| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
| |
Reported by: mdodd
Pointy hat to: jhb
|
|
|
|
|
|
|
| |
removing the related 220.backup-distfile script and associatd periodic.conf
entry.
Discussed with: obrien
|
| |
|
| |
|
|
|
|
|
| |
Tell sendmail to clean up its own host status cache.
The error condition handling could probably be done better.
|
| |
|
|
|
|
|
|
| |
base system one step closer to being totally perl-free.
Approved by: re (jhb)
|
|
|
|
|
|
|
| |
is shorter than the other.
Reviewed by: roberto
MFC after: 3 days
|
|
|
|
|
|
| |
Reviewed by: roberto
Committed from: EuroBSDCon Amsterdam
MFC after: 3 days
|
|
|
|
| |
Reviewed by: roberto
|
|
|
|
|
|
|
|
| |
rejected by ipfilter (510.ipfdenied), and a corresponding periodic.conf
knob (daily_status_security_ipfdenied_enable).
Reviewed by: roberto
Approved by: re@
|
|
|
|
|
|
|
| |
separate file, /etc/periodic/security/security.functions.
Reviewed by: roberto (mentor)
Approved by: re@
|
|
|
|
|
|
|
|
|
| |
and atime only, but also the ctime. Otherwise, files extracted from
tar or zip archives will immediately be declared stale since they've
got their mtime reset to the original mtime.
Reviewed by: brian
MFC after: 1 week
|
|
|
|
| |
of pkg_version in periodic/weekly/400.status-pkg.
|
|
|
|
| |
All old sorts understand -k too.
|
|
|
|
|
|
|
|
|
| |
in the script. Eliminates a bug where we create a temp file, but don't
delete it since the rm(1) is only done if the check is enabled.
PR: bin/40960
Submitted by: frf <frf@xocolatl.com>
MFC after: 3 days
|
|
|
|
|
|
|
|
| |
o Bring if/then style in sync with /etc/rc scripts
PR: conf/41570
Submitted by: Konstantin M Volevatch <cox@rosnet.ru>
MFC after: 1 week
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
MP=`mount -t ufs | grep -v " nosuid" | awk '{ print $3 }' | sort`
sets ${MP} to an empty string so the next line:
set ${MP}
actually just dumps all of the shells variables to stdout (and therefore
the security report). Fixed by surrounding the code which goes through the
mounts with a test for an empty string before using ${MP}.
Reviewed by: brian
MFC after: 3 days
|
|
|
|
| |
strip the suffixes).
|
| |
|
|
|
|
|
|
|
| |
no output.
PR: 39618
MFC after: 1 week
|
|
|
|
|
|
|
|
|
|
| |
of wtmp.0 is done as mode 600.
This ensures that tight permissions set in /etc/newsyslog.conf for
wtmp logging aren't ``betrayed''.
Suggested by: lumpy <lumpy@the.whole.net>
MFC after: 3 days
|
|
|
|
|
|
|
|
|
|
|
| |
The change was introduced in src/etc/security 1.53 almost a year ago
in an attempt to see ipfw deny message logs.
However, ipfw deny/reject logs have been displayed since version 1.13
of the same file as a separate ``job'' and have since moved to
src/etc/periodic/security/500.ipfwdenied.
MFC after: 3 days
|
|
|
|
|
| |
Problem reported by: lumpy <lumpy@the.whole.net>
MFC after: 3 days
|
|
|
|
|
|
| |
Returning $? masks security output when ``periodic security'' is successful !
MFC after: 3 days
|
|
|
|
|
|
| |
PR: 23766
Mostly submitted by: lambert@ssabsd.csw.net
MFC after: 3 days
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Due to the way we run ls(1), through xargs(1), the leading whitespace
can change even when the setuid files haven't. To avoid displaying
these lines, we currently run diff(1) with the '-w' option. However,
this is probably not the ideal way to go; there is a very, very small
possibility for diff(1) to miss things is shouldn't. So, with the
leading space cleaned, we can revert to the '-b' option which is
"safer."
PR: conf/37618
Reviewed by: brian
MFC after: 3 days
|
|
|
|
|
|
| |
PR: 37529
Partially submitted by: Peter Hollaubek <fifteen@inext.hu>
MFC after: 1 week
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
clientmqueue (submit mail queue).
The new mailq display is only active if both the old
daily_status_mailq_enable is set to "YES" and the new
daily_status_include_submit_mailq is set to "YES" so people who disabled
440.status-mailq won't have any surprises.
Likewise, the new queue run is only active if both the old
daily_queuerun_enable is set to "YES" and the new daily_submit_queuerun
is set to "YES" so people who disabled 500.queuerun won't have any
surprises.
While I am here, remove the [ ! -d /var/spool/mqueue ] checks from
both scripts as the queue directory isn't always /var/spool/mqueue for
the main daemon -- it can be set to anything in the sendmail.cf file.
MFC after: 1 week
|
| |
|
|
|
|
|
|
| |
and teach it to look for more general classes of failures, including
SSH login failures. This is similar but not identical to a patch
submitted by aeonflux@synapse.subneural.net.
|
|
|
|
|
| |
PR: bin/35558
Submitted by: Nicolas Rachinsky <list@rachinsky.de>
|
|
|
|
|
|
|
|
| |
the output of all goes well.
PR: 34825
Submitted by: Valentin Nechayev <netch@netch.kiev.ua>
MFC after: 3 weeks
|
| |
|
|
|
|
| |
PR: bin/32822
|
|
|
|
|
|
|
|
|
|
| |
of /etc/daily. Some time later, /etc/daily became a set of periodic(8)
scripts. Now, this evolution continues, and /etc/security has been
broken into periodic(8) scripts to make local customization easier and
more maintainable.
Reviewed by: ru
Approved by: ru
|
|
|
|
| |
same way the daily run output does.
|
|
|
|
|
|
| |
PR: 32113
Submitted by: Yar Tikhiy <yar@comp.chem.msu.su>
MFC after: 1 week
|
|
|
|
|
|
|
|
|
| |
the idea of not masking passwords on comments in case the
administrator comments out an entry without clearing the
password. Instead completely ignore comments (since they have no
security impact) when doing the diff of the old and new passwd file.
Suggested by: rwatson
|
|
|
|
|
|
|
|
|
|
| |
Backup passwd and group files:
1c1
< # $FreeBSD:(password):09:07 peter Exp $
---
> # $FreeBSD:(password):27:16 ache Exp $
MFC after: 1 week
|
| |
|
| |
|
|
|
|
|
|
|
|
| |
files to look an (in the same way that /etc/security does).
Don't single-quote $start, reducing it to an empty string.
MFC after: 3 days
|
|
|
|
|
|
| |
Submitted by: NIIMI Satoshi <sa2c@and.or.jp>
PR: 28355
MFC after: 1 week
|
|
|
|
|
| |
PR: 27707
Approved by: bmah, markm
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
| |
originally submitted patch (oops!).
Also check for an empty $daily_accounting_save.
Submitted by: Udo Schweigert <Udo.Schweigert@cert.siemens.de>
|
|
|
|
|
| |
Submitted by: Udo Schweigert <Udo.Schweigert@cert.siemens.de>
MFC after: 2 weeks
|