1 files changed, 12 insertions, 73 deletions

diff --git a/usr.sbin/sysinstall/config.c b/usr.sbin/sysinstall/config.c
index 2085691..91dc643 100644
--- a/usr.sbin/sysinstall/config.c
+++ b/usr.sbin/sysinstall/config.c
@@ -487,52 +487,22 @@ configSecurityProfile(dialogMenuItem *self)
     return DITEM_SUCCESS;
 }
 
-/* Use the most fascist security settings */
+/* Use the most extreme security settings */
 int
-configSecurityFascist(dialogMenuItem *self)
+configSecurityExtreme(dialogMenuItem *self)
 {
     WINDOW *w = savescr();
 
-    variable_set2("inetd_enable", "NO", 1);
-    variable_set2("portmap_enable", "NO", 1);
+    variable_set2("nfs_server_enable", "NO", 1);
     variable_set2("sendmail_enable", "NO", 1);
     variable_set2("sshd_enable", "NO", 1);
-    variable_set2("nfs_server_enable", "NO", 1);
     variable_set2("kern_securelevel_enable", "YES", 1);
     variable_set2("kern_securelevel", "2", 1);
-    /* More fascist stuff should go here */
 
     if (self)
 	msgConfirm("Extreme security settings have been selected.\n\n"
-	    "This means that all \"popular\" network services and\n"
-	    "mechanisms like inetd(8) have been DISABLED by default.\n\n"
-	    "PLEASE NOTE that this still does not save you from having\n"
-	    "to properly secure your system in other ways or exercise\n"
-	    "due diligence in your administration, this simply picks\n"
-	    "a more secure set of out-of-box defaults to start with.\n\n"
-	    "To change any of these settings later, edit /etc/rc.conf");
-
-    restorescr(w);
-    return DITEM_SUCCESS;
-}
-
-int
-configSecurityHigh(dialogMenuItem *self)
-{
-    WINDOW *w = savescr();
-
-    variable_set2("inetd_enable", "NO", 1);
-    variable_set2("sendmail_enable", "YES", 1);
-    variable_set2("sshd_enable", "YES", 1);
-    variable_set2("portmap_enable", "NO", 1);
-    variable_set2("nfs_server_enable", "NO", 1);
-    variable_set2("kern_securelevel_enable", "YES", 1);
-    variable_set2("kern_securelevel", "1", 1);
-
-    if (self)
-	msgConfirm("High security settings have been selected.\n\n"
-	    "This means that most \"popular\" network services and\n"
-	    "mechanisms like inetd(8) have been DISABLED by default.\n\n"
+	    "Sendmail, SSHd, and NFS services have been disabled, and\n"
+	    "securelevels have been enabled.\n"
 	    "PLEASE NOTE that this still does not save you from having\n"
 	    "to properly secure your system in other ways or exercise\n"
 	    "due diligence in your administration, this simply picks\n"
@@ -543,54 +513,23 @@ configSecurityHigh(dialogMenuItem *self)
     return DITEM_SUCCESS;
 }
 
-int
 configSecurityModerate(dialogMenuItem *self)
 {
     WINDOW *w = savescr();
 
-    variable_set2("inetd_enable", "YES", 1);
-    if (!variable_cmp("nfs_client_enable", "YES") ||
-	!variable_cmp("nfs_server_enable", "YES"))
-    	variable_set2("portmap_enable", "YES", 1);
-    if (!variable_cmp("nfs_server_enable", "YES"))
-	variable_set2("nfs_reserved_port_only", "YES", 1);
+    variable_set2("nfs_reserved_port_only", "YES", 1);
     variable_set2("sendmail_enable", "YES", 1);
     variable_set2("sshd_enable", "YES", 1);
     variable_set2("kern_securelevel_enable", "NO", 1);
 
     if (self)
 	msgConfirm("Moderate security settings have been selected.\n\n"
-	    "This means that most \"popular\" network services and\n"
-	    "mechanisms like inetd(8) have been enabled by default\n"
-	    "for a comfortable user experience but with possible\n"
-	    "trade-offs in system security.  If this bothers you and\n"
-	    "you know exactly what you are doing, select one of the\n"
-	    "other security profiles instead.\n\n"
-	    "To change any of these settings later, edit /etc/rc.conf");
-
-    restorescr(w);
-    return DITEM_SUCCESS;
-}
-
-int
-configSecurityLiberal(dialogMenuItem *self)
-{
-    WINDOW *w = savescr();
-
-    variable_set2("inetd_enable", "YES", 1);
-    variable_set2("portmap_enable", "YES", 1);
-    variable_set2("sendmail_enable", "YES", 1);
-    variable_set2("sshd_enable", "YES", 1);
-    variable_set2("kern_securelevel_enable", "NO", 1);
-
-    if (self)
-	msgConfirm("Liberal security settings have been selected.\n\n"
-	    "This means that most \"popular\" network services and\n"
-	    "mechanisms like inetd(8) have been enabled by default\n"
-	    "for the most comfortable user experience but with possible\n"
-	    "trade-offs in system security.  If this bothers you and\n"
-	    "you know exactly what you are doing, select one of the\n"
-	    "other security profiles instead.\n\n"
+	    "Sendmail and SSHd have been enabled, securelevels are\n"
+	    "disabled, and NFS server settings have been left intact.\n"
+            "PLEASE NOTE that this still does not save you from having\n"
+            "to properly secure your system in other ways or exercise\n"
+            "due diligence in your administration, this simply picks\n"
+            "a standard set of out-of-box defaults to start with.\n\n"
 	    "To change any of these settings later, edit /etc/rc.conf");
 
     restorescr(w);