tyler.durden
/
lynis
mirror of https://github.com/CISOfy/lynis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix: HostID2 generation on OpenWrt 

OpenWrt uses `dropbear` as a lightweight SSH server.

I assume, that all devices with OpenWrt have MAC address (they are routers),
so to minimize impact on other OSes, I didn't touch SSH-based HostID
generation.
This commit is contained in:
macie 2025-02-09 08:37:45 +01:00
parent 580c7a3e2c
commit 89383ee196
No known key found for this signature in database
1 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
include/functions
View File

@ -1069,7 +1069,7 @@
if HasData "${FIND}"; then
LogText "Info: using hardware address '${FIND}' to create HostID"
if [ -n "${SHA1SUMBINARY}" ]; then
HOSTID=$(echo ${FIND} | ${SHA1SUMBINARY} | awk '{ print $1 }')
HOSTID=$(echo ${FIND} | ${SHA1SUMBINARY} | awk '{ print $1 }')
elif [ -n "${SHA256SUMBINARY}" ]; then
# Truncate hash to match SHA1 length
HOSTID=$(echo ${FIND} | ${SHA256SUMBINARY} | awk '{ print $1 }' | head -c 40)
@ -1203,10 +1203,9 @@
LogText "Info: start generation of HostID (version 2)"
FOUND=0
DATA_SSH=""
# Use public keys
SSH_KEY_FILES="ssh_host_ed25519_key.pub ssh_host_ecdsa_key.pub ssh_host_dsa_key.pub ssh_host_rsa_key.pub"
if [ -d /etc/ssh ]; then
for I in ${SSH_KEY_FILES}; do
SSH_PUBKEY_FILES="ssh_host_ed25519_key.pub ssh_host_ecdsa_key.pub ssh_host_dsa_key.pub ssh_host_rsa_key.pub"
for I in ${SSH_PUBKEY_FILES}; do
if [ ${FOUND} -eq 0 ]; then
if [ -f /etc/ssh/${I} ]; then
LogText "Result: found file ${I} in /etc/ssh, using that as candidate to create hostid2"
@ -1215,8 +1214,20 @@
fi
fi
done
elif [ -d /etc/dropbear ]; then
SSH_KEY_FILES="dropbear_ed25519_host_key dropbear_rsa_host_key"
for I in ${SSH_KEY_FILES}; do
if [ ${FOUND} -eq 0 ]; then
if [ -f "/etc/dropbear/${I}" ]; then
LogText "Result: found file ${I} in /etc/dropbear, using that as candidate to create hostid2"
# Dropbear stores both keys in one binary file
DATA_SSH=$(dropbearkey -y -f "/etc/dropbear/${I}" | grep '^ssh')
FOUND=1
fi
fi
done
else
LogText "Result: no /etc/ssh directory found, skipping"
LogText "Result: no /etc/ssh nor /etc/dropbear directory found, skipping"
fi
STRING_TO_HASH=""