2014-08-26 17:33:55 +02:00
#!/bin/sh
#################################################################################
#
# Lynis
# ------------------
#
2015-03-25 17:30:13 +01:00
# Copyright 2007-2015, Michael Boelen, CISOfy (michael.boelen@cisofy.com)
2014-11-13 00:58:11 +01:00
# Web site: https://cisofy.com
2014-08-26 17:33:55 +02:00
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Category: Boot and services
#
#################################################################################
#
InsertSection "Boot and services"
#
#################################################################################
#
2014-12-02 13:55:06 +01:00
BOOT_LOADER="unknown"
2014-09-22 23:39:31 +02:00
BOOT_LOADER_FOUND=0
2014-09-25 17:47:23 +02:00
GRUB_VERSION=0
2014-12-02 13:55:06 +01:00
SERVICE_MANAGER="unknown"
2014-08-26 17:33:55 +02:00
#
#################################################################################
2014-10-19 12:25:40 +02:00
#
# Test : BOOT-5102
# Description : Check for AIX boot device
# Notes : The AIX bootstrap is called as software ROS. Bootstrap contains IPL (Initial Program loader)
Register --test-no BOOT-5102 --os AIX --weight L --network NO --root-only YES --description "Check for AIX boot device"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: Query bootinfo for AIX boot device"
if [ -x /usr/sbin/bootinfo ]; then
FIND=`/usr/sbin/bootinfo -b`
if [ ! "${FIND}" = "" ]; then
logtext "Result: found boot device ${FIND}"
2014-12-03 14:22:58 +01:00
Display --indent 2 --text "- Checking boot device (bootinfo)" --result FOUND --color GREEN
2014-10-19 12:25:40 +02:00
BOOT_LOADER="ROS"
BOOT_LOADER_FOUND=1
else
logtext "Result: no data received from bootinfo, most likely boot device not found"
#Display --indent 4 --text "- Checking boot device (bootinfo)" --result "NOT FOUND" --color YELLOW
#ReportSuggestion ${TEST_NO} "Only use root (not sudo account) to query properly boot device"
fi
fi
fi
2014-12-02 13:55:06 +01:00
#
#################################################################################
#
# Test : BOOT-5104
# Description : Determine service manager
2014-12-03 14:22:58 +01:00
# Notes :
# initscripts - Used by Arch before
# systemd - Common option with more Linux distros implementing it
# upstart - Used by Debian/Ubuntu
2014-12-02 13:55:06 +01:00
Register --test-no BOOT-5104 --weight L --network NO --description "Determine service manager"
if [ ${SKIPTEST} -eq 0 ]; then
case ${OS} in
2014-12-05 17:11:59 +01:00
"Linux")
2014-12-02 13:55:06 +01:00
if [ -f /proc/1/cmdline ]; then
2014-12-09 18:11:21 +01:00
FILE=`cat /proc/1/cmdline | grep "^/" | awk '{ print $1 }'`
if [ ! "${FILE}" = "" ]; then
if [ -L ${FILE} ]; then
ShowSymlinkPath ${FILE}
if [ -f ${sFILE} ]; then
2014-12-02 13:55:06 +01:00
SHORTNAME=`echo ${sFILE} | awk -F/ '{ print $NF }'`
case ${SHORTNAME} in
upstart)
SERVICE_MANAGER="upstart"
;;
systemd)
SERVICE_MANAGER="systemd"
;;
*)
logtext "Found ${SHORTNAME} but unclear what service manager this is"
;;
esac
else
logtext "Result: Could not find linked file ${sFILE}"
2014-12-09 18:11:21 +01:00
fi
else
FIND=`echo ${FILE} | grep "/systemd"`
if [ ! "${FIND}" = "" ]; then
SERVICE_MANAGER="systemd"
fi
2014-12-03 14:22:58 +01:00
fi
else
2014-12-09 18:11:21 +01:00
logtext "Result: /proc/1/cmdline does not link to a binary on disk"
2014-12-02 13:55:06 +01:00
fi
fi
2014-12-03 14:22:58 +01:00
# Continue testing if we didn't find it yet
if [ "${SERVICE_MANAGER}" = "unknown" ]; then
if [ -f /usr/bin/init-openrc ]; then SERVICE_MANAGER="openrc"; fi
fi
;;
2014-12-05 17:11:59 +01:00
"DragonFly"|"NetBSD")
2014-12-03 14:22:58 +01:00
if [ -x /sbin/init -a -d /etc/rc.d -a -f /etc/rc ]; then
SERVICE_MANAGER="bsdrc"
fi
2014-12-02 13:55:06 +01:00
;;
*)
logtext "Result: unknown service manager"
esac
if [ "${SERVICE_MANAGER}" = "unknown" ]; then
Display --indent 2 --text "- Service Manager" --result "UNKNOWN" --color YELLOW
else
Display --indent 2 --text "- Service Manager" --result "${SERVICE_MANAGER}" --color GREEN
fi
fi
2014-10-19 12:25:40 +02:00
#
#################################################################################
2014-08-26 17:33:55 +02:00
#
# Test : BOOT-5121
# Description : Check for GRUB boot loader
Register --test-no BOOT-5121 --weight L --network NO --description "Check for GRUB boot loader presence"
if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0
2014-09-15 12:01:09 +02:00
logtext "Test: Checking for presence GRUB conf file (/boot/grub/grub.conf or /boot/grub/menu.lst)"
2014-08-26 17:33:55 +02:00
if [ -f /boot/grub/grub.conf -o -f /boot/grub/menu.lst ]; then
FOUND=1
BOOT_LOADER="GRUB"
2014-09-22 23:39:31 +02:00
BOOT_LOADER_FOUND=1
2014-09-25 17:47:23 +02:00
GRUB_VERSION=1
2014-09-15 12:01:09 +02:00
Display --indent 4 --text "- Checking presence GRUB" --result "OK" --color GREEN
2014-08-26 17:33:55 +02:00
if [ -f /boot/grub/grub.conf ]; then GRUBCONFFILE="/boot/grub/grub.conf"; else GRUBCONFFILE="/boot/grub/menu.lst"; fi
fi
# GRUB2 configuration file
2014-10-09 00:41:06 +02:00
if [ -f /boot/grub/grub.cfg -o -f /boot/grub2/grub.cfg ]; then
2014-08-26 17:33:55 +02:00
FOUND=1
BOOT_LOADER="GRUB2"
2014-09-22 23:39:31 +02:00
BOOT_LOADER_FOUND=1
2014-09-25 17:47:23 +02:00
GRUB_VERSION=2
2014-09-15 12:01:09 +02:00
Display --indent 4 --text "- Checking presence GRUB2" --result FOUND --color GREEN
2014-10-06 21:27:23 +02:00
if [ -f /boot/grub/grub.cfg ]; then
GRUBCONFFILE="/boot/grub/grub.cfg"
elif [ -f /boot/grub2/grub.cfg ]; then
GRUBCONFFILE="/boot/grub2/grub.cfg"
fi
logtext "Result: found GRUB2 configuration file (${GRUBCONFFILE})"
2014-08-26 17:33:55 +02:00
# YYY password check, when documentation of GRUB2 project is improved
# YYY Add check permission check (600)
2014-10-06 21:27:23 +02:00
2014-09-25 17:51:08 +02:00
fi
2014-09-25 17:57:59 +02:00
# Some OSes like Gentoo do not have /boot mounted by default
2014-09-25 17:47:23 +02:00
if [ -d /boot ]; then
2014-09-25 17:51:08 +02:00
if [ "`ls /boot/* 2> /dev/null`" = "" -a ! "${GRUB2INSTALLBINARY}" = "" ]; then
2014-09-25 17:57:59 +02:00
BOOT_LOADER_FOUND=1
2014-09-25 17:47:23 +02:00
logtext "Result: found empty /boot, however with GRUB2 binary installed. Best guess is that GRUB2 is actually installed, but /boot not mounted"
2014-12-03 14:22:58 +01:00
Display --indent 2 --text "- Checking presence GRUB2" --result "POSSIBLE MATCH" --color YELLOW
2014-09-25 17:47:23 +02:00
ReportManual "${TEST_NO}:01"
fi
2014-08-26 17:33:55 +02:00
fi
if [ ${FOUND} -eq 0 ]; then
logtext "Result: no GRUB configuration file found."
fi
fi
#
#################################################################################
2014-09-25 17:47:23 +02:00
#
# Test : BOOT-5122
# Description : Check for GRUB boot loader configuration
if [ ! "${GRUBCONFFILE}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no BOOT-5122 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check for GRUB boot password"
if [ ${SKIPTEST} -eq 0 ]; then
2014-11-13 00:58:11 +01:00
FOUND=0
2014-09-25 17:47:23 +02:00
logtext "Found file ${GRUBCONFFILE}, proceeding with tests."
FileIsReadable ${GRUBCONFFILE}
if [ ${CANREAD} -eq 1 ]; then
FIND=`cat ${GRUBCONFFILE} | grep 'password --md5' | grep -v '^#'`
FIND2=`cat ${GRUBCONFFILE} | grep 'password --encrypted' | grep -v '^#'`
2014-11-13 00:58:11 +01:00
FIND3=`cat ${GRUBCONFFILE} | grep 'set superusers' | grep -v '^#'`
FIND4=`cat ${GRUBCONFFILE} | grep 'password_pbkdf2' | grep -v '^#'`
# GRUB1: MD5 or SHA1
if [ ! "${FIND}" = "" -o ! "${FIND2}" = "" ]; then
FOUND=1
# GRUB2: Superusers and password should be defined
elif [ ! "${FIND3}" = "" -a ! "${FIND4}" = "" ]; then
FOUND=1
fi
if [ ${FOUND} -eq 1 ]; then
2014-12-03 14:22:58 +01:00
Display --indent 4 --text "- Checking for password protection" --result OK --color GREEN
2014-09-25 17:47:23 +02:00
logtext "Result: GRUB has password protection."
AddHP 4 4
2014-11-13 00:58:11 +01:00
else
2014-12-03 14:22:58 +01:00
Display --indent 4 --text "- Checking for password protection" --result WARNING --color RED
2014-11-13 00:58:11 +01:00
logtext "Result: Didn't find hashed password line in GRUB boot file!"
ReportSuggestion ${TEST_NO} "Set a password on GRUB bootloader to prevent altering boot configuration (e.g. boot in single user mode without password)"
AddHP 0 2
2014-09-25 17:47:23 +02:00
fi
else
logtext "Result: Can not read ${GRUBCONFFILE} (no permission)"
fi
fi
#
#################################################################################
2014-08-26 17:33:55 +02:00
#
# Test : BOOT-5124
# Description : Check for FreeBSD boot loader
Register --test-no BOOT-5124 --os FreeBSD --weight L --network NO --description "Check for FreeBSD boot loader presence"
if [ ${SKIPTEST} -eq 0 ]; then
if [ -f /boot/boot1 -a -f /boot/boot2 -a -f /boot/loader ]; then
logtext "Result: found boot1, boot2 and loader files in /boot"
2014-12-03 14:22:58 +01:00
Display --indent 2 --text "- Checking presence FreeBSD loader" --result FOUND --color GREEN
2014-08-26 17:33:55 +02:00
BOOT_LOADER="FreeBSD"
2014-09-22 23:39:31 +02:00
BOOT_LOADER_FOUND=1
2014-08-26 17:33:55 +02:00
else
logtext "Result: Not all expected files found in /boot"
fi
fi
#
#################################################################################
#
# Test : BOOT-5126
# Description : Check for NetBSD boot loader
Register --test-no BOOT-5126 --os NetBSD --weight L --network NO --description "Check for NetBSD boot loader presence"
if [ ${SKIPTEST} -eq 0 ]; then
if [ -f /boot.${HARDWARE} -o -f /boot -o -f /ofwboot ]; then
logtext "Result: found NetBSD secondary bootstrap"
2014-12-03 14:22:58 +01:00
Display --indent 2 --text "- Checking presence NetBSD loader" --result FOUND --color GREEN
2014-08-26 17:33:55 +02:00
BOOT_LOADER="NetBSD"
2014-09-22 23:39:31 +02:00
BOOT_LOADER_FOUND=1
2014-08-26 17:33:55 +02:00
else
logtext "Result: NetBSD secondary bootstrap not found"
ReportException "${TEST_NO}:1" "No boot loader found on NetBSD"
fi
fi
#
#################################################################################
#
# Test : BOOT-5139
# Description : Check for LILO boot loader
# Notes : password= or password =
Register --test-no BOOT-5139 --weight L --network NO --description "Check for LILO boot loader presence"
if [ ${SKIPTEST} -eq 0 ]; then
2014-09-09 14:49:37 +02:00
LILOCONFFILE="/etc/lilo.conf"
2014-09-15 12:01:09 +02:00
logtext "Test: checking for presence LILO configuration file"
2014-09-09 14:49:37 +02:00
if [ -f ${LILOCONFFILE} ]; then
FileIsReadable ${LILOCONFFILE}
if [ ${CANREAD} -eq 1 ]; then
BOOT_LOADER="LILO"
2014-09-22 23:39:31 +02:00
BOOT_LOADER_FOUND=1
2014-12-03 14:22:58 +01:00
Display --indent 2 --text "- Checking presence LILO" --result "OK" --color GREEN
2014-09-15 12:01:09 +02:00
logtext "Checking password option LILO"
2014-09-09 14:49:37 +02:00
FIND=`cat ${LILOCONFFILE} | ${EGREPBINARY} 'password[[:space:]]?=' | grep -v "^#"`
if [ "${FIND}" = "" ]; then
2014-12-03 14:22:58 +01:00
Display --indent 4 --text "- Password option presence " --result "WARNING" --color RED
2014-09-09 14:49:37 +02:00
logtext "Result: no password set for LILO. Bootloader is unprotected to"
logtext "dropping to single user mode or unauthorized access to devices/data."
ReportSuggestion ${TEST_NO} "Add a password to LILO, by adding a line to the lilo.conf file, above the first line saying 'image=<name>': password=<password>"
ReportWarning ${TEST_NO} "M" "No password set on LILO bootloader"
AddHP 0 2
else
2014-12-03 14:22:58 +01:00
Display --indent 4 --text "- Password option presence " --result "OK" --color GREEN
2014-09-09 14:49:37 +02:00
logtext "Result: LILO password option set"
AddHP 4 4
fi
#YYY (making /etc/lilo.conf immutable is a good idea, chattr +i /etc/lilo.conf)
2014-08-26 17:33:55 +02:00
else
2014-09-15 10:52:06 +02:00
logtext "Result: can not read ${LILOCONFFILE} (no permission)"
2014-08-26 17:33:55 +02:00
fi
else
logtext "Result: LILO configuration file not found"
fi
fi
#
#################################################################################
#
# Test : BOOT-5142
# Description : Check for SILO boot loader
Register --test-no BOOT-5142 --weight L --network NO --description "Check SPARC Improved boot loader (SILO)"
if [ ${SKIPTEST} -eq 0 ]; then
if [ -f /etc/silo.conf ]; then
logtext "Result: Found SILO configuration file (/etc/silo.conf)"
2014-12-03 14:22:58 +01:00
Display --indent 2 --text "- Checking boot loader SILO" --result FOUND --color GREEN
2014-08-26 17:33:55 +02:00
BOOT_LOADER="SILO"
2014-09-22 23:39:31 +02:00
BOOT_LOADER_FOUND=1
2014-08-26 17:33:55 +02:00
else
logtext "Result: no SILO configuration file found."
fi
fi
#
#################################################################################
#
# Test : BOOT-5144
# Description : Check for SILO boot loader consistency
# Notes : To be tested on Gentoo
# Register --test-no BOOT-5144 --weight L --network NO --description "Check SPARC Improved boot loader (SILO)"
# if [ ${SKIPTEST} -eq 0 ]; then
# if [ -f /etc/silo.conf -a -x /sbin/silo ]; then
# FIND=`/sbin/silo | grep "appears to be valid"`
# if [ ! "${FIND}" = "" ]; then
# logtext "Result: Found SILO configuration file (/etc/silo.conf)"
# Display --indent 6 --text "- Checking SILO consistency" --result OK --color GREEN
# else
# logtext "Result: no positive result received from silo binary"
# ReportWarning ${TEST_NO} "Possible issue with boot loader (SILO)"
# Display --indent 6 --text "- Checking SILO consistency" --result WARNING --color RED
# fi
# fi
# fi
#
#################################################################################
#
# Test : BOOT-5155
# Description : Check for YABOOT boot loader
Register --test-no BOOT-5155 --weight L --network NO --description "Check for YABOOT boot loader configuration file"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: Check for /etc/yaboot.conf"
if [ -f /etc/yaboot.conf ]; then
logtext "Result: Found YABOOT configuration file (/etc/yaboot.conf)"
Display --indent 4 --text "- Checking boot loader YABOOT" --result FOUND --color GREEN
#YYY add permission check
BOOT_LOADER="YABOOT"
2014-09-22 23:39:31 +02:00
BOOT_LOADER_FOUND=1
2014-08-26 17:33:55 +02:00
else
logtext "Result: no YABOOT configuration file found."
fi
fi
#
#################################################################################
#
# Test : BOOT-5159
# Description : Check for OpenBSD boot loader
2014-11-04 00:29:44 +01:00
# More info : Only OpenBSD
2014-11-04 01:36:56 +01:00
Register --test-no BOOT-5159 --os OpenBSD --weight L --network NO --description "Check for OpenBSD boot loader presence"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
2014-11-04 00:29:44 +01:00
FOUND=0
# Boot files
# /usr/mdec/biosboot: first stage bootstrap
# /boot : second stage bootstrap
if [ -f /usr/mdec/biosboot -a -f /boot ]; then
FOUND=1
fi
# Configuration file
2014-08-26 17:33:55 +02:00
if [ -f /etc/boot.conf ]; then
2014-11-04 00:29:44 +01:00
FOUND=1
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking /etc/boot.conf" --result "FOUND" --color GREEN
2014-08-26 17:33:55 +02:00
FIND=`grep '^boot' /etc/boot.conf`
if [ "${FIND}" = "" ]; then
2014-09-15 12:01:09 +02:00
Display --indent 4 --text "- Checking boot option" --result WARNING --color RED
2014-09-22 23:39:31 +02:00
#ReportSuggestion ${TEST_NO} "Add 'boot' to the /etc/boot.conf file to disable the default 5 seconds waiting time, to disallow booting into single user mode."
2014-08-26 17:33:55 +02:00
ReportWarning ${TEST_NO} "M" "System can be booted into single user mode without password"
else
2014-09-15 12:01:09 +02:00
Display --indent 4 --text "- Checking boot option" --result OK --color GREEN
2014-08-26 17:33:55 +02:00
logtext "Ok, boot option is enabled."
fi
else
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking /etc/boot.conf" --result "NOT FOUND" --color YELLOW
2014-08-26 17:33:55 +02:00
logtext "Result: no /etc/boot.conf found. When using the default boot loader, physical"
logtext "access to the server can be used to possibly enter single user mode."
ReportSuggestion ${TEST_NO} "Add 'boot' to the /etc/boot.conf file to disable the default 5 seconds waiting time."
fi
2014-11-04 00:29:44 +01:00
if [ ${FOUND} -eq 1 ]; then
2014-11-04 01:36:56 +01:00
logtext "Result: found OpenBSD boot loader"
2014-11-04 00:29:44 +01:00
BOOT_LOADER="OpenBSD"
BOOT_LOADER_FOUND=1
fi
2014-08-26 17:33:55 +02:00
fi
#
#################################################################################
2014-09-22 23:39:31 +02:00
#
if [ ${BOOT_LOADER_FOUND} -eq 0 ]; then
# Your boot loader is not detected. Want to help supporting it, see the README
ReportException "BOOTLOADER" "No boot loader found"
Display --indent 4 --text "- Boot loader" --result "NONE FOUND" --color RED
fi
#
#################################################################################
2014-08-26 17:33:55 +02:00
#
# Test : BOOT-5165
# Description : Check for FreeBSD boot services
Register --test-no BOOT-5165 --os FreeBSD --weight L --network NO --description "Check for FreeBSD boot services"
if [ ${SKIPTEST} -eq 0 ]; then
# FreeBSD (Read /etc/rc.conf file for enabled services)
2014-09-15 12:01:09 +02:00
logtext "Searching for services at startup (rc.conf)"
2014-08-26 17:33:55 +02:00
FIND=`egrep -v -i '^#|none' /etc/rc.conf | egrep -i '_enable.*(yes|on|1)' | sort | awk -F= '{ print $1 }' | sed 's/_enable//'`
N=0
for I in ${FIND}; do
logtext "Found service (rc.conf): ${I}"
report "boottask[]=${I}"
N=`expr ${N} + 1`
done
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking services at startup (rc.conf)" --result "DONE" --color GREEN
2014-08-26 17:33:55 +02:00
Display --indent 6 --text "Result: found $N services/options set"
logtext "Found $N services/options to run at startup"
fi
#
#################################################################################
#
# Test : BOOT-5166
# Description : Check for /etc/rc.local file (and contents)
#
#################################################################################
#
# Test : BOOT-5177
# Description : Check for Linux boot services (systemd and chkconfig)
# Notes : We skip using chkconfig if systemd is being used.
Register --test-no BOOT-5177 --os Linux --weight L --network NO --description "Check for Linux boot and running services"
if [ ${SKIPTEST} -eq 0 ]; then
CHECKED=0
logtext "Test: checking presence systemctl binary"
# Determine if we have systemctl on board
if [ ! "${SYSTEMCTLBINARY}" = "" ]; then
logtext "Result: systemctl binary found, trying that to discover information"
# Running services
logtext "Searching for running services (systemctl services only)"
FIND=`${SYSTEMCTLBINARY} --full --type=service | awk '{ if ($4=="running") { print $1 } }' | awk -F. '{ print $1 }'`
N=0
report "running_service_tool=systemctl"
for I in ${FIND}; do
logtext "Found running service: ${I}"
report "running_service[]=${I}"
N=`expr ${N} + 1`
done
2014-09-21 13:05:14 +02:00
logtext "Note: Run systemctl --full --type=service to see all services"
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Check running services (systemctl)" --result "DONE" --color GREEN
2014-08-26 17:33:55 +02:00
Display --indent 8 --text "Result: found $N running services"
logtext "Result: Found $N enabled services"
# Services at boot
logtext "Searching for enabled services (systemctl services only)"
FIND=`${SYSTEMCTLBINARY} list-unit-files --type=service | awk '{ if ($2=="enabled") { print $1 } }' | awk -F. '{ print $1 }'`
N=0
report "boot_service_tool=systemctl"
for I in ${FIND}; do
logtext "Found enabled service at boot: ${I}"
report "boot_service[]=${I}"
N=`expr ${N} + 1`
done
2014-09-21 13:05:14 +02:00
logtext "Note: Run systemctl list-unit-files --type=service to see all services"
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Check enabled services at boot (systemctl)" --result "DONE" --color GREEN
2014-08-26 17:33:55 +02:00
Display --indent 8 --text "Result: found $N enabled services"
logtext "Result: Found $N running services"
else
logtext "Result: systemctl binary not found, checking chkconfig binary"
if [ ! "${CHKCONFIGBINARY}" = "" ]; then
logtext "Result: chkconfig binary found, trying that to discover information"
2014-09-15 12:01:09 +02:00
logtext "Searching for services at startup (chkconfig, runlevel 3 and 5)"
2014-08-26 17:33:55 +02:00
FIND=`${CHKCONFIGBINARY} --list | egrep '3:on|5:on' | awk '{ print $1 }'`
N=0
report "boot_service_tool=chkconfig"
for I in ${FIND}; do
logtext "Found service (at boot, runlevel 3 or 5): ${I}"
report "boot_service[]=${I}"
N=`expr ${N} + 1`
done
logtext "Suggestion: Run chkconfig --list to see all services and disable unneeded services"
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Check services at startup (chkconfig)" --result "DONE" --color GREEN
2014-08-26 17:33:55 +02:00
Display --indent 8 --text "Result: found $N services"
logtext "Result: Found $N services at startup"
else
logtext "Result: both systemctl and chkconfig not found. Skipping this test"
fi
fi
fi
#
#################################################################################
#
# Test : BOOT-5178
# Description : Check for Linux boot services (Red Hat style)
# if [ ! "${CHKCONFIGBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
# Register --test-no BOOT-5178 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --description "Check for unneeded Linux boot services (Red Hat style)"
# if [ ${SKIPTEST} -eq 0 ]; then
# N=0
# N=`expr ${N} + 1`
#* mctrans (if selinux is NOT enabled)
#* restorecond (if selinux is NOT enabled) --> and is it really needed?
#
# if profile is server, warn if found:
#* pcscd (if profile=server)
#* avahi-daemon
# Redhat: /etc/sysconfig/network
# check if NOZEROCONF=yes is available
#
#* xfs (if /usr/bin/startx is not found)
#
#if [ ! -f /etc/mdadm.conf -a ! -f /etc/mdadm/mdadm.conf ]; then
#* mdmonitor
#
#
#* firstboot
# Display warning if [ ! -f /etc/reconfigSys ]
# AND "RUN_FIRSTBOOT=YES" is NOT in /etc/sysconfig/firstboot
#
#* acpid
# Display warning if no modules are loaded (lsmod | grep -i acpi)
#
#
# fi
#
#################################################################################
#
# Test : BOOT-5180
# Description : Check for Linux boot services (Debian style)
if [ "${LINUX_VERSION}" = "Debian" -o "${LINUX_VERSION}" = "Ubuntu" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no BOOT-5180 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --description "Check for Linux boot services (Debian style)"
if [ ${SKIPTEST} -eq 0 ]; then
# YYY runlevel check
sRUNLEVEL=`${RUNLEVELBINARY} | grep "N 2"`
if [ ! "${sRUNLEVEL}" = "" ]; then
FIND=`find /etc/rc2.d -type l -print | cut -d '/' -f4 | sed "s/S[0-9][0-9]//g" | sort`
if [ ! "${FIND}" = "" ]; then
N=0
for I in ${FIND}; do
logtext "Found service (at boot, runlevel 2): ${I}"
N=`expr ${N} + 1`
done
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Check services at startup (rc2.d)" --result "DONE" --color WHITE
2014-08-26 17:33:55 +02:00
Display --indent 4 --text "Result: found $N services"
logtext "Found $N services"
fi
else
ReportSuggestion ${TEST_NO} "Determine runlevel and services at startup"
fi
fi
#
#################################################################################
#
# Test : BOOT-5184
# Description : Check world writable startup scripts
Register --test-no BOOT-5184 --os Linux --weight L --network NO --description "Check permissions for boot files/scripts"
if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0
CHECKDIRS="/etc/init.d /etc/rc.d /etc/rcS.d"
logtext "Result: checking /etc/init.d scripts for writable bit"
for I in ${CHECKDIRS}; do
logtext "Test: checking if directory ${I} exists"
if [ -d ${I} ]; then
logtext "Result: directory ${I} found"
logtext "Test: checking for available files in directory"
FIND=`find ${I} -type f -print`
if [ ! "${FIND}" = "" ]; then
logtext "Result: found files in directory, checking permissions now"
for J in ${FIND}; do
logtext "Test: checking permissions of file ${J}"
IsWorldWritable ${J}
2015-03-25 17:30:13 +01:00
if [ $? -eq 1 ]; then
2014-08-26 17:33:55 +02:00
logtext "Result: warning, file ${J} is world writable"
FOUND=1
else
logtext "Result: good, file ${J} not world writable"
fi
done
else
logtext "Result: found no files in directory."
fi
else
logtext "Result: directory ${I} not found. Skipping.."
fi
done
# /etc/rc[0-6].d
for NO in 0 1 2 3 4 5 6; do
logtext "Test: Checking /etc/rc${NO}.d scripts for writable bit"
if [ -d /etc/rc${NO}.d ]; then
FIND=`find /etc/rc${NO}.d -type f -print`
for I in ${FIND}; do
IsWorldWritable ${I}
2015-03-25 17:30:13 +01:00
if [ $? -eq 1 ]; then
2014-08-26 17:33:55 +02:00
logtext "Result: warning, file ${I} is world writable"
FOUND=1
else
logtext "Result: good, file ${I} not world writable"
fi
done
fi
done
# Other files
CHECKFILES="/etc/rc /etc/rc.local /etc/rc.d/rc.sysinit"
for I in ${CHECKFILES}; do
if [ -f ${I} ]; then
logtext "Test: Checking ${I} file for writable bit"
IsWorldWritable ${I}
2015-03-25 17:30:13 +01:00
if [ $? -eq 1 ]; then
2014-08-26 17:33:55 +02:00
ReportWarning ${TEST_NO} "H" "Found writable startup script ${I}"
FOUND=1
logtext "Result: warning, file ${I} is world writable"
else
logtext "Result: good, file ${I} not world writable"
fi
fi
done
# Check results
if [ ${FOUND} -eq 1 ]; then
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Check startup files (permissions)" --result "WARNING" --color RED
2015-03-25 17:30:13 +01:00
ReportWarning ${TEST_NO} "H" "Found world writable startup scripts"
2014-08-26 17:33:55 +02:00
logtext "Result: found one or more scripts which are possibly writable by other users"
AddHP 0 3
else
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Check startup files (permissions)" --result "OK" --color GREEN
2014-08-26 17:33:55 +02:00
AddHP 3 3
fi
fi
#
#################################################################################
#
# Add autostart services, like from KDE/Gnome
# Test : BOOT-5102
# Description : Check for tasks which are autostarted via /etc/inittab
#Register --test-no BOOT-5102 --weight L --network NO --description "Check inittab for services"
#if [ ${SKIPTEST} -eq 0 ]; then
#fi
#YYY check against static list?
#
#################################################################################
#
# Test : BOOT-5202
# Description : Check uptime of system
Register --test-no BOOT-5202 --weight L --network NO --description "Check uptime of system"
if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0
FIND=""
case "${OS}" in
Linux)
2014-11-04 01:04:28 +01:00
# Idle time, not real uptime
if [ -f /proc/uptime ]; then
FIND=`cat /proc/uptime | cut -d ' ' -f1 | cut -d '.' -f1`
else
Display --indent 2 --text "- Checking uptime" --result SKIPPED --color YELLOW
ReportException "${TEST_NO}:1" "No uptime test available for this operating system (/proc/uptime missing)"
fi
;;
2014-11-04 01:36:56 +01:00
2014-12-09 18:11:21 +01:00
DragonFly|FreeBSD|MacOS)
2014-11-04 01:04:28 +01:00
if [ ! "${SYSCTLBINARY}" = "" ]; then
2014-12-05 17:11:59 +01:00
FIND=`${SYSCTLBINARY} kern.boottime | awk '{ print $5 }' | sed -e 's/,//' | grep "[0-9]"`
2014-11-04 01:04:28 +01:00
else
Display --indent 2 --text "- Checking uptime" --result SKIPPED --color YELLOW
ReportException "${TEST_NO}:4" "No uptime test available for this operating system (sysctl missing)"
fi
;;
2014-12-03 14:22:58 +01:00
NetBSD|OpenBSD)
2014-11-04 01:04:28 +01:00
if [ ! "${SYSCTLBINARY}" = "" ]; then
TIME_BOOT=`${SYSCTLBINARY} -n kern.boottime`
2014-11-04 02:23:43 +01:00
TIME_NOW=`date "+%s"`
2014-11-04 01:04:28 +01:00
logtext "Boot time: ${TIME_BOOT}"
logtext "Current time: ${TIME_NOW}"
2014-11-04 02:23:43 +01:00
if [ ! "${TIME_BOOT}" = "" -a ! "${TIME_NOW}" = "" ]; then
2014-11-04 01:04:28 +01:00
UPTIME_IN_SECS=`expr ${TIME_NOW} - ${TIME_BOOT}`
else
ReportException "${TEST_NO}:5" "Most likely kern.boottime empty, unable to determine uptime"
fi
else
Display --indent 2 --text "- Checking uptime" --result SKIPPED --color YELLOW
ReportException "${TEST_NO}:4" "No uptime test available for this operating system (sysctl missing)"
fi
;;
2014-09-25 19:00:36 +02:00
2014-08-26 17:33:55 +02:00
Solaris)
2014-11-04 01:04:28 +01:00
if [ ! "${KSTATBINARY}" = "" ]; then
FIND=`${KSTATBINARY} -p unix:0:system_misc:snaptime | grep "^unix" | awk '{print $2}' | cut -d "." -f1`
else
Display --indent 2 --text "- Checking uptime" --result SKIPPED --color YELLOW
ReportException "${TEST_NO}:2" "No uptime test available for this operating system (kstat missing)"
fi
;;
2014-08-26 17:33:55 +02:00
*)
2014-11-04 01:04:28 +01:00
Display --indent 2 --text "- Checking uptime" --result SKIPPED --color YELLOW
2014-08-26 17:33:55 +02:00
2014-11-04 01:04:28 +01:00
# Want to help improving Lynis? Share your operating system and a way to determine the uptime (in seconds)
ReportException "${TEST_NO}:3" "No uptime test available yet for this operating system"
;;
2014-08-26 17:33:55 +02:00
esac
if [ ! "${FIND}" = "" ]; then
UPTIME_IN_SECS="${FIND}"
UPTIME_IN_DAYS=`expr ${UPTIME_IN_SECS} / 60 / 60 / 24`
logtext "Uptime (in seconds): ${UPTIME_IN_SECS}"
logtext "Uptime (in days): ${UPTIME_IN_DAYS}"
2014-09-25 19:00:36 +02:00
report "uptime_in_seconds=${UPTIME_IN_SECS}"
report "uptime_in_days=${UPTIME_IN_DAYS}"
2014-08-26 17:33:55 +02:00
else
logtext "Result: no uptime information available"
fi
fi
#
#################################################################################
#
2014-12-09 18:11:21 +01:00
# Test : BOOT-5260
# Description : Check single user mode for systemd
Register --test-no BOOT-5260 --weight L --network NO --description "Check single user mode for systemd"
if [ ${SKIPTEST} -eq 0 ]; then
# Check if file exists
logtext "Test: Searching /usr/lib/systemd/system/rescue.service"
if [ -f /usr/lib/systemd/system/rescue.service ]; then
logtext "Result: file /usr/lib/systemd/system/rescue.service"
logtext "Test: checking presence sulogin for single user mode"
2015-04-27 09:07:45 +02:00
FIND=`egrep "^ExecStart=-(/bin/sh -c \")?(/usr)?/(s)?bin/sulogin" /usr/lib/systemd/system/rescue.service`
2014-12-09 18:11:21 +01:00
if [ ! "${FIND}" = "" ]; then
FOUND=1
logtext "Result: found sulogin, so single user is protected"
AddHP 3 3
else
logtext "Result: did not find sulogin in rescue.service"
AddHP 1 3
Display --indent 2 --text "- Checking sulogin in rescue.service" --result "NOT FOUND" --color YELLOW
2015-02-13 15:09:37 +01:00
ReportSuggestion "${TEST_NO}" "Protect rescue.service by using sulogin"
2014-12-09 18:11:21 +01:00
fi
else
logtext "Result: file /usr/lib/systemd/system/rescue.service does not exist"
fi
fi
#
#################################################################################
#
2014-08-26 17:33:55 +02:00
report "boot_loader=${BOOT_LOADER}"
2014-12-02 13:55:06 +01:00
report "service_manager=${SERVICE_MANAGER}"
2014-08-26 17:33:55 +02:00
wait_for_keypress
#
#================================================================================
2015-03-25 17:30:13 +01:00
# Lynis - Copyright 2007-2015, Michael Boelen, CISOfy - https://cisofy.com
