mirror of
https://github.com/CISOfy/lynis.git
synced 2025-07-29 08:44:21 +02:00
Update tests_firewalls
This commit is contained in:
nser77
GitHub
parent
d90413e243
commit
2d4ec42696
@ -109,53 +109,119 @@
|
||||
Register --test-no FIRE-4508 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --root-only YES --category security --description "Check used policies of iptables chains"
|
||||
if [ ${SKIPTEST} -eq 0 ]; then
|
||||
Display --indent 4 --text "- Checking iptables policies of chains" --result "${STATUS_FOUND}" --color GREEN
|
||||
TABLES="filter nat mangle raw security"
|
||||
for table in ${TABLES}; do
|
||||
chains="PREROUTING INPUT FORWARD OUTPUT POSTROUTING"
|
||||
if [ "${table}" = "filter" ]; then
|
||||
chains="INPUT FORWARD OUTPUT"
|
||||
fi
|
||||
for chain in ${chains}; do
|
||||
${IPTABLESBINARY} -t "${table}" -S "${chain}" 2>/dev/zero | while read -r line; do
|
||||
set -- ${line}
|
||||
while [ $# -gt 0 ]; do
|
||||
if [ "${1}" = "-P" ]; then
|
||||
target="${3}"
|
||||
tables="filter nat mangle raw security"
|
||||
for t in ${tables}
|
||||
do
|
||||
${iptables_binary} -t "${t}" -S -v -w 1 2>/dev/zero | while read -r line
|
||||
do
|
||||
set -- ${line}
|
||||
while [ $# -gt 0 ]
|
||||
do
|
||||
if [ "${1}" = "!" ]
|
||||
then
|
||||
not="${1}"
|
||||
if [ "${2}" = "-d" ]
|
||||
then
|
||||
d="${not} ${3}"
|
||||
shift 3
|
||||
elif [ "${2}" = "-s" ]
|
||||
then
|
||||
s="${not} ${3}"
|
||||
shift 3
|
||||
elif [ "${2}" = "-i" ]
|
||||
then
|
||||
p="${not} ${3}"
|
||||
shift 3
|
||||
elif [ "${2}" = "-o" ]
|
||||
then
|
||||
o="${not} ${3}"
|
||||
shift 3
|
||||
elif [ "${2}" = "-f" ]
|
||||
then
|
||||
p="${not} ${3}"
|
||||
shift 3
|
||||
elif [ "${1}" = "-j" ]; then
|
||||
target="${2}"
|
||||
shift
|
||||
elif [ "${1}" = "-d" ]; then
|
||||
dst="${2}"
|
||||
shift
|
||||
elif [ "${1}" = "-s" ]; then
|
||||
src="${2}"
|
||||
shift
|
||||
else
|
||||
shift
|
||||
fi
|
||||
done
|
||||
|
||||
# logics
|
||||
if ( [ "${table}" = "filter" ] || [ "${table}" = "security" ] ) && [ "${chain}" = "INPUT" ] && [ "${target}" = "ACCEPT" ] ; then
|
||||
LogText "Result: Found ${target} for ${chain} (table: ${table})"
|
||||
Display --indent 6 --text "- Checking chain ${chain} (table: ${table}, chain ${chain})" --result "${target}" --color YELLOW
|
||||
AddHP 1 3
|
||||
fi
|
||||
if ( [ "${table}" = "filter" ] || [ "${table}" = "security" ] ) && [ "${chain}" = "INPUT" ] && [ "${target}" = "DROP" ] ; then
|
||||
LogText "Result: Found ${target} for ${chain} (table: ${table})"
|
||||
Display --indent 6 --text "- Checking chain ${chain} (table: ${table}, chain ${chain})" --result "${target}" --color GREEN
|
||||
AddHP 3 3
|
||||
fi
|
||||
if ( [ "${table}" = "filter" ] || [ "${table}" = "security" ] ) && ( [ "${chain}" = "INPUT" ] || [ "${chain}" = "FORWARD" ] || [ "${chain}" = "OUTPUT" ] ) && [ "${target}" = "NFQUEUE" ] ; then
|
||||
LogText "Result: Found ${target} for ${chain} (table: ${table})"
|
||||
Display --indent 6 --text "- Checking chain ${chain} (table: ${table}, chain ${chain})" --result "${target}" --color RED
|
||||
ReportSuggestion "${TEST_NO}" "Consider avoid ${target} target if possible (iptables chain ${chain}, table: ${table})"
|
||||
AddHP 0 3
|
||||
shift
|
||||
elif [ "${1}" = "-P" ]
|
||||
then
|
||||
c="${2}"
|
||||
j="${3}"
|
||||
shift 3
|
||||
elif [ "${1}" = "-A" ] || [ "${1}" = "-N" ]
|
||||
then
|
||||
c="${2}"
|
||||
shift 2
|
||||
elif [ "${1}" = "-j" ]
|
||||
then
|
||||
j="${2}"
|
||||
shift
|
||||
elif [ "${1}" = "-p" ]
|
||||
then
|
||||
p="${2}"
|
||||
shift
|
||||
elif [ "${1}" = "-d" ]
|
||||
then
|
||||
d="${2}"
|
||||
shift
|
||||
elif [ "${1}" = "-s" ]
|
||||
then
|
||||
s="${2}"
|
||||
shift
|
||||
elif [ "${1}" = "-m" ]
|
||||
then
|
||||
m="${2}"
|
||||
shift
|
||||
elif [ "${1}" = "-g" ]
|
||||
then
|
||||
g="${2}"
|
||||
shift
|
||||
elif [ "${1}" = "-i" ]
|
||||
then
|
||||
i="${2}"
|
||||
shift
|
||||
elif [ "${1}" = "-o" ]
|
||||
then
|
||||
o="${2}"
|
||||
shift
|
||||
elif [ "${1}" = "-f" ]
|
||||
then
|
||||
f="${2}"
|
||||
shift
|
||||
elif [ "${1}" = "-c" ]
|
||||
then
|
||||
pc="${2}"
|
||||
bc="${3}"
|
||||
shift 3
|
||||
else
|
||||
shift
|
||||
fi
|
||||
done
|
||||
done
|
||||
done
|
||||
# logics
|
||||
if [ "${t}" = "filter" ] || [ "${t}" = "security" ]
|
||||
then
|
||||
if [ "${c}" = "INPUT" ] && [ "${j}" = "ACCEPT" ]
|
||||
then
|
||||
LogText "Result: Found ${j} for ${c} (table: ${t})"
|
||||
Display --indent 6 --text "- Checking chain ${c} (table: ${t}, chain ${c})" --result "${j}" --color YELLOW
|
||||
AddHP 1 3
|
||||
elif [ "${c}" = "INPUT" ] && [ "${j}" = "DROP" ]
|
||||
then
|
||||
LogText "Result: Found ${j} for ${c} (table: ${t})"
|
||||
Display --indent 6 --text "- Checking chain ${c} (table: ${t}, chain ${c})" --result "${j}" --color GREEN
|
||||
AddHP 3 3
|
||||
elif [ "${c}" = "INPUT" ] || [ "${c}" = "FORWARD" ] || [ "${c}" = "OUTPUT" ]
|
||||
then
|
||||
if [ "${j}" = "NFQUEUE" ]
|
||||
then
|
||||
LogText "Result: Found ${j} for ${c} (table: ${t})"
|
||||
Display --indent 6 --text "- Checking chain ${c} (table: ${t}, chain ${c})" --result "${j}" --color RED
|
||||
ReportSuggestion "${TEST_NO}" "Consider avoid ${j} target if possible (iptables chain ${c}, table: ${t})"
|
||||
AddHP 0 3
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
done
|
||||
done
|
||||
fi
|
||||
#
|
||||
#################################################################################
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user