mirror of https://github.com/CISOfy/lynis.git
[SCHD-7704] permission checks and minor code cleanups
This commit is contained in:
Michael Boelen
parent
320a397772
commit
6083f6d9ff
|
|
@ -36,9 +36,9 @@
|
||||||
Register --test-no SCHD-7702 --weight L --network NO --category security --description "Check status of cron daemon"
|
Register --test-no SCHD-7702 --weight L --network NO --category security --description "Check status of cron daemon"
|
||||||
if [ ${SKIPTEST} -eq 0 ]; then
|
if [ ${SKIPTEST} -eq 0 ]; then
|
||||||
FIND=$(${PSBINARY} aux | ${EGREPBINARY} "( cron$|/cron(d)? )")
|
FIND=$(${PSBINARY} aux | ${EGREPBINARY} "( cron$|/cron(d)? )")
|
||||||
if [ "${FIND}" = "" ]; then
|
if [ -z "${FIND}" ]; then
|
||||||
LogText "Result: no cron daemon found"
|
LogText "Result: no cron daemon found"
|
||||||
else
|
else
|
||||||
LogText "Result: cron daemon running"
|
LogText "Result: cron daemon running"
|
||||||
CROND_RUNNING=1
|
CROND_RUNNING=1
|
||||||
Report "crond_running=1"
|
Report "crond_running=1"
|
||||||
|
|
@ -73,14 +73,13 @@
|
||||||
for I in ${CRON_DIRS}; do
|
for I in ${CRON_DIRS}; do
|
||||||
LogText "Test: checking directory ${I}"
|
LogText "Test: checking directory ${I}"
|
||||||
if [ -d ${I} ]; then
|
if [ -d ${I} ]; then
|
||||||
FileIsReadable ${I}
|
if FileIsReadable ${I}; then
|
||||||
if [ ${CANREAD} -eq 1 ]; then
|
|
||||||
LogText "Result: found directory ${I}"
|
LogText "Result: found directory ${I}"
|
||||||
LogText "Test: searching files in ${I}"
|
LogText "Test: searching files in ${I}"
|
||||||
FIND=$(find ${I} -type f -print | ${GREPBINARY} -v ".placeholder")
|
FIND=$(find ${I} -type f -print | ${GREPBINARY} -v ".placeholder")
|
||||||
if [ "${FIND}" = "" ]; then
|
if [ "${FIND}" = "" ]; then
|
||||||
LogText "Result: no files found in ${I}"
|
LogText "Result: no files found in ${I}"
|
||||||
else
|
else
|
||||||
LogText "Result: found one or more files in ${I}. Analyzing files.."
|
LogText "Result: found one or more files in ${I}. Analyzing files.."
|
||||||
for J in ${FIND}; do
|
for J in ${FIND}; do
|
||||||
if IsWorldWritable ${J}; then LogText "Result: insecure file permissions for cronjob file ${J}"; Report "insecure_fileperms_cronjob[]=${J}"; BAD_FILE_PERMISSIONS=1; AddHP 0 5; fi
|
if IsWorldWritable ${J}; then LogText "Result: insecure file permissions for cronjob file ${J}"; Report "insecure_fileperms_cronjob[]=${J}"; BAD_FILE_PERMISSIONS=1; AddHP 0 5; fi
|
||||||
|
|
@ -95,10 +94,10 @@
|
||||||
done
|
done
|
||||||
LogText "Result: done with analyzing files in ${I}"
|
LogText "Result: done with analyzing files in ${I}"
|
||||||
fi
|
fi
|
||||||
else
|
else
|
||||||
LogText "Result: can not read file or directory ${I}"
|
LogText "Result: can not read file or directory ${I}"
|
||||||
fi
|
fi
|
||||||
else
|
else
|
||||||
LogText "Result: directory ${I} does not exist"
|
LogText "Result: directory ${I} does not exist"
|
||||||
fi
|
fi
|
||||||
done
|
done
|
||||||
|
|
@ -108,21 +107,25 @@
|
||||||
LogText "Test: checking directory ${I}"
|
LogText "Test: checking directory ${I}"
|
||||||
if [ -d ${I} ]; then
|
if [ -d ${I} ]; then
|
||||||
LogText "Result: found directory ${I}"
|
LogText "Result: found directory ${I}"
|
||||||
LogText "Test: searching files in ${I}"
|
if FileIsReadable ${I}; then
|
||||||
FIND=$(find ${I} -type f -print | ${GREPBINARY} -v ".placeholder")
|
LogText "Test: searching files in ${I}"
|
||||||
if [ "${FIND}" = "" ]; then
|
FIND=$(find ${I} -type f -print 2> /dev/null | ${GREPBINARY} -v ".placeholder")
|
||||||
LogText "Result: no files found in ${I}"
|
if [ "${FIND}" = "" ]; then
|
||||||
else
|
LogText "Result: no files found in ${I}"
|
||||||
LogText "Result: found one or more files in ${I}. Analyzing files.."
|
else
|
||||||
for J in ${FIND}; do
|
LogText "Result: found one or more files in ${I}. Analyzing files.."
|
||||||
if IsWorldWritable ${J}; then LogText "Result: insecure file permissions for cronjob file ${J}"; Report "insecure_fileperms_cronjob[]=${J}"; BAD_FILE_PERMISSIONS=1; AddHP 0 5; fi
|
for J in ${FIND}; do
|
||||||
if ! IsOwnedByRoot ${J}; then LogText "Result: incorrect owner found for cronjob file ${J}"; Report "bad_fileowner_cronjob[]=${J}"; BAD_FILE_OWNERSHIP=1; AddHP 0 5; fi
|
if IsWorldWritable ${J}; then LogText "Result: insecure file permissions for cronjob file ${J}"; Report "insecure_fileperms_cronjob[]=${J}"; BAD_FILE_PERMISSIONS=1; AddHP 0 5; fi
|
||||||
LogText "Result: Found cronjob (${I}): ${J}"
|
if ! IsOwnedByRoot ${J}; then LogText "Result: incorrect owner found for cronjob file ${J}"; Report "bad_fileowner_cronjob[]=${J}"; BAD_FILE_OWNERSHIP=1; AddHP 0 5; fi
|
||||||
Report "cronjob[]=${J}"
|
LogText "Result: Found cronjob (${I}): ${J}"
|
||||||
done
|
Report "cronjob[]=${J}"
|
||||||
LogText "Result: done with analyzing files in ${I}"
|
done
|
||||||
|
LogText "Result: done with analyzing files in ${I}"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
LogText "Result: directory permissions are too strict to enter it (which might be good)"
|
||||||
fi
|
fi
|
||||||
else
|
else
|
||||||
LogText "Result: directory ${I} does not exist"
|
LogText "Result: directory ${I} does not exist"
|
||||||
fi
|
fi
|
||||||
done
|
done
|
||||||
|
|
@ -130,23 +133,27 @@
|
||||||
# /var/spool/cron/* and /var/spool/cron/crontabs/*
|
# /var/spool/cron/* and /var/spool/cron/crontabs/*
|
||||||
# Search only in one tree, to avoid searching the tree twice
|
# Search only in one tree, to avoid searching the tree twice
|
||||||
if [ -d /var/spool/cron/crontabs ]; then
|
if [ -d /var/spool/cron/crontabs ]; then
|
||||||
FIND=$(find /var/spool/cron/crontabs -type f -print)
|
FIND=$(${FINDBINARY} /var/spool/cron/crontabs -xdev -type f -print 2> /dev/null)
|
||||||
for I in ${FIND}; do
|
for I in ${FIND}; do
|
||||||
FindCronJob ${I}
|
if FileIsReadable ${I}; then
|
||||||
for J in ${sCRONJOBS}; do
|
FindCronJob ${I}
|
||||||
LogText "Found cronjob (/var/spool/cron/crontabs): ${I} (${J})"
|
for J in ${sCRONJOBS}; do
|
||||||
Report "cronjob[]=${I}"
|
LogText "Found cronjob (/var/spool/cron/crontabs): ${I} (${J})"
|
||||||
done
|
Report "cronjob[]=${I}"
|
||||||
|
done
|
||||||
|
fi
|
||||||
done
|
done
|
||||||
else
|
else
|
||||||
if [ -d /var/spool/cron ]; then
|
if [ -d /var/spool/cron ]; then
|
||||||
FIND=$(find /var/spool/cron -type f -print)
|
FIND=$(find /var/spool/cron -type f -print)
|
||||||
for I in ${FIND}; do
|
for I in ${FIND}; do
|
||||||
FindCronJob ${I}
|
if FileIsReadable ${I}; then
|
||||||
for J in ${sCRONJOBS}; do
|
FindCronJob ${I}
|
||||||
LogText "Found cronjob (/var/spool/cron): ${I} (${J})"
|
for J in ${sCRONJOBS}; do
|
||||||
LogText "cronjob[]=${I}"
|
LogText "Found cronjob (/var/spool/cron): ${I} (${J})"
|
||||||
done
|
LogText "cronjob[]=${I}"
|
||||||
|
done
|
||||||
|
fi
|
||||||
done
|
done
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
@ -156,11 +163,11 @@
|
||||||
if [ -f /etc/anacrontab ]; then
|
if [ -f /etc/anacrontab ]; then
|
||||||
LogText "Test: checking anacrontab"
|
LogText "Test: checking anacrontab"
|
||||||
sANACRONJOBS=$(${EGREPBINARY} '^([0-9@])' /etc/anacrontab | ${TRBINARY} '\t' ' ' | ${TRBINARY} -s ' ' | ${TRBINARY} ' ' ',')
|
sANACRONJOBS=$(${EGREPBINARY} '^([0-9@])' /etc/anacrontab | ${TRBINARY} '\t' ' ' | ${TRBINARY} -s ' ' | ${TRBINARY} ' ' ',')
|
||||||
if [ ! "${sANACRONJOBS}" = "" ]; then
|
if [ ! -z "${sANACRONJOBS}" ]; then
|
||||||
Report "scheduler[]=anacron"
|
Report "scheduler[]=anacron"
|
||||||
for J in ${sANACRONJOBS}; do
|
for I in ${sANACRONJOBS}; do
|
||||||
LogText "Found anacron job (/etc/anacrontab): ${J}"
|
LogText "Found anacron job (/etc/anacrontab): ${I}"
|
||||||
Report "cronjob[]=${J}"
|
Report "cronjob[]=${I}"
|
||||||
done
|
done
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
@ -187,12 +194,12 @@
|
||||||
if [ ${SKIPTEST} -eq 0 ]; then
|
if [ ${SKIPTEST} -eq 0 ]; then
|
||||||
LogText "Test: Checking atd status"
|
LogText "Test: Checking atd status"
|
||||||
FIND=$(${PSBINARY} ax | ${GREPBINARY} "/atd" | ${GREPBINARY} -v "grep")
|
FIND=$(${PSBINARY} ax | ${GREPBINARY} "/atd" | ${GREPBINARY} -v "grep")
|
||||||
if [ ! "${FIND}" = "" ]; then
|
if [ ! -z "${FIND}" ]; then
|
||||||
LogText "Result: at daemon active"
|
LogText "Result: at daemon active"
|
||||||
Display --indent 2 --text "- Checking atd status" --result "${STATUS_RUNNING}" --color GREEN
|
Display --indent 2 --text "- Checking atd status" --result "${STATUS_RUNNING}" --color GREEN
|
||||||
ATD_RUNNING=1
|
ATD_RUNNING=1
|
||||||
Report "scheduler[]=atd"
|
Report "scheduler[]=atd"
|
||||||
else
|
else
|
||||||
LogText "Result: at daemon not active"
|
LogText "Result: at daemon not active"
|
||||||
if IsVerbose; then Display --indent 2 --text "- Checking atd status" --result "${STATUS_NOT_RUNNING}" --color WHITE; fi
|
if IsVerbose; then Display --indent 2 --text "- Checking atd status" --result "${STATUS_NOT_RUNNING}" --color WHITE; fi
|
||||||
fi
|
fi
|
||||||
|
|
@ -227,7 +234,7 @@
|
||||||
FIND=$(${SORTBINARY} ${AT_ALLOW})
|
FIND=$(${SORTBINARY} ${AT_ALLOW})
|
||||||
if [ "${FIND}" = "" ]; then
|
if [ "${FIND}" = "" ]; then
|
||||||
LogText "Result: File empty, no users are allowed to schedule at jobs"
|
LogText "Result: File empty, no users are allowed to schedule at jobs"
|
||||||
else
|
else
|
||||||
for I in ${FIND}; do
|
for I in ${FIND}; do
|
||||||
LogText "Allowed at user: ${I}"
|
LogText "Allowed at user: ${I}"
|
||||||
done
|
done
|
||||||
|
|
@ -235,32 +242,32 @@
|
||||||
else
|
else
|
||||||
LogText "Result: can not read ${AT_ALLOW} (no permission)"
|
LogText "Result: can not read ${AT_ALLOW} (no permission)"
|
||||||
fi
|
fi
|
||||||
else
|
else
|
||||||
LogText "Result: file ${AT_ALLOW} does not exist"
|
LogText "Result: file ${AT_ALLOW} does not exist"
|
||||||
LogText "Test: checking for file ${AT_DENY}"
|
LogText "Test: checking for file ${AT_DENY}"
|
||||||
if [ -f ${AT_DENY} ]; then
|
if [ -f ${AT_DENY} ]; then
|
||||||
FileIsReadable ${AT_DENY}
|
FileIsReadable ${AT_DENY}
|
||||||
if [ ${CANREAD} -eq 1 ]; then
|
if [ ${CANREAD} -eq 1 ]; then
|
||||||
LogText "Result: file ${AT_DENY} exists, only non listed users can schedule at jobs"
|
LogText "Result: file ${AT_DENY} exists, only non listed users can schedule at jobs"
|
||||||
FIND=$(${SORTBINARY} ${AT_DENY})
|
FIND=$(${SORTBINARY} ${AT_DENY})
|
||||||
if [ "${FIND}" = "" ]; then
|
if [ "${FIND}" = "" ]; then
|
||||||
LogText "Result: file is empty, no users are denied access to schedule jobs"
|
LogText "Result: file is empty, no users are denied access to schedule jobs"
|
||||||
else
|
else
|
||||||
for I in ${FIND}; do
|
for I in ${FIND}; do
|
||||||
LogText "Denied at user: ${I}"
|
LogText "Denied at user: ${I}"
|
||||||
done
|
done
|
||||||
fi
|
fi
|
||||||
else
|
else
|
||||||
LogText "Result: can not read ${AT_DENY} (no permission)"
|
LogText "Result: can not read ${AT_DENY} (no permission)"
|
||||||
fi
|
fi
|
||||||
else
|
else
|
||||||
LogText "Result: both ${AT_ALLOW} and ${AT_DENY} do not exist"
|
LogText "Result: both ${AT_ALLOW} and ${AT_DENY} do not exist"
|
||||||
LogText "Note: only root can schedule at jobs"
|
LogText "Note: only root can schedule at jobs"
|
||||||
AddHP 1 1
|
AddHP 1 1
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
Display --indent 4 --text "- Checking at users" --result "${STATUS_DONE}" --color GREEN
|
Display --indent 4 --text "- Checking at users" --result "${STATUS_DONE}" --color GREEN
|
||||||
else
|
else
|
||||||
Display --indent 4 --text "- Checking at users" --result "${STATUS_SKIPPED}" --color YELLOW
|
Display --indent 4 --text "- Checking at users" --result "${STATUS_SKIPPED}" --color YELLOW
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
|
|
@ -281,7 +288,7 @@
|
||||||
LogText "Found at job: ${VALUE}"
|
LogText "Found at job: ${VALUE}"
|
||||||
done
|
done
|
||||||
Display --indent 4 --text "- Checking at jobs" --result "${STATUS_FOUND}" --color GREEN
|
Display --indent 4 --text "- Checking at jobs" --result "${STATUS_FOUND}" --color GREEN
|
||||||
else
|
else
|
||||||
LogText "Result: no pending at jobs"
|
LogText "Result: no pending at jobs"
|
||||||
Display --indent 4 --text "- Checking at jobs" --result "${STATUS_NONE}" --color GREEN
|
Display --indent 4 --text "- Checking at jobs" --result "${STATUS_NONE}" --color GREEN
|
||||||
fi
|
fi
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue