aboutsummaryrefslogtreecommitdiff
path: root/etc/periodic/security
Commit message (Collapse)AuthorAgeFilesLines
* Move all periodic related config and scripts to usr.sbin/periodic/Brad Davis2018-08-1116-960/+0
| | | | | | | | | | | | This makes pkgbase easier by tagging these as CONFS so they are properly tagged as config files. Approved by: will (mentor) Sponsored by: Essen Hackathon Differential Revision: https://reviews.freebsd.org/D16553 Notes: svn path=/head/; revision=337648
* Fix 100.chksetuid and 110.neggrpperm for mountpoints with spacesAlan Somers2017-08-253-2/+15
| | | | | | | | | | | Also, fix them for mountpoints with tabs. PR: 48325 Reported by: pguyot@kallisys.net, aaron@baugher.biz MFC after: 3 weeks Notes: svn path=/head/; revision=322868
* Only install 900.tcpwrap if MK_INETD != "no" and MK_TCP_WRAPPERS != "no"Enji Cooper2017-03-081-2/+5
| | | | | | | | | | | | | | | It relies on output from inetd that is triggered by MK_TCP_WRAPPERS=yes. We need to check for both knobs being set -- otherwise the script doesn't have much value. PR: 217577 Submitted by: Sergey <kpect@protonmail.com> (MK_TCP_WRAPPERS piece) MFC after: 1 week Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=314895
* Make 502.pfdenied find blacklistd/* filter names dynamicallyKurt Lidl2016-10-041-2/+1
| | | | | | | | | | | | This change is needed to make the 520.pfdenied script find the new blacklistd/* anchor points for reporting blocked traffic. Reviewed by: kp MFC after: 1 week Sponsored by: The FreeBSD Foundation Notes: svn path=/head/; revision=306696
* Fix periodic scripts when an NFS mount covers a local mountAlan Somers2016-09-202-2/+2
| | | | | | | | | | | | | | | | 100.chksetuid and 110.neggrpperm try to search through all UFS and ZFS filesystems. But their logic contains an error. They also search through remote filesystems that are mounted on top of the root of a local filesystem. For example, if a user installs a FreeBSD system with the default ZFS layout, he'll get a zroot/usr/home filesystem. If he then mounts /usr/home over NFS, these scripts would search through /usr/home. MFC after: 4 weeks Sponsored by: Spectra Logic Corp Differential Revision: https://reviews.freebsd.org/D7482 Notes: svn path=/head/; revision=306048
* Add basic blacklist build supportKurt Lidl2016-06-021-2/+8
| | | | | | | | | | | Reviewed by: rpaulo Approved by: rpaulo Relnotes: YES Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D5913 Notes: svn path=/head/; revision=301226
* Zero pf rule counters so daily reports make senseKurt Lidl2016-02-091-1/+1
| | | | | | | | | | | | | | Zero pf rule counters so that each daily report lists an absolute number of rejected packets, not the total since the last time the machine rebooted (or the counters were manually cleared). PR: 206467 Submitted by: Rick Adams Approved by: rpaulo (mentor) Differential Revision: https://reviews.freebsd.org/D5172 Notes: svn path=/head/; revision=295452
* Use '^[>+][^+]' instead of '^[>+]' with grep(1) when filtering theMarius Strobl2016-01-291-1/+1
| | | | | | | | | | | | | | diff(1) output between two files in "new_only"-mode. Otherwise, with the default of using unified format a remnant of the header in the output is the result. This is especially irritating when the two files differ but the second one is empty, amounting to the vestige of the header being the only readout. Reported by: Stefan Haemmerl MFC after: 3 days Notes: svn path=/head/; revision=295032
* Restrict 520.pfdenied to only list rules that blocked traffic.Kurt Lidl2015-11-051-1/+1
| | | | | | | | | | | | | Before this change, the 520.pfdenied script listed all rules that matched /^block/ in the rule. Restrict the printed output to only those rules that result in packets being dropped. PR: conf/187224 Approved by: rpaulo (mentor) Differential Revision: https://reviews.freebsd.org/D4068 Notes: svn path=/head/; revision=290405
* Avoid installing security.functions with executable bits, periodic(8) willBaptiste Daroussin2014-11-051-2/+4
| | | | | | | | | | try to execute all files with an executable bit in /etc/periodic/*/ while this file is supposed only to be sourced by others MFC after: 1 week Notes: svn path=/head/; revision=274130
* Use src.opts.mk in preference to bsd.own.mk except where we need stuffWarner Losh2014-05-061-1/+1
| | | | | | | from the latter. Notes: svn path=/head/; revision=265420
* Further refine the auth fail regex to catch more auth failures andChristian Brueffer2014-02-201-1/+1
| | | | | | | | | | | | | | | | reduce false positives. The committed patch was provided by Christian Marg. PR: 91732 Submitted by: Daniel O'Connor <doconnor at gsoft.com.au> Skye Poier <spoier at gmail.com> Alan Amesbury <amesbury at umn.edu> Christian Marg <marg at rz.tu-clausthal.de> MFC after: 1 month Notes: svn path=/head/; revision=262273
* After around 20 years of duty it is time for pkg_install to retireBaptiste Daroussin2013-10-312-70/+0
| | | | Notes: svn path=/head/; revision=257444
* Make the period of each periodic security script configurable.Jeremie Le Hen2013-08-2716-84/+115
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are now six additional variables weekly_status_security_enable weekly_status_security_inline weekly_status_security_output monthly_status_security_enable monthly_status_security_inline monthly_status_security_output alongside their existing daily counterparts. They all have the same default values. All other "daily_status_security_${scriptname}_${whatever}" variables have been renamed to "security_status_${name}_${whatever}". A compatibility shim has been introduced for the old variable names, which we will be able to remove in 11.0-RELEASE. "security_status_${name}_enable" is still a boolean but a new "security_status_${name}_period" allows to define the period of each script. The value is one of "daily" (the default for backward compatibility), "weekly", "monthly" and "NO". Note that when the security periodic scripts are run directly from crontab(5) (as opposed to being called by daily or weekly periodic scripts), they will run unless the test is explicitely disabled with a "NO", either for in the "_enable" or the "_period" variable. When the security output is not inlined, the mail subject has been changed from "$host $arg run output" to "$host $arg $period run output". For instance: myfbsd security run output -> myfbsd security daily run output I don't think this is considered as a stable API, but feel free to correct me if I'm wrong. Finally, I will rearrange periodic.conf(5) and default/periodic.conf to put the security options in their own section. I left them in place for this commit to make reviewing easier. Reviewed by: hackers@ Notes: svn path=/head/; revision=254974
* Hook the 220.backup-pkgdb script I added to the build unconditionallyDoug Barton2011-03-271-0/+1
| | | | | | | | | Hook up 610.ipf6denied based on MK_IPFILTER as 510.ipfdenied is now Poked by: Andrzej Tobola <ato@iem.pw.edu.pl> Notes: svn path=/head/; revision=220049
* Add svn:executable property on remaining period scripts without itDoug Barton2011-03-275-0/+0
| | | | Notes: svn path=/head/; revision=220048
* Add an (off by default) check for negative permissions (where theBrooks Davis2010-11-132-0/+55
| | | | | | | | | | | group on a object has less permissions that everyone). These permissions will not work reliably over NFS if you have more than 14 supplemental groups and are usually not what you mean. MFC after: 1 week Notes: svn path=/head/; revision=215213
* Hide 460.chkportsum in MK_PKGTOOLS != no case.Xin LI2010-11-091-1/+4
| | | | | | | | Submitted by: Alex Kozlov <spam rm-rf kiev ua> MFC after: 2 weeks Notes: svn path=/head/; revision=215045
* - Fixes to the chkportsum script to handle better some special cases,Gabor Kovesdan2010-08-101-9/+9
| | | | | | | | | | like spaces in filename Submitted by: Alex Kozlov <spam@rm-rf.kiev.ua> Approved by: delphij (mentor) Notes: svn path=/head/; revision=211141
* - Add a periodic script, which can be used to find installed ports' files withGabor Kovesdan2010-07-192-0/+69
| | | | | | | | | | | mismatched checksum PR: conf/124641 Submitted by: Alex Kozlov <spam@rm-rf.kiev.ua> Approved by: delphij (mentor) Notes: svn path=/head/; revision=210254
* Silence warning printed by getfsspec(3) when /etc/fstab does not existColin Percival2009-09-281-0/+3
| | | | | | | | | | | | | | fstab: /etc/fstab:0: No such file or directory and from dump(8) when setfsent(3) fails due to /etc/fstab not existing: DUMP: Can't open /etc/fstab for dump table information: No such... This makes daily and security periodic runs somewhat cleaner in jails which lack /etc/fstab files. MFC after: 1 month Notes: svn path=/head/; revision=197552
* Sort `mount -p' output by name before checking for any differences.Ed Schouten2008-10-251-1/+1
| | | | | | | | | | | | | | | I noticed on a system at home that restarting named(8) causes the /var/named/dev mount to be moved to the bottom of the mount list, because it gets remounted. When I received the daily security email this morning, I was quite amazed to see that the security report listed the differences, while it was nothing out of the ordinary. If we just throw the `mount -p' output through sort(1), we'll only receive notifications about changes to mounts if something has really changed. Notes: svn path=/head/; revision=184265
* add new build knobs and jigger some existing controls to improveSam Leffler2008-09-211-4/+17
| | | | | | | | | | | control over the result of buildworld and installworld; this especially helps packaging systems such as nanobsd Reviewed by: various (posted to arch) MFC after: 1 month Notes: svn path=/head/; revision=183242
* Improve periodic/security/550.ipfwlimit a bit:Antoine Brodin2008-08-101-6/+3
| | | | | | | | | | | | - don't run it if net.inet.ip.fw.verbose = 0 as it is pointless - handle rules without logging limit correctly [1] (those rules show up without logamount in "ipfw -a list") PR: conf/126060 [1] MFC after: 1 month Notes: svn path=/head/; revision=181531
* Rev. 1.8 broke matching on lines where the failure mode is at the headMike Makonnen2008-06-301-1/+1
| | | | | | | | | | | of the message, such as: Jun 30 10:49:21 rogue sshd[17553]: Invalid user iceman from 127.0.0.1 PR: conf/124569 Submitted by: Taku <taku@tekipaki.jp> Notes: svn path=/head/; revision=180111
* Add a missing ;.Remko Lodder2008-03-251-1/+1
| | | | | | | | | | PR: misc/122069 Submitted by: taku@tekipaki.jp MFC after: 3 days Approved by: imp (mentor, implicit trivial change). Notes: svn path=/head/; revision=177606
* Eliminate xargs in favor of find -exec {} +Dag-Erling Smørgrav2008-02-031-2/+1
| | | | Notes: svn path=/head/; revision=175906
* Rewrite to consume significantly less memory, by using find -s instead ofDag-Erling Smørgrav2008-02-021-16/+11
| | | | | | | | | | | | | | | | find | sort. As a bonus, this simplifies the logic considerably. Also remove the bogus "overruning the args to ls" comment and the corresponding "-n 20" argument to xargs; the whole point with xargs is precisely that it knows how large the argument list can safely get. Note that the first run of the updated script may hypotheticall produce false positives due to differences between find's and sort's sorting algorithm. I haven't seen this during testing, but others might. MFC after: 2 weeks Notes: svn path=/head/; revision=175890
* Also check setuid executables on ZFS.Ruslan Ermilov2007-11-231-1/+1
| | | | Notes: svn path=/head/; revision=173873
* Only match on log messages containing fail,invalid,Remko Lodder2007-02-231-1/+1
| | | | | | | | | | | | | bad or illegal. This prevents matching on systems that have a name that matches the query. PR: conf/107560 Submitted by: Christian Laursen <cfsl at pil dot dk> MFC after: 3 days Approved by: imp (mentor) Notes: svn path=/head/; revision=166928
* Use egrep instead of grep so that reporting of login failures (brokenJohn Polstra2007-02-051-1/+1
| | | | | | | | by revision 1.6) works again. This fix is already in RELENG_6, but was never committed to HEAD. Notes: svn path=/head/; revision=166519
* Add login.conf checking to periodic security scripts. If the login.conf fileTom Rhodes2006-08-252-0/+53
| | | | | | | | | is not UID/GID 0, limits will be ignored and a strange error sent to auth.log. Head nod: ru, rwatson Notes: svn path=/head/; revision=161602
* Move etc/rc.firewall6 to ipfw2+v6, update related rc.d and periodic scripts.Max Laier2006-05-123-118/+0
| | | | | | | | Since ipfw2 now does dual-stack, statistics for IPv6 come from the ipfw scripts as well. Notes: svn path=/head/; revision=158497
* Enhance loginfail: it will catch sshd, proftpd and su errors, as well as ↵Matteo Riondato2006-03-051-1/+1
| | | | | | | | | | | | other programs PR: conf/70973 Submitted by: Ryan Sommers" <ryans@gamersimpact.com> Approved by: philip (mentor) MFC after: 3 days Notes: svn path=/head/; revision=156312
* A new version of rev. 1.4: postpone a temporary file creationMaxim Konovalov2005-09-111-1/+1
| | | | | | | | | | | until we realize if ipfw(4) ever used. PR: bin/85970 Submitted by: Andre Albsmeier MFC after: 3 days Notes: svn path=/head/; revision=149989
* Fix braino in last commit. Print nothing if ipfw(4) is not present.Gleb Smirnoff2005-08-311-2/+2
| | | | Notes: svn path=/head/; revision=149659
* When looking for new lines in diff output, grep for '^[>+]' instead ofColin Percival2005-08-221-1/+1
| | | | | | | | | | '^>', in order to catch both normal and unified diffs. Problem reported by: volker at vwsoft dot com via -stable MFC after: 3 days Notes: svn path=/head/; revision=149366
* - Correctly parse output, when logging amount is limited in theGleb Smirnoff2005-08-201-7/+15
| | | | | | | | | | | | | rule itself, not in verbose_limit sysctl. [1] - Do check rules, even if verbose_limit is set 0. Rules may have their own log limits. PR: conf/77929 Submitted by: Andriy Gapon [1] Reviewed by: matteo Notes: svn path=/head/; revision=149320
* Replace "ipfw l", which is now deprecated, with "ipfw list".Suleiman Souhlal2005-02-232-2/+2
| | | | | | | Approved by: grehan (mentor) Notes: svn path=/head/; revision=142303
* Don't do setuid checks on file systems mounted with noexec option.Gleb Smirnoff2005-01-131-1/+1
| | | | | | | | Reviewed by: brian, ru MFC after: 1 week Notes: svn path=/head/; revision=140186
* Teach periodic(8) security output to display information about blockedMax Laier2004-11-242-0/+54
| | | | | | | | | | | | | | | | | | | | | packet counts by pf(4). This adds a ``daily_status_security_pfdenied_enable'' variable to periodic.conf, which defaults to ``YES'' as the matching IPF(W) versions. The output will look like this (line wrapped): pf denied packets: > block drop log on rl0 proto tcp all [ Evaluations: 504986 Packets: 0 Bytes: 0 States: 0 ] > block drop log on rl0 all [ Evaluations: 18559 Packets: 427 Bytes: 140578 States: 0 ] Submitted by: clive (thanks a lot!) MFC after: 2 weeks Notes: svn path=/head/; revision=138061
* Add a knob 'daily_status_security_diff_flags' controlling theJoseph Koshy2004-09-231-1/+2
| | | | | | | | | | format of the 'diff' output generated during periodic(8) scripts. Submitted by: keramida (script changes) Reviewed by: keramida (man page changes) Notes: svn path=/head/; revision=135591
* Add script for checking ipv6 blocked packets from PR.Darren Reed2004-04-201-0/+53
| | | | | | | | PR: misc/50154 Submitted by: Kimura Fuyuki <fuyuki@hadaly.org> Notes: svn path=/head/; revision=128473
* Have mktemp(1) construct the temporary file name for us insteadMike Makonnen2003-06-306-6/+6
| | | | | | | | | of providing a template manually. Submitted by: Lars Eggert <larse@isi.edu> Notes: svn path=/head/; revision=117088
* Add support for bzip2ed log files.Stefan Eßer2003-01-052-2/+14
| | | | Notes: svn path=/head/; revision=108727
* Avoid using perl in the periodic & security scripts. This brings theGiorgos Keramidas2002-12-072-4/+8
| | | | | | | | | base system one step closer to being totally perl-free. Approved by: re (jhb) Notes: svn path=/head/; revision=107674
* Do not emit a message on stderr when one of the compared filesThomas Quinot2002-11-161-1/+1
| | | | | | | | | | is shorter than the other. Reviewed by: roberto MFC after: 3 days Notes: svn path=/head/; revision=106988
* Remove incorrect output redirection.Thomas Quinot2002-11-161-1/+1
| | | | | | | | | Reviewed by: roberto Committed from: EuroBSDCon Amsterdam MFC after: 3 days Notes: svn path=/head/; revision=106987
* Add newly-added sripts to FILES.Thomas Quinot2002-10-251-1/+3
| | | | | | | Reviewed by: roberto Notes: svn path=/head/; revision=105938
* Add a new /etc/periodic/security script to check for packetsThomas Quinot2002-10-251-0/+53
| | | | | | | | | | | rejected by ipfilter (510.ipfdenied), and a corresponding periodic.conf knob (daily_status_security_ipfdenied_enable). Reviewed by: roberto Approved by: re@ Notes: svn path=/head/; revision=105937
generated by cgit v1.3 (git 2.53.0) at 2026-09-05 21:33:13 +0000