2014-08-26 17:33:55 +02:00
|
|
|
#!/bin/sh
|
|
|
|
|
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
# Lynis
|
|
|
|
|
# ------------------
|
|
|
|
|
#
|
|
|
|
|
# Copyright 2007-2014, Michael Boelen (michael@rootkit.nl), The Netherlands
|
|
|
|
|
# Web site: http://www.rootkit.nl
|
|
|
|
|
#
|
|
|
|
|
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
|
|
|
|
|
# welcome to redistribute it under the terms of the GNU General Public License.
|
|
|
|
|
# See LICENSE file for usage of this software.
|
|
|
|
|
#
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
# SSH
|
|
|
|
|
#
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
SSH_DAEMON_CONFIG_LOCS="/etc /etc/ssh /usr/local/etc/ssh /opt/csw/etc/ssh"
|
|
|
|
|
SSH_DAEMON_CONFIG=""
|
|
|
|
|
SSH_DAEMON_PORT=""
|
|
|
|
|
SSH_DAEMON_RUNNING=0
|
|
|
|
|
#
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
InsertSection "SSH Support"
|
|
|
|
|
#
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
# Test : SSH-7402
|
|
|
|
|
# Description : Check for a running SSH daemon
|
|
|
|
|
Register --test-no SSH-7402 --weight L --network NO --description "Check for running SSH daemon"
|
|
|
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
|
|
|
logtext "Test: Searching for a SSH daemon..."
|
|
|
|
|
IsRunning sshd
|
|
|
|
|
if [ ${RUNNING} -eq 1 ]; then
|
|
|
|
|
SSH_DAEMON_RUNNING=1
|
|
|
|
|
Display --indent 2 --text "- Checking running SSH daemon..." --result FOUND --color GREEN
|
|
|
|
|
else
|
|
|
|
|
Display --indent 2 --text "- Checking running SSH daemon..." --result "NOT FOUND" --color WHITE
|
|
|
|
|
fi
|
|
|
|
|
fi
|
|
|
|
|
#
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
# Test : SSH-7404
|
|
|
|
|
# Description : Determine SSH daemon configuration file location
|
|
|
|
|
if [ ${SSH_DAEMON_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
|
|
|
Register --test-no SSH-7404 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH daemon file location"
|
|
|
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
|
|
|
FOUND=0
|
|
|
|
|
logtext "Action: searching for sshd_config file"
|
|
|
|
|
for I in ${SSH_DAEMON_CONFIG_LOCS}; do
|
|
|
|
|
if [ -f "${I}/sshd_config" ]; then
|
|
|
|
|
logtext "Result: ${I}/sshd_config exists"
|
|
|
|
|
if [ ${FOUND} -eq 1 ]; then
|
|
|
|
|
ReportException "${TEST_NO}:01"
|
|
|
|
|
logtext "Result: we already had found another sshd_config file. Using this new file then."
|
|
|
|
|
fi
|
2014-09-09 14:49:37 +02:00
|
|
|
FileIsReadable ${I}/sshd_config
|
|
|
|
|
if [ ${CANREAD} -eq 1 ]; then
|
|
|
|
|
FOUND=1
|
|
|
|
|
SSH_DAEMON_CONFIG="${I}/sshd_config"
|
|
|
|
|
else
|
2014-09-15 10:52:06 +02:00
|
|
|
logtext "Result: can not read ${I}/sshd_config file (no permission)"
|
2014-09-09 14:49:37 +02:00
|
|
|
fi
|
|
|
|
|
fi
|
|
|
|
|
done
|
|
|
|
|
if [ "${SSH_DAEMON_CONFIG}" = "" ]; then
|
|
|
|
|
logtext "Result: No sshd configuration found"
|
|
|
|
|
Display --indent 4 --text "- Searching SSH configuration..." --result "NOT FOUND" --color YELLOW
|
|
|
|
|
ReportException "${TEST_NO}:1" "SSH daemon is running, but no readable configuration file found"
|
|
|
|
|
else
|
|
|
|
|
logtext "Result: using last found configuration file: ${SSH_DAEMON_CONFIG}"
|
|
|
|
|
Display --indent 4 --text "- Searching SSH configuration..." --result FOUND --color GREEN
|
|
|
|
|
fi
|
2014-08-26 17:33:55 +02:00
|
|
|
fi
|
|
|
|
|
#
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
# # Test : SSH-7406
|
|
|
|
|
# # Description : Check for a running SSH daemon
|
|
|
|
|
# if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
|
|
|
# Register --test-no SSH-7406 --preqs-met ${PREQS_MET} --weight L --network NO --description "SSH daemon listening port"
|
|
|
|
|
# if [ ${SKIPTEST} -eq 0 ]; then
|
|
|
|
|
# logtext "Test: Searching for a SSH daemon..."
|
|
|
|
|
# CheckOption "^Port " ${SSH_DAEMON_CONFIG}
|
|
|
|
|
# if [ ${FOUND} -eq 1 ]; then
|
|
|
|
|
# FIND=`echo ${FIND} | awk '{ if ($1=="Port") { print $2 }}'`
|
|
|
|
|
# # Check if this output is numeric and usuable for later (e.g. in netstat output)
|
|
|
|
|
# Display --indent 2 --text "- Checking SSH listening port..." --result FOUND --color GREEN
|
|
|
|
|
# logtext "Result: setting port number to ${FIND}"
|
|
|
|
|
# SSH_DAEMON_PORT="${FIND}"
|
|
|
|
|
# else
|
|
|
|
|
# Display --indent 2 --text "- Checking SSH listening port..." --result "NOT FOUND" --color WHITE
|
|
|
|
|
# logtext "Result: setting port to default number, as no other port has been configured"
|
|
|
|
|
# SSH_DAEMON_PORT="22"
|
|
|
|
|
# fi
|
|
|
|
|
# fi
|
|
|
|
|
#
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
# Test : SSH-7408
|
|
|
|
|
# Description : Check SSH specific defined options
|
|
|
|
|
if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
|
|
|
Register --test-no SSH-7408 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH defined options"
|
|
|
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
|
|
|
logtext "Test: Checking all specific defined options in ${SSH_DAEMON_CONFIG}"
|
|
|
|
|
FIND=`cat ${SSH_DAEMON_CONFIG} | grep -v "^#" | grep -v "^$" | ${AWKBINARY} '{gsub("\t"," ");print}' | sed 's/ /!space!/g'`
|
|
|
|
|
for I in ${FIND}; do
|
|
|
|
|
I=`echo ${I} | sed 's/!space!/ /g'`
|
|
|
|
|
logtext "Found SSH option: ${I}"
|
|
|
|
|
done
|
|
|
|
|
Display --indent 4 --text "- Checking defined SSH options..." --result "DONE" --color GREEN
|
|
|
|
|
fi
|
|
|
|
|
#
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
# Test : SSH-7412
|
|
|
|
|
# Description : Check SSH PermitRootLogin option
|
|
|
|
|
if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
|
|
|
Register --test-no SSH-7412 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH option: PermitRootLogin"
|
|
|
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
2014-09-09 14:49:37 +02:00
|
|
|
logtext "Test: check PermitRootLogin option"
|
|
|
|
|
FIND=`cat ${SSH_DAEMON_CONFIG} | grep "^PermitRootLogin" | awk '{ print $2 }'`
|
|
|
|
|
if [ "${FIND}" = "yes" -o "${FIND}" = "YES" -o "${FIND}" = "Yes" ]; then
|
|
|
|
|
logtext "Result: PermitRootLogin is enabled, root can login directly"
|
|
|
|
|
Display --indent 4 --text "- SSH option: PermitRootLogin..." --result WARNING --color RED
|
2014-08-26 17:33:55 +02:00
|
|
|
ReportWarning ${TEST_NO} "M" "Root can directly login via SSH"
|
2014-09-09 14:49:37 +02:00
|
|
|
AddHP 0 3
|
|
|
|
|
else
|
|
|
|
|
# YYY add test for DenyUsers root
|
|
|
|
|
if [ "${FIND}" = "no" -o "${FIND}" = "No" ]; then
|
|
|
|
|
logtext "Result: PermitRootLogin is disabled. Root can't login directly"
|
|
|
|
|
Display --indent 4 --text "- SSH option: PermitRootLogin..." --result DISABLED --color GREEN
|
|
|
|
|
AddHP 3 3
|
|
|
|
|
else
|
|
|
|
|
logtext "Result: Value of PermitRootLogin is unknown (not defined)"
|
|
|
|
|
Display --indent 4 --text "- SSH option: PermitRootLogin..." --result DEFAULT --color WHITE
|
|
|
|
|
fi
|
|
|
|
|
fi
|
2014-08-26 17:33:55 +02:00
|
|
|
fi
|
|
|
|
|
#
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
# Test : SSH-7414
|
|
|
|
|
# Description : Check SSH Protocol option
|
|
|
|
|
if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
|
|
|
Register --test-no SSH-7414 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH option: Protocol"
|
|
|
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
2014-09-09 14:49:37 +02:00
|
|
|
logtext "Test: check allowed SSH protocol versions"
|
|
|
|
|
FIND=`cat ${SSH_DAEMON_CONFIG} | grep "^Protocol" | awk '{ print $2 }'`
|
|
|
|
|
if [ "${FIND}" = "1" -o "${FIND}" = "2,1" -o "${FIND}" = "1,2" ]; then
|
|
|
|
|
logtext "Result: Protocol option is set to allow SSH protocol version 1"
|
|
|
|
|
Display --indent 4 --text "- SSH option: Protocol..." --result WARNING --color RED
|
2014-08-26 17:33:55 +02:00
|
|
|
ReportWarning ${TEST_NO} "M" "SSH protocol version 1 is allowed"
|
2014-09-09 14:49:37 +02:00
|
|
|
AddHP 0 3
|
|
|
|
|
else
|
|
|
|
|
if [ "${FIND}" = "2" ]; then
|
|
|
|
|
logtext "Result: only protocol 2 is allowed"
|
|
|
|
|
Display --indent 4 --text "- SSH option: Protocol..." --result OK --color GREEN
|
|
|
|
|
AddHP 3 3
|
|
|
|
|
else
|
|
|
|
|
logtext "Result: value of Protocol is unknown (not defined)"
|
|
|
|
|
Display --indent 4 --text "- SSH option: Protocol..." --result DEFAULT --color WHITE
|
|
|
|
|
fi
|
|
|
|
|
fi
|
2014-08-26 17:33:55 +02:00
|
|
|
fi
|
|
|
|
|
#
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
# Test : SSH-7416
|
|
|
|
|
# Description : Check SSH StrictModes option
|
|
|
|
|
if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
|
|
|
Register --test-no SSH-7416 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH option: StrictModes"
|
|
|
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
2014-09-09 14:49:37 +02:00
|
|
|
logtext "Test: Check configured StrictModes option"
|
|
|
|
|
FIND=`cat ${SSH_DAEMON_CONFIG} | grep "^StrictModes" | awk '{ print $2 }'`
|
|
|
|
|
if [ "${FIND}" = "no" -o "${FIND}" = "NO" -o "${FIND}" = "No" ]; then
|
|
|
|
|
logtext "Result: StrictModes option is set to 'no', which means file permissions are NOT checked"
|
|
|
|
|
Display --indent 4 --text "- SSH option: StrictModes..." --result WARNING --color RED
|
2014-08-26 17:33:55 +02:00
|
|
|
ReportWarning ${TEST_NO} "M" "StrictModes is turned off"
|
2014-09-09 14:49:37 +02:00
|
|
|
ReportSuggestion ${TEST_NO} "Check StrictModes option in sshd_config"
|
|
|
|
|
AddHP 0 3
|
|
|
|
|
else
|
|
|
|
|
if [ "${FIND}" = "yes" -o "${FIND}" = "YES" -o "${FIND}" = "Yes" ]; then
|
|
|
|
|
logtext "Result: StrictModes active, file permissions are checked"
|
|
|
|
|
Display --indent 4 --text "- SSH option: StrictModes..." --result OK --color GREEN
|
|
|
|
|
AddHP 3 3
|
|
|
|
|
else
|
|
|
|
|
logtext "Result: value of StrictModes is unknown (not defined)"
|
|
|
|
|
Display --indent 4 --text "- SSH option: StrictModes..." --result DEFAULT --color WHITE
|
|
|
|
|
fi
|
|
|
|
|
fi
|
2014-08-26 17:33:55 +02:00
|
|
|
fi
|
|
|
|
|
#
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
# Test : SSH-7418
|
|
|
|
|
# Description : Check SSH Port option
|
|
|
|
|
# if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
|
|
|
# Register --test-no SSH-7418 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH option: Port"
|
|
|
|
|
# if [ ${SKIPTEST} -eq 0 ]; then
|
|
|
|
|
# logtext "Test: check allowed SSH protocol versions"
|
|
|
|
|
# FIND=`cat ${SSH_DAEMON_CONFIG} | grep "^Port" | awk '{ if ($2!="22") { print $2 } }'`
|
|
|
|
|
# if [ "${FIND}" = "1" -o "${FIND}" = "2,1" -o "${FIND}" = "1,2" ]; then
|
|
|
|
|
# logtext "Result: Protocol option is set to allow SSH protocol version 1"
|
|
|
|
|
# Display --indent 4 --text "- SSH option: Protocol..." --result WARNING --color RED
|
|
|
|
|
# ReportWarning ${TEST_NO} "M" "SSH protocol version 1 is allowed"
|
|
|
|
|
# AddHP 0 3
|
|
|
|
|
# else
|
|
|
|
|
# if [ "${FIND}" = "2" ]; then
|
|
|
|
|
# logtext "Result: only protocol 2 is allowed"
|
|
|
|
|
# Display --indent 4 --text "- SSH option: Protocol..." --result OK --color GREEN
|
|
|
|
|
# AddHP 3 3
|
|
|
|
|
# else
|
|
|
|
|
# logtext "Result: value of Protocol is unknown (not defined)"
|
|
|
|
|
# Display --indent 4 --text "- SSH option: Protocol..." --result DEFAULT --color WHITE
|
|
|
|
|
# fi
|
|
|
|
|
# fi
|
|
|
|
|
# fi
|
|
|
|
|
#
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
# Test : SSH-7440
|
|
|
|
|
# Description : AllowUsers / AllowGroups
|
|
|
|
|
# Goal : Check if only a specific amount of users/groups can log in to the system
|
|
|
|
|
if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
|
|
|
Register --test-no SSH-7440 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH option: AllowUsers and AllowGroups"
|
|
|
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
|
|
|
FOUND=0
|
2014-09-09 14:49:37 +02:00
|
|
|
# AllowUsers
|
|
|
|
|
FIND=`egrep "^AllowUsers" ${SSH_DAEMON_CONFIG} | awk '{ print $2 }'`
|
|
|
|
|
if [ ! "${FIND}" = "" ]; then
|
|
|
|
|
logtext "Result: AllowUsers set, with value ${FIND}"
|
|
|
|
|
Display --indent 4 --text "- SSH option: AllowUsers..." --result FOUND --color GREEN
|
|
|
|
|
FOUND=1
|
|
|
|
|
else
|
|
|
|
|
logtext "Result: AllowUsers is not set"
|
|
|
|
|
Display --indent 4 --text "- SSH option: AllowUsers..." --result "NOT FOUND" --color WHITE
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
# AllowGroups
|
|
|
|
|
FIND=`egrep "^AllowGroups" ${SSH_DAEMON_CONFIG} | awk '{ print $2 }'`
|
|
|
|
|
if [ ! "${FIND}" = "" ]; then
|
|
|
|
|
logtext "Result: AllowUsers set ${FIND}"
|
|
|
|
|
Display --indent 4 --text "- SSH option: AllowGroups..." --result FOUND --color GREEN
|
|
|
|
|
FOUND=1
|
|
|
|
|
else
|
|
|
|
|
logtext "Result: AllowGroups is not set"
|
|
|
|
|
Display --indent 4 --text "- SSH option: AllowGroups..." --result "NOT FOUND" --color WHITE
|
|
|
|
|
fi
|
2014-08-26 17:33:55 +02:00
|
|
|
|
2014-09-09 14:49:37 +02:00
|
|
|
if [ ${FOUND} -eq 1 ]; then
|
|
|
|
|
logtext "Result: SSH is limited to a specific set of users, which is good"
|
|
|
|
|
AddHP 2 2
|
|
|
|
|
else
|
|
|
|
|
logtext "Result: SSH has no specific user or group limitation. Most likely all valid users can SSH to this machine."
|
|
|
|
|
AddHP 0 1
|
|
|
|
|
fi
|
2014-08-26 17:33:55 +02:00
|
|
|
fi
|
|
|
|
|
#
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
# Test : SSH-7464
|
|
|
|
|
# Description : HashKnownHosts
|
|
|
|
|
#if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
|
|
|
#Register --test-no SSH-7464 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH option: HashKnownHosts"
|
|
|
|
|
#if [ ${SKIPTEST} -eq 0 ]; then
|
|
|
|
|
# /etc/ssh/ssh_config
|
|
|
|
|
# ReportSuggestion ${TEST_NO} "HashKnownHosts option can migitate worm attacks"
|
|
|
|
|
#AddHP 2 2
|
|
|
|
|
#fi
|
|
|
|
|
#
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
# Test : SSH-7480
|
|
|
|
|
# Description : AllowUsers / AllowGroups
|
|
|
|
|
# Goal : Scan SSH daemon
|
|
|
|
|
#if [ ! ${SSHKEYSCANBINARY} = "" -a ${SSH_DAEMON_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
|
|
|
#Register --test-no SSH-7480 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH option: AllowUsers and AllowGroups"
|
|
|
|
|
#if [ ${SKIPTEST} -eq 0 ]; then
|
|
|
|
|
# First determine what port the local instance of SSH daemon is running on. If unknown, use port 22
|
|
|
|
|
# FIND=`${SSHKEYSCANBINARY} localhost 2>&1 | grep OpenSSH | egrep -i "bsd|debian|ubuntu|redhat"`
|
|
|
|
|
#
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
# sshd -T can provide additional insights
|
|
|
|
|
#
|
|
|
|
|
#################################################################################
|
|
|
|
|
#
|
|
|
|
|
report "ssh_daemon_running=${SSH_DAEMON_RUNNING}"
|
|
|
|
|
#report "ssh_daemon_port=${SSH_DAEMON_PORT}"
|
|
|
|
|
|
|
|
|
|
wait_for_keypress
|
|
|
|
|
|
|
|
|
|
#
|
|
|
|
|
#================================================================================
|
|
|
|
|
# Lynis - Copyright 2007-2014, Michael Boelen - www.rootkit.nl - The Netherlands
|
