tyler.durden
/
lynis
mirror of https://github.com/CISOfy/lynis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
lynis/include/tests_mail_messaging

271 lines
12 KiB
Plaintext
Raw Normal View History

Initial import
2014-08-26 17:33:55 +02:00
#!/bin/sh
#################################################################################
#
# Lynis
# ------------------
#
# Copyright 2007-2014, Michael Boelen (michael@rootkit.nl), The Netherlands
# Web site: http://www.rootkit.nl
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# E-mail and messaging
#
#################################################################################
#
InsertSection "Software: e-mail and messaging"
#
#################################################################################
#
DOVECOT_RUNNING=0
EXIM_RUNNING=0
SMTP_DAEMON=""
POSTFIX_RUNNING=0
QMAIL_RUNNING=0
SENDMAIL_RUNNING=0
Check for OpenSMTPD on all platforms, but only if smtpctl is found
2014-11-29 16:20:20 +01:00
OPENSMTPD_RUNNING=0
Initial import
2014-08-26 17:33:55 +02:00
#
#################################################################################
#
# Test : MAIL-8802
# Description : Check Exim process status
Register --test-no MAIL-8802 --weight L --network NO --description "Check Exim status"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: check Exim status"
IsRunning exim
if [ ${RUNNING} -eq 1 ]; then
logtext "Result: found running Exim process"
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking Exim status" --result RUNNING --color GREEN
Initial import
2014-08-26 17:33:55 +02:00
EXIM_RUNNING=1
SMTP_DAEMON="exim"
else
logtext "Result: no running Exim processes found"
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking Exim status" --result "NOT FOUND" --color WHITE
Initial import
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : MAIL-8804
# Description : Check Exim configuration
#if [ ${EXIM_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
#Register --test-no MAIL-8804 --weight L --network NO --description "Check Exim configuration"
#if [ ${SKIPTEST} -eq 0 ]; then
# if [ ! "${EXIMBINARY}" = "" ]; then
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
# logtext "Test: Searching Exim configuration file"
Initial import
2014-08-26 17:33:55 +02:00
# FIND=`${EXIMBINARY} -d | grep "configuration file is" | sed 's/configuration file is//'`
# if [ ! "${FIND}" = "" ]; then
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
# Display --indent 2 --text "- Checking Exim configuration" --result FOUND --color GREEN
Initial import
2014-08-26 17:33:55 +02:00
# Display --indent 4 --text "Result: configuration file is ${FIND}"
# logtext "Result: found Exim"
# logtext "Result: configuration file is ${FIND}"
# else
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
# Display --indent 2 --text "- Checking Exim configuration" --result WARNING --color RED
Initial import
2014-08-26 17:33:55 +02:00
# logtext "Couldn't find the Exim configuration file, however Exim seems to be installed."
# fi
# else
# logtext "Exim binary not found, no tests performed"
# fi
#
#################################################################################
#
# Test : MAIL-8814
# Description : Check Postfix process
# Notes : qmgr and pickup run under postfix uid, without full path to binary
Register --test-no MAIL-8814 --weight L --network NO --description "Check postfix process status"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: check Postfix status"
# Some other processes also use master, therefore it should include both master and postfix
FIND1=`${PSBINARY} ax | grep "master" | grep "postfix" | grep -v "grep"`
Made adjustments to run in non-privileged scans
2014-09-09 14:49:37 +02:00
#FIND2=`${PSBINARY} ax | grep "qmgr" | grep "postfix" | grep -v "grep"`
#FIND3=`${PSBINARY} ax | grep "pickup" | grep "postfix" | grep -v "grep"`
if [ ! "${FIND1}" = "" ]; then
Initial import
2014-08-26 17:33:55 +02:00
logtext "Result: found running Postfix process"
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking Postfix status" --result RUNNING --color GREEN
Initial import
2014-08-26 17:33:55 +02:00
POSTFIX_RUNNING=1
SMTP_DAEMON="postfix"
else
logtext "Result: no running Postfix processes found"
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking Postfix status" --result "NOT FOUND" --color WHITE
Initial import
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : MAIL-8816
# Description : Check Postfix configuration
if [ ${POSTFIX_RUNNING} -eq 1 -a ! "${POSTFIXBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no MAIL-8816 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check Postfix configuration"
if [ ${SKIPTEST} -eq 0 ]; then
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking Postfix configuration" --result FOUND --color GREEN
Initial import
2014-08-26 17:33:55 +02:00
POSTFIX_CONFIGDIR=`${POSTCONFBINARY} | grep '^config_directory' | awk '{ print $3 }'`
POSTFIX_CONFIGFILE="${POSTFIX_CONFIGDIR}/main.cf"
logtext "Postfix configuration directory: ${POSTFIX_CONFIGDIR}"
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
logtext "Postfix configuration file: ${POSTFIX_CONFIGFILE}"
Initial import
2014-08-26 17:33:55 +02:00
fi
#
#################################################################################
#
# Test : MAIL-8818
# Description : Check Postfix configuration
if [ ${POSTFIX_RUNNING} -eq 1 -a ! "${POSTFIXBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no MAIL-8818 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check Postfix configuration: banner"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: Checking Postfix banner"
FIND1=`${POSTCONFBINARY} | grep '^smtpd_banner' | grep 'postfix'`
FIND2=`${POSTCONFBINARY} | grep '^smtpd_banner' | grep '$mail_name'`
FIND3=`${POSTCONFBINARY} | grep '^mail_name' | grep -i 'postfix'`
#YYY Check if OS name shows up in banner
Made adjustments to run in non-privileged scans
2014-09-09 14:49:37 +02:00
#FIND4=`${POSTCONFBINARY} | grep '^smtpd_banner' | egrep "${OS}|${LINUX_VERSION}`
Initial import
2014-08-26 17:33:55 +02:00
SHOWWARNING=0
if [ ! "${FIND1}" = "" ]; then
SHOWWARNING=1
else
if [ ! "${FIND2}" = "" -a ! "${FIND3}" = "" ]; then
SHOWWARNING=1
else
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
Display --indent 4 --text "- Checking Postfix banner" --result OK --color GREEN
Initial import
2014-08-26 17:33:55 +02:00
fi
fi
if [ ${SHOWWARNING} -eq 1 ]; then
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
Display --indent 4 --text "- Checking Postfix banner" --result WARNING --color RED
Initial import
2014-08-26 17:33:55 +02:00
logtext "Result: found mail_name in SMTP banner, and/or mail_name contains 'Postfix'."
ReportWarning ${TEST_NO} "L" "Found mail_name in SMTP banner, and/or mail_name contains 'Postfix'"
ReportSuggestion ${TEST_NO} "You are adviced to hide the mail_name (option: smtpd_banner) from your postfix configuration. Use postconf -e or change your main.cf file (${POSTFIX_CONFIGFILE})"
fi
fi
#
#################################################################################
#
# Test : MAIL-8838
# Description : Check Dovecot process
Register --test-no MAIL-8838 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check dovecot process"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: check dovecot status"
IsRunning dovecot
if [ ${RUNNING} -eq 1 ]; then
logtext "Result: found running dovecot process"
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking Dovecot status" --result RUNNING --color GREEN
Initial import
2014-08-26 17:33:55 +02:00
DOVECOT_RUNNING=1
IMAP_DAEMON="dovecot"
POP3_DAEMON="dovecot"
else
logtext "Result: dovecot not found"
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking Dovecot status" --result "NOT FOUND" --color WHITE
Initial import
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : MAIL-8842
# Description : Check Dovecot logging locations
#Register --test-no MAIL-8842 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check dovecot logging locations"
#if [ ${SKIPTEST} -eq 0 ]; then
# ParseDovecot
# CONF="/etc/dovecot/dovecot.conf"
# FIND=`cat ${CONF} | grep "^log_path" | awk '{ if ($1=="") { print "syslog" } else { print $3 } }'`
# if [ ! "${FIND}" = "" ]; then
# logtext "Result: output for error messages = ${FIND}"
# fi
#
# FIND=`cat ${CONF} | grep "^log_info_path" | awk '{ if ($1=="") { print "syslog" } else { print $3 } }'`
# if [ ! "${FIND}" = "" ]; then
# logtext "Result: output for informational messages = ${FIND}"
# fi
#
# fi
#
#################################################################################
#
# Test : MAIL-8860
# Description : Check Qmail process status
Register --test-no MAIL-8860 --weight L --network NO --description "Check Qmail status"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: check Qmail status"
IsRunning qmail-smtpd
if [ ${RUNNING} -eq 1 ]; then
logtext "Result: found running Qmail process"
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking Qmail status" --result RUNNING --color GREEN
Initial import
2014-08-26 17:33:55 +02:00
QMAIL_RUNNING=1
Log proper daemon qmail/sendmail
2014-08-28 14:03:31 +02:00
SMTP_DAEMON="qmail"
Initial import
2014-08-26 17:33:55 +02:00
else
logtext "Result: no running Qmail processes found"
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking Qmail status" --result "NOT FOUND" --color WHITE
Initial import
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : MAIL-8880
# Description : Check Sendmail process status
Register --test-no MAIL-8880 --weight L --network NO --description "Check Sendmail status"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: check sendmail status"
IsRunning sendmail
if [ ${RUNNING} -eq 1 ]; then
logtext "Result: found running Sendmail process"
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking Sendmail status" --result RUNNING --color GREEN
Initial import
2014-08-26 17:33:55 +02:00
SENDMAIL_RUNNING=1
SMTP_DAEMON="sendmail"
else
logtext "Result: no running Sendmail processes found"
Code cleanup and small enhancements
2014-09-15 12:01:09 +02:00
Display --indent 2 --text "- Checking Sendmail status" --result "NOT FOUND" --color WHITE
Initial import
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : MAIL-8920
Check for OpenSMTPD on all platforms, but only if smtpctl is found
2014-11-29 16:20:20 +01:00
# Description : Check OpenSMTPD process status
Added proper check for smtpctl binary
2014-11-29 16:22:36 +01:00
if [ ! "${SMTPCTLBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Check for OpenSMTPD on all platforms, but only if smtpctl is found
2014-11-29 16:20:20 +01:00
Register --test-no MAIL-8920 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check OpenSMTPD status"
Initial import
2014-08-26 17:33:55 +02:00
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: check smtpd status"
Added additional process check for OpenSMTPD
2014-12-05 13:27:29 +01:00
FIND=`${PSBINARY} ax | egrep "(/smtpd|smtpd: smtp)" | grep -v "grep"`
Initial import
2014-08-26 17:33:55 +02:00
if [ ! "${FIND}" = "" ]; then
logtext "Result: found running smtpd process"
Check for OpenSMTPD on all platforms, but only if smtpctl is found
2014-11-29 16:20:20 +01:00
Display --indent 2 --text "- Checking OpenSMTPD status" --result RUNNING --color GREEN
OPENSMTPD_RUNNING=1
SMTP_DAEMON="opensmtpd"
Initial import
2014-08-26 17:33:55 +02:00
else
logtext "Result: smtpd not found"
Check for OpenSMTPD on all platforms, but only if smtpctl is found
2014-11-29 16:20:20 +01:00
Display --indent 2 --text "- Checking OpenSMTPD status" --result "NOT FOUND" --color WHITE
Initial import
2014-08-26 17:33:55 +02:00
fi
fi
#
#################################################################################
#
# Test : MAIL-xxxx
# Description : Check if outgoing mail is obscured (increased privacy)
#Register --test-no MAIL-xxxx --weight L --network NO --description "Check XXX"
#if [ ${SKIPTEST} -eq 0 ]; then
#
#################################################################################
#
#YYY Add support for mail, procmail
#YYY Add support for MUAs: Thunderbird, Kmail, Evolution
# Other software : Cyrus-IMAP, Amavisd-new, SpamAssassin, Fetchmail, Procmail, maildrop
#- Dovecot : \'/usr/local/etc/dovecot.conf\'
#- For Sendmail : \'/var/mail/sendmail.cf\'
#- Fetchmail : \'~/.fetchmailrc\' (not only root)
#- Cyrus-IMAP : \'/usr/local/etc/imapd.conf\' for parameters and \'/usr/local/etc/cyrus.conf\' for the services launched
#
#################################################################################
#
report "imap_daemon=${IMAP_DAEMON}"
report "pop3_daemon=${POP3_DAEMON}"
report "smtp_daemon=${SMTP_DAEMON}"
wait_for_keypress
#
#================================================================================
# Lynis - Copyright 2007-2014, Michael Boelen - www.rootkit.nl - The Netherlands