tyler.durden
/
lynis
mirror of https://github.com/CISOfy/lynis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

New SSH options added and small changes to improve output on screen and in log file

This commit is contained in:
mboelen 2015-12-04 11:05:13 +01:00
parent ce06bc6b2c
commit 386d7701f3
1 changed files with 21 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
include/tests_ssh
View File

@ -87,26 +87,28 @@
if [ ${SKIPTEST} -eq 0 ]; then if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: Checking specific defined options in ${SSH_DAEMON_CONFIG}" logtext "Test: Checking specific defined options in ${SSH_DAEMON_CONFIG}"
## SSHOPTIONS scheme: ## SSHOPTIONS scheme:
## <OptionName>:<ExpectedValue>,<MediumScoreValue>,<WrongValue> ## <OptionName>:<ExpectedValue>,<MediumScoreValue>,<WeakValue>
## Example: ## Example:
## PermitRootLogin:NO,WITHOUT-PASSWORD,YES ## PermitRootLogin:NO,WITHOUT-PASSWORD,YES
SSHOPS="Protocol:2,,1\ SSHOPS="Compression:NO,DELAYED,YES,\
PermitRootLogin:NO,WITHOUT-PASSWORD,YES\ FingerprintHash:SHA256,MD5,,\
StrictModes:YES,,NO\ IgnoreRhosts:YES,,NO,\
VerifyReverseMapping:YES,,NO\ LogLevel:VERBOSE,INFO,,\
IgnoreRhosts:YES,,NO\ PermitRootLogin:NO,WITHOUT-PASSWORD,YES,\
UseDNS:YES,,NO\ PrintLastLog:YES,,NO,\
X11Forwarding:NO,,YES\ Protocol:2,,1,\
FingerprintHash:SHA256,MD5,\ StrictModes:YES,,NO,\
TCPKeepAlive:YES,,NO\ TCPKeepAlive:YES,,NO,\
Compression:NO,DELAYED,YES\ UseDNS:YES,,NO,\
PrintLastLog:YES,,NO" UsePrivilegeSeparation:SANDBOX,YES,NO,\
VerifyReverseMapping:YES,,NO,\
X11Forwarding:NO,,YES,"
for I in ${SSHOPS}; do for I in ${SSHOPS}; do
OPTIONNAME=`echo ${I} | cut -d ':' -f1` OPTIONNAME=`echo ${I} | cut -d ':' -f1`
EXPECTEDVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f1` EXPECTEDVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f1`
MEDIUMSCOREDVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f2` MEDIUMSCOREDVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f2`
WRONGVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f3` WEAKVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f3`
FOUNDVALUE=`awk -v OPT="${OPTIONNAME}" 'index($0, OPT) == 1 { print toupper($2) }' ${SSH_DAEMON_CONFIG}` FOUNDVALUE=`awk -v OPT="${OPTIONNAME}" 'index($0, OPT) == 1 { print toupper($2) }' ${SSH_DAEMON_CONFIG}`
logtext "Test: Checking ${OPTIONNAME} in ${SSH_DAEMON_CONFIG}" logtext "Test: Checking ${OPTIONNAME} in ${SSH_DAEMON_CONFIG}"
@ -119,20 +121,21 @@
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result OK --color GREEN Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result OK --color GREEN
AddHP 3 3 AddHP 3 3
elif [ "${FOUNDVALUE}" = "${MEDIUMSCOREDVALUE}" ]; then elif [ "${FOUNDVALUE}" = "${MEDIUMSCOREDVALUE}" ]; then
logtext "Result: SSH option ${OPTIONNAME} is configured totally wrong" logtext "Result: SSH option ${OPTIONNAME} is configured reasonably"
ReportSuggestion ${TEST_NO} "Consider hardening of SSH configuration" "${OPTIONNAME}" "-" ReportSuggestion ${TEST_NO} "Consider hardening of SSH configuration" "${OPTIONNAME} (${FOUNDVALUE} --> ${EXPECTEDVALUE})" "-"
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "MEDIUM" --color YELLOW Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "MEDIUM" --color YELLOW
AddHP 1 3 AddHP 1 3
elif [ "${FOUNDVALUE}" = "${WRONGVALUE}" ]; then elif [ "${FOUNDVALUE}" = "${WEAKVALUE}" ]; then
logtext "Result: SSH option ${OPTIONNAME} is configured totally wrong" logtext "Result: SSH option ${OPTIONNAME} is in a weak configuruation state and should be fixed"
#ReportWarning ${TEST_NO} "M" "Unsafe configured SSH option: ${OPTIONNAME}" #ReportWarning ${TEST_NO} "M" "Unsafe configured SSH option: ${OPTIONNAME}"
ReportSuggestion ${TEST_NO} "Consider hardening SSH configuration" "${OPTIONNAME}" "-" ReportSuggestion ${TEST_NO} "Consider hardening SSH configuration" "${OPTIONNAME} (${FOUNDVALUE} --> ${EXPECTEDVALUE})" "-"
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result WARNING --color RED Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result WARNING --color RED
AddHP 0 3 AddHP 0 3
else else
logtext "Result: Value of SSH option ${OPTIONNAME} is unknown (not defined)" logtext "Result: Value of SSH option ${OPTIONNAME} is unknown (not defined)"
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result DEFAULT --color WHITE Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result DEFAULT --color WHITE
#ReportException "SSH-7408:01" "Unknown SSH option" #ReportException "SSH-7408:01" "Unknown SSH option"
report "unknown_config_option[]=ssh|$SSH_DAEMON_CONFIG}|${OPTIONNAME}|"
fi fi
else else