tyler.durden
/
lynis
mirror of https://github.com/CISOfy/lynis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added the detection of LMD, or Linux Malware Detect tooling

This commit is contained in:
mboelen 2015-09-24 16:45:03 +02:00
parent cecde99f12
commit 4f5eedabfc
3 changed files with 20 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/binaries
View File

@ -124,6 +124,7 @@
kldstat) KLDSTATFOUND=1; KLDSTATBINARY="${BINARY}"; logtext " Found known binary: kldstat (kernel modules) - ${BINARY}" ;;
kstat) KSTATFOUND=1; KSTATBINARY="${BINARY}"; logtext " Found known binary: kstat (kernel statistics) - ${BINARY}" ;;
launchctl) LAUNCHCTLBINARY="${BINARY}"; SERVICE_MANAGER="launchd"; logtext " Found known binary: launchctl (launchd client) - ${BINARY}" ;;
lmd) LMDFOUND=1; LMDBINARY="${BINARY}"; MALWARE_SCANNER_INSTALLED=1; logtext " Found known binary: lmd (malware scanner) - ${BINARY}" ;;
locate) LOCATEFOUND=1; LOCATEBINARY="${BINARY}"; logtext " Found known binary: locate (file database) - ${BINARY}" ;;
logrotate) LOGROTATEFOUND=1; LOGROTATEBINARY="${BINARY}"; logtext " Found known binary: logrotate (log rotation tool) - ${BINARY}" ;;
ls) LSFOUND=1; LSBINARY="${BINARY}"; logtext " Found known binary: ls (file listing) - ${BINARY}" ;;

2
include/consts
View File

@ -71,6 +71,8 @@ unset LANG
IPTABLESBINARY=""
LINUX_VERSION=""
LINUXCONFIGFILE=""
LMDBINARY=""
LMDFOUND=0
LOGFILE=""
LYNIS_COMPLIANCE_TESTS=0
MACHINEID=""

22
include/tests_malware
View File

@ -62,6 +62,23 @@
fi
#
#################################################################################
#
# Test : MALW-3278
# Description : Check for installed tool (Linux Malware Detect or LMD)
Register --test-no MALW-3278 --weight L --network NO --description "Check for LMD"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: checking presence LMD"
if [ ! "${LMDBINARY}" = "" ]; then
Display --indent 2 --text "- Checking LMD (Linux Malware Detect)" --result "FOUND" --color GREEN
logtext "Result: Found ${LMDBINARY}"
MALWARE_SCANNER_INSTALLED=1
AddHP 2 2
else
logtext "Result: LMD not found"
fi
fi
#
#################################################################################
#
# Test : MALW-3280
# Description : Check if an anti-virus tool is installed
@ -184,11 +201,6 @@
fi
#
#################################################################################
#
# Test : MALW-3204
# Description : Check for LMD
#
#################################################################################
#
report "malware_scanner_installed=${MALWARE_SCANNER_INSTALLED}"