lynis/include/tests_webservers

654 lines
33 KiB
Plaintext
Raw Permalink Normal View History

2014-08-26 17:33:55 +02:00
#!/bin/sh
#################################################################################
#
# Lynis
# ------------------
#
2016-03-13 16:00:39 +01:00
# Copyright 2007-2013, Michael Boelen
2021-01-07 15:22:19 +01:00
# Copyright 2007-2021, CISOfy
2016-03-13 16:00:39 +01:00
#
# Website : https://cisofy.com
# Blog : http://linux-audit.com
# GitHub : https://github.com/CISOfy/lynis
2014-08-26 17:33:55 +02:00
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Software: webserver
#
#################################################################################
#
InsertSection "${SECTION_WEBSERVER}"
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
# Reset Apache status
APACHE_INSTALLED=0
2016-08-16 08:08:15 +02:00
APACHE_MODULES_ENABLED_LOCS="${ROOTDIR}etc/apache2/mods-enabled"
APACHE_MODULES_LOCS="${ROOTDIR}etc/httpd/modules ${ROOTDIR}opt/local/apache2/modules ${ROOTDIR}usr/lib/apache ${ROOTDIR}usr/lib/apache2 ${ROOTDIR}usr/lib/httpd/modules ${ROOTDIR}usr/libexec/apache2 ${ROOTDIR}usr/lib64/apache2 ${ROOTDIR}usr/lib64/apache2/modules ${ROOTDIR}usr/lib64/httpd/modules ${ROOTDIR}usr/local/libexec/apache ${ROOTDIR}usr/local/libexec/apache22 ${ROOTDIR}usr/local/libexec/apache24"
2014-08-26 17:33:55 +02:00
NGINX_RUNNING=0
NGINX_CONF_LOCS="${ROOTDIR}etc/nginx ${ROOTDIR}usr/local/etc/nginx ${ROOTDIR}usr/local/nginx/conf"
2014-08-26 17:33:55 +02:00
NGINX_CONF_LOCATION=""
2016-08-16 08:08:15 +02:00
NGINX_CONF_FILES=""
2016-08-16 08:36:42 +02:00
NGINX_CONF_FILES_ADDITIONS=""
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
2017-08-02 13:01:23 +02:00
sTEST_APACHE_TARGETS="${ROOTDIR}etc/apache ${ROOTDIR}etc/apache2 ${ROOTDIR}etc/httpd \
${ROOTDIR}opt/apache \
${ROOTDIR}usr/local/apache ${ROOTDIR}usr/local/apache2 \
2017-04-23 20:06:54 +02:00
${ROOTDIR}usr/local/etc/apache ${ROOTDIR}usr/local/etc/apache2 ${ROOTDIR}usr/local/etc/apache22 \
${ROOTDIR}usr/pkg/etc/httpd ${ROOTDIR}etc/sysconfig/apache2 ${ROOTDIR}usr/local/etc/apache24"
2014-08-26 17:33:55 +02:00
CreateTempFile || ExitFatal
TMPFILE="${TEMP_FILE}"
CreateTempFile || ExitFatal
TMPFILE2="${TEMP_FILE}"
2021-05-14 13:56:48 +02:00
CreateTempFile || ExitFatal
TMPFILE3="${TEMP_FILE}"
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
# Test : HTTP-6622
# Description : Test for Apache installation
# Notes : Do not run on NetBSD, -v is unknown option for httpd binary
# On OpenBSD do not run /usr/sbin/httpd with -v: builtin non-Apache
2014-08-26 17:33:55 +02:00
if [ ! "${OS}" = "NetBSD" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no HTTP-6622 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking Apache presence"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
if [ "${OS}" = "OpenBSD" -a "${HTTPDBINARY}" = "/usr/sbin/httpd" ]; then HTTPDBINARY=""; fi
2017-05-03 10:42:34 +02:00
if IsEmpty "${HTTPDBINARY}"; then
Display --indent 2 --text "- Checking Apache" --result "${STATUS_NOT_FOUND}" --color WHITE
2017-04-23 20:06:54 +02:00
else
LogText "Test: Scanning for Apache binary"
2023-04-23 23:38:21 +02:00
IS_APACHE=$(${HTTPDBINARY} -v 2> /dev/null | ${GREPBINARY} -E '[aA]pache')
2017-05-03 10:42:34 +02:00
if IsEmpty "${IS_APACHE}"; then
LogText "Result: ${HTTPDBINARY} is not Apache"
2014-08-26 17:33:55 +02:00
Display --indent 2 --text "- Checking Apache (binary ${HTTPDBINARY})" --result "NO MATCH" --color WHITE
2017-04-23 20:06:54 +02:00
else
Display --indent 2 --text "- Checking Apache (binary ${HTTPDBINARY})" --result "${STATUS_FOUND}" --color GREEN
LogText "Result: ${HTTPDBINARY} seems to be Apache HTTP daemon"
2014-08-26 17:33:55 +02:00
APACHE_INSTALLED=1
APACHE_VERSION=$(${HTTPDBINARY} -v 2> /dev/null | ${GREPBINARY} "^Server version:" | ${AWKBINARY} '{ print $3 }' | ${AWKBINARY} -F/ '{ print $2 }')
LogText "Apache version: ${APACHE_VERSION}"
Report "apache_version=${APACHE_VERSION}"
2014-08-26 17:33:55 +02:00
fi
fi
fi
#
#################################################################################
#
# Test : HTTP-6624
# Description : Testing main Apache configuration file
# Notes : Do not run on OpenBSD/NetBSD, as -V is an unknown option for httpd binary
2014-08-26 17:33:55 +02:00
if [ ${APACHE_INSTALLED} -eq 1 ]; then
if [ ! "${OS}" = "NetBSD" -a ! "${OS}" = "OpenBSD" ]; then
2014-08-26 17:33:55 +02:00
PREQS_MET="YES"
2017-04-23 20:06:54 +02:00
else
2014-08-26 17:33:55 +02:00
PREQS_MET="NO"
fi
else
2014-08-26 17:33:55 +02:00
PREQS_MET="NO"
fi
Register --test-no HTTP-6624 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Testing main Apache configuration file"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
APACHE_CONFIGFILE=""
APACHE_TEST=$(${HTTPDBINARY} -V 2> /dev/null | ${GREPBINARY} "\-D SERVER_CONFIG_FILE=" | ${SEDBINARY} 's/[ ]-D SERVER_CONFIG_FILE=//' | ${TRBINARY} -d '"' | ${TRBINARY} -d ' ' | ${TRBINARY} -d '[:cntrl:]')
2014-08-26 17:33:55 +02:00
2017-05-03 10:42:34 +02:00
if IsEmpty "${APACHE_TEST}"; then
LogText "Result: Can't find the configuration file, so skipping some Apache related tests"
2017-04-23 20:06:54 +02:00
else
2014-08-26 17:33:55 +02:00
# We found a possible match. Checking if it's valid filename. If not, we need to add a prefix
if [ -f ${APACHE_TEST} ]; then
APACHE_CONFIGFILE="${APACHE_TEST}"
Display --indent 6 --text "Info: Configuration file found (${APACHE_CONFIGFILE})"
2017-04-23 20:06:54 +02:00
else
2014-08-26 17:33:55 +02:00
# Probably the prefix is missing, so we are going to search that
APACHE_HTTPDROOT=$(${HTTPDBINARY} -V 2> /dev/null | ${GREPBINARY} "\-D HTTPD_ROOT=" | ${SEDBINARY} 's/[ ]-D HTTPD_ROOT=//' | ${TRBINARY} -d '"' | ${TRBINARY} -d ' ')
2014-08-26 17:33:55 +02:00
APACHE_TESTFILE="${APACHE_HTTPDROOT}/${APACHE_TEST}"
if [ -f ${APACHE_TESTFILE} ]; then
APACHE_CONFIGFILE="${APACHE_TESTFILE}"
Display --indent 6 --text "Info: Configuration file found (${APACHE_CONFIGFILE})"
LogText "Result: Configuration file found (${APACHE_CONFIGFILE})"
2017-04-23 20:06:54 +02:00
else
2019-03-19 13:07:12 +01:00
LogText "Result: File or directory ${APACHE_TESTFILE} does not exist"
2014-08-26 17:33:55 +02:00
Display --indent 6 --text "[Notice] possible directory/file parts found, but still unsure what the real configuration file is. Skipping some Apache related tests"
ReportException "${TEST_NO}:1" "Found some unknown directory or file references in Apache configuration"
2019-03-19 13:07:12 +01:00
LogText "Note: if only the Apache binary package has been installed, then the configuration might be missing. Is the Apache package really needed?"
2014-08-26 17:33:55 +02:00
fi
fi
fi
fi
#
#################################################################################
#
# Test : HTTP-6626
# Description : Testing other Apache configuration files
if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no HTTP-6626 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Testing other Apache configuration file"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
2017-05-03 10:42:34 +02:00
for DIR in ${sTEST_APACHE_TARGETS}; do
if [ -d ${DIR} ]; then
find ${DIR} -name "*.conf" -print >> ${TMPFILE2}
2014-08-26 17:33:55 +02:00
fi
done
# Sort unsorted list, save it in temp file and then remove unsorted list
if [ -f ${TMPFILE2} ]; then
2016-08-25 15:31:33 +02:00
${SORTBINARY} -u ${TMPFILE2} >> ${TMPFILE}
2014-08-26 17:33:55 +02:00
rm -f ${TMPFILE2}
fi
cVHOSTS=0; tVHOSTS=""
# Check every configuration file
for I in $(cat ${TMPFILE}); do
LogText "Apache config file: ${I}"
2014-08-26 17:33:55 +02:00
FileIsReadable ${I}
if [ ${CANREAD} -eq 1 ]; then
# Search Virtual Hosts
for J in $(${GREPBINARY} "ServerName" ${I} | ${GREPBINARY} -v "^#" | ${AWKBINARY} '{ if ($1=="ServerName" && $2!="*" && $2!="default") print $2 }'); do
2017-05-03 10:42:34 +02:00
if HasData "${J}"; then
tVHOSTS="${tVHOSTS} ${J}"
cVHOSTS=$((cVHOSTS + 1))
fi
done
# Search Server aliases
2016-09-10 16:16:58 +02:00
for J in $(${GREPBINARY} "ServerAlias" ${I} | ${GREPBINARY} -v "^#" | ${SEDBINARY} "s/\s*ServerAlias //g" | ${SEDBINARY} "s/#.*//g"); do
2019-09-19 14:05:15 +02:00
if [ -n "${J}" ]; then
tVHOSTS="${tVHOSTS} ${J}"
cVHOSTS=$((cVHOSTS + 1))
fi
done
2017-04-23 20:06:54 +02:00
else
LogText "Result: can not read configuration file with this user ID"
ReportException "${TEST_NO}:1" "Can not read configuration file $I"
fi
2014-08-26 17:33:55 +02:00
done
# Log all virtual hosts we found
for J in ${tVHOSTS}; do
2019-09-19 14:05:15 +02:00
if [ -n "${J}" ]; then
LogText "Virtual host: ${J}"
#Report "apache_vhost_name[]=${J}"
2014-08-26 17:33:55 +02:00
fi
done
# Show number of vhosts if we found any
LogText "Result: found ${cVHOSTS} virtual hosts"
2014-08-26 17:33:55 +02:00
if [ ${cVHOSTS} -gt 0 ]; then
Display --indent 6 --text "Info: Found ${cVHOSTS} virtual hosts"
2017-04-23 20:06:54 +02:00
else
2014-08-26 17:33:55 +02:00
Display --indent 6 --text "Info: No virtual hosts found"
fi
fi
# Remove temp files
2019-07-16 13:20:30 +02:00
if [ -f ${TMPFILE} -a -n "${TMPFILE}" ]; then
2014-08-26 17:33:55 +02:00
rm -f ${TMPFILE}
fi
2019-07-16 13:20:30 +02:00
if [ -n "${TMPFILE2}" ]; then if [ -f ${TMPFILE2} ]; then rm -f ${TMPFILE2}; fi; fi
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
# TODO
# Do you have Apache running and want to contribute? Help us testing this control and send in a pull request
2014-08-26 17:33:55 +02:00
# Test : HTTP-6630
# Description : Search for all loaded modules
#if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
#Register --test-no HTTP-6630 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determining all loaded Apache modules"
2014-08-26 17:33:55 +02:00
#if [ ${SKIPTEST} -eq 0 ]; then
2017-05-03 10:42:34 +02:00
# # Testing Debian style
# LogText "Test: searching loaded/enabled Apache modules"
2023-04-23 23:38:21 +02:00
# apachectl -t -D DUMP_MODULES 2>&1 | ${GREPBINARY} -E -v "(Loaded Modules|Syntax OK)" | ${SEDBINARY} 's/(\(shared\|static\))//' | ${SEDBINARY} 's/ //'
2017-05-03 10:42:34 +02:00
# for I in ${APACHE_MODULES_ENABLED_LOCS}; do
# LogText "Test: checking ${I}"
# if [ -d ${I} ]; then
# FIND=$(${GREPBINARY} -r LoadModule ${I}/* | ${GREPBINARY} -v "^#" | ${AWKBINARY} '{ print $2":"$3 }')
# else
# LogText "Result: ${I} does not exist"
# fi
# done
2014-08-26 17:33:55 +02:00
#fi
#
#################################################################################
#
# Test : HTTP-6632
# Description : Search for available Apache modules
if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no HTTP-6632 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determining all available Apache modules"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: searching available Apache modules"
COUNT=0
for DIR in ${APACHE_MODULES_LOCS}; do
DirectoryExists ${DIR}
2014-08-26 17:33:55 +02:00
if [ ${DIRECTORY_FOUND} -eq 1 ]; then
FIND=$(${FINDBINARY} ${DIR} -name "mod_*" -print | ${SORTBINARY})
for ITEM in ${FIND}; do
Report "apache_module[]=${ITEM}"
LogText "Result: found Apache module ${ITEM}"
COUNT=$((COUNT + 1))
2014-08-26 17:33:55 +02:00
done
fi
done
if [ ${COUNT} -eq 0 ]; then
Display --indent 4 --text "* Loadable modules" --result "${STATUS_NONE}" --color WHITE
2014-08-26 17:33:55 +02:00
ReportException "${TEST_NO}:1" "No loadable Apache modules found"
2017-04-23 20:06:54 +02:00
else
Display --indent 4 --text "* Loadable modules" --result "${STATUS_FOUND} (${COUNT})" --color GREEN
Display --indent 8 --text "- Found ${COUNT} loadable modules"
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : HTTP-6640
# Description : Search for special Apache modules: evasive
if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no HTTP-6640 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determining existence of specific Apache modules"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
# Check modules, module
if CheckItem "apache_module" "/mod_evasive([0-9][0-9])?.so"; then
Display --indent 10 --text "mod_evasive: anti-DoS/brute force" --result "${STATUS_FOUND}" --color GREEN
2014-08-26 17:33:55 +02:00
AddHP 3 3
2017-04-23 20:06:54 +02:00
else
Display --indent 10 --text "mod_evasive: anti-DoS/brute force" --result "${STATUS_NOT_FOUND}" --color WHITE
2014-08-26 17:33:55 +02:00
AddHP 2 3
2019-12-18 12:17:46 +01:00
ReportSuggestion "${TEST_NO}" "Install Apache mod_evasive to guard webserver against DoS/brute force attempts"
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : HTTP-6641
# Description : Search for special Apache modules: Quality of Service
# Notes : Was mod_qos before. Since Apache 2.2.15 mod_reqtimeout
2014-08-26 17:33:55 +02:00
if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no HTTP-6641 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determining existence of specific Apache modules"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
# Check modules, module
if CheckItem "apache_module" "/mod_(reqtimeout|qos).so"; then
Display --indent 10 --text "mod_reqtimeout/mod_qos" --result "${STATUS_FOUND}" --color GREEN
2014-08-26 17:33:55 +02:00
AddHP 3 3
else
Display --indent 10 --text "mod_reqtimeout/mod_qos" --result "${STATUS_NOT_FOUND}" --color WHITE
2014-08-26 17:33:55 +02:00
AddHP 2 3
2019-12-18 12:17:46 +01:00
ReportSuggestion "${TEST_NO}" "Install Apache mod_reqtimeout or mod_qos to guard webserver against Slowloris attacks"
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : HTTP-6643
# Description : Search for special Apache modules: security
if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no HTTP-6643 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determining existence of specific Apache modules"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
# Check modules, module
if CheckItem "apache_module" "/mod_security(2|3).so" ; then
Display --indent 10 --text "ModSecurity: web application firewall" --result "${STATUS_FOUND}" --color GREEN
2014-08-26 17:33:55 +02:00
AddHP 3 3
2017-04-23 20:06:54 +02:00
else
Display --indent 10 --text "ModSecurity: web application firewall" --result "${STATUS_NOT_FOUND}" --color WHITE
2014-08-26 17:33:55 +02:00
AddHP 2 3
2019-12-18 12:17:46 +01:00
ReportSuggestion "${TEST_NO}" "Install Apache modsecurity to guard webserver against web application attacks"
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
2021-05-14 13:56:48 +02:00
# Test : HTTP-6660
2014-08-26 17:33:55 +02:00
# Description : Search for "TraceEnable off" in configuration files
2021-05-14 13:56:48 +02:00
if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no HTTP-6660 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking Apache security setting: TraceEnable"
if [ ${SKIPTEST} -eq 0 ]; then
for DIR in ${sTEST_APACHE_TARGETS}; do
if [ -d ${DIR} ]; then
find ${DIR} -name "*.conf" -print >> ${TMPFILE3}
fi
done
# Check all Apache conf-files for TraceEnable
if [ -f ${TMPFILE3} ]; then
Display --indent 2 --text '- Checking TraceEnable setting in:'
for APACHE_CONFFILE in $(cat ${TMPFILE3}); do
TRACEENABLE=$( ${GREPBINARY} -i -E '^TraceEnable' ${APACHE_CONFFILE} | ${AWKBINARY} '{print $2}' )
if [ ! ${TRACEENABLE} ]; then
LogText "Result: no TraceEnable setting found in ${APACHE_CONFFILE}"
Display --indent 4 --text " ${APACHE_CONFFILE}" --result "${STATUS_NOT_FOUND}" --color WHITE
else
TRACEENABLED_SETTING=$( echo ${TRACEENABLE} | tr 'A-Z' 'a-z' )
2024-08-30 19:38:13 +02:00
if [ "x${TRACEENABLED_SETTING}" = 'xoff' ]; then
2021-05-14 13:56:48 +02:00
LogText "Result: found TraceEnable setting set to 'off' in ${APACHE_CONFFILE}"
Report "Apache setting: 'TraceEnable Off' in ${APACHE_CONFFILE}"
Display --indent 4 --text " ${APACHE_CONFFILE}" --result "${STATUS_FOUND}" --color GREEN
else
LogText "Result: found TraceEnable setting set to '"${TRACEENABLE}"' in ${APACHE_CONFFILE}"
Report "Apache setting: 'TraceEnable "${TRACEENABLE}"' in ${APACHE_CONFFILE}"
Display --indent 4 --text " ${APACHE_CONFFILE}" --result "${STATUS_SUGGESTION}" --color YELLOW
ReportSuggestion "${TEST_NO}" "Consider setting 'TraceEnable Off' in ${APACHE_CONFFILE}" "Set TraceEnable to 'On' or 'extended' for testing and diagnostic purposes only."
fi
fi
done
rm -f ${TMPFILE3}
fi
fi
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
# Test : HTTP-6702
# Description : Search for nginx process
Register --test-no HTTP-6702 --weight L --network NO --category security --description "Check nginx process"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: searching running nginx process"
2017-09-16 14:08:38 +02:00
if IsRunning "nginx"; then
LogText "Result: found running nginx process(es)"
Display --indent 2 --text "- Checking nginx" --result "${STATUS_FOUND}" --color GREEN
2014-08-26 17:33:55 +02:00
NGINX_RUNNING=1
2016-08-16 08:08:15 +02:00
Report "nginx_running=1"
2017-04-23 20:06:54 +02:00
else
LogText "Result: no running nginx process found"
Display --indent 2 --text "- Checking nginx" --result "${STATUS_NOT_FOUND}" --color WHITE
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : HTTP-6704
# Description : Search for nginx configuration file
if [ ${NGINX_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no HTTP-6704 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check nginx configuration file"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: searching nginx configuration file"
for DIR in ${NGINX_CONF_LOCS}; do
if [ -f ${DIR}/nginx.conf ]; then
NGINX_CONF_LOCATION="${DIR}/nginx.conf"
LogText "Found file ${NGINX_CONF_LOCATION}"
NGINX_CONF_FILES="${DIR}/nginx.conf"
2014-08-26 17:33:55 +02:00
fi
done
if HasData "${NGINX_CONF_LOCATION}"; then
LogText "Result: found nginx configuration file"
Report "nginx_main_conf_file=${NGINX_CONF_LOCATION}"
Display --indent 4 --text "- Searching nginx configuration file" --result "${STATUS_FOUND}" --color GREEN
2017-04-23 20:06:54 +02:00
else
LogText "Result: no nginx configuration file found"
Display --indent 2 --text "- Searching nginx configuration file" --result "${STATUS_NOT_FOUND}" --color WHITE
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : HTTP-6706
# Description : Search for includes within nginx configuration file
# Notes : Daemon nginx should be running, nginx.conf should be found
2019-07-16 13:20:30 +02:00
if [ ${NGINX_RUNNING} -eq 1 -a -n "${NGINX_CONF_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no HTTP-6706 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for additional nginx configuration files"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
CreateTempFile || ExitFatal
TMPFILE="${TEMP_FILE}"
COUNT=0
${SEDBINARY} -e 's/^[ \t]*//' ${NGINX_CONF_LOCATION} | ${GREPBINARY} -v "^#" | ${GREPBINARY} -v "^$" | ${SEDBINARY} 's/[\t]/ /g' | ${SEDBINARY} 's/ / /g' | ${SEDBINARY} 's/ / /g' >> ${TMPFILE}
2014-08-26 17:33:55 +02:00
# Search for included configuration files (may include directories and wild cards)
FIND=$(${GREPBINARY} "include" ${NGINX_CONF_LOCATION} | ${AWKBINARY} '{ if ($1=="include") { print $2 }}' | ${SEDBINARY} 's/;$//g')
2014-08-26 17:33:55 +02:00
for I in ${FIND}; do
FIND2=$(${LSBINARY} ${I} 2>/dev/null)
2014-08-26 17:33:55 +02:00
for J in ${FIND2}; do
2016-08-16 08:08:15 +02:00
# Ensure that we are parsing normal files
if [ -f ${J} ]; then
COUNT=$((COUNT + 1))
2016-08-16 08:08:15 +02:00
LogText "Result: found Nginx configuration file ${J}"
Report "nginx_sub_conf_file[]=${J}"
2017-04-23 20:06:54 +02:00
FileIsReadable ${J}
if [ ${CANREAD} -eq 1 ]; then
NGINX_CONF_FILES="${NGINX_CONF_FILES} ${J}"
FIND3=$(sed -e 's/^[ \t]*//' ${J} | ${GREPBINARY} -v "^#" | ${GREPBINARY} -v "^$" | ${SEDBINARY} 's/[\t]/ /g' | ${SEDBINARY} 's/ / /g' | ${SEDBINARY} 's/ / /g' >> ${TMPFILE})
2017-04-23 20:06:54 +02:00
else
ReportException "${TEST_NO}:1" "Can not parse file ${J}, as it is not readable"
fi
2016-08-16 08:08:15 +02:00
fi
2014-08-26 17:33:55 +02:00
done
done
# Sort all discovered configuration lines and store unique ones. Also strip out the mime types configured in nginx
2023-04-23 23:38:21 +02:00
SORTFILE=$(${SORTBINARY} -u ${TMPFILE} | ${SEDBINARY} 's/ /:space:/g' | ${GREPBINARY} -E -v "(application|audio|image|text|video)/" | ${GREPBINARY} -E -v "({|})")
2015-09-07 10:13:20 +02:00
for I in ${SORTFILE}; do
I=$(echo ${I} | ${SEDBINARY} 's/:space:/ /g')
2016-08-16 08:08:15 +02:00
Report "nginx_config_option[]=${I}";
2015-09-07 10:13:20 +02:00
done
2014-08-26 17:33:55 +02:00
# Remove unsorted file for next tests
2015-09-07 10:13:20 +02:00
if [ -f ${TMPFILE} ]; then rm -f ${TMPFILE}; fi
2014-08-26 17:33:55 +02:00
if [ ${COUNT} -eq 0 ]; then
LogText "Result: no nginx include statements found"
2017-04-23 20:06:54 +02:00
else
Display --indent 6 --text "- Found nginx includes" --result "${COUNT} FOUND" --color GREEN
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : HTTP-6708
# Description : Check discovered nginx configuration settings for further hardening
2014-08-26 17:33:55 +02:00
# Notes : Daemon of nginx should be running, nginx.conf should be found
2019-07-16 13:20:30 +02:00
if [ ${NGINX_RUNNING} -eq 1 -a -n "${NGINX_CONF_FILES}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no HTTP-6708 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check discovered nginx configuration settings"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: start parsing all discovered nginx options"
2014-09-15 12:01:09 +02:00
Display --indent 4 --text "- Parsing configuration options"
for FILE in ${NGINX_CONF_FILES}; do
FILENAME=$(echo ${FILE} | ${AWKBINARY} -F/ '{print $NF}')
2016-08-16 08:36:42 +02:00
if [ ! "${FILENAME}" = "mime.types" ]; then
if FileIsReadable ${FILE}; then
Display --indent 8 --text "- ${FILE}"
ParseNginx ${FILE}
2016-08-16 08:36:42 +02:00
else
Display --indent 8 --text "- ${FILE}" --result "SKIPPED (NOT READABLE)" --color YELLOW
2016-08-16 08:36:42 +02:00
fi
2016-08-16 08:08:15 +02:00
else
2016-08-16 08:36:42 +02:00
LogText "Result: this configuration file is skipped, as it contains usually no interesting details"
2016-08-16 08:08:15 +02:00
fi
done
2019-07-16 13:20:30 +02:00
if [ -n "${NGINX_CONF_FILES_ADDITIONS}" ]; then
2016-08-16 08:36:42 +02:00
for I in ${NGINX_CONF_FILES_ADDITIONS}; do
2016-08-25 15:31:33 +02:00
FILENAME=$(echo ${I} | ${AWKBINARY} -F/ '{print $NF}')
2016-08-16 08:36:42 +02:00
if [ ! "${FILENAME}" = "mime.types" ]; then
if FileIsReadable ${I}; then
Display --indent 8 --text "- ${I}"
ParseNginx ${I}
else
Display --indent 8 --text "- ${I}" --result "SKIPPED (NOT READABLE)" --color YELLOW
fi
else
LogText "Result: this configuration file is skipped, as it contains usually no interesting details"
fi
done
fi
2014-08-26 17:33:55 +02:00
fi
#
#################################################################################
#
# Test : HTTP-6710
# Description : Check SSL configuration of nginx
# Notes : Daemon of nginx should be running, nginx.conf should be found
2019-07-16 13:20:30 +02:00
if [ ${NGINX_RUNNING} -eq 1 -a -n "${NGINX_CONF_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no HTTP-6710 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check nginx SSL configuration settings"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
NGINX_SSL_SUGGESTION=0
if [ ${NGINX_SSL_ON} -eq 1 ]; then
LogText "Result: SSL is configured in nginx on one or more virtual hosts"
Display --indent 6 --text "- SSL configured" --result "${STATUS_YES}" --color GREEN
2014-08-26 17:33:55 +02:00
AddHP 5 5
# Cipher tests
if [ ${NGINX_SSL_CIPHERS} -eq 1 ]; then
Display --indent 8 --text "- Ciphers configured" --result "${STATUS_YES}" --color GREEN
2017-04-23 20:06:54 +02:00
else
Display --indent 8 --text "- Ciphers configured" --result "${STATUS_NO}" --color RED
2014-08-26 17:33:55 +02:00
NGINX_SSL_SUGGESTION=1
fi
if [ ${NGINX_SSL_PREFER_SERVER_CIPHERS} -eq 1 ]; then
Display --indent 8 --text "- Prefer server ciphers" --result "${STATUS_YES}" --color GREEN
2017-04-23 20:06:54 +02:00
else
Display --indent 8 --text "- Prefer server ciphers" --result "${STATUS_NO}" --color RED
2014-08-26 17:33:55 +02:00
NGINX_SSL_SUGGESTION=1
fi
if [ ${NGINX_SSL_PROTOCOLS} -eq 1 ]; then
Display --indent 8 --text "- Protocols configured" --result "${STATUS_YES}" --color GREEN
if [ ${NGINX_WEAK_SSL_PROTOCOL_FOUND} -eq 0 ]; then
Display --indent 10 --text "- Insecure protocols found" --result "${STATUS_NO}" --color GREEN
2017-04-23 20:06:54 +02:00
else
Display --indent 10 --text "- Insecure protocols found" --result "${STATUS_YES}" --color RED
ReportSuggestion "${TEST_NO}" "Disable weak protocol in nginx configuration"
fi
2017-04-23 20:06:54 +02:00
else
Display --indent 8 --text "- Protocols configured" --result "${STATUS_NO}" --color RED
2014-08-26 17:33:55 +02:00
NGINX_SSL_SUGGESTION=1
fi
2017-04-23 20:06:54 +02:00
else
LogText "Result: No SSL configuration found"
Display --indent 6 --text "- SSL configured" --result "${STATUS_NO}" --color RED
2019-12-18 12:17:46 +01:00
ReportSuggestion "${TEST_NO}" "Add HTTPS to nginx virtual hosts for enhanced protection of sensitive data and privacy"
2014-08-26 17:33:55 +02:00
AddHP 1 5
fi
if [ ${NGINX_SSL_SUGGESTION} -eq 1 ]; then
LogText "Result: one or more parts of the nginx configuration could be enhanced regarding SSL"
2016-08-16 08:08:15 +02:00
ReportSuggestion "${TEST_NO}" "Change the HTTPS and SSL settings for enhanced protection of sensitive data and privacy"
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : HTTP-6712
# Description : Check logging configuration of nginx
# Notes : Daemon of nginx should be running, nginx.conf should be found
2019-07-16 13:20:30 +02:00
if [ ${NGINX_RUNNING} -eq 1 -a -n "${NGINX_CONF_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no HTTP-6712 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check nginx access logging"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
NGINX_LOG_SUGGESTION=0
2014-09-15 12:01:09 +02:00
Display --indent 6 --text "- Checking log file configuration"
2014-08-26 17:33:55 +02:00
# Check for missing access log
if [ ${NGINX_ACCESS_LOG_MISSING} -eq 1 ]; then
NGINX_LOG_SUGGESTION=1
Display --indent 8 --text "- Missing log files (access_log)" --result "${STATUS_YES}" --color RED
2017-04-23 20:06:54 +02:00
else
Display --indent 8 --text "- Missing log files (access_log)" --result "${STATUS_NO}" --color GREEN
2014-08-26 17:33:55 +02:00
fi
# Access log disabled
if [ ${NGINX_ACCESS_LOG_DISABLED} -eq 1 ]; then
NGINX_LOG_SUGGESTION=1
LogText "Result: found one or more virtual hosts which have their access log disabled"
Display --indent 8 --text "- Disabled access logging" --result "${STATUS_YES}" --color RED
2014-08-26 17:33:55 +02:00
AddHP 2 3
2017-04-23 20:06:54 +02:00
else
LogText "Result: no virtual hosts found which have their access log disabled"
Display --indent 8 --text "- Disabled access logging" --result "${STATUS_NO}" --color GREEN
2014-08-26 17:33:55 +02:00
AddHP 3 3
fi
# Report suggestion
if [ ${NGINX_LOG_SUGGESTION} -eq 1 ]; then
2019-12-18 12:17:46 +01:00
ReportSuggestion "${TEST_NO}" "Check your nginx access log for proper functioning"
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : HTTP-6714
# Description : Check missing error logs in nginx
2019-07-16 13:20:30 +02:00
if [ ${NGINX_RUNNING} -eq 1 -a -n "${NGINX_CONF_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no HTTP-6714 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for missing error logs in nginx"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
NGINX_LOG_SUGGESTION=0
# Check for missing access log
if [ ${NGINX_ERROR_LOG_MISSING} -eq 1 ]; then
NGINX_LOG_SUGGESTION=1
Display --indent 8 --text "- Missing log files (error_log)" --result "${STATUS_YES}" --color RED
2017-04-23 20:06:54 +02:00
else
Display --indent 8 --text "- Missing log files (error_log)" --result "${STATUS_NO}" --color GREEN
2014-08-26 17:33:55 +02:00
fi
# Report suggestion
if [ ${NGINX_LOG_SUGGESTION} -eq 1 ]; then
2019-12-18 12:17:46 +01:00
ReportSuggestion "${TEST_NO}" "Check your nginx error_log statements"
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : HTTP-6716
# Description : Check debug mode on error log in nginx
2019-07-16 13:20:30 +02:00
if [ ${NGINX_RUNNING} -eq 1 -a -n "${NGINX_CONF_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no HTTP-6716 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for debug mode on error log in nginx"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
NGINX_LOG_SUGGESTION=0
# Access log in debug mode
if [ ${NGINX_ERROR_LOG_DEBUG} -eq 1 ]; then
NGINX_LOG_SUGGESTION=1
LogText "Result: found one or more virtual hosts which have their error log in debug mode"
Display --indent 8 --text "- Debugging mode on error_log" --result "${STATUS_YES}" --color RED
2014-08-26 17:33:55 +02:00
AddHP 2 3
2017-04-23 20:06:54 +02:00
else
LogText "Result: no virtual hosts found which have their error log in debug mode"
Display --indent 8 --text "- Debugging mode on error_log" --result "${STATUS_NO}" --color GREEN
2014-08-26 17:33:55 +02:00
AddHP 3 3
fi
# Report suggestion
if [ ${NGINX_LOG_SUGGESTION} -eq 1 ]; then
2019-12-18 12:17:46 +01:00
ReportSuggestion "${TEST_NO}" "Check your nginx error_log statements and disable debug mode"
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : HTTP-6720
2017-05-08 14:56:39 +02:00
# Description : Search for nginx log files
2014-08-26 17:33:55 +02:00
if [ ${NGINX_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no HTTP-6720 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check Nginx log files"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Checking directories for files with log file definitions"
for DIR in ${NGINX_CONF_LOCS}; do
LogText "Test: Checking ${DIR}"
if [ -d ${DIR} ]; then
LogText "Result: Directory ${DIR} exists, so will be used as search path"
FIND=$(find ${DIR} -type f -exec ${GREPBINARY} access_log \{\} \; | ${GREPBINARY} -v "#" | ${AWKBINARY} '{ if($1=="access_log") { print $2 } }' | ${SEDBINARY} 's/;$//g' | ${SORTBINARY} -u)
2017-05-03 10:42:34 +02:00
if IsEmpty "${FIND}"; then
LogText "Result: no log files found"
else
LogText "Result: found one or more log files"
for FILE in ${FIND}; do
if [ -f ${FILE} ]; then
LogText "Found log file: ${FILE}"
Report "log_file=${FILE}"
else
LogText "Found non existing log file: ${FILE}"
fi
2014-08-26 17:33:55 +02:00
done
fi
else
LogText "Result: directory ${DIR} not found, skipping search in this directory."
fi
2014-08-26 17:33:55 +02:00
done
unset DIR FILE FIND
2014-08-26 17:33:55 +02:00
fi
#
#################################################################################
#
# Remove temp file (double check)
2019-07-16 13:20:30 +02:00
if [ -n "${TMPFILE}" ]; then if [ -f ${TMPFILE} ]; then rm -f ${TMPFILE}; fi; fi
if [ -n "${TMPFILE2}" ]; then if [ -f ${TMPFILE2} ]; then rm -f ${TMPFILE2}; fi; fi
2021-05-14 13:56:48 +02:00
if [ -n "${TMPFILE3}" ]; then if [ -f ${TMPFILE3} ]; then rm -f ${TMPFILE3}; fi; fi
2014-08-26 17:33:55 +02:00
2017-04-23 20:06:54 +02:00
WaitForKeyPress
2014-08-26 17:33:55 +02:00
#
#================================================================================
# Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com