aboutsummaryrefslogtreecommitdiffstats
path: root/share/README
diff options
context:
space:
mode:
authorEugeni Dodonov <eugeni@mandriva.org>2009-01-06 21:31:46 +0000
committerEugeni Dodonov <eugeni@mandriva.org>2009-01-06 21:31:46 +0000
commitff31c9236b1fd7465ea9687fc735e8af882e780e (patch)
treeeec89033b4ad0b2459fbb91fa6dd39077eeaf407 /share/README
parentab984707253940bf5ced3a379699e8d0dc757fa6 (diff)
downloadmsec-ff31c9236b1fd7465ea9687fc735e8af882e780e.tar
msec-ff31c9236b1fd7465ea9687fc735e8af882e780e.tar.gz
msec-ff31c9236b1fd7465ea9687fc735e8af882e780e.tar.bz2
msec-ff31c9236b1fd7465ea9687fc735e8af882e780e.tar.xz
msec-ff31c9236b1fd7465ea9687fc735e8af882e780e.zip
Updated to working version of new msec.
Conflicts: Makefile cron-sh/security_check.sh share/msec.py
Diffstat (limited to 'share/README')
-rw-r--r--share/README87
1 files changed, 0 insertions, 87 deletions
diff --git a/share/README b/share/README
deleted file mode 100644
index 4bb3846..0000000
--- a/share/README
+++ /dev/null
@@ -1,87 +0,0 @@
-******************
-Configurations files in /etc/security/msec/
-Shell scripts in /usr/share/msec.
-******************
-
-Suggestions & comments:
-flepied@mandriva.com
-
-******************
-Doc of the rewritting in python:
-
- 0 1 2 3 4 5
-root umask 022 022 022 022 022 077
-shell timeout 0 0 0 0 3600 900
-deny services none none none none local all
-su only for wheel grp no no no no no yes
-user umask 022 022 022 022 077 077
-shell history size default default default default 10 10
-direct root login yes yes yes yes no no
-remote root login yes yes yes yes no no
-sulogin for single user no no no no yes yes
-user list in [kg]dm yes yes yes yes no no
-promisc check no no no no yes yes
-ignore icmp echo no no no no yes yes
-ignore broadcasted icmp echo no no no no yes yes
-ignore bogus error responses no no no no yes yes
-enable libsafe no no no no yes yes
-allow reboot by user yes yes yes yes no no
-allow crontab/at yes yes yes yes no no
-password aging no no no no 60 30
-allow autologin yes yes yes no no no
-console log no no no yes yes yes
-issues yes yes yes local local no
-ip spoofing protection no no no yes yes yes
-dns spoofing protection no no no yes yes yes
-log stange ip packets no no no yes yes yes
-periodic security check no yes yes yes yes yes
-allow X connections yes local local no no no
-allow xauth from root yes yes yes yes no no
-X server listen to tcp tcp tcp tcp local local
-run msec by cron yes yes yes yes yes yes
-
-Periodic security checks by level:
-
- 0 1 2 3 4 5
-CHECK_SECURITY no yes yes yes yes yes
-CHECK_PERMS no no no yes yes yes
-CHECK_SUID_ROOT no no yes yes yes yes
-CHECK_SUID_MD5 no no yes yes yes yes
-CHECK_SGID no no yes yes yes yes
-CHECK_WRITABLE no no yes yes yes yes
-CHECK_UNOWNED no no no no yes yes
-CHECK_PROMISC no no no no yes yes
-CHECK_OPEN_PORT no no no yes yes yes
-CHECK_PASSWD no no no yes yes yes
-CHECK_SHADOW no no no yes yes yes
-TTY_WARN no no no no yes yes
-MAIL_WARN no no no yes yes yes
-SYSLOG_WARN no no yes yes yes yes
-RPM_CHECK no no no yes yes yes
-CHKROOTKIT_CHECK no no no yes yes yes
-
-These variables are configured by the user:
-
-MAIL_USER the user to send the dayly reports. If not set, the email is
-sent to root.
-
-PERM_LEVEL is used to determine which file to use to fix
-permissions/owners/groups (from /usr/share/msec/perm.$PERM_LEVEL). If
-not set, the SECURE_LEVEL is used instead. If the file
-/etc/security/msec/perm.local exists, it's used too. The syntax for
-each line if the following:
-
-<file specification> <owner> <permission> [force]
-
-<file specification> can be any glob to specify one or multiple
-files/diretories.
-
-<owner> must be in the form <user>.<group> or <user>. (force only
-user) or .<group> (force only group) or current (keep current user and
-group).
-
-<permission> is an octal number representing the access rights or
-current to keep the current permissions.
-
-If force is present as a 4th argument, it means that msec will enforce
-the permission even if the previous permission was lower.