services have been disabled, and\n"
+	    "securelevels have been enabled.\n"
 	    "PLEASE NOTE that this still does not save you from having\n"
 	    "to properly secure your system in other ways or exercise\n"
 	    "due diligence in your administration, this simply picks\n"
@@ -543,54 +513,23 @@ configSecurityHigh(dialogMenuItem *self)
     return DITEM_SUCCESS;
 }
 
-int
 configSecurityModerate(dialogMenuItem *self)
 {
     WINDOW *w = savescr();
 
-    variable_set2("inetd_enable", "YES", 1);
-    if (!variable_cmp("nfs_client_enable", "YES") ||
-	!variable_cmp("nfs_server_enable", "YES"))
-    	variable_set2("portmap_enable", "YES", 1);
-    if (!variable_cmp("nfs_server_enable", "YES"))
-	variable_set2("nfs_reserved_port_only", "YES", 1);
+    variable_set2("nfs_reserved_port_only", "YES", 1);
     variable_set2("sendmail_enable", "YES", 1);
     variable_set2("sshd_enable", "YES", 1);
     variable_set2("kern_securelevel_enable", "NO", 1);
 
     if (self)
 	msgConfirm("Moderate security settings have been selected.\n\n"
-	    "This means that most \"popular\" network services and\n"
-	    "mechanisms like inetd(8) have been enabled by default\n"
-	    "for a comfortable user experience but with possible\n"
-	    "trade-offs in system security.  If this bothers you and\n"
-	    "you know exactly what you are doing, select one of the\n"
-	    "other security profiles instead.\n\n"
-	    "To change any of these settings later, edit /etc/rc.conf");
-
-    restorescr(w);
-    return DITEM_SUCCESS;
-}
-
-int
-configSecurityLiberal(dialogMenuItem *self)
-{
-    WINDOW *w = savescr();
-
-    variable_set2("inetd_enable", "YES", 1);
-    variable_set2("portmap_enable", "YES", 1);
-    variable_set2("sendmail_enable", "YES", 1);
-    variable_set2("sshd_enable", "YES", 1);
-    variable_set2("kern_securelevel_enable", "NO", 1);
-
-    if (self)
-	msgConfirm("Liberal security settings have been selected.\n\n"
-	    "This means that most \"popular\" network services and\n"
-	    "mechanisms like inetd(8) have been enabled by default\n"
-	    "for the most comfortable user experience but with possible\n"
-	    "trade-offs in system security.  If this bothers you and\n"
-	    "you know exactly what you are doing, select one of the\n"
-	    "other security profiles instead.\n\n"
+	    "Sendmail and SSHd have been enabled, securelevels are\n"
+	    "disabled, and NFS server settings have been left intact.\n"
+            "PLEASE NOTE that this still does not save you from having\n"
+            "to properly secure your system in other ways or exercise\n"
+            "due diligence in your administration, this simply picks\n"
+            "a standard set of out-of-box defaults to start with.\n\n"
 	    "To change any of these settings later, edit /etc/rc.conf");
 
     restorescr(w);
diff --git a/usr.sbin/sysinstall/help/security.hlp b/usr.sbin/sysinstall/help/security.hlp
index 1b39f3e..ee172ff 100644
--- a/usr.sbin/sysinstall/help/security.hlp
+++ b/usr.sbin/sysinstall/help/security.hlp
@@ -3,19 +3,14 @@ profiles. The following table is intended to give you a rough idea just
 which services are enabled (or disabled) by each of the canned security
 profiles:
 
-               Extreme        High           Medium         Low
-               -------        ----           --------       ---
-inetd          NO             NO             YES            YES
-sendmail       NO             YES            YES            YES
-sshd           NO             YES            YES            YES
-portmap        NO             NO             *              YES
-nfs_server     NO             NO             **             ***
-securelevel    YES (2)        YES (1)        NO             NO
+               Extreme        Medium
+               -------        ------
+nfs_server     NO             *
+sendmail       NO             YES
+sshd           NO             YES
+securelevel    YES (2)        NO
 
 
 NOTES:
-*   Portmap is enabled if the machine has been configured as either an NFS
-    client or an NFS server earlier in the installation process.
-**  If the machine has been configured as an NFS server, NFS will only run
-    on a reserved port.
-*** No changes are made to the NFS configuration.
+*  If the machine has been configured as an NFS server, NFS will only run
+   on a reserved port.
diff --git a/usr.sbin/sysinstall/menus.c b/usr.sbin/sysinstall/menus.c
index 490dd13..a7e6bbe 100644
--- a/usr.sbin/sysinstall/menus.c
+++ b/usr.sbin/sysinstall/menus.c
@@ -1673,10 +1673,8 @@ DMenu MenuSecurityProfile = {
     "Select a canned security profile - F1 for help",
     "security",						/* help file */
     { { "X Exit",	"Exit this menu (returning to previous)", NULL, configSecurityModerate },
-      { "Low",		"Fairly wide-open (little) security.", NULL, configSecurityLiberal },
       { "Medium",	"Moderate security settings [DEFAULT].", NULL, configSecurityModerate },
-      { "High",		"Fairly safe security settings.", NULL, configSecurityHigh },
-      { "Extreme",	"Very restrictive security settings.", NULL, configSecurityFascist },
+      { "Extreme",	"Very restrictive security settings.", NULL, configSecurityExtreme },
       { NULL } },
 };
 
diff --git a/usr.sbin/sysinstall/sysinstall.h b/usr.sbin/sysinstall/sysinstall.h
index 79371e3..b473ab6 100644
--- a/usr.sbin/sysinstall/sysinstall.h
+++ b/usr.sbin/sysinstall/sysinstall.h
@@ -451,10 +451,8 @@ extern int	configInetd(dialogMenuItem *self);
 extern int	configNFSServer(dialogMenuItem *self);
 extern int	configWriteRC_conf(dialogMenuItem *self);
 extern int	configSecurityProfile(dialogMenuItem *self);
-extern int	configSecurityFascist(dialogMenuItem *self);
-extern int	configSecurityHigh(dialogMenuItem *self);
+extern int	configSecurityExtreme(dialogMenuItem *self);
 extern int	configSecurityModerate(dialogMenuItem *self);
-extern int	configSecurityLiberal(dialogMenuItem *self);
 extern int	configEtcTtys(dialogMenuItem *self);
 
 /* crc.c */