tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-28 08:14:10 +02:00
Code Issues Packages Projects Releases Wiki Activity

[CRYP-7902] Optionally check also certificates provided by packages

Browse Source 
The package maintainers are not immune to mistakes or they might not
always provide timely updates, so let's check (optionally) more
certificates even if they are delivered by packages.

I found three expired certificates in my Debian/unstable system,
thanks to changed Lynis.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
This commit is contained in:
Topi Miettinen 2020-03-27 11:25:31 +02:00
parent b5a2d11738
commit 9642bcffc8
No known key found for this signature in database
GPG Key ID: 87E1A51C590B0577
5 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@ -95,6 +95,7 @@ Using the relevant options, the scan will change base on the intended goal.
- BANN-7126 - additional words for login banner are accepted - BANN-7126 - additional words for login banner are accepted
- BOOT-5122 - check for defined password in all GRUB configuration files - BOOT-5122 - check for defined password in all GRUB configuration files
- CONT-8106 - support newer 'docker info' output - CONT-8106 - support newer 'docker info' output
- CRYP-7902 - optionally check also certificates provided by packages
- CRYP-8002 - gather kernel entropy on Linux systems - CRYP-8002 - gather kernel entropy on Linux systems
- FILE-6310 - support for HP-UX - FILE-6310 - support for HP-UX
- FILE-6374 - changed log and allow root location to be changed - FILE-6374 - changed log and allow root location to be changed

3
default.prf
View File

@ -93,8 +93,9 @@ skip-plugins=no
#skip-upgrade-test=yes #skip-upgrade-test=yes
# Locations where to search for SSL certificates (separate paths with a colon) # Locations where to search for SSL certificates (separate paths with a colon)
ssl-certificate-paths=/etc/apache2:/etc/dovecot:/etc/httpd:/etc/letsencrypt:/etc/pki:/etc/postfix:/etc/ssl:/opt/psa/var/certificates:/usr/local/psa/var/certificates:/usr/local/share/ca-certificates:/var/www:/srv/www ssl-certificate-paths=/etc/apache2:/etc/dovecot:/etc/httpd:/etc/letsencrypt:/etc/pki:/etc/postfix:/etc/ssl:/opt/psa/var/certificates:/usr/local/psa/var/certificates:/usr/local/share/ca-certificates:/usr/share/ca-certificates:/usr/share/gnupg:/var/www:/srv/www
ssl-certificate-paths-to-ignore=/etc/letsencrypt/archive: ssl-certificate-paths-to-ignore=/etc/letsencrypt/archive:
ssl-certificate-include-packages=no
# Scan type - how deep the audit should be (light, normal or full) # Scan type - how deep the audit should be (light, normal or full)
test-scan-mode=full test-scan-mode=full

1
include/consts
View File

@ -279,6 +279,7 @@ unset LANG
SNORTBINARY="" SNORTBINARY=""
SSHKEYSCANBINARY="" SSHKEYSCANBINARY=""
SSHKEYSCANFOUND=0 SSHKEYSCANFOUND=0
SSL_CERTIFICATE_INCLUDE_PACKAGES=0
SSL_CERTIFICATE_PATHS="" SSL_CERTIFICATE_PATHS=""
SSL_CERTIFICATE_PATHS_TO_IGNORE="" SSL_CERTIFICATE_PATHS_TO_IGNORE=""
STUNNELBINARY="" STUNNELBINARY=""

7
include/profiles
View File

@ -376,6 +376,13 @@
AddSetting "ssl-certificate-paths-to-ignore" "${SSL_CERTIFICATE_PATHS_TO_IGNORE}" "Paths that should be ignored for SSL certificates" AddSetting "ssl-certificate-paths-to-ignore" "${SSL_CERTIFICATE_PATHS_TO_IGNORE}" "Paths that should be ignored for SSL certificates"
;; ;;
# Check also certificates provided by packages?
ssl-certificate-include-packages)
FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)") && SSL_CERTIFICATE_INCLUDE_PACKAGES=1
Debug "Check also certificates provided by packages set to ${SSL_CERTIFICATE_INCLUDE_PACKAGES}"
;;
# Set strict mode for development and quality purposes # Set strict mode for development and quality purposes
strict) strict)
FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)") && SET_STRICT=1 FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)") && SET_STRICT=1

4
include/tests_crypto
View File

@ -74,8 +74,8 @@
COUNT_DIR=$((COUNT_DIR + 1)) COUNT_DIR=$((COUNT_DIR + 1))
FileIsReadable "${FILE}" FileIsReadable "${FILE}"
if [ ${CANREAD} -eq 1 ]; then if [ ${CANREAD} -eq 1 ]; then
# Only check the files that are not installed by a package # Only check the files that are not installed by a package, unless enabled by profile
if ! FileInstalledByPackage "${FILE}"; then if [ ${SSL_CERTIFICATE_INCLUDE_PACKAGES} -eq 1 ] || ! FileInstalledByPackage "${FILE}"; then
OUTPUT=$(${GREPBINARY} -q 'BEGIN CERT' "${FILE}") OUTPUT=$(${GREPBINARY} -q 'BEGIN CERT' "${FILE}")
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
LogText "Result: file is a certificate file" LogText "Result: file is a certificate file"