tyler.durden
/
lynis
mirror of https://github.com/CISOfy/lynis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

GRUB2 password protection test

This commit is contained in:
mboelen 2014-11-13 00:58:11 +01:00
parent f50595d4e2
commit 2938a2d5af
1 changed files with 18 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
include/tests_boot_services
View File

@ -5,8 +5,8 @@
# Lynis # Lynis
# ------------------ # ------------------
# #
# Copyright 2007-2014, Michael Boelen (michael@rootkit.nl), The Netherlands # Copyright 2007-2014, CISOfy & Michael Boelen, The Netherlands
# Web site: http://www.rootkit.nl # Web site: https://cisofy.com
# #
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are # Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License. # welcome to redistribute it under the terms of the GNU General Public License.
@ -107,24 +107,30 @@
if [ ! "${GRUBCONFFILE}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi if [ ! "${GRUBCONFFILE}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no BOOT-5122 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check for GRUB boot password" Register --test-no BOOT-5122 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check for GRUB boot password"
if [ ${SKIPTEST} -eq 0 ]; then if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0
logtext "Found file ${GRUBCONFFILE}, proceeding with tests." logtext "Found file ${GRUBCONFFILE}, proceeding with tests."
FileIsReadable ${GRUBCONFFILE} FileIsReadable ${GRUBCONFFILE}
if [ ${CANREAD} -eq 1 ]; then if [ ${CANREAD} -eq 1 ]; then
FIND=`cat ${GRUBCONFFILE} | grep 'password --md5' | grep -v '^#'` FIND=`cat ${GRUBCONFFILE} | grep 'password --md5' | grep -v '^#'`
FIND2=`cat ${GRUBCONFFILE} | grep 'password --encrypted' | grep -v '^#'` FIND2=`cat ${GRUBCONFFILE} | grep 'password --encrypted' | grep -v '^#'`
if [ "${FIND}" = "" -a "${FIND2}" = "" ]; then FIND3=`cat ${GRUBCONFFILE} | grep 'set superusers' | grep -v '^#'`
Display --indent 6 --text "- Checking for password protection" --result WARNING --color RED FIND4=`cat ${GRUBCONFFILE} | grep 'password_pbkdf2' | grep -v '^#'`
logtext "Result: Didn't find MD5/SHA1 hashed password line in GRUB boot file!" # GRUB1: MD5 or SHA1
logtext "Risk: user can switch to single user mode by editing current menu items or bypassing them." if [ ! "${FIND}" = "" -o ! "${FIND2}" = "" ]; then
logtext "Additional information: Do NOT use a plaintext password, since the grub.conf or menu.lst file is most likely to be world readable!" FOUND=1
logtext "If an unsecured OS like DOS is used, add 'lock' below that entry and setup a password with the password option, to prevent direct system access." # GRUB2: Superusers and password should be defined
ReportSuggestion ${TEST_NO} "Set a password on GRUB bootloader to prevent altering boot configuration (e.g. boot in single user mode without password)" elif [ ! "${FIND3}" = "" -a ! "${FIND4}" = "" ]; then
logtext "Tip: Run grub-crypt or grub-md5-crypt and create a hashed password. Add a line below the line timeout=<value>, add: password --md5 <password hash> or password --encrypted <password hash> for SHA1 encrypted password" FOUND=1
AddHP 0 2 fi
else if [ ${FOUND} -eq 1 ]; then
Display --indent 6 --text "- Checking for password protection" --result OK --color GREEN Display --indent 6 --text "- Checking for password protection" --result OK --color GREEN
logtext "Result: GRUB has password protection." logtext "Result: GRUB has password protection."
AddHP 4 4 AddHP 4 4
else
Display --indent 6 --text "- Checking for password protection" --result WARNING --color RED
logtext "Result: Didn't find hashed password line in GRUB boot file!"
ReportSuggestion ${TEST_NO} "Set a password on GRUB bootloader to prevent altering boot configuration (e.g. boot in single user mode without password)"
AddHP 0 2
fi fi
else else
logtext "Result: Can not read ${GRUBCONFFILE} (no permission)" logtext "Result: Can not read ${GRUBCONFFILE} (no permission)"