tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-28 00:04:16 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #882 from topimiettinen/check-package-certificates

Browse Source 
[CRYP-7902] Check also certificates provided by packages
This commit is contained in:
Michael Boelen 2020-04-09 11:01:39 +02:00 committed by GitHub
commit a166691199
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@ -99,6 +99,7 @@ Using the relevant options, the scan will change base on the intended goal.
- BANN-7126 - additional words for login banner are accepted - BANN-7126 - additional words for login banner are accepted
- BOOT-5122 - check for defined password in all GRUB configuration files - BOOT-5122 - check for defined password in all GRUB configuration files
- CONT-8106 - support newer 'docker info' output - CONT-8106 - support newer 'docker info' output
- CRYP-7902 - optionally check also certificates provided by packages
- CRYP-8002 - gather kernel entropy on Linux systems - CRYP-8002 - gather kernel entropy on Linux systems
- FILE-6310 - support for HP-UX - FILE-6310 - support for HP-UX
- FILE-6374 - changed log and allow root location to be changed - FILE-6374 - changed log and allow root location to be changed

3
default.prf
View File

@ -93,8 +93,9 @@ skip-plugins=no
#skip-upgrade-test=yes #skip-upgrade-test=yes
# Locations where to search for SSL certificates (separate paths with a colon) # Locations where to search for SSL certificates (separate paths with a colon)
ssl-certificate-paths=/etc/apache2:/etc/dovecot:/etc/httpd:/etc/letsencrypt:/etc/pki:/etc/postfix:/etc/ssl:/opt/psa/var/certificates:/usr/local/psa/var/certificates:/usr/local/share/ca-certificates:/var/www:/srv/www ssl-certificate-paths=/etc/apache2:/etc/dovecot:/etc/httpd:/etc/letsencrypt:/etc/pki:/etc/postfix:/etc/ssl:/opt/psa/var/certificates:/usr/local/psa/var/certificates:/usr/local/share/ca-certificates:/usr/share/ca-certificates:/usr/share/gnupg:/var/www:/srv/www
ssl-certificate-paths-to-ignore=/etc/letsencrypt/archive: ssl-certificate-paths-to-ignore=/etc/letsencrypt/archive:
ssl-certificate-include-packages=no
# Scan type - how deep the audit should be (light, normal or full) # Scan type - how deep the audit should be (light, normal or full)
test-scan-mode=full test-scan-mode=full

1
include/consts
View File

@ -281,6 +281,7 @@ unset LANG
SNORTBINARY="" SNORTBINARY=""
SSHKEYSCANBINARY="" SSHKEYSCANBINARY=""
SSHKEYSCANFOUND=0 SSHKEYSCANFOUND=0
SSL_CERTIFICATE_INCLUDE_PACKAGES=0
SSL_CERTIFICATE_PATHS="" SSL_CERTIFICATE_PATHS=""
SSL_CERTIFICATE_PATHS_TO_IGNORE="" SSL_CERTIFICATE_PATHS_TO_IGNORE=""
STUNNELBINARY="" STUNNELBINARY=""

7
include/profiles
View File

@ -376,6 +376,13 @@
AddSetting "ssl-certificate-paths-to-ignore" "${SSL_CERTIFICATE_PATHS_TO_IGNORE}" "Paths that should be ignored for SSL certificates" AddSetting "ssl-certificate-paths-to-ignore" "${SSL_CERTIFICATE_PATHS_TO_IGNORE}" "Paths that should be ignored for SSL certificates"
;; ;;
# Check also certificates provided by packages?
ssl-certificate-include-packages)
FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)") && SSL_CERTIFICATE_INCLUDE_PACKAGES=1
Debug "Check also certificates provided by packages set to ${SSL_CERTIFICATE_INCLUDE_PACKAGES}"
;;
# Set strict mode for development and quality purposes # Set strict mode for development and quality purposes
strict) strict)
FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)") && SET_STRICT=1 FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)") && SET_STRICT=1

4
include/tests_crypto
View File

@ -74,8 +74,8 @@
COUNT_DIR=$((COUNT_DIR + 1)) COUNT_DIR=$((COUNT_DIR + 1))
FileIsReadable "${FILE}" FileIsReadable "${FILE}"
if [ ${CANREAD} -eq 1 ]; then if [ ${CANREAD} -eq 1 ]; then
# Only check the files that are not installed by a package # Only check the files that are not installed by a package, unless enabled by profile
if ! FileInstalledByPackage "${FILE}"; then if [ ${SSL_CERTIFICATE_INCLUDE_PACKAGES} -eq 1 ] || ! FileInstalledByPackage "${FILE}"; then
OUTPUT=$(${GREPBINARY} -q 'BEGIN CERT' "${FILE}") OUTPUT=$(${GREPBINARY} -q 'BEGIN CERT' "${FILE}")
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
LogText "Result: file is a certificate file" LogText "Result: file is a certificate file"