mirror of https://github.com/CISOfy/lynis.git
Replace / with root directory
This commit is contained in:
Michael Boelen
parent
242f91ab97
commit
a0e289d73f
|
|
@ -22,7 +22,7 @@
|
|||
#
|
||||
#################################################################################
|
||||
#
|
||||
AUDITD_CONF_LOCS="/etc /etc/audit"
|
||||
AUDITD_CONF_LOCS="${ROOTDIR}etc ${ROOTDIR}etc/audit"
|
||||
AUDITD_CONF_FILE=""
|
||||
LINUX_AUDITD_RUNNING=0
|
||||
AUDIT_DAEMON_RUNNING=0
|
||||
|
|
@ -34,7 +34,7 @@
|
|||
# Description : Check availability FreeBSD accounting data
|
||||
Register --test-no ACCT-2754 --os FreeBSD --weight L --network NO --category security --description "Check for available FreeBSD accounting information"
|
||||
if [ ${SKIPTEST} -eq 0 ]; then
|
||||
if [ -f /var/account/acct ]; then
|
||||
if [ -f ${ROOTDIR}var/account/acct ]; then
|
||||
Display --indent 2 --text "- Checking accounting information" --result "${STATUS_OK}" --color GREEN
|
||||
LogText "Result: /var/account/acct available"
|
||||
AddHP 3 3
|
||||
|
|
@ -74,15 +74,15 @@
|
|||
Register --test-no ACCT-9622 --os Linux --weight L --network NO --category security --description "Check for available Linux accounting information"
|
||||
if [ ${SKIPTEST} -eq 0 ]; then
|
||||
LogText "Test: Check accounting information"
|
||||
if [ -f /var/account/pacct ]; then
|
||||
if [ -f ${ROOTDIR}var/account/pacct ]; then
|
||||
Display --indent 2 --text "- Checking accounting information" --result "${STATUS_OK}" --color GREEN
|
||||
LogText "Result: /var/account/pacct available"
|
||||
AddHP 3 3
|
||||
elif [ -f /var/log/account/pacct ]; then
|
||||
elif [ -f ${ROOTDIR}var/log/account/pacct ]; then
|
||||
Display --indent 2 --text "- Checking accounting information" --result "${STATUS_OK}" --color GREEN
|
||||
LogText "Result: /var/log/account/pacct available"
|
||||
AddHP 3 3
|
||||
elif [ -f /var/log/pacct ]; then
|
||||
elif [ -f ${ROOTDIR}var/log/pacct ]; then
|
||||
Display --indent 2 --text "- Checking accounting information" --result "${STATUS_OK}" --color GREEN
|
||||
LogText "Result: /var/log/pacct available"
|
||||
AddHP 3 3
|
||||
|
|
@ -102,29 +102,29 @@
|
|||
Register --test-no ACCT-9626 --os Linux --weight L --network NO --category security --description "Check for sysstat accounting data"
|
||||
if [ ${SKIPTEST} -eq 0 ]; then
|
||||
LogText "Test: check /etc/default/sysstat presence"
|
||||
if [ -f /etc/default/sysstat ]; then
|
||||
LogText "Result: /etc/default/sysstat found"
|
||||
FIND=`grep "^ENABLED" /etc/default/sysstat | grep -i true`
|
||||
if [ -f ${ROOTDIR}etc/default/sysstat ]; then
|
||||
LogText "Result: ${ROOTDIR}etc/default/sysstat found"
|
||||
FIND=`grep "^ENABLED" ${ROOTDIR}etc/default/sysstat | grep -i true`
|
||||
if [ ! "${FIND}" = "" ]; then
|
||||
LogText "Result: sysstat enabled via /etc/default/sysstat"
|
||||
LogText "Result: sysstat enabled via ${ROOTDIR}etc/default/sysstat"
|
||||
Display --indent 2 --text "- Checking sysstat accounting data" --result "${STATUS_ENABLED}" --color GREEN
|
||||
else
|
||||
LogText "Result: sysstat disabled via /etc/default/sysstat"
|
||||
LogText "Result: sysstat disabled via ${ROOTDIR}etc/default/sysstat"
|
||||
Display --indent 2 --text "- Checking sysstat accounting data" --result "${STATUS_DISABLED}" --color WHITE
|
||||
ReportSuggestion ${TEST_NO} "Enable sysstat to collect accounting (disabled)"
|
||||
fi
|
||||
elif [ -f /etc/cron.d/sysstat ]; then
|
||||
FIND=`grep -v '^[[:space:]]*\(#\|$\)' /etc/cron.d/sysstat`
|
||||
elif [ -f ${ROOTDIR}etc/cron.d/sysstat ]; then
|
||||
FIND=`grep -v '^[[:space:]]*\(#\|$\)' ${ROOTDIR}etc/cron.d/sysstat`
|
||||
if [ ! "${FIND}" = "" ]; then
|
||||
LogText "Result: sysstat enabled via /etc/cron.d/sysstat"
|
||||
LogText "Result: sysstat enabled via ${ROOTDIR}etc/cron.d/sysstat"
|
||||
Display --indent 2 --text "- Checking sysstat accounting data" --result "${STATUS_ENABLED}" --color GREEN
|
||||
else
|
||||
LogText "Result: sysstat disabled via /etc/cron.d/sysstat"
|
||||
LogText "Result: sysstat disabled via ${ROOTDIR}etc/cron.d/sysstat"
|
||||
Display --indent 2 --text "- Checking sysstat accounting data" --result "${STATUS_DISABLED}" --color WHITE
|
||||
ReportSuggestion ${TEST_NO} "Enable sysstat to collect accounting (cron disabled)"
|
||||
fi
|
||||
else
|
||||
LogText "Result: sysstat not found via /etc/default/sysstat or /etc/cron.d/sysstat"
|
||||
LogText "Result: sysstat not found via ${ROOTDIR}etc/default/sysstat or /etc/cron.d/sysstat"
|
||||
Display --indent 2 --text "- Checking sysstat accounting data" --result "${STATUS_NOT_FOUND}" --color YELLOW
|
||||
ReportSuggestion ${TEST_NO} "Enable sysstat to collect accounting (no results)"
|
||||
fi
|
||||
|
|
@ -245,13 +245,13 @@
|
|||
# Description : Check for Snoopy (wrapper for execve() and logger)
|
||||
Register --test-no ACCT-9636 --os Linux --weight L --network NO --category security --description "Check for Snoopy wrapper and logger"
|
||||
if [ ${SKIPTEST} -eq 0 ]; then
|
||||
FILE="/lib/snoopy.so"
|
||||
FILE="${ROOTDIR}lib/snoopy.so"
|
||||
if [ -f ${FILE} ]; then
|
||||
LogText "Result: found ${FILE}"
|
||||
Display --indent 2 --text "- Checking Snoopy" --result "${STATUS_FOUND}" --color GREEN
|
||||
if [ -f /etc/ld.so.preload ]; then
|
||||
LogText "Result: found /etc/ld.so.preload, testing if snoopy.so is listed"
|
||||
FIND=`grep ${FILE} /etc/ld.so.preload`
|
||||
if [ -f ${ROOTDIR}etc/ld.so.preload ]; then
|
||||
LogText "Result: found ${ROOTDIR}etc/ld.so.preload, testing if snoopy.so is listed"
|
||||
FIND=`grep ${FILE} ${ROOTDIR}etc/ld.so.preload`
|
||||
if [ ! "${FIND}" = "" ]; then
|
||||
LogText "Result: found snoopy in ld.so.preload"
|
||||
LogText "Output: ${FIND}"
|
||||
|
|
@ -263,7 +263,7 @@
|
|||
AddHP 3 3
|
||||
fi
|
||||
else
|
||||
LogText "Result: /etc/ld.so.preload does not exist"
|
||||
LogText "Result: ${ROOTDIR}etc/ld.so.preload does not exist"
|
||||
Display --indent 6 --text "- Library in ld.so.preload" --result "${STATUS_UNKNOWN}" --color PURPLE
|
||||
ReportException "${TEST_NO}:1" "Unsure how Snoopy might be loaded as ld.so.preload does not exist"
|
||||
fi
|
||||
|
|
@ -314,17 +314,17 @@
|
|||
if [ ${SOLARIS_AUDITD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
||||
Register --test-no ACCT-9654 --os Solaris --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check BSM auditing in /etc/system"
|
||||
if [ ${SKIPTEST} -eq 0 ]; then
|
||||
LogText "Test: check if BSM is enabled in /etc/system"
|
||||
if [ -f /etc/system ]; then
|
||||
FIND=`grep 'set c2audit:audit_load = 1' /etc/system`
|
||||
LogText "Test: check if BSM is enabled in ${ROOTDIR}etc/system"
|
||||
if [ -f ${ROOTDIR}etc/system ]; then
|
||||
FIND=`grep 'set c2audit:audit_load = 1' ${ROOTDIR}etc/system`
|
||||
if [ ! "${FIND}" = "" ]; then
|
||||
LogText "Result: BSM is enabled in /etc/system"
|
||||
Display --indent 4 --text "- Checking Solaris BSM (/etc/system)" --result "${STATUS_ENABLED}" --color GREEN
|
||||
LogText "Result: BSM is enabled in ${ROOTDIR}etc/system"
|
||||
Display --indent 4 --text "- Checking Solaris BSM (${ROOTDIR}etc/system)" --result "${STATUS_ENABLED}" --color GREEN
|
||||
else
|
||||
Display --indent 4 --text "- Checking Solaris BSM (/etc/system)" --result "${STATUS_NOT_FOUND}" --color YELLOW
|
||||
Display --indent 4 --text "- Checking Solaris BSM (${ROOTDIR}etc/system)" --result "${STATUS_NOT_FOUND}" --color YELLOW
|
||||
fi
|
||||
else
|
||||
LogText "Result: /etc/system does not exist"
|
||||
LogText "Result: ${ROOTDIR}etc/system does not exist"
|
||||
fi
|
||||
fi
|
||||
#
|
||||
|
|
@ -358,9 +358,9 @@
|
|||
Register --test-no ACCT-9660 --os Solaris --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check location of audit events"
|
||||
if [ ${SKIPTEST} -eq 0 ]; then
|
||||
LogText "Test: check /etc/security/audit_control for event logging location"
|
||||
if [ -f /etc/security/audit_control ]; then
|
||||
LogText "Result: file /etc/security/audit_control found"
|
||||
FIND=`grep "^dir" /etc/security/audit_control | ${AWKBINARY} -F: '{ print $2 }'`
|
||||
if [ -f ${ROOTDIR}etc/security/audit_control ]; then
|
||||
LogText "Result: file ${ROOTDIR}etc/security/audit_control found"
|
||||
FIND=`grep "^dir" ${ROOTDIR}etc/security/audit_control | ${AWKBINARY} -F: '{ print $2 }'`
|
||||
if [ ! "${FIND}" = "" ]; then
|
||||
LogText "Result: found location ${FIND}"
|
||||
LogText "Test: Checking if location is a valid directory"
|
||||
|
|
@ -378,7 +378,7 @@
|
|||
ReportSuggestion "${TEST_NO}" "Check if the Solaris audit directory is properly configured"
|
||||
fi
|
||||
else
|
||||
LogText "Result: could not find /etc/security/audit_control"
|
||||
LogText "Result: could not find ${ROOTDIR}etc/security/audit_control"
|
||||
Display --indent 4 --text "- Checking Solaris audit location" --result "${STATUS_SKIPPED}" --color YELLOW
|
||||
fi
|
||||
fi
|
||||
|
|
|
|||
Loading…
Reference in New Issue