mirror of https://github.com/CISOfy/lynis.git
Improved templates and examples
This commit is contained in:
mboelen
parent
c364fbe9b8
commit
a3084da623
|
|
@ -5,67 +5,107 @@
|
|||
# Here you could insert your own custom checks
|
||||
#
|
||||
# Tips:
|
||||
# - Make sure to use each test ID only once in Register function
|
||||
# - Make sure to use each test ID only once in Register function and prefix them with CUST
|
||||
# - Use big steps in numbering, so you can easily put tests in between
|
||||
# - Want to improve Lynis? Share your checks!
|
||||
#
|
||||
#################################################################################
|
||||
#
|
||||
# This has already been inserted, but you might reuse it to split your tests
|
||||
# InsertSection "Custom Checks"
|
||||
# Test : CUST-0001
|
||||
# Description : We show some lines on the screen
|
||||
|
||||
# Register our first custom test
|
||||
# We consider it to be a lightweight test (no heavy IO, or long searches), no network connection needed
|
||||
Register --test-no CUST-0001 --weight L --network NO --description "A test case for colors and text display"
|
||||
if [ ${SKIPTEST} -eq 0 ]; then
|
||||
# The Display function makes it easy to show something on screen, with colors.
|
||||
# --indent defines amount of spaces
|
||||
# --text text to be displayed on screen
|
||||
# --result text at end of line
|
||||
# --color color of result text
|
||||
Display --indent 2 --text "- Checking if everything is OK..." --result OK --color GREEN
|
||||
Display --indent 4 --text "This shows one level deeper " --result NOTICE --color YELLOW
|
||||
Display --indent 6 --text "And even deeper" --result WARNING --color RED
|
||||
|
||||
# Here we could add specific tests, like testing for a directory
|
||||
# Most tests use the "if-then-else". If something is true, take one step, otherwise the other.
|
||||
if [ -d /tmp ]; then
|
||||
LogText "Result: we have a temporary directory"
|
||||
else
|
||||
LogText "Result: no temporary directory found"
|
||||
fi
|
||||
|
||||
# Common examples to use:
|
||||
# if [ -f /etc/file ]; then = Test if file exists
|
||||
# if [ -d /var/run/mydirectory ]; then = Test if directory exists
|
||||
# if [ ${MYVARIABLE} -eq 1 ]; then = Test if variable is set to 1
|
||||
# if [ "${MYVARIABLE}" = "Value" ]; then = Test if variable is equal to specific value
|
||||
|
||||
if [ -f /etc/file ]; then
|
||||
LogText "Result: Found file /etc/file"
|
||||
elif [ -f /etc/file2 ]; then
|
||||
LogText "Result: Found file /etc/file2"
|
||||
else
|
||||
LogText "Result: both /etc/file and /etc/file2 not found"
|
||||
fi
|
||||
|
||||
# If a single value is stored in a variable, using case is effective.
|
||||
case ${OS} in
|
||||
# Only match one value
|
||||
"Linux")
|
||||
LogText "Found Linux"
|
||||
Display --indent 2 --text "OS: Linux" --result OK --color GREEN
|
||||
;;
|
||||
# Matching several platforms
|
||||
"FreeBSD"|"NetBSD"|"OpenBSD")
|
||||
LogText "Found an operating system based on BSD"
|
||||
Display --indent 2 --text "OS: *BSD" --result OK --color GREEN
|
||||
# Catch-all for unknown values
|
||||
*)
|
||||
LogText "Did find another operating system"
|
||||
;;
|
||||
esac
|
||||
|
||||
# Show a warning on screen and in the report. We can specify a detail and how to solve it.
|
||||
ReportWarning "${TEST_NO}" "Something was wrong and should be fixed" "/etc/motd" "text:Change your motd"
|
||||
ReportSuggestion "${TEST_NO}" "Check if this process is running" "apache" "url:https://cisofy.com/support/"
|
||||
fi
|
||||
#
|
||||
#################################################################################
|
||||
#
|
||||
# Test : CUST-0010
|
||||
# Author : Your name <e-mail address>
|
||||
# Description : Check for something interesting - template
|
||||
# Notes : This test first checks if OpenSSL binary was found
|
||||
|
||||
# * Prerequisites Check
|
||||
# -----------------------
|
||||
#
|
||||
# Check first if any dependency. If it doesn't meet, the test will be skipped after registration (SKIPTEST == 1)
|
||||
#
|
||||
# Examples:
|
||||
# -f /etc/file = Test if file exists
|
||||
# -d /var/run/mydirectory = Test if directory exists
|
||||
# ${MYVARIABLE} -eq 1 = Test if variable is set to 1
|
||||
# "${MYVARIABLE}" = "Value" = Test if variable is equal to specific value
|
||||
|
||||
if [ -f /etc/myfile ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
||||
|
||||
# * Registration of Test
|
||||
# ------------------------
|
||||
#
|
||||
# Register the test, with custom ID CUST-0010, and only execute it when the prerequisites were met
|
||||
Register --test-no CUST-0010 --preqs-met ${PREQS_MET} --weight L --network NO --description "Description of what this test does"
|
||||
|
||||
# Or we could use this test without any dependencies
|
||||
# Register --test-no CUST-0010 --weight L --network NO --description "Description of what this test does"
|
||||
|
||||
# If everything is fine, perform test
|
||||
# Add a new section to screen output
|
||||
InsertSection "Other Tests"
|
||||
#
|
||||
#################################################################################
|
||||
#
|
||||
# First check if OPENSSLBINARY is known as a prerequisite for this test.
|
||||
if [ ! "${OPENSSLBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
||||
Register --test-no CUST-0002 --preqs-met ${PREQS_MET} --weight M --network NO --description "Description of custom test"
|
||||
if [ ${SKIPTEST} -eq 0 ]; then
|
||||
FOUND=0
|
||||
LogText "Test: checking something"
|
||||
if [ ${FOUND} -eq 0 ]; then
|
||||
Display --indent 4 --text "- Performing custom test" --result OK --color GREEN
|
||||
LogText "Result: the test result looks great!"
|
||||
|
||||
# Optional: create a suggestion after a specific finding
|
||||
#ReportSuggestion "${TEST_NO}" "This is my suggestion to improve the system even further."
|
||||
|
||||
FOUNDPROBLEM=0
|
||||
DIR="/my/path"
|
||||
LogText "Test: we are going to check if we can find a particular directory (${DIR})"
|
||||
# Check if a directory exists
|
||||
if [ -d ${DIR} ]; then
|
||||
LogText "Result: log entry for easier debugging or additional information"
|
||||
else
|
||||
Display --indent 4 --text "- Performing custom test" --result WARNING --color RED
|
||||
LogText "Result: this test had a bad result :("
|
||||
# Throw a warning to the screen and report
|
||||
ReportWarning ${TEST_NO} "M" "This is a warning message"
|
||||
FOUNDPROBLEM=1
|
||||
LogText "Result: directory ${DIR} was not found!"
|
||||
ReportWarning "${TEST_NO}" "This is a test warning line" "${DIR}" "text:Create directory ${DIR}"
|
||||
fi
|
||||
|
||||
if [ ${FOUNDPROBLEM} -eq 0 ]; then
|
||||
Display --indent 2 --text "- Checking if everything is OK..." --result OK --color GREEN
|
||||
else
|
||||
Display --indent 2 --text "- Checking if everything is OK..." --result WARNING --color RED
|
||||
ReportSuggestion ${TEST_NO} "This is a suggestion"
|
||||
fi
|
||||
fi
|
||||
|
||||
#
|
||||
#################################################################################
|
||||
#
|
||||
|
||||
# Wait for keypress (unless --quick is being used)
|
||||
wait_for_keypress
|
||||
|
||||
#
|
||||
|
|
|
|||
|
|
@ -1,11 +1,12 @@
|
|||
#!/bin/sh
|
||||
|
||||
# -------------------------- CUT THIS SECTION ---------------------------
|
||||
# This is a template to create a personal plugin
|
||||
# This is a template to create a customized plugin
|
||||
#
|
||||
# Each plugin should at least have several variables defined with the
|
||||
# prefix PLUGIN_* (see below)
|
||||
#
|
||||
# To add a section header, use the InsertSection function (see below)
|
||||
# If you want to learn what functions you can use, check include/functions
|
||||
#
|
||||
# -------------------------- CUT THIS SECTION ---------------------------
|
||||
|
||||
|
|
@ -19,43 +20,59 @@
|
|||
# PLUGIN_NAME=[plugin_name]
|
||||
# PLUGIN_REQUIRED_TESTS=
|
||||
#-----------------------------------------------------
|
||||
#########################################################################
|
||||
#
|
||||
#
|
||||
#
|
||||
#########################################################################
|
||||
#
|
||||
# Add custom section to screen output
|
||||
# InsertSection "Personal Plugin"
|
||||
# Add custom section to screen output
|
||||
InsertSection "Custom Plugin"
|
||||
#
|
||||
#################################################################################
|
||||
#
|
||||
# Test : CUST-0001
|
||||
# Description : We show some lines on the screen
|
||||
|
||||
# Register our first custom test
|
||||
# We consider it to be a lightweight test (no heavy IO, or long searches), no network connection needed
|
||||
Register --test-no CUST-0001 --weight L --network NO --description "A test case for colors and text display"
|
||||
if [ ${SKIPTEST} -eq 0 ]; then
|
||||
# The Display function makes it easy to show something on screen, with colors.
|
||||
# --indent defines amount of spaces
|
||||
# --text text to be displayed on screen
|
||||
# --result text at end of line
|
||||
# --color color of result text
|
||||
Display --indent 2 --text "- Checking if everything is OK..." --result OK --color GREEN
|
||||
Display --indent 4 --text "This shows one level deeper " --result NOTICE --color YELLOW
|
||||
Display --indent 6 --text "And even deeper" --result WARNING --color RED
|
||||
|
||||
# Show a warning on screen and in the report. We can specify a detail and how to solve it.
|
||||
ReportWarning "${TEST_NO}" "Something was wrong and should be fixed" "/etc/motd" "text:Change your motd"
|
||||
ReportSuggestion "${TEST_NO}" "Check if this process is running" "apache" "url:https://cisofy.com/support/"
|
||||
fi
|
||||
#
|
||||
#################################################################################
|
||||
#
|
||||
# Test : CUS-0000
|
||||
# Description : check for an ordinary directory!
|
||||
|
||||
# First check if OPENSSLBINARY is known as a prerequisite for this test.
|
||||
if [ ! -z "${OPENSSLBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
||||
Register --test-no CUS-0000 --preqs-met ${PREQS_MET} --weight L --network NO --description "Description of custom test"
|
||||
|
||||
# Just do check without any prerequisites
|
||||
Register --test-no CUS-0000 --weight L --network NO --description "Description of custom test"
|
||||
Register --test-no CUST-0001 --preqs-met ${PREQS_MET} --weight M --network NO --description "Description of custom test"
|
||||
if [ ${SKIPTEST} -eq 0 ]; then
|
||||
FOUNDPROBLEM=0
|
||||
DIR="/my/path"
|
||||
LogText "Test: we are going to check if we can find a particular directory (${DIR})"
|
||||
# Check if a directory exists
|
||||
if [ -d /my/path ]; then
|
||||
logtext "Result: log entry for easier debugging or additional information"
|
||||
else
|
||||
FOUNDPROBLEM=1
|
||||
logtext "Result: problem found!"
|
||||
ReportWarning ${TEST_NO} "M" "This is a test warning line"
|
||||
if [ -d ${DIR} ]; then
|
||||
LogText "Result: log entry for easier debugging or additional information"
|
||||
else
|
||||
FOUNDPROBLEM=1
|
||||
LogText "Result: directory ${DIR} was not found!"
|
||||
ReportWarning "${TEST_NO}" "This is a test warning line" "${DIR}" "text:Create directory ${DIR}"
|
||||
fi
|
||||
|
||||
if [ ${FOUNDPROBLEM} -eq 0 ]; then
|
||||
Display --indent 2 --text "- Checking xxx..." --result OK --color GREEN
|
||||
Display --indent 2 --text "- Checking if everything is OK..." --result OK --color GREEN
|
||||
else
|
||||
Display --indent 2 --text "- Checking xxx..." --result WARNING --color RED
|
||||
Display --indent 2 --text "- Checking if everything is OK..." --result WARNING --color RED
|
||||
ReportSuggestion ${TEST_NO} "This is a suggestion"
|
||||
ReportWarning ${TEST_NO} "M" "This is a medium level warning"
|
||||
fi
|
||||
fi
|
||||
#
|
||||
|
|
|
|||
Loading…
Reference in New Issue