Subject: Re: Bug#3368: cron's checksecurity still scans NFS servers

From: Steve Greenland <[email-masked]>
Date: Sun, 30 Jun 1996 13:48:40 -0500 (CDT)

Dominik Kubla wrote:
> [checksecurity still descends down NFS links]
> And while we are at it: The same goes for AFS, ALEX and AMD filesystems,
> so please make the script ignore the AFS filetype and the following
> directories:
> 
>   /a
>   /afs
>   /alex
>   /amd
>   /n
>   /net
> 
> These directories have a special meaning to the named software products.

They're also perfectly legitimate directory names having nothing
to do with the named software products. I'll try to trap the afs
type (not having access to that, will the nfs filter work by
replacing 'nfs' with 'afs'?). However, it is my opinion that
filtering by name is something best left to the individual
administrator.

Maybe some sort of config file is needed here? '/etc/checksecurity.conf'?
Any objections? I'm thinking that checksecurity could source
checksecurity.conf, which at present would define the single
envirnoment variable FILTER, which would in turn be the argument
to 'grep -vE'. If later additions were needed, it would be pretty
straight forward.

In fact, I should probably build FILTER up out of FILTER_TYPES,
FILTER_OPTIONS, and FILTER_DIRS.  Other ideas?

SteveG

-- 
The Mole - I think, therefore I scream 

			"MR. DeGUZMAN, YOUR DAYS ARE
			 NUMBERED!"
						"That's Harris.	 DeGuzman is
						 math."
			"BAH!  They're ALL
			 scoundrels..."
[Zack, looking desperately for evil, from ZOT!]

---

From: Lars Wirzenius <[email-masked]>
Date: Sun, 30 Jun 1996 22:13:39 +0300

[ NB: I read the list.  Don't CC replies to me.  I pay for my PPP.  Thanks ]

> Maybe some sort of config file is needed here? '/etc/checksecurity.conf'?

This might be an appropriate time to start thinking again about
/etc/default (under whatever name).  If I remember correctly, someone
told us that one of the commercial vendors (or SVR4?) has a directory
/etc/default, with shell scripts that set certain variables.  This is
used for configuration.  When a program (script) needs the configuration,
it sources the script.  One of the benefits is that there's a lot of
potential small configuration files like this, and it could be a bit
neater to put them into the same directory.

Examples:

	/etc/init.d/boot
		- is hardware clock GMT or local time?
		- should /etc/motd be updated automatically?
		
	httpd: what's the document directory? (if you don't want
	/home/httpd-data)
	
	/etc/init.d/console: name of font and keymap
	
	/etc/init.d/network: network configuration
	
The point is that it is often easier to have the configuration and
the script using it separate -- you can replace the script, but you
don't have to make the user edit the new script to have the old
configuration data.

However, each script should have some sensible builtin defaults:

	if test -f /etc/default/checksecurity
	then
		. /etc/default/checksecurity
	else
		FS_DENY='nfs afs'
		DIR_DENY=''
		...
	fi

At least on my system, /etc/default already exists, and has the file
/etc/default/console in it.

---

From: Miquel van Smoorenburg <[email-masked]>
Date: Mon, 1 Jul 1996 01:02:58 +2600 (MET DST)

> /etc/default, with shell scripts that set certain variables.  This is

Yes yes yes. Let's do this, but we'll have to be sure we are compatible
with other systems. I think the shadow package also wants /etc/default,
and so does mgetty. I for one would be very happy with /etc/default/boot
etc. for the init scripts!

Unless ofcourse has a better proposal, which wouldn't surprise me given
the neat ideas that are part of debian already ;)

Mike.
-- 
  Miquel van    | Cistron Internet Services   --    Alphen aan den Rijn.
  Smoorenburg,  | mailto:[email-masked]          http://www.cistron.nl/
[email-masked] | Tel: +31-172-419445 (Voice) 430979 (Fax) 442580 (Data)