lynis/include/tests_php

#!/bin/sh

#################################################################################
#
#   Lynis
# ------------------
#
# Copyright 2007-2013, Michael Boelen
# Copyright 2007-2017, CISOfy
#
# Website  : https://cisofy.com
# Blog     : http://linux-audit.com
# GitHub   : https://github.com/CISOfy/lynis
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Software: PHP
#
#################################################################################
#
    InsertSection "PHP"

    # Possible locations of php.ini
    PHPINILOCS="${ROOTDIR}etc/php.ini ${ROOTDIR}etc/php.ini.default \
                ${ROOTDIR}etc/php/php.ini ${ROOTDIR}etc/php5.5/php.ini ${ROOTDIR}etc/php5.6/php.ini ${ROOTDIR}etc/php7.0/php.ini ${ROOTDIR}etc/php7.1/php.ini ${ROOTDIR}etc/php7.2/php.ini \
                ${ROOTDIR}etc/php/cgi-php5/php.ini ${ROOTDIR}etc/php/cli-php5/php.ini ${ROOTDIR}etc/php/apache2-php5/php.ini \
                ${ROOTDIR}etc/php/apache2-php5.5/php.ini ${ROOTDIR}etc/php/apache2-php5.6/php.ini ${ROOTDIR}etc/php/apache2-php7.0/php.ini ${ROOTDIR}etc/php/apache2-php7.1/php.ini \
                ${ROOTDIR}etc/php/cgi-php7.1/php.ini ${ROOTDIR}etc/php/apache2-php7.1/php.ini ${ROOTDIR}etc/php/cgi-php5.5/php.ini ${ROOTDIR}etc/php/cgi-php5.6/php.ini ${ROOTDIR}etc/php/cgi-php7.0/php.ini \
                ${ROOTDIR}etc/php/cli-php7.1/php.ini ${ROOTDIR}etc/php/cli-php5.5/php.ini ${ROOTDIR}etc/php/cli-php5.6/php.ini ${ROOTDIR}etc/php/cli-php7.0/php.ini \
                ${ROOTDIR}etc/php/embed-php7.1/php.ini ${ROOTDIR}etc/php/embed-php5.5/php.ini ${ROOTDIR}etc/php/embed-php5.6/php.ini ${ROOTDIR}etc/php/embed-php7.0/php.ini \
                ${ROOTDIR}etc/php/fpm-php7.1/php.ini ${ROOTDIR}etc/php/fpm-php5.5/php.ini ${ROOTDIR}etc/php/fpm-php5.6/php.ini ${ROOTDIR}etc/php/fpm-php7.0/php.ini \
                ${ROOTDIR}etc/php5/cgi/php.ini \
                ${ROOTDIR}etc/php5/cli/php.ini \
                ${ROOTDIR}etc/php5/cli-php5.4/php.ini ${ROOTDIR}etc/php5/cli-php5.5/php.ini ${ROOTDIR}etc/php5/cli-php5.6/php.ini \
                ${ROOTDIR}etc/php5/apache2/php.ini \
                ${ROOTDIR}etc/php5/fpm/php.ini \
                ${ROOTDIR}private/etc/php.ini \
                ${ROOTDIR}etc/php/7.0/cli/php.ini ${ROOTDIR}etc/php/7.0/fpm/php.ini \
                ${ROOTDIR}var/www/conf/php.ini \
                ${ROOTDIR}usr/local/etc/php.ini ${ROOTDIR}usr/local/lib/php.ini \
                ${ROOTDIR}usr/local/etc/php5/cgi/php.ini \
                ${ROOTDIR}usr/local/php54/lib/php.ini \
                ${ROOTDIR}usr/local/php56/lib/php.ini \
                ${ROOTDIR}usr/local/php70/lib/php.ini \
                ${ROOTDIR}usr/local/php71/lib/php.ini \
                ${ROOTDIR}usr/local/zend/etc/php.ini \
                ${ROOTDIR}usr/pkg/etc/php.ini \
                ${ROOTDIR}opt/cpanel/ea-php54/root/etc/php.ini \
                ${ROOTDIR}opt/cpanel/ea-php55/root/etc/php.ini \
                ${ROOTDIR}opt/cpanel/ea-php56/root/etc/php.ini \
                ${ROOTDIR}opt/cpanel/ea-php70/root/etc/php.ini \
                ${ROOTDIR}opt/cpanel/ea-php71/root/etc/php.ini \
                ${ROOTDIR}opt/alt/php44/etc/php.ini \
                ${ROOTDIR}opt/alt/php51/etc/php.ini \
                ${ROOTDIR}opt/alt/php52/etc/php.ini \
                ${ROOTDIR}opt/alt/php53/etc/php.ini \
                ${ROOTDIR}opt/alt/php54/etc/php.ini \
                ${ROOTDIR}opt/alt/php55/etc/php.ini \
                ${ROOTDIR}opt/alt/php56/etc/php.ini \
                ${ROOTDIR}opt/alt/php70/etc/php.ini \
                ${ROOTDIR}opt/alt/php71/etc/php.ini"

    PHPINIDIRS="${ROOTDIR}etc/php5/conf.d \
                ${ROOTDIR}etc/php/7.0/cli/conf.d \
                ${ROOTDIR}etc/php/7.1/cli/conf.d \
                ${ROOTDIR}etc/php/7.2/cli/conf.d \
                ${ROOTDIR}etc/php/7.0/fpm/conf.d \
                ${ROOTDIR}etc/php/7.1/fpm/conf.d \
                ${ROOTDIR}etc/php/7.2/fpm/conf.d \
                ${ROOTDIR}etc/php.d \
                ${ROOTDIR}opt/cpanel/ea-php54/root/etc/php.d ${ROOTDIR}opt/cpanel/ea-php55/root/etc/php.d ${ROOTDIR}opt/cpanel/ea-php56/root/etc/php.d ${ROOTDIR}opt/cpanel/ea-php70/root/etc/php.d \
                ${ROOTDIR}opt/cpanel/ea-php71/root/etc/php.d \
                ${ROOTDIR}opt/alt/php44/etc/php.d.all \
                ${ROOTDIR}opt/alt/php51/etc/php.d.all \
                ${ROOTDIR}opt/alt/php52/etc/php.d.all \
                ${ROOTDIR}opt/alt/php53/etc/php.d.all \
                ${ROOTDIR}opt/alt/php54/etc/php.d.all \
                ${ROOTDIR}opt/alt/php55/etc/php.d.all \
                ${ROOTDIR}opt/alt/php56/etc/php.d.all \
                ${ROOTDIR}opt/alt/php70/etc/php.d.all \
                ${ROOTDIR}opt/alt/php71/etc/php.d.all"
#
#################################################################################
#
    # Test        : PHP-2211
    # Description : Check php.ini presence
    Register --test-no PHP-2211 --weight L --network NO --category security --description "Check php.ini presence"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking for presence php.ini"
        PHPINIFILE=""
        PHPINI_ALLFILES=""
        for FILE in ${PHPINILOCS}; do
            LogText "Test: checking presence ${FILE}"
            if [ -f ${FILE} ]; then
                PHPINIFILE="${FILE}"
                LogText "Result: Found php.ini file (${PHPINIFILE})"
                LogText "Note: Adding file to php.ini array"
                PHPINI_ALLFILES="${PHPINI_ALLFILES} ${PHPINIFILE}"
            else
                LogText "Result: file ${FILE} not found"
            fi
        done

        # Check all known locations
        for DIR in ${PHPINIDIRS}; do
            FIND=$(ls ${DIR}/*.ini 2> /dev/null)
            if [ -z "${FIND}" ]; then
                LogText "Result: no files found for ${DIR}"
            else
                LogText "Result: found files in location ${DIR}, checking"
                for FILE in ${FIND}; do
                    if [ -f ${FILE} ]; then
                        LogText "Result: file ${FILE} exists, adding to php.ini array"
                        PHPINI_ALLFILES="${PHPINI_ALLFILES} ${FILE}"
                    fi
                done
            fi
        done

        if [ ! -z "${PHPINIFILE}" ]; then
            Display --indent 2 --text "- Checking PHP" --result "${STATUS_FOUND}" --color GREEN
            LogText "Result: using single file ${PHPINIFILE} for main php.ini tests"
            LogText "Result: using php.ini array ${PHPINI_ALLFILES} for further tests"
        else
            Display --indent 2 --text "- Checking PHP" --result "${STATUS_NOT_FOUND}" --color WHITE
            LogText "Result: no php.ini file found"
        fi
        unset DIR; unset FILE; unset FIND
    fi
#
#################################################################################
#
    # Test        : PHP-2320
    # Description : Check php disable functions option
    if [ ! -z "${PHPINI_ALLFILES}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no PHP-2320 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP disabled functions"
    if [ ${SKIPTEST} -eq 0 ]; then
        FOUND=0
        for I in ${PHPINI_ALLFILES}; do
            LogText "Test: Checking for PHP function hardening disabled_functions or suhosin.executor.func.blacklist in file ${I}"
            FIND=$(${GREPBINARY} "^disable_functions.*=" ${I})
            if [ -z "${FIND}" ]; then
                LogText "Result: ${I}: disabled_functions not found"
            else
                LogText "Result: ${I}: found disabled_functions"
                FOUND=1
            fi

            FIND=$(${GREPBINARY} "^suhosin.executor.func.blacklist=" ${I})
            if [ -z "${FIND}" ]; then
                LogText "Result: ${I}: suhosin.executor.func.blacklist not found"
            else
                LogText "Result: ${I}: found suhosin.executor.func.blacklist"
                FOUND=1
            fi
        done
        if [ ${FOUND} -eq 0 ]; then
            LogText "Result: all PHP functions can be executed"
            Display --indent 4 --text "- Checking PHP disabled functions" --result "${STATUS_NONE}" --color YELLOW
            ReportSuggestion ${TEST_NO} "Harden PHP by disabling risky functions"
            LogText "Functions of interest to research/disable: chown, diskfreespace, disk_free_space, disk_total_space, dl, exec, escapeshellarg, escapeshellcmd, fileinode, highlight_file, max_execution_time, passthru, pclose, phpinfo, popen, proc_close, proc_open, proc_get_status, proc_nice, proc_open, proc_terminate, set_time_limit, shell_exec, show_source, system)"
            AddHP 0 1
        else
            LogText "Result: one or more PHP functions are disabled/blacklisted"
            Display --indent 4 --text "- Checking PHP disabled functions" --result "${STATUS_FOUND}" --color GREEN
            AddHP 3 3
        fi
    fi
#
#################################################################################
#
    # Test        : PHP-2368
    # Description : Check php register_globals option
    # Notes       : Don't test for it if PHP version is 5.4.0 or later (it has been removed)
    if [ ! -z "${PHPINIFILE}" -a ! -z "${PHPVERSION}" -a ! -z "${EGREPBINARY}" ]; then
        if [ -f "${PHPINIFILE}" ]; then
            FIND=$(echo ${PHPVERSION} | ${EGREPBINARY} "^(4.|5.[0-3])")
            if [ -z "${FIND}" ]; then
                PREQS_MET="NO"; Debug "Found most likely PHP version 5.4.0 or higher (${PHPVERSION}) which does not use register_globals"
            else
                PREQS_MET="YES"; Debug "Found PHP version 4 or up to 5.3 (${FIND}) which we are going to scan"
            fi
        else
            Debug "File php.ini (${PHPINIFILE}) not found"
        fi
    else
        PREQS_MET="NO"
        Debug "Skipping test: php.ini not found, or PHP version empty"
        Debug "php.ini: ${PHPINIFILE}"
        Debug "version: ${PHPVERSION}"
    fi
    Register --test-no PHP-2368 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP register_globals option"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking PHP register_globals option"
        FIND=$(${EGREPBINARY} -i 'register_globals.*(on|yes|1)' ${PHPINIFILE} | ${GREPBINARY} -v '^;')
        if [ ! -z "${FIND}" ]; then
            Display --indent 4 --text "- Checking register_globals option" --result "${STATUS_WARNING}" --color RED
            ReportWarning ${TEST_NO} "PHP option register_globals option is turned on, which can be a risk for variable value overwriting"
            ReportSuggestion ${TEST_NO} "Change the register_globals line to: register_globals = Off"
            LogText "Result: register_globals option is turned on, which can be a risk for variable value overwriting."
            AddHP 1 2
        else
            Display --indent 4 --text "- Checking register_globals option" --result "${STATUS_OK}" --color GREEN
            LogText "Result: No 'register_globals' found. Most likely it is in disabled state (0, no, or off), which is the default nowadays and considered the safe value."
            ReportManual ${TEST_NO}:01
            AddHP 2 2
        fi
    fi
#
#################################################################################
#
    # Test        : PHP-2372
    # Description : Check php expose_php option
    # Notes       : Extend test to check all PHP files YYY
    if [ ! -z "${PHPINIFILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no PHP-2372 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP expose_php option"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking expose_php option"
        FIND=$(${EGREPBINARY} -i 'expose_php.*(off|no|0)' ${PHPINIFILE} | ${GREPBINARY} -v '^;')
        if [ -z "${FIND}" ]; then
            Display --indent 4 --text "- Checking expose_php option" --result "${STATUS_ON}" --color RED
            ReportWarning ${TEST_NO} "PHP option expose_php is possibly turned on, which can reveal useful information for attackers."
            ReportSuggestion ${TEST_NO} "Change the expose_php line to: expose_php = Off"
            Report "Result: expose_php option is turned on, which can expose useful information for an attacker"
            AddHP 1 2
        else
            Display --indent 4 --text "- Checking expose_php option" --result "${STATUS_OFF}" --color GREEN
            LogText "Result: Found 'expose_php' in disabled state (0, no, or off)"
            AddHP 2 2
        fi
        # TODO Check through all files
    fi
#
#################################################################################
#
    # Test        : PHP-2374
    # Description : Check PHP enable_dl option
    # Notes       : Extend test to check all PHP files
    if [ ! -z "${PHPINIFILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no PHP-2374 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP enable_dl option"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking PHP enable_dl option"
        FIND=$(${EGREPBINARY} -i 'enable_dl.*(on|yes|1)' ${PHPINIFILE} | ${GREPBINARY} -v '^;')
        if [ ! -z "${FIND}" ]; then
            Display --indent 4 --text "- Checking enable_dl option" --result "${STATUS_ON}" --color YELLOW
            Report "Result: enable_dl option is turned on, which can be used to enable more modules dynamically and circumventing security controls"
            ReportSuggestion ${TEST_NO} "Change the enable_dl line to: enable_dl = Off, to disable dynamically loading new modules"
            AddHP 0 1
        else
            Display --indent 4 --text "- Checking enable_dl option" --result "${STATUS_OFF}" --color GREEN
            LogText "Result: Found 'enable_dl' in disabled state (not present, 0, no, or off)"
            AddHP 2 2
        fi
    fi
#
#################################################################################
#
    # Test        : PHP-2376
    # Description : Check PHP allow_url_fopen option
    # Notes       : Extend test to check all PHP files YYY
    if [ ! -z "${PHPINIFILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no PHP-2376 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP allow_url_fopen option"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking PHP allow_url_fopen option"
        FIND=$(${EGREPBINARY} -i 'allow_url_fopen.*(off|no|0)' ${PHPINIFILE} | ${GREPBINARY} -v '^;')
        if [ -z "${FIND}" ]; then
            Display --indent 4 --text "- Checking allow_url_fopen option" --result "${STATUS_ON}" --color YELLOW
            LogText "Result: allow_url_fopen option is turned on, which can be used for riskful downloads via PHP"
            ReportSuggestion ${TEST_NO} "Change the allow_url_fopen line to: allow_url_fopen = Off, to disable downloads via PHP"
            AddHP 0 1
        else
            Display --indent 4 --text "- Checking allow_url_fopen option" --result "${STATUS_OFF}" --color GREEN
            LogText "Result: Found 'allow_url_fopen' in disabled state (0, no, or off)"
            AddHP 2 2
        fi
        # TODO Check through all files
    fi
#
#################################################################################
#
    # Test        : PHP-2378
    # Description : Check PHP allow_url_include option
    # Notes       : Extend test to check all PHP files YYY
    if [ ! -z "${PHPINIFILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no PHP-2378 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP allow_url_include option"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking PHP allow_url_include option"
        FIND=$(${EGREPBINARY} -i 'allow_url_include.*(off|no|0)' ${PHPINIFILE} | ${GREPBINARY} -v '^;')
        if [ -z "${FIND}" ]; then
            Display --indent 4 --text "- Checking allow_url_include option" --result "${STATUS_ON}" --color YELLOW
            Report "Result: allow_url_include option is turned on, which can be used for riskful downloads via PHP"
            ReportSuggestion ${TEST_NO} "Change the allow_url_include line to: allow_url_include = Off, to disable downloads via PHP"
            AddHP 0 1
        else
            Display --indent 4 --text "- Checking allow_url_include option" --result "${STATUS_OFF}" --color GREEN
            LogText "Result: Found 'allow_url_include' in disabled state (0, no, or off)"
            AddHP 2 2
        fi
    fi
#
#################################################################################
#
    # Test        : PHP-2379
    # Description : Check PHP suhosin extension status
    if [ ! -z "${PHPINI_ALLFILES}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no PHP-2379 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP suhosin extension status"

    if [ ${SKIPTEST} -eq 0 ]; then
        FOUND=0
        SIMULATION=0
        MAJOR_VERSION=$(echo ${PHPVERSION} | ${EGREPBINARY} "^7")
        if [ "${OS}" = "OpenBSD" ]; then
            FOUND=1                    # On OpenBSD, Suhosin is hard linked into PHP
            SIMULATION=off
        else
            for I in ${PHPINI_ALLFILES}; do
                LogText "Test: Checking for PHP suhosin extension status in file ${I}"
                FIND=$(${GREPBINARY} -oP '^extension=.*?suhosin7?.so.*$' ${I})
                if [ -z "${FIND}" ]; then
                    LogText "Result: ${I}: suhosin is not enabled"
                else
                    LogText "Result: ${I}: suhosin is enabled"
                    FOUND=1
                fi

                LogText "Test: Check Suhosin simulation mode status"
                SIMULATION=$(${GREPBINARY} -oP '^suhosin.simulation.*$' ${I} | ${CUTBINARY} -d= -f2 | ${GREPBINARY} -io 'off' | ${TRBINARY} '[:upper:]' '[:lower:]')
                if [ "${SIMULATION}" = "off" ]; then
                    LogText "Result: ${I}: suhosin simulation mode is not active"
                else
                    LogText "Result: ${I}: suhosin simulation mode is active"
                fi
            done
        fi

        # Check Suhosin for PHP 7
        if [ ! -z ${MAJOR_VERSION} -a ${FOUND} -eq 1 ]; then
            LogText "Test: Check Suhosin for PHP 7 is not enabled"
            LogText "Result: Suhosin for PHP 7 is in alpha stage and should not be used in production"
            ReportSuggestion ${TEST_NO} "Disable Suhosin for PHP 7"
            Display --indent 4 --text "- Checking PHP suhosin extension status" --result "${STATUS_WARNING}" --color RED
            Display --indent 6 --text "- Suhosin is enabled for PHP 7" --result "${STATUS_WARNING}" --color RED
            AddHP 0 1
        elif [ ! -z ${MAJOR_VERSION} -a ${FOUND} -eq 0 ]; then
            LogText "Test: Check Suhosin for PHP 7 is not enabled"
            LogText "Result: Suhosin for PHP 7 is not enabled"
            Display --indent 4 --text "- Checking PHP suhosin extension status" --result "${STATUS_OK}" --color GREEN
            Display --indent 6 --text "- Suhosin is not enabled for PHP 7" --result "${STATUS_OK}" --color GREEN
            AddHP 1 1
        else
            if [ ${FOUND} -eq 0 ]; then
                LogText "Result: Suhosin extension is not enabled"
                Display --indent 4 --text "- Checking PHP suhosin extension status" --result "${STATUS_WARNING}" --color RED
                ReportSuggestion ${TEST_NO} "Harden PHP by enabling suhosin extension"
                LogText "suhosin extension is not enabled"
                AddHP 0 1
    
            else
                LogText "Result: Suhosin extension is enabled"
                Display --indent 4 --text "- Checking PHP suhosin extension status" --result "${STATUS_OK}" --color GREEN
                AddHP 2 2
            fi
    
            if [ "${SIMULATION}" = "off" ]; then
                LogText "Result: Suhosin simulation mode is not active"
                Display --indent 6 --text "- Suhosin simulation mode status" --result "${STATUS_OK}" --color GREEN
                AddHP 2 2
            else
                LogText "Result: Suhosin simulation mode is active"
                Display --indent 6 --text "- Suhosin simulation mode status" --result "${STATUS_WARNING}" --color RED
                ReportSuggestion ${TEST_NO} "Harden PHP by deactivating suhosin simulation mode"
                LogText "suhosin simulation mode is active"
                AddHP 0 1
            fi
        fi
    fi
#
#################################################################################
#

WaitForKeyPress

#
#================================================================================
# Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com