2014-08-26 17:33:55 +02:00
#!/bin/sh
#################################################################################
#
# Lynis
# ------------------
#
2015-01-03 12:45:22 +01:00
# Copyright 2007-2015, Michael Boelen (michael@rootkit.nl), The Netherlands
2014-08-26 17:33:55 +02:00
# Web site: http://www.rootkit.nl
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Ports and packages
#
#################################################################################
#
InsertSection "Ports and packages"
PACKAGE_MGR_PKG=0
PKG_AUDIT_TOOL_FOUND=0
2015-01-03 12:45:22 +01:00
INSTALLED_PACKAGES=""
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Searching package managers"
2014-08-26 17:33:55 +02:00
# Test : PKGS-7301
# Description : Query FreeBSD pkg
if [ -x /usr/sbin/pkg ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7301 --preqs-met ${PREQS_MET} --weight L --network NO --description "Query NetBSD pkg"
if [ ${SKIPTEST} -eq 0 ]; then
FIND=`pkg -N 2>&1; echo $?`
if [ "${FIND}" = "0" ]; then
2014-09-15 12:01:09 +02:00
Display --indent 4 --text "- Searching packages with pkg" --result FOUND --color GREEN
2014-08-26 17:33:55 +02:00
report "package_manager[]=pkg"
PACKAGE_MGR_PKG=1
2015-01-03 12:45:22 +01:00
logtext "Result: Found pkg"
logtext "Test: Querying pkg to get package list"
Display --indent 6 --text "- Querying pkg for installed packages"
logtext "Output:"; logtext "-----"
SPACKAGES=`/usr/sbin/pkg query %n,%v`
for J in ${SPACKAGES}; do
sPKG_NAME=`echo ${J} | cut -d ',' -f1`
sPKG_VERSION=`echo ${J} | cut -d ',' -f2`
logtext "Installed package: ${sPKG_NAME} (version: ${sPKG_VERSION})"
INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${J}"
done
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : PKGS-7302
# Description : Query FreeBSD/NetBSD pkg_info
if [ -x /usr/sbin/pkg_info ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7302 --preqs-met ${PREQS_MET} --weight L --network NO --description "Query FreeBSD/NetBSD pkg_info"
if [ ${SKIPTEST} -eq 0 ]; then
N=0
2014-09-15 12:01:09 +02:00
Display --indent 4 --text "- Checking pkg_info" --result FOUND --color GREEN
2014-08-26 17:33:55 +02:00
logtext "Result: Found pkg_info"
report "package_manager[]=pkg_info"
2014-09-15 12:01:09 +02:00
logtext "Test: Querying pkg_info to get package list"
Display --indent 6 --text "- Querying pkg_info for installed packages"
2014-08-26 17:33:55 +02:00
logtext "Output:"; logtext "-----"
SPACKAGES=`/usr/sbin/pkg_info 2>&1 | sort | tr -s ' ' | cut -d ' ' -f1 | sed -e 's/^\(.*\)-\([0-9].*\)$/\1,\2/g'`
for J in ${SPACKAGES}; do
N=`expr ${N} + 1`
sPKG_NAME=`echo ${J} | cut -d ',' -f1`
sPKG_VERSION=`echo ${J} | cut -d ',' -f2`
logtext "Installed package: ${sPKG_NAME} (version: ${sPKG_VERSION})"
2015-01-03 12:45:22 +01:00
INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${J}"
2014-08-26 17:33:55 +02:00
done
report "installed_packages=${N}"
fi
#
#################################################################################
#
# Temporary disabled due false positives
# Packages like docbook, gcc, automake report multiple installed versions
# # Test : PKGS-7303
# # Description : Query FreeBSD pkg_info
# if [ -x /usr/sbin/pkg_info ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
# Register --test-no PKGS-7303 --preqs-met ${PREQS_MET} --weight L --network NO --description "Query FreeBSD for double installed packages"
# if [ ${SKIPTEST} -eq 0 ]; then
# SDOUBLEINSTALLED=`pkg_info | sort | sed -e 's/-[0-9].*$//' | uniq -c | grep -v '^[[:space:]]*1' | tr -s ' ' | cut -d ' ' -f3`
# if [ "${SDOUBLEINSTALLED}" = "" ]; then
2014-09-15 12:01:09 +02:00
# Display --indent 6 --text "- Querying pkg_info for double installed packages" --result OK --color GREEN
2014-08-26 17:33:55 +02:00
# logtext "Ok, no packages show up twice or more in the package listing."
# else
2014-09-15 12:01:09 +02:00
# Display --indent 6 --text "- Querying pkg_info for double installed packages" --result WARNING --color RED
2014-08-26 17:33:55 +02:00
# for J in ${SDOUBLEINSTALLED}; do
# ReportWarning ${TEST_NO} "M" "Found probably incorrect installed package (${J})"
# logtext "This package ${J} is visible twice or more in the pkg_info listing."
# ReportSuggestion ${TEST_NO} "(FreeBSD) run pkgdb -F and check this manually."
# ReportSuggestion ${TEST_NO} "(OpenBSD) check dependencies to see if one of the double "
# logtext "installed packages is unneeded."
# report "double_installed_package[]=${J}"
# done
# fi
# else
2014-09-15 12:01:09 +02:00
# Display --indent 4 --text "- Searching pkg_info" --result "NOT FOUND" --color WHITE
2014-08-26 17:33:55 +02:00
# logtext "Result: pkg_info can NOT be found on this system"
# fi
#
#################################################################################
2014-09-23 22:48:20 +02:00
#
# Test : PKGS-7304
# Description : Gentoo packages
2014-09-23 22:54:38 +02:00
if [ -x /usr/bin/emerge -a -x /usr/bin/equery ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7304 --preqs-met ${PREQS_MET} --weight L --network NO --description "Querying Gentoo packages"
if [ ${SKIPTEST} -eq 0 ]; then
2014-09-23 22:48:20 +02:00
Display --indent 4 --text "- Searching emerge" --result FOUND --color GREEN
logtext "Result: Found Gentoo emerge"
report "package_manager[]=emerge"
logtext "Test: Querying portage to get package list"
Display --indent 4 --text "- Querying portage for installed packages"
logtext "Output:"; logtext "-----"
GPACKAGES=`equery l '*' | sed -e 's/[.*]//g'`
for J in ${GPACKAGES}; do
logtext "Found package ${J}"
2015-01-03 12:45:22 +01:00
INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${J},0,"
2014-09-23 22:48:20 +02:00
done
else
logtext "Result: emerge can NOT be found on this system"
fi
#
#
#################################################################################
2014-08-26 17:33:55 +02:00
#
# Test : PKGS-7306
# Description : Solaris packages
if [ -x /usr/bin/pkginfo ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7306 --os Solaris --preqs-met ${PREQS_MET} --weight L --network NO --description "Querying Solaris packages"
if [ ${SKIPTEST} -eq 0 ]; then
2014-09-15 12:01:09 +02:00
Display --indent 4 --text "- Searching pkginfo" --result FOUND --color GREEN
2014-08-26 17:33:55 +02:00
logtext "Result: Found Solaris pkginfo"
report "package_manager[]=pkginfo"
logtext "Test: Querying pkginfo to get package list"
2014-09-15 12:01:09 +02:00
Display --indent 4 --text "- Querying pkginfo for installed packages"
2014-08-26 17:33:55 +02:00
logtext "Output:"; logtext "-----"
# Strip SUNW from strings
SPACKAGES=`/usr/bin/pkginfo -i | tr -s ' ' | cut -d ' ' -f2 | sed "s#^SUNW##"`
for J in ${SPACKAGES}; do
logtext "Found package ${J}"
2015-01-03 12:45:22 +01:00
INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${J},0,"
2014-08-26 17:33:55 +02:00
done
else
logtext "Result: pkginfo can NOT be found on this system"
fi
#
#
#################################################################################
#
# Test : PKGS-7308
# Description : RPM package based systems
if [ ! "${RPMBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7308 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking package list with RPM"
if [ ${SKIPTEST} -eq 0 ]; then
N=0
2014-09-15 12:01:09 +02:00
Display --indent 4 --text "- Searching RPM package manager" --result FOUND --color GREEN
2014-08-26 17:33:55 +02:00
logtext "Result: Found rpm binary (${RPMBINARY})"
report "package_manager[]=rpm"
logtext "Test: Querying 'rpm -qa' to get package list"
2014-09-15 12:01:09 +02:00
Display --indent 6 --text "- Querying RPM package manager"
2014-08-26 17:33:55 +02:00
logtext "Output:"; logtext "--------"
2014-10-26 23:33:26 +01:00
SPACKAGES=`${RPMBINARY} -qa 2> /dev/null | sort`
2014-08-26 17:33:55 +02:00
if [ "${SPACKAGES}" = "" ]; then
logtext "Result: RPM binary available, but package list seems to be empty"
logtext "Info: looks like the rpm binary is installed, but not used for package installation"
2014-10-26 23:33:26 +01:00
ReportSuggestion "${TEST_NO}" "Check RPM database as RPM binary available but does not reveal any packages"
2014-08-26 17:33:55 +02:00
else
for J in ${SPACKAGES}; do
N=`expr ${N} + 1`
logtext "Found package: ${J}"
2015-01-03 12:45:22 +01:00
INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${J},0,"
2014-08-26 17:33:55 +02:00
done
report "installed_packages=${N}"
fi
else
logtext "Result: RPM binary NOT found on this system, test skipped"
fi
#
#################################################################################
#
# Test : PKGS-7310
# Description : pacman package based systems
if [ ! "${PACMANBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7310 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking package list with pacman"
if [ ${SKIPTEST} -eq 0 ]; then
N=0
2014-09-15 12:01:09 +02:00
Display --indent 4 --text "- Searching pacman package manager" --result FOUND --color GREEN
2014-08-26 17:33:55 +02:00
logtext "Result: Found pacman binary (${PACMANBINARY})"
report "package_manager[]=pacman"
logtext "Test: Querying 'pacman -Q' to get package list"
2014-09-15 12:01:09 +02:00
Display --indent 6 --text "- Querying pacman package manager"
2014-08-26 17:33:55 +02:00
logtext "Output:"; logtext "--------"
SPACKAGES=`${PACMANBINARY} -Q | sort | sed 's/ /,/g'`
if [ "${SPACKAGES}" = "" ]; then
logtext "Result: pacman binary available, but package list seems to be empty"
logtext "Info: looks like the pacman binary is installed, but not used for package installation"
#YYY ReportException?
else
for J in ${SPACKAGES}; do
N=`expr ${N} + 1`
PACKAGE_NAME=`echo ${J} | awk -F, '{ print $1 }'`
PACKAGE_VERSION=`echo ${J} | awk -F, '{ print $2 }'`
logtext "Found package: ${PACKAGE_NAME} (version: ${PACKAGE_VERSION})"
2015-01-03 12:45:22 +01:00
INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${J}"
2014-08-26 17:33:55 +02:00
done
report "installed_packages=${N}"
fi
fi
#
#################################################################################
#
# Test : PKGS-7312
2014-09-22 23:40:53 +02:00
# Description : Check for available package updates when pacman package is used (Arch Linux)
if [ ! "${PACMANBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7312 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking available updates for pacman based system"
if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0
FIND=`which checkupdates`
if [ ! "${FIND}" = "" ]; then
FIND=`checkupdates`
for I in ${FIND}; do
logtext "Result: update available for ${I}"
report "available_update[]=${I}"
FOUND=1
done
2014-09-25 16:55:47 +02:00
if [ ${FOUND} -eq 1 ]; then
2014-09-22 23:40:53 +02:00
Display --indent 4 --text "- Searching update status (checkupdates)" --result "OUTDATED" --color YELLOW
ReportSuggestion "${TEST_NO}" "Perform update of system updates as this system uses rolling updates"
else
Display --indent 4 --text "- Searching update status (checkupdates)" --result "UP-TO-DATE" --color GREEN
fi
else
logtext "Result: skipping this test, can't find checkupdates binary"
fi
else
logtext "Result: pacman binary NOT found on this system, test skipped"
fi
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
2014-09-22 23:40:53 +02:00
# Test : PKGS-7314
# Description : Check pacman.conf options
PACMANCONF="/etc/pacman.conf"
if [ ! "${PACMANBINARY}" = "" -a -f ${PACMANCONF} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7314 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking pacman configuration options"
if [ ${SKIPTEST} -eq 0 ]; then
COUNT=0
# Check configuration options (options start with a capital)
logtext "Test: searching configured options in ${PACMANCONF}"
2015-04-13 22:06:14 +02:00
FIND=`grep "^[A-Z]" ${PACMANCONF} | sort | uniq | sed 's/ /:space:/g'`
2014-09-22 23:40:53 +02:00
for I in ${FIND}; do
PMOPTION=`echo ${I} | sed 's/:space:/ /g' | ${AWKBINARY} -F= '{ print $1 }'`
PMVALUE=`echo ${I} | sed 's/:space:/ /g' | ${AWKBINARY} -F= '{ print $2 }'`
logtext "Result: found option ${PMOPTION} configured with value ${PMVALUE}"
report "pacman_option[]=${PMOPTION}:${PMVALUE}:"
done
# Check software repositories
logtext "Test: checking available repositories"
FIND=`grep "^\[.*\]$" ${PACMANCONF} | tr -d '[]'`
for I in ${FIND}; do
COUNT=`expr ${COUNT} + 1`
report "package_repository[]=${I}"
done
logtext "Result: found ${COUNT} repositories"
fi
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
# Test : PKGS-7328
# Description : Check installed packages with Zypper
if [ ! "${ZYPPERBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7328 --preqs-met ${PREQS_MET} --weight L --network NO --description "Querying Zypper for installed packages"
if [ ${SKIPTEST} -eq 0 ]; then
N=0
FIND=`${ZYPPERBINARY} se -i | awk '{ if ($1=="i") { print $3 } }'`
if [ ! "${FIND}" = "" ]; then
for I in ${FIND}; do
N=`expr ${N} + 1`
logtext "Installed package: ${I}"
2015-01-03 12:45:22 +01:00
INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${J},0,"
2014-08-26 17:33:55 +02:00
done
report "installed_packages=${N}"
else
# Could not find any installed packages
ReportException ${TEST_NO} "No installed packages found with Zypper"
fi
fi
#
#################################################################################
#
# Test : PKGS-7330
# Description : Check vulnerable packages with Zypper
if [ ! "${ZYPPERBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7330 --preqs-met ${PREQS_MET} --weight L --network NO --description "Querying Zypper for vulnerable packages"
if [ ${SKIPTEST} -eq 0 ]; then
FIND=`${ZYPPERBINARY} lp | ${AWKBINARY} '{ if ($7=="security") { if ($11=="update") { print $13 } else { print $11 } } }' | sed 's/:$//' | grep -v "^$" | sort | uniq`
if [ "${FIND}" = "" ]; then
logtext "Result: No security updates found with Zypper"
2015-03-25 15:55:29 +01:00
Display --indent 2 --text "- Using Zypper to obtain vulnerable packages" --result NONE --color GREEN
2014-08-26 17:33:55 +02:00
else
Display --indent 2 --text "- Using Zypper to obtain vulnerabilities" --result WARNING --color RED
logtext "Result: Zypper found one or more installed packages which are vulnerable."
ReportWarning ${TEST_NO} "H" "Found one or more vulnerable packages installed"
logtext "List of vulnerable packages/version:"
for I in ${FIND}; do
report "vulnerable_package[]=${I}"
logtext "Vulnerable package: ${I}"
# Decrease hardening points for every found vulnerable package
AddHP 1 2
done
fi
fi
#
#################################################################################
#
# Test : PKGS-7345
# Description : Debian package based systems (dpkg)
if [ -x /usr/bin/dpkg ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7345 --preqs-met ${PREQS_MET} --weight L --network NO --description "Querying dpkg"
if [ ${SKIPTEST} -eq 0 ]; then
N=0
Display --indent 4 --text "- Searching dpkg package manager" --result FOUND --color GREEN
logtext "Result: Found dpkg binary"
report "package_manager[]=dpkg"
logtext "Test: Querying dpkg -l to get package list"
2014-09-15 12:01:09 +02:00
Display --indent 6 --text "- Querying package manager"
2014-08-26 17:33:55 +02:00
logtext "Output:"
2015-01-03 12:45:22 +01:00
SPACKAGES=`dpkg -l 2>/dev/null | grep "^ii" | tr -s ' ' | tr ' ' ',' | sort`
2014-08-26 17:33:55 +02:00
for J in ${SPACKAGES}; do
N=`expr ${N} + 1`
2015-01-03 12:45:22 +01:00
PACKAGE_NAME=`echo ${J} | cut -d ',' -f2`
PACKAGE_VERSION=`echo ${J} | cut -d ',' -f3`
2014-08-26 17:33:55 +02:00
logtext "Found package: ${PACKAGE_NAME} (version: ${PACKAGE_VERSION})"
2015-01-03 12:45:22 +01:00
INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${PACKAGE_NAME},${PACKAGE_VERSION}"
2014-08-26 17:33:55 +02:00
done
report "installed_packages=${N}"
else
logtext "Result: dpkg can NOT be found on this system, test skipped"
fi
#
#################################################################################
#
# Test : PKGS-7346
# Description : Check packages which are removed, but still own configuration files, cron jobs etc
# Notes : Cleanup: for pkg in `dpkg -l | grep "^rc" | cut -d' ' -f3`; do aptitude purge ${pkg}; done
if [ -x /usr/bin/dpkg ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7346 --preqs-met ${PREQS_MET} --weight L --network NO --description "Search unpurged packages on system"
if [ ${SKIPTEST} -eq 0 ]; then
N=0
logtext "Test: Querying dpkg -l to get unpurged packages"
SPACKAGES=`dpkg -l 2>/dev/null | grep "^rc" | cut -d ' ' -f3 | sort`
if [ "${SPACKAGES}" = "" ]; then
Display --indent 4 --text "- Query unpurged packages" --result NONE --color GREEN
logtext "Result: no packages found with left overs"
else
Display --indent 4 --text "- Query unpurged packages" --result FOUND --color YELLOW
logtext "Result: found one or more packages with left over configuration files, cron jobs etc"
logtext "Output:"
for J in ${SPACKAGES}; do
N=`expr ${N} + 1`
logtext "Found unpurged package: ${J}"
done
ReportSuggestion ${TEST_NO} "Purge old/removed packages (${N} found) with aptitude purge or dpkg --purge command. This will cleanup old configuration files, cron jobs and startup scripts."
fi
else
logtext "Result: dpkg can NOT be found on this system, test skipped"
fi
#
#################################################################################
# Test : PKGS-7348
# Description : Show unneeded distfiles if present
# Notes : Portsclean seems to be gone from the ports, so no suggestion or warning is
# issued when it's missing.
# Add portmaster --clean-distfiles-all
Register --test-no PKGS-7348 --os FreeBSD --weight L --network NO --description "Check for old distfiles"
if [ ${SKIPTEST} -eq 0 ]; then
if [ -x /usr/local/sbin/portsclean ]; then
FIND=`/usr/local/sbin/portsclean -n -DD | grep 'Delete' | wc -l | tr -d ' '`
if [ ${FIND} -eq 0 ]; then
Display --indent 2 --text "- Checking presence old distfiles" --result OK --color GREEN
logtext "Result: no unused distfiles found"
else
Display --indent 2 --text "- Checking presence old distfiles" --result WARNING --color YELLOW
logtext "Result: found ${FIND} unused distfiles"
ReportSuggestion ${TEST_NO} "Unused distfiles found. Use portsclean to delete these files. For example: portsclean -DD."
fi
fi
fi
#
#################################################################################
2014-12-05 19:43:35 +01:00
#
# Test : PKGS-7370
# Description : Check debsums output
#
#################################################################################
2014-08-26 17:33:55 +02:00
#
# Test : PKGS-7378
# Description : Query FreeBSD portmaster for available port upgrades
if [ -x /usr/local/sbin/portmaster ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7378 --preqs-met ${PREQS_MET} --weight L --network NO --description "Query portmaster for port upgrades"
if [ ${SKIPTEST} -eq 0 ]; then
N=0
logtext "Test: Querying portmaster for possible port upgrades"
UPACKAGES=`/usr/local/sbin/portmaster -L | grep "version available" | awk '{ print $5 }'`
for J in ${UPACKAGES}; do
N=`expr ${N} + 1`
logtext "Upgrade available (new version): ${J}"
report "upgrade_available[]=${J}"
done
report "upgrade_available_count=${N}"
if [ ${N} -eq 0 ]; then
logtext "Result: no upgrades found"
Display --indent 2 --text "- Checking portmaster for updates" --result NONE --color GREEN
else
Display --indent 2 --text "- Checking portmaster for updates" --result FOUND --color YELLOW
fi
fi
#
#################################################################################
#
# Test : PKGS-7380
# Description : Check for vulnerable NetBSD packages (with pkg_admin)
Register --test-no PKGS-7381 --os NetBSD --weight L --network NO --description "Check for vulnerable NetBSD packages"
if [ ${SKIPTEST} -eq 0 ]; then
if [ -x /usr/sbin/pkg_admin ]; then
PKG_AUDIT_TOOL_FOUND=1
PKG_AUDIT_TOOL="pkg_admin audit"
2014-12-05 19:43:35 +01:00
if [ -f /var/db/pkg/pkgs-vulnerabilities ]; then
FIND=`/usr/sbin/pkg_admin audit`
if [ "${FIND}" = "" ]; then
logtext "Result: pkg audit results are clean"
Display --indent 2 --text "- Checking pkg_admin audit to obtain vulnerable packages" --result NONE --color GREEN
AddHP 2 2
else
Display --indent 2 --text "- Checking pkg_admin audit to obtain vulnerable packages" --result WARNING --color RED
logtext "Result: pkg_admin audit found one or more installed packages which are vulnerable."
ReportWarning ${TEST_NO} "M" "Found one or more vulnerable packages."
logtext "List of vulnerable packages/version:"
for I in `/usr/sbin/pkg_admin audit | awk '{ print $2 }' | sort | uniq`; do
report "vulnerable_package[]=${I}"
logtext "Vulnerable package: ${I}"
# Decrease hardening points for every found vulnerable package
AddHP 1 2
done
fi
else
ReportSuggestion "${TEST_NO}" "Fetch the package database with pkg_admin fetch-pkg-vulnerabilities"
AddHP 0 2
2014-08-26 17:33:55 +02:00
fi
else
Display --indent 2 --text "- pkg_admin audit not installed" --result "NOT FOUND" --color WHITE
logtext "Result: pkg_admin audit not installed, skipping this vulnerability test."
fi
fi
#
#################################################################################
#
# Test : PKGS-7381
# Description : Check for vulnerable FreeBSD packages (with pkg)
2015-01-03 12:45:22 +01:00
if [ -x /usr/sbin/pkg -a /var/db/pkg/vuln.xml ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7381 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check for vulnerable FreeBSD packages"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
if [ -x /usr/sbin/pkg ]; then
FIND=`/usr/sbin/pkg audit | grep 'problem(s) in your installed packages found' | grep -v '0 problem(s) in your installed packages found'`
PKG_AUDIT_TOOL_FOUND=1
PKG_AUDIT_TOOL="pkg audit"
if [ "${FIND}" = "" ]; then
logtext "Result: pkg audit results are clean"
Display --indent 2 --text "- Checking pkg audit to obtain vulnerable packages" --result NONE --color GREEN
# Don't check yet, output of found vulnerable packages unclear (YYY)
else
logtext "Result: ${FIND}"
2014-09-15 12:01:09 +02:00
#Display --indent 2 --text "- Checking pkg audit to obtain vulnerable packages" --result WARNING --color RED
2014-08-26 17:33:55 +02:00
#logtext "Result: pkg audit found one or more installed packages which are vulnerable."
#ReportWarning ${TEST_NO} "M" "Found one or more vulnerable packages."
#ReportSuggestion ${TEST_NO} "Update your system with portupgrade or other tools"
#logtext "List of vulnerable packages/version:"
#for I in `/usr/sbin/pkg audit -F | grep "Affected package" | cut -d ' ' -f3 | sort | uniq`; do
# report "vulnerable_package[]=${I}"
# logtext "Vulnerable package: ${I}"
# # Decrease hardening points for every found vulnerable package
# AddHP 1 2
#done
fi
else
Display --indent 2 --text "- pkg audit not installed" --result "NOT FOUND" --color WHITE
logtext "Result: pkg audit not installed, skipping this vulnerability test."
fi
fi
#
#################################################################################
#
# Test : PKGS-7382
# Description : Check for vulnerable FreeBSD packages
2015-01-03 12:45:22 +01:00
# Notes : Newer machines should use pkg audit instead of portaudit
if [ -x /usr/local/sbin/portaudit ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7382 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check for vulnerable FreeBSD packages"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
PKG_AUDIT_TOOL_FOUND=1
FIND=`/usr/local/sbin/portaudit | grep 'problem(s) in your installed packages found' | grep -v '0 problem(s) in your installed packages found'`
if [ "${FIND}" = "" ]; then
logtext "Result: Portaudit results are clean"
2015-03-25 15:55:29 +01:00
Display --indent 2 --text "- Checking portaudit to obtain vulnerable packages" --result NONE --color GREEN
2014-08-26 17:33:55 +02:00
else
Display --indent 2 --text "- Checking portaudit to obtain vulnerabilities" --result WARNING --color RED
logtext "Result: Portaudit found one or more installed packages which are vulnerable."
ReportWarning ${TEST_NO} "M" "Found one or more vulnerable packages."
ReportSuggestion ${TEST_NO} "Update your system with portupgrade or other tools"
logtext "List of vulnerable packages/version:"
for I in `/usr/local/sbin/portaudit | grep "Affected package" | cut -d ' ' -f3 | sort | uniq`; do
report "vulnerable_package[]=${I}"
logtext "Vulnerable package: ${I}"
# Decrease hardening points for every found vulnerable package
AddHP 1 2
done
fi
fi
#
#################################################################################
#
# Test : PKGS-7383
# Description : Check for YUM package Update management
if [ ! "${YUMBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7383 --preqs-met ${PREQS_MET} --os Linux --weight M --network NO --description "Check for YUM package Update management"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: YUM package update management"
sFIND=`${YUMBINARY} repolist 2>/dev/null | grep repolist | sed 's/ //g' | sed 's/[,.]//g' | awk -F ":" '{print $2}'`
if [ "$(echo ${sFIND} | egrep "^[0-9]+$")" -a "${sFIND}" = "0" ]; then
logtext "Result: YUM package update management failed"
Display --indent 2 --text "- Checking YUM package management consistency" --result WARNING --color RED
ReportWarning ${TEST_NO} "M" "YUM is not properly configured or registered for this platform (no repolist found)"
#ReportSuggestion ${TEST_NO} "Check YUM registration for repository configuration (repolist)"
else
logtext "Result: YUM repository available (${sFIND})"
Display --indent 2 --text "- Checking YUM package management consistency" --result OK --color GREEN
fi
fi
#
#################################################################################
#
# Test : PKGS-7384
# Description : Search for YUM utils package
if [ ! "${YUMBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7384 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --description "Check for YUM utils package"
if [ ${SKIPTEST} -eq 0 ]; then
if [ -x /usr/bin/package-cleanup ]; then
logtext "Result: found YUM utils package (/usr/bin/package-cleanup)"
# Check for duplicates
logtext "Test: Checking for duplicate packages"
FIND=`/usr/bin/package-cleanup -q --dupes > /dev/null; echo $?`
if [ "${FIND}" = "0" ]; then
logtext "Result: No duplicate packages found"
Display --indent 2 --text "- Checking package database duplicates" --result OK --color GREEN
else
logtext "Result: One or more duplicate packages found"
Display --indent 2 --text "- Checking package database duplicates" --result WARNING --color RED
ReportWarning ${TEST_NO} "L" "Found one or more duplicate packages installed"
ReportSuggestion ${TEST_NO} "Run package-cleanup to solve duplicate package problems"
fi
# Check for package database problems
logtext "Test: Checking for database problems"
FIND=`/usr/bin/package-cleanup --problems > /dev/null; echo $?`
if [ "${FIND}" = "0" ]; then
logtext "Result: No package database problems found"
Display --indent 2 --text "- Checking package database for problems" --result OK --color GREEN
else
logtext "Result: One or more problems found in package database"
Display --indent 2 --text "- Checking package database for problems" --result WARNING --color RED
ReportWarning ${TEST_NO} "L" "Found one or more problems in the package database"
ReportSuggestion ${TEST_NO} "Run package-cleanup to solve package problems"
fi
else
Display --indent 2 --text "- yum-utils package not installed" --result SUGGESTION --color YELLOW
logtext "Result: YUM utils package not found"
ReportSuggestion ${TEST_NO} "Install package 'yum-utils' for better consistency checking of the package database"
fi
fi
#
#################################################################################
#
# Test : PKGS-7386
# Description : Search for YUM security package
# Notes : This test does not apply to CentOS and clones, as --security is not available
if [ -x /usr/bin/yum ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7386 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --description "Check for YUM security package"
if [ ${SKIPTEST} -eq 0 ]; then
DO_TEST=0
logtext "Test: Determining if yum-security package installed"
2014-10-13 20:36:09 +02:00
# Check for built-in --security option
if [ ${DO_TEST} -eq 0 ]; then
2014-10-13 20:43:46 +02:00
FileExists /usr/share/yum-cli/cli.py
2014-10-13 20:36:09 +02:00
if [ ${FILE_FOUND} -eq 1 ]; then
2014-10-13 20:47:42 +02:00
SearchItem "\-\-security" "/usr/share/yum-cli/cli.py"
2014-10-13 20:36:09 +02:00
if [ ${ITEM_FOUND} -eq 1 ]; then
DO_TEST=1
logtext "Result: found built-in security in yum"
fi
fi
fi
if [ ${DO_TEST} -eq 0 ]; then
FileExists /etc/yum/pluginconf.d/security.conf
if [ ${FILE_FOUND} -eq 1 ]; then
SearchItem "^enabled=1$" "/etc/yum/pluginconf.d/security.conf"
if [ ${ITEM_FOUND} -eq 1 ]; then
DO_TEST=1
logtext "Result: Found enabled plugin"
fi
fi
fi
# Check if it's installed as package (this is old style)
if [ ${DO_TEST} -eq 0 ]; then
FIND=`rpm -q yum-security yum-plugin-security | grep -v "not installed"`
if [ ! "${FIND}" = "" ]; then
logtext "Result: found yum-plugin-security package"
DO_TEST=1
fi
2014-08-26 17:33:55 +02:00
fi
2014-10-13 20:36:09 +02:00
# If we have the module of yum active, continue testing
2014-08-26 17:33:55 +02:00
if [ ${DO_TEST} -eq 1 ]; then
PKG_AUDIT_TOOL_FOUND=1
PKG_AUDIT_TOOL="yum-security"
logtext "Test: Checking for vulnerable packages"
FIND2=`/usr/bin/yum list-sec security | awk '{ if($2=="security") print $3","$5 }'`
if [ "${FIND2}" = "" ]; then
logtext "Result: no vulnerable packages found"
Display --indent 2 --text "- Checking missing security packages" --result OK --color GREEN
else
logtext "Result: found vulnerable package(s)"
Display --indent 2 --text "- Checking missing security packages" --result WARNING --color RED
for I in ${FIND2}; do
report "vulnerable_package[]=${I}"
logtext "Vulnerable package: ${I}"
AddHP 1 2
done
ReportWarning ${TEST_NO} "M" "Found one or more vulnerable packages."
ReportSuggestion ${TEST_NO} "Use 'yum --security update' to update your system"
fi
else
logtext "Result: yum-security package not found"
Display --indent 2 --text "- Checking missing security packages" --result SKIPPED --color YELLOW
ReportSuggestion ${TEST_NO} "Install package yum-plugin-security if possible, to maintain security updates easier (yum install yum-plugin-security)"
fi
fi
#
#################################################################################
#
# Test : PKGS-7387
# Description : Search for YUM GPG check
if [ -x /usr/bin/yum ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7387 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --description "Check for GPG signing in YUM security package"
if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0
FileExists /etc/yum.conf
if [ ${FILE_FOUND} -eq 1 ]; then
SearchItem "^gpgenabled=1$" "/etc/yum.conf"; if [ ${ITEM_FOUND} -eq 1 ]; then FOUND=1; fi
SearchItem "^gpgcheck=1$" "/etc/yum.conf"; if [ ${ITEM_FOUND} -eq 1 ]; then FOUND=1; fi
if [ ${FOUND} -eq 1 ]; then
logtext "Result: GPG check is enabled"
Display --indent 2 --text "- Checking GPG checks (yum.conf)" --result OK --color GREEN
else
Display --indent 2 --text "- Checking GPG checks (yum.conf)" --result DISABLED --color RED
ReportWarning ${TEST_NO} "M" "No GPG signing option found in yum.conf"
fi
fi
fi
#
#################################################################################
#
# Test : PKGS-7388
# Description : Check security repository in Debian/ubuntu apt sources.list file
2014-09-15 11:17:26 +02:00
if [ -f /etc/apt/sources.list -a -d /etc/apt/sources.list.d ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
2014-09-15 12:01:09 +02:00
Register --test-no PKGS-7388 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check security repository in Debian/ubuntu apt sources.list file"
2014-08-26 17:33:55 +02:00
if [ $SKIPTEST -eq 0 ]; then
FOUND=0
2014-09-15 11:17:26 +02:00
if [ ! "${OPTION_DEBIAN_SKIP_SECURITY_REPOSITORY}" = "yes" ]; then
if [ -f /etc/apt/sources.list ]; then
logtext "Searching for security.debian.org/security.ubuntu.com or security repositories in /etc/apt/sources.list file"
FIND=`egrep "security.debian.org|security.ubuntu.com|-security " /etc/apt/sources.list | grep -v '#' | sed 's/ /!space!/g'`
if [ ! "${FIND}" = "" ]; then
FOUND=1
Display --indent 2 --text "- Checking security repository in sources.list file" --result OK --color GREEN
logtext "Result: Found security repository in /etc/apt/sources.list"
for I in ${FIND}; do
I=`echo ${I} | sed 's/!space!/ /g'`
logtext "Output: ${I}"
done
2014-08-26 17:33:55 +02:00
fi
2014-09-15 11:17:26 +02:00
fi
if [ -d /etc/apt/sources.list.d ]; then
logtext "Searching for security.debian.org/security.ubuntu.com or security repositories in /etc/apt/sources.list.d directory"
2014-10-24 01:23:35 +02:00
FIND=`egrep -r "security.debian.org|security.ubuntu.com|-security " /etc/apt/sources.list.d | grep -v '#' | sed 's/ /!space!/g'`
2014-09-15 11:17:26 +02:00
if [ ! "${FIND}" = "" ]; then
FOUND=1
Display --indent 2 --text "- Checking security repository in sources.list.d directory" --result OK --color GREEN
logtext "Result: Found security repository in one or more files in directory /etc/apt/sources.list.d"
for I in ${FIND}; do
I=`echo ${I} | sed 's/!space!/ /g'`
logtext "Output: ${I}"
done
2014-08-26 17:33:55 +02:00
fi
2014-09-15 11:17:26 +02:00
fi
if [ ${FOUND} -eq 1 ]; then
logtext "Result: security repository was found"
AddHP 3 3
2014-08-26 17:33:55 +02:00
else
2014-09-15 11:17:26 +02:00
Display --indent 2 --text "- Checking security repository in sources.list file or directory" --result WARNING --color RED
ReportWarning ${TEST_NO} "M" "Can't find any security repository in /etc/apt/sources.list or sources.list.d directory"
AddHP 0 3
2014-08-26 17:33:55 +02:00
fi
else
2014-09-15 11:17:26 +02:00
logtext "Skipped as option is set to ignore security repository"
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : PKGS-7390
# Description : Check Ubuntu database consistency
if [ "${LINUX_VERSION}" = "Ubuntu" -a -x /usr/bin/apt-get ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7390 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --description "Check Ubuntu database consistency"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: Package database consistency by running apt-get check"
2014-09-08 23:51:27 +02:00
FIND=`/usr/bin/apt-get -q=2 check 2> /dev/null; echo $?`
2014-08-26 17:33:55 +02:00
if [ "${FIND}" = "0" ]; then
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking APT package database" --result OK --color GREEN
2014-08-26 17:33:55 +02:00
logtext "Result: package database seems to be consistent."
else
logtext "Result: package database is most likely NOT consistent"
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking APT package database" --result WARNING --color RED
2014-08-26 17:33:55 +02:00
ReportWarning ${TEST_NO} "M" "apt-get check returned a non successful exit code."
ReportSuggestion ${TEST_NO} "Run apt-get to perform a manual package database consistency check."
fi
fi
#
#################################################################################
#
# Test : PKGS-7392
# Description : Check Debian/Ubuntu vulnerable packages
if [ -x /usr/bin/apt-get ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7392 --os Linux --preqs-met ${PREQS_MET} --weight L --network YES --description "Check for Debian/Ubuntu security updates"
if [ ${SKIPTEST} -eq 0 ]; then
VULNERABLE_PACKAGES_FOUND=0
SCAN_PERFORMED=0
# Update the repository, outdated repositories don't give much information
logtext "Action: updating repository with apt-get"
/usr/bin/apt-get -q=2 update
logtext "Result: apt-get finished"
2014-09-19 02:02:22 +02:00
logtext "Test: Checking if /usr/lib/update-notifier/apt-check exists"
2014-08-26 17:33:55 +02:00
if [ -x /usr/lib/update-notifier/apt-check ]; then
PKG_AUDIT_TOOL_FOUND=1
PKG_AUDIT_TOOL="apt-check"
logtext "Result: found /usr/lib/update-notifier/apt-check"
2014-09-19 02:02:22 +02:00
logtext "Test: checking if any of the updates contain security updates"
2014-09-04 20:38:21 +02:00
# apt-check binary is a script and translated. Do not search for normal text strings, but use numbered output only
FIND=`/usr/lib/update-notifier/apt-check 2>&1 | awk -F\; '{ print $2 }'`
2014-08-26 17:33:55 +02:00
# Check if we get the proper line back and amount of security patches available
if [ "${FIND}" = "" ]; then
logtext "Result: did not find security updates line"
2014-09-04 20:38:21 +02:00
ReportSuggestion ${TEST_NO} "Check if system is up-to-date, security updates test (apt-check) gives an unexpected result"
ReportException "${TEST_NO}:1" "Apt-check did not provide any result"
2014-08-26 17:33:55 +02:00
else
if [ "${FIND}" = "0" ]; then
logtext "Result: no vulnerable packages found via apt-check"
SCAN_PERFORMED=1
else
VULNERABLE_PACKAGES_FOUND=1
SCAN_PERFORMED=1
logtext "Result: found ${FIND} security updates via apt-check"
AddHP 0 25
fi
fi
else
logtext "Result: apt-check (update-notifier-common) not found"
fi
# Trying also with apt-get directly (does not always work, as updates are distributed on both -security and -updates)
# Show packages which would be upgraded and match 'security' in repository name
2014-09-09 14:49:37 +02:00
FIND=`/usr/bin/apt-get --dry-run --show-upgraded upgrade 2> /dev/null | grep '-security' | grep "^Inst" | cut -d ' ' -f2 | sort | uniq`
2014-08-26 17:33:55 +02:00
if [ ! "${FIND}" = "" ]; then
2014-09-15 12:01:09 +02:00
#Display --indent 2 --text "- Checking vulnerable packages" --result WARNING --color RED
2014-08-26 17:33:55 +02:00
VULNERABLE_PACKAGES_FOUND=1
SCAN_PERFORMED=1
logtext "Result: found vulnerable package(s) via apt-get (-security channel)"
PKG_AUDIT_TOOL="apt-get"
PKG_AUDIT_TOOL_FOUND=1
for I in ${FIND}; do
logtext "Found vulnerable package: ${I}"
report "vulnerable_package[]=${I}"
done
fi
if [ ${SCAN_PERFORMED} -eq 1 ]; then
if [ ${VULNERABLE_PACKAGES_FOUND} -eq 1 ]; then
ReportWarning ${TEST_NO} "M" "Found one or more vulnerable packages."
ReportSuggestion ${TEST_NO} "Update your system with apt-get update, apt-get upgrade, apt-get dist-upgrade and/or unattended-upgrades"
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking vulnerable packages" --result WARNING --color RED
2014-08-26 17:33:55 +02:00
else
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking vulnerable packages" --result OK --color GREEN
2014-08-26 17:33:55 +02:00
logtext "Result: no vulnerable packages found"
fi
else
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking vulnerable packages (apt-get only)" --result DONE --color GREEN
2014-08-26 17:33:55 +02:00
logtext "Result: test not fully executed (missing apt-check output)"
fi
fi
#
#################################################################################
2014-09-23 22:48:20 +02:00
#
# Test : PKGS-7393
# Description : Check Gentoo vulnerable packages
if [ -x /usr/bin/emerge-webrsync ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7393 --preqs-met ${PREQS_MET} --weight L --network YES --description "Check for Gentoo vulnerable packages"
if [ ${SKIPTEST} -eq 0 ]; then
VULNERABLE_PACKAGES_FOUND=0
SCAN_PERFORMED=0
# Update portage.
# Multiple ways to do this. Some require extra packages to be installed,
# others require potential firewall ports to be open, outbound. This is the
# "most friendly" way.
logtext "Action: updating portage with emerge-webrsync"
2014-09-25 19:10:58 +02:00
/usr/bin/emerge-webrsync --quiet 2> /dev/null
2014-09-23 22:48:20 +02:00
logtext "Result: emerge-webrsync finished"
logtext "Test: checking if /usr/bin/glsa-check exists"
if [ -x /usr/bin/glsa-check ]; then
PKG_AUDIT_TOOL_FOUND=1
PKG_AUDIT_TOOL="glsa-check"
logtext "Result: found /usr/bin/glsa-check"
logtext "Test: checking if there are any vulnerable packages"
# glsa-check reports the GLSA date/ID string, not the vulnerable package.
2014-10-13 09:19:59 +02:00
FIND=`/usr/bin/glsa-check -t all 2>&1 | grep -v "This system is affected by the following GLSAs:" | grep -v "This system is not affected by any of the listed GLSAs" | wc -l`
2014-09-23 22:48:20 +02:00
if [ "${FIND}" = "" ]; then
2014-10-14 10:54:02 +02:00
logtext "Result: unexpected result: wc should report 0 if no vulnerable packages are found."
logtext "Notes: Check if system is up-to-date, security updates check (glsa-check) gives and unexpected result"
ReportException "${TEST_NO}:1" "glsa-check did not provide any result, which is unexpected"
2014-09-23 22:48:20 +02:00
else
if [ "${FIND}" = "0" ]; then
logtext "Result; no vulnerable packages found via glsa-check"
2014-10-14 10:54:02 +02:00
Display --indent 2 --text "- Checking vulnerable packages (glsa-check)" --result OK --color GREEN
2014-09-23 22:48:20 +02:00
else
VULNERABLE_PACKAGES_FOUND=1
2014-10-14 10:54:02 +02:00
Display --indent 2 --text "- Checking vulnerable packages (glsa-check)" --result FOUND --color RED
2014-09-23 22:48:20 +02:00
logtext "Result: found ${FIND} security updates with glsa-check"
2014-10-14 10:39:34 +02:00
ReportWarning "${TEST_NO}" "H" "Found ${FIND} security update(s) with glsa-check."
logtext "Notes: Run 'glsa-check -t all' to see which GLSA(s) were identified."
2014-09-23 22:48:20 +02:00
AddHP 0 25
fi
fi
else
2014-09-25 19:10:58 +02:00
logtext "Result: glsa-check tool not found"
ReportSuggestion ${TEST_NO} "Use Emerge to install the gentoolkit package, which includes glsa-check tool for additional security checks."
2014-09-23 22:48:20 +02:00
fi
fi
#
#################################################################################
2014-08-26 17:33:55 +02:00
#
# Test : PKGS-7394
# Description : Check Ubuntu upgradeable packages
if [ "${LINUX_VERSION}" = "Ubuntu" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PKGS-7394 --os Linux --preqs-met ${PREQS_MET} --weight L --network YES --description "Check for Ubuntu updates"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: checking /usr/bin/apt-show-versions"
if [ -x /usr/bin/apt-show-versions ]; then
logtext "Result: found /usr/bin/apt-show-versions"
logtext "Test: Checking packages which can be upgraded via apt-show-versions"
FIND=`/usr/bin/apt-show-versions -u | sed 's/ /!space!/g'`
if [ "${FIND}" = "" ]; then
logtext "Result: no packages found which can be upgraded"
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking upgradeable packages" --result NONE --color GREEN
2014-08-26 17:33:55 +02:00
AddHP 3 3
else
logtext "Result: found one or more packages which can be upgraded"
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking upgradeable packages" --result FOUND --color YELLOW
2014-08-26 17:33:55 +02:00
# output: program/repository upgradeable from version X to Y
for I in ${FIND}; do
I=`echo ${I} | sed 's/!space!/ /g'`
logtext "${I}"
done
fi
else
logtext "Result: /usr/bin/apt-show-versions not found"
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking upgradeable packages" --result SKIPPED --color WHITE
2014-08-26 17:33:55 +02:00
ReportSuggestion ${TEST_NO} "Install package apt-show-versions for patch management purposes"
fi
fi
#
#################################################################################
#
# Test : PKGS-7398
# Description : Check package audit tool
Register --test-no PKGS-7398 --weight L --network YES --description "Check for package audit tool"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: checking for package audit tool"
if [ ${PKG_AUDIT_TOOL_FOUND} -eq 0 ]; then
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking package audit tool" --result NONE --color RED
2014-08-26 17:33:55 +02:00
ReportSuggestion ${TEST_NO} "Install a package audit tool to determine vulnerable packages"
logtext "Result: no package audit tool found"
else
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking package audit tool" --result INSTALLED --color GREEN
2014-08-26 17:33:55 +02:00
Display --indent 4 --text "Found: ${PKG_AUDIT_TOOL}"
logtext "Result: found package audit tool: ${PKG_AUDIT_TOOL}"
fi
fi
#
#################################################################################
#
2014-09-22 23:40:53 +02:00
# Description : HP-UX packages
# Notes : swlist -l fileset (|grep patch) / print_manifest
#
#################################################################################
#
# Description : AIX patches
# Notes : /usr/sbin/instfix -c -i | cut -d":" -f1
#
#################################################################################
#
2014-08-26 17:33:55 +02:00
# check for popularity-contest (Debian/Ubuntu)
# check for yum-changelog
2015-01-03 12:45:22 +01:00
if [ ! "${INSTALLED_PACKAGES}" = "" ]; then
report "installed_packages_array=${INSTALLED_PACKAGES}"
fi
2014-08-26 17:33:55 +02:00
report "pkg_audit_tool=${PKG_AUDIT_TOOL}"
report "pkg_audit_tool_found=${PKG_AUDIT_TOOL_FOUND}"
wait_for_keypress
#
#================================================================================
2015-01-03 12:45:22 +01:00
# Lynis - Copyright 2007-2015 Michael Boelen, CISOfy - https://cisofy.com
