Currently checksecurity will *only* do checks regarding SUID files which
is kind of misleading (since one would like 'checksecurity' to be a
security check and not just that).

While reading an article about Security in Linux distributions [1] y found
out that SUSE's checksecurity [2] will do quite a little bit more and it
is, in fact, GPLd (what a surprise, available here [3])

I would like checksecurity to do more than SUID changes. I'm not sure,
however, of which features should be enabled by default. Some of this
checks are already done by Tiger (see [4]) and I'm not sure I want
checksecurity to do all of them (since they might be a little too much)

Thank you

	Javier Fernandez-Sanguino

From seccheck's README:

The following daily checks are done:
 /etc/passwd check : length/number/contents of fields, accounts with same
uid
			accounts with uid/gid of 0 or 1 beside root and
bin
 /etc/shadow check : length/number/contents of fields, accounts with no
password
 /etc/group check  : length/number/contents of fields
 user root checks  : secure umask and PATH
 /etc/ftpusers     : checks if important system users are put there
 /etc/aliases      : checks for mail aliases which execute programs
 .rhosts check     : checks if users' .rhosts file contain + signs
 homedirectory     : checks if homedirectories are writable or owned by
			someone else
 dot-files check   : checks many dot-files in the homedirectories if they
			are writable or owned by someone else
 mailbox check     : checks if user mailboxes are owned by user and
unreadable
 NFS export check  : exports should not be exported globaly
 NFS import check  : NFS mounts should have the "nosuid" option set
 promisc check     : checks if network cards are in promiscious mode
 list modules      : just lists loaded modules
 list sockets      : just lists open ports

The following weekly checks are done:
 password check    : runs john to crack the password file, user will get
an
			email notice to change his password asap
 rpm md5 check     : checks for changed files via rpm's md5 checksum
feature
 suid/sgid check   : lists all suid and sgid files
 exec group write  : lists all executables which are group/world writeable
 writable check    : lists all files which are world writable (incl.
above)
 device check      : lists all devices

The following monthly things are done:
 The monthly file is not a diff like the daily/weekly ones but the full
 reports in one file.




[1] http://www.linuxjournal.com/article.php?sid=6362&mode=thread&order=0
[2] http://www.suse.de/~marc/seccheck.html
[3] http://www.suse.de/~marc/seccheck-2.0.tar.gz
[4] http://savannah.nongnu.org/projects/tiger
--- Begin /etc/checksecurity.conf (modified conffile)
CS_NFSAFS='(nfs|afs|coda)'
CS_TYPES=' type (auto|proc|msdos|fat|vfat|iso9660|usbdevfs|ncpfs|smbfs|ntfs|devpts|none|'$CS_NFSAFS')'
CS_OPTS='\(.*(nosuid|noexec).*\)'
CS_DEVS='^/dev/fd'
CS_DIRS='on /mnt'
CHECKSECURITY_FILTER="$CS_TYPES|$CS_OPTS|$CS_DEVS|$CS_DIRS"
unset CS_NFSAFS CS_TYPES CS_DIRS CS_OPTS
CHECKSECURITY_NOFINDERRORS="FALSE"
CHECKSECURITY_DISABLE="FALSE"
CHECKSECURITY_NONFSAFS="FALSE"
CHECKSECURITY_EMAIL="guru"
CHECKSECURITY_DEVICEFILTER="-path /dev/*"
CHECKSECURITY_PATHFILTER="-false"
LOGDIR=/var/log

--- End /etc/checksecurity.conf

The "checksecurity" part of cron is a big joke. It's completely out of
place, and has been so neutered by complainers over the years that I'm
planning on separating it out of cron and then orphaning the package.
The tricky part is getting the conffile safely moved, which is why I
haven't done it earlier.

Steve

	However, it is my opinion that Debian *does* need a checksecurity
script just like every *BSD and many Linux distros have already. Maybe
making it an independent package might make it be improved differently. If
you do orphan it, please tell me first.

	I will try to think a way on how to separate this into a new
package (without breaking policy). Maybe this could be done with cron's
pre-inst moving the file into an /etc/checksecurity/ directory (with a
name like 'checksecurity.previous.conf') and have the 'checksecurity'
package (on postinst) see if there is a previous.conf and move it over
into /etc/checksecurity/checksecurity.conf for example. This would not
break the policy (since each package handles its conf files) as I
understand it.

	Regards

	Javi

Hi,

  I've recently taken over this package, and I remember our earlier
 thread upon Debian-devel about common security checks.

  So far checksecurity has been upgraded a little in line with those
 comments - and does have a more extensible setup, so that further
 checks can be added in the future.

  Right now that's not really been taken advantage of, but it will
 come.

Steve
--
# Debian Security Audit Project
http://www.steve.org.uk/Debian/

  I shall do on both counts.

  I made a new upload this morning containing man pages for each of the
 currently shipped plugins, and some more descriptive text generally.

  I'll rename README.Debian upon the next upload - that hadn't occurred
 to me, but you are entirely correct.

Steve
--

Yes.

That's very nice
that fulfill the bug report. In any case, I believe it would be nice if you
could summarise the threads at debian-devel in the README.Debian file.
Specially describing what checksecurity does as compared to other
'check-security' scripts available (SuSE's, OpenBSD's, Mandrake's...) or to
other similar tools available in Debian.

I'm afraid that checksecurity does not currently provide enough
documentation and that should be also an area of improvement.

Regards

Javi

PS: BTW, why is there a README.Debian file at all? If it's a native Debian
package it should just be README