Commit Graph

180 Commits

Author SHA1 Message Date
Brooks Davis
7cdc1c0007 Add an (off by default) check for negative permissions (where the
group on a object has less permissions that everyone).  These
permissions will not work reliably over NFS if you have more than
14 supplemental groups and are usually not what you mean.

MFC after:	1 week
2010-11-13 00:40:43 +00:00
Xin LI
65a1c46588 Hide 460.chkportsum in MK_PKGTOOLS != no case.
Submitted by:	Alex Kozlov <spam rm-rf kiev ua>
MFC after:	2 weeks
2010-11-09 18:46:44 +00:00
Alexander Leidinger
3dd9aad270 - Change the threshold from 'running next scrub the <value+1>th day after the
last one' to 'running next scrub the <value>th day after the last one'.
- Improve wording.

Requested by:	jhell <jhell@DataIX.net>
MFC after:	1 week
2010-08-25 08:09:42 +00:00
Oliver Fromme
686fdc1fc1 Connect the new script 490.status-pkg-changes (see r210863)
to the build, so it gets actually installed.

Approved by:	des (mentor)
MFC after:	17 days
2010-08-10 12:58:44 +00:00
Gabor Kovesdan
c2f40dcd3f - Fixes to the chkportsum script to handle better some special cases,
like spaces in filename

Submitted by:	Alex Kozlov <spam@rm-rf.kiev.ua>
Approved by:	delphij (mentor)
2010-08-10 11:15:17 +00:00
Oliver Fromme
6ece019fcf Add a daily script to the periodic framework that reports
changes to the package database, i.e. any packages that
have been added, updated or deleted in the past 24 hours.
The format is intentionally simple and concise.

That information is particularly useful on servers that
are maintained by multiple administrators.  When someone
adds, updates or deletes a package, the others will see
it in the daily periodic output.

This script is disabled by default.

PR:		conf/113913
Submitted by:	olli
Approved by:	des (mentor)
MFC after:	3 weeks
2010-08-05 15:53:33 +00:00
Gabor Kovesdan
d8456aa881 - Add a periodic script, which can be used to find installed ports' files with
mismatched checksum

PR:		conf/124641
Submitted by:	Alex Kozlov <spam@rm-rf.kiev.ua>
Approved by:	delphij (mentor)
2010-07-19 20:19:14 +00:00
Alexander Leidinger
92dee8c3a0 - add the zfs scrub script
- move the zfs status script into the MK_ZFS conditional to respect
  WITHOUT_ZFS

Noticed by:	Andrzej Tobola <ato@iem.pw.edu.pl>
2010-06-17 12:25:47 +00:00
Alexander Leidinger
63669de232 Add a periodic zfs scrub script.
Features:
 - configurable amount of days between scrubs (default value or per pool)
 - do not scrub directly after pool creation (respects the configured
   number of days between scrubs)
 - do not scrub if a scrub is in progress
 - tells how to see the status of the scrub
 - tells how many days since the last scrub if it skips the scrubbing
 - warns if a non-existent pool is specified explicitely
   (default: no pools specified -> all currently imported pools are
   handled)
 - runs late in the periodic run to not slow down the other periodic daily
   scripts

Discussed on:	fs@
2010-06-15 08:58:16 +00:00
Jung-uk Kim
07e547fe26 Add a new build option, MAN_UTILS. This option lets you control building
utilities and related support files for manual pages, which were previously
controlled by MAN.  For POLA, the default depends on MAN, i.e., WITHOUT_MAN
implies WITHOUT_MAN_UTILS and WITH_MAN implies WITH_MAN_UTILS.  This patch
is slightly improved by me from:

PR:		misc/145212
2010-05-19 23:56:26 +00:00
Doug Barton
2557f5bf0a Remove trailing white space. No functional changes. 2010-05-14 04:53:57 +00:00
Ed Schouten
1e40039260 Let rc and periodic infrastructure and newsyslog use the utmpx files. 2010-01-13 19:07:48 +00:00
Colin Percival
ca82268b2a Silence warning printed by getfsspec(3) when /etc/fstab does not exist
fstab: /etc/fstab:0: No such file or directory
and from dump(8) when setfsent(3) fails due to /etc/fstab not existing:
  DUMP: Can't open /etc/fstab for dump table information: No such...

This makes daily and security periodic runs somewhat cleaner in jails
which lack /etc/fstab files.

MFC after:	1 month
2009-09-28 03:32:35 +00:00
Brian Somers
045e970615 Rather than using both -prune (which requires directory-first tree traversal)
and -delete (which implies depth-first traversal), avoid using -delete in
favour of -execdir.

This has a side-effect of not removing directories that contain files,
even if we delete all of those files, but IMHO that's a better option
than specifying all possible local filesystem types in this script.

PR:		122811
MFC after:	3 weeks
2009-06-02 07:35:51 +00:00
Brian Somers
48369f7cc0 Update this script so that it handles different ruleset failures
differently.  The output now shows the ruleset and shortens to
slightly different text (using $daily_status_mail_rejects_shorten),
but it should be more descriptive.

PR:		35018
Inspired by:	Mikhail Teterin - mi at aldan dot algebra dot com
MFC after:	3 weeks
2009-05-28 07:43:06 +00:00
Hajimu UMEMOTO
620b9b80bc Fix typo to install 400.status-pkg, again. 2009-01-14 09:00:30 +00:00
Ed Schouten
53cb00a92b Sort `mount -p' output by name before checking for any differences.
I noticed on a system at home that restarting named(8) causes the
/var/named/dev mount to be moved to the bottom of the mount list,
because it gets remounted. When I received the daily security email this
morning, I was quite amazed to see that the security report listed the
differences, while it was nothing out of the ordinary.

If we just throw the `mount -p' output through sort(1), we'll only
receive notifications about changes to mounts if something has really
changed.
2008-10-25 18:45:40 +00:00
Sam Leffler
690f477d75 add new build knobs and jigger some existing controls to improve
control over the result of buildworld and installworld; this especially
helps packaging systems such as nanobsd

Reviewed by:	various (posted to arch)
MFC after:	1 month
2008-09-21 22:02:26 +00:00
Antoine Brodin
86e82d6ef7 Improve periodic/security/550.ipfwlimit a bit:
- don't run it if net.inet.ip.fw.verbose = 0 as it is pointless
- handle rules without logging limit correctly [1]
(those rules show up without logamount in "ipfw -a list")

PR:		conf/126060 [1]
MFC after:	1 month
2008-08-10 18:11:24 +00:00
Mike Makonnen
10df26f936 Rev. 1.8 broke matching on lines where the failure mode is at the head
of the message, such as:
  Jun 30 10:49:21 rogue sshd[17553]: Invalid user iceman from 127.0.0.1

PR: conf/124569
Submitted by:	Taku <taku@tekipaki.jp>
2008-06-30 08:01:47 +00:00
Remko Lodder
1fa09c8b65 Add a missing ;.
PR:		misc/122069
Submitted by:	taku@tekipaki.jp
MFC after:	3 days
Approved by:	imp (mentor, implicit trivial change).
2008-03-25 15:16:19 +00:00
Dag-Erling Smørgrav
43085e37e4 Eliminate xargs in favor of find -exec {} + 2008-02-03 00:33:05 +00:00
Dag-Erling Smørgrav
a4afe9200c Rewrite to consume significantly less memory, by using find -s instead of
find | sort.  As a bonus, this simplifies the logic considerably.  Also
remove the bogus "overruning the args to ls" comment and the corresponding
"-n 20" argument to xargs; the whole point with xargs is precisely that it
knows how large the argument list can safely get.

Note that the first run of the updated script may hypotheticall produce
false positives due to differences between find's and sort's sorting
algorithm.  I haven't seen this during testing, but others might.

MFC after:	2 weeks
2008-02-02 12:27:37 +00:00
Diomidis Spinellis
f029c53a5c A new configuration variable, daily_status_mail_rejects_shorten, allows
the rejected mail reports to tally the rejects per blacklist without
providing details about individual sender hosts.  The default configuration
keeps the reports in their original form.

MFC after:	1 week
2008-01-08 07:22:43 +00:00
Ruslan Ermilov
5f3a6945d4 Also check setuid executables on ZFS. 2007-11-23 13:00:31 +00:00
Maxim Konovalov
f629328d0a o Install 480.status-ntpd.
Pointed out by:	Henrik Brix Anders
2007-05-14 17:34:59 +00:00
Maxim Konovalov
c7cc017f3b o Add a script to check ntpd(8) state. Default is off.
PR:		conf/112604
Submitted by:	Oliver Fromme
MFC after:	1 month
2007-05-13 09:33:35 +00:00
Pawel Jakub Dawidek
0daa3e3561 Add ZFS periodic scripts that monitors status of ZFS pools.
Submitted by:	des
2007-04-06 02:33:06 +00:00
Remko Lodder
217d9e4862 Only match on log messages containing fail,invalid,
bad or illegal. This prevents matching on systems that
have a name that matches the query.

PR:		conf/107560
Submitted by:	Christian Laursen <cfsl at pil dot dk>
MFC after:	3 days
Approved by:	imp (mentor)
2007-02-23 21:42:54 +00:00
Remko Lodder
4ee46876eb Move to the preferred syntax for nice (-n) instead
of the depricated one.

PR:		conf/108611
Submitted by:	TAOKA Fumiyoshi <fmysh at iijmio-mail dot jp>
Approved by:	imp (mentor)
2007-02-23 18:44:20 +00:00
John Polstra
bd4dbd7879 Use egrep instead of grep so that reporting of login failures (broken
by revision 1.6) works again.  This fix is already in RELENG_6, but was
never committed to HEAD.
2007-02-05 16:36:25 +00:00
Ruslan Ermilov
ca7f20f57f The kvm_mkdb(8) is long dead. 2006-08-29 08:49:58 +00:00
Tom Rhodes
b5aea37f80 Add login.conf checking to periodic security scripts. If the login.conf file
is not UID/GID 0, limits will be ignored and a strange error sent to auth.log.

Head nod:	ru, rwatson
2006-08-25 07:34:36 +00:00
Maxim Konovalov
e64917677e o Add missed $start variable in the grep statement back.
PR:		conf/96658
Submitted by:	James Snow
MFC after:	1 week
2006-06-11 20:39:12 +00:00
Max Laier
9277da52e1 Move etc/rc.firewall6 to ipfw2+v6, update related rc.d and periodic scripts.
Since ipfw2 now does dual-stack, statistics for IPv6 come from the ipfw
scripts as well.
2006-05-12 19:17:34 +00:00
Matteo Riondato
846bc8c6f4 Fix output and exit status when daily_mailq_shorten is set to YES
PR:		conf/93472
MFC after:	3
2006-03-08 17:26:53 +00:00
Matteo Riondato
fe468fe9c0 Enhance loginfail: it will catch sshd, proftpd and su errors, as well as other programs
PR: conf/70973
Submitted by:	Ryan Sommers" <ryans@gamersimpact.com>
Approved by:	philip (mentor)
MFC after:	3 days
2006-03-05 15:45:38 +00:00
Christian Brueffer
9ccfd1e437 Add periodic scripts that check the status of graid3(8), gstripe(8)
and gconcat(8) devices, respectively.

Approved by:	rwatson (mentor)
2006-03-02 14:44:19 +00:00
Matteo Riondato
2da6fa9f1f When there are no interesting information in output, exit with 0.
PR:		conf/92299
Submitted by:	Petr Rehor <prehor@gmail.com>
Approved by:	philip (mentor)
MFC after:	3 days
2006-02-07 08:21:06 +00:00
Maxim Konovalov
eb6b185e1e o Add 406.status-gmirror, sort.
Submitted by:	brueffer
2006-01-21 20:16:30 +00:00
Garrett Wollman
9960bd718b Add a daily script to show the status of gmirror(8) devices. 2006-01-13 18:07:52 +00:00
Doug Barton
a2362f35f6 Update the test for failed zone transfers to reflect BIND 9.3.1 semantics
Simplify the shell scripting a bit, and remove a useless grep | sed

The problem was pointed out by the PR, and I used part of the solution
suggested there, but the semantics changed again for 9.2.x -> 9.3.x.

PR:		conf/74228
Submitted by:	Jeremy Chadwick <freebsd@jdc.parodius.com>
2005-11-22 22:24:27 +00:00
Maxim Konovalov
17793b6ae5 A new version of rev. 1.4: postpone a temporary file creation
until we realize if ipfw(4) ever used.

PR:		bin/85970
Submitted by:	Andre Albsmeier
MFC after:	3 days
2005-09-11 14:29:58 +00:00
Gleb Smirnoff
fcb3c1b182 Fix braino in last commit. Print nothing if ipfw(4) is not present. 2005-08-31 08:31:14 +00:00
Colin Percival
d7883da19f When looking for new lines in diff output, grep for '^[>+]' instead of
'^>', in order to catch both normal and unified diffs.

Problem reported by:	volker at vwsoft dot com via -stable
MFC after:	3 days
2005-08-22 09:33:36 +00:00
Gleb Smirnoff
07d6ed30ec - Correctly parse output, when logging amount is limited in the
rule itself, not in verbose_limit sysctl. [1]
- Do check rules, even if verbose_limit is set 0. Rules may have
  their own log limits.

PR:		conf/77929
Submitted by:	Andriy Gapon [1]
Reviewed by:	matteo
2005-08-20 09:41:49 +00:00
Ruslan Ermilov
8aad57438b Purge orphan catpages.
PR:		conf/35242
Submitted by:	Annihilator <annihilator.c@usa.net>
2005-03-30 18:02:49 +00:00
Suleiman Souhlal
71b7f1cffb Replace "ipfw l", which is now deprecated, with "ipfw list".
Approved by:	grehan (mentor)
2005-02-23 15:07:36 +00:00
Gleb Smirnoff
aed9792fae Don't do setuid checks on file systems mounted with noexec option.
Reviewed by:	brian, ru
MFC after:	1 week
2005-01-13 15:07:35 +00:00
Brian Somers
b96d69488c Sed doesn't grok '[ \t]' -- it doesn't expand the \t :(
As there are no tabs in maillog, reduce the expression so that only spaces
are used.

Problem raised by:      Leif Neland root at internet dot dk
2005-01-12 01:31:21 +00:00