lynis/include/tests_time

#!/bin/sh

#################################################################################
#
#   Lynis
# ------------------
#
# Copyright 2007-2016, Michael Boelen, CISOfy (michael.boelen@cisofy.com)
# Web site: https://cisofy.com
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Time
#
#################################################################################
#
    InsertSection "Time and Synchronization"
#
#################################################################################
#
    CRON_DIRS="/etc/cron.d /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly /var/spool/crontabs"
    NTP_DAEMON=""
    NTP_DAEMON_RUNNING=0
    NTP_CONFIG_FOUND=0
    NTP_CONFIG_TYPE_DAEMON=0
    NTP_CONFIG_TYPE_SCHEDULED=0
    NTP_CONFIG_TYPE_EVENTBASED=0
    NTP_CONFIG_TYPE_STARTUP=0
    NTPD_RUNNING=0 # Specific for ntpd
    SYSTEMD_NTP_ENABLED=0
#
#################################################################################
#
    # Test        : TIME-3104
    # Description : Check for a running NTP daemon
    if [ -f /sys/hypervisor/type ]; then
          # Skip NTP tests if we are in a DomU xen instance YYY
          FIND=`cat /sys/hypervisor/type`
          if [ "${FIND}" = "xen" ]; then PREQS_MET="NO"; else PREQS_MET="YES"; fi
        else
          PREQS_MET="YES"
    fi
    Register --test-no TIME-3104 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check for running NTP daemon or client"
    if [ ${SKIPTEST} -eq 0 ]; then
        # Linux/FreeBSD (ntpdate), OpenBSD (ntpd, rdate), Chrony, systemd-timesyncd
        LogText "Test: Searching for a running NTP daemon or available client"
        FOUND=0

        if [ -f /etc/chrony.conf ]; then
            IsRunning chronyd
            if [ ${RUNNING} -eq 1 ]; then
                FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="chronyd"
                Display --indent 2 --text "- NTP daemon found: chronyd" --result FOUND --color GREEN
            fi
        fi

        # Check time daemon (eg DragonFly BSD)
        IsRunning dntpd
        if [ ${RUNNING} -eq 1 ]; then
            FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="dntpd"
            Display --indent 2 --text "- NTP daemon found: dntpd" --result FOUND --color GREEN
        fi

        # Check running processes
        FIND=`${PSBINARY} ax | grep "ntpd" | grep -v "dntpd" | grep -v "grep"`
        if [ ! "${FIND}" = "" ]; then
            FOUND=1; NTPD_RUNNING=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1
            NTP_DAEMON="ntpd"
            LogText "Result: found running NTP daemon in process list"
            Display --indent 2 --text "- NTP daemon found: ntpd" --result FOUND --color GREEN
        fi

        # Check time daemon (eg NetBSD)
        IsRunning timed
        if [ ${RUNNING} -eq 1 ]; then
            FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="timed"
            Display --indent 2 --text "- NTP daemon found: timed" --result FOUND --color GREEN
        fi

        # Check timedate daemon (systemd)
        if [ ! "${TIMEDATECTL}" = "" ]; then
            FIND=`${TIMEDATECTL} status | grep "NTP enabled: yes"`
            if [ ! "${FIND}" = "" ]; then
                # Check for systemd-timesyncd
                if [ -f /etc/systemd/timesyncd.conf ]; then
                    FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="systemd-timesyncd"
                    Display --indent 2 --text "- NTP daemon found: systemd (timesyncd)" --result "FOUND" --color GREEN
                    SYSTEMD_NTP_ENABLED=1
                fi
              else
                LogText "Result: time sychronization not performed according timedatectl command"
            fi
        fi

        # Check crontab for OpenBSD/FreeBSD
        # Check anacrontab for Linux
        CRONTAB_FILES="/etc/anacrontab /etc/crontab"
        for I in ${CRONTAB_FILES}; do
            if [ -f ${I} ]; then
                LogText "Test: checking for ntpdate or rdate in crontab file ${I}"
                FIND=`${EGREPBINARY} "ntpdate|rdate" ${I} | grep -v '^#'`
                if [ ! "${FIND}" = "" ]; then
                    FOUND=1; NTP_CONFIG_TYPE_SCHEDULED=1
                    Display --indent 2 --text "- Checking NTP client in crontab file (${I})" --result FOUND --color GREEN
                    LogText "Result: found ntpdate or rdate reference in crontab file ${I}"
                  else
                    #Display --indent 2 --text "- Checking NTP client in crontab file (${I})" --result "NOT FOUND" --color WHITE
                    LogText "Result: no ntpdate or rdate reference found in crontab file ${I}"
                fi
              else
                LogText "Result: crontab file ${I} not found"
            fi
        done

        # Don't run check in cron job directory on Solaris
        # /etc/cron.d/FIFO is a special file and test get stuck at this file
        FOUND_IN_CRON=0

        # Check cron jobs
        for I in ${CRON_DIRS}; do
            if [ -d ${I} ]; then
                FIND=`ls ${I} | grep -v FIFO`
                if [ ! "${FIND}" = "" ]; then
                    for J in ${FIND}; do
                        LogText "Test: checking for ntpdate or rdate in ${I}/${J}"
                        FIND2=`${EGREPBINARY} "rdate|ntpdate" ${I}/${J} | grep -v "^#"`
                        if [ ! "${FIND2}" = "" ]; then
                            LogText "Positive match found: ${FIND2}"
                            FOUND=1; FOUND_IN_CRON=1; NTP_CONFIG_TYPE_SCHEDULED=1
                        fi
                    done
                  else
                    LogText "Result: ${I} is empty, skipping search in directory"
                fi
            fi
        done

        if [ ${FOUND_IN_CRON} -eq 1 ]; then
            Display --indent 2 --text "- Checking NTP client in cron files" --result FOUND --color GREEN
            LogText "Result: found ntpdate or rdate in cron directory"
          else
            #Display --indent 2 --text "- Checking NTP client in cron.d files" --result "NOT FOUND" --color WHITE
            LogText "Result: no ntpdate or rdate found in cron directories"
        fi

        # Checking if ntpdate is performed by event
        LogText "Test: checking for file /etc/network/if-up.d/ntpdate"
        if [ -f /etc/network/if-up.d/ntpdate ]; then
            LogText "Result: found ntpdate action when network interface comes up"
            FOUND=1
            NTP_CONFIG_TYPE_EVENTBASED=1
            Display --indent 2 --text "- Checking event based ntpdate (if-up)" --result FOUND --color GREEN
          else
            LogText "Result: file /etc/network/if-up.d/ntpdate does not exist"
        fi

        # Configuration file for *BSD
        if [ -f /etc/rc.conf ]; then
                LogText "Test: Checking if ntpdate is enabled at startup in *BSD"
                FIND=`grep 'ntpdate_enable="YES"' /etc/rc.conf`
                if [ ! "${FIND}" = "" ]; then
                    LogText "Result: ntpdate is enabled in rc.conf"
                    FOUND=1
                    NTP_CONFIG_TYPE_STARTUP=1
                    # Only show suggestion when ntpdate is enabled, however ntpd is not running
                    if [ ${NTP_DAEMON_RUNNING} -eq 0 ]; then
                        ReportSuggestion ${TEST_NO} "Although ntpdate is enabled in rc.conf, it is advised to run it at least daily or use a NTP daemon"
                    fi
                  else
                    LogText "Result: ntpdate is not enabled in rc.conf"
                fi
        fi

        if [ ${FOUND} -eq 0 ]; then
            if [ ${ISVIRTUALMACHINE} -eq 1 ]; then
                LogText "Result: Skipping display warning, as virtual machines usually don't need time synchronization in the VM itself"
              else
                Display --indent 2 --text "- Checking for a running NTP daemon or client" --result WARNING --color RED
                LogText "Result: Could not find a NTP daemon or client"
                ReportSuggestion ${TEST_NO} "Use NTP daemon or NTP client to prevent time issues."
                AddHP 0 2
            fi
          else
            Display --indent 2 --text "- Checking for a running NTP daemon or client" --result OK --color GREEN
            LogText "Result: Found a time syncing daemon/client."
            AddHP 3 3
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3106
    # Description : Check status of systemd time synchronization
    if [ ${SYSTEMD_NTP_ENABLED} -eq 1 -a ! "${TIMEDATECTL}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3106 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check systemd NTP time synchronization status"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Check the status of time synchronization via timedatectl"
        FIND=`${TIMEDATECTL} status | grep "NTP sychronized: yes"`
        if [ "${FIND}" = "" ]; then
            LogText "Result: time not synchronized via NTP"
            ReportSuggestion "${TEST_NO}" "Check timedatectl output. Sychronization via NTP is enabled, but status reflects it is not synchronized"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3112
    # Description : Check for valid associations from ntpq peers list
    if [ ${NTPD_RUNNING} -eq 1 -a ! "${NTPQBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3112 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check active NTP associations ID's"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking for NTP association ID's from ntpq peers list"
        FIND=`${NTPQBINARY} -p -n | grep "No association ID's returned"`
        if [ "${FIND}" = "" ]; then
            Display --indent 2 --text "- Checking valid association ID's" --result FOUND --color GREEN
            LogText "Result: Found one or more association ID's"
          else
            Display --indent 2 --text "- Checking valid association ID's" --result WARNING --color RED
            ReportSuggestion ${TEST_NO} "Check ntp.conf for properly configured NTP servers and a correctly functioning name service."
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3116
    # Description : Check for stratum 16 peers
    if [ ${NTPD_RUNNING} -eq 1 -a ! "${NTPQBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3116 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check peers with stratum value of 16"
    if [ ${SKIPTEST} -eq 0 ]; then
        N=0
        LogText "Test: Checking stratum 16 sources from ntpq peers list"
        FIND=`${NTPQBINARY} -p -n | awk '{ if ($3=="16") { print $1 } }'`
        if [ "${FIND}" = "" ]; then
            Display --indent 2 --text "- Checking high stratum ntp peers" --result OK --color GREEN
            LogText "Result: All peers are lower than stratum 16"
          else
            for I in ${FIND}; do
                LogText "Found stratum 16 peer: ${I}"
                FIND2=`egrep "^ntp:ignore_stratum_16_peer:${I}:" ${PROFILE}`
                if [ "${FIND2}" = "" ]; then
                    N=`expr ${N} + 1`
                  else
                    LogText "Output: host ${I} ignored by profile"
                fi
            done
            # Check if one or more high stratum time servers are found
            if [ ${N} -eq 0 ]; then
                Display --indent 2 --text "- Checking high stratum ntp peers" --result OK --color GREEN
                LogText "Result: all non local servers are lower than stratum 16, or whitelisted within the scan profile"
              else
                Display --indent 2 --text "- Checking high stratum ntp peers" --result WARNING --color RED
                LogText "Result: Found one or more high stratum (16) peers)"
                ReportSuggestion ${TEST_NO} "Check ntpq peers output"
                ReportWarning ${TEST_NO} "L" "Found one or more stratum 16 peers"
            fi
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3120
    # Description : Check unreliable peers from peer list
    # Notes       : Items with # are too far away (network distance)
    #               Items with - are not chosing due clustering algoritm
    if [ ${NTPD_RUNNING} -eq 1 -a ! "${NTPQBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3120 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check unreliable NTP peers"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking unreliable ntp peers"
        FIND=`${NTPQBINARY} -p -n | egrep "^(-|#)" | awk '{ print $1 }' | sed 's/^-//g'`
        if [ "${FIND}" = "" ]; then
            Display --indent 2 --text "- Checking unreliable ntp peers" --result NONE --color GREEN
            LogText "Result: No unreliable peers found"
          else
            Display --indent 2 --text "- Checking unreliable ntp peers" --result FOUND --color YELLOW
            LogText "Result: Found one or more unreliable peers (marked with a minus or dash sign)"
            for I in ${FIND}; do
                LogText "Unreliable peer: ${I}"
            done
            ReportSuggestion ${TEST_NO} "Check ntpq peers output for unreliable ntp peers and correct/replace them"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3124
    # Description : Check selected time source
    if [ ${NTPD_RUNNING} -eq 1 -a ! "${NTPQBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3124 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check selected time source"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking selected time source"
        FIND=`${NTPQBINARY} -p -n | grep '^*' | awk '{ if ($4=="l") { print $1 } }'`
        FIND2=`${NTPQBINARY} -p -n | grep '^*' | awk '{ print $1 }'`
        if [ "${FIND}" = "" -a ! "${FIND2}" = "" ]; then
            Display --indent 2 --text "- Checking selected time source" --result OK --color GREEN
            FIND2=`echo ${FIND2} | sed 's/*//g'`
            LogText "Result: Found selected time source (value: ${FIND2})"
          else
            Display --indent 2 --text "- Checking selected time source" --result WARNING --color RED
            LogText "Result: Found local source as selected time source. This could indicate that no external sources are available to sync with."
            LogText "Local source: ${FIND}"
            ReportSuggestion ${TEST_NO} "Check ntpq peers output for selected time source"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3128
    # Description : Check time source candidates
    if [ ${NTPD_RUNNING} -eq 1 -a ! "${NTPQBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3128 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check preffered time source"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking preferred time source"
        FIND=`${NTPQBINARY} -p -n | grep '^+' | awk '{ print $1 }'`
        if [ "${FIND}" = "" ]; then
            Display --indent 2 --text "- Checking time source candidates" --result NONE --color YELLOW
            LogText "Result: No other time source candidates found"
            ReportSuggestion ${TEST_NO} "Check ntpq peers output for time source candidates"
          else
            Display --indent 2 --text "- Checking time source candidates" --result OK --color GREEN
            LogText "Result: Found one or more candidates to synchronize time with."
                for I in ${FIND}; do
                I=`echo ${I} | sed 's/+//g'`
                LogText "Candidate found: ${I}"
            done
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3132
    # Description : Check ntpq falsetickers
    if [ ${NTPD_RUNNING} -eq 1 -a ! "${NTPQBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3132 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check NTP falsetickers"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking preferred time source"
        FIND=`${NTPQBINARY} -p -n | grep '^x'`
        if [ "${FIND}" = "" ]; then
            Display --indent 2 --text "- Checking falsetickers" --result OK --color GREEN
            LogText "Result: No falsetickers found (items preceeding with an 'x')"
          else
            Display --indent 2 --text "- Checking falsetickers" --result NONE --color YELLOW
            LogText "Result: Found one or more falsetickers  (items preceeding with an 'x')"
            for I in ${FIND}; do
                I=`echo ${I} | sed 's/x//g'`
                LogText "Falseticker found: ${I}"
                Report "ntp_falseticker=${I}"
            done
            ReportSuggestion ${TEST_NO} "Check ntpq peers output for falsetickers"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3136
    # Description : Check ntpq reported ntp version (Linux)
    if [ ${NTPD_RUNNING} -eq 1 -a ! "${NTPQBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3136 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --description "Check NTP protocol version"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking NTP protocol version (ntpq -c ntpversion)"
        FIND=`${NTPQBINARY} -c ntpversion | awk '{ if ($1=="NTP" && $2=="version" && $5=="is") { print $6 } }'`
        if [ "${FIND}" = "" ]; then
            Display --indent 2 --text "- Checking NTP version" --result UNKNOWN --color YELLOW
            LogText "Result: No NTP version found"
            ReportSuggestion ${TEST_NO} "Check ntpq output for NTP protocol version"
          else
            Display --indent 2 --text "- Checking NTP version" --result FOUND --color GREEN
            LogText "Result: Found NTP version ${FIND}"
            Report "ntp_version=${FIND}"
        fi
    fi
#
#################################################################################
#
    # Test        : TIME-3146
    # Description : Check /etc/default/ntpdate (Linux)
    # Notes       : ntpdate-debian binary
    #if [ ${NTPD_RUNNING} -eq 1 -a ! "${NTPQBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    #Register --test-no TIME-3146 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --description "Check /etc/default/ntpdate"
    #if [ ${SKIPTEST} -eq 0 ]; then
#
#################################################################################
#
    # Test        : TIME-3160
    # Description : Check empty NTP step-tickers
    # Notes       : Mostly applies to Red Hat and clones
    if [ "${NTPD_RUNNING}" -eq 1 -a ! "${NTPQBINARY}" = "" -a ! "${CHKCONFIGBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no TIME-3160 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --description "Check empty NTP step-tickers"
    if [ ${SKIPTEST} -eq 0 ]; then
        FOUND=0
        FILE="/etc/ntp/step-tickers"
        if [ -f ${FILE} ]; then
            if [ -z ${FILE} ]; then
                LogText "Result: ${FILE} is empty. The step-tickers contain no configured NTP servers"
                Display --indent 2 --text "- Checking NTP step-tickers file" --result "EMPTY FILE" --color YELLOW
                ReportSuggestion ${TEST_NO} "Use step-rickers file for quicker time synchronization"
              else
                LogText "Result: /etc/ntp/step-tickers is not empty, which is fine"
                Display --indent 2 --text "- Checking NTP step-tickers file" --result "OK" --color GREEN
                sFIND=`${AWKBINARY} '/^server/ { print $2 }' /etc/ntp.conf | ${GREPBINARY} -v '127.127.1.0'`
                for I in ${sFIND}; do
                    FIND=`${GREPBINARY} ^${I} ${FILE} | wc -l`
                    if [ ${FIND} -gt 0 ]; then
                        LogText "Result: $I exist in ${FILE}"
                      else
                        LogText "Result: ${I} does NOT exist in ${FILE}"
                        FOUND=1
                    fi
                done
                if [ ${FOUND} -eq 1 ]; then
                    Display --indent 4 --text "- Checking step-tickers ntp servers entries" --result "SOME MISSING" --color YELLOW
                    ReportSuggestion ${TEST_NO} "Some time servers missing in step-tickers file"
                    AddHP 3 4
                  else
                    Display --indent 4 --text "- Checking step-tickers ntp servers entries" --result OK --color GREEN
                    LogText "Result: all time servers are in step-tickers file"
                    AddHP 4 4
                fi
            fi
            LogText "Information: step-tickers is used by ntpdate where as ntp.conf is the configuration file for the ntpd daemon. ntpdate is initially run to set the clock before ntpd to make sure time is within 1000 sec."
            LogText "Risk: ntp will not run at boot if the time difference between the server and client by more then 1000 sec."
          else
            LogText "Result: test skipped because ${FILE} not found"
        fi
    fi
#
#################################################################################
#
# For VMs check ntpd.conf : tinker panic 0
#

wait_for_keypress

#
#################################################################################
#
    # Test        : TIME-3170
    # Description : Check file permissions and ownership of configuration files
    # Notes       : Files should be owned by root, or the user running
    #               Group owner should have only read access
    #               Other should preferably have no access, or read-only at max

    FILE_ARRAY="/etc/chrony.conf /etc/inet/ntp.conf /etc/ntp.conf /usr/local/etc/ntp.conf"
    Register --test-no TIME-3170 --weight L --network NO --description "Check configuration files"
    if [ ${SKIPTEST} -eq 0 ]; then
        for FILE in ${FILE_ARRAY}; do
            if [ -f ${FILE} ]; then
                LogText "Result: found ${FILE}"
                if IsWorldWritable ${FILE}; then
                    ReportWarning "${TEST_NO}" "Found world writable configuration file"
                fi
                Report "ntp_config_file[]=${FILE}"
            fi
        done
    fi
#
#################################################################################
#
    Report "ntp_config_found=${NTP_CONFIG_FOUND}"
    Report "ntp_config_type_daemon=${NTP_CONFIG_TYPE_DAEMON}"
    Report "ntp_config_type_eventbased=${NTP_CONFIG_TYPE_EVENTBASED}"
    Report "ntp_config_type_scheduled=${NTP_CONFIG_TYPE_SCHEDULED}"
    Report "ntp_config_type_startup=${NTP_CONFIG_TYPE_STARTUP}"
    Report "ntp_daemon=${NTP_DAEMON}"
    Report "ntp_daemon_running=${NTP_DAEMON_RUNNING}"
#
#################################################################################
#
    # OS        Time daemons  Configuration file
    # --------------------------------------------
    # AIX       xntpd         /etc/ntp.conf
    # HP
    # Linux     ntpd          /etc/ntp.conf
    #           chrony        /etc/chrony.conf
    # OpenBSD   ntpd          /etc/ntpd.conf
    # Solaris   xntpd         /etc/inet/ntp.conf

#
#================================================================================
# Lynis - Copyright 2007-2016, Michael Boelen, CISOfy - https://cisofy.com