lynis/include/tests_squid

#!/bin/sh

#################################################################################
#
#   Lynis
# ------------------
#
# Copyright 2007-2013, Michael Boelen
# Copyright 2013-2016, CISOfy
#
# Website  : https://cisofy.com
# Blog     : http://linux-audit.com
# GitHub   : https://github.com/CISOfy/lynis
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Squid
#
#################################################################################
#
    SQUID_DAEMON_CONFIG_LOCS="/etc /etc/squid /etc/squid3 /usr/local/etc/squid /usr/local/squid/etc"
    SQUID_DAEMON_CONFIG=""
    SQUID_DAEMON_UNSAFE_PORTS_LIST="22 23 25"
    SQUID_DAEMON_RUNNING=0
#
#################################################################################
#
    InsertSection "Squid Support"
#
#################################################################################
#
    # Test        : SQD-3602
    # Description : Check for a running Squid daemon
    # Notes       : Search for squid(3) with a space, to avoid SquidGuard and other
    #               programs.
    Register --test-no SQD-3602 --weight L --network NO --description "Check for running Squid daemon"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Searching for a Squid daemon"
        FOUND=0
        # Check running processes
        FIND=`${PSBINARY} ax | egrep "(squid|squid3) " | grep -v "grep"`
        if [ ! "${FIND}" = "" ]; then
            SQUID_DAEMON_RUNNING=1
            LogText "Result: Squid daemon is running"
            Display --indent 2 --text "- Checking running Squid daemon" --result "${STATUS_FOUND}" --color GREEN
          else
            LogText "Result: No running Squid daemon found"
            Display --indent 2 --text "- Checking running Squid daemon" --result "${STATUS_NOT_FOUND}" --color WHITE
        fi
    fi
#
#################################################################################
#
    # Test        : SQD-3604
    # Description : Determine Squid daemon configuration file location
    if [ ${SQUID_DAEMON_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no SQD-3604 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check Squid daemon file location"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: searching for squid.conf or squid3.conf file"
        for I in ${SQUID_DAEMON_CONFIG_LOCS}; do
            # Checking squid.conf
            if [ -f "${I}/squid.conf" ]; then
              LogText "Result: ${I}/squid.conf exists"
              SQUID_DAEMON_CONFIG="${I}/squid.conf"
            fi
            # Checking squid3.conf
            if [ -f "${I}/squid3.conf" ]; then
              LogText "Result: ${I}/squid3.conf exists"
              SQUID_DAEMON_CONFIG="${I}/squid3.conf"
            fi
        done
        if [ "${SQUID_DAEMON_CONFIG}" = "" ]; then
            LogText "Result: No Squid configuration file found"
            Display --indent 4 --text "- Searching Squid configuration file" --result "${STATUS_NOT_FOUND}" --color YELLOW
          else
            LogText "Result: using last found configuration file: ${SQUID_DAEMON_CONFIG}"
            Display --indent 4 --text "- Searching Squid configuration" --result "${STATUS_FOUND}" --color GREEN
        fi
    fi
#
#################################################################################
#
    # Test        : SQD-3606
    # Description : Check Squid version
    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! "${SQUID_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no SQD-3606 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check Squid version"
    if [ ${SKIPTEST} -eq 0 ]; then
        if [ ! "${SQUIDBINARY}" = "" ]; then
            LogText "Result: Squid binary found (${SQUIDBINARY})"
            # Skip check if a setuid/setgid bit is found
            FIND=`find ${SQUIDBINARY} \( -perm 4000 -o -perm 2000 \) -print`
            if [ "${FIND}" = "" ]; then
                FIND2=`${SQUIDBINARY} -v | awk '{ if ($3=="Version") { print $4 } }'`
                Display --indent 4 --text "- Checking Squid version" --result "${STATUS_FOUND}" --color GREEN
                SQUID_VERSION="${FIND2}"
              else
                LogText "Result: test skipped for security reasons, setuid/setgid bit set"
                Display --indent 4 --text "- Checking Squid version" --result "${STATUS_SKIPPED}" --color RED
            fi
          else
            LogText "Result: no Squid binary found"
        fi
    fi
#
#################################################################################
#
    # Test        : SQD-3610
    # Description : Check Squid configuration options
    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! "${SQUID_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no SQD-3610 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check Squid version"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking all specific defined options in ${SQUID_DAEMON_CONFIG}"
        FIND=`grep -v "^#" ${SQUID_DAEMON_CONFIG} | grep -v "^$" | ${AWKBINARY} '{gsub("\t"," ");print}' | sed 's/ /!space!/g'`
        for I in ${FIND}; do
            I=`echo ${I} | sed 's/!space!/ /g'`
            LogText "Found Squid option: ${I}"
            Report "squid_option=${I}"
        done
        Display --indent 4 --text "- Checking defined Squid options" --result "${STATUS_DONE}" --color GREEN
    fi
#
#################################################################################
#
    # Test        : SQD-3613
    # Description : Check Squid configuration options
    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! "${SQUID_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no SQD-3613 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check Squid file permissions"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking file permissions of ${SQUID_DAEMON_CONFIG}"
        FIND=`find ${SQUID_DAEMON_CONFIG} -type f -a \( -perm -004 -o -perm -002 -o -perm -001 \)`
        if [ ! "${FIND}" = "" ]; then
            LogText "Result: file ${SQUID_DAEMON_CONFIG} is world readable, writable or executable and could leak information or passwords"
            Display --indent 4 --text "- Checking Squid configuration file permissions" --result "${STATUS_WARNING}" --color RED
            ReportSuggestion ${TEST_NO} "Check file permissions of ${SQUID_DAEMON_CONFIG} to limit access"
            ReportWarning ${TEST_NO} "M" "File permissions of ${SQUID_DAEMON_CONFIG} are not restrictive"
            AddHP 0 2
          else
            LogText "Result: file ${SQUID_DAEMON_CONFIG} has proper file permissions"
            Display --indent 4 --text "- Checking Squid configuration file permissions" --result "${STATUS_OK}" --color GREEN
            AddHP 2 2
        fi
    fi
#
#################################################################################
#
    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! "${SQUID_DAEMON_CONFIG}" = "" ]; then
        Display --indent 4 --text "- Checking Squid access control"
    fi
#
#################################################################################
#
    # Test        : SQD-3614
    # Description : Check Squid authentication
    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! "${SQUID_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no SQD-3614 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check Squid authentication methods"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: check auth_param option for authentication methods"
        FIND=`grep "^auth_param" ${SQUID_DAEMON_CONFIG} | awk '{ print $2 }'`
        if [ "${FIND}" = "" ]; then
            LogText "No auth_param option found, proxy access anonymous or based on other methods (like ACLs)"
            Display --indent 6 --text "- Checking Squid authentication methods" --result "${STATUS_NONE}" --color YELLOW
          else
            Display --indent 6 --text "- Checking Squid authentication methods" --result "${STATUS_FOUND}" --color GREEN
            for I in ${FIND}; do
                LogText "Result: found authentication method ${I}"
                Report "squid_auth_method=${I}"
            done
        fi
    fi
#
#################################################################################
#
    # Test        : SQD-3616
    # Description : Check external Squid authentication
    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! "${SQUID_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no SQD-3616 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check external Squid authentication"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: check external_acl_type option for external authentication helpers"
        FIND=`grep "^external_acl_type" ${SQUID_DAEMON_CONFIG}`
        if [ "${FIND}" = "" ]; then
            LogText "No external_acl_type found"
            Display --indent 6 --text "- Checking Squid external authentication methods" --result "${STATUS_NONE}" --color YELLOW
          else
            Display --indent 6 --text "- Checking Squid external authentication methods" --result "${STATUS_FOUND}" --color GREEN
            for I in ${FIND}; do
                LogText "Result: found external authentication method helper"
                LogText "Output: ${FIND}"
                #Report "squid_external_acl_type=TRUE"
            done
        fi
    fi
#
#################################################################################
#
    # Test        : SQD-3620
    # Description : Check ACLs
    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! "${SQUID_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no SQD-3620 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check Squid access control lists"
    if [ ${SKIPTEST} -eq 0 ]; then
        N=0
        LogText "Test: checking ACLs"
        FIND=`grep "^acl " ${SQUID_DAEMON_CONFIG} | sed 's/ /!space!/g'`
        if [ "${FIND}" = "" ]; then
            LogText "Result: No ACLs found"
            Display --indent 6 --text "- Checking Access Control Lists" --result "${STATUS_NONE}" --color RED
          else
            for I in ${FIND}; do
                N=$((N + 1))
                I=`echo ${I} | sed 's/!space!/ /g'`
                LogText "Found ACL: ${I}"
                #Report "squid_acl=${I}"
            done
            LogText "Result: Found ${N} ACLs"
            Display --indent 6 --text "- Checking Access Control Lists" --result "${N} ACLs FOUND" --color GREEN
        fi
    fi
#
#################################################################################
#
    # Test        : SQD-3624 [T]
    # Description : Check unsecure ports in Safe_ports list
    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! "${SQUID_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no SQD-3624 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check Squid safe ports"
    if [ ${SKIPTEST} -eq 0 ]; then
        N=0
        LogText "Test: checking ACL Safe_ports http_access option"
        FIND=`grep "^http_access" ${SQUID_DAEMON_CONFIG} | grep "Safe_ports"`
        if [ "${FIND}" = "" ]; then
            LogText "Result: no Safe_ports found"
            Display --indent 6 --text "- Checking ACL 'Safe_ports' http_access option" --result "${STATUS_NOT_FOUND}" --color YELLOW
            ReportSuggestion ${TEST_NO} "Check if Squid has been configured to restrict access to all safe ports"
          else
            LogText "Result: checking ACL safe ports"
            FIND2=`grep "^acl Safe_ports port" ${SQUID_DAEMON_CONFIG} | awk '{ print $4 }'`
            if [ "${FIND2}" = "" ]; then
                Display --indent 6 --text "- Checking ACL 'Safe_ports' ports" --result "NONE FOUND" --color YELLOW
                ReportSuggestion ${TEST_NO} "Check if Squid has been configured for which ports it can allow outgoing traffic (Safe_ports)"
                AddHP 0 1
              else
                LogText "Result: Safe_ports found"
                for I in ${FIND}; do
                    LogText "Found safe port: ${I}"
                done
                Display --indent 6 --text "- Checking ACL 'Safe_ports' ports" --result "${STATUS_FOUND}" --color GREEN
                AddHP 1 1
            fi
            #SQUID_DAEMON_UNSAFE_PORTS_LIST
            for I in ${SQUID_DAEMON_UNSAFE_PORTS_LIST}; do
                LogText "Test: Checking port ${I} in Safe_ports list"
                FIND2=`grep -w "^acl Safe_ports port ${I}" ${SQUID_DAEMON_CONFIG}`
                if [ "${FIND2}" = "" ]; then
                    Display --indent 6 --text "- Checking ACL 'Safe_ports' (port ${I})" --result "${STATUS_NOT_FOUND}" --color GREEN
                    AddHP 1 1
                  else
                    Display --indent 6 --text "- Checking ACL 'Safe_ports' (port ${I})" --result "${STATUS_FOUND}" --color RED
                    ReportWarning ${TEST_NO} "H" "Squid configuration possibly allows relaying traffic via configured Safe_port ${I}"
                    AddHP 0 1
                fi
            done
        fi
    fi
#
#################################################################################
#
    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! "${SQUID_DAEMON_CONFIG}" = "" ]; then
        Display --indent 4 --text "- Checking Squid Denial of Service tuning options"
    fi
#
#################################################################################
#
    # Test        : SQD-3630 [T]
    # Description : Check reply_body_max_size value
    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! "${SQUID_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no SQD-3630 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check Squid reply_body_max_size option"
    if [ ${SKIPTEST} -eq 0 ]; then
        N=0
        LogText "Test: checking option reply_body_max_size"
        FIND=`grep "^reply_body_max_size " ${SQUID_DAEMON_CONFIG} | sed 's/ /!space!/g'`
        if [ "${FIND}" = "" ]; then
            LogText "Result: option reply_body_max_size not configured"
            Display --indent 6 --text "- Checking option: reply_body_max_size" --result "${STATUS_NONE}" --color RED
            AddHP 1 2
            ReportSuggestion ${TEST_NO} "Configure Squid option reply_body_max_size to limit the upper size of requests."
          else
            LogText "Result: option reply_body_max_size configured"
            LogText "Output: ${FIND}"
            Display --indent 6 --text "- Checking option: reply_body_max_size" --result "${STATUS_FOUND}" --color GREEN
            AddHP 2 2
        fi
    fi
#
#################################################################################
#
    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! "${SQUID_DAEMON_CONFIG}" = "" ]; then
        Display --indent 4 --text "- Checking Squid general options"
    fi
#
#################################################################################
#
    # Test        : SQD-3680
    # Description : Check httpd_suppress_version_string
    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! "${SQUID_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no SQD-3680 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check Squid version suppresion"
    if [ ${SKIPTEST} -eq 0 ]; then
        FIND=`grep "^httpd_suppress_version_string " ${SQUID_DAEMON_CONFIG} | grep " on"`
        if [ "${FIND}" = "" ]; then
            LogText "Result: option httpd_suppress_version_string not configured"
            Display --indent 6 --text "- Checking option: httpd_supress_version_string" --result "${STATUS_NOT_FOUND}" --color YELLOW
            AddHP 1 2
            ReportSuggestion ${TEST_NO} "Configure Squid option httpd_suppress_version_string (on) to suppress the version."
          else
            LogText "Result: option httpd_suppress_version_string configured"
            LogText "Output: ${FIND}"
            Display --indent 6 --text "- Checking option: httpd_suppress_version_string" --result "${STATUS_FOUND}" --color GREEN
            AddHP 2 2
        fi
    fi
#
#################################################################################
#

WaitForKeyPress

#
#================================================================================
# Lynis - Copyright 2007-2016 Michael Boelen, CISOfy - https://cisofy.com