HardenedBSD/etc/group

# $FreeBSD$
#
wheel:*:0:root
daemon:*:1:
kmem:*:2:
sys:*:3:
tty:*:4:
operator:*:5:root
mail:*:6:
bin:*:7:
news:*:8:
man:*:9:
games:*:13:
ftp:*:14:
staff:*:20:
sshd:*:22:
smmsp:*:25:
mailnull:*:26:
guest:*:31:
bind:*:53:
proxy:*:62:
authpf:*:63:
_pflogd:*:64:
_dhcp:*:65:
uucp:*:66:
dialer:*:68:
network:*:69:
audit:*:77:
www:*:80:
nogroup:*:65533:
nobody:*:65534:
$Id$ -> $FreeBSD$ 1999-08-28 01:37:10 +02:00			`# $FreeBSD$`
Add Id keyword 1998-09-14 01:11:13 +02:00			`#`
Removed bill and lynne from group file, this was a security hole in the 0.1 distribution, as they had accounts in the password file with out passwords, and were in group wheel! 1993-07-19 20:56:42 +02:00			`wheel:*:0:root`
For consistency with other entries in group, don't put the daemon or xten users in their groups explicitly--we pick that up from the gid field in master.passwd. 2002-10-13 18:26:26 +02:00			`daemon:*:1:`
Remove root from the kmem, sys, tty, and staff groups in the default configuration. Root privileges override DAC on local file systems and therefore root does not generally need to be a member of a group to access files owned by that group. In the NFS case, require explicit authorization for root to have these privileges. Leave root in operator for dump/restore broadcast reasons; leave root in wheel until discrepencies in the "no users in wheel means any user can su" policy are resolved (possibly indefinitely). 2002-10-13 19:00:37 +02:00			`kmem:*:2:`
			`sys:*:3:`
			`tty:*:4:`
Initial import of 386BSD 0.1 othersrc/etc 1993-06-20 15:41:45 +02:00			`operator:*:5:root`
Add mail group. 1997-05-02 02:06:09 +02:00			`mail:*:6:`
Initial import of 386BSD 0.1 othersrc/etc 1993-06-20 15:41:45 +02:00			`bin:*:7:`
			`news:*:8:`
As per Rod's wishes, man uses uid/gid 9 now. 1994-03-20 00:31:39 +01:00			`man:*:9:`
Initial import of 386BSD 0.1 othersrc/etc 1993-06-20 15:41:45 +02:00			`games:*:13:`
Create group ftp by default. This is gid 14 as this is the historical id used by sysinstall when enabling anonymous FTP. Change the default group used by sysinstall for setting up anonymous FTP from operator to ftp; there is no reason to use operator and there are potential security issues when doing so. PR: 93284 Approved by: ru (mentor) Reviewed by: simon 2007-06-11 20:36:39 +02:00			`ftp:*:14:`
Remove root from the kmem, sys, tty, and staff groups in the default configuration. Root privileges override DAC on local file systems and therefore root does not generally need to be a member of a group to access files owned by that group. In the NFS case, require explicit authorization for root to have these privileges. Leave root in operator for dump/restore broadcast reasons; leave root in wheel until discrepencies in the "no users in wheel means any user can su" policy are resolved (possibly indefinitely). 2002-10-13 19:00:37 +02:00			`staff:*:20:`
Add an sshd user and group for the OpenSSH privilege separation code. 2002-06-23 22:41:06 +02:00			`sshd:*:22:`
Add two new accounts/groups for sendmail: smmsp - sendmail 8.12 operates as a set-group-ID binary (instead of set-user-ID). This new user/group will be used for command line submissions. UID/GID 25 is suggested in the sendmail documentation and has been adopted by other operating systems such as OpenBSD and Solaris 9. mailnull - The default value for DefaultUser is now set to the uid and gid of the first existing user mailnull, sendmail, or daemon that has a non-zero uid. If none of these exist, sendmail reverts back to the old behavior of using uid 1 and gid 1. Currently FreeBSD uses daemon for DefaultUser but I would prefer not to use an account used by other programs, hence the addition of mailnull. UID/GID 26 has been chosen for this user. This was discussed on -arch on October 18-19, 2001. MFC after: 1 week 2001-11-17 22:24:45 +01:00			`smmsp:*:25:`
			`mailnull:*:26:`
Remove root from the 'guest' group: missed in a previous pass. Spotted by: jhb 2002-10-14 22:55:49 +02:00			`guest:*:31:`
Added group bind(53), added sandbox users tty(4), kmem(5), and bind(53), adjustd inetd.conf to run comsat and ntalk from tty sandbox, and the (commented out) ident from the kmem sandbox. Note that it is necessary to give each group access it's own uid to prevent programs running under a single uid from being able to gdb or otherwise mess with other programs (with different group perms) running under the same uid. 1998-12-01 22:19:49 +01:00			`bind:*:53:`
Add trailing collon Noticed by: dwhite Approved by: bms(mentor) 2004-03-10 16:04:29 +01:00			`proxy:*:62:`
			`authpf:*:63:`
Add "privsep" user/group _pflogd:_pflogd (64:64) to make pflogd(8) work again. This user/group is not required for install* targets, hence do not add them to CHECK_UIDS/CHECK_GIDS in Makefile.inc1 (no need to annoy people). Discussed-on: -current 2004-06-23 03:32:28 +02:00			`_pflogd:*:64:`
Add _dhcp user/group as required by the OpenBSD dhclient. 2005-06-06 22:19:56 +02:00			`_dhcp:*:65:`
Intruduce new group for uucp, gid 66 1994-05-31 06:36:30 +02:00			`uucp:*:66:`
Move "dialer" to gid == 68. 1996-03-12 16:19:31 +01:00			`dialer:*:68:`
ppp => network As discussed on cvs-committers 1997-09-04 02:36:38 +02:00			`network:*:69:`
Assign gid 77 to audit instead of gid 73. The ports group list did not include '73', which was assigned in a ports passwd entry to ircservices. Pointed out by: ceri 2006-02-05 20:34:09 +01:00			`audit:*:77:`
Re-commit www:www If anybody wants to remove them for some reason, please consider "pop" removing first. Approved by: arch discussion from Oct 20 MFC after: 3 days 2001-10-25 05:27:16 +02:00			`www:*:80:`
nogroup 32766 -> 65533 to go with nobody's change to 65534. 1995-05-17 12:02:07 +02:00			`nogroup:*:65533:`
change nobody master.passwd entry to 65534:65534 change nobody group entry to 65534 Suggested-by: pst 1995-05-15 21:24:57 +02:00			`nobody:*:65534:`