diff --git a/include/binaries b/include/binaries index 95813686..1c56607b 100644 --- a/include/binaries +++ b/include/binaries @@ -220,6 +220,7 @@ tune2fs) TUNE2FSBINARY="${BINARY}"; LogText " Found known binary: tune2fs (file system tool) - ${BINARY}" ;; uname) UNAMEBINARY="${BINARY}"; LogText " Found known binary: uname (operating system details) - ${BINARY}" ;; uniq) UNIQBINARY="${BINARY}"; LogText " Found known binary: uniq (text manipulation utility) - ${BINARY}";; + usbguard) USBGUARDBINARY="${BINARY}"; LogText " Found known binary: usbguard (USB security tool) - ${BINARY}" ;; vgdisplay) VGDISPLAYBINARY="${BINARY}"; LogText " Found known binary: vgdisplay (LVM tool) - ${BINARY}" ;; vmtoolsd) VMWARETOOLSDBINARY="${BINARY}"; LogText " Found known binary: vmtoolsd (VMWare tools) - ${BINARY}" ;; wc) WCBINARY="${BINARY}"; LogText " Found known binary: wc (word count) - ${BINARY}" ;; diff --git a/include/consts b/include/consts index e5c0b4b0..4bb55a3a 100644 --- a/include/consts +++ b/include/consts @@ -283,6 +283,10 @@ unset LANG UPLOAD_PROXY_SERVER="" UPLOAD_TOOL="" UPLOAD_TOOL_ARGS="" + USBGUARDFOUND=0 + USBGUARDBINARY="" + USBGUARD_CONFIG="" + USBGUARD_ROOT="" VALUE="" VERBOSE=0 VGDISPLAYBINARY="" diff --git a/include/tests_usb_devices b/include/tests_usb_devices new file mode 100644 index 00000000..64e80aaf --- /dev/null +++ b/include/tests_usb_devices @@ -0,0 +1,266 @@ +#!/bin/sh + +################################################################################# +# +# Lynis +# ------------------ +# +# Website : https://cisofy.com +# Blog : http://linux-audit.com +# GitHub : https://github.com/CISOfy/lynis +# +# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are +# welcome to redistribute it under the terms of the GNU General Public License. +# See LICENSE file for usage of this software. +# +################################################################################# +# +# USB Devices +# +################################################################################# +# + + USBGUARD_FOUND=0 + USBGUARD_CONFIG="" + USBGUARD_RULES="" + USBGUARD_RESTORE_POLICY="" + USBGUARD_CONTROLLER_POLICY="" + USBGUARD_DEVICE_POLICY="" + USBGUARD_INSERTED_POLICY="" + USBGUARD_DEFAULT_POLICY="" + USBGUARD_RULES_ALLOW=0 + USBGUARD_RULES_BLOCK=0 + USBGUARD_RULES_REJECT=0 + +# +################################################################################# +# + InsertSection "USB Devices" +# +################################################################################# +# + + # PLACEHOLDER USB-0000 used until a good test name & number can be assigned. + # Once that is done, we are one step closer to being able to enable the + # suggestions below. + + # Test : USB-0000 + # Description : Perform file permissions check + Register --test-no USB-0000 --os Linux --weight L --network NO --category security --description "Check for presence of USBGuard" + if [ ${SKIPTEST} -eq 0 ]; then + + if [ ! -z "${USBGUARDBINARY}" ]; then + USBGUARD_FOUND=1 + LogText "Result: USBGuard is installed (${USBGUARDBINARY})" + Display --indent 2 --text "- Checking USBGuard" --result "${STATUS_FOUND}" --color GREEN + AddHP 1 1 + + LogText "Checking USBGuard configuration file" + if [ -f /etc/usbguard/usbguard-daemon.conf ]; then + USBGUARD_CONFIG="/etc/usbguard/usbguard-daemon.conf" + else + USBGUARD_CONFIG="" + fi + + if [ ! -z "${USBGUARD_CONFIG}" ]; then + LogText "Result: USBGuard configuration found (${USBGUARD_CONFIG})" + Display --indent 4 --text "- Configuration" --result "${STATUS_FOUND}" --color GREEN + AddHP 1 1 + + LogText "Checking USBGuard restore controller device state (RestoreControllerDeviceState)" + USBGUARD_RESTORE_POLICY=$(${AWKBINARY} -F '=' -v OPT="RestoreControllerDeviceState" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG}) + if [ ! -z "${USBGUARD_RESTORE_POLICY}" ]; then + LogText "Result: RestoreControllerDeviceState = ${USBGUARD_RESTORE_POLICY}" + case "${USBGUARD_RESTORE_POLICY}" in + "true") + Display --indent 6 --text "- Restore controller device state" --result "${USBGUARD_RESTORE_POLICY}" --color YELLOW + LogText " Consider changing RestoreControllerDeviceState to \"false\"" + # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion + # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "RestoreControllerDeviceState (${USBGUARD_RESTORE_POLICY} --> false)" + AddHP 0 1 + ;; + "false") + Display --indent 6 --text "- Restore controller device state" --result "${USBGUARD_RESTORE_POLICY}" --color GREEN + AddHP 1 1 + ;; + *) + LogText "Result: Invalid configuration for RestoreControllerDeviceState" + Display --indent 6 --text "- Restore controller device state" --result "Invalid" --color RED + # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion + # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "RestoreControllerDeviceState invalid \"${USBGUARD_RESTORE_POLICY}\"" + AddHP 0 1 + ;; + esac + + else + LogText "Result: RestoreControllerDeviceState not found" + Display --indent 6 --text "- Restore controller device state" --result "NOT FOUND" --color WHITE + AddHP 0 1 + fi + + LogText "Checking USBGuard rule for controllers connected before daemon starts (PresentControllerPolicy)" + USBGUARD_CONTROLLER_POLICY=$(${AWKBINARY} -F '=' -v OPT="PresentControllerPolicy" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG}) + if [ ! -z "${USBGUARD_CONTROLLER_POLICY}" ]; then + LogText "Result: PresentControllerPolicy = ${USBGUARD_CONTROLLER_POLICY}" + case "${USBGUARD_CONTROLLER_POLICY}" in + "allow"|"keep") + Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "${USBGUARD_CONTROLLER_POLICY}" --color YELLOW + LogText " Consider changing PresentControllerPolicy to \"apply-policy\", \"block\" or \"reject\"" + # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion + # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "PresentControllerPolicy (${USBGUARD_CONTROLLER_POLICY} --> (apply-policy|block|reject)" + AddHP 0 1 + ;; + "apply-policy"|"block"|"reject") + Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "${USBGUARD_CONTROLLER_POLICY}" --color GREEN + AddHP 1 1 + ;; + *) + LogText "Result: Invalid configuration for PresentControllerPolicy" + Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "Invalid" --color RED + # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion + # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "PresentControllerPolicy invalid \"${USBGUARD_CONTROLLER_POLICY}\"" + AddHP 0 1 + ;; + esac + else + LogText "Result: PresentControllerPolicy not found" + Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "NOT FOUND" --color WHITE + AddHP 0 1 + fi + + LogText "Checking USBGuard rule for devices connected before daemon starts (PresentDevicePolicy)" + USBGUARD_DEVICE_POLICY=$(${AWKBINARY} -F '=' -v OPT="PresentDevicePolicy" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG}) + if [ ! -z "${USBGUARD_DEVICE_POLICY}" ]; then + LogText "Result: PresentDevicePolicy = ${USBGUARD_DEVICE_POLICY}" + case "${USBGUARD_DEVICE_POLICY}" in + "allow"|"keep") + Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "${USBGUARD_DEVICE_POLICY}" --color YELLOW + LogText " Consider changing PresentDevicePolicy to \"apply-policy\", \"block\" or \"reject\"" + # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion + # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "PresentDevicePolicy (${USBGUARD_DEVICE_POLICY} --> (apply-policy|block|reject)" + AddHP 0 1 + ;; + "apply-policy"|"block"|"reject") + Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "${USBGUARD_DEVICE_POLICY}" --color GREEN + AddHP 1 1 + ;; + *) + LogText "Result: Invalid configuration for PresentDevicePolicy" + Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "Invalid" --color RED + # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion + # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "PresentDevicePolicy invalid \"${USBGUARD_DEVICE_POLICY}\"" + AddHP 0 1 + ;; + esac + else + LogText "Result: PresentDevicePolicy not found" + Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "NOT FOUND" --color WHITE + AddHP 0 1 + fi + + LogText "Checking USBGuard rule for devices inserted after daemon starts (InsertedDevicePolicy)" + USBGUARD_INSERTED_POLICY=$(${AWKBINARY} -F '=' -v OPT="InsertedDevicePolicy" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG}) + if [ ! -z "${USBGUARD_INSERTED_POLICY}" ]; then + LogText "Result: InsertedDevicePolicy = ${USBGUARD_INSERTED_POLICY}" + case "${USBGUARD_INSERTED_POLICY}" in + "allow"|"keep") + Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "${USBGUARD_INSERTED_POLICY}" --color YELLOW + LogText " Consider changing InsertedDevicePolicy to \"apply-policy\", \"block\" or \"reject\"" + # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion + # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "InsertedDevicePolicy (${USBGUARD_INSERTED_POLICY} --> (apply-policy|block|reject)" + AddHP 0 1 + ;; + "apply-policy"|"block"|"reject") + Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "${USBGUARD_INSERTED_POLICY}" --color GREEN + AddHP 1 1 + ;; + *) + LogText "Result: Invalid configuration for InsertedDevicePolicy" + Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "Invalid" --color RED + # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion + # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "InsertedDevicePolicy invalid \"${USBGUARD_INSERTED_POLICY}\"" + AddHP 0 1 + ;; + esac + else + LogText "Result: InsertedDevicePolicy not found" + Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "NOT FOUND" --color WHITE + AddHP 0 1 + fi + + LogText "Checking USBGuard rule for devices not in RuleFile (ImplicitPolicyTarget)" + USBGUARD_DEFAULT_POLICY=$(${AWKBINARY} -F '=' -v OPT="ImplicitPolicyTarget" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG}) + if [ ! -z "${USBGUARD_DEFAULT_POLICY}" ]; then + LogText "Result: ImplicitPolicyTarget = ${USBGUARD_DEFAULT_POLICY}" + case "${USBGUARD_DEFAULT_POLICY}" in + "allow") + Display --indent 6 --text "- Rule for devices not in RuleFile" --result "${USBGUARD_DEFAULT_POLICY}" --color YELLOW + LogText " Consider changing ImplicitPolicyTarget to \"block\" or \"reject\"" + # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion + # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "ImplicitPolicyTarget (${USBGUARD_DEFAULT_POLICY} --> (block|reject)" + AddHP 0 1 + ;; + "block"|"reject") + Display --indent 6 --text "- Rule for devices not in RuleFile" --result "${USBGUARD_DEFAULT_POLICY}" --color GREEN + AddHP 1 1 + ;; + *) + LogText "Result: Invalid configuration for ImplicitPolicyTarget" + Display --indent 6 --text "- Rule for devices not in RuleFile" --result "Invalid" --color RED + # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion + # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "ImplicitPolicyTarget invalid \"${USBGUARD_DEFAULT_POLICY}\"" + AddHP 0 1 + ;; + esac + else + LogText "Result: ImplicitPolicyTarget not found" + Display --indent 4 --text "- Rule for devices not in RuleFile" --result "NOT FOUND" --color WHITE + AddHP 0 1 + fi + + LogText "Checking RuleFile" + USBGUARD_RULES=$(${AWKBINARY} -F '=' -v OPT="RuleFile" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG}) + if [ ! -z "${USBGUARD_RULES}" ] && [ -f "${USBGUARD_RULES}" ]; then + LogText "Result: RuleFile found (${USBGUARD_RULES})" + Display --indent 4 --text "- RuleFile" --result "${STATUS_FOUND}" --color GREEN + AddHP 1 1 + + USBGUARD_RULES_ALLOW=$(${EGREPBINARY} -c "^allow" ${USBGUARD_RULES}) + Display --indent 6 --text "- Controllers & Devices allow" --result "${USBGUARD_RULES_ALLOW}" --color WHITE + USBGUARD_RULES_BLOCK=$(${EGREPBINARY} -c "^block" ${USBGUARD_RULES}) + Display --indent 6 --text "- Controllers & Devices block" --result "${USBGUARD_RULES_BLOCK}" --color WHITE + USBGUARD_RULES_REJECT=$(${EGREPBINARY} -c "^reject" ${USBGUARD_RULES}) + Display --indent 6 --text "- Controllers & Devices reject" --result "${USBGUARD_RULES_REJECT}" --color WHITE + else + LogText "Result: RuleFile not found (\"man usbguard\" for instructions to install initial policies)" + Display --indent 4 --text "- RuleFile" --result "${STATUS_NOT_FOUND}" --color RED + # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion + ReportSuggestion ${TEST_NO} "Install USBGuard RuleFile" "\"man usbguard\" for instructions to install initial policies" + AddHP 0 1 + fi + + else + Display --indent 4 --text "- Configuration" --result "${STATUS_NOT_FOUND}" --color WHITE + LogText "Result: Configuration not found" + # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion + #ReportSuggestion ${TEST_NO} "USBGuard configuration file not found, consider reinstalling" + AddHP 0 7 + fi + else + LogText "Result: USBGuard not found" + Display --indent 2 --text "- Checking USBGuard" --result "${STATUS_NOT_FOUND}" --color WHITE + # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion + #ReportSuggestion ${TEST_NO} "Install USBGuard to allow for fine-grained control of USB authorization" + AddHP 0 8 + fi + + fi + +# +################################################################################# +# + +WaitForKeyPress + +# +#================================================================================ diff --git a/lynis b/lynis index ab277235..2b8e9168 100755 --- a/lynis +++ b/lynis @@ -925,7 +925,7 @@ ${NORMAL} LogText "Info: perform tests from all categories" INCLUDE_TESTS="boot_services kernel memory_processes authentication shells \ - filesystems storage storage_nfs nameservices ports_packages networking printers_spools \ + filesystems usb_devices storage storage_nfs nameservices ports_packages networking printers_spools \ mail_messaging firewalls webservers ssh snmp databases ldap php squid logging \ insecure_services banners scheduling accounting time crypto virtualization containers \ mac_frameworks file_integrity tooling malware file_permissions homedirs \