2014-08-26 17:33:55 +02:00
#!/bin/sh
#################################################################################
#
# Lynis
# ------------------
#
2016-03-13 16:00:39 +01:00
# Copyright 2007-2013, Michael Boelen
# Copyright 2013-2016, CISOfy
#
# Website : https://cisofy.com
# Blog : http://linux-audit.com
# GitHub : https://github.com/CISOfy/lynis
2014-08-26 17:33:55 +02:00
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# File systems
#
#################################################################################
#
# Number of days to mark a file as old
TMP_OLD_DAYS=90
LVM_VG_USED=0
#
#################################################################################
#
InsertSection "File systems"
#
#################################################################################
#
# Test : FILE-6310
2015-04-07 17:19:25 +02:00
# Description : Checking if some mount points are separated from /
# Goal : Users should not be able to fill their home directory or temporary directory and creating a Denial of Service
Register --test-no FILE-6310 --weight L --network NO --description "Checking /tmp, /home and /var directory"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
Display --indent 2 --text "- Checking mount points"
2015-04-07 17:19:25 +02:00
SEPARATED_FILESYTEMS="/home /tmp /var"
2014-08-26 17:33:55 +02:00
for I in ${SEPARATED_FILESYTEMS}; do
2015-12-21 21:17:15 +01:00
LogText "Test: Checking if ${I} is mounted separately or mounted on / file system"
2014-08-26 17:33:55 +02:00
if [ -L ${I} ]; then
2016-03-08 11:35:15 +01:00
ShowSymlinkPath ${I}
LogText "Result: ${I} is a symlink. Manual check required to determine exact file system options"
ReportSuggestion ${TEST_NO} "Symlinked mount point needs to be checked manually" "${I}" ""
2014-09-15 12:01:09 +02:00
Display --indent 4 --text "- Checking ${I} mount point" --result SYMLINK --color WHITE
2014-08-26 17:33:55 +02:00
elif [ -d ${I} ]; then
2015-12-21 21:17:15 +01:00
LogText "Result: directory ${I} exists"
2014-08-26 17:33:55 +02:00
FIND=`mount | grep "${I}"`
if [ ! "${FIND}" = "" ]; then
2015-12-21 21:17:15 +01:00
LogText "Result: found ${I} as a separated mount point"
2016-06-18 11:14:01 +02:00
Display --indent 4 --text "- Checking ${I} mount point" --result "${STATUS_OK}" --color GREEN
2015-04-07 17:19:25 +02:00
AddHP 10 10
2014-08-26 17:33:55 +02:00
else
2015-12-21 21:17:15 +01:00
LogText "Result: ${I} not found in mount list. Directory most likely stored on / file system"
2016-06-18 11:14:01 +02:00
Display --indent 4 --text "- Checking ${I} mount point" --result "${STATUS_SUGGESTION}" --color YELLOW
2014-08-26 17:33:55 +02:00
ReportSuggestion ${TEST_NO} "To decrease the impact of a full ${I} file system, place ${I} on a separated partition"
2015-04-07 17:19:25 +02:00
AddHP 9 10
2014-08-26 17:33:55 +02:00
fi
else
2015-12-21 21:17:15 +01:00
LogText "Result: directory ${I} does not exist"
2014-08-26 17:33:55 +02:00
fi
done
fi
#
#################################################################################
#
# Test : FILE-6311
# Description : Checking LVM Volume Groups
# Notes : No volume groups found is sent to STDERR for unclear reasons. Filtering both STDERR redirecting and grep.
2014-10-26 23:33:08 +01:00
if [ ! "${VGDISPLAYBINARY}" = "" -o ! "${LSVGBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
2014-08-26 17:33:55 +02:00
Register --test-no FILE-6311 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking LVM volume groups"
if [ ${SKIPTEST} -eq 0 ]; then
2015-12-21 21:17:15 +01:00
LogText "Test: Checking for LVM volume groups"
2014-10-26 23:33:08 +01:00
case ${OS} in
AIX)
FIND=`${LSVGBINARY} -o`
;;
Linux)
FIND=`${VGDISPLAYBINARY} 2> /dev/null | grep -v "No volume groups found" | grep "VG Name" | awk '{ print $3 }' | sort`
;;
*)
ReportException "${TEST_NO}:1" "Don't know this specific operating system yet, while volume group manager was found"
;;
esac
2014-08-26 17:33:55 +02:00
if [ ! "${FIND}" = "" ]; then
2015-12-21 21:17:15 +01:00
LogText "Result: found one or more volume groups"
2014-08-26 17:33:55 +02:00
for I in ${FIND}; do
2015-12-21 21:17:15 +01:00
LogText "Found LVM volume group: ${I}"
Report "lvm_volume_group[]=${I}"
2014-08-26 17:33:55 +02:00
done
LVM_VG_USED=1
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- Checking LVM volume groups" --result "${STATUS_FOUND}" --color GREEN
2014-08-26 17:33:55 +02:00
else
2015-12-21 21:17:15 +01:00
LogText "Result: no LVM volume groups found"
2016-06-18 11:14:01 +02:00
if IsVerbose; then Display --indent 2 --text "- Checking LVM volume groups" --result "${STATUS_NONE}" --color WHITE; fi
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : FILE-6312
# Description : Checking LVM volumes
2014-10-26 23:33:08 +01:00
if [ ${LVM_VG_USED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
2014-08-26 17:33:55 +02:00
Register --test-no FILE-6312 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking LVM volumes"
if [ ${SKIPTEST} -eq 0 ]; then
2015-12-21 21:17:15 +01:00
LogText "Test: Checking for LVM volumes"
2014-10-26 23:33:08 +01:00
case ${OS} in
AIX)
ACTIVE_VG_LIST=`${LSVGBINARY} -o`
FIND=`for I in ${ACTIVE_VG_LIST}; do ${LSVGBINARY} -l ${I} | awk 'NR>2 { print $1 }'; done`
;;
Linux)
FIND=`${LVDISPLAYBINARY} | grep -v "No volume groups found" | grep "LV Name" | awk '{ print $3 }' | sort`
;;
*)
ReportException "${TEST_NO}:1" "Need specific test for gathering volume manager data"
;;
esac
2014-08-26 17:33:55 +02:00
if [ ! "${FIND}" = "" ]; then
2015-12-21 21:17:15 +01:00
LogText "Result: found one or more volumes"
2014-08-26 17:33:55 +02:00
for I in ${FIND}; do
2015-12-21 21:17:15 +01:00
LogText "Found LVM volume: ${I}"
Report "lvm_volume[]=${I}"
2014-08-26 17:33:55 +02:00
done
2016-06-18 11:14:01 +02:00
Display --indent 4 --text "- Checking LVM volumes" --result "${STATUS_FOUND}" --color GREEN
2014-08-26 17:33:55 +02:00
else
2015-12-21 21:17:15 +01:00
LogText "Result: no LVM volume groups found"
2016-06-18 11:14:01 +02:00
Display --indent 4 --text "- Checking LVM volumes" --result "${STATUS_NONE}" --color WHITE
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : FILE-6316
# Description : Checking /etc/fstab file permissions
#Register --test-no FILE-6316 --os Linux --weight L --network NO --description "Checking /etc/fstab"
#if [ ${SKIPTEST} -eq 0 ]; then
# 644
#
#################################################################################
#
# Test : FILE-6323
# Description : Checking Linux EXT2, EXT3, EXT4 file systems
Register --test-no FILE-6323 --os Linux --weight L --network NO --description "Checking EXT file systems"
if [ ${SKIPTEST} -eq 0 ]; then
2015-12-21 21:17:15 +01:00
LogText "Test: Checking for Linux EXT file systems"
2014-08-26 17:33:55 +02:00
FIND=`mount -t ext2,ext3,ext4 | awk '{ print $3","$5 }'`
if [ ! "${FIND}" = "" ]; then
2015-12-21 21:17:15 +01:00
LogText "Result: found one or more EXT file systems"
2014-08-26 17:33:55 +02:00
for I in ${FIND}; do
FILESYSTEM=`echo ${I} | cut -d ',' -f1`
FILETYPE=`echo ${I} | cut -d ',' -f2`
2015-12-21 21:17:15 +01:00
LogText "File system: ${FILESYSTEM} (type: ${FILETYPE})"
Report "file_systems_ext[]=${FILESYSTEM}|${FILETYPE}|"
2014-08-26 17:33:55 +02:00
done
2014-10-30 18:09:03 +01:00
else
2015-12-21 21:17:15 +01:00
LogText "Result: no EXT file systems found"
Report "file_systems_ext[]=none"
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : FILE-6329
# Description : Query all FFS/UFS mounts from /etc/fstab
if [ -f /etc/fstab ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no FILE-6329 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking FFS/UFS file systems"
if [ ${SKIPTEST} -eq 0 ]; then
2015-12-21 21:17:15 +01:00
LogText "Test: Query /etc/fstab for available FFS/UFS mount points"
2014-08-26 17:33:55 +02:00
FIND=`awk '{ if ($3 == "ufs" || $3 == "ffs" ) { print $1":"$2":"$3":"$4":" }}' /etc/fstab`
if [ "${FIND}" = "" ]; then
2016-06-18 11:14:01 +02:00
if IsVerbose; then Display --indent 2 --text "- Querying FFS/UFS mount points (fstab)" --result "${STATUS_NONE}" --color WHITE; fi
2015-12-21 21:17:15 +01:00
LogText "Result: unable to find any single mount point (FFS/UFS)"
2014-08-26 17:33:55 +02:00
else
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- Querying FFS/UFS mount points (fstab)" --result "${STATUS_FOUND}" --color GREEN
2015-12-21 21:17:15 +01:00
Report "filesystem[]=ufs"
2014-08-26 17:33:55 +02:00
for I in ${FIND}; do
2015-12-21 21:17:15 +01:00
LogText "FFS/UFS mount found: ${I}"
Report "mountpoint_ufs[]=${I}"
2014-08-26 17:33:55 +02:00
done
fi
fi
#
#################################################################################
#
# Test : FILE-6330
# Description : Query all ZFS mounts from /etc/fstab
Register --test-no FILE-6330 --os FreeBSD --weight L --network NO --description "Checking ZFS file systems"
if [ ${SKIPTEST} -eq 0 ]; then
2015-12-21 21:17:15 +01:00
LogText "Test: Query /etc/fstab for available ZFS mount points"
2014-08-26 17:33:55 +02:00
FIND=`mount -p | awk '{ if ($3 == "zfs") { print $1":"$2":"$3":"$4":" }}'`
if [ "${FIND}" = "" ]; then
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- Querying ZFS mount points (mount -p)" --result "${STATUS_NONE}" --color WHITE
2015-12-21 21:17:15 +01:00
LogText "Result: unable to find any single mount point (ZFS)"
2014-08-26 17:33:55 +02:00
else
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- Querying ZFS mount points (mount -p)" --result "${STATUS_FOUND}" --color GREEN
2015-12-21 21:17:15 +01:00
Report "filesystem[]=zfs"
2014-08-26 17:33:55 +02:00
for I in ${FIND}; do
2015-12-21 21:17:15 +01:00
LogText "ZFS mount found: ${I}"
Report "mountpoint_zfs[]=${I}"
2014-08-26 17:33:55 +02:00
done
fi
fi
#
#################################################################################
#
# Test : FILE-6332
# Description : Check swap partitions
if [ -f /etc/fstab ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no FILE-6332 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking swap partitions"
if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0
2015-12-21 21:17:15 +01:00
LogText "Test: query swap partitions from /etc/fstab file"
2014-08-26 17:33:55 +02:00
# Check if third field contains 'swap'
2015-05-26 11:12:36 +02:00
FIND=`awk '{ if ($2=="swap" || $3=="swap") { print $1 }}' /etc/fstab | grep -v "^#"`
2014-08-26 17:33:55 +02:00
for I in ${FIND}; do
FOUND=1
2015-05-26 11:12:36 +02:00
REAL=""
UUID=""
2015-12-21 21:17:15 +01:00
LogText "Swap partition found: ${I}"
2014-09-04 20:38:57 +02:00
# YYY Add a test if partition is not a normal partition (e.g. UUID=)
# Can be ^/dev/mapper/vg-name_lv-name
# Can be ^/dev/partition
2015-05-26 11:12:36 +02:00
2014-09-04 20:38:57 +02:00
# Can be ^UUID=uuid --> /dev/disk/by-uuid/<uuid>
2015-05-26 11:12:36 +02:00
HAS_UUID=`echo ${I} | grep "^UUID="`
if [ ! "${HAS_UUID}" = "" ]; then
UUID=`echo ${HAS_UUID} | awk -F= '{ print $2 }'`
2015-12-21 21:17:15 +01:00
LogText "Result: Using ${UUID} as UUID"
2015-05-26 11:12:36 +02:00
if [ ! "${BLKIDBINARYx}" = "" ]; then
FIND2=`${BLKIDBINARY} | awk '{ if ($2=="UUID=\"${UUID}\"") print $1 }' | sed 's/:$//'`
if [ ! "${FIND2}" = "" ]; then
REAL="${FIND2}"
fi
else
2015-12-21 21:17:15 +01:00
LogText "Result: blkid binary not found, trying by checking device listing"
2015-05-26 11:12:36 +02:00
sFILE=""
if [ -L /dev/disk/by-uuid/${UUID} ]; then
2015-12-21 21:17:15 +01:00
LogText "Result: found disk via /dev/disk/by-uuid listing"
2015-05-26 11:12:36 +02:00
ShowSymlinkPath /dev/disk/by-uuid/${UUID}
if [ ! "${sFILE}" = "" ]; then
REAL="${sFILE}"
2015-12-21 21:17:15 +01:00
LogText "Result: disk is ${REAL}"
2015-05-26 11:12:36 +02:00
fi
else
2015-12-21 21:17:15 +01:00
LogText "Result: no symlink found to /dev/disk/by-uuid/${UUID}"
2015-05-26 11:12:36 +02:00
fi
fi
fi
# Set real device
if [ "${REAL}" = "" ]; then
REAL="${I}"
fi
2015-12-21 21:17:15 +01:00
Report "swap_partition[]=${I},${REAL},"
2014-08-26 17:33:55 +02:00
done
if [ ${FOUND} -eq 1 ]; then
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- Query swap partitions (fstab)" --result "${STATUS_OK}" --color GREEN
2014-08-26 17:33:55 +02:00
else
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- Query swap partitions (fstab)" --result "${STATUS_NONE}" --color YELLOW
2015-12-21 21:17:15 +01:00
LogText "Result: no swap partitions found in /etc/fstab"
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : FILE-6336
# Description : Check swap mount options
2015-06-17 17:06:51 +02:00
# Examples : [partition] swap swap defaults 0 0
# [partition] none swap sw 0 0
2014-08-26 17:33:55 +02:00
if [ -f /etc/fstab ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no FILE-6336 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking swap mount options"
if [ ${SKIPTEST} -eq 0 ]; then
2014-09-02 14:00:36 +02:00
# Swap partitions should be mounted with 'sw' or 'swap'
2015-12-21 21:17:15 +01:00
LogText "Test: check swap partitions with incorrect mount options"
2014-10-14 10:02:41 +02:00
#FIND=`awk '{ if ($3=="swap" && ($4!="sw" && $4!="swap" && $4!="defaults")) print $1 }' /etc/fstab`
2015-06-17 17:13:44 +02:00
FIND=`awk '{ if ($3=="swap" && ($4~/sw/ || $4=="defaults")) { print $1 }}' /etc/fstab`
2014-10-14 10:02:41 +02:00
if [ ! "${FIND}" = "" ]; then
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- Testing swap partitions" --result "${STATUS_OK}" --color GREEN
2015-12-21 21:17:15 +01:00
LogText "Result: all swap partitions have correct options (sw or swap)"
2014-08-26 17:33:55 +02:00
else
2015-06-17 17:06:51 +02:00
Display --indent 2 --text "- Testing swap partitions" --result "CHECK NEEDED" --color YELLOW
2015-12-21 21:17:15 +01:00
LogText "Result: possible incorrect mount options used for mounting swap partition (${FIND})"
2014-09-02 14:00:36 +02:00
#ReportWarning ${TEST_NO} "L" "Possible incorrect mount options used for swap parition (${FIND})"
2015-06-17 17:06:51 +02:00
ReportSuggestion ${TEST_NO} "Check your /etc/fstab file for swap partition mount options"
2015-12-21 21:17:15 +01:00
LogText "Notes: usually swap partition have 'sw' or 'swap' in the options field (4th)"
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
2016-07-11 16:48:25 +02:00
#
# Test : FILE-6337
# Description : Check proc mount options (Linux >=3.3 only)
# Examples : proc /proc proc defaults,hidepid=2 0 0
# Goal : Users should not be able to see processes of other users
if [ -f /proc/version ] && [ "$(cat /proc/version | cut -d" " -f3)" \> "3.2" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no FILE-6337 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --description "Checking proc mount options"
if [ ${SKIPTEST} -eq 0 ]; then
# Proc should be mounted with 'hidepid=2' or 'hidepid=1' at least
LogText "Test: check proc mount with incorrect mount options"
FIND=`mount | grep proc | egrep -o "hidepid=[0-9]"`
if [ "${FIND}" = "hidepid=2" ]; then
Display --indent 2 --text "- Testing proc mount" --result "${STATUS_OK}" --color GREEN
LogText "Result: proc mount mounted with hidepid=2"
else
if [ "${FIND}" = "" ]; then
HIDEPID1_SUGGESTION=" (or at least hidepid=1)"
fi
Display --indent 2 --text "- Testing proc mount" --result "${STATUS_SUGGESTION}" --color YELLOW
LogText "Result: proc file system not mounted with option hidepid=2$HIDEPID1_SUGGESTION"
ReportSuggestion ${TEST_NO} "Consider mounting /proc via /etc/fstab with mount option hidepid=2$HIDEPID1_SUGGESTION"
fi
fi
#
#################################################################################
2014-08-26 17:33:55 +02:00
#
# Test : FILE-6354
# Description : Search files within /tmp which are older than 3 months
if [ -d /tmp ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no FILE-6354 --preqs-met ${PREQS_MET} --weight L --network NO --description "Searching for old files in /tmp"
if [ ${SKIPTEST} -eq 0 ]; then
2015-12-21 21:17:15 +01:00
LogText "Test: Searching for old files in /tmp"
2014-08-26 17:33:55 +02:00
# Search for files only in /tmp, with an access time older than X days
2016-05-30 19:38:42 +02:00
FIND=`find /tmp -xdev -type f -atime +${TMP_OLD_DAYS} | sed 's/ /!space!/g'`
2014-08-26 17:33:55 +02:00
if [ "${FIND}" = "" ]; then
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- Checking for old files in /tmp" --result "${STATUS_OK}" --color GREEN
2015-12-21 21:17:15 +01:00
LogText "Result: no files found in /tmp which are older than 3 months"
2014-08-26 17:33:55 +02:00
else
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- Checking for old files in /tmp" --result "${STATUS_FOUND}" --color RED
2014-08-26 17:33:55 +02:00
N=0
for I in ${FIND}; do
FILE=`echo ${I} | sed 's/!space!/ /g'`
2015-12-21 21:17:15 +01:00
LogText "Old temporary file: ${FILE}"
2016-05-03 14:57:53 +02:00
N=$((N + 1))
2014-08-26 17:33:55 +02:00
done
2015-12-21 21:17:15 +01:00
LogText "Result: found old files in /tmp, which were not modified in the last ${TMP_OLD_DAYS} days"
LogText "Advice: check and clean up unused files in /tmp. Old files can fill up a disk or contain"
LogText "private information and should be deleted it not being used actively. Use a tool like lsof to"
LogText "see which programs possibly are using a particular file. Some systems can cleanup temporary"
LogText "directories by setting a boot option."
2014-09-15 10:42:11 +02:00
ReportSuggestion ${TEST_NO} "Check ${N} files in /tmp which are older than ${TMP_OLD_DAYS} days"
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : FILE-6362
# Description : Check for sticky bit on /tmp
if [ -d /tmp -a ! -L /tmp ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no FILE-6362 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking /tmp sticky bit"
if [ ${SKIPTEST} -eq 0 ]; then
# Depending on OS, number of field with 'tmp' differs
FIND=`ls -l / | tr -s ' ' | awk -F" " '{ if ( $8 == "tmp" || $9 == "tmp" ) { print $1 } }' | cut -c 10`
if [ "${FIND}" = "t" -o "${FIND}" = "T" ]; then
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- Checking /tmp sticky bit" --result "${STATUS_OK}" --color GREEN
2015-12-21 21:17:15 +01:00
LogText "Result: Sticky bit (${FIND}) found on /tmp directory"
2014-08-26 17:33:55 +02:00
AddHP 3 3
else
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- Checking /tmp sticky bit" --result "${STATUS_WARNING}" --color RED
2014-08-26 17:33:55 +02:00
ReportWarning ${TEST_NO} "H" "No sticky bit found on /tmp directory, which can be dangerous!"
ReportSuggestion ${TEST_NO} "Consult documentation and place the sticky bit, to prevent users deleting (by other owned) files in the /tmp directory."
AddHP 0 3
fi
else
2015-12-21 21:17:15 +01:00
LogText "Result: Sticky bit test (on /tmp) skipped. Possible reason: missing or symlinked directory, or test skipped."
2014-08-26 17:33:55 +02:00
fi
#
#################################################################################
#
# Test : FILE-6366
# Description : Check for noatime option
# More info : especially useful for profile 'desktop' and 'server-storage'
2016-05-11 16:02:46 +02:00
# Want to contribute to Lynis? Create this test
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
# Test : FILE-6368
# Description : Checking Linux root file system ACL support
2014-09-08 23:51:27 +02:00
Register --test-no FILE-6368 --os Linux --weight L --network NO --root-only YES --description "Checking ACL support on root file system"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0
2016-05-11 15:16:28 +02:00
LogText "Test: Checking acl option on ext[2-4] root file system"
2014-10-30 18:09:03 +01:00
FIND=`mount | ${AWKBINARY} '{ if ($3=="/" && $5~/ext[2-4]/) { print $6 } }' | grep acl`
2014-08-26 17:33:55 +02:00
if [ ! "${FIND}" = "" ]; then
2015-12-21 21:17:15 +01:00
LogText "Result: found ACL option"
2014-08-26 17:33:55 +02:00
FOUND=1
else
2015-12-21 21:17:15 +01:00
LogText "Result: mount point probably mounted with defaults"
LogText "Test: Checking device which holds root file system"
2014-08-26 17:33:55 +02:00
# Get device on which root file system is mounted. Use /dev/root if it exists, or
# else check output of mount
if [ -b /dev/root ]; then
FIND1="/dev/root"
else
2014-10-30 18:09:03 +01:00
# Only determine device if it is EXT2/3/4
#FIND1=`mount | grep "on / " | awk '{ if ($5~/ext[2-4]/) { print $1 }}'`
FIND1=`mount -t ext2,ext3,ext4 | grep "on / " | awk '{ print $1 }'`
2014-08-26 17:33:55 +02:00
fi
2014-10-30 18:09:03 +01:00
# Trying to determine default mount options from EXT2/EXT3/EXT4 file systems
2014-08-26 17:33:55 +02:00
if [ ! "${FIND1}" = "" ]; then
2015-12-21 21:17:15 +01:00
LogText "Result: found ${FIND1}"
LogText "Test: Checking default options on ${FIND1}"
2014-10-30 18:09:03 +01:00
FIND2=`${TUNE2FSBINARY} -l ${FIND1} 2> /dev/null | grep "^Default mount options" | grep "acl"`
2014-08-26 17:33:55 +02:00
if [ ! "${FIND2}" = "" ]; then
2015-12-21 21:17:15 +01:00
LogText "Result: found ACL option in default mount options"
2014-08-26 17:33:55 +02:00
FOUND=1
else
2015-12-21 21:17:15 +01:00
LogText "Result: no ACL option found in default mount options list"
2014-08-26 17:33:55 +02:00
fi
else
2015-12-21 21:17:15 +01:00
LogText "Result: No file system found with root file system"
2014-08-26 17:33:55 +02:00
fi
fi
2016-05-11 15:16:28 +02:00
LogText "Test: Checking acl option on xfs root file system"
FIND=`mount | ${AWKBINARY} '{ if ($3=="/" && $5~/xfs/) { print $6 } }' | egrep 'no_acl|no_user_xattr'`
if [ "${FIND}" = "" ]; then
FOUND=1
# some other tests to do ?
fi
2014-08-26 17:33:55 +02:00
if [ ${FOUND} -eq 0 ]; then
2015-12-21 21:17:15 +01:00
LogText "Result: ACL option NOT enabled on root file system"
LogText "Additional information: if file access need to be more restricted, ACLs could be used. Install the acl utilities and remount the file system with the acl option"
LogText "Activate acl support on and active file system with mount -o remount,acl / and add the acl option to the fstab file"
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- ACL support root file system" --result "${STATUS_DISABLED}" --color YELLOW
2014-08-26 17:33:55 +02:00
AddHP 0 1
else
2015-12-21 21:17:15 +01:00
LogText "Result: ACL option enabled on root file system"
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- ACL support root file system" --result "${STATUS_ENABLED}" --color GREEN
2014-08-26 17:33:55 +02:00
AddHP 3 3
fi
fi
#
#################################################################################
#
# Test : FILE-6372
# Description : Check / mount options for Linux
# Notes :
Register --test-no FILE-6372 --os Linux --weight L --network NO --description "Checking / mount options"
if [ ${SKIPTEST} -eq 0 ]; then
if [ -f /etc/fstab ]; then
2016-04-19 17:39:01 +02:00
FIND=`cat /etc/fstab | grep -v "^#" | awk '{ if ($2=="/") { print $4 } }'`
2016-05-11 15:18:39 +02:00
NODEV=`echo ${FIND} | awk '{ if ($1 ~ "nodev") { print "YES" } else { print "NO" } }'`
NOEXEC=`echo ${FIND} | awk '{ if ($1 ~ "noexec") { print "YES" } else { print "NO" } }'`
NOSUID=`echo ${FIND} | awk '{ if ($1 ~ "nosuid") { print "YES" } else { print "NO" } }'`
2014-08-26 17:33:55 +02:00
if [ ! "${FIND}" = "" ]; then
2015-12-21 21:17:15 +01:00
LogText "Result: mount system / is configured with options: ${FIND}"
2014-08-26 17:33:55 +02:00
if [ "${FIND}" = "defaults" ]; then
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- Mount options of /" --result "${STATUS_OK}" --color GREEN
2014-08-26 17:33:55 +02:00
else
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Mount options of /" --result "NON DEFAULT" --color YELLOW
2014-08-26 17:33:55 +02:00
fi
else
2015-12-21 21:17:15 +01:00
LogText "Result: no mount point / or expected options found"
2014-08-26 17:33:55 +02:00
fi
fi
fi
#
#################################################################################
#
# Test : FILE-6374
2015-09-03 15:44:10 +02:00
# Description : Check mount options for Linux
# Notes : This test determines if the mount point exists. If it does not exist as mount point, yet it is an directory,
# you might consider to make it a separate mount point with restrictions.
#
# Depending on the primary goals of a machine, some mount points might be too restrictive. Before applying any
# mount flags, test them on a similar or cloned test system.
#
# ---------------------------------------------------------
# Mount point nodev noexec nosuid
# /boot v v v
2016-05-11 15:57:36 +02:00
# /dev/shm v v v
2015-09-03 15:44:10 +02:00
# /home v v
# /tmp v v v
# /var v
# /var/log v v v
# /var/log/audit v v v
2016-05-11 15:57:36 +02:00
# /var/tmp v v v
2015-09-03 15:44:10 +02:00
# ---------------------------------------------------------
2016-05-11 15:57:36 +02:00
FILESYSTEMS_TO_CHECK="/boot:nodev,noexec,nosuid /dev/shm:nosuid,nodev,noexec /home:nodev,nosuid /tmp:nodev,noexec,nosuid /var:nosuid /var/log:nodev,noexec,nosuid /var/log/audit:nodev,noexec,nosuid /var/tmp:nodev,noexec,nosuid"
2014-08-26 17:33:55 +02:00
Register --test-no FILE-6374 --os Linux --weight L --network NO --description "Checking /boot mount options"
if [ ${SKIPTEST} -eq 0 ]; then
if [ -f /etc/fstab ]; then
2015-09-03 15:44:10 +02:00
for I in ${FILESYSTEMS_TO_CHECK}; do
FILESYSTEM=`echo ${I} | cut -d: -f1`
EXPECTED_FLAGS=`echo ${I} | cut -d: -f2 | sed 's/,/ /g'`
IN_FSTAB=`cat /etc/fstab | awk -v fs=${FILESYSTEM} '{ if ($2==fs) { print "FOUND" } }'`
if [ ! "${IN_FSTAB}" = "" ]; then
FOUND_FLAGS=`cat /etc/fstab | awk -v fs=${FILESYSTEM} '{ if ($2==fs) { print $4 } }' | sed 's/,/ /g'`
2015-12-21 21:17:15 +01:00
LogText "File system: ${FILESYSTEM}"
LogText "Expected flags: ${EXPECTED_FLAGS}"
LogText "Found flags: ${FOUND_FLAGS}"
2015-09-03 15:44:10 +02:00
PARTIALLY_HARDENED=0
FULLY_HARDENED=1
for FLAG in ${EXPECTED_FLAGS}; do
FLAG_AVAILABLE=`echo ${FOUND_FLAGS} | grep ${FLAG}`
if [ "${FLAG_AVAILABLE}" = "" ]; then
2015-12-21 21:17:15 +01:00
LogText "Result: Could not find mount option ${FLAG} on file system ${FILESYSTEM}"
2015-09-03 15:44:10 +02:00
FULLY_HARDENED=0
else
2015-12-21 21:17:15 +01:00
LogText "Result: GOOD, found mount option ${FLAG} on file system ${FILESYSTEM}"
2015-09-03 15:44:10 +02:00
PARTIALLY_HARDENED=1
fi
done
if [ ${FULLY_HARDENED} -eq 1 ]; then
2015-12-21 21:17:15 +01:00
LogText "Result: marked ${FILESYSTEM} as fully hardenened"
2015-09-03 15:44:10 +02:00
Display --indent 2 --text "- Mount options of ${FILESYSTEM}" --result HARDENED --color GREEN
AddHP 5 5
elif [ ${PARTIALLY_HARDENED} -eq 1 ]; then
2015-12-21 21:17:15 +01:00
LogText "Result: marked ${FILESYSTEM} as fully hardenened"
2015-09-03 15:44:10 +02:00
Display --indent 2 --text "- Mount options of ${FILESYSTEM}" --result "PARTIALLY HARDENED" --color YELLOW
2014-08-26 17:33:55 +02:00
AddHP 4 5
2015-09-03 15:44:10 +02:00
else
if [ "${FOUND_FLAGS}" = "defaults" ]; then
2015-12-21 21:17:15 +01:00
LogText "Result: marked ${FILESYSTEM} options as default (non hardened)"
2015-09-03 15:44:10 +02:00
Display --indent 2 --text "- Mount options of ${FILESYSTEM}" --result DEFAULT --color YELLOW
AddHP 3 5
else
2015-12-21 21:17:15 +01:00
LogText "Result: marked ${FILESYSTEM} options as non default (unclear about hardening)"
2015-09-03 15:44:10 +02:00
Display --indent 2 --text "- Mount options of ${FILESYSTEM}" --result "NON DEFAULT" --color YELLOW
AddHP 4 5
fi
2014-08-26 17:33:55 +02:00
fi
2015-09-03 15:44:10 +02:00
else
2015-12-21 21:17:15 +01:00
LogText "Result: file system ${FILESYSTEM} not found in /etc/fstab"
2014-08-26 17:33:55 +02:00
fi
2015-09-03 15:44:10 +02:00
done
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
2016-05-11 15:20:08 +02:00
#
2016-05-11 15:57:36 +02:00
# Test : FILE-6376
2016-05-11 15:20:08 +02:00
# Description : Bind mount the /var/tmp directory to /tmp
2016-05-11 15:57:36 +02:00
Register --test-no FILE-6376 --os Linux --weight L --network NO --description "Determine if /var/tmp is bound to /tmp"
2016-05-11 15:20:08 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
if [ -f /etc/fstab ]; then
2016-05-11 15:57:36 +02:00
FIND=`awk '{ if ($2=="/var/tmp") { print $4 } }' /etc/fstab`
2016-05-11 15:20:08 +02:00
BIND=`echo ${FIND} | awk '{ if ($1 ~ "bind") { print "YES" } else { print "NO" } }'`
if [ ! "${FIND}" = "" ]; then
LogText "Result: mount system /var/tmp is configured with options: ${FIND}"
if [ "${BIND}" = "YES" ]; then
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- /var/tmp is bound to /tmp" --result "${STATUS_OK}" --color GREEN
2016-05-11 15:20:08 +02:00
LogText "Result : /var/tmp is bind to /tmp"
else
2016-05-11 15:57:36 +02:00
Display --indent 2 --text "- /var/tmp is not bound to /tmp" --result "NON DEFAULT" --color YELLOW
2016-05-11 15:20:08 +02:00
LogText "Result: /var/tmp is not bind to /tmp"
fi
else
LogText "Result: no mount point /var/tmp or expected options found"
2016-05-11 15:57:36 +02:00
if IsVerbose; then Display --indent 2 --text "- /var/tmp is not bound to /tmp" --result "INFO" --color WHITE; fi
2016-05-11 15:20:08 +02:00
fi
fi
fi
#
#################################################################################
2014-08-26 17:33:55 +02:00
#
# Test : FILE-6378
# Description : Check for nodirtime option
2016-05-11 16:02:46 +02:00
# Want to contribute to Lynis? Create this test
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
# Test : FILE-6380
# Description : Check for relatime
2016-05-11 16:02:46 +02:00
# Want to contribute to Lynis? Create this test
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
# Test : FILE-6390
# Description : Check writeback/journalling mode (ext3)
# More info : data=writeback | data=ordered | data=journal
2016-05-11 16:02:46 +02:00
# Want to contribute to Lynis? Create this test
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
# Test : FILE-6394
# Description : Check vm.swappiness (Linux)
2016-05-11 16:02:46 +02:00
# Want to contribute to Lynis? Create this test
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
# Test : FILE-6398
# Description : Check if JBD (Journal Block Device) driver is loaded
2016-05-11 16:02:46 +02:00
# Want to contribute to Lynis? Create this test
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
# Test : FILE-6410
# Description : Checking locate database (file index)
# Notes : Linux /var/lib/mlocate/mlocate.db or /var/lib/slocate/slocate.db
# or /var/cache/locate/locatedb
# FreeBSD /var/db/locate.database
if [ ! "${LOCATEBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
2015-04-27 09:31:43 +02:00
Register --test-no FILE-6410 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --description "Checking Locate database"
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
2015-12-21 21:17:15 +01:00
LogText "Test: Checking locate database"
2014-08-26 17:33:55 +02:00
FOUND=0
2015-09-01 20:50:07 +02:00
LOCATE_DBS="/var/lib/mlocate/mlocate.db /var/lib/locate/locatedb /var/lib/locatedb /var/lib/slocate/slocate.db /var/cache/locate/locatedb /var/db/locate.database"
2014-08-26 17:33:55 +02:00
for I in ${LOCATE_DBS}; do
if [ -f ${I} ]; then
2015-12-21 21:17:15 +01:00
LogText "Result: locate database found (${I})"
2014-08-26 17:33:55 +02:00
FOUND=1
LOCATE_DB="${I}"
else
2015-12-21 21:17:15 +01:00
LogText "Result: file ${I} not found"
2014-08-26 17:33:55 +02:00
fi
done
if [ ${FOUND} -eq 1 ]; then
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- Checking Locate database" --result "${STATUS_FOUND}" --color GREEN
2015-12-21 21:17:15 +01:00
Report "locate_db=${LOCATE_DB}"
2014-08-26 17:33:55 +02:00
else
2015-12-21 21:17:15 +01:00
LogText "Result: database not found"
2016-06-18 11:14:01 +02:00
Display --indent 2 --text "- Checking Locate database" --result "${STATUS_NOT_FOUND}" --color YELLOW
2014-08-26 17:33:55 +02:00
ReportSuggestion ${TEST_NO} "The database required for 'locate' could not be found. Run 'updatedb' or 'locate.updatedb' to create this file."
fi
fi
#
#################################################################################
#
# Test : FILE-6420
# Description : Check automount process
2016-05-11 16:02:46 +02:00
# Want to contribute to Lynis? Create this test
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
# Test : FILE-6422
# Description : Check automount maps (files or for example LDAP based)
# Notes : Warn when automounter is running
2016-05-11 16:02:46 +02:00
# Want to contribute to Lynis? Create this test
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
# Test : FILE-6424
# Description : Check automount map files
2016-05-11 16:02:46 +02:00
# Want to contribute to Lynis? Create this test
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
# Test : FILE-6425
# Description : Check mounted files systems via automounter
# Notes : Warn when no systems are mounted?
2016-05-11 16:02:46 +02:00
# Want to contribute to Lynis? Create this test
2016-07-11 10:24:38 +02:00
#
#################################################################################
#
# Test : FILE-6430
2016-07-11 11:18:53 +02:00
# Description : Disable mounting of some filesystems
# Rationale : Unless there is a specific reason to use a particular file system, disable it.
# Data : cramfs freevxfs hfs hfsplus jffs2 squashfs udf
Register --test-no FILE-6430 --weight L --network NO --description "Disable mounting of some filesystems"
2016-07-11 10:24:38 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
if [ ! "${LSMODBINARY}" = "" -a -f /proc/modules ]; then
2016-07-11 11:18:53 +02:00
Display --indent 2 --text "- Disable mounting of some filesystems"
LIST_FS_NOT_SUPPORTED="cramfs freevxfs hfs hfsplus jffs2 squashfs udf"
2016-07-11 10:24:38 +02:00
for FS in ${LIST_FS_NOT_SUPPORTED}; do
2016-07-11 11:18:53 +02:00
Display --indent 4 --text "- Disable mounting of ${FS} filesystem"
LogText "Test: Checking if ${FS} is not present in loaded modules"
2016-07-11 10:24:38 +02:00
# Check if FS is present in lsmod output
2016-07-11 11:18:53 +02:00
FIND=`${LSMODBINARY} | ${EGREPBINARY} "^${FS}"`
if [ -z "${FIND}" ]; then
LogText "Result: module ${FS} not loaded in the kernel"
Display --indent 6 --text "- Module ${FS} not loaded in the kernel" --result OK --color GREEN
AddHP 2 2
2016-07-11 10:24:38 +02:00
else
2016-07-11 11:18:53 +02:00
LogText "Result: module ${FS} loaded in the kernel"
Display --indent 6 --text "- Module $FS loaded in the kernel" --result "FOUND" --color YELLOW
AddHP 2 5
2016-07-11 10:24:38 +02:00
fi
# Check if FS is present in modprobe output
2016-07-11 11:18:53 +02:00
FIND=`${MODPROBEBINARY} -v -n $FS 2>/dev/null | ${EGREPBINARY} "/${FS}.ko" | tail -1`
if [ ! -z "${FIND}" ]; then
LogText "Result: found module support in kernel: ${FIND}"
Display --indent 6 --text "- Module ${FS} present in the kernel" --result "FOUND" --color YELLOW
AddHP 2 3
2016-07-11 10:24:38 +02:00
else
2016-07-11 11:18:53 +02:00
AddHP 2 2
Display --indent 6 --text "- Module ${FS} not present in the kernel" --result OK --color GREEN
#ReportSuggestion ${TEST_NO} "The modprobe.d directory should contain a file with the entry 'install ${FS} /bin/true'"
2016-07-11 10:24:38 +02:00
fi
done
else
LogText "Test skipped lsmod binary not found or /proc/modules can not be opened"
fi
fi
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
2016-04-28 12:31:57 +02:00
WaitForKeyPress
2014-08-26 17:33:55 +02:00
#
#================================================================================
2016-03-13 16:03:46 +01:00
# Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com
