head	1.43;
access;
symbols
	netbsd-8-3-RELEASE:1.40
	netbsd-9-4-RELEASE:1.40
	netbsd-10-0-RELEASE:1.43
	netbsd-10-0-RC6:1.43
	netbsd-10-0-RC5:1.43
	netbsd-10-0-RC4:1.43
	netbsd-10-0-RC3:1.43
	netbsd-10-0-RC2:1.43
	netbsd-10-0-RC1:1.43
	netbsd-10:1.43.0.6
	netbsd-10-base:1.43
	netbsd-9-3-RELEASE:1.40
	cjep_sun2x-base1:1.43
	cjep_sun2x:1.43.0.4
	cjep_sun2x-base:1.43
	cjep_staticlib_x-base1:1.43
	netbsd-9-2-RELEASE:1.40
	cjep_staticlib_x:1.43.0.2
	cjep_staticlib_x-base:1.43
	netbsd-9-1-RELEASE:1.40
	phil-wifi-20200421:1.41
	phil-wifi-20200411:1.41
	is-mlppp:1.41.0.2
	is-mlppp-base:1.41
	phil-wifi-20200406:1.41
	netbsd-8-2-RELEASE:1.40
	netbsd-9-0-RELEASE:1.40
	netbsd-9-0-RC2:1.40
	netbsd-9-0-RC1:1.40
	phil-wifi-20191119:1.40
	netbsd-9:1.40.0.28
	netbsd-9-base:1.40
	phil-wifi-20190609:1.40
	netbsd-8-1-RELEASE:1.40
	netbsd-8-1-RC1:1.40
	pgoyette-compat-merge-20190127:1.40
	pgoyette-compat-20190127:1.40
	pgoyette-compat-20190118:1.40
	pgoyette-compat-1226:1.40
	pgoyette-compat-1126:1.40
	pgoyette-compat-1020:1.40
	pgoyette-compat-0930:1.40
	pgoyette-compat-0906:1.40
	netbsd-7-2-RELEASE:1.40
	pgoyette-compat-0728:1.40
	netbsd-8-0-RELEASE:1.40
	phil-wifi:1.40.0.26
	phil-wifi-base:1.40
	pgoyette-compat-0625:1.40
	netbsd-8-0-RC2:1.40
	pgoyette-compat-0521:1.40
	pgoyette-compat-0502:1.40
	pgoyette-compat-0422:1.40
	netbsd-8-0-RC1:1.40
	pgoyette-compat-0415:1.40
	pgoyette-compat-0407:1.40
	pgoyette-compat-0330:1.40
	pgoyette-compat-0322:1.40
	pgoyette-compat-0315:1.40
	netbsd-7-1-2-RELEASE:1.40
	pgoyette-compat:1.40.0.24
	pgoyette-compat-base:1.40
	netbsd-7-1-1-RELEASE:1.40
	matt-nb8-mediatek:1.40.0.22
	matt-nb8-mediatek-base:1.40
	perseant-stdc-iso10646:1.40.0.20
	perseant-stdc-iso10646-base:1.40
	netbsd-8:1.40.0.18
	netbsd-8-base:1.40
	prg-localcount2-base3:1.40
	prg-localcount2-base2:1.40
	prg-localcount2-base1:1.40
	prg-localcount2:1.40.0.16
	prg-localcount2-base:1.40
	pgoyette-localcount-20170426:1.40
	bouyer-socketcan-base1:1.40
	pgoyette-localcount-20170320:1.40
	netbsd-7-1:1.40.0.14
	netbsd-7-1-RELEASE:1.40
	netbsd-7-1-RC2:1.40
	netbsd-7-nhusb-base-20170116:1.40
	bouyer-socketcan:1.40.0.12
	bouyer-socketcan-base:1.40
	pgoyette-localcount-20170107:1.40
	netbsd-7-1-RC1:1.40
	pgoyette-localcount-20161104:1.40
	netbsd-7-0-2-RELEASE:1.40
	localcount-20160914:1.40
	netbsd-7-nhusb:1.40.0.10
	netbsd-7-nhusb-base:1.40
	pgoyette-localcount-20160806:1.40
	pgoyette-localcount-20160726:1.40
	pgoyette-localcount:1.40.0.8
	pgoyette-localcount-base:1.40
	netbsd-7-0-1-RELEASE:1.40
	netbsd-7-0:1.40.0.6
	netbsd-7-0-RELEASE:1.40
	netbsd-7-0-RC3:1.40
	netbsd-7-0-RC2:1.40
	netbsd-7-0-RC1:1.40
	netbsd-5-2-3-RELEASE:1.33
	netbsd-5-1-5-RELEASE:1.33
	netbsd-6-0-6-RELEASE:1.37
	netbsd-6-1-5-RELEASE:1.37
	netbsd-7:1.40.0.4
	netbsd-7-base:1.40
	yamt-pagecache-base9:1.40
	yamt-pagecache-tag8:1.37.6.1
	netbsd-6-1-4-RELEASE:1.37
	netbsd-6-0-5-RELEASE:1.37
	tls-earlyentropy:1.40.0.2
	tls-earlyentropy-base:1.40
	riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.40
	riastradh-drm2-base3:1.40
	netbsd-6-1-3-RELEASE:1.37
	netbsd-6-0-4-RELEASE:1.37
	netbsd-5-2-2-RELEASE:1.33
	netbsd-5-1-4-RELEASE:1.33
	netbsd-6-1-2-RELEASE:1.37
	netbsd-6-0-3-RELEASE:1.37
	netbsd-5-2-1-RELEASE:1.33
	netbsd-5-1-3-RELEASE:1.33
	netbsd-6-1-1-RELEASE:1.37
	riastradh-drm2-base2:1.39
	riastradh-drm2-base1:1.39
	riastradh-drm2:1.39.0.4
	riastradh-drm2-base:1.39
	netbsd-6-1:1.37.0.14
	netbsd-6-0-2-RELEASE:1.37
	netbsd-6-1-RELEASE:1.37
	netbsd-6-1-RC4:1.37
	netbsd-6-1-RC3:1.37
	agc-symver:1.39.0.6
	agc-symver-base:1.39
	netbsd-6-1-RC2:1.37
	netbsd-6-1-RC1:1.37
	yamt-pagecache-base8:1.39
	netbsd-5-2:1.33.0.14
	netbsd-6-0-1-RELEASE:1.37
	yamt-pagecache-base7:1.39
	netbsd-5-2-RELEASE:1.33
	netbsd-5-2-RC1:1.33
	matt-nb6-plus-nbase:1.37
	yamt-pagecache-base6:1.39
	netbsd-6-0:1.37.0.12
	netbsd-6-0-RELEASE:1.37
	netbsd-6-0-RC2:1.37
	tls-maxphys:1.39.0.2
	tls-maxphys-base:1.40
	matt-nb6-plus:1.37.0.10
	matt-nb6-plus-base:1.37
	netbsd-6-0-RC1:1.37
	yamt-pagecache-base5:1.39
	yamt-pagecache-base4:1.39
	netbsd-6:1.37.0.8
	netbsd-6-base:1.37
	netbsd-5-1-2-RELEASE:1.33
	netbsd-5-1-1-RELEASE:1.33
	yamt-pagecache-base3:1.37
	yamt-pagecache-base2:1.37
	yamt-pagecache:1.37.0.6
	yamt-pagecache-base:1.37
	cherry-xenmp:1.37.0.4
	cherry-xenmp-base:1.37
	bouyer-quota2-nbase:1.37
	bouyer-quota2:1.37.0.2
	bouyer-quota2-base:1.37
	matt-mips64-premerge-20101231:1.37
	matt-nb5-mips64-premerge-20101231:1.33
	matt-nb5-pq3:1.33.0.12
	matt-nb5-pq3-base:1.33
	netbsd-5-1:1.33.0.10
	netbsd-5-1-RELEASE:1.33
	netbsd-5-1-RC4:1.33
	matt-nb5-mips64-k15:1.33
	netbsd-5-1-RC3:1.33
	netbsd-5-1-RC2:1.33
	netbsd-5-1-RC1:1.33
	netbsd-5-0-2-RELEASE:1.33
	matt-nb5-mips64-premerge-20091211:1.33
	matt-premerge-20091211:1.33
	matt-nb5-mips64-u2-k2-k4-k7-k8-k9:1.33
	matt-nb4-mips64-k7-u2a-k9b:1.33
	matt-nb5-mips64-u1-k1-k5:1.33
	matt-nb5-mips64:1.33.0.8
	netbsd-5-0-1-RELEASE:1.33
	jym-xensuspend-nbase:1.33
	netbsd-5-0:1.33.0.6
	netbsd-5-0-RELEASE:1.33
	netbsd-5-0-RC4:1.33
	netbsd-5-0-RC3:1.33
	netbsd-5-0-RC2:1.33
	jym-xensuspend:1.33.0.4
	jym-xensuspend-base:1.33
	netbsd-5-0-RC1:1.33
	netbsd-5:1.33.0.2
	netbsd-5-base:1.33
	matt-mips64-base2:1.33
	matt-mips64:1.31.0.20
	netbsd-4-0-1-RELEASE:1.31
	wrstuden-revivesa-base-3:1.33
	wrstuden-revivesa-base-2:1.33
	wrstuden-fixsa-newbase:1.31
	wrstuden-revivesa-base-1:1.33
	yamt-pf42-base4:1.33
	yamt-pf42-base3:1.33
	hpcarm-cleanup-nbase:1.32
	yamt-pf42-baseX:1.32
	yamt-pf42-base2:1.32
	wrstuden-revivesa:1.32.0.4
	wrstuden-revivesa-base:1.33
	yamt-pf42:1.32.0.2
	yamt-pf42-base:1.32
	mjf-devfs2:1.31.0.18
	mjf-devfs2-base:1.33
	keiichi-mipv6-nbase:1.31
	keiichi-mipv6:1.31.0.16
	keiichi-mipv6-base:1.31
	matt-armv6-nbase:1.31
	matt-armv6-prevmlocking:1.31
	wrstuden-fixsa-base-1:1.31
	netbsd-4-0:1.31.0.14
	netbsd-4-0-RELEASE:1.31
	cube-autoconf:1.31.0.12
	cube-autoconf-base:1.31
	netbsd-4-0-RC5:1.31
	netbsd-4-0-RC4:1.31
	netbsd-4-0-RC3:1.31
	netbsd-4-0-RC2:1.31
	netbsd-4-0-RC1:1.31
	matt-armv6:1.31.0.10
	matt-armv6-base:1.31
	matt-mips64-base:1.31
	hpcarm-cleanup:1.31.0.8
	hpcarm-cleanup-base:1.31
	netbsd-3-1-1-RELEASE:1.29.2.2
	netbsd-3-0-3-RELEASE:1.29
	wrstuden-fixsa:1.31.0.6
	wrstuden-fixsa-base:1.31
	abandoned-netbsd-4-base:1.31
	abandoned-netbsd-4:1.31.0.2
	netbsd-3-1:1.29.2.2.0.2
	netbsd-3-1-RELEASE:1.29.2.2
	netbsd-3-0-2-RELEASE:1.29
	netbsd-3-1-RC4:1.29.2.2
	netbsd-3-1-RC3:1.29.2.2
	netbsd-3-1-RC2:1.29.2.2
	netbsd-3-1-RC1:1.29.2.2
	netbsd-4:1.31.0.4
	netbsd-4-base:1.31
	chap-midi-nbase:1.31
	netbsd-3-0-1-RELEASE:1.29
	chap-midi:1.29.0.6
	chap-midi-base:1.31
	netbsd-3-0:1.29.0.4
	netbsd-3-0-RELEASE:1.29
	netbsd-3-0-RC6:1.29
	netbsd-3-0-RC5:1.29
	netbsd-3-0-RC4:1.29
	netbsd-3-0-RC3:1.29
	netbsd-3-0-RC2:1.29
	netbsd-3-0-RC1:1.29
	netbsd-2-0-3-RELEASE:1.25
	netbsd-2-1:1.25.0.6
	netbsd-2-1-RELEASE:1.25
	netbsd-2-1-RC6:1.25
	netbsd-2-1-RC5:1.25
	netbsd-2-1-RC4:1.25
	netbsd-2-1-RC3:1.25
	netbsd-2-1-RC2:1.25
	netbsd-2-1-RC1:1.25
	netbsd-2-0-2-RELEASE:1.25
	netbsd-3:1.29.0.2
	netbsd-3-base:1.29
	netbsd-2-0-1-RELEASE:1.25
	netbsd-2:1.25.0.4
	netbsd-2-base:1.25
	netbsd-2-0-RELEASE:1.25
	netbsd-2-0-RC5:1.25
	netbsd-2-0-RC4:1.25
	netbsd-2-0-RC3:1.25
	netbsd-2-0-RC2:1.25
	netbsd-2-0-RC1:1.25
	netbsd-2-0:1.25.0.2
	netbsd-2-0-base:1.25
	netbsd-1-6-PATCH002-RELEASE:1.16
	netbsd-1-6-PATCH002:1.16
	netbsd-1-6-PATCH002-RC4:1.16
	netbsd-1-6-PATCH002-RC3:1.16
	netbsd-1-6-PATCH002-RC2:1.16
	netbsd-1-6-PATCH002-RC1:1.16
	netbsd-1-6-PATCH001:1.16
	netbsd-1-6-PATCH001-RELEASE:1.16
	netbsd-1-6-PATCH001-RC3:1.16
	netbsd-1-6-PATCH001-RC2:1.16
	netbsd-1-6-PATCH001-RC1:1.16
	fvdl_fs64_base:1.16
	netbsd-1-6-RELEASE:1.16
	netbsd-1-6-RC3:1.16
	netbsd-1-6-RC2:1.16
	netbsd-1-6-RC1:1.16
	netbsd-1-6:1.16.0.2
	netbsd-1-6-base:1.16
	netbsd-1-5-PATCH003:1.9
	netbsd-1-5-PATCH002:1.9
	netbsd-1-5-PATCH001:1.9
	netbsd-1-5-RELEASE:1.9
	netbsd-1-5-BETA2:1.9
	netbsd-1-5-BETA:1.9
	netbsd-1-4-PATCH003:1.6
	netbsd-1-5-ALPHA2:1.9
	netbsd-1-5:1.9.0.4
	netbsd-1-5-base:1.9
	minoura-xpg4dl:1.9.0.2
	minoura-xpg4dl-base:1.9
	netbsd-1-4-PATCH002:1.6
	wrstuden-devbsize-19991221:1.6
	wrstuden-devbsize:1.6.0.6
	wrstuden-devbsize-base:1.6
	comdex-fall-1999:1.6.0.4
	comdex-fall-1999-base:1.6
	netbsd-1-4-PATCH001:1.6
	netbsd-1-4-RELEASE:1.6
	netbsd-1-4:1.6.0.2
	netbsd-1-4-base:1.6
	netbsd-1-3-PATCH003:1.3
	netbsd-1-3-PATCH003-CANDIDATE2:1.3
	netbsd-1-3-PATCH003-CANDIDATE1:1.3
	netbsd-1-3-PATCH003-CANDIDATE0:1.3
	netbsd-1-3-PATCH002:1.3
	netbsd-1-3-PATCH001:1.3
	netbsd-1-3-RELEASE:1.3
	netbsd-1-3-BETA:1.3
	netbsd-1-3:1.3.0.2
	netbsd-1-3-base:1.3;
locks; strict;
comment	@# @;


1.43
date	2021.01.10.23.24.26;	author riastradh;	state Exp;
branches;
next	1.42;
commitid	nvjdXwWVOKPFFeDC;

1.42
date	2020.12.02.14.18.13;	author wiz;	state Exp;
branches;
next	1.41;
commitid	0spyv1YSJnfoWayC;

1.41
date	2019.12.06.14.43.30;	author riastradh;	state Exp;
branches;
next	1.40;
commitid	36hsZmlDZdRyIENB;

1.40
date	2013.11.06.19.37.06;	author spz;	state Exp;
branches
	1.40.26.1;
next	1.39;
commitid	zCe1RdRZ5dP4Ifcx;

1.39
date	2012.04.05.09.15.56;	author wiz;	state Exp;
branches
	1.39.2.1;
next	1.38;

1.38
date	2012.04.05.09.10.21;	author spz;	state Exp;
branches;
next	1.37;

1.37
date	2010.02.05.17.23.47;	author wiz;	state Exp;
branches
	1.37.6.1;
next	1.36;

1.36
date	2010.02.05.16.32.20;	author jmmv;	state Exp;
branches;
next	1.35;

1.35
date	2010.01.20.07.33.25;	author wiz;	state Exp;
branches;
next	1.34;

1.34
date	2010.01.19.22.08.52;	author jmmv;	state Exp;
branches;
next	1.33;

1.33
date	2008.05.29.14.51.25;	author mrg;	state Exp;
branches;
next	1.32;

1.32
date	2008.04.08.14.51.02;	author sborrill;	state Exp;
branches
	1.32.2.1
	1.32.4.1;
next	1.31;

1.31
date	2006.05.29.22.07.25;	author wiz;	state Exp;
branches
	1.31.18.1;
next	1.30;

1.30
date	2006.05.25.02.38.10;	author lukem;	state Exp;
branches;
next	1.29;

1.29
date	2005.02.05.15.31.29;	author wiz;	state Exp;
branches
	1.29.2.1
	1.29.6.1;
next	1.28;

1.28
date	2005.02.05.15.26.38;	author jdolecek;	state Exp;
branches;
next	1.27;

1.27
date	2004.09.28.15.19.02;	author wiz;	state Exp;
branches;
next	1.26;

1.26
date	2004.09.28.15.05.13;	author erh;	state Exp;
branches;
next	1.25;

1.25
date	2003.11.18.09.07.25;	author wiz;	state Exp;
branches;
next	1.24;

1.24
date	2003.11.18.03.25.16;	author jhawk;	state Exp;
branches;
next	1.23;

1.23
date	2003.06.26.11.52.19;	author wiz;	state Exp;
branches;
next	1.22;

1.22
date	2003.03.31.17.49.27;	author perry;	state Exp;
branches;
next	1.21;

1.21
date	2003.03.03.06.41.51;	author wiz;	state Exp;
branches;
next	1.20;

1.20
date	2003.02.21.22.47.54;	author jhawk;	state Exp;
branches;
next	1.19;

1.19
date	2003.02.13.02.42.37;	author jhawk;	state Exp;
branches;
next	1.18;

1.18
date	2003.02.13.02.12.07;	author jhawk;	state Exp;
branches;
next	1.17;

1.17
date	2003.01.18.18.32.21;	author grant;	state Exp;
branches;
next	1.16;

1.16
date	2001.10.15.08.53.28;	author lukem;	state Exp;
branches;
next	1.15;

1.15
date	2001.10.01.03.02.34;	author atatat;	state Exp;
branches;
next	1.14;

1.14
date	2001.09.11.01.01.58;	author wiz;	state Exp;
branches;
next	1.13;

1.13
date	2001.09.08.01.29.08;	author wiz;	state Exp;
branches;
next	1.12;

1.12
date	2001.03.15.02.23.48;	author hubertf;	state Exp;
branches;
next	1.11;

1.11
date	2001.02.11.09.55.09;	author jdolecek;	state Exp;
branches;
next	1.10;

1.10
date	2001.01.09.17.30.30;	author abs;	state Exp;
branches;
next	1.9;

1.9
date	2000.05.26.17.08.22;	author ad;	state Exp;
branches;
next	1.8;

1.8
date	2000.05.05.18.28.54;	author itojun;	state Exp;
branches;
next	1.7;

1.7
date	2000.04.24.23.46.38;	author fair;	state Exp;
branches;
next	1.6;

1.6
date	99.03.17.20.19.48;	author garbled;	state Exp;
branches;
next	1.5;

1.5
date	99.02.18.18.53.32;	author abs;	state Exp;
branches;
next	1.4;

1.4
date	98.08.25.13.50.45;	author lukem;	state Exp;
branches;
next	1.3;

1.3
date	97.10.10.05.40.08;	author mrg;	state Exp;
branches;
next	1.2;

1.2
date	97.07.01.22.55.26;	author rat;	state Exp;
branches;
next	1.1;

1.1
date	97.01.05.11.50.18;	author mrg;	state Exp;
branches;
next	;

1.40.26.1
date	2020.04.08.14.07.22;	author martin;	state Exp;
branches;
next	;
commitid	Qli2aW9E74UFuA3C;

1.39.2.1
date	2014.08.20.00.02.36;	author tls;	state Exp;
branches;
next	;
commitid	jTnpym9Qu0o4R1Nx;

1.37.6.1
date	2012.04.17.00.05.47;	author yamt;	state Exp;
branches;
next	1.37.6.2;

1.37.6.2
date	2014.05.22.11.37.51;	author yamt;	state Exp;
branches;
next	;
commitid	P3Rlj4go6xHqKwBx;

1.32.2.1
date	2008.06.04.02.04.38;	author yamt;	state Exp;
branches;
next	;

1.32.4.1
date	2008.06.23.04.30.01;	author wrstuden;	state Exp;
branches;
next	;

1.31.18.1
date	2008.06.02.13.21.40;	author mjf;	state Exp;
branches;
next	;

1.29.2.1
date	2006.07.12.14.23.25;	author tron;	state Exp;
branches;
next	1.29.2.2;

1.29.2.2
date	2006.07.12.14.24.12;	author tron;	state Exp;
branches;
next	;

1.29.6.1
date	2006.06.19.04.15.04;	author chap;	state Exp;
branches;
next	;


desc
@@


1.43
log
@Various entropy integration improvements.

- New /etc/security check for entropy in daily security report.

- New /etc/rc.d/entropy script runs (after random_seed and rndctl) to
  check for entropy at boot -- in rc.conf, you can:

  . set `entropy=check' to halt multiuser boot and enter single-user
    mode if not enough entropy

  . set `entropy=wait' to make multiuser boot wait until enough entropy

  Default is to always boot without waiting -- and rely on other
  channels like security report to alert the operator if there's a
  problem.

- New man page entropy(7) discussing the higher-level concepts and
  system integration with cross-references.

- New paragraph in afterboot(8) about entropy citing entropy(7) for
  more details.

This change addresses many of the issues discussed in security/55659.
This is a first draft; happy to take improvements to the man pages and
scripted messages to improve clarity.

I considered changing motd to include an entropy warning with a
reference to the entropy(7) man page, but it's a little trickier:
- Not sure it's appropriate for all users to see at login rather than
  users who have power to affect the entropy estimate (maybe it is,
  just haven't decided).
- We only have a mechanism for changing once at boot; the message would
  remain until next boot even if an operator adds enough entropy.
- The mechanism isn't really conducive to making a message appear
  conditionally from boot to boot.
@
text
@.\"	$NetBSD: security.conf.5,v 1.42 2020/12/02 14:18:13 wiz Exp $
.\"
.\" Copyright (c) 1996 Matthew R. Green
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
.\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
.\" AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
.\" OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
.Dd December 2, 2020
.Dt SECURITY.CONF 5
.Os
.Sh NAME
.Nm security.conf
.Nd daily security check configuration file
.Sh DESCRIPTION
The
.Nm
file specifies which of the standard
.Pa /etc/security
services are performed.
The
.Pa /etc/security
script is run, by default, every night from
.Pa /etc/daily ,
on a
.Nx
system, if configured do to so from
.Pa /etc/daily.conf .
.Pp
The variables described below can be set to "NO" to disable the test:
.Bl -tag -width check_pkg_vulnerabilities
.It Sy check_entropy
This checks whether the system has enough entropy
.Pq see Xr entropy 7 .
.It Sy check_passwd
This checks the
.Pa /etc/master.passwd
file for inconsistencies.
.It Sy check_group
This checks the
.Pa /etc/group
file for inconsistencies.
.It Sy check_rootdotfiles
This checks the root users startup files for sane settings of $PATH
and umask.
This test is not fail safe and any warning generated from
this should be checked for correctness.
.It Sy check_ftpusers
This checks that the correct users are in the
.Pa /etc/ftpusers
file.
.It Sy check_aliases
This checks for security problems in the
.Pa /etc/mail/aliases
file.
For backward compatibility,
.Pa /etc/aliases
will be checked as well if exists.
.It Sy check_rhosts
This checks for system and user rhosts files with "+" in them.
.It Sy check_homes
This checks that home directories are owned by the correct user,
and have appropriate permissions.
.It Sy check_varmail
This checks that the correct user owns mail in
.Pa /var/mail ,
and that the mail box has the right permissions.
.It Sy check_nfs
This checks that the
.Pa /etc/exports
file does not export filesystems to the world.
.It Sy check_devices
This checks for changes to devices and setuid files.
.It Sy check_mtree
This runs
.Xr mtree 8
to ensure that the system is installed correctly.
The following configuration files are checked:
.Bl -tag -width 4n
.It Pa /etc/mtree/special
Default files to check.
.It Pa /etc/mtree/special.local
Local site additions and overrides.
.It Pa /etc/mtree/DIR.secure
Specification for the directory
.Pa DIR .
.El
.It Sy check_disklabels
Backup text copies of the disklabels of available disk drives into
.Pa /var/backups/work/disklabel.XXX ,
and display any differences in those and the previous copies
as per
.Sy check_changelist
below.
If
.Xr fdisk 8
is available on the current platform, the output of
.Pa /sbin/fdisk
for each available disk drive is stored in
.Pa /var/backups/work/fdisk.XXX ,
and any differences displayed as per the disklabels.
.It Sy check_pkgs
This stores a list of all installed pkgs into
.Pa /var/backups/work/pkgs
and checks it for any changes.
.It Sy check_changelist
This determines a list of files from the contents of
.Pa /etc/changelist ,
and the output of
.Ic mtree -D
for
.Pa /etc/mtree/special
and
.Pa /etc/mtree/special.local .
For each file in the list it compares the files with their backups in
.Pa /var/backups/file.current
and
.Pa /var/backups/file.backup ,
and displays any differences found.
The following
.Xr mtree 8
.Sy tags
modify how files are determined from
.Pa /etc/mtree/special
and
.Pa /etc/mtree/special.local :
.Bl -tag -width exclude -offset indent
.It exclude
The entry is ignored; no backups are made and the differences are not
displayed.
This includes dynamic or binary files such as
.Pa /var/run/utmp .
.It nodiff
The entry is backed up but the differences are not displayed because
the contents of the file are sensitive.
This includes files such as
.Pa /etc/master.passwd .
.El
.It Sy check_pkg_vulnerabilities
Checks the currently installed packages against a database of known
vulnerabilities and reports those that are vulnerable.
Check the
.Sy fetch_pkg_vulnerabilities
setting in
.Xr daily.conf 5
to keep the database up to date.
.It Sy check_pkg_signatures
Checks the digital signature of all files installed by packages against
the expected values stored in the packages database.
.El
.Pp
The variables described below can be set to modify the tests:
.Bl -tag -width check_network
.It Sy check_homes_permit_usergroups
During the
.Sy check_homes
phase, allow the checked files to be group-writable if the group name is
the same as the username.
.It Sy check_homes_permit_other_owner
During the
.Sy check_homes
phase, allow the home directory and files of the listed users to be owned
by a different user.
.It Sy check_devices_ignore_fstypes
Lists filesystem types to ignore during the
.Sy check_devices
phase.
Prefixing the type with a
.Sq \&!
inverts the match.
For example,
.Ql procfs !local
will ignore
.Ql procfs
type filesystems and filesystems that are not
.Ql local .
.It Sy check_devices_ignore_paths
Lists pathnames to ignore during the
.Sy check_devices
phase.
Prefixing the path with a
.Sq \&!
inverts the match.
For example,
.Ql /tftp
will ignore paths under
.Pa /tftp
while
.Ql !/home
will ignore paths that are not under
.Pa /home .
.It Sy check_mtree_follow_symlinks
During the
.Sy check_mtree
phase, instruct mtree to follow symbolic links.
Please note, this may cause the
.Sy check_mtree
phase to report errors for entries for these symbolic links (i.e. of
type=link in the mtree specification) as they will always appear to be plain
files for the purposes of the check.
.Pa /etc/mtree/special.local
may be used to override the checks for the affected links.
.It Sy check_passwd_nowarn_shells
If
.Sy check_passwd
is enabled, most warnings will be suppressed for entries whose shells
are listed in this space-separated list.
This is of particular value when those shells are not in
.Pa /etc/shells .
.It Sy check_passwd_nowarn_users
If
.Sy check_passwd
is enabled, suppress warnings for these users.
.It Sy check_passwd_permit_dups
If
.Sy check_passwd
is enabled, do not warn about duplicate uids for the listed login names.
.It Sy check_passwd_permit_nonalpha
If
.Sy check_passwd
is enabled, do not warn about login names which use non-alphanumeric
characters.
.It Sy check_passwd_permit_star
If
.Sy check_passwd
is enabled, do not warn about password fields set to
.Dq * .
Note that the use of password fields such as
.Dq *ssh
is encouraged, instead.
.It Sy max_grouplen
If
.Sy check_group
is enabled, this determines the maximum permitted length of group names.
.It Sy max_loginlen
If
.Sy check_passwd
is enabled, this determines the maximum permitted length of login names.
.It Sy backup_dir
Change the backup directory from
.Pa /var/backup .
.It Sy diff_options
Specify the options passed to
.Xr diff 1
when it is invoked to show changes made to system files.
Defaults to
.Dq -u ,
for unified-format context-diffs.
.It Sy pkgdb_dir
.Em DEPRECATED .
Please set
.Dv PKGDB_DIR
in
.Xr pkg_install.conf 5
instead.
.Pp
If defined, points to the location of the packages database.
Defaults to
.Pa /usr/pkg/pkgdb .
.It Sy backup_uses_rcs
Use
.Xr rcs 1
for maintaining backup copies of files noted in
.Sy check_devices ,
.Sy check_disklabels ,
.Sy check_pkgs ,
and
.Sy check_changelist
instead of just keeping a current copy and a backup copy.
.It Sy random_file
Name of the entropy seed file used at boot.
Default is
.Pa /var/db/entropy-file
as used by
.Pa /etc/rc.d/random_seed .
Set
.Sy random_file
to empty to disable saving a seed every time
.Pa /etc/security
runs.
.El
.Sh FILES
.Bl -tag -width /etc/defaults/security.conf -compact
.It Pa /etc/defaults/security.conf
defaults for /etc/security.conf
.It Pa /etc/security
daily security check script
.It Pa /etc/security.conf
daily security check configuration
.It Pa /etc/security.local
local site additions to
.Pa /etc/security
.El
.Sh SEE ALSO
.Xr daily.conf 5
.Sh HISTORY
The
.Nm
file appeared in
.Nx 1.3 .
The
.Sy check_disklabels
functionality was added in
.Nx 1.4 .
The
.Sy backup_uses_rcs
and
.Sy check_pkgs
features were added in
.Nx 1.6 .
.Sy diff_options
appeared in
.Nx 2.0 ;
prior to that, traditional-format (context free) diffs were generated.
@


1.42
log
@Update default pkgsrc database location from /var/db/pkg to /usr/pkg/pkgdb.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.41 2019/12/06 14:43:30 riastradh Exp $
d50 3
@


1.41
log
@Save the entropy seed daily in /etc/security.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.40 2013/11/06 19:37:06 spz Exp $
d27 1
a27 1
.Dd April 5, 2012
d274 1
a274 1
.Pa /var/db/pkg .
@


1.40
log
@Introduce a variable for security.conf, default empty, to list users
whose home is (allowed to be) owned by another user.

It's a separate variable and not just check_passwd_permit_dups so I can
make security shut up about my uucp users.

Fixes the second half of PR misc/36063
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.39 2012/04/05 09:15:56 wiz Exp $
d285 11
@


1.40.26.1
log
@Merge changes from current as of 20200406
@
text
@d1 1
a1 1
.\"	$NetBSD$
a284 11
.It Sy random_file
Name of the entropy seed file used at boot.
Default is
.Pa /var/db/entropy-file
as used by
.Pa /etc/rc.d/random_seed .
Set
.Sy random_file
to empty to disable saving a seed every time
.Pa /etc/security
runs.
@


1.39
log
@Bump date for previous.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.38 2012/04/05 09:10:21 spz Exp $
d174 5
@


1.39.2.1
log
@Rebase to HEAD as of a few days ago.
@
text
@d1 1
a1 1
.\"	$NetBSD$
a173 5
.It Sy check_homes_permit_other_owner
During the
.Sy check_homes
phase, allow the home directory and files of the listed users to be owned
by a different user.
@


1.38
log
@add a description for the new check_passwd_permit_dups variable
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.37 2010/02/05 17:23:47 wiz Exp $
d27 1
a27 1
.Dd February 5, 2010
@


1.37
log
@Mark up PKGDB_DIR with Dv (same as in pkg_install.conf).
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.36 2010/02/05 16:32:20 jmmv Exp $
d224 4
@


1.37.6.1
log
@sync with head
@
text
@d1 1
a1 1
.\"	$NetBSD$
d27 1
a27 1
.Dd April 5, 2012
a223 4
.It Sy check_passwd_permit_dups
If
.Sy check_passwd
is enabled, do not warn about duplicate uids for the listed login names.
@


1.37.6.2
log
@sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.37.6.1 2012/04/17 00:05:47 yamt Exp $
a173 5
.It Sy check_homes_permit_other_owner
During the
.Sy check_homes
phase, allow the home directory and files of the listed users to be owned
by a different user.
@


1.36
log
@Note that pkgdb_dir is deprecated and point to the alternative setting.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.35 2010/01/20 07:33:25 wiz Exp $
d258 1
a258 1
.Sq PKGDB_DIR
@


1.35
log
@Remove trailing whitespace.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.34 2010/01/19 22:08:52 jmmv Exp $
d27 1
a27 1
.Dd January 19, 2010
d256 10
a265 5
Change the pkg database directory from
.Pa /var/db/pkg
when
.Sy check_pkgs
is enabled.
@


1.34
log
@Document the new package-related maintenance options and security checks
in daily.conf and security.conf.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.33 2008/05/29 14:51:25 mrg Exp $
d210 1
a210 1
files for the purposes of the check. 
@


1.33
log
@remove clause #3 from my license where there are no other
copyright holders involved.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.32 2008/04/08 14:51:02 sborrill Exp $
d27 1
a27 1
.Dd May 29, 2006
d49 1
a49 1
.Bl -tag -width check_network
d154 11
@


1.32
log
@Note that /etc/mtree/special.local can override entries in
/etc/mtree/special not just add new entries.
Explain that check_mtree_follow_symlinks will give reports of links not
being links (notably /etc/localtime)
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.31 2006/05/29 22:07:25 wiz Exp $
a13 2
.\" 3. The name of the author may not be used to endorse or promote products
.\"    derived from this software without specific prior written permission.
@


1.32.4.1
log
@Sync w/ -current. 34 merge conflicts to follow.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.32 2008/04/08 14:51:02 sborrill Exp $
d14 2
@


1.32.2.1
log
@sync with head
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.32 2008/04/08 14:51:02 sborrill Exp $
d14 2
@


1.31
log
@Improve documentation for ! in check_devices_ignore_paths.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.30 2006/05/25 02:38:10 lukem Exp $
d100 1
a100 1
Local site additions.
d197 7
@


1.31.18.1
log
@Sync with HEAD.
@
text
@d1 1
a1 1
.\"	$NetBSD$
d14 2
d100 1
a100 1
Local site additions and overrides.
a196 7
Please note, this may cause the
.Sy check_mtree
phase to report errors for entries for these symbolic links (i.e. of
type=link in the mtree specification) as they will always appear to be plain
files for the purposes of the check. 
.Pa /etc/mtree/special.local
may be used to override the checks for the affected links.
@


1.30
log
@Implement check_devices_ignore_paths, which is a list of paths to
avoid traversing during check_devices.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.29 2005/02/05 15:31:29 wiz Exp $
d29 1
a29 1
.Dd May 25, 2006
d186 1
a186 1
.Ql /tftp !/home
d189 3
a191 1
and paths that are not under
@


1.29
log
@Fix Dd argument, and a grammar fix.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.28 2005/02/05 15:26:38 jdolecek Exp $
d29 1
a29 1
.Dd February 5, 2005
d178 13
@


1.29.2.1
log
@Pull up following revision(s) (requested by lukem in ticket #1377):
	etc/security: revision 1.98
	share/man/man5/security.conf.5: revision 1.30 by patch
	etc/defaults/security.conf: revision 1.18
Implement check_devices_ignore_paths, which is a list of paths to
avoid traversing during check_devices.
@
text
@d1 1
a1 1
.\"	$NetBSD$
d29 1
a29 1
.Dd May 25, 2006
a177 13
.It Sy check_devices_ignore_paths
Lists pathnames to ignore during the
.Sy check_devices
phase.
Prefixing the path with a
.Sq \&!
inverts the match.
For example,
.Ql /tftp !/home
will ignore paths under
.Pa /tftp
and paths that are not under
.Pa /home .
@


1.29.2.2
log
@Pull up following revision(s) (requested by lukem in ticket #1377):
	share/man/man5/security.conf.5: revision 1.31
Improve documentation for ! in check_devices_ignore_paths.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.29.2.1 2006/07/12 14:23:25 tron Exp $
d29 1
a29 1
.Dd May 29, 2006
d186 1
a186 1
.Ql /tftp
d189 1
a189 3
while
.Ql !/home
will ignore paths that are not under
@


1.29.6.1
log
@Sync with head.
@
text
@d1 1
a1 1
.\"	$NetBSD$
d29 1
a29 1
.Dd May 29, 2006
a177 15
.It Sy check_devices_ignore_paths
Lists pathnames to ignore during the
.Sy check_devices
phase.
Prefixing the path with a
.Sq \&!
inverts the match.
For example,
.Ql /tftp
will ignore paths under
.Pa /tftp
while
.Ql !/home
will ignore paths that are not under
.Pa /home .
@


1.28
log
@add a check_passwd_permin_nonalpha option, which changes the passwd
test to permit non-alphanumeric characters in login names
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.27 2004/09/28 15:19:02 wiz Exp $
d29 1
a29 1
.Dd Febrary 5, 2005
d196 1
a196 1
is enabled, do not warn about login names, which use non-alphanumeric
@


1.27
log
@Bump date for *ignore_fstypes addition; new sentence, new line;
mark up the bang.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.26 2004/09/28 15:05:13 erh Exp $
d29 1
a29 1
.Dd September 28, 2004
d193 5
@


1.26
log
@PR misc/7716: document the check_devices_ignore_fstypes and
find_core_ignore_fstypes options.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.25 2003/11/18 09:07:25 wiz Exp $
d29 1
a29 1
.Dd November 17, 2003
d168 5
a172 1
phase.  Prefixing the type with a ! inverts the match.  For example, 
d174 1
a174 1
will ignore 
@


1.25
log
@Drop trailing space.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.24 2003/11/18 03:25:16 jhawk Exp $
d165 9
@


1.24
log
@Document check_homes_permit_usergroups.
/etc/defaults/security.conf in FILES.
Bump Dd.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.23 2003/06/26 11:52:19 wiz Exp $
d161 1
a161 1
During the 
@


1.23
log
@There will be no NetBSD-1.7.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.22 2003/03/31 17:49:27 perry Exp $
d29 1
a29 1
.Dd February 21, 2003
d160 5
d224 3
a226 1
.Bl -tag -width /etc/security.local -compact
@


1.22
log
@spelling errors, some from Igor Sobrado in PR misc/19909
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.21 2003/03/03 06:41:51 wiz Exp $
d247 1
a247 1
.Nx 1.7 ;
@


1.21
log
@New sentence, new line.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.20 2003/02/21 22:47:54 jhawk Exp $
d59 1
a59 1
file for inconsistancies.
d168 1
a168 1
are listed in this space-seperated list.
@


1.20
log
@Use $diff_options when running diff in /etc/security.
Default diff_options to -u, for unified-format context diffs,
because context is essential to a useful evaluation of differences.
This represents a behavior change.

Implements change-request PR security/17247 from
Takahiro Kambe <taca@@sky.yamashina.kyoto.jp>.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.19 2003/02/13 02:42:37 jhawk Exp $
d168 2
a169 3
are listed in this space-seperated list.  This is of particular value
when those shells are not
in
d197 2
a198 1
when it is invoked to show changes made to system files. Defaults to
@


1.19
log
@Document check_mtree_follow_symlinks.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.18 2003/02/13 02:12:07 jhawk Exp $
d29 1
a29 1
.Dd February 12, 2003
d195 6
d245 4
@


1.18
log
@Document check_passwd_nowarn_shells, check_passwd_nowarn_users, and
check_passwd_permit_star; really the HISTORY section is kind of long in
the tooth.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.17 2003/01/18 18:32:21 grant Exp $
d160 4
@


1.17
log
@Fix some typos. From Igor Sobrado in PR pkg/19907.

While I'm here, new sentence, new line.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.16 2001/10/15 08:53:28 lukem Exp $
d29 1
a29 1
.Dd October 15, 2001
d160 20
@


1.16
log
@- expand check_homes description
- check_disklabels now backs up fdisk output if /sbin/fdisk exists
- expand check_mtree description
- s/pkg_dbdir/pkgdb_dir/
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.15 2001/10/01 03:02:34 atatat Exp $
d40 2
a41 1
services are performed.  The
d55 1
a55 1
file for inconsistancies.
d62 2
a63 1
and umask.  This test is not fail safe and any warning generated from
@


1.15
log
@Man page updates to cover recent work and work that I did before I
realized there was a man page for this stuff.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.14 2001/09/11 01:01:58 wiz Exp $
d29 1
a29 1
.Dd September 30, 2001
d77 2
a78 1
This checks that home directories are owned by the correct user.
d93 10
d105 1
a105 1
.Pa /var/backups/disklabel.XXX ,
d110 7
d119 1
a119 1
.Pa /var/backups/pkgs
d122 9
a130 3
This updates the list of files in
.Pa /etc/changelist
and their backups in
d135 19
d169 1
a169 1
.It Sy pkg_dbdir
@


1.14
log
@Sort SEE ALSO correctly; trade empty lines for .Pp; drop superfluous .Pp's;
correct oder of sections; even comment in some .Xr's in one case.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.13 2001/09/08 01:29:08 wiz Exp $
d29 1
a29 1
.Dd August 25, 1998
d99 4
d126 16
d164 6
@


1.13
log
@Whitespace/punctuation fixes.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.12 2001/03/15 02:23:48 hubertf Exp $
a122 1
.Pp
@


1.12
log
@Run skeyaudit (only) from /etc/daily instead of /etc/security, else there's
some risk that the users don't get warned if an admin turns off running
/etc/security (by putting run_security=no into daily.conf).

Fixes PR 12267.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.11 2001/02/11 09:55:09 jdolecek Exp $
d104 1
a104 1
and 
@


1.11
log
@Introduce max_grouplen - this determines the maximum permitted length
of group names, similarily to max_loginlen
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.10 2001/01/09 17:30:30 abs Exp $
a106 5
.It Sy run_skeyaudit
The
.Xr skeyaudit 1
program checks the S/Key database and informs users of S/Keys that
are about to expire.
@


1.10
log
@Add a new variable 'backup_dir', which can be used to change the backup
directory from /var/backup (useful for those of us who have a separate /var
and would like to have our backup disklabels on the root filesystem).
Default behaviour unchanged. backup_dir being unset is taken as /var/backup.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.9 2000/05/26 17:08:22 ad Exp $
d116 4
@


1.9
log
@We may as well allow local additions to /etc/security, since it gets done
for the other periodic checks.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.8 2000/05/05 18:28:54 itojun Exp $
d120 3
@


1.8
log
@check /etc/mail/aliases on check_aliases.
/etc/aliases will be checked as well, if exists (for backward compatibility).
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.7 2000/04/24 23:46:38 fair Exp $
d123 7
d131 1
a131 1
.Pa /etc/security.conf
@


1.7
log
@Add skeyaudit to /etc/security (with a variable to disable) per PR 5871
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.6 1999/03/17 20:19:48 garbled Exp $
d69 3
d73 1
a73 1
file.
@


1.6
log
@More and more .Os cleanups.  .Os is defined in the tmac.doc-common file,
so we shouldn't override it with versions in the manpages.  Many more to
come.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.5 1999/02/18 18:53:32 abs Exp $
d104 5
@


1.5
log
@Handle + in master.passwd (From PR#4802).
Also, handle + in group and allow max_loginlen to be configurable.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.4 1998/08/25 13:50:45 lukem Exp $
d31 1
a31 1
.Os NetBSD 1.3
@


1.4
log
@document check_disklabels
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.3 1997/10/10 05:40:08 mrg Exp $
d104 8
@


1.3
log
@remove advertising clause from all my licenses.
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.2 1997/07/01 22:55:26 rat Exp $
d29 1
a29 1
.Dd December 30, 1996
d89 7
d102 2
a103 1
.Pa /var/backups/file.backup .
d116 4
@


1.2
log
@'backsups' --> 'backups'
@
text
@d1 1
a1 1
.\"	$NetBSD: security.conf.5,v 1.1 1997/01/05 11:50:18 mrg Exp $
d14 1
a14 5
.\" 3. All advertising materials mentioning features or use of this software
.\"    must display the following acknowledgement:
.\"      This product includes software developed by Matthew R. Green for
.\"      the NetBSD Project.
.\" 4. The name of the author may not be used to endorse or promote products
@


1.1
log
@add man pages for mostly new and some old configuration files.
@
text
@d1 1
a1 1
.\"	$NetBSD$
d97 1
a97 1
.Pa /var/backsups/file.current
d99 1
a99 1
.Pa /var/backsups/file.backup .
@