What should go into a security-checking shell script?

[Skip Montanaro]

I've been thinking about this topic recently. While I can't rattle off a
list of shoulds and shouldn'ts, you might take a look at Bruce Spence's
paper in the proceedings of latest USENIX workshop on administering large
systems. He described a program (actually a shell script) called 'spy' which
looked at a number of things, such as badly formatted /etc/passwd files,
writable .rhost files, and so forth. I'd give you more details, but I can't
find my copy of the proceedings at the moment. I'm sure others on the net
can elaborate.
--
Skip Montanaro (montanaro at crdgw1.ge.com)