merge back 0.15-17mdk in CVS

1 files changed, 561 insertions, 0 deletions

diff --git a/TODO b/TODO
new file mode 100644
index 0000000..983327d
--- /dev/null
+++ b/TODO
@@ -0,0 +1,561 @@
+ Some new stuff I thought should be implemented as well... And yes they keep
+on a coming!!!!!!!!! : )
+
+ ######## Begin new stuff ##############
+#!/bin/bash
+
+#Logging
+
+echo "Would you like set to up addtional logging ?"
+echo "Logging will still go to its respected places in /var/log as well."
+WaitAnswer;clear
+if [[ ${answer} == yes ]]; then
+echo "Would you like for auth and warnings to be logged to tty11 ?"
+WaitAnswer;clear
+if [[ ${answer} == yes ]]; then
+AddRules "authpriv.* /dev/tty11" /etc/syslog.conf
+echo "Would you like kernel logging to go tty10 ?"
+WaitAnswer;clear
+if [[ ${answer} == yes ]]; then
+AddRules "kern.* /dev/tty10" /etc/syslog.conf 
+echo "Would you like mail logging to go tty9 ?"
+echo "This is only useful if you're running a mail server(sendmail)."
+WaitAnswer;clear
+if [[ ${answer} == yes ]]; then
+AddRules "mail.* /dev/tty9" /etc/syslog.conf
+/etc/rc.d/init.d/syslog restart > /dev/null
+fi
+ fi
+  fi
+#End of logging
+
+Is BSD style process accounting on by default in Mandrake ?
+echo "We can setup your system to log who does what commands and when..."
+echo "May we set up proccess accounting ?"
+echo "The log file will get filled up VERY quickly 
+WaitAnswer;clear
+if [[ ${answer} == yes ]]; then
+AddRules "/sbin/accton /var/log/pacct" /etc/rc.d/rc.local #This probablly needs
+it's own script though
+echo "/var/log/pacct { " >> /etc/logrotate.conf 
+echo "     postrotate" >> /etc/logrotate.conf
+echo " /usr/sbin/accton /var/log/pacct" >> /etc/logrotate.conf
+echo >> /etc/logrotate.conf
+echo >> "}" /etc/logrotate.conf
+#Got a be a cleaner way to do this : )
+fi
+#End BSD style process accounting
+
+#PAM stuff
+#default file size limit 
+dfsize=40000 
+echo "We help prevent certain types of DoS attacks through the use of
+PAM(Pluggable Authentication Modules.)"
+echo "By setting a limit on how big user files may get and how many processes a
+user may run."
+echo "Would you like to set up some PAM configuration ?"
+WaitAnswer;clear
+if [[ ${answer} == yes ]]; then
+AddRules "# Limit user processes" /etc/security/limits.conf
+AddRules "*   soft    nproc   100" /etc/security/limits.conf
+AddRules "*   hard    nproc   150" /etc/security/limits.conf
+echo "Would you like to set a maximum file size a user is allowed ?"
+WaitAnswer;clear
+if [[ ${answer} == yes ]]; then
+echo "What shall be the maximum file size(default it 40000 = 40MB)"
+echo -n "Size[40000]: "
+read fsize
+if [[ -z ${fsize} ]]; then
+AddRules "# limits size of any one of users' files" /etc/security/limits.conf
+AddRules "*     hard    $dfsize" /etc/security/limits.conf
+else
+AddRules "# limits size of any one of users' files" /etc/security/limits.conf
+AddRules "*     hard    $fsize" /etc/security/limits.conf 
+fi
+ fi
+  fi
+#End PAM stuff
+
+
+
+**********************************
+
+ ###########Begin modified custom.sh######################
+#!/bin/bash
+
+#
+# Security level implementation...
+# Writen by Vandoorselaere Yoann <yoann@mandrakesoft.com>
+#
+
+if [[ -f /usr/share/lsec/lib.sh ]]; then
+    . /usr/share/lsec/lib.sh
+else
+    echo "Can't find /usr/share/lsec/lib.sh, exiting."
+    exit 1
+fi
+
+clear
+
+WRITE_CRON="false"
+
+###
+echo  "This script allows you to customize the security on your system. "
+echo  "If you feel at all you don't know what you're doing abort now!!! "
+echo  "'ctrl-c' to abort"
+echo -n "Otherwise, please press [enter] to continue "
+read FOO
+clear
+
+###
+echo "Do you want all system events to be logged on tty12 ?"
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+    AddRules "*.* /dev/tty12" /etc/syslog.conf
+fi
+
+###
+echo "Do you want to be notified by mail of _all_ root logins ?"
+echo "(This is strongle recommended)"
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+if [[ -s /root/.bashrc ]]; then
+cp /root/.bashrc /tmp/bashrc
+sed '/root login/d' /tmp/bashrc > /root/.bashrc
+AddRules 'echo "root login Check your syslog /var/log/messages" | /bin/mail -s
+"Root Login" root' /root/.bashrc
+rm -f /tmp/bashrc
+echo "Done"
+fi
+fi
+
+
+###
+echo "Do you want to only allow ctrl-alt-del if root is logged locally ?"
+echo "( or if a user present in /etc/shutdown.allow is logged locally )"
+WaitAnswer; clear
+tmpfile=`mktemp /tmp/secure.XXXXXX`
+cp /etc/inittab ${tmpfile}
+if [[ ${answer} == yes ]]; then
+    cat ${tmpfile} | \
+    sed s'/ca::ctrlaltdel:\/sbin\/shutdown -t3 -r
+now/ca::ctrlaltdel:\/sbin\/shutdown -a -t3 -r now/' > /etc/inittab
+else
+    cat ${tmpfile} | \
+    sed s'/ca::ctrlaltdel:\/sbin\/shutdown -a -t3 -r
+now/ca::ctrlaltdel:\/sbin\/shutdown -t3 -r now/' > /etc/inittab
+fi
+rm -f ${tmpfile}
+
+#Compile tools
+#More needs to be added and this is very sloppy but you get the idea : )
+mgtools()
+{
+mgcon=mgcon1
+echo "Do you want only root to have access to the system compiler(gcc/g++) ?"
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+chmod 0700 /usr/bin/gcc
+chmod 0700 /usr/bin/g++
+fi
+}
+gtools()
+{
+gcon=gcon0
+dgrp=devel
+echo "Do you want to setup compiling tools(gcc,g++,etc..) so that they may"
+echo "be used by a certain group ?"
+echo -n "yes/no: "
+read answer
+if [[ ${answer} == yes ]]; then
+gcon=gcon1
+echo
+echo -n "What shall the name of this group be [devel]: "
+read grp
+if [[ -z ${grp} ]]; then
+groupadd ${dgrp}
+.. /etc/security/lsec/perm.ctoolsd
+else
+groupadd ${grp}
+.. /etc/security/lsec/perm.ctools
+fi
+fi
+}
+gtools
+#if [[ ${gcon} = gcon1 ]]; then
+#ntools
+#else
+#mgtools
+#fi
+
+#network tools
+mntools()
+{
+echo "Do you want to disable 'ping' to all users except root ?"
+WaitAnswer; clear
+if [[ $answer} == yes ]]; then
+chmod 0700 /bin/ping
+fi
+
+echo "Do you want to disable 'traceroute' to all users except root ?"
+WaitAnswer; clear
+if [[ $answer == yes ]]; then
+chmod 0700 /usr/sbin/traceroute
+fi
+
+echo "Do you want to disable 'who' to all users except root ?"
+WaitAnswer; clear
+if [[ $answer == yes ]]; then
+chmod 0700 /usr/bin/who
+fi
+
+echo "Do you want to disable 'w' to all users except root ?"
+WaitAnswer; clear
+if [[ $answer == yes ]]; then
+chmod 0700 /usr/bin/w
+fi
+
+echo "Do you want to disable 'finger' to all users except root ?"
+WaitAnswer; clear
+if [[ $answer == yes ]]; then
+chmod 0700 /usr/bin/finger
+fi
+
+echo "Do you want to disable telnet client to all users except root ?"
+WaitAnswer; clear
+if [[ $answer == yes ]]; then
+chmod 0700 /usr/bin/telnet
+fi
+
+echo "Do you want to disable ssh client to all users except root ?"
+WaitAnswer; clear
+if [[ $answer == yes ]]; then
+chmod 0700 /usr/bin/ssh
+fi
+}
+ntools()
+{
+ncon=ncon0
+ngrpd=netsys
+echo "Do you want to set up network tools so that they may be used only"
+echo "by users of a certain group ?"
+echo -n "yes/no: "
+read answer
+if [[ ${answer} == yes ]]; then
+ncon=ncon1
+echo
+echo -n "What shall the name of this group be [netsys]: "
+read ngrp
+if [[ -z ${ngrp} ]]; then
+groupadd ${ngrpd}
+.. /etc/security/lsec/perm.netsysd
+else
+groupadd ${ngrp}
+.. /etc/security/lsec/perm.netsysd
+fi
+fi
+}
+if [[ ${gcon} = gcon1 ]]; then
+ntools
+else
+mgtools
+fi
+
+if [[ ${mgcon} = mgcon1 ]]; then
+ntools
+else
+mntools
+fi
+
+if [[ $ncon = ncon1 ]]; then
+echo "Done"
+else
+mntools
+fi
+
+###
+echo "Do you want to deny any machine to connect to yours ?"
+WaitAnswer
+if [[ ${answer} == yes ]]; then
+    echo "Do you want only localhost to be allowed ?"
+    WaitAnswer; clear
+    if [[ ${answer} == yes ]]; then
+	AddRules "ALL:ALL EXCEPT localhost:DENY" /etc/hosts.deny
+    else
+	AddRules "ALL:ALL:DENY" /etc/hosts.deny
+    fi
+fi
+
+###
+echo "Do you want root console login to be allowed ?" 
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+    AddRules "tty1" /etc/securetty quiet
+    AddRules "tty2" /etc/securetty quiet
+    AddRules "tty3" /etc/securetty quiet
+    AddRules "tty4" /etc/securetty quiet
+    AddRules "tty5" /etc/securetty quiet
+    AddRules "tty6" /etc/securetty 
+fi
+###
+
+if [[ -f /usr/lib/libsafe.so.1.2 ]]; then
+echo "Do you want to enable the libsafe stack overflow protection ?"
+echo "This stack overflow protection work by catching dangerous function call"
+echo "like strcpy, strcat, getwd, gets, [vf]scanf, realpath, [v]sprintf"
+echo "and verify the address & the size of the destination buffer in the stack"
+echo "this is done by searching in the stack frame the one which contain the"
+echo "destination address, and by substracting the frame address to the
+destination buffer one" 
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+	AddRules "export LD_PRELOAD=/usr/lib/libsafe.so.1.2" /etc/profile
+fi
+fi
+
+###
+echo "Do you want your system to daily check important security problem ?"
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+	AddRules "CHECK_SECURITY=yes" /etc/security/lsec/security.conf
+	WRITE_CRON="true"
+fi
+
+###
+echo "Do you want your system to daily check new open port listening ?"
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+	AddRules "CHECK_OPEN_PORT=yes" /etc/security/lsec/security.conf
+	WRITE_CRON="true"
+fi
+
+###
+echo "Do you want your system to check for grave permission problem on
+sensibles files ?"
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+	AddRules "CHECK_PERMS=yes" /etc/security/lsec/security.conf
+        WRITE_CRON="true"
+fi
+
+###
+echo "Do you want your system to daily check SUID Root file change ?"
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+    AddRules "CHECK_SUID_ROOT=yes" /etc/security/lsec/security.conf
+    WRITE_CRON="true"
+fi
+
+###
+echo "Do you want your system to daily check suid files md5 checksum changes ?"
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+	AddRules "CHECK_SUID_MD5=yes" /etc/security/lsec/security.conf
+	WRITE_CRON="true"
+fi
+
+###
+echo "Do you want your system to daily check SUID Group file change ?"
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+    AddRules "CHECK_SUID_GROUP=yes" /etc/security/lsec/security.conf
+    WRITE_CRON="true"
+fi
+
+###
+echo "Do you want your system to daily check Writeable file change ?"
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+    AddRules "CHECK_WRITEABLE=yes" /etc/security/lsec/security.conf
+    WRITE_CRON="true"
+fi
+
+###
+echo "Do you want your system to daily check Unowned file change ?"
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+    AddRules "CHECK_UNOWNED=yes" /etc/security/lsec/security.conf
+    WRITE_CRON="true"
+fi
+
+###
+echo "Do you want your system to verify every minutes if a network interface"
+echo "is in promiscuous state (which mean someone is probably running a sniffer
+on your machine ) ?"
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+    AddRules "CHECK_PROMISC=yes" /etc/security/lsec/security.conf
+    AddRules "*/1 * * * *    root    nice --adjustment=+19
+/usr/share/lsec/promisc_check.sh" /etc/crontab
+fi
+###
+
+###
+echo "Do you want security report to be done in syslog ?"
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+    AddRules "SYSLOG_WARN=yes" /etc/security/lsec/security.conf
+else
+    AddRules "SYSLOG_WARN=no" /etc/security/lsec/security.conf
+fi
+###
+
+echo "Do you want security report to be done by mail ?"
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+    AddRules "MAIL_WARN=yes" /etc/security/lsec/security.conf
+else
+    AddRules "MAIL_WARN=no" /etc/security/lsec/security.conf
+fi
+###
+
+if [[ ${WRITE_CRON} == "true" ]]; then
+    AddRules "0 0-23 * * *    root    nice --adjustment=+19
+/usr/share/lsec/security.sh" /etc/crontab
+fi
+
+LiloUpdate;
+/sbin/lilo >& /dev/null
+
+###
+echo "Do you want to disable all services except(gpm,xfs,keytable,"
+echo "network,crond, and syslogd ?"
+echo "This is _highly_ recommended if you have not configured other"
+echo "said services."
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+	echo -n "Disabling all service, except : {"
+	chkconfig --list | awk '{print $1}' | while read service; do
+   		if grep -qx ${service} /etc/security/lsec/server.4; then
+       		echo -n " ${service}"
+   		fi
+	done
+	echo " } : "
+
+	chkconfig --list | awk '{print $1}' | while read service; do
+    	chkconfig --del "${service}"
+    	if ! chkconfig --add "${service}"; then
+       	 	echo -e "\t- Services ${service} is now disabled."
+    	fi
+	done
+   chkconfig --add gpm
+   chkconfig --add xfs
+   chkconfig --add network
+   chkconfig --add keytable
+   chkconfig --add syslog
+   chkconfig --add crond  
+ echo -e "done.\n";
+fi
+
+###
+echo "Do you want an easy, normal, restricted, or paranoid umask ?"
+echo "easy ( 002 )   = user = rwx, group = rwx, other = rx"
+echo "normal ( 022 ) = user = rwx, group = rx, other = rx"
+echo "restricted ( for users ) ( 077 ) = user = rwx, group =, other ="
+echo "restricted ( for root ) ( 022 ) = user = rwx, = group = rx, other = rx" 
+echo "paranoid ( 077 ) = user = rwx, group = , other ="
+answer="nothing"
+while [[ "${answer}" != "easy" && "${answer}" != "normal" && "${answer}" !=
+"restricted" && "${answer}" != "paranoid"  ]]; do
+	echo -n "easy/normal/restricted/paranoid : "
+    read answer
+done
+case "${answer}" in
+	"easy")
+	AddRules "umask 002" /etc/profile
+	;;
+	"normal")
+	AddRules "umask 022" /etc/profile
+	;;
+	"restricted")
+	AddRules "if [[ \${UID} == 0 ]]; then umask 022; else umask 077; fi"
+/etc/profile
+	;;
+	"paranoid")
+	AddRules "umask 077" /etc/profile
+	;;
+esac
+
+###
+echo "Do you want a "." in your PATH variable ?"
+echo "This permit you to not use ./progname & to just type progname"
+echo "However this is a *high* security risk."
+WaitAnswer; clear
+if [[ ${answer} == yes ]]; then
+    AddRules "PATH=\$PATH:/usr/X11R6/bin:/usr/games:." /etc/profile quiet
+else
+    AddRules "PATH=\$PATH:/usr/X11R6/bin:/usr/games" /etc/profile quiet
+fi
+
+AddRules "export PATH SECURE_LEVEL" /etc/profile
+
+echo "Do you want normal, restricted, or paranoid file permissions ?"
+while [[ "${answer}" != "normal" && "${answer}" != "strict" && "${answer}" !=
+"paranoid" ]]; do
+echo -n "normal/restricted/paranoid : "
+    read answer
+done
+case "${answer}" in
+        "normal")
+         /usr/share/lsec/file_perm.sh /etc/security/lsec/perm.3
+        ;;
+        "strict")
+         /usr/share/lsec/file_perm.sh /etc/security/lsec/perm.4
+        ;;
+        "paranoid")#!/bin/bash
+/usr/share/lsec/file_perm.sh /etc/security/lsec/perm.5
+        ;;
+esac
+#EOF
+# /etc/security/msec/perm.ctools
+chown root.$grp /usr/bin/gcc
+chmod 750 /usr/bin/gcc
+chown root.$grp /usr/bin/cc
+chmod 750 /usr/bin/cc
+chown root.$grp /usr/bin/g++
+chmod 750 /usr/bin/g++
+
+# /etc/security/msec/perm.ctoolsd
+chown root.$dgrp /usr/bin/gcc
+chmod 750 /usr/bin/gcc
+chown root.$dgrp /usr/bin/cc
+chmod 750 /usr/bin/cc
+chown root.$dgrp /usr/bin/g++
+chmod 750 /usr/bin/g++
+
+
+# /etc/security/msec/perm.netsys
+chown root.$ngrp /usr/bin/ping
+chmod 750 /usr/bin/gcc
+chown root.$ngrp /usr/bin/w
+chmod 750 /usr/bin/w
+chown root.$ngrp /usr/bin/w
+chmod 750 /usr/bin/who
+chown root.$ngrp /usr/bin/telnet
+chmod 750 /usr/bin/telnet
+chown root.$ngrp /usr/bin/ssh
+chmod 750 /usr/bin/ssh
+chown root.$ngrp /usr/sbin/traceroute
+chmod 750 /usr/sbin/traceoute
+chown root.$ngrp /usr/bin/finger
+chmod 750 /usr/bin/finger
+
+# /etc/security/msec/perm.netsys.d
+chown root.$ngrpd /bin/ping
+chmod 750 /usr/bin/gcc
+chown root.$ngrpd /usr/bin/w
+chmod 750 /usr/bin/w
+chown root.$ngrpd /usr/bin/w
+chmod 750 /usr/bin/who
+chown root.$ngrpd /usr/bin/telnet
+chmod 750 /usr/bin/telnet
+chown root.$ngrpd /usr/bin/ssh
+chmod 750 /usr/bin/ssh
+chown root.$ngrpd /usr/sbin/traceroute
+chmod 750 /usr/sbin/traceroute
+chown root.$ngrpd /usr/bin/finger
+chmod 750 /usr/bin/finger
+
+######## END
+
+