store radius passwords and nothing requires it to be group readable.
ok yasuoka@

Add soii.key to changelist (pointed out by semarie) and mtree/special
(suggest by Craig Skinner).
OK naddy, sthen, rpe, tb

OK reyk mlarkin

checks for the correct mode/ownership.
prodded by ajacoutot@

ok deraadt@ sthen@ florian@

ok jung@ (some time ago) phessler@

CUPS wants it to be a symlink, and that is probably the most common
printing system.  Bad idea to constantly spam everybody about that!
Antoine already adjusted the file permissions in pkg/cupsd.rc rev. 1.24.
OK ajacoutot@  (print/cups MAINTAINER).

won't complain in the daily(8) mail.
ok ajacoutot@

the doas program itself will refuse to use an insecure config file.
(changelist will continue to watch for changes, as well.)

to hook the rc script and modify etc/rc.conf to make it disable by
default.  Also add an entry for /etc/radiusd.conf to etc/changelist
and etc/mtree/special.
ok deraadt

ok matthieu@

ok matthieu@

likely to be more changes here to match the new layout.
ok ingo aja

From inframare at arachnogoat dot com; OK deraadt@ sthen@

ok landry@ ajacoutot@

ok henning@

ok deraadt@ guenther@

ok deraadt@

by Bjorn Ketelaars.  Check that the /var/nsd/etc directory is protected
instead, it may contain zone-transfer keys etc.

Make sure the directory, DB and master keys have secure permissions.
ok dcoppa@ robert@ beck@

ok schwarze@ giovanni@ sthen@

ok deraadt@

Also pointed out by Mattieu Baptiste <mattieu dot b at gmail dot com>, thanks.

does not require special permissions.  The security(8) scripts hates
group-writeable home directories, so remove the needless permissions.
Issue noticed by Andrew Fresh <andrew at afresh1 dot com>.
If i understand naddy@ correctly, this is unlikely to harm even UUCP users.
"Just remove the group writeable bit" deraadt@.

ok deraadt@

ok jsg@

ok pyr@

in preparation for improvements in /etc/daily and /etc/weekly
using feedback and suggestions from jmc@ and sthen@
ok jmc@, and sthen@ agreed with the general direction

approved by deraadt@, ok thib@

From Daniel Ouellet (daniel at presscom dot net)

At this time, there is no sensitive information in that file.
ok beck@, millert@, jdixon@, deraadt@