Re: weekly periodic security status

2013-08-27 Thread Jeremie Le Hen
Hi Darren, On Mon, Aug 26, 2013 at 06:11:04PM -0400, Darren Pilgrim wrote: > On 8/26/2013 5:09 PM, Jeremie Le Hen wrote: > > On Mon, Aug 26, 2013 at 12:29:30PM -0400, Darren Pilgrim wrote: > >> The new framework would let me rely on the environment instead of $0, > >> which, IMO, is more reliable.

Re: weekly periodic security status

2013-08-26 Thread Darren Pilgrim
On 8/26/2013 5:09 PM, Jeremie Le Hen wrote: On Mon, Aug 26, 2013 at 12:29:30PM -0400, Darren Pilgrim wrote: The new framework would let me rely on the environment instead of $0, which, IMO, is more reliable. I'd need to be able to tell periodic to run that script with the daily, weekly and mont

Re: weekly periodic security status

2013-08-26 Thread Jeremie Le Hen
Darren On Mon, Aug 26, 2013 at 12:29:30PM -0400, Darren Pilgrim wrote: > >> On 8/25/2013 7:05 AM, Jeremie Le Hen wrote: > >>> And the following variables to control whether you want each check to > >>> run "daily", "weekly" or directly from "crontab" (the default, backward > >>> compatible values

Re: weekly periodic security status

2013-08-26 Thread Darren Pilgrim
On 8/25/2013 1:37 PM, Jeremie Le Hen wrote: Hi Darren, On Sun, Aug 25, 2013 at 12:45:22PM -0400, Darren Pilgrim wrote: On 8/25/2013 7:05 AM, Jeremie Le Hen wrote: And the following variables to control whether you want each check to run "daily", "weekly" or directly from "crontab" (the default

Re: weekly periodic security status

2013-08-26 Thread Jeremie Le Hen
On Mon, Aug 26, 2013 at 05:03:32PM +0100, RW wrote: > On Sun, 25 Aug 2013 22:03:58 +0200 > Jeremie Le Hen wrote: > > > I've implemented it here: > > http://people.freebsd.org/~jlh/security_status_period.diff > > > > Doesn't this mean that if you want to run "periodic security" from > crontab or

Re: weekly periodic security status

2013-08-26 Thread RW
On Sun, 25 Aug 2013 22:03:58 +0200 Jeremie Le Hen wrote: > I've implemented it here: > http://people.freebsd.org/~jlh/security_status_period.diff > Doesn't this mean that if you want to run "periodic security" from crontab or manually etc, you have to override every single entry to "crontab" in

Re: weekly periodic security status

2013-08-25 Thread Julian Elischer
On 8/25/13 7:05 PM, Jeremie Le Hen wrote: And the following variables to control whether you want each check to run "daily", "weekly" or directly from "crontab" (the default, backward compatible values are shown): security_status_chksetuid_enable="daily" security_status_neggrpperm_enab

Re: weekly periodic security status

2013-08-25 Thread James Gosnell
*Throughout the land, hard drives rejoice* On Sun, Aug 25, 2013 at 3:03 PM, Jeremie Le Hen wrote: > On Sun, Aug 25, 2013 at 07:39:25AM -0800, Royce Williams wrote: > > On Sun, Aug 25, 2013 at 3:05 AM, Jeremie Le Hen wrote: > > > > > On Sat, Aug 24, 2013 at 06:57:04PM +0200, Jeremie Le Hen wrot

Re: weekly periodic security status

2013-08-25 Thread Jeremie Le Hen
On Sun, Aug 25, 2013 at 07:39:25AM -0800, Royce Williams wrote: > On Sun, Aug 25, 2013 at 3:05 AM, Jeremie Le Hen wrote: > > > On Sat, Aug 24, 2013 at 06:57:04PM +0200, Jeremie Le Hen wrote: > > > On Fri, Aug 23, 2013 at 08:35:55PM -0800, Royce Williams wrote: > > > > On Fri, Aug 23, 2013 at 10:4

Re: weekly periodic security status

2013-08-25 Thread Jeremie Le Hen
Hi Darren, On Sun, Aug 25, 2013 at 12:45:22PM -0400, Darren Pilgrim wrote: > On 8/25/2013 7:05 AM, Jeremie Le Hen wrote: > > And the following variables to control whether you want each check to > > run "daily", "weekly" or directly from "crontab" (the default, backward > > compatible values are s

Re: weekly periodic security status

2013-08-25 Thread Darren Pilgrim
On 8/25/2013 7:05 AM, Jeremie Le Hen wrote: And the following variables to control whether you want each check to run "daily", "weekly" or directly from "crontab" (the default, backward compatible values are shown): What do we do if we want to run a check both daily and weekly?

Re: weekly periodic security status

2013-08-25 Thread Royce Williams
On Sun, Aug 25, 2013 at 3:05 AM, Jeremie Le Hen wrote: > On Sat, Aug 24, 2013 at 06:57:04PM +0200, Jeremie Le Hen wrote: > > On Fri, Aug 23, 2013 at 08:35:55PM -0800, Royce Williams wrote: > > > On Fri, Aug 23, 2013 at 10:44 AM, Darren Pilgrim < > > > list_free...@bluerosetech.com> wrote: > > > >

Re: weekly periodic security status

2013-08-25 Thread Jeremie Le Hen
On Sat, Aug 24, 2013 at 06:57:04PM +0200, Jeremie Le Hen wrote: > On Fri, Aug 23, 2013 at 08:35:55PM -0800, Royce Williams wrote: > > On Fri, Aug 23, 2013 at 10:44 AM, Darren Pilgrim < > > list_free...@bluerosetech.com> wrote: > > > > > Thank you for this, but if I may make one suggestion: don't c

Re: weekly periodic security status

2013-08-24 Thread Jeremie Le Hen
On Sat, Aug 24, 2013 at 06:03:37PM -0400, Eitan Adler wrote: > On Sat, Aug 24, 2013 at 4:47 PM, Jeremie Le Hen wrote: > > On Sat, Aug 24, 2013 at 10:41:56AM -0400, Eitan Adler wrote: > >> On Thu, Aug 22, 2013 at 4:49 PM, Jeremie Le Hen wrote: > >> > Well, whatever, if you have any concerns, objec

Re: weekly periodic security status

2013-08-24 Thread Eitan Adler
On Sat, Aug 24, 2013 at 4:47 PM, Jeremie Le Hen wrote: > On Sat, Aug 24, 2013 at 10:41:56AM -0400, Eitan Adler wrote: >> On Thu, Aug 22, 2013 at 4:49 PM, Jeremie Le Hen wrote: >> > Well, whatever, if you have any concerns, objections or comments, please >> > speak now :). >> >> This LGTM but plea

Re: weekly periodic security status

2013-08-24 Thread Jeremie Le Hen
On Sat, Aug 24, 2013 at 10:41:56AM -0400, Eitan Adler wrote: > On Thu, Aug 22, 2013 at 4:49 PM, Jeremie Le Hen wrote: > > Well, whatever, if you have any concerns, objections or comments, please > > speak now :). > > This LGTM but please include a comment above the warning with a date / > release

Re: weekly periodic security status

2013-08-24 Thread Jeremie Le Hen
On Sat, Aug 24, 2013 at 02:38:15PM +0100, RW wrote: > On Thu, 22 Aug 2013 22:49:58 +0200 > Jeremie Le Hen wrote: > > > Hi, > > > > I plan to commit the attached patch. This allows the turn the daily > > security checks into weekly checks. You do this by adding the > > following to periodic.conf

Re: weekly periodic security status

2013-08-24 Thread Jeremie Le Hen
On Fri, Aug 23, 2013 at 08:35:55PM -0800, Royce Williams wrote: > On Fri, Aug 23, 2013 at 10:44 AM, Darren Pilgrim < > list_free...@bluerosetech.com> wrote: > > > Thank you for this, but if I may make one suggestion: don't combine all > > the security report settings--keep both daily_* and weekly_

Re: weekly periodic security status

2013-08-24 Thread Eitan Adler
On Thu, Aug 22, 2013 at 4:49 PM, Jeremie Le Hen wrote: > Well, whatever, if you have any concerns, objections or comments, please > speak now :). This LGTM but please include a comment above the warning with a date / release number when this compatibility can be removed. -- Eitan Adler ___

Re: weekly periodic security status

2013-08-24 Thread RW
On Thu, 22 Aug 2013 22:49:58 +0200 Jeremie Le Hen wrote: > Hi, > > I plan to commit the attached patch. This allows the turn the daily > security checks into weekly checks. You do this by adding the > following to periodic.conf(5): > > daily_status_security_enable=NO > weekly_status_se

Re: weekly periodic security status

2013-08-23 Thread Royce Williams
On Fri, Aug 23, 2013 at 10:44 AM, Darren Pilgrim < list_free...@bluerosetech.com> wrote: > Thank you for this, but if I may make one suggestion: don't combine all > the security report settings--keep both daily_* and weekly_*. This makes > possible running some security tasks on a daily basis and

Re: weekly periodic security status

2013-08-23 Thread Darren Pilgrim
Thank you for this, but if I may make one suggestion: don't combine all the security report settings--keep both daily_* and weekly_*. This makes possible running some security tasks on a daily basis and others on a weekly basis. For example, daily pkg/portaudit checks, but weekly filesystem s

weekly periodic security status

2013-08-22 Thread Jeremie Le Hen
Hi, I plan to commit the attached patch. This allows the turn the daily security checks into weekly checks. You do this by adding the following to periodic.conf(5): daily_status_security_enable=NO weekly_status_security_enable=YES All other $daily_status_security_whatever variables wil