|
@ -1,6 +1,6 @@ |
|
|
#!/bin/sh - |
|
|
#!/bin/sh - |
|
|
# |
|
|
# |
|
|
# $OpenBSD: security,v 1.14 1996/12/06 17:17:13 millert Exp $ |
|
|
|
|
|
|
|
|
# $OpenBSD: security,v 1.15 1996/12/06 17:51:49 millert Exp $ |
|
|
# from: @(#)security 8.1 (Berkeley) 6/9/93 |
|
|
# from: @(#)security 8.1 (Berkeley) 6/9/93 |
|
|
# |
|
|
# |
|
|
|
|
|
|
|
@ -33,7 +33,7 @@ awk -F: '{ |
|
|
} |
|
|
} |
|
|
if (NF != 10) |
|
|
if (NF != 10) |
|
|
printf("Line %d has the wrong number of fields.\n", NR); |
|
|
printf("Line %d has the wrong number of fields.\n", NR); |
|
|
if ($1 ~ /^[+-].*$/) |
|
|
|
|
|
|
|
|
if ($1 ~ /^[+-]/) |
|
|
next; |
|
|
next; |
|
|
if ($1 == "") |
|
|
if ($1 == "") |
|
|
printf("Line %d has an empty login field.\n", NR); |
|
|
printf("Line %d has an empty login field.\n", NR); |
|
@ -43,7 +43,7 @@ awk -F: '{ |
|
|
printf("Login %s has more than 8 characters.\n", $1); |
|
|
printf("Login %s has more than 8 characters.\n", $1); |
|
|
if ($2 == "") |
|
|
if ($2 == "") |
|
|
printf("Login %s has no password.\n", $1); |
|
|
printf("Login %s has no password.\n", $1); |
|
|
if (length($2) != 13 && ($10 ~ /.*sh$/ || $10 == "")) |
|
|
|
|
|
|
|
|
if ((length($2) != 13 && ($10 ~ /.*sh$/ || $10 == "")) && system("for i in .rhosts .shosts .klogin ; do test -s "$9"/$i -a ! -O "$9"/$i && exit 1 ; done ; exit 0") != 0) |
|
|
printf("Login %s is off but still has a valid shell.\n", $1); |
|
|
printf("Login %s is off but still has a valid shell.\n", $1); |
|
|
if ($3 == 0 && $1 != "root") |
|
|
if ($3 == 0 && $1 != "root") |
|
|
printf("Login %s has a user id of 0.\n", $1); |
|
|
printf("Login %s has a user id of 0.\n", $1); |
|
@ -132,7 +132,7 @@ rhome=/root |
|
|
umaskset=no |
|
|
umaskset=no |
|
|
list="/etc/csh.cshrc /etc/csh.login ${rhome}/.cshrc ${rhome}/.login" |
|
|
list="/etc/csh.cshrc /etc/csh.login ${rhome}/.cshrc ${rhome}/.login" |
|
|
for i in $list ; do |
|
|
for i in $list ; do |
|
|
if [ -f $i ] ; then |
|
|
|
|
|
|
|
|
if [ -s $i ] ; then |
|
|
if egrep umask $i > /dev/null ; then |
|
|
if egrep umask $i > /dev/null ; then |
|
|
umaskset=yes |
|
|
umaskset=yes |
|
|
fi |
|
|
fi |
|
@ -174,7 +174,7 @@ rhome=/root |
|
|
umaskset=no |
|
|
umaskset=no |
|
|
list="${rhome}/.profile" |
|
|
list="${rhome}/.profile" |
|
|
for i in $list; do |
|
|
for i in $list; do |
|
|
if [ -f $i ] ; then |
|
|
|
|
|
|
|
|
if [ -s $i ] ; then |
|
|
if egrep umask $i > /dev/null ; then |
|
|
if egrep umask $i > /dev/null ; then |
|
|
umaskset=yes |
|
|
umaskset=yes |
|
|
fi |
|
|
fi |
|
@ -252,7 +252,7 @@ awk -F: '$1 != "root" && $1 !~ /^[+-]/ && \ |
|
|
while read uid homedir; do |
|
|
while read uid homedir; do |
|
|
for j in .rhosts .shosts; do |
|
|
for j in .rhosts .shosts; do |
|
|
# Root owned .rhosts/.shosts files are ok. |
|
|
# Root owned .rhosts/.shosts files are ok. |
|
|
if [ -f ${homedir}/$j -a ! -O ${homedir}/$j ] ; then |
|
|
|
|
|
|
|
|
if [ -s ${homedir}/$j -a ! -O ${homedir}/$j ] ; then |
|
|
rhost=`ls -ldgT ${homedir}/$j` |
|
|
rhost=`ls -ldgT ${homedir}/$j` |
|
|
printf "$uid: $rhost\n" |
|
|
printf "$uid: $rhost\n" |
|
|
fi |
|
|
fi |
|
|