| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
non-printable characters to sneak into /var/log/messages (e.g.
someone aims a Solaris/Linux RCP exploit at your FreeBSD box and
you end up with his shellcode as part of a log entry). You might
get something like,
host.mydom.org login failures:
Binary file (standard input) matches
In the daily security script as a result. Allowing attackers to
mess with your security script's ability to accurately report
is a Bad Thing. Tell grep(1) to treat /var/log/messages like a
text file even if it has non-printable characters.
Submitted by: Tim Zingelman <zingelman@fnal.gov> on freebsd-security
Approved by: ru
MFC after: 1 week
|
|
|
|
|
| |
PR: 26870
Submitted by: Tomonobu AKIMOTO <akimoto@xephion.ne.jp>
|
| |
|
|
|
|
| |
periodic/daily/470.status-named.
|
|
|
|
| |
MFC canidate.
|
|
|
|
|
|
|
|
|
| |
'denied AXFR', not 'unapproved AXFR'.
This is an MFC candidate.
PR: misc/26529
Submitted by: duwde@duwde.com.br
|
|
|
|
|
| |
PR: 25845
Submitted by: Udo Schweigert <ust@cert.siemens.de>
|
|
|
|
|
|
| |
Submitted by: inTEXT Communications <glenn@intextonline.com>
Ok'd by: imp, kris
Not objected to by: freebsd-audit
|
|
|
|
|
|
|
|
|
|
| |
just messages{,.0*} when looking for login failures and refused
connections.
PR: 23415
Mostly submitted by: phk
Convert a few " "s to tabs while I'm here - for consistency.
|
|
|
|
|
|
|
|
|
|
| |
* Put quotes around each line
* Single quotes for lines with no variable interpolation
* Double quotes if there is
* Capitalize each word that begins a line
* Make echo -n 'Doing foo:' ... echo '.' more of a standard
No functionality changes
|
|
|
|
| |
w/o giving any credit.
|
|
|
|
|
|
| |
Requested by: des
Remove a redundant sed
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
All periodic sub-scripts <larf> now have their return codes interpreted
by periodic(8). Output may be masked based on variable values in
periodic.conf.
It's also now possible to email periodic output to arbitrary addresses,
or to send it to a log file, examples of which can be found in
newsyslog.conf.
The upshot of it all should be no discernable changes to the default
behaviour of periodic(8).
PR: 21250
|
|
|
|
| |
rather than ``diff -b''.
|
|
|
|
|
|
|
|
|
|
| |
I've seen some script kiddie tools out there that fake the timestamps
but don't preserve the inode number.
Note - this will cause a lot of output the first time it is run!
PR: 18947
Reviewed by: Sheldon Hearn <sheldonh@uunet.co.za>
|
|
|
|
|
| |
mounts and ignoring mfs mounts.
Default functionality stays the same.
|
|
|
|
|
|
|
| |
today from the way they were mounted yesterday.
PR: 17155
Submitted by: "Crist J. Clark" <cjc@cc942873-a.ewndsr1.nj.home.com>
|
|
|
|
| |
Submitted by: "Sean O'Connell" <sean@stat.Duke.EDU>
|
|
|
|
|
| |
PR: misc/12228
Submitted by: Philippe SCHACK <phschak@inba.fr>
|
|
|
|
|
| |
PR: 13909
Submitted by: Peter Jeremy <peter.jeremy@alcatel.com.au>
|
|
|
|
|
|
|
| |
the unfortunate side-effect of breaking the security script for hosts
without kernel support for IPFW. Fix.
Reported by: jhay
|
|
|
|
|
|
|
|
|
| |
case instead of test where appropriate, since case allows case is a sh
builtin and (as a side-effect) allows case-insensitivity.
Changes discussed on freebsd-hackers.
Submitted by: Doug Barton <Doug@gorean.org>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* All variables are now embraced: ${foo}
* All comparisons against some value now take the form:
[ "${foo}" ? "value" ]
where ? is a comparison operator
* All empty string tests now take the form:
[ -z "${foo}" ]
* All non-empty string tests now take the form:
[ -n "${foo}" ]
Submitted by: jkh
|
|
|
|
|
|
| |
PR: 9639
Reported by: Bob Willcox <bob@pmr.com>
Submitted by: des
|
|
|
|
|
| |
PR: 9424
Submitted by: Lars K*ller <root@cc.fh-lippe.de>
|
|
|
|
|
|
|
|
|
| |
to a hostname. This will help those who keep a cluster of machines all with
the same hostname but different domain names.
PR: bin/9091
Submitted By: Heikki Suonsivu <hsu@clinet.fi>
No Response From: -current mailing list
|
|
|
|
|
| |
PR: 7621
Submitted by: Mark Huizer
|
|
|
|
| |
Use awk -F: rather than 'BEGIN {FS=":"}'
|
|
|
|
|
|
|
|
| |
fail to detect 00.
PR: 7218
Submitted by: Michal Listos <mcl@Amnesiac.123.org>
Niall Smart <rotel@indigo.ie>
|
|
|
|
|
| |
- login failures
- tcp_wrapper messages about refused connections
|
| |
|
|
|
|
| |
or unreach.
|
|
|
|
| |
dmesg changes.
|
|
|
|
| |
The -g option to ls has been depreciated.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This allows find to pass files with "illegal" characters to xargs in a
safe manner.
Note: due to the manner in which the file names are now passed between
find and xargs, the files are now sorted differently than before.
The first /etc/security run after installing this change may result
in a lot of output when nothing did in fact change.
Closes PR# 1910.
2.2 candidate.
|
| |
|
|
|
|
|
|
|
|
| |
This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.
Boy, I'm glad we're not using sup anymore. This update would have been
insane otherwise.
|
|
|
|
| |
to freefall!)
|
|
|
|
| |
messages using the output of dmesg.
|
| |
|
|
|
|
|
|
| |
that have changed since the last security check.
Make the spacing between sections more consistent.
|
|
|
|
|
|
|
| |
the /etc/security setuid checks. This is useful for things like large
news spool partitions that dont have executables.
Reviewed by: pst
|
|
|
|
| |
guessing involves too much AI.
|
|
|
|
|
|
| |
Check devices too, follow original BSD intention
Find only executable files with s-bits, close PR bin/1022
Reset locale to C to have equal results in any case
|
|
|
|
| |
warning and make it, all following commands fails in old case
|
| |
|
|
|
|
| |
found SUID files, only SGID files. The find has missed some parantheses.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Subject: Re: daily insecurity output (fwd)
|From: rgrimes@agora.rain.com (Rodney Grimes)
|
|This is from the new /etc/security script. I no longer get the segmentation
|violation, but now the arg list is too long, some /bin/sh program want to
|fix the current /etc/security ls command so that it is a pipe insteal of
|a back quoted arg?
|
|> checking setuid files and devices:
|> /etc/security: ls: argument list too long
This uses xargs instead. My slip line's down so I can't check it in
at the moment. Rich
|
|
|
|
| |
directorty contents.
|