SECURITY(8)

📦 in nixpkgs unstable

💅 SECURITY(8) — the manual page, but make it cute

okay so bestie, buckle up, this is security from section 8 of the manual (the sysadmin one, not the "call the cops" one 😭) — and it's literally the vibe check your server runs on itself every single day. let's get into it ✨

🛡️ NAME

security — the periodic system security check, a.k.a. your machine's daily selfie to make sure nothing sketchy is going on 📸

💖 DESCRIPTION

security is a command script that examines the system for some signs of security weaknesses. think of it as a little detective 🕵️‍♀️ that goes through your box looking for red flags. but real talk: it is only a security aid and does not offer complete protection. it's not a bodyguard, it's a friend going "hmm girl that permission looks a little sus 👀".

security is run by daily(8), which mails any output to root on a daily basis. so yes, root gets a little daily newsletter about your system's drama 💌

The security script carries out the following list of simple checks:

  • Check the master.passwd(5) and group(5) files for syntax, empty passwords, partially closed accounts, suspicious UIDs, suspicious GIDs, and duplicate entries. 🕵️‍♀️
  • Check root's home directory and login environment for insecure permissions, suspicious paths, and umask commands in the dotfiles. 🏠
  • Check for suspicious commands in /etc/mail/aliases. 📧
  • Check for insecurities in /etc/hosts.lpd. 🖨️
  • Check user .rhosts and .shosts files for open access. 🚪
  • Check user home directory permissions. 📁
  • Check many user dotfile permissions. 🔍
  • Check user mailbox permissions. 📬
  • Check NFS exports(5) file for global export entries. 🌍
  • Check for changes in setuid/setgid files and devices. 🔧
  • Check disk ownership and permissions. 💾
  • Check for changes in the device file list. 🎛️
  • Check for permission changes in special files and system binaries listed in /etc/mtree/special. security also provides hooks for administrators to create their own lists. These lists should be kept in /etc/mtree/ and filenames must have the suffix “.secure”. The following example shows how to create such a list, to protect the programs in /bin:
# mtree -cx -p /bin -K sha256digest,type > /etc/mtree/bin.secure
# chown root:wheel /etc/mtree/bin.secure
# chmod 600 /etc/mtree/bin.secure
Note: These checks do not provide complete protection against Trojan horse binaries, as the miscreant can modify the tree specification to match the replaced binary. For details on really protecting yourself against modified binaries, see mtree(8). 🐴💀 (yes, that's a real caveat — no cap, read it twice)
  • Check for changes in files listed in /etc/changelist. Files being created or deleted, as well as content change in the files themselves, are reported. See changelist(5) for further details. 📝
  • Check for changes to the disklabels and partition tables of mounted disks. 💿
  • Report on the installation or removal of any system package(5). 📦
  • Check hostname.if(5) file permissions. 🌐

The intent of the security script is to point out some obvious holes to the system administrator. it's not doing a full forensic audit, it's pointing at the obvious stuff like "bestie. that file is writable by everyone. please." 🫶

🌸 ENVIRONMENT

The following variables can be set in /etc/daily.local:

  • PASSWDSKIP — a whitespace-separated list of name:shell pairs allowed to have empty passwords. for example, a machine running both CVS and gotd for anonymous access might set:
PASSWDSKIP="anoncvs:/usr/local/bin/anoncvssh
            anonymous:/usr/local/bin/gotsh"
  • SUIDSKIP — a whitespace-separated list of absolute paths to be skipped in setuid/setgid file checks and in device special file checks. Avoid trailing slashes. (the script gets confused, and honestly same 😭)

🎀 FILES

  • /etc/changelist
  • /etc/daily
  • /etc/mtree
  • /usr/libexec/security
  • /var/backups

🦋 SEE ALSO

changelist(5), daily(8), mtree(8)

⭐ HISTORY

A security shell script appeared in 4.3BSD-Reno, but most functionality only came with 4.4BSD. so it's giving old money, new features 💅

👑 AUTHORS

The present manual was written by David Leonard for OpenBSD 2.9. Andrew Fresh <afresh1@openbsd.org> and Ingo Schwarze <schwarze@openbsd.org> rewrote security from scratch in perl(1) for OpenBSD 5.0. iconic behaviour, honestly 🫶

💀 BUGS

The name of this script may provide a false sense of security. 😬 like... the name is doing a LOT of heavy lifting here.

There are perhaps an infinite number of ways the system can be compromised without this script noticing. infinity. bestie. INFINITY. 🔥

and that's the whole page, bestie — this one shipped with Debian, dated March 31, 2025 🎀 go forth and let your server tattle on itself daily 💖✨

📦 where this page comes from