Shell Programming and Scripting

I am an AIX noobie, and have a question around an AIX 5.2 script that I need to run. Security Audit requires us to have no World Writable files on our server, but every time we restart the Domino server on AIX it re-flags two files as World Writable.

I have a little script that I created that works to fix this, but I want to make it so that I can use the same exact script on all of our Domino servers. Here is what I have:

Code:

#!/bin/ksh
 
cd $HOME/data/nsd.sl04 <- This needs to be changed to nsd.serverID
chmod 664 nsd*

Domino puts the files in an nsd.xxxx directory where the xxxx is the userID of the server.

Please let me know if there is an easy way of doing this. I was going to try to use $UserID in the second line but could not get it to work.

Thanks!

Moderator's Comments:

How to use code tags

If server ID is the hostname you can use something like serverID=$(uname -n).

I believe all home dirs are the next to last field in /etc/passwd, unless you have network accounts, then 'ypcat passwd', 'niscat passwd' or the like. You might just say "chmod -R o-w /" but that takes a while. Are the domino files always just "$HOME/data/nsd.*/nsd*"?

Yes, they are always in the nsd.* directory and start with nsd. Is there a way in the chmod command to use the wildcards to do anything under an nsd.* directory that starts with nsd*?

Thanks so much for your replies.

Sure, wild cards would be fine. For all users in /home1, /home2/ etc., you could just

Code:

chmod /home*/data/nsd.*/nsd* 2>/dev/null

(The shell expands it all and chmod just has a long argument list.) Of course, if you want to just touch the ones that need to be fixed, and avoid errors if no such file

Code:

ls -ltd /home*/data/nsd.*/nsd* 2>/dev/null | sed -n '
    s/^-.......w.*//p
  ' | xargs -0 chmod o-w

You might want to patrol all and fix all and report, on a cron:

Code:

#!/bin/ksh

date "+%Y-%m-%d %H:%M:%S ($$) WWList scan start."

find / -type f -ls | sed -n '
    s/.* -.......w. .* \//\//p
  ' | tee /tmp/WWlist.$$ | xargs -0 chmod o-w

if [ -s /tmp/WWlist.$$ ]
then
 echo "WWList not empty: "$(wc -l </tmp/WWlist.$$)
 mail -s $(uname -n)-WWList your_email </tmp/WWlist.$$
else
  rm /tmp/WWlist.$$
fi

date "+%Y-%m-%d %H:%M:%S ($$) WWList scan end."

Check the man page for chmod - most implementations support a recursive option.