*** empty log message ***

11 files changed, 144 insertions, 38 deletions

diff --git a/ChangeLog b/ChangeLog
index 025a4e3..97c2aa3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,10 @@
 	* level[1-3].sh: Changed crontab call to file_check.sh 
 	from every hour to every midnight ( bug reported by axalon ).
     * file_check.sh: clean up.
+	* moved file_check.sh to diff_check.sh and changed 
+	  what is related to cron call in level[15].sh
+	* Added missing configurations question in level custom.
+	* bug fix.
 
 1999-12-08  Chmouel Boudjnah  <chmouel@mandrakesoft.com>
 
diff --git a/cron-sh/file_check.sh b/cron-sh/diff_check.sh
index 9ff094f..0388c76 100755
--- a/cron-sh/file_check.sh
+++ b/cron-sh/diff_check.sh
@@ -1,7 +1,6 @@
 #!/bin/bash
-
 #
-# Basic security checking for suid files.
+# is that the check contained in this one ( file_check ) are  
 # Written by Vandoorselaere Yoann, <yoann@mandrakesoft.com>
 #
 
@@ -230,12 +229,8 @@ fi
 if [ -s ${TMP} ]; then
     Syslog ${TMP}
     Ttylog ${TMP}
+	date=`date`
+	echo -n "\n\n*** ${date} ***\n" >> ${SECURITY_LOG}
     cat ${TMP} >> ${SECURITY_LOG}
     rm -f ${TMP}
 fi
-
-
-# We launch our other report engine :)
-/etc/security/msec/cron-sh/security_check.sh
-
-
diff --git a/cron-sh/security_check.sh b/cron-sh/security_check.sh
index 6c174d8..3c72d3d 100755
--- a/cron-sh/security_check.sh
+++ b/cron-sh/security_check.sh
@@ -1,7 +1,6 @@
 #!/bin/bash
 
 #
-# Basic security checking for suid files.
 # Written by Vandoorselaere Yoann, <yoann@mandrakesoft.com>
 #
 
diff --git a/init-sh/custom.sh b/init-sh/custom.sh
index feb5fdc..367f5aa 100755
--- a/init-sh/custom.sh
+++ b/init-sh/custom.sh
@@ -18,12 +18,14 @@ WaitAnswer; clear
 if [ ${answer} == "yes" ]; then
     find /var/log/ -type f -exec chattr +a {} \;
 fi
+
 ###
 echo "Do you want all system events to be logged on tty12 ?"
 WaitAnswer; clear
 if [ ${answer} == "yes" ]; then
     AddRules "*.* /dev/tty12" /etc/syslog.conf
 fi
+
 ###
 echo "Do you want to deny any machine to connect to yours ?"
 WaitAnswer
@@ -36,6 +38,7 @@ if [ ${answer} == "yes" ]; then
 	AddRules "ALL:ALL:DENY" /etc/hosts.deny
     fi
 fi
+
 ###
 echo "Do you want root console login to be allowed ?" 
 WaitAnswer; clear
@@ -48,33 +51,70 @@ if [ ${answer} == "yes" ]; then
     AddRules "tty6" /etc/securetty 
 fi
 ###
+echo "Do you want your system to daily check important security problem ?"
+WaitAnswer; clear
+if [ ${answer} == "yes" ]; then
+	AddRules "CHECK_SECURITY=yes" /etc/security/msec/security.conf
+	AddRules "0 0-23 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/security_check.sh" /etc/crontab
+fi
+
+###
+echo "Do you want your system to daily check new open port listening ?"
+WaitAnswer; clear
+if [ ${answer} == "yes" ]; then
+	AddRules "CHECK_OPEN_PORT=yes" /etc/security/msec/security.conf
+	AddRules "0 0-23 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/security_check.sh" /etc/crontab
+	AddRules "0 0-23 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/diff_check.sh" /etc/crontab
+fi
+
+###
+echo "Do you want your system to check for permission problem ?"
+WaitAnswer; clear
+if [ ${answer} == "yes" ]; then
+	AddRules "CHECK_PERMS=yes" /etc/security/msec/security.conf
+	AddRules "0 0-23 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/security_check.sh" /etc/crontab
+fi
+
+###
 echo "Do you want your system to daily check SUID Root file change ?"
 WaitAnswer; clear
 if [ ${answer} == "yes" ]; then
     AddRules "CHECK_SUID_ROOT=yes" /etc/security/msec/security.conf
-    AddRules "0 0-23 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab
+    AddRules "0 0-23 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/diff_check.sh" /etc/crontab
+fi
+
+###
+echo "Do you want your system to daily check suid files md5 checksum changes ?"
+WaitAnswer; clear
+if [ ${answer} == "yes" ]; then
+	AddRules "CHECK_SUID_MD5=yes" /etc/security/msec/security.conf
+	AddRules "0 0-23 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/diff_check.sh" /etc/crontab
 fi
+
 ###
 echo "Do you want your system to daily check SUID Group file change ?"
 WaitAnswer; clear
 if [ ${answer} == "yes" ]; then
     AddRules "CHECK_SUID_GROUP=yes" /etc/security/msec/security.conf
-    AddRules "0 0-23 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab
+    AddRules "0 0-23 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/diff_check.sh" /etc/crontab
 fi
+
 ###
-echo "Do you want your system to daily check Writable file change ?"
+echo "Do you want your system to daily check Writeable file change ?"
 WaitAnswer; clear
 if [ ${answer} == "yes" ]; then
     AddRules "CHECK_WRITEABLE=yes" /etc/security/msec/security.conf
-    AddRules "0 0-23 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab
+    AddRules "0 0-23 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/diff_check.sh" /etc/crontab
 fi
+
 ###
 echo "Do you want your system to daily check Unowned file change ?"
 WaitAnswer; clear
 if [ ${answer} == "yes" ]; then
     AddRules "CHECK_UNOWNED=yes" /etc/security/msec/security.conf
-    AddRules "0 0-23 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab
+    AddRules "0 0-23 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/diff_check.sh" /etc/crontab
 fi
+
 ###
 echo "Do you want your system to verify every minutes if a network interface"
 echo "is in promiscuous state (which mean someone is probably running a sniffer on your machine ) ?"
@@ -84,23 +124,81 @@ if [ ${answer} == "yes" ]; then
     AddRules "*/1 * * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/promisc_check.sh" /etc/crontab
 fi
 ###
+
 LiloUpdate;
 /sbin/lilo >& /dev/null
+
 ###
-echo "Do you want a "." in your PATH variable ?"
-echo "This permit you to not use ./progname & to just type progname"
-echo "However this is a *high* security risk."
+echo "Do you want to disable your running server ( except important one )"
+echo "This is only valuable for server installed with rpm."
 WaitAnswer; clear
 if [ ${answer} == "yes" ]; then
-    AddRules "PATH=\$PATH:/usr/X11R6/bin" /etc/profile
+	echo -n "Disabling all service, except : {"
+	for service in `chkconfig --list | awk '{print $1}'`; do
+   		if grep -qx ${service} /etc/security/msec/init-sh/server.5 | grep -v "^#";
+		then
+       		echo -n " ${service}"
+   		fi
+	done
+	echo " } : "
+
+	for service in `chkconfig --list | awk '{print $1}'`; do
+    	chkconfig --del "${service}"
+    	if ! chkconfig --msec --add "${service}"; then
+       	 	echo -e "\t- Services ${service} is now disabled."
+    	fi
+	done
+	echo -e "done.\n";
 fi
+
 ###
-AddRules "SECURE_LEVEL=\"custom\"" /etc/profile
-export SECURE_LEVEL="custom"
-###
-AddRules "umask 077" /etc/profile
+echo "Do you want to disallow rpm to automatically enable a new installed server for run on next reboot ?"
+echo "yes = you will need to chkconfig (--add ) servername for the server to run on boot."
+echo "no  = rpm will do it for you, but you have less control of what is running on your machine."
+WaitAnswer; clear
+if [ ${answer} == "yes" ]; then
+	export SECURE_LEVEL="4"
+	AddRules "SECURE_LEVEL=\"4\"" /etc/profile
+else
+	AddRules "SECURE_LEVEL=\"3\"" /etc/profile
+fi
 
+###
+echo "Do you want an easy, normal, restricted, or paranoid umask ?"
+echo "easy ( 002 )   = user = rwx, group = rwx, other = rx"
+echo "normal ( 022 ) = user = rwx, group = rx, other = rx"
+echo "restricted ( for users ) ( 077 ) = user = rwx, group =, other ="
+echo "restricted ( for root ) ( 022 ) = user = rwx, = group = rx, other = rx" 
+echo "paranoid ( 077 ) = user = rwx, group = , other ="
+answer="nothing"
+while [[ "${answer}" != "easy" && "${answer}" != "normal" && "${answer} != "restricted" && "${answer}" != "paranoid"  ]]; do
+	echo -n "easy/normal/restricted/paranoid : "
+    read answer
+done
+case "${answer}" in
+	"easy")
+	AddRules "umask 002" /etc/profile
+	;;
+	"normal")
+	AddRules "umask 022" /etc/profile
+	;;
+	"restricted")
+	AddRules "if [ \${UID} == 0 ]; then umask 022; else umask 077; fi" /etc/profile
+	;;
+	"paranoid")
+	AddRules "umask 077" /etc/profile
+	;;
 
+###
+echo "Do you want a "." in your PATH variable ?"
+echo "This permit you to not use ./progname & to just type progname"
+echo "However this is a *high* security risk."
+WaitAnswer; clear
+if [ ${answer} == "yes" ]; then
+    AddRules "PATH=\$PATH:/usr/X11R6/bin:/usr/games:." /etc/profile
+else
+    AddRules "PATH=\$PATH:/usr/X11R6/bin:/usr/games" /etc/profile
+fi
 
 
 
diff --git a/init-sh/level1.sh b/init-sh/level1.sh
index b652fc6..a0cd43c 100755
--- a/init-sh/level1.sh
+++ b/init-sh/level1.sh
@@ -40,8 +40,6 @@ echo -e "\t- Check promiscuous mode : no."
     AddRules "CHECK_PROMISC=no" /etc/security/msec/security.conf        quiet
 echo -e "\t- Check listening port : no."                               
     AddRules "CHECK_OPEN_PORT=no" /etc/security/msec/security.conf	quiet
-echo -e "\t- Check for dangerous .[sr]hosts file : no."                               
-    AddRules "CHECK_RHOST=no" /etc/security/msec/security.conf	        quiet
 echo -e "\t- Check passwd file integrity : no."
     AddRules "CHECK_PASSWD=no" /etc/security/msec/security.conf	        quiet
 echo -e "\t- Check shadow file integrity : no."
diff --git a/init-sh/level2.sh b/init-sh/level2.sh
index 1e6d605..20f3298 100755
--- a/init-sh/level2.sh
+++ b/init-sh/level2.sh
@@ -40,8 +40,6 @@ echo -e "\t- Check promiscuous mode : no."
     AddRules "CHECK_PROMISC=no" /etc/security/msec/security.conf        quiet
 echo -e "\t- Check listening port : no."                               
     AddRules "CHECK_OPEN_PORT=no" /etc/security/msec/security.conf	quiet
-echo -e "\t- Check for dangerous .[sr]hosts file : no."                               
-    AddRules "CHECK_RHOST=no" /etc/security/msec/security.conf	        quiet
 echo -e "\t- Check passwd file integrity : no."
     AddRules "CHECK_PASSWD=no" /etc/security/msec/security.conf	        quiet
 echo -e "\t- Check shadow file integrity : no."
@@ -66,6 +64,7 @@ AddRules "umask 022" /etc/profile
 echo "Adding \"normal\" PATH variable :"
 AddRules "PATH=\$PATH:/usr/X11R6/bin:/usr/games" /etc/profile quiet
 AddRules "export PATH SECURE_LEVEL" /etc/profile
+
 # Group
 echo -n "Adding \"${DRAKX_USERS}\" to audio group :"
 for user in ${DRAKX_USERS}; do
diff --git a/init-sh/level3.sh b/init-sh/level3.sh
index 5859689..3d33690 100755
--- a/init-sh/level3.sh
+++ b/init-sh/level3.sh
@@ -41,11 +41,9 @@ echo -e "\t- Check world writable file : yes."
 echo -e "\t- Check unowned file : no."
     AddRules "CHECK_UNOWNED=no" /etc/security/msec/security.conf	quiet
 echo -e "\t- Check promiscuous mode : no."
-    AddRules "CHECK_PROMISC=yes" /etc/security/msec/security.conf       quiet
+    AddRules "CHECK_PROMISC=no" /etc/security/msec/security.conf       quiet
 echo -e "\t- Check listening port : yes."                               
     AddRules "CHECK_OPEN_PORT=yes" /etc/security/msec/security.conf	quiet
-echo -e "\t- Check for dangerous .[sr]hosts file : yes."                               
-    AddRules "CHECK_RHOST=yes" /etc/security/msec/security.conf	        quiet
 echo -e "\t- Check passwd file integrity : yes."
     AddRules "CHECK_PASSWD=yes" /etc/security/msec/security.conf	quiet
 echo -e "\t- Check shadow file integrity : yes."
@@ -58,7 +56,8 @@ echo -e "\t- Security warning in syslog : \"yes\" :"
 
 # Crontab
 echo "Adding permission check in crontab (scheduled every midnight) :"
-AddRules "0 0 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab
+AddRules "0 0 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/diff_check.sh" /etc/crontab
+AddRules "0 0 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/security_check.sh" /etc/crontab
 
 echo -n "Running lilo to record new config : "
 /sbin/lilo >& /dev/null
diff --git a/init-sh/level4.sh b/init-sh/level4.sh
index 00ea93d..6745ae5 100755
--- a/init-sh/level4.sh
+++ b/init-sh/level4.sh
@@ -54,8 +54,6 @@ echo -e "\t- Check promiscuous mode : yes."
     AddRules "CHECK_PROMISC=yes" /etc/security/msec/security.conf       quiet
 echo -e "\t- Check listening port : yes."                               
     AddRules "CHECK_OPEN_PORT=yes" /etc/security/msec/security.conf	quiet
-echo -e "\t- Check for dangerous .[sr]hosts file : yes."                               
-    AddRules "CHECK_RHOST=yes" /etc/security/msec/security.conf	        quiet
 echo -e "\t- Check passwd file integrity : yes."
     AddRules "CHECK_PASSWD=yes" /etc/security/msec/security.conf	quiet
 echo -e "\t- Check shadow file integrity : yes."
@@ -70,8 +68,11 @@ echo -e "\t- Security warning in syslog : \"yes\" :"
 echo "Adding promisc check in crontab (scheduled every minutes) :"
 AddRules "*/1 * * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/promisc_check.sh" /etc/crontab
 
-echo "Adding permission check in crontab (scheduled every midnight) :"
-AddRules "0 0 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab
+echo "Adding \"diff\" security check in crontab (scheduled every midnight) :"
+AddRules "0 0 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/diff_check.sh" /etc/crontab
+
+echo "Adding \"global\" security check in crontab (scheduled every midnight) :"
+AddRules "0 0 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/security_check.sh" /etc/crontab
 
 # Do you want a password ?
 LiloUpdate;
diff --git a/init-sh/level5.sh b/init-sh/level5.sh
index 272267f..33ad73b 100755
--- a/init-sh/level5.sh
+++ b/init-sh/level5.sh
@@ -45,8 +45,6 @@ echo -e "\t- Check promiscuous mode : yes."
     AddRules "CHECK_PROMISC=yes" /etc/security/msec/security.conf       quiet
 echo -e "\t- Check listening port : yes."                               
     AddRules "CHECK_OPEN_PORT=yes" /etc/security/msec/security.conf	quiet
-echo -e "\t- Check for dangerous .[sr]hosts file : yes."                               
-    AddRules "CHECK_RHOST=yes" /etc/security/msec/security.conf	        quiet
 echo -e "\t- Check passwd file integrity : yes."
     AddRules "CHECK_PASSWD=yes" /etc/security/msec/security.conf	quiet
 echo -e "\t- Check shadow file integrity : yes."
@@ -62,8 +60,11 @@ echo -e "\t- Security warning in syslog : \"yes\" :"
 echo "Adding promisc check in crontab (scheduled every minutes) :"
 AddRules "*/1 * * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/promisc_check.sh" /etc/crontab
 
-echo "Adding permission check in crontab (schedued every midnight) :"
+echo "Adding \"diff\" security check in crontab (scheduled every midnight) :"
 AddRules "0 0 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab
+
+echo "Adding \"global\" security check in crontab (scheduled every midnight) :"
+AddRules "0 0 * * *    root    nice --adjustment=+19 /etc/security/msec/cron-sh/security_check.sh" /etc/crontab
 ###################################################
 
 # Wanna a password ?
diff --git a/init-sh/lib.sh b/init-sh/lib.sh
index 971a228..07a0507 100644
--- a/init-sh/lib.sh
+++ b/init-sh/lib.sh
@@ -99,7 +99,7 @@ Syslog() {
 
 Ttylog() {
     if [ "${TTY_LOG}" == "yes" ]; then
-        for i in `w | grep -v "load\|TTY" | awk '{print $2}'` ; do
+		w | grep -v "load\|TTY" | awk '{print $2}' | while read line; do
             echo -e ${1} > /dev/$i
         done
     fi
@@ -166,6 +166,7 @@ CleanRules /etc/profile
 CleanRules /etc/lilo.conf
 CleanRules /etc/rc.d/rc.firewall
 CleanRules /etc/crontab
+CleanRules /etc/security/msec/security.users
 
 echo -e "\nStarting to reconfigure the system : "
 
@@ -188,6 +189,8 @@ if [ ! -f /tmp/secure.DrakX ]; then
 	    echo "Problem removing user \"${user}\" from group audio."
 	fi
     done
+else
+		AddRules "${DRAKX_USERS}" /etc/security/msec/security.conf
 fi
 
 
diff --git a/msec.spec b/msec.spec
index 934be3c..0c8729c 100644
--- a/msec.spec
+++ b/msec.spec
@@ -35,6 +35,15 @@ rm -rf $RPM_BUILD_ROOT
 /usr/bin/promisc_check
 
 %changelog
+* Wed Dec  8 1999 Yoann Vandoorselaere <yoan@mandrakesoft.com>
+    - level[1-3].sh: Changed crontab call to file_check.sh
+      from every hour to every midnight ( bug reported by axalon ).
+    - diff_check.sh: clean up.
+    - moved file_check.sh to diff_check.sh and changed
+      what is related to cron call in level[15].sh
+    - Added missing configurations question in level custom.
+    - bug fix.
+
 * Wed Dec  8 1999 Chmouel Boudjnah <chmouel@mandrakesoft.com>
 - Various (Makefile|specfiles) clean-up.
 - insert doc.