
    SECURITY

    Security is quickly becoming one of the administrator's primary
    concerns as networks continue to grow in both numbers and diversity.
    Enlighten helps you integrate security capabilities, thus insuring
    system and network integrity. The Security menu contains the
    following security auditing checks:

    + Vital Files
    + Filesystem Devices
    + Boot and Shutdown Script Checks
    + Crontab Contents
    + Password File Integrity
    + Group File Integrity
    + User Home Directories
    + Attempted Break-ins
    + Obvious Passwords

    Each of these security checks, except for Obvious Passwords, appends
    their findings to a security logfile, as shown in the example on the
    following page. You can use the Clear Log button to flush the
    logfile and the Print button to print the logfile as needed.


    Vital Files

    This program will check the system directories and their files for
    easily breachable write permissions. It checks the following files
    and directories:

    + /etc
    + /usr/adm
    + /usr/bin
    + /usr/etc
    + /usr/lib
    + /usr/local
    + /usr/spool

    and creates a report listing any potential breaches it found.

    File System Devices

    This program will check that the raw device name of each mounted
    filesystem is in order. It looks at:

    + The ownership of the device name (filesystem)
    + The user group ownership of the device name (filesystem)
    + Read and write permissions on the device name (filesystem)

    and creates a report listing any potential problems it found.

    Boot and Shutdown Script Checks

    This program will check the contents of all files in the /etc/rc0.d
    /etc/rc1.d /etc/rc2.d /etc/rc3.d /etc/rcS.d directories and the
    /etc/rc files for potential back doors which could be activated at
    boot or shutdown time. These files are executed at boot time to
    initialize/shutdown the system.

    All the start-up and shutdown files referenced within the boot and
    shutdown scripts are checked for:

    + The existence of the file
    + Write permissions on the file
    + Write permissions on the directory containing the file

    and a report listing any problems found is then created. This
    process may be time consuming when a large number of files is being
    checked.

    Crontab Contents

    This program will check the contents of the crontab files for
    potential back doors via the cron utility. All executable programs
    referenced in the cron tables are checked for:

    + The existence of the file
    + Write permission on the file
    + Write permission on the directory containing the file
    + crontab permissions on the file

    and a report listing any problems found is then created.

    Password File Integrity

    This program will check the password file /etc/passwd for the
    following security breaches:

    + No blank lines in the file
    + Each entry has seven fields separated by colons (`:')
    + The username is alphanumeric
    + The user has a password
    + The Userid is numeric
    + If the Userid is 0, the login name is root
    + The Groupid is numeric and exists in the group file
    + The HOME directory of each entry exists
    + The starting SHELL of each entry exists

    and creates a report listing any problems it found.

    Group File Integrity

    This program will check the group file /etc/group for the following
    security breaches.

    + No blank lines in the file
    + Each entry has four fields separated by colons (`:')
    + The groupname is alphanumeric
    + The GID is numeric
    + The user group does not have a password
    + Check each group member to see if:
    + The username is alphanumeric
    + They do not exist in duplicate within the group
    + They are valid users in the /etc/passwd file

    and creates a report listing any problems it found.

    User Home Directories

    This program will check each user's HOME directory for the following
    potential problems:

    + Checks to see if each user has a home directory
    + Checks to make sure the directory is not world writable
    + Checks start-up scripts for world write permission
    + Checks start-up scripts for group write permission

    and creates a report listing any problems it found.

    Attempted Break-ins

    This program finds all the users who failed a second attempt to
    become superuser or some other user through the su command. It then
    creates a report listing any problems it found.
