tyler.durden
/
lynis
mirror of https://github.com/CISOfy/lynis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Refactorized [SSH-7408]. 

First step for differents types of tests.
This commit is contained in:
Kamil Boratyński 2015-12-05 20:37:47 +01:00
parent f8940e20b2
commit 013886ec16
1 changed files with 58 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

92
include/tests_ssh
View File

@ -87,28 +87,37 @@
if [ ${SKIPTEST} -eq 0 ]; then if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: Checking specific defined options in ${SSH_DAEMON_CONFIG}" logtext "Test: Checking specific defined options in ${SSH_DAEMON_CONFIG}"
## SSHOPTIONS scheme: ## SSHOPTIONS scheme:
## <OptionName>:<ExpectedValue>,<MediumScoreValue>,<WeakValue> ## <OptionName>:<ExpectedValue>,<MediumScoreValue>,<WeakValue>:<TestType>
##
## Test types:
## (a) '=' -- equal to is better,
## (b) '<' -- less or equal is better,
## (c) '>' -- more or equal is better,
## (d) '!' -- not equal is better.
##
## Example: ## Example:
## PermitRootLogin:NO,WITHOUT-PASSWORD,YES ## PermitRootLogin:NO,WITHOUT-PASSWORD,YES,:=
SSHOPS="Compression:NO,DELAYED,YES,\ SSHOPS="Compression:NO,DELAYED,YES:=\
FingerprintHash:SHA256,MD5,,\ FingerprintHash:SHA256,MD5,:=\
IgnoreRhosts:YES,,NO,\ IgnoreRhosts:YES,,NO:=\
LogLevel:VERBOSE,INFO,,\ LogLevel:VERBOSE,INFO,:=\
PermitRootLogin:NO,WITHOUT-PASSWORD,YES,\ PermitRootLogin:NO,WITHOUT-PASSWORD,YES:=\
PrintLastLog:YES,,NO,\ PrintLastLog:YES,,NO:=\
Protocol:2,,1,\ Protocol:2,,1:=\
StrictModes:YES,,NO,\ StrictModes:YES,,NO:=\
TCPKeepAlive:YES,,NO,\ TCPKeepAlive:YES,,NO:=\
UseDNS:YES,,NO,\ UseDNS:YES,,NO:=\
UsePrivilegeSeparation:SANDBOX,YES,NO,\ UsePrivilegeSeparation:SANDBOX,YES,NO:=\
VerifyReverseMapping:YES,,NO,\ VerifyReverseMapping:YES,,NO:=\
X11Forwarding:NO,,YES," X11Forwarding:NO,,YES:="
for I in ${SSHOPS}; do for I in ${SSHOPS}; do
OPTIONNAME=`echo ${I} | cut -d ':' -f1` OPTIONNAME=`echo ${I} | cut -d ':' -f1`
EXPECTEDVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f1` EXPECTEDVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f1`
MEDIUMSCOREDVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f2` MEDIUMSCOREDVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f2`
WEAKVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f3` WEAKVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f3`
TESTTYPE=`echo ${I} | cut -d ':' -f3`
RESULT="NONE"
FOUNDVALUE=`awk -v OPT="${OPTIONNAME}" 'index($0, OPT) == 1 { print toupper($2) }' ${SSH_DAEMON_CONFIG}` FOUNDVALUE=`awk -v OPT="${OPTIONNAME}" 'index($0, OPT) == 1 { print toupper($2) }' ${SSH_DAEMON_CONFIG}`
logtext "Test: Checking ${OPTIONNAME} in ${SSH_DAEMON_CONFIG}" logtext "Test: Checking ${OPTIONNAME} in ${SSH_DAEMON_CONFIG}"
@ -116,32 +125,47 @@
logtext "Result: Option ${OPTIONNAME} found in ${SSH_DAEMON_CONFIG}" logtext "Result: Option ${OPTIONNAME} found in ${SSH_DAEMON_CONFIG}"
logtext "Result: Option ${OPTIONNAME} value is ${FOUNDVALUE}" logtext "Result: Option ${OPTIONNAME} value is ${FOUNDVALUE}"
if [ "${FOUNDVALUE}" = "${EXPECTEDVALUE}" ]; then if [ "${TESTTYPE}" = "=" ]; then
logtext "Result: SSH option ${OPTIONNAME} is configured very well" if [ "${FOUNDVALUE}" = "${EXPECTEDVALUE}" ]; then
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result OK --color GREEN RESULT="GOOD"
AddHP 3 3 elif [ "${FOUNDVALUE}" = "${MEDIUMSCOREDVALUE}" ]; then
elif [ "${FOUNDVALUE}" = "${MEDIUMSCOREDVALUE}" ]; then RESULT="MIDSCORED"
logtext "Result: SSH option ${OPTIONNAME} is configured reasonably" elif [ "${FOUNDVALUE}" = "${WEAKVALUE}" ]; then
ReportSuggestion ${TEST_NO} "Consider hardening of SSH configuration" "${OPTIONNAME} (${FOUNDVALUE} --> ${EXPECTEDVALUE})" "-" RESULT="WEAK"
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "MEDIUM" --color YELLOW else
AddHP 1 3 RESULT="UNKNOWN"
elif [ "${FOUNDVALUE}" = "${WEAKVALUE}" ]; then fi
logtext "Result: SSH option ${OPTIONNAME} is in a weak configuruation state and should be fixed"
#ReportWarning ${TEST_NO} "M" "Unsafe configured SSH option: ${OPTIONNAME}"
ReportSuggestion ${TEST_NO} "Consider hardening SSH configuration" "${OPTIONNAME} (${FOUNDVALUE} --> ${EXPECTEDVALUE})" "-"
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result WARNING --color RED
AddHP 0 3
else else
logtext "Result: Value of SSH option ${OPTIONNAME} is unknown (not defined)" RESULT="NONE"
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result DEFAULT --color WHITE
#ReportException "SSH-7408:01" "Unknown SSH option"
report "unknown_config_option[]=ssh|$SSH_DAEMON_CONFIG}|${OPTIONNAME}|"
fi fi
fi
if [ "${RESULT}" = "GOOD" ]; then
logtext "Result: SSH option ${OPTIONNAME} is configured very well"
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result OK --color GREEN
AddHP 3 3
elif [ "${RESULT}" = "MIDSCORED" ]; then
logtext "Result: SSH option ${OPTIONNAME} is configured reasonably"
ReportSuggestion ${TEST_NO} "Consider hardening of SSH configuration" "${OPTIONNAME} (${FOUNDVALUE} --> ${EXPECTEDVALUE})" "-"
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "MEDIUM" --color YELLOW
AddHP 1 3
elif [ "${RESULT}" = "WEAK" ]; then
logtext "Result: SSH option ${OPTIONNAME} is in a weak configuruation state and should be fixed"
#ReportWarning ${TEST_NO} "M" "Unsafe configured SSH option: ${OPTIONNAME}"
ReportSuggestion ${TEST_NO} "Consider hardening SSH configuration" "${OPTIONNAME} (${FOUNDVALUE} --> ${EXPECTEDVALUE})" "-"
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result WARNING --color RED
AddHP 0 3
elif [ "${RESULT}" = "UNKNOWN" ]; then
logtext "Result: Value of SSH option ${OPTIONNAME} is unknown (not defined)"
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result DEFAULT --color WHITE
#ReportException "SSH-7408:01" "Unknown SSH option"
report "unknown_config_option[]=ssh|$SSH_DAEMON_CONFIG}|${OPTIONNAME}|"
else else
logtext "Result: Option ${OPTIONNAME} not found in ${SSH_DAEMON_CONFIG}" logtext "Result: Option ${OPTIONNAME} not found in ${SSH_DAEMON_CONFIG}"
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "NOT FOUND" --color WHITE Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "NOT FOUND" --color WHITE
fi fi
done done
fi fi
# #