lynis/include/tests_webservers

#!/bin/sh

#################################################################################
#
#   Lynis
# ------------------
#
# Copyright 2007-2013, Michael Boelen
# Copyright 2013-2016, CISOfy
#
# Website  : https://cisofy.com
# Blog     : http://linux-audit.com
# GitHub   : https://github.com/CISOfy/lynis
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Software: webserver
#
#################################################################################
#
    InsertSection "Software: webserver"
#
#################################################################################
#
    # Reset Apache status
    APACHE_INSTALLED=0
    APACHE_MODULES_ENABLED_LOCS="/etc/apache2/mods-enabled"
    APACHE_MODULES_LOCS="/etc/httpd/modules /opt/local/apache2/modules /usr/lib/apache2 /usr/lib/httpd/modules /usr/libexec/apache2 /usr/lib64/apache2 /usr/lib64/apache2/modules /usr/lib64/httpd/modules /usr/local/libexec/apache /usr/local/libexec/apache22"
    NGINX_RUNNING=0
    NGINX_CONF_LOCS="/etc/nginx /usr/local/etc/nginx /usr/local/nginx/conf"
    NGINX_CONF_LOCATION=""
#
#################################################################################
#
    sTEST_APACHE_TARGETS="/etc/apache /etc/apache2 /etc/httpd /usr/local/apache /usr/local/apache2 \
                          /usr/local/etc/apache /usr/local/etc/apache2 /usr/local/etc/apache22 \
                          /usr/pkg/etc/httpd /etc/sysconfig/apache2"

    CreateTempFile || ExitFatal
    TMPFILE="${TEMP_FILE}"
    CreateTempFile || ExitFatal
    TMPFILE2="${TEMP_FILE}"
#
#################################################################################
#
    # Test        : HTTP-6622
    # Description : Test for Apache installation
    # Notes       : Do not run on NetBSD, -v is unknown option for httpd binary
    #               On OpenBSD do not run /usr/sbin/httpd with -v: builtin non-Apache
    if [ ! "${OS}" = "NetBSD" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no HTTP-6622 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking Apache presence"
    if [ ${SKIPTEST} -eq 0 ]; then
        if [ "${OS}" = "OpenBSD" -a "${HTTPDBINARY}" = "/usr/sbin/httpd" ]; then HTTPDBINARY=""; fi
        if [ "${HTTPDBINARY}" = "" ]; then
            Display --indent 2 --text "- Checking Apache" --result "${STATUS_NOT_FOUND}" --color WHITE
          else
            LogText "Test: Scanning for Apache binary"
            IS_APACHE=`${HTTPDBINARY} -v 2> /dev/null | egrep '[aA]pache'`
            if [ "${IS_APACHE}" = "" ]; then
                LogText "Result: ${HTTPDBINARY} is not Apache"
                Display --indent 2 --text "- Checking Apache (binary ${HTTPDBINARY})" --result "NO MATCH" --color WHITE
              else
                Display --indent 2 --text "- Checking Apache (binary ${HTTPDBINARY})" --result "${STATUS_FOUND}" --color GREEN
                LogText "Result: ${HTTPDBINARY} seems to be Apache HTTP daemon"
                APACHE_INSTALLED=1
                APACHE_VERSION=`${HTTPDBINARY} -v 2> /dev/null | grep "^Server version:" | awk '{ print $3 }' | awk -F/ '{ print $2 }'`
                LogText "Apache version: ${APACHE_VERSION}"
                Report "apache_version=${APACHE_VERSION}"
            fi
        fi
    fi
#
#################################################################################
#
    # Test        : HTTP-6624
    # Description : Testing main Apache configuration file
    # Notes       : Do not run on OpenBSD/NetBSD, as -V is an unknown option for httpd binary
    if [ ${APACHE_INSTALLED} -eq 1 ]; then
        if [ ! "${OS}" = "NetBSD" -a ! "${OS}" = "OpenBSD" ]; then
            PREQS_MET="YES"
          else
            PREQS_MET="NO"
        fi
      else
        PREQS_MET="NO"
    fi
    Register --test-no HTTP-6624 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Testing main Apache configuration file"
    if [ ${SKIPTEST} -eq 0 ]; then
        APACHE_CONFIGFILE=""
        APACHE_TEST=`${HTTPDBINARY} -V 2> /dev/null | grep "\-D SERVER_CONFIG_FILE=" | sed 's/[ ]-D SERVER_CONFIG_FILE=//' | tr -d '"' | tr -d ' ' | tr -d '[:cntrl:]'`

        if [ "${APACHE_TEST}" = "" ]; then
            LogText "Result: Can't find the configuration file, so skipping some Apache related tests"
          else
            # We found a possible match. Checking if it's valid filename. If not, we need to add a prefix
            if [ -f ${APACHE_TEST} ]; then
                APACHE_CONFIGFILE="${APACHE_TEST}"
                Display --indent 6 --text "Info: Configuration file found (${APACHE_CONFIGFILE})"
              else
                # Probably the prefix is missing, so we are going to search that
                APACHE_HTTPDROOT=`${HTTPDBINARY} -V 2> /dev/null | grep "\-D HTTPD_ROOT=" | sed 's/[ ]-D HTTPD_ROOT=//' | tr -d '"' | tr -d ' '`
                #echo "Apache root prefix: ${APACHE_HTTPDROOT}"
                #echo "Complete path to configuration file: ${APACHE_HTTPDROOT}/${APACHE_TEST}"
                APACHE_TESTFILE="${APACHE_HTTPDROOT}/${APACHE_TEST}"
                if [ -f ${APACHE_TESTFILE} ]; then
                    APACHE_CONFIGFILE="${APACHE_TESTFILE}"
                    Display --indent 6 --text "Info: Configuration file found (${APACHE_CONFIGFILE})"
                    LogText "Result: Configuration file found (${APACHE_CONFIGFILE})"
                  else
                    LogText "Result: File or directory ${APACHE_CONFIGFILE} does not exist"
                    Display --indent 6 --text "[Notice] possible directory/file parts found, but still unsure what the real configuration file is. Skipping some Apache related tests"
                    ReportException "${TEST_NO}:1" "Found some unknown directory or file references in Apache configuration"
                fi
            fi
        fi
    fi
#
#################################################################################
#
    # Test        : HTTP-6626
    # Description : Testing other Apache configuration files
    if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no HTTP-6626 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Testing other Apache configuration file"
    if [ ${SKIPTEST} -eq 0 ]; then
        #Display --indent 4 --text "- Searching Apache virtual hosts"
        for I in ${sTEST_APACHE_TARGETS}; do
            if [ -d ${I} ]; then
                find ${I} -name "*.conf" -print >> ${TMPFILE2}
            fi
        done

        # Sort unsorted list, save it in temp file and then remove unsorted list
        if [ -f ${TMPFILE2} ]; then
            sort -u ${TMPFILE2} >> ${TMPFILE}
            rm -f ${TMPFILE2}
        fi
        cVHOSTS=0; tVHOSTS=""

        # Check every configuration file
        for I in `cat ${TMPFILE}`; do
            LogText "Apache config file: ${I}"

            FileIsReadable ${I}
            if [ ${CANREAD} -eq 1 ]; then
                # Search Virtual Hosts
                for J in `grep "ServerName" ${I} | grep -v "^#" | awk '{ if ($1=="ServerName" && $2!="*" && $2!="default") print $2 }'`; do
                    if [ ! -z ${J} ]; then
                        tVHOSTS="${tVHOSTS} ${J}"
                        cVHOSTS=$((cVHOSTS + 1))
                    fi
                done
                # Search Server aliases
                for J in `grep "ServerAlias" ${I} | grep -v "^#" | sed "s/.* ServerAlias//g" | sed "s/#.*//g"`; do
                    if [ ! -z ${J} ]; then
                        tVHOSTS="${tVHOSTS} ${J}"
                        cVHOSTS=$((cVHOSTS + 1))
                    fi
                done
              else
                LogText "Result: can not read configuration file with this user ID"
                ReportException "${TEST_NO}:1" "Can not read configuration file $I"
            fi
        done

        # Log all virtual hosts we found
            for J in ${tVHOSTS}; do
                if [ ! -z ${J} ]; then
                    LogText "Virtual host: ${J}"
                    Report "apache_vhost_name[]=${J}"
                fi
            done

        # Show number of vhosts if we found any
        LogText "Result: found ${cVHOSTS} virtual hosts"
        if [ ${cVHOSTS} -gt 0 ]; then
            Display --indent 6 --text "Info: Found ${cVHOSTS} virtual hosts"
          else
            Display --indent 6 --text "Info: No virtual hosts found"
        fi
    fi

    # Remove temp files
    if [ -f ${TMPFILE} -a ! "${TMPFILE}" = "" ]; then
        rm -f ${TMPFILE}
    fi
    if [ ! "${TMPFILE2}" = "" ]; then if [ -f ${TMPFILE2} ]; then rm -f ${TMPFILE2}; fi; fi
#
#################################################################################
#
    # Test        : HTTP-6628
    # Description : Testing other Apache configuration files
    #if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    #Register --test-no HTTP-6628 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Testing other Apache configuration file"
    #if [ ${SKIPTEST} -eq 0 ]; then
#    	        # Configuration specific tests
#	        SERVERTOKENSFOUND=0
#	        APACHE_CONFIGFILES="${APACHE_CONFIGFILE} /usr/local/etc/apache22/extra/httpd-default.conf /etc/apache2/sysconfig.d/global.conf"
#
#	        for APACHE_CONFIGFILE in ${APACHE_CONFIGFILES}; do
#	            if [ -f ${APACHE_CONFIGFILE} ]; then
#	        	# Check if option ServerTokens is configured
#	        	SERVERTOKENSTEST=`grep ServerTokens ${APACHE_CONFIGFILE} | grep -v '^#'`
#	        	if [ ! "${SERVERTOKENSTEST}" = "" ]; then
#	    		    Display --indent 4 --text "- Checking option ServerTokens" --result "${STATUS_FOUND}" --color WHITE
#	        	    SERVERTOKENSTEST=`echo ${SERVERTOKENSTEST} | sed 's/ServerTokens//' | tr -d ' '`
#	    		    LogText "Option ServerTokens found: ${SERVERTOKENSTEST}"
#	    		    SERVERTOKENSEXPECTED=`grep 'apache' ${PROFILE} | grep 'ServerTokens' | cut -d ':' -f3`
#	    		    if [ "${SERVERTOKENSEXPECTED}" = "${SERVERTOKENSTEST}" ]; then
#	    		        LogText "Result: Value from configuration file yielded the same output as in template"
#	    		        SERVERTOKENSFOUND=1
#	    	              else
#	    		        LogText "Result: Value of ServerTokens within active configuration is different than from used template."
#	    		        LogText "Found: ${SERVERTOKENSTEST}"
#	    		        LogText "Expected: ${SERVERTOKENSEXPECTED}"
#	    		    fi
#	    	          else
#	        	    Display --indent 4 --text "- Checking option ServerTokens" --result "${STATUS_NOT_FOUND}" --color WHITE
#	        	fi
#
#    		    else
#    		      # File does not exist, skipping
#    		      LogText "File ${APACHE_CONFIGFILE} does not exist, so skipping tests on this file"
#    	      fi
#    	    done
#
#    	    # Display results from checks
#    	    if [ ${SERVERTOKENSFOUND} -eq 1 ]; then
#        	Display --indent 6 --text "- Value of ServerTokens" --result "${STATUS_OK}" --color GREEN
#    	      else
#    	        Display --indent 6 --text "- Value of ServerTokens" --result "${STATUS_WARNING}" --color RED
#        	ReportWarning ${TEST_NO} "M" "Value of 'ServerTokens' in Apache config is different than template"
#    	    fi
#           fi
#        fi
#    fi

#
#################################################################################
#
    # Test        : HTTP-6630
    # Description : Search for all loaded modules
    #if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    #Register --test-no HTTP-6630 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determining all loaded Apache modules"
    #if [ ${SKIPTEST} -eq 0 ]; then
        # Testing Debian style
        #LogText "Test: searching loaded/enabled Apache modules"
        #apachectl -t -D DUMP_MODULES 2>&1 | egrep -v "(Loaded Modules|Syntax OK)" | sed 's/(\(shared\|static\))//' | sed 's/ //'
        #for I in ${APACHE_MODULES_ENABLED_LOCS}; do
            #LogText "Test: checking ${I}"
            #if [ -d ${I} ]; then
                #FIND=`grep -r LoadModule ${I}/* | grep -v "^#" | awk '{ print $2":"$3 }'`
              #else
                #LogText "Result: ${I} does not exist"
            #fi
        #done
    #fi
#
#################################################################################
#
    # Test        : HTTP-6632
    # Description : Search for available Apache modules
    if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no HTTP-6632 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determining all available Apache modules"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: searching available Apache modules"
        N=0
        for I in ${APACHE_MODULES_LOCS}; do
            DirectoryExists ${I}
            if [ ${DIRECTORY_FOUND} -eq 1 ]; then
                FIND=$(find ${I} -name "mod_*" -print | sort)
                for J in ${FIND}; do
                    Report "apache_module[]=${J}"
                    LogText "Result: found Apache module ${J}"
                    N=$((N + 1))
                done
            fi
        done
        if [ ${N} -eq 0 ]; then
            Display --indent 4 --text "* Loadable modules" --result "${STATUS_NONE}" --color WHITE
            ReportException "${TEST_NO}:1" "No loadable Apache modules found"
          else
            Display --indent 4 --text "* Loadable modules" --result "${STATUS_FOUND}" --color GREEN
            Display --indent 8 --text "- Found ${N} loadable modules"
        fi
    fi
#
#################################################################################
#
    # Test        : HTTP-6640
    # Description : Search for special Apache modules: evasive
    if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no HTTP-6640 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determining existence of specific Apache modules"
    if [ ${SKIPTEST} -eq 0 ]; then
        # Check modules, module
        CheckItem "apache_module" "/mod_evasive([0-9][0-9])?.so"
        if [ ${ITEM_FOUND} -eq 1 ]; then
            Display --indent 10 --text "mod_evasive: anti-DoS/brute force" --result "${STATUS_FOUND}" --color GREEN
            AddHP 3 3
          else
            Display --indent 10 --text "mod_evasive: anti-DoS/brute force" --result "${STATUS_NOT_FOUND}" --color WHITE
            AddHP 2 3
            ReportSuggestion ${TEST_NO} "Install Apache mod_evasive to guard webserver against DoS/brute force attempts"
        fi
    fi
#
#################################################################################
#
    # Test        : HTTP-6641
    # Description : Search for special Apache modules: Quality of Service
    if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no HTTP-6641 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determining existence of specific Apache modules"
    if [ ${SKIPTEST} -eq 0 ]; then
        # Check modules, module
        CheckItem "apache_module" "/mod_qos.so"
        if [ ${ITEM_FOUND} -eq 1 ]; then
            Display --indent 10 --text "mod_qos: anti-Slowloris" --result "${STATUS_FOUND}" --color GREEN
            AddHP 3 3
          else
            Display --indent 10 --text "mod_qos: anti-Slowloris" --result "${STATUS_NOT_FOUND}" --color WHITE
            AddHP 2 3
            ReportSuggestion ${TEST_NO} "Install Apache mod_qos to guard webserver against Slowloris attacks"
        fi
    fi
#
#################################################################################
#
    # Test        : HTTP-6642
    # Description : Search for special Apache modules: Spamhaus
    # Notes       : This test is outdated
    #if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    #Register --test-no HTTP-6642 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determining existence of specific Apache modules"
    #if [ ${SKIPTEST} -eq 0 ]; then
    #    # Check modules, module
    #    CheckItem "apache_module" "/mod_spamhaus.so"
    #    if [ ${ITEM_FOUND} -eq 1 ]; then
    #        Display --indent 10 --text "mod_spamhaus: anti-spam (spamhaus)" --result "${STATUS_FOUND}" --color GREEN
    #        AddHP 3 3
    #      else
    #        Display --indent 10 --text "mod_spamhaus: anti-spam (spamhaus)" --result "${STATUS_NOT_FOUND}" --color WHITE
    #        AddHP 2 3
    #        ReportSuggestion ${TEST_NO} "Install Apache mod_spamhaus to guard webserver against spammers"
    #    fi
    #fi
#
#################################################################################
#
    # Test        : HTTP-6643
    # Description : Search for special Apache modules: security
    if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no HTTP-6643 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determining existence of specific Apache modules"
    if [ ${SKIPTEST} -eq 0 ]; then
        # Check modules, module
        CheckItem "apache_module" "/mod_security2.so"
        if [ ${ITEM_FOUND} -eq 1 ]; then
            Display --indent 10 --text "ModSecurity: web application firewall" --result "${STATUS_FOUND}" --color GREEN
            AddHP 3 3
          else
            Display --indent 10 --text "ModSecurity: web application firewall" --result "${STATUS_NOT_FOUND}" --color WHITE
            AddHP 2 3
            ReportSuggestion ${TEST_NO} "Install Apache modsecurity to guard webserver against web application attacks"
        fi
        # Extend test with nginx?
    fi
#
#################################################################################
#
    # Test        : HTTP-6660
    # Description : Search for "TraceEnable off" in configuration files
#
#################################################################################
#
    # Test        : HTTP-6702
    # Description : Search for nginx process
    Register --test-no HTTP-6702 --weight L --network NO --category security --description "Check nginx process"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: searching running nginx process"
        FIND=`${PSBINARY} ax | grep "/nginx" | grep "master" | grep -v "grep"`
        if [ ! "${FIND}" = "" ]; then
            LogText "Result: found running nginx process(es)"
            Display --indent 2 --text "- Checking nginx" --result "${STATUS_FOUND}" --color GREEN
            NGINX_RUNNING=1
          else
            LogText "Result: no running nginx process found"
            Display --indent 2 --text "- Checking nginx" --result "${STATUS_NOT_FOUND}" --color WHITE
        fi
    fi
#
#################################################################################
#
    # Test        : HTTP-6704
    # Description : Search for nginx configuration file
    if [ ${NGINX_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no HTTP-6704 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check nginx configuration file"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: searching nginx configuration file"
        for I in ${NGINX_CONF_LOCS}; do
            if [ -f ${I}/nginx.conf ]; then
                NGINX_CONF_LOCATION="${I}/nginx.conf"
                LogText "Found file ${NGINX_CONF_LOCATION}"
            fi
        done
        if [ ! "${NGINX_CONF_LOCATION}" = "" ]; then
            LogText "Result: found nginx configuration file"
            Report "nginx_main_conf_file=${NGINX_CONF_LOCATION}"
            Display --indent 4 --text "- Searching nginx configuration file" --result "${STATUS_FOUND}" --color GREEN
          else
            LogText "Result: no nginx configuration file found"
            Display --indent 2 --text "- Searching nginx configuration file" --result "${STATUS_NOT_FOUND}" --color WHITE
        fi
    fi
#
#################################################################################
#
    # Test        : HTTP-6706
    # Description : Search for includes within nginx configuration file
    # Notes       : Daemon nginx should be running, nginx.conf should be found
    if [ ${NGINX_RUNNING} -eq 1 -a ! "${NGINX_CONF_LOCATION}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no HTTP-6706 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for additional nginx configuration files"
    if [ ${SKIPTEST} -eq 0 ]; then
        # Remove temp file
        if [ ! "${TMPFILE}" = "" ]; then if [ -f ${TMPFILE} ]; then rm -f ${TMPFILE}; fi; fi
        N=0
        sed -e 's/^[ 	]*//' ${NGINX_CONF_LOCATION} | grep -v "^#" | grep -v "^$" | sed 's/[	]/ /g' | sed 's/  / /g' | sed 's/  / /g' >> ${TMPFILE}
        # Search for included configuration files (may include directories and wild cards)
        FIND=`grep "include" ${NGINX_CONF_LOCATION} | ${AWKBINARY} '{ if ($1=="include") { print $2 }}' | sed 's/;$//g'`
        for I in ${FIND}; do
            FIND2=`${LSBINARY} ${I} 2>/dev/null`
            for J in ${FIND2}; do
              # Ensure that we are parsing normal files
              if [ -f ${J} ]; then
                  N=$((N + 1))
                  LogText "Result: found Nginx configuration file ${J}"
                  Report "nginx_sub_conf_file=${J}"
                  FileIsReadable ${J}
                  if [ ${CANREAD} -eq 1 ]; then
                      FIND3=`sed -e 's/^[ 	]*//' ${J} | grep -v "^#" | grep -v "^$" | sed 's/[	]/ /g' | sed 's/  / /g' | sed 's/  / /g' >> ${TMPFILE}`
                    else
                      ReportException "${TEST_NO}:1" "Can not parse file ${J}, as it is not readable"
                  fi
              fi
            done
        done

        # Sort all discovered configuration lines and store unique ones. Also strip out the mime types configured in nginx
        SORTFILE=`sort -u ${TMPFILE} | sed 's/ /:space:/g' | egrep -v "(application|audio|image|text|video)/" | egrep -v "({|})"`
        for I in ${SORTFILE}; do
            I=`echo ${I} | sed 's/:space:/ /g'`
            Report "nginx_config_option=${I}";
        done

        # Remove unsorted file for next tests
        if [ -f ${TMPFILE} ]; then rm -f ${TMPFILE}; fi

        if [ ${N} -eq 0 ]; then
            LogText "Result: no nginx include statements found"
          else
            Display --indent 6 --text "- Found nginx includes" --result "${N} FOUND" --color GREEN
        fi
    fi
#
#################################################################################
#
    # Test        : HTTP-6708
    # Description : Check discovered nginx configuration settings for further hardering
    # Notes       : Daemon of nginx should be running, nginx.conf should be found
    if [ ${NGINX_RUNNING} -eq 1 -a "${NGINX_CONF_LOCATION}" != "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no HTTP-6708 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check discovered nginx configuration settings"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: start parsing all discovered nginx options"
        Display --indent 4 --text "- Parsing configuration options"
        ParseNginx
    fi
#
#################################################################################
#
    # Test        : HTTP-6710
    # Description : Check SSL configuration of nginx
    # Notes       : Daemon of nginx should be running, nginx.conf should be found
    if [ ${NGINX_RUNNING} -eq 1 -a "${NGINX_CONF_LOCATION}" != "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no HTTP-6710 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check nginx SSL configuration settings"
    if [ ${SKIPTEST} -eq 0 ]; then
        NGINX_SSL_SUGGESTION=0
        if [ ${NGINX_SSL_ON} -eq 1 ]; then
            LogText "Result: SSL is configured in nginx on one or more virtual hosts"
            Display --indent 6 --text "- SSL configured" --result "${STATUS_YES}" --color GREEN
            AddHP 5 5
            # Cipher tests
            if [ ${NGINX_SSL_CIPHERS} -eq 1 ]; then
                Display --indent 8 --text "- Ciphers configured" --result "${STATUS_YES}" --color GREEN
              else
                Display --indent 8 --text "- Ciphers configured" --result "${STATUS_NO}" --color RED
                NGINX_SSL_SUGGESTION=1
            fi

            if [ ${NGINX_SSL_PREFER_SERVER_CIPHERS} -eq 1 ]; then
                Display --indent 8 --text "- Prefer server ciphers" --result "${STATUS_YES}" --color GREEN
              else
                Display --indent 8 --text "- Prefer server ciphers" --result "${STATUS_NO}" --color RED
                NGINX_SSL_SUGGESTION=1
            fi

            if [ ${NGINX_SSL_PROTOCOLS} -eq 1 ]; then
                Display --indent 8 --text "- Protocols configured" --result "${STATUS_YES}" --color GREEN
                if [ ${NGINX_WEAK_SSL_PROTOCOL_FOUND} -eq 0 ]; then
                    Display --indent 10 --text "- Insecure protocols found" --result "${STATUS_NO}" --color GREEN
                  else
                    Display --indent 10 --text "- Insecure protocols found" --result "${STATUS_YES}" --color RED
                    ReportSuggestion "${TEST_NO}" "Disable weak protocol in nginx configuration"
                fi
              else
                Display --indent 8 --text "- Protocols configured" --result "${STATUS_NO}" --color RED
                NGINX_SSL_SUGGESTION=1
            fi

          else
            LogText "Result: No SSL configuration found"
            Display --indent 6 --text "- SSL configured" --result "${STATUS_NO}" --color RED
            NGINX_SSL_SUGGESTION=1
            AddHP 1 5
        fi
        if [ ${NGINX_SSL_SUGGESTION} -eq 1 ]; then
            LogText "Result: one or more parts of the nginx configuration could be enhanced regarding SSL"
            ReportSuggestion ${TEST_NO} "Configure SSL in nginx for protection of sensitive data and privacy"
        fi
    fi
#
#################################################################################
#
    # Test        : HTTP-6712
    # Description : Check logging configuration of nginx
    # Notes       : Daemon of nginx should be running, nginx.conf should be found
    if [ ${NGINX_RUNNING} -eq 1 -a "${NGINX_CONF_LOCATION}" != "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no HTTP-6712 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check nginx access logging"
    if [ ${SKIPTEST} -eq 0 ]; then
        NGINX_LOG_SUGGESTION=0
        Display --indent 6 --text "- Checking log file configuration"

        # Check for missing access log
        if [ ${NGINX_ACCESS_LOG_MISSING} -eq 1 ]; then
            NGINX_LOG_SUGGESTION=1
            Display --indent 8 --text "- Missing log files (access_log)" --result "${STATUS_YES}" --color RED
          else
            Display --indent 8 --text "- Missing log files (access_log)" --result "${STATUS_NO}" --color GREEN
        fi
        # Access log disabled
        if [ ${NGINX_ACCESS_LOG_DISABLED} -eq 1 ]; then
            NGINX_LOG_SUGGESTION=1
            LogText "Result: found one or more virtual hosts which have their access log disabled"
            Display --indent 8 --text "- Disabled access logging" --result "${STATUS_YES}" --color RED
            AddHP 2 3
          else
            LogText "Result: no virtual hosts found which have their access log disabled"
            Display --indent 8 --text "- Disabled access logging" --result "${STATUS_NO}" --color GREEN
            AddHP 3 3
        fi
        # Report suggestion
        if [ ${NGINX_LOG_SUGGESTION} -eq 1 ]; then
            ReportSuggestion ${TEST_NO} "Check your nginx access log for proper functioning"
        fi
    fi
#
#################################################################################
#
    # Test        : HTTP-6714
    # Description : Check missing error logs in nginx
    if [ ${NGINX_RUNNING} -eq 1 -a "${NGINX_CONF_LOCATION}" != "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no HTTP-6714 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for missing error logs in nginx"
    if [ ${SKIPTEST} -eq 0 ]; then
        NGINX_LOG_SUGGESTION=0
        # Check for missing access log
        if [ ${NGINX_ERROR_LOG_MISSING} -eq 1 ]; then
            NGINX_LOG_SUGGESTION=1
            Display --indent 8 --text "- Missing log files (error_log)" --result "${STATUS_YES}" --color RED
          else
            Display --indent 8 --text "- Missing log files (error_log)" --result "${STATUS_NO}" --color GREEN
        fi
        # Report suggestion
        if [ ${NGINX_LOG_SUGGESTION} -eq 1 ]; then
            ReportSuggestion ${TEST_NO} "Check your nginx error_log statements"
        fi
    fi
#
#################################################################################
#
    # Test        : HTTP-6716
    # Description : Check debug mode on error log in nginx
    if [ ${NGINX_RUNNING} -eq 1 -a "${NGINX_CONF_LOCATION}" != "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no HTTP-6716 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for debug mode on error log in nginx"
    if [ ${SKIPTEST} -eq 0 ]; then
        NGINX_LOG_SUGGESTION=0
        # Access log in debug mode
        if [ ${NGINX_ERROR_LOG_DEBUG} -eq 1 ]; then
            NGINX_LOG_SUGGESTION=1
            LogText "Result: found one or more virtual hosts which have their error log in debug mode"
            Display --indent 8 --text "- Debugging mode on error_log" --result "${STATUS_YES}" --color RED
            AddHP 2 3
          else
            LogText "Result: no virtual hosts found which have their access log disabled"
            Display --indent 8 --text "- Debugging mode on error_log" --result "${STATUS_NO}" --color GREEN
            AddHP 3 3
        fi
        # Report suggestion
        if [ ${NGINX_LOG_SUGGESTION} -eq 1 ]; then
            ReportSuggestion ${TEST_NO} "Check your nginx error_log statements"
        fi
    fi
#
#################################################################################
#
    # Test        : HTTP-67xx
    # Description : Check if nginx is running as a reverse proxy
    # Notes       : aliases are not counted yet (YYY)
#    if [ ${NGINX_RUNNING} -eq 1 -a ! "${NGINX_CONF_LOCATION}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
#    Register --test-no HTTP-67xx --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check nginx virtual hosts"
#    if [ ${SKIPTEST} -eq 0 ]; then
#	N=0
#	LogText "Test: searching proxy_pass statement in configuration file ${NGINX_CONF_LOCATION}"
#	FIND=`grep "proxy_pass" ${NGINX_CONF_LOCATION} | grep -v "#" | sed 's/proxy_pass//g' | tr -d ';'`
#	for I in ${FIND}; do
#	    LogText "Found reverse proxy configuration for: ${I}"
#	    N=$((N + 1))
#	done
#	if [ ${N} -eq 0 ]; then
#	    LogText "Result: no reverse proxying functionality found"
#	    Display --indent 4 --text "- Searching reverse proxy functionality" --result "${STATUS_NOT_FOUND}" --color WHITE
#	  else
#	    LogText "Result: found ${N} addresses for which nginx will be a reverse proxy"
#           Display --indent 4 --text "- Searching reverse proxy functionality" --result "${N} FOUND" --color GREEN
#	fi
#    fi
#
#################################################################################
#
    # Test        : HTTP-67xx
    # Description : Search for nginx virtual hosts
    # Notes       : Test if not aware yet of included configuration files
#    if [ ${NGINX_RUNNING} -eq 1 -a ! "${NGINX_CONF_LOCATION}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
#    Register --test-no HTTP-67xx --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check nginx virtual hosts"
#    if [ ${SKIPTEST} -eq 0 ]; then
#	N=0
#	LogText "Test: searching nginx virtual hosts"
#	FIND=`grep "server_name" ${NGINX_CONF_LOCATION} | grep -v "#" | sed 's/server_name//g' | tr -d ';'`
#	for I in ${FIND}; do
#	    if [ "${I}" = "_" ]; then I="Default virtual host"; fi
#	    LogText "Found virtual host: ${I}"
#	    Report "nginx_vhost_name[]=${I}"
#	    N=$((N + 1))
#	done
#	if [ ${N} -eq 0 ]; then
#	    LogText "Result: no virtual hosts found"
#	    Display --indent 4 --text "- Searching virtual hosts" --result "${STATUS_NOT_FOUND}" --color WHITE
#	  else
#	    LogText "Result: found ${N} virtual hosts"
#            Display --indent 4 --text "- Searching virtual hosts" --result "${N} FOUND" --color GREEN
#	fi
#    fi
#
#################################################################################
#
    # Test        : HTTP-6720
    # Description : Search for Nginx log files
    if [ ${NGINX_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no HTTP-6720 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check Nginx log files"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking directories for files with log file definitions"
        for I in ${NGINX_CONF_LOCS}; do
            LogText "Test: Checking ${I}"
            if [ -d ${I} ]; then
                LogText "Result: Directory ${I} exists, so will be used as search path"
                FIND=`find ${I} -type f -exec grep access_log \{\} \; | grep -v "#" | awk '{ if($1=="access_log") { print $2 } }' | sed 's/;$//g' | sort -u`
                if [ "${FIND}" = "" ]; then
                    LogText "Result: no log files found"
                  else
                    LogText "Result: found one or more log files"
                    for I in ${FIND}; do
                      if [ -f ${I} ]; then
                        LogText "Found log file: ${I}"
                        Report "log_file=${I}"
                      else
                        LogText "Found non existing log file: ${I}"
                      fi
                    done
                fi
              else
                  LogText "Result: directory ${I} not found, skipping search in this directory."
              fi
        done
    fi
#
#################################################################################
#
    # Test        : HTTP-6740
    # Description : Nginx: Check for server_tokens off in configuration files
#
#################################################################################
#

    # Remove temp file (double check)
    if [ ! "${TMPFILE}" = "" ]; then if [ -f ${TMPFILE} ]; then rm -f ${TMPFILE}; fi; fi
    if [ ! "${TMPFILE2}" = "" ]; then if [ -f ${TMPFILE2} ]; then rm -f ${TMPFILE2}; fi; fi


WaitForKeyPress

#
#================================================================================
# Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com