From 5b09da0d9878096d45f04b858c4f65e674369ab4 Mon Sep 17 00:00:00 2001
From: Katka Durechova <durechova@ynet.sk>
Date: Sat, 27 Oct 2018 20:19:08 +0200
Subject: [PATCH 001/679] Store log and data file in home directory for
 non-privileged usage

---
 lynis | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/lynis b/lynis
index f2926cce..5956290b 100755
--- a/lynis
+++ b/lynis
@@ -236,21 +236,21 @@ Make sure to execute ${PROGRAM_NAME} from untarred directory or check your insta
     # Disable logging if no alternative was provided
     if [ ${PRIVILEGED} -eq 0 ]; then
         if [ -z "${LOGFILE}" ]; then
-            # Try creating a log file in temporary directory
-            if [ ! -f /tmp/lynis.log ]; then
-                if [ -L /tmp/lynis.log ]; then echo "Log file is symlinked, which can introduce the risk of a symlink attack."; exit 1; fi
-                touch /tmp/lynis.log
-                if [ $? -eq 0 ]; then LOGFILE="/tmp/lynis.log"; else LOGFILE="/dev/null"; fi
+            # Try creating a log file in home directory
+            if [ ! -f "$HOME/lynis.log" ]; then
+                if [ -L "$HOME/lynis.log" ]; then echo "Log file is symlinked, which can introduce the risk of a symlink attack."; exit 1; fi
+                touch "$HOME/lynis.log"
+                if [ $? -eq 0 ]; then LOGFILE="$HOME/lynis.log"; else LOGFILE="/dev/null"; fi
             else
-                LOGFILE="/tmp/lynis.log"
+                LOGFILE="$HOME/lynis.log"
             fi
         else
             if [ -L "${LOGFILE}" ]; then echo "Log file is symlinked, which can introduce the risk of a symlink attack."; exit 1; fi
         fi
         if [ -z "${REPORTFILE}" ]; then
-            touch /tmp/lynis-report.dat
-            if [ -L /tmp/lynis-report.dat ]; then echo "Report file is symlinked, which can introduce the risk of a symlink attack."; exit 1; fi
-            if [ $? -eq 0 ]; then REPORTFILE="/tmp/lynis-report.dat"; else REPORTFILE="/dev/null"; fi
+            touch "$HOME/lynis-report.dat"
+            if [ -L "$HOME/lynis-report.dat" ]; then echo "Report file is symlinked, which can introduce the risk of a symlink attack."; exit 1; fi
+            if [ $? -eq 0 ]; then REPORTFILE="$HOME/lynis-report.dat"; else REPORTFILE="/dev/null"; fi
         else
             if [ -L "${REPORTFILE}" ]; then echo "Report file is symlinked, which can introduce the risk of a symlink attack."; exit 1; fi
         fi

From 19921ab00142c94033f0473febfcf26919db56b9 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 28 Feb 2019 10:19:09 +0100
Subject: [PATCH 002/679] Style improvements, typo, variable usage

---
 include/tests_authentication | 56 ++++++++++++++++++------------------
 1 file changed, 28 insertions(+), 28 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index c4f62b64..e0571a49 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -487,35 +487,35 @@
     if [ ! -z "${SUDOERS_FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no AUTH-9252 --preqs-met ${PREQS_MET} --weight L --network NO --root-only YES --category security --description "Check ownership and permissions for sudo configuration files"
     if [ ${SKIPTEST} -eq 0 ]; then
-      SUDO_CONFIG_FILES="${SUDOERS_FILE}"
-      SUDOERS_D="${SUDOERS_FILE}.d"
-      if [ -d "${SUDOERS_D}" ]; then
-	LogText "Test: checking drop-in directory (${SUDOERS_D})"
-	FIND=$(${LSBINARY} -ld ${SUDOERS_D} | ${CUTBINARY} -c 2-10)
-	FIND1=$(${LSBINARY} -nd ${SUDOERS_D} | ${AWKBINARY} '{print $3$4}')
-	LogText "Result: Found directory permissions: ${FIND} and owner UID GID: ${FIND1}"
-	if [ "${FIND}" = "rwxrwx---" -o "${FIND}" = "rwxr-x---" -o "${FIND}" = "rwx------" ] && [ "${FIND1}" = "00" ]; then
-	  LogText "Result: directory ${SUDOERS_D} permissions/ownership OK"
-	  Display --indent 4 --text "- Permissions for directory: ${SUDOERS_D}" --result "${STATUS_OK}" --color GREEN
-	else
-	  LogText "Result: directory has possibly unsafe permissions/ownership"
-          Display --indent 4 --text "- Permissions for directory: ${SUDOERS_D}" --result "${STATUS_WARNING}" --color RED
-	fi
-	SUDO_CONFIG_FILES="${SUDO_CONFIG_FILES} $(${FINDBINARY} ${SUDOERS_D} -type f -print)"
-      fi
-      for f in ${SUDO_CONFIG_FILES}; do
-        LogText "Test: checking file (${f})"
-        FIND=$(${LSBINARY} -l ${f} | ${CUTBINARY} -c 2-10)
-	FIND1=$(${LSBINARY} -n ${f} | ${AWKBINARY} '{print $3$4}')
-        LogText "Result: Found file permissions: ${FIND} and owner UID GID: ${FIND1}"
-        if [ "${FIND}" = "rw-------" -o "${FIND}" = "rw-rw----" -o "${FIND}" = "r--r-----" ] && [ "${FIND1}" = "00" ]; then
-            LogText "Result: file ${f} permissions/ownerhsip OK"
-	    Display --indent 4 --text "- Permissions for: ${f}" --result "${STATUS_OK}" --color GREEN
-        else
-            LogText "Result: file has possibly unsafe permissions/ownership"
-	    Display --indent 4 --text "- Permissions for: ${f}" --result "${STATUS_WARNING}" --color RED
+        SUDO_CONFIG_FILES="${SUDOERS_FILE}"
+        SUDOERS_D="${SUDOERS_FILE}.d"
+        if [ -d "${SUDOERS_D}" ]; then
+            LogText "Test: checking drop-in directory (${SUDOERS_D})"
+            FIND=$(${LSBINARY} -ld ${SUDOERS_D} | ${CUTBINARY} -c 2-10)
+            FIND2=$(${LSBINARY} -nd ${SUDOERS_D} | ${AWKBINARY} '{print $3$4}')
+            LogText "Result: Found directory permissions: ${FIND} and owner UID GID: ${FIND2}"
+            if [ "${FIND}" = "rwxrwx---" -o "${FIND}" = "rwxr-x---" -o "${FIND}" = "rwx------" ] && [ "${FIND2}" = "00" ]; then
+                LogText "Result: directory ${SUDOERS_D} permissions/ownership OK"
+                Display --indent 4 --text "- Permissions for directory: ${SUDOERS_D}" --result "${STATUS_OK}" --color GREEN
+            else
+                LogText "Result: directory has possibly unsafe permissions/ownership"
+                Display --indent 4 --text "- Permissions for directory: ${SUDOERS_D}" --result "${STATUS_WARNING}" --color RED
+            fi
+            SUDO_CONFIG_FILES="${SUDO_CONFIG_FILES} $(${FINDBINARY} ${SUDOERS_D} -type f -print)"
         fi
-      done
+        for f in ${SUDO_CONFIG_FILES}; do
+            LogText "Test: checking file (${f})"
+            FIND=$(${LSBINARY} -l ${f} | ${CUTBINARY} -c 2-10)
+            FIND2=$(${LSBINARY} -n ${f} | ${AWKBINARY} '{print $3$4}')
+            LogText "Result: Found file permissions: ${FIND} and owner UID GID: ${FIND2}"
+            if [ "${FIND}" = "rw-------" -o "${FIND}" = "rw-rw----" -o "${FIND}" = "r--r-----" ] && [ "${FIND2}" = "00" ]; then
+                LogText "Result: file ${f} permissions/ownership OK"
+                Display --indent 4 --text "- Permissions for: ${f}" --result "${STATUS_OK}" --color GREEN
+            else
+                LogText "Result: file has possibly unsafe permissions/ownership"
+                Display --indent 4 --text "- Permissions for: ${f}" --result "${STATUS_WARNING}" --color RED
+            fi
+        done
     fi
 #
 #################################################################################

From ab9a53169b369d66898380c013e9d2f771578123 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 28 Feb 2019 10:20:26 +0100
Subject: [PATCH 003/679] Updated log

---
 CHANGELOG.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a0da6223..8cdae27c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,8 +5,13 @@
 ### Added
 - Support for end-of-life detection of the operating system
 
----------------------------------------------------------------------------------
+### Changed
+- RPi/Raspian path to PAM_FILE_LOCATIONS
+- AUTH-9252 - Adds support for files in sudoers.d
+- AUTH-9252 - Test extended to check file and directory ownership
+- NETW-2704Ignore inline comments in /etc/resolv.conf
 
+---------------------------------------------------------------------------------
 
 ## Lynis 2.7.1 (2019-01-30)
 

From e0b93ed0cc5ed00d7fb76a55c9f0dd1b31a3ac2e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 4 Mar 2019 12:08:47 +0100
Subject: [PATCH 004/679] Replace awk statement with grep to simplify search

---
 include/osdetection | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/osdetection b/include/osdetection
index 959d3a9e..83ba2312 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -515,7 +515,8 @@
     if [ ! -z "${OS_VERSION}" ]; then
         if [ -f "${DBDIR}/software-eol.db" ]; then
             FIND="${OS_FULLNAME}"
-            EOL_DATE=$(awk -v value="${FIND}" -F: '{if ($1=="os" && $2 ~ value){print $3}}' ${DBDIR}/software-eol.db | head -n 1)
+            # Does not work on FreeBSD: EOL_DATE=$(awk -v value="${FIND}" -F: '{if ($1=="os" && $2 ~ value){print $3}}' ${DBDIR}/software-eol.db | head -n 1)
+            EOL_DATE=$(grep "os:${FIND}" ${DBDIR}/software-eol.db | awk -F: '{print $3}' | head -n 1)
             if [ ! -z "${EOL_DATE}" ]; then
                 NOW=$(date "+%s")
                 FIND=$(date "+%s" --date=${EOL_DATE})

From 9d8b12e0f8683d5a0c93dd0aac845241e464119e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 4 Mar 2019 12:13:47 +0100
Subject: [PATCH 005/679] Initial lookup with awk corrected

---
 include/osdetection | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/osdetection b/include/osdetection
index 83ba2312..ef105eba 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -515,8 +515,8 @@
     if [ ! -z "${OS_VERSION}" ]; then
         if [ -f "${DBDIR}/software-eol.db" ]; then
             FIND="${OS_FULLNAME}"
-            # Does not work on FreeBSD: EOL_DATE=$(awk -v value="${FIND}" -F: '{if ($1=="os" && $2 ~ value){print $3}}' ${DBDIR}/software-eol.db | head -n 1)
-            EOL_DATE=$(grep "os:${FIND}" ${DBDIR}/software-eol.db | awk -F: '{print $3}' | head -n 1)
+            EOL_DATE=$(awk -v value="${FIND}" -F: '{if ($1=="os" && value ~ $2){print $3}}' ${DBDIR}/software-eol.db | head -n 1)
+            #EOL_DATE=$(grep "os:${FIND}" ${DBDIR}/software-eol.db | awk -F: '{print $3}' | head -n 1)
             if [ ! -z "${EOL_DATE}" ]; then
                 NOW=$(date "+%s")
                 FIND=$(date "+%s" --date=${EOL_DATE})

From f7a291a62f2e4747eb7624f06a0c34581cfb9f3f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 4 Mar 2019 12:33:03 +0100
Subject: [PATCH 006/679] Use datestamps instead of date, due to compatibility
 with other platforms

---
 db/software-eol.db  | 48 +++++++++++++++++++++++++++------------------
 include/osdetection |  8 +++-----
 2 files changed, 32 insertions(+), 24 deletions(-)

diff --git a/db/software-eol.db b/db/software-eol.db
index 9bf96c12..56b3cb76 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -1,22 +1,32 @@
+#
 # End-of-life for operating systems and software
+#
+# This file has 4 fields:
+# 1) category
+# 2) name
+# 3) date (human-readable)
+# 4) converted date (seconds since epoch)
+#
+# Date can be converted on Linux using: date "+%s" --date=2020-01-01
+#
 # FreeBSD - https://www.freebsd.org/releases/
-os:FreeBSD 9.3:2014-07-01:
-os:FreeBSD 10.0:2014-01-01:
-os:FreeBSD 10.1:2014-11-01:
-os:FreeBSD 10.2:2015-08-01:
-os:FreeBSD 10.3:2016-04-01:
-os:FreeBSD 10.4:2017-10-01:
-os:FreeBSD 11.0:2016-10-01:
-os:FreeBSD 11.1:2017-07-01:
+os:FreeBSD 9.3:2014-07-01:1404165600:
+os:FreeBSD 10.0:2014-01-01:1388530800:
+os:FreeBSD 10.1:2014-11-01:0:
+os:FreeBSD 10.2:2015-08-01:0:
+os:FreeBSD 10.3:2016-04-01:0:
+os:FreeBSD 10.4:2017-10-01:0:
+os:FreeBSD 11.0:2016-10-01:0:
+os:FreeBSD 11.1:2017-07-01:0:
 # Ubuntu - https://wiki.ubuntu.com/Kernel/LTSEnablementStack
-os:Ubuntu 14.04:2019-05-01:
-os:Ubuntu 14.10:2015-07-01:
-os:Ubuntu 15.04:2016-01-01:
-os:Ubuntu 15.10:2016-07-01:
-os:Ubuntu 16.04:2021-05-01:
-os:Ubuntu 16.10:2017-07-01:
-os:Ubuntu 17.04:2018-01-01:
-os:Ubuntu 17.10:2018-07-01:
-os:Ubuntu 18.04:2023-05-01:
-os:Ubuntu 18.10:2019-07-01:
-os:Ubuntu 19.04:2020-01-01:
\ No newline at end of file
+os:Ubuntu 14.04:2019-05-01:0:
+os:Ubuntu 14.10:2015-07-01:0:
+os:Ubuntu 15.04:2016-01-01:0:
+os:Ubuntu 15.10:2016-07-01:0:
+os:Ubuntu 16.04:2021-05-01:0:
+os:Ubuntu 16.10:2017-07-01:0:
+os:Ubuntu 17.04:2018-01-01:0:
+os:Ubuntu 17.10:2018-07-01:0:
+os:Ubuntu 18.04:2023-05-01:1682892000:
+os:Ubuntu 18.10:2019-07-01:1561932000:
+os:Ubuntu 19.04:2020-01-01:1577833200:
\ No newline at end of file
diff --git a/include/osdetection b/include/osdetection
index ef105eba..069167bb 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -515,13 +515,11 @@
     if [ ! -z "${OS_VERSION}" ]; then
         if [ -f "${DBDIR}/software-eol.db" ]; then
             FIND="${OS_FULLNAME}"
-            EOL_DATE=$(awk -v value="${FIND}" -F: '{if ($1=="os" && value ~ $2){print $3}}' ${DBDIR}/software-eol.db | head -n 1)
-            #EOL_DATE=$(grep "os:${FIND}" ${DBDIR}/software-eol.db | awk -F: '{print $3}' | head -n 1)
+            EOL_DATE=$(awk -v value="${FIND}" -F: '{if ($1=="os" && value ~ $2){print $4}}' ${DBDIR}/software-eol.db | head -n 1)
             if [ ! -z "${EOL_DATE}" ]; then
                 NOW=$(date "+%s")
-                FIND=$(date "+%s" --date=${EOL_DATE})
-                if [ ! -z "${FIND}" ]; then
-                    if [ ${NOW} -gt ${FIND} ]; then
+                if [ ! -z "${NOW}" ]; then
+                    if [ ${NOW} -gt ${EOL_DATE} ]; then
                         EOL=1
                     else
                         EOL=0

From ff6446a5bceb0229bc4a6d81586a935103327f93 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 4 Mar 2019 12:33:25 +0100
Subject: [PATCH 007/679] Added 'show eol' command

---
 include/helper_show | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/include/helper_show b/include/helper_show
index cb154c68..6e0738e6 100644
--- a/include/helper_show
+++ b/include/helper_show
@@ -32,13 +32,14 @@ COMMANDS="audit configure show update upload-only"
 HELPERS="audit configure show update"
 OPTIONS="--auditor\n--cronjob (--cron)\n--debug\n--developer\n--help (-h)\n--license-key\n--log-file\n--manpage (--man)\n--no-colors\n--no-log\n--pentest\n--profile\n--plugin-dir\n--quick (-Q)\n--quiet (-q)\n--report-file\n--reverse-colors\n--skip-plugins\n--tests\n--tests-from-category\n--tests-from-group\n--upload\n--verbose\n--version (-V)\n--wait\n--warnings-only"
 
-SHOW_ARGS="categories changelog commands dbdir details environment groups help hostids includedir language license logfile man options os pidfile plugindir profiles release releasedate report settings tests version workdir"
+SHOW_ARGS="categories changelog commands dbdir details environment eol groups help hostids includedir language license logfile man options os pidfile plugindir profiles release releasedate report settings tests version workdir"
 SHOW_HELP="lynis show ${BROWN}categories${NORMAL}              (display test categories)
 lynis show ${BROWN}changelog${NORMAL} ${GRAY}[version]${NORMAL}     (release details)
 lynis show ${BROWN}commands${NORMAL}                (all available commands)
 lynis show ${BROWN}dbdir${NORMAL}                   (database directory)
 lynis show ${BROWN}details${NORMAL}                 (display test details from log file)
 lynis show ${BROWN}environment${NORMAL}             (hardware, virtual machine, or container type)
+lynis show ${BROWN}eol${NORMAL}                     (OS end-of-life status)
 lynis show ${BROWN}groups${NORMAL}                  (test groups)
 lynis show ${BROWN}help${NORMAL}                    (detailed information about arguments)
 lynis show ${BROWN}hostids${NORMAL}                 (unique IDs for this system)
@@ -242,6 +243,17 @@ if [ $# -gt 0 ]; then
                 ${ECHOCMD} "virtual-machine=0"
             fi
             ;;
+        "eol")
+            if [ ${EOL} -eq 0 ]; then
+                ${ECHOCMD} "OS end-of-life: No"
+            elif [ ${EOL} -eq 1 ]; then
+                ${ECHOCMD} "OS end-of-life: Yes"
+            elif [ ${EOL} -eq 255 ]; then
+                ${ECHOCMD} "OS end-of-life: Not tested"
+            else
+                ${ECHOCMD} "OS end-of-life: Unknown"
+            fi
+            ;;
         "groups")
             ViewGroups
             ;;

From 1214c2436346163796086330b4522371bb9af2b0 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 4 Mar 2019 12:33:50 +0100
Subject: [PATCH 008/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8cdae27c..da4e6fd9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 ### Added
 - Support for end-of-life detection of the operating system
+- New 'lynis show eol' command
 
 ### Changed
 - RPi/Raspian path to PAM_FILE_LOCATIONS

From 19f38bc1eff7dee22fef8854c944d61d6c0dd90c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 4 Mar 2019 13:40:40 +0100
Subject: [PATCH 009/679] Updated entries

---
 db/software-eol.db | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/db/software-eol.db b/db/software-eol.db
index 56b3cb76..d50471df 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -19,14 +19,14 @@ os:FreeBSD 10.4:2017-10-01:0:
 os:FreeBSD 11.0:2016-10-01:0:
 os:FreeBSD 11.1:2017-07-01:0:
 # Ubuntu - https://wiki.ubuntu.com/Kernel/LTSEnablementStack
-os:Ubuntu 14.04:2019-05-01:0:
+os:Ubuntu 14.04:2019-05-01:1556661600:
 os:Ubuntu 14.10:2015-07-01:0:
 os:Ubuntu 15.04:2016-01-01:0:
 os:Ubuntu 15.10:2016-07-01:0:
-os:Ubuntu 16.04:2021-05-01:0:
+os:Ubuntu 16.04:2021-05-01:1619820000:
 os:Ubuntu 16.10:2017-07-01:0:
-os:Ubuntu 17.04:2018-01-01:0:
-os:Ubuntu 17.10:2018-07-01:0:
+os:Ubuntu 17.04:2018-01-01:1514761200:
+os:Ubuntu 17.10:2018-07-01:1530396000:
 os:Ubuntu 18.04:2023-05-01:1682892000:
 os:Ubuntu 18.10:2019-07-01:1561932000:
 os:Ubuntu 19.04:2020-01-01:1577833200:
\ No newline at end of file

From 06bf77cb3052c7417b6fe44e70428b36da68c031 Mon Sep 17 00:00:00 2001
From: chr0mag <phillips.julian@gmail.com>
Date: Tue, 5 Mar 2019 09:57:58 -0800
Subject: [PATCH 010/679] [FIRE-4540] Modify test to better measure rules
 (#636)

This test was previously measuring the number of bytes (wc -c)
in the exported JSON which is likely not what was intended and
will lead to false positives anytime the number of bytes exceeds
16.

The export feature is poorly documented and requires the jansson
package on the target system to export as JSON - which may not
always be the case.

Lastly, 16 is an arbitrary and uncessarily high number. A simple
workstation firewall can have only 3 rules and be effective.

This commit makes use of 'nft list ruleset' instead of the export
command, strips out blank lines as well as table & chain headers
before measuring the number of lines in the output. Any result
with more than 3 rules is now considered non-empty. This is more
consistent with the equivalent iptables test case.
---
 include/tests_firewalls | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/tests_firewalls b/include/tests_firewalls
index d794b3f4..85f2b150 100644
--- a/include/tests_firewalls
+++ b/include/tests_firewalls
@@ -506,13 +506,13 @@
     # Test        : FIRE-4540
     # Description : Check nftables configuration
     if HasData "${NFTBINARY}"; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no FIRE-4540 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for empty nftables configuration"
+    Register --test-no FIRE-4540 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --root-only YES --category security --description "Check for empty nftables configuration"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check for empty ruleset
-        NFT_RULES_LENGTH=$(${NFTBINARY} export json 2> /dev/null | wc -c)
-        if [ ${NFT_RULES_LENGTH} -le 16 ]; then
+        NFT_RULES_LENGTH=$(${NFTBINARY} list ruleset --stateless 2> /dev/null | ${EGREPBINARY} -v "table|chain|;$|}$|^$" | ${WCBINARY} -l)
+        if [ ${NFT_RULES_LENGTH} -le 3 ]; then
             FIREWALL_EMPTY_RULESET=1
-            LogText "Result: this firewall set has 16 rules or less and is considered to be empty"
+            LogText "Result: this firewall set has 3 rules or less and is considered to be empty"
         else
             LogText "Result: found ${NFT_RULES_LENGTH} rules in nftables configuration"
         fi

From 0dafe4a02b494e0c94c3d1b89e9e9791e2fde63d Mon Sep 17 00:00:00 2001
From: jirib <46245+jirib@users.noreply.github.com>
Date: Tue, 5 Mar 2019 19:03:44 +0100
Subject: [PATCH 011/679] better OpenBSD support (#641)

---
 db/tests.db                  |   4 ++
 include/binaries             |   3 +
 include/tests_authentication |  44 +++++++++++++
 include/tests_boot_services  | 116 ++++++++++++++++++++++++++++++++++-
 include/tests_hardening      |   2 +-
 include/tests_php            |   6 ++
 6 files changed, 173 insertions(+), 2 deletions(-)

diff --git a/db/tests.db b/db/tests.db
index cfc6b287..fae4a41b 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -45,6 +45,8 @@ AUTH-9340:test:security:authentication:Solaris:Solaris account locking:
 AUTH-9402:test:security:authentication::Query LDAP authentication support:
 AUTH-9406:test:security:authentication::Query LDAP servers in client configuration:
 AUTH-9408:test:security:authentication::Logging of failed login attempts via /etc/login.defs:
+AUTH-9409:test:security:authentication:OpenBSD:Check for doas file:
+AUTH-9410:test:security:authentication:OpenBSD:Check for doas file permissions:
 AUTH-9489:test:security:authentication:DragonFly:Check login shells for passwordless accounts:
 BANN-7113:test:security:banners:FreeBSD:Check COPYRIGHT banner file:
 BANN-7124:test:security:banners::Check issue banner file:
@@ -71,6 +73,8 @@ BOOT-5184:test:security:boot_services:Linux:Check permissions for boot files/scr
 BOOT-5202:test:security:boot_services::Check uptime of system:
 BOOT-5260:test:security:boot_services::Check single user mode for systemd:
 BOOT-5261:test:security:boot_services:DragonFly:Check for DragonFly boot loader presence:
+BOOT-5262:test:security:boot_services:OpenBSD:Check for OpenBSD boot daemons:
+BOOT-5263:test:security:boot_services:OpenBSD:Check permissions for boot files/scripts:
 CONT-8004:test:security:containers:Solaris:Query running Solaris zones:
 CONT-8102:test:security:containers::Checking Docker status and information:
 CONT-8104:test:security:containers::Checking Docker info for any warnings:
diff --git a/include/binaries b/include/binaries
index 1042aa63..c993899a 100644
--- a/include/binaries
+++ b/include/binaries
@@ -109,9 +109,11 @@
                             base64)                 BASE64BINARY="${BINARY}";          LogText "  Found known binary: base64 (encoding tool) - ${BINARY}" ;;
                             blkid)                  BLKDBINARY="${BINARY}";            LogText "  Found known binary: blkid (information about block devices) - ${BINARY}" ;;
                             cat)                    CAT_BINARY="${BINARY}";            LogText "  Found known binary: cat (generic file handling) - ${BINARY}" ;;
+                            cc)                     CCBINARY="${BINARY}";              COMPILER_INSTALLED=1;  LogText "  Found known binary: cc (compiler) - ${BINARY}" ;;			    
                             chkconfig)              CHKCONFIGBINARY=${BINARY};         LogText "  Found known binary: chkconfig (administration tool) - ${BINARY}" ;;
                             clamconf)               CLAMCONF_BINARY=${BINARY};         LogText "  Found known binary: clamconf (information about ClamAV) - ${BINARY}" ;;
                             clamscan)               CLAMSCANBINARY=${BINARY};          LogText "  Found known binary: clamscan (AV scanner) - ${BINARY}" ;;
+                            clang)                  CLANGBINARY=${BINARY};             COMPILER_INSTALLED=1;  LogText "  Found known binary: clang (compiler) - ${BINARY}" ;;			    
                             cfagent)                CFAGENTBINARY="${BINARY}";         FILE_INT_TOOL_FOUND=1;                 LogText "  Found known binary: cfengine agent (configuration tool) - ${BINARY}" ;;
                             chkrootkit)             CHKROOTKITBINARY="${BINARY}";      MALWARE_SCANNER_INSTALLED=1;           LogText "  Found known binary: chkrootkit (malware scanner) - ${BINARY}" ;;
                             comm)                   COMMBINARY="${BINARY}";            LogText "  Found known binary: comm (file compare) - ${BINARY}" ;;
@@ -194,6 +196,7 @@
                             python)                 PYTHONBINARY="${BINARY}";          PYTHONVERSION=$(${BINARY}  --version 2>&1 | sed 's/^Python //'); LogText "Found known binary: ${FILENAME} (programming language interpreter) - ${BINARY} (version ${PYTHONVERSION})" ;;
                             python2)                PYTHON2BINARY="${BINARY}";         PYTHON2VERSION=$(${BINARY}  --version 2>&1 | sed 's/^Python //'); LogText "Found known binary: ${FILENAME} (programming language interpreter) - ${BINARY} (version ${PYTHON2VERSION})" ;;
                             python3)                PYTHON3BINARY="${BINARY}";         PYTHON3VERSION=$(${BINARY}  --version 2>&1 | sed 's/^Python //'); LogText "Found known binary: ${FILENAME} (programming language interpreter) - ${BINARY} (version ${PYTHON3VERSION})" ;;
+                            rcctl)                  RCCTLBINARY="${BINARY}";           LogText "  Found known binary: rcctl (services and daemons configuration and control) - ${BINARY}" ;;
                             readlink)               READLINKBINARY="${BINARY}";        LogText "  Found known binary: readlink (follows symlinks) - ${BINARY}" ;;
                             rkhunter)               RKHUNTERBINARY="${BINARY}";        MALWARE_SCANNER_INSTALLED=1;           LogText "  Found known binary: rkhunter (malware scanner) - ${BINARY}" ;;
                             rootsh)                 ROOTSHBINARY="${BINARY}";          LogText "  Found known binary: rootsh (wrapper for shells) - ${BINARY}" ;;
diff --git a/include/tests_authentication b/include/tests_authentication
index e0571a49..fe8ece41 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -1389,6 +1389,50 @@
     fi
 #
 #################################################################################
+#
+    # Test        : AUTH-9409
+    # Description : Check for doas file
+    DOAS_FILE=""
+    Register --test-no AUTH-9409 --os OpenBSD --weight L --network NO --category security --description "Checking /etc/doas.conf file"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        FOUND=0
+        LogText "Test: checking presence /etc/doas.conf"
+        if [ -f /etc/doas.conf ]; then
+        DOAS_FILE=/etc/doas.conf
+            FOUND=1
+            LogText "Result: file /etc/doas.conf found"
+        else
+            LogText "Result: file /etc/doas.conf not found"
+        fi
+        if [ ${FOUND} -eq 1 ]; then
+            LogText "Result: /etc/doas.conf file found"
+            Display --indent 2 --text "- doas file" --result "${STATUS_FOUND}" --color GREEN
+        else
+            LogText "Result: doas file NOT found"
+            Display --indent 2 --text "- doas file" --result "${STATUS_NOT_FOUND}" --color YELLOW
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : AUTH-9410
+    # Description : Check for doas file permissions
+    if [ ! -z "${DOAS_FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no AUTH-9410 --os OpenBSD --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check /etc/doas.conf file permissions"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking /etc/doas.conf permissions"
+        FIND=$(ls -l ${DOAS_FILE} | ${CUTBINARY} -c 2-10)
+        LogText "Result: Found /etc/doas.conf file permissions: ${FIND}"
+        if [ "${FIND}" = "rw-------" -o "${FIND}" = "rw-rw----" -o "${FIND}" = "r--r-----" ]; then
+            LogText "Result: file /etc/doas.conf has correct permissions"
+            Display --indent 4 --text "- Check doas file permissions" --result "${STATUS_OK}" --color GREEN
+        else
+            LogText "Result: file has possibly unsafe file permissions"
+            Display --indent 4 --text "- Check doas file permissions" --result "${STATUS_WARNING}" --color RED
+        fi
+    fi
+#
+#################################################################################
 #
 
 Report "auth_failed_logins_logged=${AUTH_FAILED_LOGINS_LOGGED}"
diff --git a/include/tests_boot_services b/include/tests_boot_services
index 325407b3..84680efc 100644
--- a/include/tests_boot_services
+++ b/include/tests_boot_services
@@ -125,7 +125,7 @@
                     if [ -f /usr/bin/init-openrc ]; then SERVICE_MANAGER="openrc"; fi
                 fi
             ;;
-            "DragonFly" | "NetBSD" | "FreeBSD")
+            "DragonFly" | "NetBSD" | "FreeBSD" | "OpenBSD")
                 if [ -x /sbin/init -a -d ${ROOTDIR}etc/rc.d -a -f ${ROOTDIR}etc/rc ]; then
                     SERVICE_MANAGER="bsdrc"
                 fi
@@ -823,6 +823,120 @@
     fi
 #
 #################################################################################
+#
+    # Test        : BOOT-5262
+    # Description : Check for OpenBSD boot daemons
+    Register --test-no BOOT-5262 --os OpenBSD --weight L --network NO --category security --description "Check for OpenBSD boot daemons"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        if HasData "${RCCTLBINARY}"; then
+            LogText "Result: rcctl binary found, trying that to discover information"
+            # OpenBSD (Ask rcctl(8) for running daemons)
+            LogText "Searching for running daemons (rcctl)"
+            FIND=$(${RCCTLBINARY} ls started)
+            COUNT=0
+            Report "running_service_tool=rcctl"
+            for ITEM in ${FIND}; do
+                LogText "Found running daemon: ${ITEM}"
+                Report "running_service[]=${ITEM}"
+                COUNT=$((COUNT + 1 ))
+            done
+            LogText "Note: Run rcctl ls all | egrep  '^(pf|check_quotas|library_aslr)$' to see all daemons"
+            Display --indent 2 --text "- Check running daemons (rcctl)" --result "${STATUS_DONE}" --color GREEN
+            Display --indent 8 --text "Result: found ${COUNT} running daemons"
+            LogText "Result: Found ${COUNT} running daemons"
+
+            # OpenBSD (Ask rcctl(8) for enabled daemons)
+            LogText "Searching for enabled daemons (rcctl)"
+            FIND=$(${RCCTLBINARY} ls on | ${EGREPBINARY} -v '^(pf|check_quotas|library_aslr)$')
+            COUNT=0
+            Report "boot_service_tool=rcctl"
+            for ITEM in ${FIND}; do
+                LogText "Found enabled daemon at boot: ${ITEM}"
+                Report "boot_service[]=${ITEM}"
+                COUNT=$((COUNT + 1 ))
+            done
+            LogText "Note: Run rcctl ls all | egrep  '^(pf|check_quotas|library_aslr)$' to see all daemons"
+            Display --indent 2 --text "- Check enabled daemons at boot (rcctl)" --result "${STATUS_DONE}" --color GREEN
+            Display --indent 8 --text "Result: found ${COUNT} enabled daemons at boot"
+            LogText "Result: Found ${COUNT} enabled daemons at boot"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : BOOT-5263
+    # Description : Check OpenBSD world writable startup scripts
+    Register --test-no BOOT-5263 --os OpenBSD --weight L --network NO --category security --description "Check permissions for boot files/scripts"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        FOUND=0
+        CHECKDIR="${ROOTDIR}etc/rc.d"
+        LogText "Result: checking ${ROOTDIR}etc/rc.d scripts for writable bit"
+        LogText "Test: checking if directory ${DIR} exists"
+        if [ -d ${CHECKDIR} ]; then
+            LogText "Result: directory ${DIR} found"
+            LogText "Test: checking for available files in directory"
+            # OpenBSD uses symlinks to create another instance of daemons
+            FIND=$(${FINDBINARY} ${CHECKDIR} \( -type f -o -type l \) -print | ${SORTBINARY})
+            if [ ! -z "${FIND}" ]; then
+                LogText "Result: found files in directory, checking permissions now"
+                for FILE in ${FIND}; do
+                    LogText "Test: checking permissions of file ${FILE}"
+                    ShowSymlinkPath "${FILE}"
+                    if [ ${FOUNDPATH} -eq 1 ]; then
+                        CHECKFILE="${SYMLINK}"
+                        LogText "Result: found the path behind this symlink (${CHECKFILE} --> ${FILE})"
+                    else
+                        CHECKFILE="${FILE}"
+                    fi
+                    if IsWorldWritable ${CHECKFILE}; then
+                        FOUND=1
+                        LogText "Result: warning, file ${CHECKFILE} is world writable"
+                    else
+                        LogText "Result: good, file ${CHECKFILE} not world writable"
+                    fi
+                done
+            else
+                LogText "Result: found no files in directory."
+            fi
+        else
+            LogText "Result: directory ${CHECKDIR} not found. Skipping.."
+        fi
+
+        # Other files
+        CHECKFILES="${ROOTDIR}etc/rc ${ROOT}etc/rc.conf ${ROOT}etc/rc.conf.local ${ROOTDIR}etc/rc.local"
+        for I in ${CHECKFILES}; do
+            if [ -f ${I} ]; then
+                ShowSymlinkPath "${I}"
+                if [ ${FOUNDPATH} -eq 1 ]; then
+                    CHECKFILE="${SYMLINK}"
+                    LogText "Result: found the path behind this symlink (${CHECKFILE} --> ${I})"
+                else
+                    CHECKFILE="${I}"
+                fi
+                LogText "Test: Checking ${CHECKFILE} file for writable bit"
+                if IsWorldWritable ${CHECKFILE}; then
+                    FOUND=1
+                    ReportWarning ${TEST_NO} "Found writable startup script ${CHECKFILE}"
+                    LogText "Result: warning, file ${CHECKFILE} is world writable"
+                else
+                    LogText "Result: good, file ${CHECKFILE} not world writable"
+                fi
+            fi
+        done
+
+        # Check results
+        if [ ${FOUND} -eq 1 ]; then
+            Display --indent 2 --text "- Check startup files (permissions)" --result "${STATUS_WARNING}" --color RED
+            ReportWarning ${TEST_NO} "Found world writable startup scripts" "-" "-"
+            LogText "Result: found one or more scripts which are possibly writable by other users"
+            AddHP 0 3
+        else
+            Display --indent 2 --text "- Check startup files (permissions)" --result "${STATUS_OK}" --color GREEN
+            AddHP 3 3
+        fi
+    fi
+#
+#################################################################################
 #
 
 Report "boot_loader=${BOOT_LOADER}"
diff --git a/include/tests_hardening b/include/tests_hardening
index 8945f9a3..0719cf8e 100644
--- a/include/tests_hardening
+++ b/include/tests_hardening
@@ -54,7 +54,7 @@
             LogText "Result: no compilers found"
         else
             # TODO - c89 c99 cpp ld
-            TEST_BINARIES="${ASBINARY} ${GCCBINARY}"
+            TEST_BINARIES="${ASBINARY} ${CCBINARY} ${CLANGBINARY} ${GCCBINARY}"
             for ITEM in ${TEST_BINARIES}; do
                 FILE="${ITEM}"
                 LogText "Test: Check file permissions for ${ITEM}"
diff --git a/include/tests_php b/include/tests_php
index 795ce253..363321cf 100644
--- a/include/tests_php
+++ b/include/tests_php
@@ -72,6 +72,9 @@
                 ${ROOTDIR}etc/opt/remi/php70/php.ini \
                 ${ROOTDIR}etc/opt/remi/php71/php.ini \
                 ${ROOTDIR}etc/opt/remi/php72/php.ini"
+    # HEADS-UP: OpenBSD, last two releases are supported, and snapshots of -current
+    PHPINILOCS="${PHPINILOCS} \
+                ${ROOTDIR}etc/php-5.6.ini ${ROOTDIR}etc/php-7.0.ini ${ROOTDIR}etc/php-7.1.ini ${ROOTDIR}etc/php-7.2.ini"
 
     PHPINIDIRS="${ROOTDIR}etc/php5/conf.d \
                 ${ROOTDIR}etc/php/7.0/cli/conf.d \
@@ -92,6 +95,9 @@
                 ${ROOTDIR}opt/alt/php56/etc/php.d.all \
                 ${ROOTDIR}opt/alt/php70/etc/php.d.all \
                 ${ROOTDIR}opt/alt/php71/etc/php.d.all"
+    # HEADS-UP: OpenBSD, last two releases are supported, and snapshots of -current
+    PHPINIDIRS="${PHPINIDIRS} \
+                ${ROOTDIR}etc/php-5.6 ${ROOTDIR}etc/php-7.0 ${ROOTDIR}etc/php-7.1 ${ROOTDIR}etc/php-7.2"
 #
 #################################################################################
 #

From 9b5ef7c80f683bf3cc3c4adfa0fd021df3c03335 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 5 Mar 2019 19:30:53 +0100
Subject: [PATCH 012/679] Updated log

---
 CHANGELOG.md | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index da4e6fd9..bd58385c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,14 +3,20 @@
 ## Lynis 2.7.2 (not released yet)
 
 ### Added
+- AUTH-9409 - Support for doas (OpenBSD)
+- AUTH-9410 - Test file permissions of doas configuration
+- BOOT-5262 - Check OpenBSD boot daemons
+- BOOT-5263 - Test permissions for boot files and scripts
 - Support for end-of-life detection of the operating system
 - New 'lynis show eol' command
 
 ### Changed
-- RPi/Raspian path to PAM_FILE_LOCATIONS
 - AUTH-9252 - Adds support for files in sudoers.d
 - AUTH-9252 - Test extended to check file and directory ownership
+- FIRE-4540 - Modify test to better measure rules
 - NETW-2704Ignore inline comments in /etc/resolv.conf
+- RPi/Raspian path to PAM_FILE_LOCATIONS
+
 
 ---------------------------------------------------------------------------------
 

From 32fc4a01b0fc9ebfdf23b7d08bee85dc4f57c1bf Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 5 Mar 2019 19:31:11 +0100
Subject: [PATCH 013/679] Corrected FreeBSD, added CentOS and OpenBSD

---
 db/software-eol.db | 34 ++++++++++++++++++++++++----------
 1 file changed, 24 insertions(+), 10 deletions(-)

diff --git a/db/software-eol.db b/db/software-eol.db
index d50471df..39edb2da 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -9,22 +9,36 @@
 #
 # Date can be converted on Linux using: date "+%s" --date=2020-01-01
 #
-# FreeBSD - https://www.freebsd.org/releases/
-os:FreeBSD 9.3:2014-07-01:1404165600:
-os:FreeBSD 10.0:2014-01-01:1388530800:
-os:FreeBSD 10.1:2014-11-01:0:
-os:FreeBSD 10.2:2015-08-01:0:
-os:FreeBSD 10.3:2016-04-01:0:
-os:FreeBSD 10.4:2017-10-01:0:
-os:FreeBSD 11.0:2016-10-01:0:
-os:FreeBSD 11.1:2017-07-01:0:
+# CentOS
+#
+os:CentOS 5:2017-03-31:1490911200:
+os:CentOS 6:2020-11-30:1606690800:
+os:CentOS 7:2024-06-30:1719698400:
+#
+# FreeBSD - https://www.freebsd.org/security/unsupported.html
+#
+os:FreeBSD 9.3:2014-12-31:0:
+os:FreeBSD 10.0:2015-02-28:0:
+os:FreeBSD 10.1:2016-12-31:0:
+os:FreeBSD 10.2:2016-12-31:0:
+os:FreeBSD 10.3:2018-04-30:0:
+os:FreeBSD 10.4:2018-10-31:0:
+os:FreeBSD 11.0:2017-11-30:0:
+os:FreeBSD 11.1:2018-09-30:0:
+#
+# OpenBSD - https://en.wikipedia.org/wiki/OpenBSD_version_history
+#
+os:OpenBSD 5.8:2016-09-01:0:
+os:OpenBSD 5.9:2017-04-11:0:
+#
 # Ubuntu - https://wiki.ubuntu.com/Kernel/LTSEnablementStack
+#
 os:Ubuntu 14.04:2019-05-01:1556661600:
 os:Ubuntu 14.10:2015-07-01:0:
 os:Ubuntu 15.04:2016-01-01:0:
 os:Ubuntu 15.10:2016-07-01:0:
 os:Ubuntu 16.04:2021-05-01:1619820000:
-os:Ubuntu 16.10:2017-07-01:0:
+os:Ubuntu 16.10:2017-07-01:1498860000:
 os:Ubuntu 17.04:2018-01-01:1514761200:
 os:Ubuntu 17.10:2018-07-01:1530396000:
 os:Ubuntu 18.04:2023-05-01:1682892000:

From 8888b01dcd5cb93fa3d4d15d79a568d57841ffbc Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 5 Mar 2019 19:31:36 +0100
Subject: [PATCH 014/679] Store date and timestamp for EOL

---
 include/osdetection | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/include/osdetection b/include/osdetection
index 069167bb..5ab80293 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -512,14 +512,16 @@
     # Check if this OS is end-of-life
     EOL=255
     EOL_DATE=""
+    EOL_TIMESTAMP=0
     if [ ! -z "${OS_VERSION}" ]; then
         if [ -f "${DBDIR}/software-eol.db" ]; then
             FIND="${OS_FULLNAME}"
-            EOL_DATE=$(awk -v value="${FIND}" -F: '{if ($1=="os" && value ~ $2){print $4}}' ${DBDIR}/software-eol.db | head -n 1)
-            if [ ! -z "${EOL_DATE}" ]; then
+            EOL_TIMESTAMP=$(awk -v value="${FIND}" -F: '{if ($1=="os" && value ~ $2){print $4}}' ${DBDIR}/software-eol.db | head -n 1)
+            if [ ! -z "${EOL_TIMESTAMP}" ]; then
+                EOL_DATE=$(awk -v value="${FIND}" -F: '{if ($1=="os" && value ~ $2){print $3}}' ${DBDIR}/software-eol.db | head -n 1)
                 NOW=$(date "+%s")
                 if [ ! -z "${NOW}" ]; then
-                    if [ ${NOW} -gt ${EOL_DATE} ]; then
+                    if [ ${NOW} -gt ${EOL_TIMESTAMP} ]; then
                         EOL=1
                     else
                         EOL=0

From 89bf6074988b70cac8e3a63b0110b9540700d863 Mon Sep 17 00:00:00 2001
From: Jerry Park <jaehwa@gmail.com>
Date: Thu, 7 Mar 2019 18:01:02 +0900
Subject: [PATCH 015/679] Added Korean translation (#652)

* Korean translation for ko-KR

Translation in Korean

* changed ko-KR to ko
---
 db/languages/ko | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 db/languages/ko

diff --git a/db/languages/ko b/db/languages/ko
new file mode 100644
index 00000000..df13cf7f
--- /dev/null
+++ b/db/languages/ko
@@ -0,0 +1,40 @@
+ERROR_NO_LICENSE="라이선스 키가 없습니다"
+ERROR_NO_UPLOAD_SERVER="업로드 서버가 설정되지 않았습니다"
+GEN_CHECKING="확인중입니다"
+GEN_CURRENT_VERSION="현재 버전"
+GEN_DEBUG_MODE="디버그 모드"
+GEN_INITIALIZE_PROGRAM="프로그램을 초기화합니다"
+GEN_LATEST_VERSION="최신 버전"
+GEN_PHASE="phase"
+GEN_PLUGINS_ENABLED="플러그인이 활성화되었습니다"
+GEN_UPDATE_AVAILABLE="업데이트 가능"
+GEN_VERBOSE_MODE="상세 모드"
+GEN_WHAT_TO_DO="할 일"
+NOTE_EXCEPTIONS_FOUND="예외 발견"
+NOTE_EXCEPTIONS_FOUND_DETAILED="몇 가지 예외 이벤트나 정보가 발견되었습니다"
+NOTE_PLUGINS_TAKE_TIME="참고: 플러그인은 광범위한 테스트를 거치며 완료될 때까지 몇 분의 시간이 소요됩니다"
+NOTE_SKIPPED_TESTS_NON_PRIVILEGED="비특권 모드로 인해 테스트를 생략했습니다"
+SECTION_CUSTOM_TESTS="사용자정의 테스트"
+SECTION_MALWARE="악성코드"
+SECTION_MEMORY_AND_PROCESSES="메모리와 프로세스"
+STATUS_DISABLED="비활성화됨"
+STATUS_DONE="완료"
+STATUS_ENABLED="활성화됨"
+STATUS_ERROR="에러"
+STATUS_FOUND="발견"
+STATUS_YES="예"
+STATUS_NO="아니오"
+STATUS_OFF="끔"
+STATUS_OK="OK"
+STATUS_ON="켬"
+STATUS_NONE="없음"
+STATUS_NOT_FOUND="발견되지않음"
+STATUS_NOT_RUNNING="동작하지않음"
+STATUS_RUNNING="동작중"
+STATUS_SKIPPED="생략"
+STATUS_SUGGESTION="추천"
+STATUS_UNKNOWN="알수없음"
+STATUS_WARNING="경고"
+STATUS_WEAK="취약"
+TEXT_YOU_CAN_HELP_LOGFILE="로그 파일을 제공하면 도움을 받을 수 있습니다"
+TEXT_UPDATE_AVAILABLE="업데이트 가능"

From 17f2e34660b9be19ad671feb783bf957703fa038 Mon Sep 17 00:00:00 2001
From: silentcreek <silentcreek@users.noreply.github.com>
Date: Thu, 7 Mar 2019 10:03:11 +0100
Subject: [PATCH 016/679] [PKGS-7388] Fix false positive warning on missing
 security archive (#651)

Currently the check for the security archive in Debian/Ubuntu fails, if
the archive is not hosted on security.{debian,ubuntu}.org and the URL
does have trailing slash, such as this:
  deb http://deb.debian.org/debian-security/ stretch/updates main

Change the regular expression to allow for a trailing slash in the URL
when filtering the package sources lists.

Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
---
 include/tests_ports_packages | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 9a22e8a4..1426a068 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -993,7 +993,7 @@
         if [ ${OPTION_DEBIAN_SKIP_SECURITY_REPOSITORY} -eq 0 ]; then
             if [ -f ${ROOTDIR}etc/apt/sources.list ]; then
                 LogText "Searching for security.debian.org/security.ubuntu.com or security repositories in /etc/apt/sources.list file"
-                FIND=$(${EGREPBINARY} "security.debian.org|security.ubuntu.com|security " ${ROOTDIR}etc/apt/sources.list | ${GREPBINARY} -v '#' | ${SEDBINARY} 's/ /!space!/g')
+                FIND=$(${EGREPBINARY} "security.debian.org|security.ubuntu.com|security/? " ${ROOTDIR}etc/apt/sources.list | ${GREPBINARY} -v '#' | ${SEDBINARY} 's/ /!space!/g')
                 if [ ! -z "${FIND}" ]; then
                     FOUND=1
                     Display --indent 2 --text "- Checking security repository in sources.list file" --result "${STATUS_OK}" --color GREEN
@@ -1006,7 +1006,7 @@
             fi
             if [ -d /etc/apt/sources.list.d ]; then
                 LogText "Searching for security.debian.org/security.ubuntu.com or security repositories in /etc/apt/sources.list.d directory"
-                FIND=$(${EGREPBINARY} -r "security.debian.org|security.ubuntu.com|security " /etc/apt/sources.list.d | ${GREPBINARY} -v '#' | ${SEDBINARY} 's/ /!space!/g')
+                FIND=$(${EGREPBINARY} -r "security.debian.org|security.ubuntu.com|security/? " /etc/apt/sources.list.d | ${GREPBINARY} -v '#' | ${SEDBINARY} 's/ /!space!/g')
                 if [ ! -z "${FIND}" ]; then
                     FOUND=1
                     Display --indent 2 --text "- Checking security repository in sources.list.d directory" --result "${STATUS_OK}" --color GREEN

From fb567465c9159e9217907776e3132392ad8baeb5 Mon Sep 17 00:00:00 2001
From: silentcreek <silentcreek@users.noreply.github.com>
Date: Thu, 7 Mar 2019 10:05:12 +0100
Subject: [PATCH 017/679] [KRNL-5788] Fix false positive warning on missing
 /vmlinuz (#650)

Not all architectures use a /vmlinuz symlink in Debian. For instance,
armhf systems may only provide a symlink in /boot/vmlinuz. Fall back to
testing /boot/vmlinuz if /vmlinuz is not found.

Signed-off-by: Timo Sigurdsson <public_timo.s@silentcreek.de>
---
 include/tests_kernel | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index 88a3c2fc..62c78800 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -374,10 +374,17 @@
         LogText "Test: Searching apt-cache, to determine if a newer kernel is available"
         if [ -x ${ROOTDIR}usr/bin/apt-cache ]; then
             LogText "Result: found ${ROOTDIR}usr/bin/apt-cache"
-            LogText "Test: checking readlink location of ${ROOTDIR}vmlinuz"
-            if [ -f ${ROOTDIR}vmlinuz ]; then
+            LogText "Test: checking presence of ${ROOTDIR}vmlinuz or ${ROOTDIR}boot/vmlinuz"
+            if [ -f ${ROOTDIR}vmlinuz -o -f ${ROOTDIR}boot/vmlinuz ]; then
                 HAS_VMLINUZ=1
-                FINDKERNFILE=$(readlink -f ${ROOTDIR}vmlinuz)
+                if [ -f ${ROOTDIR}vmlinuz ]; then
+                    FINDVMLINUZ=${ROOTDIR}vmlinuz
+                else
+                    FINDVMLINUZ=${ROOTDIR}boot/vmlinuz
+                fi
+                LogText "Result: found ${FINDVMLINUZ}"
+                LogText "Test: checking readlink location of ${FINDVMLINUZ}"
+                FINDKERNFILE=$(readlink -f ${FINDVMLINUZ})
                 LogText "Output: readlink reported file ${FINDKERNFILE}"
                 LogText "Test: checking package from dpkg -S"
                 FINDKERNEL=$(dpkg -S ${FINDKERNFILE} 2> /dev/null | ${AWKBINARY} -F : '{print $1}')
@@ -386,8 +393,8 @@
                 FINDKERNEL=linux-image-$(uname -r)
                 LogText "Result: ${ROOTDIR}vmlinuz missing due to grsecurity; assuming ${FINDKERNEL}"
             else
-                LogText "This system is missing ${ROOTDIR}vmlinuz.  Unable to check whether kernel is up-to-date."
-                ReportSuggestion ${TEST_NO} "Determine why ${ROOTDIR}vmlinuz is missing on this Debian/Ubuntu system." "/vmlinuz"
+                LogText "This system is missing ${ROOTDIR}vmlinuz or ${ROOTDIR}boot/vmlinuz.  Unable to check whether kernel is up-to-date."
+                ReportSuggestion ${TEST_NO} "Determine why ${ROOTDIR}vmlinuz or ${ROOTDIR}boot/vmlinuz is missing on this Debian/Ubuntu system." "/vmlinuz or /boot/vmlinuz"
             fi
             LogText "Test: Using apt-cache policy to determine if there is an update available"
             FINDINST=$(apt-cache policy ${FINDKERNEL} | ${EGREPBINARY} 'Installed' | ${CUTBINARY} -d ':' -f2 | ${TRBINARY} -d ' ')

From 341612418f004be954b08689b3b640305045c8b1 Mon Sep 17 00:00:00 2001
From: chr0mag <phillips.julian@gmail.com>
Date: Thu, 7 Mar 2019 01:07:52 -0800
Subject: [PATCH 018/679] BOOT-5117 adds systemd-boot bootloader detection
 (#634)

Adds a test to detect systemd-boot. The 'bootctl' binary is also
added as this is the utility used to inspect the systemd-boot
configuration.

This test is only executed if systemd is installed, the bootctl
utility exists and the system is booted in UEFI mode.
---
 include/binaries            |  1 +
 include/tests_boot_services | 17 +++++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/include/binaries b/include/binaries
index c993899a..c2f7a598 100644
--- a/include/binaries
+++ b/include/binaries
@@ -108,6 +108,7 @@
                             autolog)                AUTOLOGBINARY="${BINARY}";         IDLE_SESSION_KILLER_INSTALLED=1;       LogText "  Found known binary: autolog (idle session killer) - ${BINARY}" ;;
                             base64)                 BASE64BINARY="${BINARY}";          LogText "  Found known binary: base64 (encoding tool) - ${BINARY}" ;;
                             blkid)                  BLKDBINARY="${BINARY}";            LogText "  Found known binary: blkid (information about block devices) - ${BINARY}" ;;
+			    bootctl)		    BOOTCTLBINARY="${BINARY}";	       LogText "  Found known binary: bootctl (systemd-boot manager utility) - ${BINARY}" ;;
                             cat)                    CAT_BINARY="${BINARY}";            LogText "  Found known binary: cat (generic file handling) - ${BINARY}" ;;
                             cc)                     CCBINARY="${BINARY}";              COMPILER_INSTALLED=1;  LogText "  Found known binary: cc (compiler) - ${BINARY}" ;;			    
                             chkconfig)              CHKCONFIGBINARY=${BINARY};         LogText "  Found known binary: chkconfig (administration tool) - ${BINARY}" ;;
diff --git a/include/tests_boot_services b/include/tests_boot_services
index 84680efc..2de8d748 100644
--- a/include/tests_boot_services
+++ b/include/tests_boot_services
@@ -239,6 +239,23 @@
     fi
 #
 #################################################################################
+#
+    # Test        : BOOT-5117
+    # Description : Check for systemd-boot boot loader
+    if [ ! "${BOOTCTLBINARY}" = "" -a ${HAS_SYSTEMD} -eq 1 -a ${UEFI_BOOTED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no BOOT-5117 --preqs-met ${PREQS_MET} --os "Linux" --weight L --network NO --category security --description "Check for systemd-boot bootloader presence"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        BOOT_LOADER_SEARCHED=1
+        CURRENT_BOOT_LOADER=$(${BOOTCTLBINARY} status --no-pager 2>/dev/null | ${AWKBINARY} '/Current Boot Loader/{ getline; print $2 }')
+        if [ "${CURRENT_BOOT_LOADER}" = "systemd-boot" ]; then
+	    Display --indent 2 --text "- Checking systemd-boot presence" --result "${STATUS_FOUND}" --color GREEN
+            LogText "Result: found systemd-boot"
+            BOOT_LOADER="systemd-boot"
+            BOOT_LOADER_FOUND=1
+        fi
+    fi
+#
+#################################################################################
 #
     # Test        : BOOT-5121
     # Description : Check for GRUB boot loader

From e33ca1ec58ff64376c8bed968b92f2f30dfee153 Mon Sep 17 00:00:00 2001
From: chr0mag <phillips.julian@gmail.com>
Date: Thu, 7 Mar 2019 01:10:21 -0800
Subject: [PATCH 019/679] [BOOT 5177] Simplify service filter & support
 multiple periods in names (#633)

* Handle service names with multiple periods

The current awk filter produces truncated output if the service
name contains multiple periods.

eg. dbus-org.freedesktop.resolve1.service and
dbus-org.freedesktop.network1.service both appear as 'dbus-org' in
the resulting service list.

This change addresses this by filtering on '.service' instead.

* Simplify systemd service filtering

Added systemctl switches to filter the output based on enabled
or running services. This removes the need for one of the awk
statements.
---
 include/tests_boot_services | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_boot_services b/include/tests_boot_services
index 2de8d748..77d3cb47 100644
--- a/include/tests_boot_services
+++ b/include/tests_boot_services
@@ -564,7 +564,7 @@
             LogText "Result: systemctl binary found, trying that to discover information"
             # Running services
             LogText "Searching for running services (systemctl services only)"
-            FIND=$(${SYSTEMCTLBINARY} --full --type=service | ${AWKBINARY} '{ if ($4=="running") { print $1 } }' | ${AWKBINARY} -F. '{ print $1 }')
+            FIND=$(${SYSTEMCTLBINARY} --no-legend --full --type=service --state=running | ${AWKBINARY} -F.service '{ print $1 }')
             COUNT=0
             Report "running_service_tool=systemctl"
             for ITEM in ${FIND}; do
@@ -579,7 +579,7 @@
 
             # Services at boot
             LogText "Searching for enabled services (systemctl services only)"
-            FIND=$(${SYSTEMCTLBINARY} list-unit-files --type=service | ${SORTBINARY} -u | ${AWKBINARY} '{ if ($2=="enabled") { print $1 } }' | ${AWKBINARY} -F. '{ print $1 }')
+            FIND=$(${SYSTEMCTLBINARY} list-unit-files --no-legend --type=service --state=enabled | ${SORTBINARY} -u | ${AWKBINARY} -F.service '{ print $1 }')
             COUNT=0
             Report "boot_service_tool=systemctl"
             for ITEM in ${FIND}; do

From ec4d89b978a4888747f67b0dd6e91b7db1bbbc2a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 7 Mar 2019 10:15:16 +0100
Subject: [PATCH 020/679] [BOOT-5122] don't use WARNING, but show NONE if no
 protection is implemented

---
 include/tests_boot_services | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_boot_services b/include/tests_boot_services
index 77d3cb47..5495938c 100644
--- a/include/tests_boot_services
+++ b/include/tests_boot_services
@@ -332,7 +332,7 @@
                 LogText "Result: GRUB has password protection."
                 AddHP 4 4
             else
-                Display --indent 4 --text "- Checking for password protection" --result "${STATUS_WARNING}" --color RED
+                Display --indent 4 --text "- Checking for password protection" --result "${STATUS_NONE}" --color RED
                 LogText "Result: Didn't find hashed password line in GRUB boot file!"
                 ReportSuggestion ${TEST_NO} "Set a password on GRUB bootloader to prevent altering boot configuration (e.g. boot in single user mode without password)"
                 AddHP 0 2

From c83f87853fbd69e5dcb0f9e687035af73380e2fb Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 7 Mar 2019 11:01:33 +0100
Subject: [PATCH 021/679] Add new tests

---
 db/tests.db | 1 +
 1 file changed, 1 insertion(+)

diff --git a/db/tests.db b/db/tests.db
index fae4a41b..641ea927 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -58,6 +58,7 @@ BOOT-5104:test:security:boot_services::Determine service manager:
 BOOT-5106:test:security:boot_services:MacOS:Check EFI boot file on macOS:
 BOOT-5108:test:security:boot_services:Linux:Test Syslinux boot loader:
 BOOT-5116:test:security:boot_services::Check if system is booted in UEFI mode:
+BOOT-5117:test:security:boot_services:Linux:Check for systemd-boot boot loader:
 BOOT-5121:test:security:boot_services::Check for GRUB boot loader presence:
 BOOT-5122:test:security:boot_services::Check for GRUB boot password:
 BOOT-5124:test:security:boot_services:FreeBSD:Check for FreeBSD boot loader presence:

From 015447321964162bb9d6f257006c69ef40c532ea Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 7 Mar 2019 11:55:21 +0100
Subject: [PATCH 022/679] Release 2.7.2

---
 CHANGELOG.md | 10 ++++++++--
 lynis        |  6 +++---
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bd58385c..c7027158 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,20 +1,26 @@
 # Lynis Changelog
 
-## Lynis 2.7.2 (not released yet)
+## Lynis 2.7.2 (2019-03-07)
 
 ### Added
 - AUTH-9409 - Support for doas (OpenBSD)
 - AUTH-9410 - Test file permissions of doas configuration
+- BOOT-5117 - Support for systemd-boot boot loader added
+- BOOT-5177 -  Simplify service filter and allow multiple dots in service names
 - BOOT-5262 - Check OpenBSD boot daemons
 - BOOT-5263 - Test permissions for boot files and scripts
 - Support for end-of-life detection of the operating system
 - New 'lynis show eol' command
+- Korean translation
 
 ### Changed
 - AUTH-9252 - Adds support for files in sudoers.d
 - AUTH-9252 - Test extended to check file and directory ownership
+- BOOT-5122 - Use NONE instead of WARNING if no password is set
 - FIRE-4540 - Modify test to better measure rules
-- NETW-2704Ignore inline comments in /etc/resolv.conf
+- KRNL-5788 - Resolve false positive warning on missing /vmlinuz
+- NETW-2704 - Ignore inline comments in /etc/resolv.conf
+- PKGS-7388 - Improve detection for security archive
 - RPi/Raspian path to PAM_FILE_LOCATIONS
 
 
diff --git a/lynis b/lynis
index e2ff0fdf..773caa24 100755
--- a/lynis
+++ b/lynis
@@ -35,9 +35,9 @@
     PROGRAM_AUTHOR_CONTACT="lynis-dev@cisofy.com"
 
     # Version details
-    PROGRAM_RELEASE_DATE="2019-02-26"
-    PROGRAM_RELEASE_TIMESTAMP=1548942179
-    PROGRAM_RELEASE_TYPE="dev" # dev or final
+    PROGRAM_RELEASE_DATE="2019-03-07"
+    PROGRAM_RELEASE_TIMESTAMP=1551949337
+    PROGRAM_RELEASE_TYPE="final" # dev or final
     PROGRAM_VERSION="2.7.2"
 
     # Source, documentation and license

From a4b179e4ef36f80749b49a818d9162643ac4eff0 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 7 Mar 2019 12:11:33 +0100
Subject: [PATCH 023/679] Switch to development for 2.7.3

---
 CHANGELOG.md | 9 ++++++++-
 lynis        | 4 ++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c7027158..651936be 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Lynis Changelog
 
+## Lynis 2.7.3 (not released yet)
+
+### Added
+
+### Changed
+
+---------------------------------------------------------------------------------
+
 ## Lynis 2.7.2 (2019-03-07)
 
 ### Added
@@ -23,7 +31,6 @@
 - PKGS-7388 - Improve detection for security archive
 - RPi/Raspian path to PAM_FILE_LOCATIONS
 
-
 ---------------------------------------------------------------------------------
 
 ## Lynis 2.7.1 (2019-01-30)
diff --git a/lynis b/lynis
index 773caa24..c941b705 100755
--- a/lynis
+++ b/lynis
@@ -37,8 +37,8 @@
     # Version details
     PROGRAM_RELEASE_DATE="2019-03-07"
     PROGRAM_RELEASE_TIMESTAMP=1551949337
-    PROGRAM_RELEASE_TYPE="final" # dev or final
-    PROGRAM_VERSION="2.7.2"
+    PROGRAM_RELEASE_TYPE="dev" # dev or final
+    PROGRAM_VERSION="2.7.3"
 
     # Source, documentation and license
     PROGRAM_SOURCE="https://github.com/CISOfy/lynis"

From 95c11f827044dc8cdb9977a8be356516682b1fc9 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 11 Mar 2019 14:06:17 +0100
Subject: [PATCH 024/679] [KRNL-5820] Changed color for default value - fixes
 GitHub #655

---
 include/tests_kernel | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index 62c78800..f89177ce 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -473,7 +473,7 @@
                 AddHP 0 1
             else
                 LogText "Result: found default option, some programs can dump (not processes which need to change credentials)"
-                Display --indent 4 --text "- Checking setuid core dumps configuration" --result DEFAULT --color YELLOW
+                Display --indent 4 --text "- Checking setuid core dumps configuration" --result DEFAULT --color WHITE
                 AddHP 1 1
             fi
         else

From f828a06bec0e42480982feabf2c9b5087382db51 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 14 Mar 2019 10:45:08 +0100
Subject: [PATCH 025/679] Corrected file location for tips

---
 lynis | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lynis b/lynis
index c941b705..cc874a0c 100755
--- a/lynis
+++ b/lynis
@@ -1035,7 +1035,7 @@ ${NORMAL}
     if [ -f ${INCLUDEDIR}/report ]; then SafePerms ${INCLUDEDIR}/report; . ${INCLUDEDIR}/report; fi
 
     # Show tool tips
-    if [ -f ${INCLUDEDIR}/hints_tips ]; then SafePerms ${INCLUDEDIR}/hints_tips; . ${INCLUDEDIR}/hints_tips; fi
+    if [ -f ${INCLUDEDIR}/tool_tips ]; then SafePerms ${INCLUDEDIR}/tool_tips; . ${INCLUDEDIR}/tool_tips; fi
 
     LogText "================================================================================"
     LogText "Tests performed:     ${CTESTS_PERFORMED}"

From 3cf64ff5a6940f706eb3c6f62f09b0c0fba0f8aa Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 14 Mar 2019 12:30:37 +0100
Subject: [PATCH 026/679] Preparations for user tips to improve usage of tool

---
 include/tool_tips | 38 +++++++++++++++++++++++++++++---------
 1 file changed, 29 insertions(+), 9 deletions(-)

diff --git a/include/tool_tips b/include/tool_tips
index 304e9e28..343a943c 100644
--- a/include/tool_tips
+++ b/include/tool_tips
@@ -26,16 +26,36 @@
     # Only show tips when enabled
     if [ ${SHOW_TOOL_TIPS} -eq 1 ]; then
 
+        # * Regular security auditing
+        #
+        # If package is installed, then suggest users to schedule the audit daily
+        # How: confirm presence of directory /etc/lynis and check cronjobs
+
+
+        # * Check for duplicate items between default and custom profile
+        #
+        # This can be done by marking an item if it overwrites the default profile
+        # with the same value.
+        #
+        # Rationale: default profile should contain have sensible default and
+        # custom profile allows customization for the user or system.
+
+
+        # Suggest usage of plugins if none are enabled
+
+
         # Bash completion support
-        if [ ! "${ETC_PATHS}" = "" ]; then
-            for I in ${ETC_PATHS}; do
-                if [ -d ${I}/bash-completion.d ]; then
-                    if [ ! -f ${ETC_PATHS}/bash_completion.d/lynis ]; then
-                        Display "This system has a bash_completion directory. Copy extras/bash_completion.d/lynis to ${I} to get completion support for Lynis"
-                    fi
-                fi
-            done
-        fi
+        #
+        # Detect if bash is used for active user
+        #if [ ! -z "${ETC_PATHS}" ]; then
+        #    for I in ${ETC_PATHS}; do
+        #        if [ -d ${I}/bash_completion.d ]; then
+        #            if [ ! -f ${ETC_PATHS}/bash_completion.d/lynis ]; then
+        #                Display "This system has a bash_completion directory. Copy extras/bash_completion.d/lynis to ${I} to get completion support for Lynis"
+        #            fi
+        #        fi
+        #    done
+        #fi
     fi
 
 

From 3e7b319ec7f028e51df05642686a7e6ab5a28efa Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 14 Mar 2019 12:31:39 +0100
Subject: [PATCH 027/679] Readability changes and show when plugin execution is
 skipped

---
 include/report | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/include/report b/include/report
index 3439747b..b200f6be 100644
--- a/include/report
+++ b/include/report
@@ -178,7 +178,11 @@
             echo ""
             echo "  ${CYAN}Hardening index${NORMAL} : ${WHITE}${HPINDEX}${NORMAL} ${HPGRAPH}"
             echo "  ${CYAN}Tests performed${NORMAL} : ${WHITE}${CTESTS_PERFORMED}${NORMAL}"
-            if [ ${SKIP_PLUGINS} -eq 0 ]; then echo "  ${CYAN}Plugins enabled${NORMAL} : ${WHITE}${N_PLUGIN_ENABLED}${NORMAL}"; fi
+            if [ ${SKIP_PLUGINS} -eq 0 ]; then
+                echo "  ${CYAN}Plugins enabled${NORMAL} : ${WHITE}${N_PLUGIN_ENABLED}${NORMAL}"
+            else
+                echo "  ${CYAN}Plugins enabled${NORMAL} : ${WHITE}Skipped${NORMAL}"
+            fi
             echo ""
             echo "  ${WHITE}Components${NORMAL}:"
             if [ ${FIREWALL_ACTIVE} -eq 1 ]; then FIREWALL="${GREEN}V"; else FIREWALL="${RED}X"; fi
@@ -191,15 +195,15 @@
             echo "  - Malware scanner        [${MALWARE}${NORMAL}]"
 
             echo ""
-            echo "  ${SECTION}Lynis Modules${NORMAL}:"
+            echo "  ${SECTION}Lynis modules${NORMAL}:"
             if [ ${COMPLIANCE_TESTS_PERFORMED} -eq 1 ]; then
                 if [ ${COMPLIANCE_FINDINGS_FOUND} -eq 0 ]; then COMPLIANCE="${GREEN}V"; else COMPLIANCE="${RED}X"; fi
             else
                 COMPLIANCE="${YELLOW}?"
             fi
-            echo "  - Compliance Status      [${COMPLIANCE}${NORMAL}]"
-            echo "  - Security Audit         [${GREEN}V${NORMAL}]"
-            echo "  - Vulnerability Scan     [${GREEN}V${NORMAL}]"
+            echo "  - Compliance status      [${COMPLIANCE}${NORMAL}]"
+            echo "  - Security audit         [${GREEN}V${NORMAL}]"
+            echo "  - Vulnerability scan     [${GREEN}V${NORMAL}]"
             echo ""
             echo "  ${SECTION}Files${NORMAL}:"
             echo "  - Test and debug information      : ${WHITE}${LOGFILE}${NORMAL}"

From 48195ce2212d2bec8369c837d8feb31ec04b673f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 14 Mar 2019 12:32:19 +0100
Subject: [PATCH 028/679] Initial work to detect Lynis in cronjobs

---
 include/consts           |  1 +
 include/tests_scheduling | 41 ++++++++++++++++++++++++++--------------
 2 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/include/consts b/include/consts
index 5e801e06..671ed1ca 100644
--- a/include/consts
+++ b/include/consts
@@ -139,6 +139,7 @@ unset LANG
     LOGTEXT=1
     LSMODBINARY=""
     LSVGBINARY=""
+    LYNIS_CRONJOB=""
     MACHINEID=""
     MACHINE_ROLE=""
     MALWARE_SCANNER_INSTALLED=0
diff --git a/include/tests_scheduling b/include/tests_scheduling
index 4d188eb6..f0f54b5b 100644
--- a/include/tests_scheduling
+++ b/include/tests_scheduling
@@ -61,6 +61,7 @@
 
         CRONTAB_FILE="${ROOTDIR}etc/crontab"
         if [ -f ${CRONTAB_FILE} ]; then
+            ${EGREPBINARY} -q -s 'lynis audit system' ${CRONTAB_FILE} && LYNIS_CRONJOB="file:/etc/crontab"
             if IsWorldWritable ${CRONTAB_FILE}; then LogText "Result: insecure file permissions for cronjob file ${CRONTAB_FILE}"; Report "insecure_fileperms_cronjob[]=${CRONTAB_FILE}"; BAD_FILE_PERMISSIONS=1; AddHP 0 5; fi
             if ! IsOwnedByRoot ${CRONTAB_FILE}; then LogText "Result: incorrect owner found for cronjob file ${CRONTAB_FILE}"; Report "bad_fileowner_cronjob[]=${CRONTAB_FILE}"; BAD_FILE_OWNERSHIP=1; AddHP 0 5; fi
             FindCronJob ${CRONTAB_FILE}
@@ -85,6 +86,8 @@
                         for FILE in ${FIND}; do
                             if IsWorldWritable ${FILE}; then LogText "Result: insecure file permissions for cronjob file ${J}"; Report "insecure_fileperms_cronjob[]=${J}"; BAD_FILE_PERMISSIONS=1; AddHP 0 5; fi
                             if ! IsOwnedByRoot ${FILE}; then LogText "Result: incorrect owner found for cronjob file ${J}"; Report "bad_fileowner_cronjob[]=${J}"; BAD_FILE_OWNERSHIP=1; AddHP 0 5; fi
+                            FILENAME=$(echo ${FILE} | ${AWKBINARY} -F/ '{print $NF}')
+                            if [ "${FILENAME}" = "lynis" ]; then ${EGREPBINARY} -q -s 'lynis audit system' ${CRONTAB_FILE} && LYNIS_CRONJOB="file:${FILE}"; fi
                             FindCronJob ${FILE}
                             if HasData "${sCRONJOBS}"; then
                                 for K in ${sCRONJOBS}; do
@@ -115,11 +118,13 @@
                         LogText "Result: no files found in ${I}"
                     else
                         LogText "Result: found one or more files in ${I}. Analyzing files.."
-                        for J in ${FIND}; do
-                            if IsWorldWritable ${J}; then LogText "Result: insecure file permissions for cronjob file ${J}"; Report "insecure_fileperms_cronjob[]=${J}"; BAD_FILE_PERMISSIONS=1; AddHP 0 5; fi
-                            if ! IsOwnedByRoot ${J}; then LogText "Result: incorrect owner found for cronjob file ${J}"; Report "bad_fileowner_cronjob[]=${J}"; BAD_FILE_OWNERSHIP=1; AddHP 0 5; fi
-                            LogText "Result: Found cronjob (${I}): ${J}"
-                            Report "cronjob[]=${J}"
+                        for FILE in ${FIND}; do
+                            if IsWorldWritable ${FILE}; then LogText "Result: insecure file permissions for cronjob file ${FILE}"; Report "insecure_fileperms_cronjob[]=${FILE}"; BAD_FILE_PERMISSIONS=1; AddHP 0 5; fi
+                            if ! IsOwnedByRoot ${FILE}; then LogText "Result: incorrect owner found for cronjob file ${FILE}"; Report "bad_fileowner_cronjob[]=${FILE}"; BAD_FILE_OWNERSHIP=1; AddHP 0 5; fi
+                            FILENAME=$(echo ${FILE} | ${AWKBINARY} -F/ '{print $NF}')
+                            if [ "${FILENAME}" = "lynis" ]; then ${EGREPBINARY} -q -s 'lynis audit system' ${CRONTAB_FILE} && LYNIS_CRONJOB="file:${FILE}"; fi
+                            LogText "Result: Found cronjob (${I}): ${FILE}"
+                            Report "cronjob[]=${FILE}"
                         done
                         LogText "Result: done with analyzing files in ${I}"
                     fi
@@ -137,21 +142,23 @@
             FIND=$(${FINDBINARY} /var/spool/cron/crontabs -xdev -type f -print 2> /dev/null)
             for I in ${FIND}; do
                 if FileIsReadable ${I}; then
+                    ${EGREPBINARY} -q -s 'lynis audit system' ${I} && LYNIS_CRONJOB="file:${I}"
                     FindCronJob ${I}
-                    for J in ${sCRONJOBS}; do
-                        LogText "Found cronjob (/var/spool/cron/crontabs): ${I} (${J})"
+                    for FILE in ${sCRONJOBS}; do
+                        LogText "Found cronjob (/var/spool/cron/crontabs): ${I} (${FILE})"
                         Report "cronjob[]=${I}"
                     done
                 fi
             done
         else
-            if [ -d /var/spool/cron ]; then
-                FIND=$(find /var/spool/cron -type f -print)
+            if [ -d ${ROOTDIR}var/spool/cron ]; then
+                FIND=$(find ${ROOTDIR}var/spool/cron -type f -print)
                 for I in ${FIND}; do
                     if FileIsReadable ${I}; then
+                        ${EGREPBINARY} -q -s 'lynis audit system' ${I} && LYNIS_CRONJOB="file:${I}"
                         FindCronJob ${I}
-                        for J in ${sCRONJOBS}; do
-                            LogText "Found cronjob (/var/spool/cron): ${I} (${J})"
+                        for FILE in ${sCRONJOBS}; do
+                            LogText "Found cronjob in ${ROOTDIR}var/spool/cron: ${I} (${FILE})"
                             LogText "cronjob[]=${I}"
                         done
                     fi
@@ -177,12 +184,12 @@
         # Show warning when an issue shows up. Even if *both* the permissions and ownership are wrong, just show one (prevent overload of warnings).
         if [ ${BAD_FILE_PERMISSIONS} -eq 1 ]; then
             ReportWarning "${TEST_NO}" "Found one or more cronjob files with incorrect file permissions (see log for details)"
-            Display --indent 2 --text "- Checking crontab/cronjob" --result "${STATUS_WARNING}" --color RED
+            Display --indent 2 --text "- Checking crontab and cronjobs files" --result "${STATUS_WARNING}" --color RED
         elif [ ${BAD_FILE_OWNERSHIP} -eq 1 ]; then
             ReportWarning "${TEST_NO}" "Found one or more cronjob files with incorrect ownership (see log for details)"
-            Display --indent 2 --text "- Checking crontab/cronjob" --result "${STATUS_WARNING}" --color RED
+            Display --indent 2 --text "- Checking crontab and cronjob files" --result "${STATUS_WARNING}" --color RED
         else
-            Display --indent 2 --text "- Checking crontab/cronjob" --result "${STATUS_DONE}" --color GREEN
+            Display --indent 2 --text "- Checking crontab and cronjob files" --result "${STATUS_DONE}" --color GREEN
         fi
 
     fi
@@ -298,6 +305,12 @@
 #################################################################################
 #
 
+if [ -z "${LYNIS_CRONJOB}" ]; then
+    LogText "Result: no scheduled Lynis execution found (e.g. crontab, cronjob)"
+else
+    LogText "Result: found scheduled Lynis execution (${LYNIS_CRONJOB})"
+fi
+
 WaitForKeyPress
 
 #

From 820666f448c10ac992e67ea5e140aa24e5b702ba Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 14 Mar 2019 12:33:35 +0100
Subject: [PATCH 029/679] Updated log

---
 CHANGELOG.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 651936be..c06b30f9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,8 +3,12 @@
 ## Lynis 2.7.3 (not released yet)
 
 ### Added
+- Detection for Lynis being scheduled (e.g. cronjob)
 
 ### Changed
+- KRNL-5820 - Changed color for default fs.suid_dumpable value
+- Improvements to allow tailored tool tips
+- Minor textual changes
 
 ---------------------------------------------------------------------------------
 

From 0e8a12e2080b9044fcf7826250f4deadeccbc2bd Mon Sep 17 00:00:00 2001
From: Warren <wes.p160@gmail.com>
Date: Thu, 14 Mar 2019 08:34:17 -0300
Subject: [PATCH 030/679] Quote WORKDIR directory existence in lynis (#653)

Quote both "${WORKDIR}/include" and "${WORKDIR}/db" directory existence check in if-statements to avoid "Fatal error: can't find directory" in case of a space-character in the ${WORKDIR} path.
---
 lynis | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lynis b/lynis
index cc874a0c..cf0bfa98 100755
--- a/lynis
+++ b/lynis
@@ -76,7 +76,7 @@
         tINCLUDE_TARGETS="/usr/local/include/lynis /usr/local/lynis/include /usr/share/lynis/include ./include"  # Default paths to check (CWD as last option, in case we run from standalone)
         for I in ${tINCLUDE_TARGETS}; do
             if [ "${I}" = "./include" ]; then
-                if [ -d ${WORKDIR}/include ]; then INCLUDEDIR="${WORKDIR}/include"; fi
+                if [ -d "${WORKDIR}/include" ]; then INCLUDEDIR="${WORKDIR}/include"; fi
             elif [ -d ${I} -a -z "${INCLUDEDIR}" ]; then
                 INCLUDEDIR=${I}
             fi
@@ -95,7 +95,7 @@ Make sure to execute ${PROGRAM_NAME} from untarred directory or check your insta
         DBDIR=""; tDB_TARGETS="/usr/local/share/lynis/db /usr/local/lynis/db /usr/share/lynis/db ./db"
         for I in ${tDB_TARGETS}; do
             if [ "${I}" = "./db" ]; then
-                if [ -d ${WORKDIR}/db ]; then DBDIR="${WORKDIR}/db"; fi
+                if [ -d "${WORKDIR}/db" ]; then DBDIR="${WORKDIR}/db"; fi
             elif [ -d ${I} -a -z "${DBDIR}" ]; then
                 DBDIR="${I}"
             fi

From 703a856e82ed0678d33ca089cc1566dd6979b127 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 14 Mar 2019 13:15:07 +0100
Subject: [PATCH 031/679] Corrected blkid detection

---
 include/binaries | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/binaries b/include/binaries
index c2f7a598..18b54b2a 100644
--- a/include/binaries
+++ b/include/binaries
@@ -107,14 +107,14 @@
                             auditctl)               AUDITCTLBINARY="${BINARY}";        LogText "  Found known binary: auditctl (control utility for audit daemon) - ${BINARY}" ;;
                             autolog)                AUTOLOGBINARY="${BINARY}";         IDLE_SESSION_KILLER_INSTALLED=1;       LogText "  Found known binary: autolog (idle session killer) - ${BINARY}" ;;
                             base64)                 BASE64BINARY="${BINARY}";          LogText "  Found known binary: base64 (encoding tool) - ${BINARY}" ;;
-                            blkid)                  BLKDBINARY="${BINARY}";            LogText "  Found known binary: blkid (information about block devices) - ${BINARY}" ;;
-			    bootctl)		    BOOTCTLBINARY="${BINARY}";	       LogText "  Found known binary: bootctl (systemd-boot manager utility) - ${BINARY}" ;;
+                            blkid)                  BLKIDBINARY="${BINARY}";           LogText "  Found known binary: blkid (information about block devices) - ${BINARY}" ;;
+                            bootctl)                BOOTCTLBINARY="${BINARY}";         LogText "  Found known binary: bootctl (systemd-boot manager utility) - ${BINARY}" ;;
                             cat)                    CAT_BINARY="${BINARY}";            LogText "  Found known binary: cat (generic file handling) - ${BINARY}" ;;
-                            cc)                     CCBINARY="${BINARY}";              COMPILER_INSTALLED=1;  LogText "  Found known binary: cc (compiler) - ${BINARY}" ;;			    
+                            cc)                     CCBINARY="${BINARY}";              COMPILER_INSTALLED=1;  LogText "  Found known binary: cc (compiler) - ${BINARY}" ;;
                             chkconfig)              CHKCONFIGBINARY=${BINARY};         LogText "  Found known binary: chkconfig (administration tool) - ${BINARY}" ;;
                             clamconf)               CLAMCONF_BINARY=${BINARY};         LogText "  Found known binary: clamconf (information about ClamAV) - ${BINARY}" ;;
                             clamscan)               CLAMSCANBINARY=${BINARY};          LogText "  Found known binary: clamscan (AV scanner) - ${BINARY}" ;;
-                            clang)                  CLANGBINARY=${BINARY};             COMPILER_INSTALLED=1;  LogText "  Found known binary: clang (compiler) - ${BINARY}" ;;			    
+                            clang)                  CLANGBINARY=${BINARY};             COMPILER_INSTALLED=1;  LogText "  Found known binary: clang (compiler) - ${BINARY}" ;;
                             cfagent)                CFAGENTBINARY="${BINARY}";         FILE_INT_TOOL_FOUND=1;                 LogText "  Found known binary: cfengine agent (configuration tool) - ${BINARY}" ;;
                             chkrootkit)             CHKROOTKITBINARY="${BINARY}";      MALWARE_SCANNER_INSTALLED=1;           LogText "  Found known binary: chkrootkit (malware scanner) - ${BINARY}" ;;
                             comm)                   COMMBINARY="${BINARY}";            LogText "  Found known binary: comm (file compare) - ${BINARY}" ;;

From dac92d27bb6dcec4f11b922786e4bbc60f0fb19e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 14 Mar 2019 13:15:32 +0100
Subject: [PATCH 032/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c06b30f9..8be56fd0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@
 ### Changed
 - KRNL-5820 - Changed color for default fs.suid_dumpable value
 - Improvements to allow tailored tool tips
+- Corrected detection of blkid binary
 - Minor textual changes
 
 ---------------------------------------------------------------------------------

From 89782f1e9835b319b67cd0231d574e3081dd32cf Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 14 Mar 2019 14:15:59 +0100
Subject: [PATCH 033/679] Add logging status of tool tips

---
 include/tool_tips | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/include/tool_tips b/include/tool_tips
index 343a943c..bf529ca2 100644
--- a/include/tool_tips
+++ b/include/tool_tips
@@ -26,6 +26,7 @@
     # Only show tips when enabled
     if [ ${SHOW_TOOL_TIPS} -eq 1 ]; then
 
+        LogText "Tool tips: enabled"
         # * Regular security auditing
         #
         # If package is installed, then suggest users to schedule the audit daily
@@ -56,6 +57,10 @@
         #        fi
         #    done
         #fi
+
+    else
+        LogText "Tool tips: enabled"
+
     fi
 
 

From 4a47bde240f271deb46341e66dc7a38fe8b1f4f6 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 15 Mar 2019 13:52:55 +0100
Subject: [PATCH 034/679] Adjusted descriptions

---
 include/tests_squid | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_squid b/include/tests_squid
index 3e1dbe2e..c9eb1b71 100644
--- a/include/tests_squid
+++ b/include/tests_squid
@@ -111,7 +111,7 @@
     # Test        : SQD-3610
     # Description : Check Squid configuration options
     if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! -z "${SQUID_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no SQD-3610 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check Squid version"
+    Register --test-no SQD-3610 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Gather Squid settings"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking all specific defined options in ${SQUID_DAEMON_CONFIG}"
         FIND=$(${GREPBINARY} -v "^#" ${SQUID_DAEMON_CONFIG} | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{gsub("\t"," ");print}' | ${SEDBINARY} 's/ /!space!/g')
@@ -126,7 +126,7 @@
 #################################################################################
 #
     # Test        : SQD-3613
-    # Description : Check Squid configuration options
+    # Description : Check Squid configuration file permissions
     if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! -z "${SQUID_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SQD-3613 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check Squid file permissions"
     if [ ${SKIPTEST} -eq 0 ]; then

From b6b1f109012cc5aba7fc3f8c7ee190b903d5fbea Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 15 Mar 2019 13:53:06 +0100
Subject: [PATCH 035/679] Updated log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8be56fd0..4ef53afb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,8 @@
 
 ### Changed
 - KRNL-5820 - Changed color for default fs.suid_dumpable value
+- SQD-3610  - Description of test changed
+- SQD-3613  - Corrected description in code
 - Improvements to allow tailored tool tips
 - Corrected detection of blkid binary
 - Minor textual changes

From 048815abc0106c61854e2d89dee82a162388972a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 15 Mar 2019 14:00:47 +0100
Subject: [PATCH 036/679] [SSH-7408] Increased values for MaxAuthRetries as
 sometimes SSH key-based authentication may need it

---
 include/tests_ssh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_ssh b/include/tests_ssh
index 29b8aa52..fe303778 100644
--- a/include/tests_ssh
+++ b/include/tests_ssh
@@ -137,7 +137,7 @@
                 IgnoreRhosts:YES,,NO:=\
                 LoginGraceTime:120,240,480:<\
                 LogLevel:VERBOSE,INFO,:=\
-                MaxAuthTries:2,4,6:<\
+                MaxAuthTries:3,6,999:<\
                 MaxSessions:2,4,8:<\
                 PermitRootLogin:(NO|PROHIBIT-PASSWORD|WITHOUT-PASSWORD),,YES:=\
                 PermitUserEnvironment:NO,,YES:=\

From a350dfec1b2ccdda7ecfac6125b8eb559c7bffe3 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 15 Mar 2019 14:01:48 +0100
Subject: [PATCH 037/679] Updated log

---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4ef53afb..d56b7ce2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,8 @@
 - KRNL-5820 - Changed color for default fs.suid_dumpable value
 - SQD-3610  - Description of test changed
 - SQD-3613  - Corrected description in code
-- Improvements to allow tailored tool tips
+- SSH-7408  - Increased values for MaxAuthRetries
+- Improvements to allow tailored tool tips in future
 - Corrected detection of blkid binary
 - Minor textual changes
 

From 306d9eaab6ee20d741fcff33be9f06e4c6d8ff63 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 15 Mar 2019 14:24:42 +0100
Subject: [PATCH 038/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d56b7ce2..29cab4c1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@
 
 ### Changed
 - KRNL-5820 - Changed color for default fs.suid_dumpable value
+- LOGG-2154 - Adjusted test to search in configuration file correctly
 - SQD-3610  - Description of test changed
 - SQD-3613  - Corrected description in code
 - SSH-7408  - Increased values for MaxAuthRetries

From 303050dda3ffa97c0139db07dfa41f94f2f217f8 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 15 Mar 2019 14:25:00 +0100
Subject: [PATCH 039/679] [LOGG-2154] Adjusted test to search in configuration
 file correctly

---
 include/tests_logging | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_logging b/include/tests_logging
index efb9e9d2..27e6baef 100644
--- a/include/tests_logging
+++ b/include/tests_logging
@@ -363,7 +363,7 @@
                 # Search for configured destinations with an IP address or hostname, then determine which ones are used as a log destination
                 DESTINATIONS=$(${GREPBINARY} "^destination" ${SYSLOGD_CONF} | ${EGREPBINARY} "(udp|tcp)" | ${GREPBINARY} "port" | ${AWKBINARY} '{print $2}')
                 for DESTINATION in ${DESTINATIONS}; do
-                    FIND2=$(${GREPBINARY} "log" | ${GREPBINARY} "source" | ${EGREPBINARY} "destination\(${DESTINATION}\)")
+                    FIND2=$(${GREPBINARY} "log" ${SYSLOGD_CONF} | ${GREPBINARY} "source" | ${EGREPBINARY} "destination\(${DESTINATION}\)")
                     if [ ! -z "${FIND2}" = "" ]; then
                         LogText "Result: found destination ${DESTINATION} configured for remote logging"
                         REMOTE_LOGGING_ENABLED=1

From 888df98af46549c7b93f907477e0316faad9c7bd Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 19 Mar 2019 13:06:31 +0100
Subject: [PATCH 040/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 29cab4c1..9a1cdfd9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@
 - Detection for Lynis being scheduled (e.g. cronjob)
 
 ### Changed
+- HTTP-6624 - Improved logging for test
 - KRNL-5820 - Changed color for default fs.suid_dumpable value
 - LOGG-2154 - Adjusted test to search in configuration file correctly
 - SQD-3610  - Description of test changed

From 928023ec6aead100a517d8c342c1e9b9f649a5fc Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 19 Mar 2019 13:07:12 +0100
Subject: [PATCH 041/679] [HTTP-6624] improved logging for test

---
 include/tests_webservers | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/tests_webservers b/include/tests_webservers
index 459e1633..5d0907b9 100644
--- a/include/tests_webservers
+++ b/include/tests_webservers
@@ -113,9 +113,10 @@
                     Display --indent 6 --text "Info: Configuration file found (${APACHE_CONFIGFILE})"
                     LogText "Result: Configuration file found (${APACHE_CONFIGFILE})"
                 else
-                    LogText "Result: File or directory ${APACHE_CONFIGFILE} does not exist"
+                    LogText "Result: File or directory ${APACHE_TESTFILE} does not exist"
                     Display --indent 6 --text "[Notice] possible directory/file parts found, but still unsure what the real configuration file is. Skipping some Apache related tests"
                     ReportException "${TEST_NO}:1" "Found some unknown directory or file references in Apache configuration"
+                    LogText "Note: if only the Apache binary package has been installed, then the configuration might be missing. Is the Apache package really needed?"
                 fi
             fi
         fi

From 943e09db01bf524c99396e64c5e053f53ec1f732 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 21 Mar 2019 09:07:05 +0100
Subject: [PATCH 042/679] [LOGG-2180] minor cleanup

---
 include/tests_logging | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/include/tests_logging b/include/tests_logging
index 27e6baef..c7995b47 100644
--- a/include/tests_logging
+++ b/include/tests_logging
@@ -465,13 +465,11 @@
             FIND=$(${LSOFBINARY} -n 2>&1 | ${GREPBINARY} "log$" | ${EGREPBINARY} -v "WARNING|Output information" | ${AWKBINARY} '{ if ($5=="REG") { print $9 } }' | ${SORTBINARY} -u | ${GREPBINARY} -v "^$")
             for I in ${FIND}; do
                 LogText "Found logfile: ${I}"
-                Report "open_logfile[]=${I}"
             done
             Display --indent 2 --text "- Checking open log files" --result "${STATUS_DONE}" --color GREEN
         else
             LogText "Result: lsof not installed, skipping test"
-            Display --indent 2 --text "- Checking open log files" --result "${STATUS_SKIPPED}" --color YELLOW
-            # Add suggestion
+            Display --indent 2 --text "- Checking open log files" --result "${STATUS_SKIPPED}" --color WHITE
         fi
     fi
 #

From ea8c032ea91223bd2c8eac7b0087808747b0e316 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 21 Mar 2019 09:34:26 +0100
Subject: [PATCH 043/679] [NETW-3015] added support for ip binary

---
 include/tests_networking | 41 +++++++++++++++++++++++++++++-----------
 1 file changed, 30 insertions(+), 11 deletions(-)

diff --git a/include/tests_networking b/include/tests_networking
index e2503b60..3986220b 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -507,35 +507,54 @@
 #
     # Test        : NETW-3015
     # Description : Checking promiscuous interfaces (Linux)
-    # Note        : Need ifconfig binary at this moment (does not work on Arch Linux)
-    if [ ! "${IFCONFIGBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no NETW-3015 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking promiscuous interfaces (Linux)"
+    Register --test-no NETW-3015 --os Linux --weight L --network NO --category security --description "Checking promiscuous interfaces (Linux)"
     if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: Checking promiscuous interfaces (Linux)"
-        NETWORK=$(${IFCONFIGBINARY} 2> /dev/null | ${GREPBINARY} Link | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f1)
-        if [ ! "${NETWORK}" = "" ]; then
+        FOUNDPROMISC=99
+        NETWORK=""
+        USE_IP_INSTEAD_IFCONFIG=0
+
+        if [ ! -z "${IPBINARY}" ]; then
+            LogText "Test: Using ip binary to retrieve network interfaces"
+            NETWORK=$(${IPBINARY} -o link 2> /dev/null | ${GREPBINARY} "^[0-9]" | ${AWKBINARY} '{print $2 }' | ${TRBINARY} -d ':')
+            USE_IP_INSTEAD_IFCONFIG=1
+        elif [ ! -z "${IFCONFIGBINARY}" ]; then
+            LogText "Test: Using ifconfig binary to retrieve network interfaces"
+            NETWORK=$(${IFCONFIGBINARY} 2> /dev/null | ${GREPBINARY} Link | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f1)
+        fi
+
+        LogText "Test: Checking all interfaces to discover any with promiscuous mode enabled"
+        if [ ! -z "${NETWORK}" ]; then
+            FOUNDPROMISC=0
             for I in ${NETWORK}; do
-                FIND=$(${IFCONFIGBINARY} ${I} 2> /dev/null | ${GREPBINARY} PROMISC)
-                if [ ! "${FIND}" = "" ]; then
+                if [ ${USE_IP_INSTEAD_IFCONFIG} -eq 1 ]; then
+                    FIND=$(${IPBINARY} -o -d link show ${I} 2> /dev/null | ${GREPBINARY} 'promiscuity 1')
+                else
+                    FIND=$(${IFCONFIGBINARY} ${I} 2> /dev/null | ${GREPBINARY} PROMISC)
+                fi
+                if [ ! -z "${FIND}" ]; then
                     LogText "Result: Promiscuous interface: ${I}"
                     ISWHITELISTED=$(${GREPBINARY} "^if_promisc:${I}:" ${PROFILE})
-                    if [ "${ISWHITELISTED}" = "" ]; then
+                    if [ -z "${ISWHITELISTED}" ]; then
                         FOUNDPROMISC=1
-                        ReportWarning ${TEST_NO} "Found promiscuous interface (${I})"
+                        ReportWarning ${TEST_NO} "Found promiscuous interface" "${I}" "text:Determine if this mode is required or whitelist interface in profile"
                         LogText "Note: some tools put an interface into promiscuous mode, to capture/log network traffic"
                     else
                         LogText "Result: Found promiscuous interface ${I} (*whitelisted via profile*)"
                     fi
                 fi
             done
+        else
+            LogText "Result: no network interfaces discovered, so nothing tested"
         fi
 
         # Show result
         if [ ${FOUNDPROMISC} -eq 0 ]; then
             Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_OK}" --color GREEN
             LogText "Result: No promiscuous interfaces found"
-        else
+        elif [ ${FOUNDPROMISC} -eq 1 ]; then
             Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_WARNING}" --color RED
+        else
+            Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_UNKNOWN}" --color YELLOW
         fi
     fi
 #

From 09e2de2ea5620026f9be8f13b491437e8e50074e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 21 Mar 2019 09:35:30 +0100
Subject: [PATCH 044/679] Release 2.7.3

---
 CHANGELOG.md | 5 +++--
 lynis        | 6 +++---
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9a1cdfd9..a3522551 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,6 @@
 # Lynis Changelog
 
-## Lynis 2.7.3 (not released yet)
+## Lynis 2.7.3 (2019-03-21)
 
 ### Added
 - Detection for Lynis being scheduled (e.g. cronjob)
@@ -9,12 +9,13 @@
 - HTTP-6624 - Improved logging for test
 - KRNL-5820 - Changed color for default fs.suid_dumpable value
 - LOGG-2154 - Adjusted test to search in configuration file correctly
+- NETW-3015 - Added support for ip binary
 - SQD-3610  - Description of test changed
 - SQD-3613  - Corrected description in code
 - SSH-7408  - Increased values for MaxAuthRetries
 - Improvements to allow tailored tool tips in future
 - Corrected detection of blkid binary
-- Minor textual changes
+- Minor textual changes and cleanups
 
 ---------------------------------------------------------------------------------
 
diff --git a/lynis b/lynis
index cf0bfa98..15d509ea 100755
--- a/lynis
+++ b/lynis
@@ -35,9 +35,9 @@
     PROGRAM_AUTHOR_CONTACT="lynis-dev@cisofy.com"
 
     # Version details
-    PROGRAM_RELEASE_DATE="2019-03-07"
-    PROGRAM_RELEASE_TIMESTAMP=1551949337
-    PROGRAM_RELEASE_TYPE="dev" # dev or final
+    PROGRAM_RELEASE_DATE="2019-03-21"
+    PROGRAM_RELEASE_TIMESTAMP=1553157295
+    PROGRAM_RELEASE_TYPE="final" # dev or final
     PROGRAM_VERSION="2.7.3"
 
     # Source, documentation and license

From 52dd096e0f6aa9804d2c0305cd5dcb5ee4b2d352 Mon Sep 17 00:00:00 2001
From: Capashenn <capashenn@gmail.com>
Date: Tue, 19 Mar 2019 10:45:10 +0100
Subject: [PATCH 045/679] fix issue #621

---
 include/tests_ssh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/tests_ssh b/include/tests_ssh
index fe303778..e811e069 100644
--- a/include/tests_ssh
+++ b/include/tests_ssh
@@ -98,12 +98,12 @@
     if [ ${SSH_DAEMON_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SSH-7406 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determine OpenSSH version"
     if [ ${SKIPTEST} -eq 0 ]; then
-        OPENSSHD_VERSION=$(sshd -t -d 2>&1 | ${GREPBINARY} 'sshd version' | ${AWKBINARY} '{if($4~OpenSSH_){print $4}}' | ${AWKBINARY} -F_ '{print $2}' | ${TRBINARY} -d ',')
+        OPENSSHD_VERSION=$(${SSHDBINARY} -t -d 2>&1 | ${GREPBINARY} 'sshd version' | ${AWKBINARY} '{if($4~OpenSSH_){print $4}}' | ${AWKBINARY} -F_ '{print $2}' | ${TRBINARY} -d ',' | ${TRBINARY} -d '\r')
         LogText "Result: discovered OpenSSH version is ${OPENSSHD_VERSION}"
         if [ ! -z ${OPENSSHD_VERSION} ]; then
-            OPENSSHD_VERSION_MAJOR=$(echo ${OPENSSHD_VERSION} | ${AWKBINARY} -F. '{print $1}')
+            OPENSSHD_VERSION_MAJOR=$(echo ${OPENSSHD_VERSION%%p*} | ${AWKBINARY} -F. '{print $1}')
             LogText "Result: OpenSSH major version: ${OPENSSHD_VERSION_MAJOR}"
-            OPENSSHD_VERSION_MINOR=$(echo ${OPENSSHD_VERSION} | ${AWKBINARY} -F. '{print $2}')
+            OPENSSHD_VERSION_MINOR=$(echo ${OPENSSHD_VERSION%%p*} | ${AWKBINARY} -F. '{print $2}')
             LogText "Result: OpenSSH minor version: ${OPENSSHD_VERSION_MINOR}"
         fi
     fi
@@ -113,7 +113,7 @@
     # Test        : SSH-7408
     # Description : Check SSH specific defined options
     # Notes       : Instead of parsing the configuration file, we query the SSH daemon itself
-    if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! -z "${SSH_DAEMON_OPTIONS_FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! -z "${SSH_DAEMON_OPTIONS_FILE}" -a ${OPENSSHD_VERSION_MAJOR} -ge 5 -a ${OPENSSHD_VERSION_MINOR} -ge 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SSH-7408 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check SSH specific defined options"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking specific defined options in ${SSH_DAEMON_OPTIONS_FILE}"

From 5dbe4f20fcbe0591396d996d748454ab5278770d Mon Sep 17 00:00:00 2001
From: Capashenn <capashenn@gmail.com>
Date: Thu, 21 Mar 2019 18:24:06 +0100
Subject: [PATCH 046/679] Add some default permfile/permdir

---
 default.prf | 28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/default.prf b/default.prf
index ef474b1f..d7c35e66 100644
--- a/default.prf
+++ b/default.prf
@@ -332,7 +332,28 @@ openldap:slapd.conf:owner:ldap-root:
 #permfile:/etc/inetd.conf:rw-------:root:-:WARN:
 #permfile:/etc/fstab:rw-r--r--:root:-:WARN:
 permfile:/etc/lilo.conf:rw-------:root:-:WARN:
-
+permfile:/boot/grub2/grub.cfg:rw-------:root:root:WARN:
+permfile:/boot/grub/grub.cfg:rw-------:root:root:WARN:
+permfile:/boot/grub2/user.cfg:rw-------:root:root:WARN:
+permfile:/etc/motd:rw-r--r--:root:root:WARN:
+permfile:/etc/issue:rw-r--r--:root:root:WARN:
+permfile:/etc/issue.net:rw-r--r--:root:root:WARN:
+permfile:/etc/hosts.allow:rw-r--r--:root:root:WARN:
+permfile:/etc/hosts.deny:rw-r--r--:root:root:WARN:
+permfile:/etc/crontab:rw-------:root:-:WARN:
+permfile:/etc/cron.allow:rw-------:root:-:WARN:
+permfile:/etc/cron.deny:rw-------:root:-:WARN:
+permfile:/etc/at.allow:rw-------:root:-:WARN:
+permfile:/etc/at.deny:rw-------:root:-:WARN:
+permfile:/etc/ssh/sshd_config:rw-------:root:-:WARN:
+permfile:/etc/passwd:rw-r--r--:root:-:WARN:
+permfile:/etc/shadow:---------:root:-:WARN:
+permfile:/etc/group:rw-r--r--:root:-:WARN:
+permfile:/etc/gshadow:---------:root:-:WARN:
+permfile:/etc/passwd-:rw-r--r--:root:-:WARN:
+permfile:/etc/shadow-:---------:root:-:WARN:
+permfile:/etc/group-:rw-r--r--:root:-:WARN:
+permfile:/etc/gshadow-:---------:root:-:WARN:
 
 #################################################################################
 #
@@ -343,6 +364,11 @@ permfile:/etc/lilo.conf:rw-------:root:-:WARN:
 #################################################################################
 
 permdir:/root/.ssh:rwx------:root:-:WARN:
+permdir:/etc/cron.hourly:rwx------:root:root:WARN:
+permdir:/etc/cron.daily:rwx------:root:root:WARN:
+permdir:/etc/cron.weekly:rwx------:root:root:WARN:
+permdir:/etc/cron.monthly:rwx------:root:root:WARN:
+permdir:/etc/cron.d:rwx------:root:root:WARN:
 
 # Scan for a program/binary in BINPATHs
 #scanbinary:Rootkit Hunter:rkhunter:

From c8af37c069313a3bad1d47e7bd33391e3a83e538 Mon Sep 17 00:00:00 2001
From: Capashenn <capashenn@gmail.com>
Date: Mon, 25 Mar 2019 13:44:25 +0100
Subject: [PATCH 047/679] fix issues #666 #667

---
 include/tests_homedirs | 59 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/include/tests_homedirs b/include/tests_homedirs
index 045a2753..6beadaa5 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -50,6 +50,65 @@
     fi
 #
 #################################################################################
+#
+    # Test        : HOME-9304
+    # Description : Check if users' home directories permissions are 750 or more restrictive
+    Register --test-no HOME-9304 --weight L --network NO --category security --description "Check if users' home directories permissions are 750 or more restrictive"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        # Check if users' home directories permissions are 750 or more restrictive
+        FOUND=0
+        for LINE in $(${CAT_BINARY} /etc/passwd | ${EGREPBINARY} -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }'); do
+            USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
+            DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
+            if [ -d ${DIR} ]; then
+                WRITE_GROUP_PERM=$(ls -ld ${DIR} | ${CUTBINARY} -f1 -d" " | ${CUTBINARY} -c6)
+                OTHER_PERMS=$(ls -ld ${DIR} | ${CUTBINARY} -f1 -d" " | ${CUTBINARY} -c8-10)
+                if [ ! ${WRITE_GROUP_PERM} = "-" -o ! ${OTHER_PERMS} = "---" ]; then
+                    LogText "Result: permissions of home directory ${DIR} of user ${USER} are not strict enough. Should be 750 or more restrictive. Change with: chmod 750 ${DIR}" 
+                    FOUND=1
+                fi
+            fi
+        done
+        # Result
+        if [ ${FOUND} -eq 1 ]; then
+            Display --indent 2 --text "- Checking users' home directories permissions" --result "${STATUS_WARNING}" --color RED
+            ReportWarning ${TEST_NO} "Permissions of some users' home directories are not strict enough. Should be 750 or more restrictive."
+        else
+            Display --indent 2 --text "- Checking users' home directories permissions" --result "${STATUS_OK}" --color GREEN
+            LogText "Result: Ok, All users' home directories permissions are 750 or more restrictive"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : HOME-9306
+    # Description : Check if users own their home directories
+    Register --test-no HOME-9306 --weight L --network NO --category security --description "Check if users own their home directories"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        # Check if users own their home directories
+        FOUND=0
+        for LINE in $(${CAT_BINARY} /etc/passwd | ${EGREPBINARY} -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }'); do
+            USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
+            DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
+            if [ -d ${DIR} ]; then
+                OWNER=$(ls -ld ${DIR} | awk -F" " '{ print $3 }')
+                if [ ! ${OWNER} = ${USER} ]; then
+                    LogText "Result: The home directory ${DIR} of user ${USER} is owned by ${OWNER}. Change with: chown ${OWNER} ${DIR}" 
+                    FOUND=1
+                fi
+            fi
+        done
+        # Result
+        if [ ${FOUND} -eq 1 ]; then
+            Display --indent 2 --text "- Checking users' home directories ownership" --result "${STATUS_WARNING}" --color RED
+            ReportWarning ${TEST_NO} "Owner of some users' home directories are not correctly set"
+        else
+            Display --indent 2 --text "- Checking users' home directories ownership" --result "${STATUS_OK}" --color GREEN
+            LogText "Result: Ok, All users own their home directories"
+        fi
+    fi
+#
+#################################################################################
 #
     # Test        : HOME-9310
     # Description : Check for suspicious shell history files

From 06cdf6c50f7bac61afc6dc383716262e7c7d9838 Mon Sep 17 00:00:00 2001
From: Capashenn <capashenn@gmail.com>
Date: Mon, 25 Mar 2019 14:46:27 +0100
Subject: [PATCH 048/679] fix issue #659

---
 include/tests_kernel | 68 ++++++++++++++++++++++++--------------------
 1 file changed, 37 insertions(+), 31 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index f89177ce..66a80214 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -31,6 +31,7 @@
     CPU_NX=0
     LINUXCONFIGFILE=""
     LINUXCONFIGFILE_ZIPPED=0
+    LIMITS_DIRECTORY="${ROOTDIR}etc/security/limits.d"
 #
 #################################################################################
 #
@@ -436,51 +437,56 @@
     # Description : Checking core dumps configuration (Linux)
     Register --test-no KRNL-5820 --os Linux --weight L --network NO --category security --description "Checking core dumps configuration"
     if [ ${SKIPTEST} -eq 0 ]; then
+        # Limits option
         LogText "Test: Checking presence /etc/security/limits.conf"
         if [ -f /etc/security/limits.conf ]; then
             LogText "Result: file /etc/security/limits.conf exists"
-            LogText "Test: Checking if core dumps are disabled in /etc/security/limits.conf"
-            FIND1=$(${GREPBINARY} -v "^#" /etc/security/limits.conf | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="soft" && $3=="core" && $4=="1") { print "soft core enabled" } }')
-            FIND2=$(${GREPBINARY} -v "^#" /etc/security/limits.conf | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="hard" && $3=="core" && $4=="1") { print "hard core enabled" } }')
-            if [ "${FIND1}" = "soft core enabled" -o "${FIND2}" = "hard core enabled" ]; then
-                LogText "Result: core dumps (soft or hard) are enabled"
-                Display --indent 2 --text "- Checking core dumps configuration" --result "${STATUS_ENABLED}" --color YELLOW
-                ReportSuggestion "${TEST_NO}" "Check if core dumps need to be enabled on this system"
-                AddHP 1 2
-            else
+            LogText "Test: Checking if core dumps are disabled in /etc/security/limits.conf and /etc/security/limits.d/*"
+            FIND1=$(${GREPBINARY} -r -v "^#" /etc/security/limits.conf ${LIMITS_DIRECTORY} | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="soft" && $3=="core" && $4=="0") { print "soft core disabled" } else if ($1=="*" && $2=="soft" && $3=="core" && $4!="0") { print "soft core enabled" } }')
+            FIND2=$(${GREPBINARY} -r -v "^#" /etc/security/limits.conf ${LIMITS_DIRECTORY} | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="hard" && $3=="core" && $4=="0") { print "hard core disabled" } else if ($1=="*" && $2=="hard" && $3=="core" && $4!="0") { print "hard core enabled" } }')
+            if [ "${FIND2}" = "hard core disabled" ]; then
                 LogText "Result: core dumps (soft and hard) are both disabled"
                 Display --indent 2 --text "- Checking core dumps configuration" --result "${STATUS_DISABLED}" --color GREEN
                 CORE_DUMPS_DISABLED=1
                 AddHP 3 3
-            fi
-
-            # Sysctl option
-            LogText "Test: Checking sysctl value of fs.suid_dumpable"
-            FIND=$(${SYSCTLBINARY} fs.suid_dumpable 2> /dev/null | ${AWKBINARY} '{ if ($1=="fs.suid_dumpable") { print $3 } }')
-            if [ -z "${FIND}" ]; then
-                LogText "Result: sysctl key fs.suid_dumpable not found"
+            elif [ "${FIND1}" = "soft core enabled" -o "${FIND2}" = "hard core enabled" ]; then
+                LogText "Result: core dumps (soft or hard) are enabled"
+                Display --indent 2 --text "- Checking core dumps configuration" --result "${STATUS_ENABLED}" --color YELLOW
+                ReportSuggestion "${TEST_NO}" "Check if core dumps need to be enabled on this system"
+                AddHP 1 3
             else
-                LogText "Result: value ${FIND} found"
-            fi
-            if [ "${FIND}" = "2" ]; then
-                LogText "Result: programs can dump core dump, but only readable by root (value 2, for debugging with file protection)"
-                Display --indent 4 --text "- Checking setuid core dumps configuration" --result PROTECTED --color GREEN
-                AddHP 1 1
-            elif [ "${FIND}" = "1" ]; then
-                LogText "Result: all programs can perform core dumps (value 1, for debugging)"
-                Display --indent 2 --text "- Checking setuid core dumps configuration" --result DEBUG --color YELLOW
-                ReportSuggestion "${TEST_NO}" "Determine if all binaries need to be able to core dump"
-                AddHP 0 1
-            else
-                LogText "Result: found default option, some programs can dump (not processes which need to change credentials)"
-                Display --indent 4 --text "- Checking setuid core dumps configuration" --result DEFAULT --color WHITE
-                AddHP 1 1
+                LogText "Result: core dumps are not explicitly disabled"
+                Display --indent 2 --text "- Checking core dumps configuration" --result "${STATUS_NOT_FOUND}" --color WHITE
+                ReportSuggestion "${TEST_NO}" "If not required, consider explicit disabling of core dump in /etc/security/limits.conf file"
+                AddHP 2 3
             fi
         else
             LogText "Result: file /etc/security/limits.conf does not exist, skipping test"
         fi
         # TODO: Check ulimit settings in /etc/profile and /etc/profile.d
 
+        # Sysctl option
+        LogText "Test: Checking sysctl value of fs.suid_dumpable"
+        FIND=$(${SYSCTLBINARY} fs.suid_dumpable 2> /dev/null | ${AWKBINARY} '{ if ($1=="fs.suid_dumpable") { print $3 } }')
+        if [ -z "${FIND}" ]; then
+            LogText "Result: sysctl key fs.suid_dumpable not found"
+        else
+            LogText "Result: value ${FIND} found"
+        fi
+        if [ "${FIND}" = "2" ]; then
+            LogText "Result: programs can dump core dump, but only readable by root (value 2, for debugging with file protection)"
+            Display --indent 4 --text "- Checking setuid core dumps configuration" --result PROTECTED --color GREEN
+            AddHP 1 1
+        elif [ "${FIND}" = "1" ]; then
+            LogText "Result: all programs can perform core dumps (value 1, for debugging)"
+            Display --indent 2 --text "- Checking setuid core dumps configuration" --result DEBUG --color YELLOW
+            ReportSuggestion "${TEST_NO}" "Determine if all binaries need to be able to core dump"
+            AddHP 0 1
+        else
+            LogText "Result: found default option, some programs can dump (not processes which need to change credentials)"
+            Display --indent 4 --text "- Checking setuid core dumps configuration" --result DEFAULT --color WHITE
+            AddHP 1 1
+        fi
     fi
 #
 #################################################################################

From 3ba94b9700ca6cc549ce48d133311c874754448c Mon Sep 17 00:00:00 2001
From: Capashenn <capashenn@gmail.com>
Date: Mon, 25 Mar 2019 18:36:07 +0100
Subject: [PATCH 049/679] fix issue #610 STRG-1842

---
 include/tests_usb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/include/tests_usb b/include/tests_usb
index dcb8ad77..6c874364 100644
--- a/include/tests_usb
+++ b/include/tests_usb
@@ -105,6 +105,10 @@
                     LogText "Test: ${device} is authorized currently"
                     Report "usb_authorized_device[]=${device}"
                 fi
+            else
+                LogText "Test: ${device} is authorized by default"
+                Report "usb_authorized_default_device[]=${device}"
+                FOUND=1
             fi
         done
 

From 605c381eb6063435b5da13ca2f8b3a91fe9b0aa9 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 29 Mar 2019 12:22:20 +0100
Subject: [PATCH 050/679] [PKGS-7410] add support for DPKG-based systems to
 gather installed kernel packages

---
 include/tests_ports_packages | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 1426a068..ff28678f 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -1247,8 +1247,20 @@
     Register --test-no PKGS-7410 --weight L --network NO --category security --description "Count installed kernel packages"
     if [ ${SKIPTEST} -eq 0 ]; then
         KERNELS=0
-        if [ ! -z "${RPMBINARY}" ]; then
-            LogText "Test: Checking how many kernel packages are installed"
+        LogText "Test: Checking how many kernel packages are installed"
+
+        if [ ! -z "${DPKGBINARY}" ]; then
+            KERNELS=$(${DPKGBINARY} -l 2> /dev/null | ${GREPBINARY} "linux-image-[0-9]" | ${WCBINARY} -l)
+            if [ ${KERNELS} -eq 0 ]; then
+                LogText "Result: found no kernels from dpkg -l output, which is unexpected"
+                ReportException "KRNL-5840:2" "Could not find any kernel packages from DPKG output"
+            elif [ ${KERNELS} -gt 5 ]; then
+                LogText "Result: found more than 5 kernel packages on the system, which might indicate lack of regular cleanups"
+                ReportSuggestion "${TEST_NO}" "Remove any unneeded kernel packages" "${KERNELS} kernels" "text:validate dpkg -l output and perform cleanup with apt autoremove"
+            else
+                LogText "Result: found ${KERNELS} kernel packages on the system, which is fine"
+            fi
+        elif [ ! -z "${RPMBINARY}" ]; then
             KERNELS=$(${RPMBINARY} -q kernel 2> /dev/null | ${WCBINARY} -l)
             if [ ${KERNELS} -eq 0 ]; then
                 LogText "Result: found no kernels from rpm -q kernel output, which is unexpected"
@@ -1256,12 +1268,12 @@
             elif [ ${KERNELS} -gt 5 ]; then
                 LogText "Result: found more than 5 kernel packages on the system, which might indicate lack of regular cleanups"
                 ReportSuggestion "${TEST_NO}" "Remove any unneeded kernel packages with package-cleanup utility (--old-kernels)"
-                AddHP 4 5
             else
-                LogText "Result: found ${KERNELS} on the system, which is fine"
-                AddHP 1 1
+                LogText "Result: found ${KERNELS} kernel packages on the system, which is fine"
             fi
         fi
+
+        Report "installed_kernel_packages=${KERNELS}"
     fi
 #
 #################################################################################

From de2ef2c3e718ac22a11a98808b1a1795c559b487 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 29 Mar 2019 12:23:45 +0100
Subject: [PATCH 051/679] Add apt and dpkg binaries

---
 include/binaries | 1 +
 include/consts   | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/include/binaries b/include/binaries
index 18b54b2a..ec9a634f 100644
--- a/include/binaries
+++ b/include/binaries
@@ -99,6 +99,7 @@
                             afick.pl)               AFICKBINARY=${BINARY};             LogText "  Found known binary: afick (file integrity checker) - ${BINARY}" ;;
                             aide)                   AIDEBINARY=${BINARY};              LogText "  Found known binary: aide (file integrity checker) - ${BINARY}" ;;
                             apache2)                HTTPDBINARY=${BINARY};             LogText "  Found known binary: apache2 (web server) - ${BINARY}" ;;
+                            apt)                    APTBINARY=${BINARY};               LogText "  Found known binary: apt (package manager) - ${BINARY}" ;;
                             arch-audit)             ARCH_AUDIT_BINARY="${BINARY}";     LogText "  Found known binary: arch-audit (auditing utility to test for vulnerable packages) - ${BINARY}" ;;
                             auditd)                 AUDITDBINARY=${BINARY};            LogText "  Found known binary: auditd (audit framework) - ${BINARY}" ;;
                             awk)                    AWKBINARY=${BINARY};               LogText "  Found known binary: awk (string tool) - ${BINARY}" ;;
diff --git a/include/consts b/include/consts
index 671ed1ca..1abe26f9 100644
--- a/include/consts
+++ b/include/consts
@@ -46,6 +46,7 @@ unset LANG
 #
 # == Variable initializing ==
 #
+    APTBINARY=""
     ARCH_AUDIT_BINARY=""
     AUDITORNAME=""
     AUDITCTLBINARY=""
@@ -99,6 +100,7 @@ unset LANG
     DNFBINARY=""
     DOCKERBINARY=""
     DOCKER_DAEMON_RUNNING=0
+    DPKGBINARY=""
     ECHOCMD=""
     ERROR_ON_WARNINGS=0
     FAIL2BANBINARY=""

From 20da48bdfeaaf5405e695ae10bff80c45d9c1de4 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 29 Mar 2019 12:24:01 +0100
Subject: [PATCH 052/679] Switch to development version

---
 CHANGELOG.md | 7 +++++++
 lynis        | 6 +++---
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a3522551..2a41b2eb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Lynis Changelog
 
+## Lynis 2.7.4 (not released yet)
+
+### Changed
+- PKGS-7410 - add support for DPKG-based systems to gather installed kernel packages
+
+---------------------------------------------------------------------------------
+
 ## Lynis 2.7.3 (2019-03-21)
 
 ### Added
diff --git a/lynis b/lynis
index 15d509ea..e6263074 100755
--- a/lynis
+++ b/lynis
@@ -35,10 +35,10 @@
     PROGRAM_AUTHOR_CONTACT="lynis-dev@cisofy.com"
 
     # Version details
-    PROGRAM_RELEASE_DATE="2019-03-21"
+    PROGRAM_RELEASE_DATE="2019-03-29"
     PROGRAM_RELEASE_TIMESTAMP=1553157295
-    PROGRAM_RELEASE_TYPE="final" # dev or final
-    PROGRAM_VERSION="2.7.3"
+    PROGRAM_RELEASE_TYPE="dev" # dev or final
+    PROGRAM_VERSION="2.7.4"
 
     # Source, documentation and license
     PROGRAM_SOURCE="https://github.com/CISOfy/lynis"

From f9bcf26f25e2bd07c05e840362530abfda438a79 Mon Sep 17 00:00:00 2001
From: Capashenn <37273010+Capashenn@users.noreply.github.com>
Date: Fri, 29 Mar 2019 12:26:12 +0100
Subject: [PATCH 053/679] fix issue #612 (#677)

LDAP support for Red Hat and others (fix issue #612)
---
 include/tests_authentication | 34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index fe8ece41..9fe8af43 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -700,23 +700,29 @@
     # Description : Search LDAP support in PAM files
     Register --test-no AUTH-9278 --weight L --network NO --category security --description "Checking LDAP pam status"
     if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking presence /etc/pam.d/common-auth"
-        if [ -f /etc/pam.d/common-auth ]; then
-            LogText "Result: file /etc/pam.d/common-auth exists"
-            LogText "Test: checking presence LDAP module"
-            FIND=$(${GREPBINARY} "^auth.*ldap" /etc/pam.d/common-auth)
-            if [ ! "${FIND}" = "" ]; then
-                LogText "Result: LDAP module present"
-                LogText "Output: ${FIND}"
-                Display --indent 2 --text "- LDAP module in PAM" --result "${STATUS_FOUND}" --color GREEN
-                LDAP_AUTH_ENABLED=1
-                LDAP_PAM_ENABLED=1
+        AUTH_FILES="/etc/pam.d/common-auth /etc/pam.d/system-auth"
+        for FILE in ${AUTH_FILES}; do
+            LogText "Test: checking presence ${FILE}"
+            if [ -f ${FILE} ]; then
+                LogText "Result: file ${FILE} exists"
+                LogText "Test: checking presence LDAP module"
+                FIND=$(${GREPBINARY} "^auth.*ldap" ${FILE})
+                if [ ! "${FIND}" = "" ]; then
+                    LogText "Result: LDAP module present"
+                    LogText "Output: ${FIND}"
+                    LDAP_AUTH_ENABLED=1
+                    LDAP_PAM_ENABLED=1
+                 else
+                    LogText "Result: LDAP module not found"
+                fi
             else
-                LogText "Result: LDAP module not found"
-                Display --indent 2 --text "- LDAP module in PAM" --result "${STATUS_NOT_FOUND}" --color WHITE
+                LogText "Result: file ${FILE} not found, skipping test"
             fi
+        done
+        if [ ${LDAP_PAM_ENABLED} -eq 1 ]; then
+            Display --indent 2 --text "- LDAP module in PAM" --result "${STATUS_FOUND}" --color GREEN
         else
-            LogText "Result: file /etc/pam.d/common-auth not found, skipping test"
+            Display --indent 2 --text "- LDAP module in PAM" --result "${STATUS_NOT_FOUND}" --color WHITE
         fi
     fi
 #

From 8a9edeb40b018dec05f9dc0418971e50f55026db Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 29 Mar 2019 12:30:12 +0100
Subject: [PATCH 054/679] [AUTH-9278] style change, description, allow
 different root directory

---
 include/tests_authentication | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 9fe8af43..2ede2b7d 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -698,27 +698,28 @@
 #
     # Test        : AUTH-9278
     # Description : Search LDAP support in PAM files
-    Register --test-no AUTH-9278 --weight L --network NO --category security --description "Checking LDAP pam status"
+    Register --test-no AUTH-9278 --weight L --network NO --category security --description "Determine LDAP support in PAM files"
     if [ ${SKIPTEST} -eq 0 ]; then
-        AUTH_FILES="/etc/pam.d/common-auth /etc/pam.d/system-auth"
+        AUTH_FILES="${ROOTDIR}etc/pam.d/common-auth ${ROOTDIR}etc/pam.d/system-auth"
         for FILE in ${AUTH_FILES}; do
             LogText "Test: checking presence ${FILE}"
             if [ -f ${FILE} ]; then
                 LogText "Result: file ${FILE} exists"
                 LogText "Test: checking presence LDAP module"
                 FIND=$(${GREPBINARY} "^auth.*ldap" ${FILE})
-                if [ ! "${FIND}" = "" ]; then
+                if [ ! -z "${FIND}" ]; then
                     LogText "Result: LDAP module present"
                     LogText "Output: ${FIND}"
                     LDAP_AUTH_ENABLED=1
                     LDAP_PAM_ENABLED=1
-                 else
+                else
                     LogText "Result: LDAP module not found"
                 fi
             else
                 LogText "Result: file ${FILE} not found, skipping test"
             fi
         done
+
         if [ ${LDAP_PAM_ENABLED} -eq 1 ]; then
             Display --indent 2 --text "- LDAP module in PAM" --result "${STATUS_FOUND}" --color GREEN
         else

From c36917ae83ca1cbab8b2ba88fa680361190286df Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 29 Mar 2019 12:32:08 +0100
Subject: [PATCH 055/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2a41b2eb..caf75ed3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@
 ## Lynis 2.7.4 (not released yet)
 
 ### Changed
+- AUTH-9278 - Test LDAP in all PAM components on Red Hat and other systems
 - PKGS-7410 - add support for DPKG-based systems to gather installed kernel packages
 
 ---------------------------------------------------------------------------------

From 3702ae67b5ddb71df60701fabe691cf114db8670 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 29 Mar 2019 12:53:13 +0100
Subject: [PATCH 056/679] [PKGS-7420] Detect toolkit to automatically download
 and apply upgrades

---
 include/tests_ports_packages | 40 ++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index ff28678f..05f150a6 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -1278,6 +1278,46 @@
 #
 #################################################################################
 #
+    # Test        : PKGS-7420
+    # Description : Detect toolkit to automatically download and apply upgrades
+    Register --test-no PKGS-7420 --weight L --network NO --category security --description "Detect toolkit to automatically download and apply upgrades"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        UNATTENDED_UPGRADES_TOOLKIT=0
+        UNATTENDED_UPGRADES_TOOL=""
+        if [ -f "${ROOTDIR}bin/auter" ]; then
+            UNATTENDED_UPGRADES_TOOL="auter"
+            UNATTENDED_UPGRADES_TOOLKIT=1
+            LogText "Result: found ${UNATTENDED_UPGRADES_TOOL}"
+            Report "unattended_upgrade_tool[]=auter"
+        fi
+        if [ -f "${ROOTDIR}sbin/yum-cron" ]; then
+            UNATTENDED_UPGRADES_TOOL="yum-cron"
+            UNATTENDED_UPGRADES_TOOLKIT=1
+            LogText "Result: found ${UNATTENDED_UPGRADES_TOOL}"
+            Report "unattended_upgrade_tool[]=yum-cron"
+        fi
+        if [ -f "${ROOTDIR}usr/bin/unattended-upgrade" ]; then
+            UNATTENDED_UPGRADES_TOOL="unattended-upgrade"
+            UNATTENDED_UPGRADES_TOOLKIT=1
+            LogText "Result: found ${UNATTENDED_UPGRADES_TOOL}"
+            Report "unattended_upgrade_tool[]=unattended-upgrade"
+        fi
+        if [ ${UNATTENDED_UPGRADES_TOOLKIT} -eq 1 ]; then
+            AddHP 5 5
+            Display --indent 2 --text "- Toolkit for automatic upgrades (${UNATTENDED_UPGRADES_TOOL})" --result "${STATUS_FOUND}" --color GREEN
+        else
+            # TODO - Add logic to only display this when it is applicable as not all operating systems might support such tooling
+            AddHP 1 5
+            Display --indent 2 --text "- Toolkit for automatic upgrades" --result "${STATUS_NOTFOUND}" --color YELLOW
+            LogText "Result: no toolkit for automatic updates discovered"
+            # TODO - add suggestion
+        fi
+
+    fi
+#
+#################################################################################
+#
+
 
 if [ ! -z "${INSTALLED_PACKAGES}" ]; then Report "installed_packages_array=${INSTALLED_PACKAGES}"; fi
 

From abaed3e6c1fabb172d187c943cf75634719e69ac Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 29 Mar 2019 12:53:52 +0100
Subject: [PATCH 057/679] Updated log

---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index caf75ed3..8eedb146 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,8 @@
 
 ### Changed
 - AUTH-9278 - Test LDAP in all PAM components on Red Hat and other systems
-- PKGS-7410 - add support for DPKG-based systems to gather installed kernel packages
+- PKGS-7410 - Add support for DPKG-based systems to gather installed kernel packages
+- PKGS-7420 - Detect toolkit to automatically download and apply upgrades
 
 ---------------------------------------------------------------------------------
 

From 295a2699d3fa18c06d4191725254b2b0a94ba463 Mon Sep 17 00:00:00 2001
From: Capashenn <capashenn@gmail.com>
Date: Fri, 29 Mar 2019 16:34:01 +0100
Subject: [PATCH 058/679] bugfix HOME-9304 HOME-9306

---
 include/tests_homedirs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/tests_homedirs b/include/tests_homedirs
index 6beadaa5..1c850105 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -57,7 +57,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users' home directories permissions are 750 or more restrictive
         FOUND=0
-        for LINE in $(${CAT_BINARY} /etc/passwd | ${EGREPBINARY} -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }'); do
+        for LINE in "$(${CAT_BINARY} /etc/passwd | ${EGREPBINARY} -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }')"; do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
             DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
             if [ -d ${DIR} ]; then
@@ -87,13 +87,13 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users own their home directories
         FOUND=0
-        for LINE in $(${CAT_BINARY} /etc/passwd | ${EGREPBINARY} -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }'); do
+        for LINE in "$(${CAT_BINARY} /etc/passwd | ${EGREPBINARY} -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }')"; do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
             DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
             if [ -d ${DIR} ]; then
                 OWNER=$(ls -ld ${DIR} | awk -F" " '{ print $3 }')
                 if [ ! ${OWNER} = ${USER} ]; then
-                    LogText "Result: The home directory ${DIR} of user ${USER} is owned by ${OWNER}. Change with: chown ${OWNER} ${DIR}" 
+                    LogText "Result: The home directory ${DIR} of user ${USER} is owned by ${OWNER}. Change with: chown ${USER} ${DIR}" 
                     FOUND=1
                 fi
             fi

From 3660043308d5ad56c0e767f64deea41107ca5330 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 30 Mar 2019 13:31:03 +0100
Subject: [PATCH 059/679] [PKGS-7420] limit test to specific OS, add
 dnf-automatic support, extend logging

---
 include/tests_ports_packages | 76 +++++++++++++++++++++++-------------
 1 file changed, 49 insertions(+), 27 deletions(-)

diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 05f150a6..9798a9b7 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -1284,35 +1284,57 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         UNATTENDED_UPGRADES_TOOLKIT=0
         UNATTENDED_UPGRADES_TOOL=""
-        if [ -f "${ROOTDIR}bin/auter" ]; then
-            UNATTENDED_UPGRADES_TOOL="auter"
-            UNATTENDED_UPGRADES_TOOLKIT=1
-            LogText "Result: found ${UNATTENDED_UPGRADES_TOOL}"
-            Report "unattended_upgrade_tool[]=auter"
-        fi
-        if [ -f "${ROOTDIR}sbin/yum-cron" ]; then
-            UNATTENDED_UPGRADES_TOOL="yum-cron"
-            UNATTENDED_UPGRADES_TOOLKIT=1
-            LogText "Result: found ${UNATTENDED_UPGRADES_TOOL}"
-            Report "unattended_upgrade_tool[]=yum-cron"
-        fi
-        if [ -f "${ROOTDIR}usr/bin/unattended-upgrade" ]; then
-            UNATTENDED_UPGRADES_TOOL="unattended-upgrade"
-            UNATTENDED_UPGRADES_TOOLKIT=1
-            LogText "Result: found ${UNATTENDED_UPGRADES_TOOL}"
-            Report "unattended_upgrade_tool[]=unattended-upgrade"
-        fi
-        if [ ${UNATTENDED_UPGRADES_TOOLKIT} -eq 1 ]; then
-            AddHP 5 5
-            Display --indent 2 --text "- Toolkit for automatic upgrades (${UNATTENDED_UPGRADES_TOOL})" --result "${STATUS_FOUND}" --color GREEN
-        else
-            # TODO - Add logic to only display this when it is applicable as not all operating systems might support such tooling
-            AddHP 1 5
-            Display --indent 2 --text "- Toolkit for automatic upgrades" --result "${STATUS_NOTFOUND}" --color YELLOW
-            LogText "Result: no toolkit for automatic updates discovered"
-            # TODO - add suggestion
+        UNATTENDED_UPGRADES_OPTION_AVAILABLE=0
+
+        case "${OS}" in
+            "Linux")
+                case "${LINUX_VERSION}" in
+                    "CentOS" | "Debian" | "Fedora" | "RHEL" | "Ubuntu")
+
+                        UNATTENDED_UPGRADES_OPTION_AVAILABLE=1
+                        # Test available tools for Linux
+                        if [ -f "${ROOTDIR}bin/auter" ]; then
+                            UNATTENDED_UPGRADES_TOOL="auter"
+                            UNATTENDED_UPGRADES_TOOLKIT=1
+                            LogText "Result: found ${UNATTENDED_UPGRADES_TOOL}"
+                            Report "unattended_upgrade_tool[]=${UNATTENDED_UPGRADES_TOOL}"
+                        fi
+                        if [ -f "${ROOTDIR}sbin/yum-cron" ]; then
+                            UNATTENDED_UPGRADES_TOOL="yum-cron"
+                            UNATTENDED_UPGRADES_TOOLKIT=1
+                            LogText "Result: found ${UNATTENDED_UPGRADES_TOOL}"
+                            Report "unattended_upgrade_tool[]=${UNATTENDED_UPGRADES_TOOL}"
+                        fi
+                        if [ -f "${ROOTDIR}usr/bin/dnf-automatic" ]; then
+                            UNATTENDED_UPGRADES_TOOL="dnf-automatic"
+                            UNATTENDED_UPGRADES_TOOLKIT=1
+                            LogText "Result: found ${UNATTENDED_UPGRADES_TOOL}"
+                            Report "unattended_upgrade_tool[]=${UNATTENDED_UPGRADES_TOOL}"
+                        fi
+                        if [ -f "${ROOTDIR}usr/bin/unattended-upgrade" ]; then
+                            UNATTENDED_UPGRADES_TOOL="unattended-upgrade"
+                            UNATTENDED_UPGRADES_TOOLKIT=1
+                            LogText "Result: found ${UNATTENDED_UPGRADES_TOOL}"
+                            Report "unattended_upgrade_tool[]=${UNATTENDED_UPGRADES_TOOL}"
+                        fi
+                    ;;
+                esac
+            ;;
+        esac
+
+        if [ ${UNATTENDED_UPGRADES_OPTION_AVAILABLE} -eq 1 ]; then
+            if [ ${UNATTENDED_UPGRADES_TOOLKIT} -eq 1 ]; then
+                AddHP 5 5
+                Display --indent 2 --text "- Toolkit for automatic upgrades (${UNATTENDED_UPGRADES_TOOL})" --result "${STATUS_FOUND}" --color GREEN
+            else
+                AddHP 1 5
+                Display --indent 2 --text "- Toolkit for automatic upgrades" --result "${STATUS_NOTFOUND}" --color YELLOW
+                LogText "Result: no toolkit for automatic updates discovered"
+                ReportSuggestion "${TEST_NO}" "Consider using a tool to automatically apply upgrades"
+            fi
         fi
 
+        Report "unattended_upgrade_option_avaiable=${UNATTENDED_UPGRADES_OPTION_AVAILABLE}"
     fi
 #
 #################################################################################

From d0df518426dd3ddb6f36bce86140e15c8e65ee81 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 30 Mar 2019 13:58:23 +0100
Subject: [PATCH 060/679] [PKGS-7420] corrected typo

---
 include/tests_ports_packages | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 9798a9b7..09243391 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -1334,7 +1334,7 @@
             fi
         fi
 
-        Report "unattended_upgrade_option_avaiable=${UNATTENDED_UPGRADES_OPTION_AVAILABLE}"
+        Report "unattended_upgrade_option_available=${UNATTENDED_UPGRADES_OPTION_AVAILABLE}"
     fi
 #
 #################################################################################

From 7b7086566da4b677470c13d65261719582a6bca5 Mon Sep 17 00:00:00 2001
From: Capashenn <37273010+Capashenn@users.noreply.github.com>
Date: Tue, 2 Apr 2019 07:46:04 +0200
Subject: [PATCH 061/679] Add test FILE-6324 check XFS file systems (#699)

---
 include/tests_filesystems | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/include/tests_filesystems b/include/tests_filesystems
index a52bb66b..e1be0a1f 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -163,6 +163,28 @@
     fi
 #
 #################################################################################
+#
+    # Test        : FILE-6324
+    # Description : Checking Linux XFS file systems
+    Register --test-no FILE-6324 --os Linux --weight L --network NO --category security --description "Checking XFS file systems"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: Checking for Linux XFS file systems"
+        FIND=$(${MOUNTBINARY} -t xfs | ${AWKBINARY} '{ print $3","$5 }')
+        if [ ! -z "${FIND}" ]; then
+            LogText "Result: found one or more XFS file systems"
+            for I in ${FIND}; do
+                FILESYSTEM=$(echo ${I} | ${CUTBINARY} -d ',' -f1)
+                FILETYPE=$(echo ${I} | ${CUTBINARY} -d ',' -f2)
+                LogText "File system: ${FILESYSTEM} (type: ${FILETYPE})"
+                Report "file_systems_xfs[]=${FILESYSTEM}|${FILETYPE}|"
+            done
+        else
+            LogText "Result: no XFS file systems found"
+            Report "file_systems_xfs[]=none"
+        fi
+    fi
+#
+#################################################################################
 #
     # Test        : FILE-6329
     # Description : Query all FFS/UFS mounts from /etc/fstab

From 2c83037cbad67885e85289cbffca8875330fc16c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 2 Apr 2019 07:58:10 +0200
Subject: [PATCH 062/679] Minor cleanup

---
 include/tests_filesystems | 2 --
 1 file changed, 2 deletions(-)

diff --git a/include/tests_filesystems b/include/tests_filesystems
index e1be0a1f..43b9e7ec 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -158,7 +158,6 @@
             done
         else
             LogText "Result: no EXT file systems found"
-            Report "file_systems_ext[]=none"
         fi
     fi
 #
@@ -180,7 +179,6 @@
             done
         else
             LogText "Result: no XFS file systems found"
-            Report "file_systems_xfs[]=none"
         fi
     fi
 #

From f2e6b23c9f0ce432cd55e48f52e60c9e06263097 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 2 Apr 2019 11:14:49 +0200
Subject: [PATCH 063/679] Added PKGS-7420

---
 db/tests.db | 1 +
 1 file changed, 1 insertion(+)

diff --git a/db/tests.db b/db/tests.db
index 641ea927..24023cd2 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -319,6 +319,7 @@ PKGS-7393:test:security:ports_packages::Check for Gentoo vulnerable packages:
 PKGS-7394:test:security:ports_packages:Linux:Check for Ubuntu updates:
 PKGS-7398:test:security:ports_packages::Check for package audit tool:
 PKGS-7410:test:security:ports_packages::Count installed kernel packages:
+PKGS-7420:test:security:ports_packages::Detect toolkit to automatically download and apply upgrades:
 PRNT-2302:test:security:printers_spools:FreeBSD:Check for printcap consistency:
 PRNT-2304:test:security:printers_spools::Check cupsd status:
 PRNT-2306:test:security:printers_spools::Check CUPSd configuration file:

From 349f011489f56237f42912847de35cfbb7bd114b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 2 Apr 2019 11:14:56 +0200
Subject: [PATCH 064/679] Updated log

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8eedb146..88fbf8d8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 ## Lynis 2.7.4 (not released yet)
 
+### Added
+- FILE-6324 - Discover XFS mount points
+
 ### Changed
 - AUTH-9278 - Test LDAP in all PAM components on Red Hat and other systems
 - PKGS-7410 - Add support for DPKG-based systems to gather installed kernel packages

From e0ca517aaa88e6954a1b3cda79f2cb5b70a12c7b Mon Sep 17 00:00:00 2001
From: Capashenn <37273010+Capashenn@users.noreply.github.com>
Date: Tue, 2 Apr 2019 11:15:31 +0200
Subject: [PATCH 065/679] Add tests INSE-8310 INSE-8312 (telnet) (#693)

* Add test INSE-8000

* Add xinetd support in insecure_services

* fix issue #662

* Check for talk via xinetd

* Check for chargen via xinetd

* Check for daytime via xinetd

* Check discard via xinetd

* Check echo via xinatd

* Check time via xinetd

* Check tftp via xinetd

* Check rsync via xinetd

* Add test INSE-8200

* Add test INSE-8300 INSE-8302 INSE-8304 (rsh)

* Add tests INSE-8310 INSE-8312 (telnet)
---
 include/tests_insecure_services | 629 +++++++++++++++++++++++++++++++-
 1 file changed, 628 insertions(+), 1 deletion(-)

diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index 277791d9..9490fa32 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -18,7 +18,7 @@
 #
 #################################################################################
 #
-# Unsecure services
+# Insecure services
 #
 #################################################################################
 #
@@ -28,6 +28,28 @@
 #
     INETD_ACTIVE=0
     INETD_CONFIG_FILE="${ROOTDIR}etc/inetd.conf"
+    XINETD_ACTIVE=0
+    XINETD_CONFIG_FILE="${ROOTDIR}etc/xinetd.conf"
+    XINETD_CONFIG_DIR="${ROOTDIR}etc/xinetd.d"
+#
+#################################################################################
+#
+    # Test        : INSE-8000
+    # Description : Check for installed inetd daemon
+    Register --test-no INSE-8000 --weight L --network NO --category security --description "Check for installed inetd daemon"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        # Check for installed inetd daemon
+        LogText "Test: Checking if inetd is installed"
+        PackageIsInstalled inetd
+        if [ $? -eq 0 ]; then
+            LogText "Result: inetd is installed"
+            Display --indent 2 --text "- Checking inetd installation" --result "${STATUS_SUGGESTION}" --color YELLOW
+            ReportSuggestion ${TEST_NO} "If there are no inetd services required, it is recommended that the daemon be removed"
+        else
+            LogText "Result: inetd is NOT installed"
+            Display --indent 2 --text "- Checking inetd installation" --result "${STATUS_OK}" --color GREEN
+        fi
+    fi
 #
 #################################################################################
 #
@@ -108,6 +130,611 @@
     fi
 #
 #################################################################################
+#
+    # Test        : INSE-8100
+    # Description : Check for installed xinetd daemon
+    Register --test-no INSE-8100 --weight L --network NO --category security --description "Check for installed xinetd daemon"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        # Check for installed xinetd daemon
+        LogText "Test: Checking for installed xinetd daemon"
+        PackageIsInstalled xinetd
+        if [ $? -eq 0 ]; then
+            LogText "Result: xinetd is installed"
+            Display --indent 2 --text "- Checking xinetd installation" --result "${STATUS_SUGGESTION}" --color YELLOW
+            ReportSuggestion ${TEST_NO} "If there are no xinetd services required, it is recommended that the daemon be removed"
+        else
+            LogText "Result: xinetd is NOT installed"
+            Display --indent 2 --text "- Checking xinetd installation" --result "${STATUS_OK}" --color GREEN
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8102
+    # Description : Check for xinetd status
+    Register --test-no INSE-8102 --weight L --network NO --category security --description "Check for enabled xinet daemon"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        # Check running processes
+        LogText "Test: Searching for active xinet daemon"
+        IsRunning xinetd
+        if [ ${RUNNING} -eq 1 ]; then
+            LogText "Result: xinetd is running"
+            Display --indent 4 --text "- Checking xinetd status" --result "ACTIVE" --color GREEN
+            XINETD_ACTIVE=1
+        else
+            LogText "Result: xinetd is NOT running"
+            Display --indent 4 --text "- Checking xinetd status" --result "NOT ACTIVE" --color GREEN
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8104
+    # Description : Check for xinetd configuration file
+    if [ ${XINETD_ACTIVE} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8104 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for enabled xinet daemon"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        # Check configuration file
+        LogText "Test: Searching for file ${XINETD_CONFIG_FILE}"
+        if [ -f ${XINETD_CONFIG_FILE} ]; then
+            LogText "Result: ${XINETD_CONFIG_FILE} exists"
+            Display --indent 6 --text "- Checking xinetd.conf" --result "${STATUS_FOUND}" --color WHITE
+        else
+            LogText "Result: ${XINETD_CONFIG_FILE} does not exist"
+            Display --indent 6 --text "- Checking xinetd.conf" --result "${STATUS_NOT_FOUND}" --color WHITE
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8106
+    # Description : Check for xinetd configuration file contents if xinetd is NOT active
+    if [ ${XINETD_ACTIVE} -eq 0 -a -f ${XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8106 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check configuration of xinetd when disabled"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        # Check if any service is enabled in /etc/xinetd.d (xinetd is not active, see test 8102)
+        LogText "Test: check if all services are disabled if xinetd is disabled"
+        FIND=$(${GREPBINARY} -r "disable\s*=\s*no" ${XINETD_CONFIG_DIR})
+        if [ -z "${FIND}" ]; then
+            LogText "Result: no services found in ${XINETD_CONFIG_DIR}"
+            Display --indent 6 --text "- Checking xinetd.d services" --result "${STATUS_OK}" --color GREEN
+        else
+            LogText "Result: found services in ${XINETD_CONFIG_DIR}, even though xinetd is not running"
+            Display --indent 6 --text "- Checking xinetd.d services" --result "${STATUS_SUGGESTION}" --color YELLOW
+            ReportSuggestion ${TEST_NO} "Although xinetd is not running, make sure no services are enabled in ${XINETD_CONFIG_DIR}, or remove xinetd service"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8116
+    # Description : Check for telnet enabled via xinetd
+    TELNET_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/telnet"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${TELNET_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8116 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for telnet via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking telnet presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${TELNET_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: telnet not enabled in ${TELNET_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (telnet)" --result "${STATUS_DISABLED}" --color GREEN
+            AddHP 3 3
+        else
+            LogText "Result: telnet enabled in ${TELNET_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (telnet)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable telnet in xinetd configuration and use SSH instead"
+            AddHP 1 3
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8118
+    # Description : Check for rsh enabled via xinetd
+    RSH_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/rsh"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${RSH_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8118 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for rsh via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking rsh presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${RSH_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: rsh not enabled in ${RSH_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (rsh)" --result "${STATUS_DISABLED}" --color GREEN
+            AddHP 3 3
+        else
+            LogText "Result: rsh enabled in ${RSH_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (rsh)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable rsh in xinetd configuration and use SSH instead"
+            AddHP 1 3
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8120
+    # Description : Check for rlogin enabled via xinetd
+    RLOGIN_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/rlogin"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${RLOGIN_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8120 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for rlogin via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking rlogin presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${RLOGIN_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: rlogin not enabled in ${RLOGIN_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (rlogin)" --result "${STATUS_DISABLED}" --color GREEN
+            AddHP 3 3
+        else
+            LogText "Result: rlogin enabled in ${RLOGIN_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (rlogin)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable rlogin in xinetd configuration and use SSH instead"
+            AddHP 1 3
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8122
+    # Description : Check for rexec enabled via xinetd
+    REXEC_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/rexec"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${REXEC_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8122 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for rexec via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking rexec presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${REXEC_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: rexec not enabled in ${REXEC_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (rexec)" --result "${STATUS_DISABLED}" --color GREEN
+            AddHP 3 3
+        else
+            LogText "Result: rexec enabled in ${REXEC_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (rexec)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable rexec in xinetd configuration and use SSH instead"
+            AddHP 1 3
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8124
+    # Description : Check for talk enabled via xinetd
+    TALK_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/talk"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${TALK_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8124 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for talk via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking talk presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${TALK_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: talk not enabled in ${TALK_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (talk)" --result "${STATUS_DISABLED}" --color GREEN
+        else
+            LogText "Result: talk enabled in ${TALK_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (talk)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable talk in xinetd configuration"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8126
+    # Description : Check for ntalk enabled via xinetd
+    NTALK_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/ntalk"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${NTALK_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8126 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for ntalk via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking ntalk presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${NTALK_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: ntalk not enabled in ${NTALK_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (ntalk)" --result "${STATUS_DISABLED}" --color GREEN
+        else
+            LogText "Result: ntalk enabled in ${NTALK_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (ntalk)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable ntalk in xinetd configuration"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8128
+    # Description : Check for chargen-dgram enabled via xinetd
+    CHARGEN_DGRAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/chargen-dgram"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${CHARGEN_DGRAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8128 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for chargen-dgram via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking chargen-dgram presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${CHARGEN_DGRAM_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: chargen-dgram not enabled in ${CHARGEN_DGRAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (chargen-dgram)" --result "${STATUS_DISABLED}" --color GREEN
+        else
+            LogText "Result: chargen-dgram enabled in ${CHARGEN_DGRAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (chargen-dgram)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable chargen-dgram in xinetd configuration"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8130
+    # Description : Check for chargen-stream enabled via xinetd
+    CHARGEN_STREAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/chargen-stream"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${CHARGEN-STREAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8130 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for chargen-stream via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking chargen-stream presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${CHARGEN_STREAM_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: chargen-stream not enabled in ${CHARGEN_STREAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (chargen-stream)" --result "${STATUS_DISABLED}" --color GREEN
+        else
+            LogText "Result: chargen-stream enabled in ${CHARGEN_STREAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (chargen-stream)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable chargen-stream in xinetd configuration"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8132
+    # Description : Check for daytime-dgram enabled via xinetd
+    DAYTIME_DGRAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/daytime-dgram"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${DAYTIME_DGRAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8132 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for daytime-dgram via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking daytime-dgram presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${DAYTIME_DGRAM_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: daytime-dgram not enabled in ${DAYTIME_DGRAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (daytime-dgram)" --result "${STATUS_DISABLED}" --color GREEN
+        else
+            LogText "Result: daytime-dgram enabled in ${DAYTIME_DGRAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (daytime-dgram)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable daytime-dgram in xinetd configuration"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8134
+    # Description : Check for daytime-stream enabled via xinetd
+    DAYTIME_STREAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/daytime-stream"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${DAYTIME_STREAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8134 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for daytime-stream via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking daytime-stream presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${DAYTIME_STREAM_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: daytime-stream not enabled in ${DAYTIME_STREAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (daytime-stream)" --result "${STATUS_DISABLED}" --color GREEN
+        else
+            LogText "Result: daytime-stream enabled in ${DAYTIME_STREAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (daytime-stream)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable daytime-stream in xinetd configuration"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8136
+    # Description : Check for discard-dgram enabled via xinetd
+    DISCARD_DGRAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/discard-dgram"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${DISCARD_DGRAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8136 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for discard-dgram via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking discard-dgram presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${DISCARD_DGRAM_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: discard-dgram not enabled in ${DISCARD_DGRAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (discard-dgram)" --result "${STATUS_DISABLED}" --color GREEN
+        else
+            LogText "Result: discard-dgram enabled in ${DISCARD_DGRAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (discard-dgram)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable discard-dgram in xinetd configuration"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8138
+    # Description : Check for discard-stream enabled via xinetd
+    DISCARD_STREAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/discard-stream"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${DISCARD_STREAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8138 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for discard-stream via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking discard-stream presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${DISCARD_STREAM_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: discard-stream not enabled in ${DISCARD_STREAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (discard-stream)" --result "${STATUS_DISABLED}" --color GREEN
+        else
+            LogText "Result: discard-stream enabled in ${DISCARD_STREAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (discard-stream)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable discard-stream in xinetd configuration"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8140
+    # Description : Check for echo-dgram enabled via xinetd
+    ECHO_DGRAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/echo-dgram"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${ECHO_DGRAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8140 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for echo-dgram via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking echo-dgram presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${ECHO_DGRAM_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: echo-dgram not enabled in ${ECHO_DGRAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (echo-dgram)" --result "${STATUS_DISABLED}" --color GREEN
+        else
+            LogText "Result: echo-dgram enabled in ${ECHO_DGRAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (echo-dgram)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable echo-dgram in xinetd configuration"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8142
+    # Description : Check for echo-stream enabled via xinetd
+    ECHO_STREAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/echo-stream"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${ECHO_STREAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8142 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for echo-stream via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking echo-stream presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${ECHO_STREAM_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: echo-stream not enabled in ${ECHO_STREAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (echo-stream)" --result "${STATUS_DISABLED}" --color GREEN
+        else
+            LogText "Result: echo-stream enabled in ${ECHO_STREAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (echo-stream)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable echo-stream in xinetd configuration"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8144
+    # Description : Check for time-dgram enabled via xinetd
+    TIME_DGRAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/time-dgram"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${TIME_DGRAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8144 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for time-dgram via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking time-dgram presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${TIME_DGRAM_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: time-dgram not enabled in ${TIME_DGRAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (time-dgram)" --result "${STATUS_DISABLED}" --color GREEN
+        else
+            LogText "Result: time-dgram enabled in ${TIME_DGRAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (time-dgram)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable time-dgram in xinetd configuration"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8146
+    # Description : Check for time-stream enabled via xinetd
+    TIME_STREAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/time-stream"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${TIME_STREAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8146 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for time-stream via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking time-stream presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${TIME_STREAM_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: time-stream not enabled in ${TIME_STREAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (time-stream)" --result "${STATUS_DISABLED}" --color GREEN
+        else
+            LogText "Result: time-stream enabled in ${TIME_STREAM_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (time-stream)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable time-stream in xinetd configuration"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8148
+    # Description : Check for tftp enabled via xinetd
+    TFTP_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/tftp"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${TFTP_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8148 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for tftp via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking tftp presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${TFTP_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: tftp not enabled in ${TFTP_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (tftp)" --result "${STATUS_DISABLED}" --color GREEN
+            AddHP 3 3
+        else
+            LogText "Result: tftp enabled in ${TFTP_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (tftp)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable tftp in xinetd configuration"
+            AddHP 1 3
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8150
+    # Description : Check for rsync enabled via xinetd
+    RSYNC_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/rsync"
+    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${RSYNC_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8150 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for rsync via xinetd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: checking rsync presence in xinetd configuration"
+        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${RSYNC_XINETD_CONFIG_FILE})
+        if [ "${FIND}" = "" ]; then
+            LogText "Result: rsync not enabled in ${RSYNC_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (rsync)" --result "${STATUS_DISABLED}" --color GREEN
+        else
+            LogText "Result: rsync enabled in ${RSYNC_XINETD_CONFIG_FILE}"
+            Display --indent 6 --text "- Checking xinetd (rsync)" --result "${STATUS_ENABLED}" --color RED
+            ReportSuggestion "${TEST_NO}" "Disable rsync in xinetd configuration"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8200
+    # Description : Check if tcp_wrappers is installed when inetd/xinetd is active
+    if [ ${INETD_ACTIVE} -eq 1 -o ${XINETD_ACTIVE} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8200 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check if tcp_wrappers is installed when inetd/xinetd is active"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        # Check if tcp_wrappers is installed when inetd/xinetd is active
+        LogText "Test: Checking if tcp_wrappers is installed"
+        FOUND=""
+        PACKAGES="tcp_wrappers tcpd"
+        for PACKAGE in ${PACKAGES}; do
+            PackageIsInstalled ${PACKAGE}
+            if [ $? -eq 0 ];then
+                FOUND=${PACKAGE}
+            fi
+        done
+        if [ ${FOUND} ]; then
+            LogText "Result: tcp_wrappers is installed"
+            Display --indent 2 --text "- Checking tcp_wrappers installation" --result "${STATUS_OK}" --color GREEN
+        else
+            LogText "Result: tcp_wrappers is NOT installed"
+            Display --indent 2 --text "- Checking tcp_wrappers installation" --result "${STATUS_SUGGESTION}" --color YELLOW
+            ReportSuggestion ${TEST_NO} "When network services are using the inetd/xinetd service, the tcp_wrappers package should be installed"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8300
+    # Description : Check if rsh client is installed
+    Register --test-no INSE-8300 --weight L --network NO --category security --description "Check if rsh client is installed"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        # Check if rsh is installed
+        LogText "Test: Checking if rsh client is installed"
+        FOUND=""
+        PACKAGES="rsh rsh-client rsh-redone-client"
+        for PACKAGE in ${PACKAGES}; do
+            PackageIsInstalled ${PACKAGE}
+            if [ $? -eq 0 ];then
+                FOUND=${PACKAGE}
+            fi
+        done
+        if [ ${FOUND} ]; then
+            LogText "Result: rsh client is installed"
+            Display --indent 2 --text "- Checking rsh client installation" --result "${STATUS_SUGGESTION}" --color YELLOW
+            ReportSuggestion ${TEST_NO} "Rsh client contain numerous security exposures and have been replaced with the more secure SSH package"
+        else
+            LogText "Result: rsh client is NOT installed"
+            Display --indent 2 --text "- Checking rsh client installation" --result "${STATUS_OK}" --color GREEN
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8302
+    # Description : Check presence of Rsh Trust Files
+    Register --test-no INSE-8302 --weight L --network NO --category security --description "Check presence of Rsh Trust Files"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        # Check presence of Rsh Trust Files
+        FOUND=0
+        for LINE in $(${CAT_BINARY} /etc/passwd | ${EGREPBINARY} -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }'); do
+            USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
+            DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
+                if [ -d ${DIR} ]; then
+                    for RHOSTS in ${DIR}/.rhosts; do
+                        if [ ! -h ${RHOSTS} -a -f ${RHOSTS} ]; then
+                            LogText "FOUND .rhosts file in home directory ${DIR} of ${USER}"
+                            FOUND=1
+                        fi
+                    done
+                fi
+        done
+        if [ -f /etc/hosts.equiv ];then
+            LogText "FOUND /etc/hosts.equiv"
+            FOUND=1
+        fi
+        if [ ${FOUND} -eq 1 ]; then
+            LogText "Result: found one or more Rsh Trust Files"
+            Display --indent 4 --text "- Checking presence of Rsh Trust Files" --result "${STATUS_SUGGESTION}" --color YELLOW
+            ReportSuggestion ${TEST_NO} "Remove every Rsh Trust Files as they can allow unauthenticated access to a system"
+        else
+            LogText "Result: no Rsh Trust Files found"
+            Display --indent 4 --text "- Checking presence of Rsh Trust Files" --result "${STATUS_OK}" --color GREEN
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8304
+    # Description : Check if rsh server is installed
+    Register --test-no INSE-8342 --weight L --network NO --category security --description "Check if rsh server is installed"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        # Check if rsh server is installed
+        LogText "Test: Checking if rsh server is installed"
+        FOUND=""
+        PACKAGES="rsh-server rsh-redone-server"
+        for PACKAGE in ${PACKAGES}; do
+            PackageIsInstalled ${PACKAGE}
+            if [ $? -eq 0 ];then
+                FOUND=${PACKAGE}
+            fi
+        done
+        if [ ${FOUND} ]; then
+            LogText "Result: rsh server is installed"
+            Display --indent 2 --text "- Checking rsh server installation" --result "${STATUS_SUGGESTION}" --color YELLOW
+            ReportSuggestion ${TEST_NO} "Removing the rsh-server package decreases the risk of the accidental (or intentional) activation of rsh services"
+            
+        else
+            LogText "Result: rsh server is NOT installed"
+            Display --indent 2 --text "- Checking rsh server installation" --result "${STATUS_OK}" --color GREEN
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8310
+    # Description : Check if telnet client is installed
+    Register --test-no INSE-8310 --weight L --network NO --category security --description "Check if telnet client is installed"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        # Check if telnet client is installed
+        LogText "Test: Checking if telnet client is installed"
+        PackageIsInstalled telnet
+        if [ $? -eq 0 ]; then
+            LogText "Result: telnet client is installed"
+            Display --indent 2 --text "- Checking telnet client installation" --result "${STATUS_SUGGESTION}" --color YELLOW
+            ReportSuggestion ${TEST_NO} "telnet client contain numerous security exposures and have been replaced with the more secure SSH package"
+        else
+            LogText "Result: telnet client is NOT installed"
+            Display --indent 2 --text "- Checking telnet client installation" --result "${STATUS_OK}" --color GREEN
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8312
+    # Description : Check if telnet server is installed
+    Register --test-no INSE-8322 --weight L --network NO --category security --description "Check if telnet server is installed"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        # Check if TFTP server is installed
+        LogText "Test: Checking if telnet server is installed"
+        FOUND=""
+        PACKAGES="telnetd telnet-server"
+        for PACKAGE in ${PACKAGES}; do
+            PackageIsInstalled ${PACKAGE}
+            if [ $? -eq 0 ];then
+                FOUND=${PACKAGE}
+            fi
+        done
+        if [ ${FOUND} ]; then
+            LogText "Result: telnet server is installed"
+            Display --indent 2 --text "- Checking telnet server installation" --result "${STATUS_SUGGESTION}" --color YELLOW
+            ReportSuggestion ${TEST_NO} "Removing the ${FOUND} package decreases the risk of the accidental (or intentional) activation of telnet services"
+        else
+            LogText "Result: telnet server is NOT installed"
+            Display --indent 2 --text "- Checking telnet server installation" --result "${STATUS_OK}" --color GREEN
+        fi
+    fi
+#
+#################################################################################
 #
     if [ ! -z "${LAUNCHCTL_BINARY}" ]; then PREQS_MET="YES"; SKIPREASON=""; else PREQS_MET="NO"; SKIPREASON="No launchctl binary on this system"; fi
     Register --test-no INSE-8050 --os "macOS" --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight M --network NO --category security --description "Check for insecure services on macOS"

From 247eb7d9a6bc50fa06ac33d3a118d79f7b24cc2c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 3 Apr 2019 12:46:03 +0200
Subject: [PATCH 066/679] Corrected if-statement

---
 include/functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/functions b/include/functions
index 95083600..e8965986 100644
--- a/include/functions
+++ b/include/functions
@@ -1717,7 +1717,7 @@
         if [ ! -z "${RPMBINARY}" ]; then
             output=$(${RPMBINARY} --quiet -q ${package} 2> /dev/null)
             exit_code=$?
-        elif ! -z "${DPKGBINARY}" ]; then
+        elif [ ! -z "${DPKGBINARY}" ]; then
             output=$(${DPKGBINARY} -l ${package} 2> /dev/null)
             exit_code=$?
         elif [ ! -z "${ZYPPERBINARY}" ]; then

From 28fd5948f7cc4d7d4f9119a60389da084a45e109 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 4 Apr 2019 14:41:56 +0200
Subject: [PATCH 067/679] Updated log

---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 88fbf8d8..664b52cf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,14 @@
 
 ### Added
 - FILE-6324 - Discover XFS mount points
+- INSE-8000 - Installed inetd package
+- INSE-8100 - Installed xinetd package
+- INSE-8102 - Status of xinet daemon
+- INSE-8104 - xinetd configuration file
+- INSE-8106 - xinetd configuration for inactive daemon
+- INSE-8200 - Usage of TCP wrappers
+- INSE-8300 - Presence of rsh client
+- INSE-8302 - Presence of rsh server
 
 ### Changed
 - AUTH-9278 - Test LDAP in all PAM components on Red Hat and other systems

From 7ebfd3015c4daa41607f6aaf9e435ff74332ad29 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 4 Apr 2019 14:42:06 +0200
Subject: [PATCH 068/679] Added new tests

---
 db/tests.db | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/db/tests.db b/db/tests.db
index 24023cd2..215c3595 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -169,11 +169,17 @@ HTTP-6712:test:security:webservers::Check nginx access logging:
 HTTP-6714:test:security:webservers::Check for missing error logs in nginx:
 HTTP-6716:test:security:webservers::Check for debug mode on error log in nginx:
 HTTP-6720:test:security:webservers::Check Nginx log files:
-INSE-8002:test:security:insecure_services::Check for enabled inet daemon:
-INSE-8004:test:security:insecure_services::Check for enabled inet daemon:
-INSE-8006:test:security:insecure_services::Check configuration of inetd when disabled:
+INSE-8000:test:security:insecure_services::Installed inetd package:
+INSE-8002:test:security:insecure_services::Status of inet daemon:
+INSE-8004:test:security:insecure_services::Presence of inetd configuration file:
+INSE-8006:test:security:insecure_services::Check configuration of inetd when it is disabled:
 INSE-8016:test:security:insecure_services::Check for telnet via inetd:
 INSE-8050:test:security:insecure_services:MacOS:Check for insecure services on macOS systems:
+INSE-8100:test:security:insecure_services::Installed xinetd package:
+INSE-8116:test:security:insecure_services::Insecure services enabled via xinetd:
+INSE-8200:test:security:insecure_services::Usage of TCP wrappers:
+INSE-8300:test:security:insecure_services::Presence of rsh client:
+INSE-8302:test:security:insecure_services::Presence of rsh server:
 KRNL-5622:test:security:kernel:Linux:Determine Linux default run level:
 KRNL-5677:test:security:kernel:Linux:Check CPU options and support:
 KRNL-5695:test:security:kernel:Linux:Determine Linux kernel version and release number:

From 99362242784c9efd25b84b38a347f10933af1e1a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 4 Apr 2019 14:42:39 +0200
Subject: [PATCH 069/679] Merge of several tests, cleanup, minor code
 enhancements and restructure

---
 include/tests_insecure_services | 589 ++++++++------------------------
 1 file changed, 134 insertions(+), 455 deletions(-)

diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index 9490fa32..afed850e 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -28,6 +28,7 @@
 #
     INETD_ACTIVE=0
     INETD_CONFIG_FILE="${ROOTDIR}etc/inetd.conf"
+    INETD_PACKAGE_INSTALLED=0
     XINETD_ACTIVE=0
     XINETD_CONFIG_FILE="${ROOTDIR}etc/xinetd.conf"
     XINETD_CONFIG_DIR="${ROOTDIR}etc/xinetd.d"
@@ -35,19 +36,19 @@
 #################################################################################
 #
     # Test        : INSE-8000
-    # Description : Check for installed inetd daemon
-    Register --test-no INSE-8000 --weight L --network NO --category security --description "Check for installed inetd daemon"
+    # Description : Check for installed inetd package
+    Register --test-no INSE-8000 --weight L --network NO --category security --description "Installed inetd package"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check for installed inetd daemon
         LogText "Test: Checking if inetd is installed"
-        PackageIsInstalled inetd
-        if [ $? -eq 0 ]; then
+        if PackageIsInstalled "inetd"; then
+            INETD_PACKAGE_INSTALLED=1
             LogText "Result: inetd is installed"
-            Display --indent 2 --text "- Checking inetd installation" --result "${STATUS_SUGGESTION}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "If there are no inetd services required, it is recommended that the daemon be removed"
+            Display --indent 2 --text "- Installation of inetd package" --result "${STATUS_FOUND}" --color YELLOW
+            #ReportSuggestion ${TEST_NO} "If there are no inetd services required, it is recommended that the daemon be removed"
         else
             LogText "Result: inetd is NOT installed"
-            Display --indent 2 --text "- Checking inetd installation" --result "${STATUS_OK}" --color GREEN
+            Display --indent 2 --text "- Installation of inetd package" --result "${STATUS_NOT_FOUND}" --color GREEN
         fi
     fi
 #
@@ -55,27 +56,27 @@
 #
     # Test        : INSE-8002
     # Description : Check for inetd status
-    Register --test-no INSE-8002 --weight L --network NO --category security --description "Check for enabled inet daemon"
+    if [ ${INETD_PACKAGE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8002 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for enabled inet daemon"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check running processes
         LogText "Test: Searching for active inet daemon"
-        IsRunning inetd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "inetd"; then
             LogText "Result: inetd is running"
-            Display --indent 2 --text "- Checking inetd status" --result "ACTIVE" --color GREEN
+            Display --indent 4 --text "- inetd status" --result "ACTIVE" --color GREEN
             INETD_ACTIVE=1
         else
             LogText "Result: inetd is NOT running"
-            Display --indent 2 --text "- Checking inetd status" --result "NOT ACTIVE" --color GREEN
+            Display --indent 4 --text "- inetd status" --result "NOT ACTIVE" --color GREEN
         fi
     fi
 #
 #################################################################################
 #
     # Test        : INSE-8004
-    # Description : Check for inetd configuration file
+    # Description : Check for inetd configuration file (inetd)
     if [ ${INETD_ACTIVE} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8004 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for enabled inet daemon"
+    Register --test-no INSE-8004 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Presence of inetd configuration file"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check configuration file
         LogText "Test: Searching for file ${INETD_CONFIG_FILE}"
@@ -95,15 +96,15 @@
     if [ ${INETD_ACTIVE} -eq 0 -a -f ${INETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no INSE-8006 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check configuration of inetd when disabled"
     if [ ${SKIPTEST} -eq 0 ]; then
-        # Check if any service is enabled in /etc/inetd.conf (inetd is not active, see test 8002)
-        LogText "Test: check if all services are disabled if inetd is disabled"
+        # Check if any service is enabled in /etc/inetd.conf (inetd is not active, see test INSE-8002)
+        LogText "Test: check if all services are disabled when inetd is disabled"
         FIND=$(${GREPBINARY} -v "^#" ${INETD_CONFIG_FILE} | ${GREPBINARY} -v "^$")
         if [ -z "${FIND}" ]; then
             LogText "Result: no services found in ${INETD_CONFIG_FILE}"
-            Display --indent 4 --text "- Checking inetd.conf services" --result "${STATUS_OK}" --color GREEN
+            Display --indent 4 --text "- Checking enabled inetd services" --result "${STATUS_OK}" --color GREEN
         else
             LogText "Result: found services in inetd, even though inetd is not running"
-            Display --indent 4 --text "- Checking inetd.conf services" --result "${STATUS_SUGGESTION}" --color YELLOW
+            Display --indent 4 --text "- Checking enabled inetd services" --result "${STATUS_SUGGESTION}" --color YELLOW
             ReportSuggestion ${TEST_NO} "Although inetd is not running, make sure no services are enabled in ${INETD_CONFIG_FILE}, or remove inetd service"
         fi
     fi
@@ -117,7 +118,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: checking telnet presence in inetd configuration"
         FIND=$(${GREPBINARY} "^telnet" ${INETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
+        if [ -z "${FIND}" ]; then
             LogText "Result: telnet not enabled in ${INETD_CONFIG_FILE}"
             Display --indent 2 --text "- Checking inetd (telnet)" --result "${STATUS_NOT_FOUND}" --color GREEN
             AddHP 3 3
@@ -140,11 +141,11 @@
         PackageIsInstalled xinetd
         if [ $? -eq 0 ]; then
             LogText "Result: xinetd is installed"
-            Display --indent 2 --text "- Checking xinetd installation" --result "${STATUS_SUGGESTION}" --color YELLOW
+            Display --indent 2 --text "- Installation of xinetd package" --result "${STATUS_FOUND}" --color YELLOW
             ReportSuggestion ${TEST_NO} "If there are no xinetd services required, it is recommended that the daemon be removed"
         else
             LogText "Result: xinetd is NOT installed"
-            Display --indent 2 --text "- Checking xinetd installation" --result "${STATUS_OK}" --color GREEN
+            Display --indent 2 --text "- Installation of xinetd package" --result "${STATUS_OK}" --color GREEN
         fi
     fi
 #
@@ -152,18 +153,17 @@
 #
     # Test        : INSE-8102
     # Description : Check for xinetd status
-    Register --test-no INSE-8102 --weight L --network NO --category security --description "Check for enabled xinet daemon"
+    Register --test-no INSE-8102 --weight L --network NO --category security --description "Check for active xinet daemon"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check running processes
-        LogText "Test: Searching for active xinet daemon"
-        IsRunning xinetd
-        if [ ${RUNNING} -eq 1 ]; then
+        LogText "Test: Searching for active extended internet services daemon (xinetd)"
+        if IsRunning "xinetd"; then
             LogText "Result: xinetd is running"
-            Display --indent 4 --text "- Checking xinetd status" --result "ACTIVE" --color GREEN
+            Display --indent 4 --text "- xinetd status" --result "ACTIVE" --color GREEN
             XINETD_ACTIVE=1
         else
             LogText "Result: xinetd is NOT running"
-            Display --indent 4 --text "- Checking xinetd status" --result "NOT ACTIVE" --color GREEN
+            Display --indent 4 --text "- xinetd status" --result "NOT ACTIVE" --color GREEN
         fi
     fi
 #
@@ -176,12 +176,12 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check configuration file
         LogText "Test: Searching for file ${XINETD_CONFIG_FILE}"
-        if [ -f ${XINETD_CONFIG_FILE} ]; then
+        if [ -f "${XINETD_CONFIG_FILE}" ]; then
             LogText "Result: ${XINETD_CONFIG_FILE} exists"
-            Display --indent 6 --text "- Checking xinetd.conf" --result "${STATUS_FOUND}" --color WHITE
+            Display --indent 6 --text "- Configuration file (xinetd.conf)" --result "${STATUS_FOUND}" --color WHITE
         else
             LogText "Result: ${XINETD_CONFIG_FILE} does not exist"
-            Display --indent 6 --text "- Checking xinetd.conf" --result "${STATUS_NOT_FOUND}" --color WHITE
+            Display --indent 6 --text "- Configuration file (xinetd.conf)" --result "${STATUS_NOT_FOUND}" --color WHITE
         fi
     fi
 #
@@ -192,15 +192,15 @@
     if [ ${XINETD_ACTIVE} -eq 0 -a -f ${XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no INSE-8106 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check configuration of xinetd when disabled"
     if [ ${SKIPTEST} -eq 0 ]; then
-        # Check if any service is enabled in /etc/xinetd.d (xinetd is not active, see test 8102)
+        # Check if any service is enabled in /etc/xinetd.d (xinetd is not active, see test INSE-8102)
         LogText "Test: check if all services are disabled if xinetd is disabled"
         FIND=$(${GREPBINARY} -r "disable\s*=\s*no" ${XINETD_CONFIG_DIR})
         if [ -z "${FIND}" ]; then
             LogText "Result: no services found in ${XINETD_CONFIG_DIR}"
-            Display --indent 6 --text "- Checking xinetd.d services" --result "${STATUS_OK}" --color GREEN
+            Display --indent 6 --text "- Enabled xinetd.d services" --result "${STATUS_NOT_FOUND}" --color GREEN
         else
             LogText "Result: found services in ${XINETD_CONFIG_DIR}, even though xinetd is not running"
-            Display --indent 6 --text "- Checking xinetd.d services" --result "${STATUS_SUGGESTION}" --color YELLOW
+            Display --indent 6 --text "- Enabled xinetd.d services" --result "${STATUS_FOUND}" --color YELLOW
             ReportSuggestion ${TEST_NO} "Although xinetd is not running, make sure no services are enabled in ${XINETD_CONFIG_DIR}, or remove xinetd service"
         fi
     fi
@@ -208,350 +208,41 @@
 #################################################################################
 #
     # Test        : INSE-8116
-    # Description : Check for telnet enabled via xinetd
-    TELNET_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/telnet"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${TELNET_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8116 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for telnet via xinetd"
+    # Description : Check for insecure services enabled via xinetd
+    if [ ${XINETD_ACTIVE} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no INSE-8116 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Insecure services enabled via xinetd"
     if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking telnet presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${TELNET_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: telnet not enabled in ${TELNET_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (telnet)" --result "${STATUS_DISABLED}" --color GREEN
+        XINETD_INSECURE_SERVICE_FOUND=0
+
+        ITEMS="chargen chargen-dgram chargen-stream daytime daytime-dgram daytime-stream discard discard-dgram discard-stream echo echo-dgram echo-stream time time-dgram time-stream ntalk rexec rlogin rsh talk telnet tftp"
+
+        for SERVICE in ${ITEMS}; do
+            LogText "Test: checking service ${SERVICE}"
+            if ! SkipAtomicTest "${TEST_NO}:${SERVICE}"; then
+                FILE="${XINETD_CONFIG_DIR}/${SERVICE}"
+                if [ -f "${FILE}" ]; then
+                    LogText "Test: checking status in xinetd configuration file (${FILE})"
+                    FIND=$(${GREPBINARY} "disable\s*=\s*no" ${FILE})
+                    if [ ! -z "${FIND}" ]; then
+                        LogText "Result: found insecure service enabled: ${SERVICE}"
+                        XINETD_INSECURE_SERVICE_FOUND=1
+                        ReportSuggestion "${TEST_NO}" "Disable or remove any insecure services in the xinetd configuration" "${SERVICE}" "text:See log file for more details"
+                        Report "insecure_service[]=${SERVICE}"
+                    fi
+                fi
+            else
+                LogText "Result: skipped, as this item is excluded using the profile"
+            fi
+        done
+
+        if [ ${XINETD_INSECURE_SERVICE_FOUND} -eq 0 ]; then
+            LogText "Result: no insecure services found in xinetd configuration"
+            Display --indent 6 --text "- Checking xinetd (insecure services)" --result "${STATUS_OK}" --color GREEN
             AddHP 3 3
         else
-            LogText "Result: telnet enabled in ${TELNET_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (telnet)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable telnet in xinetd configuration and use SSH instead"
-            AddHP 1 3
-        fi
-    fi
-#
-#################################################################################
-#
-    # Test        : INSE-8118
-    # Description : Check for rsh enabled via xinetd
-    RSH_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/rsh"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${RSH_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8118 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for rsh via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking rsh presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${RSH_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: rsh not enabled in ${RSH_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (rsh)" --result "${STATUS_DISABLED}" --color GREEN
-            AddHP 3 3
-        else
-            LogText "Result: rsh enabled in ${RSH_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (rsh)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable rsh in xinetd configuration and use SSH instead"
-            AddHP 1 3
-        fi
-    fi
-#
-#################################################################################
-#
-    # Test        : INSE-8120
-    # Description : Check for rlogin enabled via xinetd
-    RLOGIN_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/rlogin"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${RLOGIN_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8120 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for rlogin via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking rlogin presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${RLOGIN_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: rlogin not enabled in ${RLOGIN_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (rlogin)" --result "${STATUS_DISABLED}" --color GREEN
-            AddHP 3 3
-        else
-            LogText "Result: rlogin enabled in ${RLOGIN_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (rlogin)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable rlogin in xinetd configuration and use SSH instead"
-            AddHP 1 3
-        fi
-    fi
-#
-#################################################################################
-#
-    # Test        : INSE-8122
-    # Description : Check for rexec enabled via xinetd
-    REXEC_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/rexec"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${REXEC_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8122 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for rexec via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking rexec presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${REXEC_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: rexec not enabled in ${REXEC_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (rexec)" --result "${STATUS_DISABLED}" --color GREEN
-            AddHP 3 3
-        else
-            LogText "Result: rexec enabled in ${REXEC_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (rexec)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable rexec in xinetd configuration and use SSH instead"
-            AddHP 1 3
-        fi
-    fi
-#
-#################################################################################
-#
-    # Test        : INSE-8124
-    # Description : Check for talk enabled via xinetd
-    TALK_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/talk"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${TALK_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8124 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for talk via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking talk presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${TALK_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: talk not enabled in ${TALK_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (talk)" --result "${STATUS_DISABLED}" --color GREEN
-        else
-            LogText "Result: talk enabled in ${TALK_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (talk)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable talk in xinetd configuration"
-        fi
-    fi
-#
-#################################################################################
-#
-    # Test        : INSE-8126
-    # Description : Check for ntalk enabled via xinetd
-    NTALK_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/ntalk"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${NTALK_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8126 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for ntalk via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking ntalk presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${NTALK_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: ntalk not enabled in ${NTALK_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (ntalk)" --result "${STATUS_DISABLED}" --color GREEN
-        else
-            LogText "Result: ntalk enabled in ${NTALK_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (ntalk)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable ntalk in xinetd configuration"
-        fi
-    fi
-#
-#################################################################################
-#
-    # Test        : INSE-8128
-    # Description : Check for chargen-dgram enabled via xinetd
-    CHARGEN_DGRAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/chargen-dgram"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${CHARGEN_DGRAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8128 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for chargen-dgram via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking chargen-dgram presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${CHARGEN_DGRAM_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: chargen-dgram not enabled in ${CHARGEN_DGRAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (chargen-dgram)" --result "${STATUS_DISABLED}" --color GREEN
-        else
-            LogText "Result: chargen-dgram enabled in ${CHARGEN_DGRAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (chargen-dgram)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable chargen-dgram in xinetd configuration"
-        fi
-    fi
-#
-#################################################################################
-#
-    # Test        : INSE-8130
-    # Description : Check for chargen-stream enabled via xinetd
-    CHARGEN_STREAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/chargen-stream"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${CHARGEN-STREAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8130 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for chargen-stream via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking chargen-stream presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${CHARGEN_STREAM_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: chargen-stream not enabled in ${CHARGEN_STREAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (chargen-stream)" --result "${STATUS_DISABLED}" --color GREEN
-        else
-            LogText "Result: chargen-stream enabled in ${CHARGEN_STREAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (chargen-stream)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable chargen-stream in xinetd configuration"
-        fi
-    fi
-#
-#################################################################################
-#
-    # Test        : INSE-8132
-    # Description : Check for daytime-dgram enabled via xinetd
-    DAYTIME_DGRAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/daytime-dgram"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${DAYTIME_DGRAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8132 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for daytime-dgram via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking daytime-dgram presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${DAYTIME_DGRAM_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: daytime-dgram not enabled in ${DAYTIME_DGRAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (daytime-dgram)" --result "${STATUS_DISABLED}" --color GREEN
-        else
-            LogText "Result: daytime-dgram enabled in ${DAYTIME_DGRAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (daytime-dgram)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable daytime-dgram in xinetd configuration"
-        fi
-    fi
-#
-#################################################################################
-#
-    # Test        : INSE-8134
-    # Description : Check for daytime-stream enabled via xinetd
-    DAYTIME_STREAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/daytime-stream"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${DAYTIME_STREAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8134 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for daytime-stream via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking daytime-stream presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${DAYTIME_STREAM_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: daytime-stream not enabled in ${DAYTIME_STREAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (daytime-stream)" --result "${STATUS_DISABLED}" --color GREEN
-        else
-            LogText "Result: daytime-stream enabled in ${DAYTIME_STREAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (daytime-stream)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable daytime-stream in xinetd configuration"
-        fi
-    fi
-#
-#################################################################################
-#
-    # Test        : INSE-8136
-    # Description : Check for discard-dgram enabled via xinetd
-    DISCARD_DGRAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/discard-dgram"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${DISCARD_DGRAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8136 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for discard-dgram via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking discard-dgram presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${DISCARD_DGRAM_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: discard-dgram not enabled in ${DISCARD_DGRAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (discard-dgram)" --result "${STATUS_DISABLED}" --color GREEN
-        else
-            LogText "Result: discard-dgram enabled in ${DISCARD_DGRAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (discard-dgram)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable discard-dgram in xinetd configuration"
-        fi
-    fi
-#
-#################################################################################
-#
-    # Test        : INSE-8138
-    # Description : Check for discard-stream enabled via xinetd
-    DISCARD_STREAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/discard-stream"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${DISCARD_STREAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8138 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for discard-stream via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking discard-stream presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${DISCARD_STREAM_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: discard-stream not enabled in ${DISCARD_STREAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (discard-stream)" --result "${STATUS_DISABLED}" --color GREEN
-        else
-            LogText "Result: discard-stream enabled in ${DISCARD_STREAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (discard-stream)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable discard-stream in xinetd configuration"
-        fi
-    fi
-#
-#################################################################################
-#
-    # Test        : INSE-8140
-    # Description : Check for echo-dgram enabled via xinetd
-    ECHO_DGRAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/echo-dgram"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${ECHO_DGRAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8140 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for echo-dgram via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking echo-dgram presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${ECHO_DGRAM_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: echo-dgram not enabled in ${ECHO_DGRAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (echo-dgram)" --result "${STATUS_DISABLED}" --color GREEN
-        else
-            LogText "Result: echo-dgram enabled in ${ECHO_DGRAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (echo-dgram)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable echo-dgram in xinetd configuration"
-        fi
-    fi
-#
-#################################################################################
-#
-    # Test        : INSE-8142
-    # Description : Check for echo-stream enabled via xinetd
-    ECHO_STREAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/echo-stream"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${ECHO_STREAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8142 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for echo-stream via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking echo-stream presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${ECHO_STREAM_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: echo-stream not enabled in ${ECHO_STREAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (echo-stream)" --result "${STATUS_DISABLED}" --color GREEN
-        else
-            LogText "Result: echo-stream enabled in ${ECHO_STREAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (echo-stream)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable echo-stream in xinetd configuration"
-        fi
-    fi
-#
-#################################################################################
-#
-    # Test        : INSE-8144
-    # Description : Check for time-dgram enabled via xinetd
-    TIME_DGRAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/time-dgram"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${TIME_DGRAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8144 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for time-dgram via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking time-dgram presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${TIME_DGRAM_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: time-dgram not enabled in ${TIME_DGRAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (time-dgram)" --result "${STATUS_DISABLED}" --color GREEN
-        else
-            LogText "Result: time-dgram enabled in ${TIME_DGRAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (time-dgram)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable time-dgram in xinetd configuration"
-        fi
-    fi
-#
-#################################################################################
-#
-    # Test        : INSE-8146
-    # Description : Check for time-stream enabled via xinetd
-    TIME_STREAM_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/time-stream"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${TIME_STREAM_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8146 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for time-stream via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking time-stream presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${TIME_STREAM_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: time-stream not enabled in ${TIME_STREAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (time-stream)" --result "${STATUS_DISABLED}" --color GREEN
-        else
-            LogText "Result: time-stream enabled in ${TIME_STREAM_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (time-stream)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable time-stream in xinetd configuration"
-        fi
-    fi
-#
-#################################################################################
-#
-    # Test        : INSE-8148
-    # Description : Check for tftp enabled via xinetd
-    TFTP_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/tftp"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${TFTP_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8148 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for tftp via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking tftp presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${TFTP_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: tftp not enabled in ${TFTP_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (tftp)" --result "${STATUS_DISABLED}" --color GREEN
-            AddHP 3 3
-        else
-            LogText "Result: tftp enabled in ${TFTP_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (tftp)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable tftp in xinetd configuration"
-            AddHP 1 3
+            LogText "Result: one ore more insecure services discovered in xinetd configuration"
+            Display --indent 6 --text "- Checking xinetd (insecure services)" --result "${STATUS_WARNING}" --color RED
+            AddHP 0 3
         fi
     fi
 #
@@ -559,21 +250,21 @@
 #
     # Test        : INSE-8150
     # Description : Check for rsync enabled via xinetd
-    RSYNC_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/rsync"
-    if [ ${XINETD_ACTIVE} -eq 1 -a -f ${RSYNC_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8150 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for rsync via xinetd"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: checking rsync presence in xinetd configuration"
-        FIND=$(${GREPBINARY} "disable\s*=\s*no" ${RSYNC_XINETD_CONFIG_FILE})
-        if [ "${FIND}" = "" ]; then
-            LogText "Result: rsync not enabled in ${RSYNC_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (rsync)" --result "${STATUS_DISABLED}" --color GREEN
-        else
-            LogText "Result: rsync enabled in ${RSYNC_XINETD_CONFIG_FILE}"
-            Display --indent 6 --text "- Checking xinetd (rsync)" --result "${STATUS_ENABLED}" --color RED
-            ReportSuggestion "${TEST_NO}" "Disable rsync in xinetd configuration"
-        fi
-    fi
+    #RSYNC_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/rsync"
+    #if [ ${XINETD_ACTIVE} -eq 1 -a -f ${RSYNC_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    #Register --test-no INSE-8150 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for rsync via xinetd"
+    #if [ ${SKIPTEST} -eq 0 ]; then
+    #    LogText "Test: checking rsync presence in xinetd configuration"
+    #    FIND=$(${GREPBINARY} "disable\s*=\s*no" ${RSYNC_XINETD_CONFIG_FILE})
+    #    if [ "${FIND}" = "" ]; then
+    #        LogText "Result: rsync not enabled in ${RSYNC_XINETD_CONFIG_FILE}"
+    #        Display --indent 6 --text "- Checking xinetd (rsync)" --result "${STATUS_DISABLED}" --color GREEN
+    #    else
+    #        LogText "Result: rsync enabled in ${RSYNC_XINETD_CONFIG_FILE}"
+    #        Display --indent 6 --text "- Checking xinetd (rsync)" --result "${STATUS_ENABLED}" --color RED
+    #        ReportSuggestion "${TEST_NO}" "Disable rsync in xinetd configuration"
+    #    fi
+    #fi
 #
 #################################################################################
 #
@@ -582,23 +273,19 @@
     if [ ${INETD_ACTIVE} -eq 1 -o ${XINETD_ACTIVE} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no INSE-8200 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check if tcp_wrappers is installed when inetd/xinetd is active"
     if [ ${SKIPTEST} -eq 0 ]; then
-        # Check if tcp_wrappers is installed when inetd/xinetd is active
         LogText "Test: Checking if tcp_wrappers is installed"
-        FOUND=""
+        FOUND=0
         PACKAGES="tcp_wrappers tcpd"
         for PACKAGE in ${PACKAGES}; do
-            PackageIsInstalled ${PACKAGE}
-            if [ $? -eq 0 ];then
-                FOUND=${PACKAGE}
-            fi
+            if PackageIsInstalled ${PACKAGE}; then FOUND=1; fi
         done
-        if [ ${FOUND} ]; then
+        if [ ${FOUND} -eq 1 ]; then
             LogText "Result: tcp_wrappers is installed"
             Display --indent 2 --text "- Checking tcp_wrappers installation" --result "${STATUS_OK}" --color GREEN
         else
             LogText "Result: tcp_wrappers is NOT installed"
             Display --indent 2 --text "- Checking tcp_wrappers installation" --result "${STATUS_SUGGESTION}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "When network services are using the inetd/xinetd service, the tcp_wrappers package should be installed"
+            #ReportSuggestion ${TEST_NO} "When network services are using the inetd/xinetd service, the tcp_wrappers package should be installed"
         fi
     fi
 #
@@ -608,20 +295,16 @@
     # Description : Check if rsh client is installed
     Register --test-no INSE-8300 --weight L --network NO --category security --description "Check if rsh client is installed"
     if [ ${SKIPTEST} -eq 0 ]; then
-        # Check if rsh is installed
         LogText "Test: Checking if rsh client is installed"
-        FOUND=""
+        FOUND=0
         PACKAGES="rsh rsh-client rsh-redone-client"
         for PACKAGE in ${PACKAGES}; do
-            PackageIsInstalled ${PACKAGE}
-            if [ $? -eq 0 ];then
-                FOUND=${PACKAGE}
-            fi
+            if PackageIsInstalled "${PACKAGE}"; then FOUND=1; fi
         done
-        if [ ${FOUND} ]; then
+        if [ ${FOUND} -eq 1 ]; then
             LogText "Result: rsh client is installed"
             Display --indent 2 --text "- Checking rsh client installation" --result "${STATUS_SUGGESTION}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Rsh client contain numerous security exposures and have been replaced with the more secure SSH package"
+            ReportSuggestion ${TEST_NO} "Remove rsh client when it is not in use or replace with the more secure SSH package"
         else
             LogText "Result: rsh client is NOT installed"
             Display --indent 2 --text "- Checking rsh client installation" --result "${STATUS_OK}" --color GREEN
@@ -631,36 +314,36 @@
 #################################################################################
 #
     # Test        : INSE-8302
-    # Description : Check presence of Rsh Trust Files
-    Register --test-no INSE-8302 --weight L --network NO --category security --description "Check presence of Rsh Trust Files"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        # Check presence of Rsh Trust Files
-        FOUND=0
-        for LINE in $(${CAT_BINARY} /etc/passwd | ${EGREPBINARY} -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }'); do
-            USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
-            DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
-                if [ -d ${DIR} ]; then
-                    for RHOSTS in ${DIR}/.rhosts; do
-                        if [ ! -h ${RHOSTS} -a -f ${RHOSTS} ]; then
-                            LogText "FOUND .rhosts file in home directory ${DIR} of ${USER}"
-                            FOUND=1
-                        fi
-                    done
-                fi
-        done
-        if [ -f /etc/hosts.equiv ];then
-            LogText "FOUND /etc/hosts.equiv"
-            FOUND=1
-        fi
-        if [ ${FOUND} -eq 1 ]; then
-            LogText "Result: found one or more Rsh Trust Files"
-            Display --indent 4 --text "- Checking presence of Rsh Trust Files" --result "${STATUS_SUGGESTION}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Remove every Rsh Trust Files as they can allow unauthenticated access to a system"
-        else
-            LogText "Result: no Rsh Trust Files found"
-            Display --indent 4 --text "- Checking presence of Rsh Trust Files" --result "${STATUS_OK}" --color GREEN
-        fi
-    fi
+    # Description : Check presence of rsh Trust Files
+    #Register --test-no INSE-8302 --weight L --network NO --category security --description "Check presence of rsh Trust Files"
+    #if [ ${SKIPTEST} -eq 0 ]; then
+    #    # Check presence of Rsh Trust Files
+    #    FOUND=0
+    #    for LINE in $(${CAT_BINARY} /etc/passwd | ${EGREPBINARY} -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }'); do
+    #        USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
+    #        DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
+    #            if [ -d ${DIR} ]; then
+    #                for RHOSTS in ${DIR}/.rhosts; do
+    #                    if [ ! -h ${RHOSTS} -a -f ${RHOSTS} ]; then
+    #                        LogText "FOUND .rhosts file in home directory ${DIR} of ${USER}"
+    #                        FOUND=1
+    #                    fi
+    #                done
+    #            fi
+    #    done
+    #    if [ -f /etc/hosts.equiv ];then
+    #        LogText "FOUND /etc/hosts.equiv"
+    #        FOUND=1
+    #    fi
+    #    if [ ${FOUND} -eq 1 ]; then
+    #        LogText "Result: found one or more Rsh Trust Files"
+    #        Display --indent 4 --text "- Checking presence of Rsh Trust Files" --result "${STATUS_SUGGESTION}" --color YELLOW
+    #        ReportSuggestion ${TEST_NO} "Remove every Rsh Trust Files as they can allow unauthenticated access to a system"
+    #    else
+    #        LogText "Result: no Rsh Trust Files found"
+    #        Display --indent 4 --text "- Checking presence of Rsh Trust Files" --result "${STATUS_OK}" --color GREEN
+    #    fi
+    #fi
 #
 #################################################################################
 #
@@ -670,19 +353,16 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if rsh server is installed
         LogText "Test: Checking if rsh server is installed"
-        FOUND=""
+        FOUND=0
         PACKAGES="rsh-server rsh-redone-server"
         for PACKAGE in ${PACKAGES}; do
-            PackageIsInstalled ${PACKAGE}
-            if [ $? -eq 0 ];then
-                FOUND=${PACKAGE}
-            fi
+            if PackageIsInstalled "${PACKAGE}"; then FOUND=1; fi
         done
-        if [ ${FOUND} ]; then
+        if [ ${FOUND} -eq 1 ]; then
             LogText "Result: rsh server is installed"
             Display --indent 2 --text "- Checking rsh server installation" --result "${STATUS_SUGGESTION}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Removing the rsh-server package decreases the risk of the accidental (or intentional) activation of rsh services"
-            
+            ReportSuggestion ${TEST_NO} "Remove the rsh-server package and replace with a more secure alternative like SSH"
+            Report "insecure_service[]=rsh-server"
         else
             LogText "Result: rsh server is NOT installed"
             Display --indent 2 --text "- Checking rsh server installation" --result "${STATUS_OK}" --color GREEN
@@ -697,11 +377,12 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if telnet client is installed
         LogText "Test: Checking if telnet client is installed"
-        PackageIsInstalled telnet
-        if [ $? -eq 0 ]; then
+        if PackageIsInstalled "${PACKAGE}"; then FOUND=1; fi
+        if [ ${FOUND} -eq 1 ]; then
             LogText "Result: telnet client is installed"
-            Display --indent 2 --text "- Checking telnet client installation" --result "${STATUS_SUGGESTION}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "telnet client contain numerous security exposures and have been replaced with the more secure SSH package"
+            Display --indent 2 --text "- Checking telnet client installation" --result "${STATUS_FOUND}" --color YELLOW
+            # Telnet client usage might be used for troubleshooting instead of system administration
+            #ReportSuggestion ${TEST_NO} "telnet client contain numerous security exposures and have been replaced with the more secure SSH package"
         else
             LogText "Result: telnet client is NOT installed"
             Display --indent 2 --text "- Checking telnet client installation" --result "${STATUS_OK}" --color GREEN
@@ -716,18 +397,16 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if TFTP server is installed
         LogText "Test: Checking if telnet server is installed"
-        FOUND=""
+        FOUND=0
         PACKAGES="telnetd telnet-server"
         for PACKAGE in ${PACKAGES}; do
-            PackageIsInstalled ${PACKAGE}
-            if [ $? -eq 0 ];then
-                FOUND=${PACKAGE}
-            fi
+            if PackageIsInstalled "${PACKAGE}"; then FOUND=1; fi
         done
-        if [ ${FOUND} ]; then
+        if [ ${FOUND} -eq 1 ]; then
             LogText "Result: telnet server is installed"
-            Display --indent 2 --text "- Checking telnet server installation" --result "${STATUS_SUGGESTION}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Removing the ${FOUND} package decreases the risk of the accidental (or intentional) activation of telnet services"
+            Display --indent 2 --text "- Checking telnet server installation" --result "${STATUS_FOUND}" --color YELLOW
+            ReportSuggestion ${TEST_NO} "Removing the ${FOUND} package and replace with SSH when possible"
+            Report "insecure_service[]=telnet-server"
         else
             LogText "Result: telnet server is NOT installed"
             Display --indent 2 --text "- Checking telnet server installation" --result "${STATUS_OK}" --color GREEN

From 72ba872a2fc2de1900f7a3f088b1b136a2751e32 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 4 Apr 2019 19:04:42 +0200
Subject: [PATCH 070/679] Improve text output for AIX systems

---
 include/osdetection | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/osdetection b/include/osdetection
index 5ab80293..a6c18bb5 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -477,7 +477,7 @@
     ECHONB=""
 
     case ${OS} in
-        "AIX")                           ECHOCMD="echo" ;;
+        "AIX")                           ECHOCMD="echo"; ECHONB="printf" ;;
         "DragonFly"|"FreeBSD"|"NetBSD")  ECHOCMD="echo -e"; ECHONB="echo -n" ;;
         "macOS" | "Mac OS X")                         ECHOCMD="echo"; ECHONB="/bin/echo -n" ;;
         "Solaris")                       ECHOCMD="echo" ; test -f /usr/ucb/echo && ECHONB="/usr/ucb/echo -n" ;;

From ef0b5b7641e4af2664e578386cba425c79517f04 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 4 Apr 2019 19:05:02 +0200
Subject: [PATCH 071/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 664b52cf..a6a5e11d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@
 - AUTH-9278 - Test LDAP in all PAM components on Red Hat and other systems
 - PKGS-7410 - Add support for DPKG-based systems to gather installed kernel packages
 - PKGS-7420 - Detect toolkit to automatically download and apply upgrades
+- Improve text output for AIX systems
 
 ---------------------------------------------------------------------------------
 

From 2750e9b7b8014a01b5e218d89856a37793529ec1 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 7 Apr 2019 15:50:46 +0200
Subject: [PATCH 072/679] Detect equery binary

---
 include/binaries | 3 ++-
 include/consts   | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/binaries b/include/binaries
index ec9a634f..2ba93cfa 100644
--- a/include/binaries
+++ b/include/binaries
@@ -132,7 +132,8 @@
                             domainname)             DOMAINNAMEBINARY="${BINARY}";      LogText "  Found known binary: domainname (NIS domain) - ${BINARY}" ;;
                             dpkg)                   DPKGBINARY="${BINARY}";            LogText "  Found known binary: dpkg (package management) - ${BINARY}" ;;
                             egrep)                  EGREPBINARY=${BINARY};             LogText "  Found known binary: egrep (text search) - ${BINARY}" ;;
-                            exim)                   EXIMBINARY="${BINARY}";            EXIMVERSION=$(${BINARY} -bV | grep 'Exim version' | awk '{ print $3 }' | xargs); LogText "Found ${BINARY} (version ${EXIMVERSION})" ;;
+                            equery)                 EQUERYBINARY="${BINARY}";          LogText "  Found known binary: query (package manager) - ${BINARY}" ;;
+                            exim)                   EXIMBINARY="${BINARY}";            EXIMVERSION=$(${BINARY} -bV | grep 'Exim version' | awk '{ print $3 }' | xargs); LogText "  Found known binary ${BINARY} (version ${EXIMVERSION})" ;;
                             fail2ban-server)        FAIL2BANBINARY="${BINARY}";        LogText "  Found known binary: fail2ban (IPS tool) - ${BINARY}" ;;
                             file)                   FILEBINARY="${BINARY}";            LogText "  Found known binary: file (file type detection) - ${BINARY}" ;;
                             find)                   FINDBINARY="${BINARY}";            LogText "  Found known binary: find (search tool) - ${BINARY}" ;;
diff --git a/include/consts b/include/consts
index 1abe26f9..fa923c99 100644
--- a/include/consts
+++ b/include/consts
@@ -103,6 +103,7 @@ unset LANG
     DPKGBINARY=""
     ECHOCMD=""
     ERROR_ON_WARNINGS=0
+    EQUERYBINARY=""
     FAIL2BANBINARY=""
     FILEBINARY=""
     FILEVALUE=""

From f8b390617b14fefa045c24c3810488e3740fadcf Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 7 Apr 2019 15:51:25 +0200
Subject: [PATCH 073/679] Changed screen output

---
 include/tests_insecure_services | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index afed850e..2b673072 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -44,11 +44,11 @@
         if PackageIsInstalled "inetd"; then
             INETD_PACKAGE_INSTALLED=1
             LogText "Result: inetd is installed"
-            Display --indent 2 --text "- Installation of inetd package" --result "${STATUS_FOUND}" --color YELLOW
+            Display --indent 2 --text "- Installed inetd package" --result "${STATUS_FOUND}" --color YELLOW
             #ReportSuggestion ${TEST_NO} "If there are no inetd services required, it is recommended that the daemon be removed"
         else
             LogText "Result: inetd is NOT installed"
-            Display --indent 2 --text "- Installation of inetd package" --result "${STATUS_NOT_FOUND}" --color GREEN
+            Display --indent 2 --text "- Installed inetd package" --result "${STATUS_NOT_FOUND}" --color GREEN
         fi
     fi
 #
@@ -141,11 +141,11 @@
         PackageIsInstalled xinetd
         if [ $? -eq 0 ]; then
             LogText "Result: xinetd is installed"
-            Display --indent 2 --text "- Installation of xinetd package" --result "${STATUS_FOUND}" --color YELLOW
+            Display --indent 2 --text "- Installed xinetd package" --result "${STATUS_FOUND}" --color YELLOW
             ReportSuggestion ${TEST_NO} "If there are no xinetd services required, it is recommended that the daemon be removed"
         else
             LogText "Result: xinetd is NOT installed"
-            Display --indent 2 --text "- Installation of xinetd package" --result "${STATUS_OK}" --color GREEN
+            Display --indent 2 --text "- Installed xinetd package" --result "${STATUS_OK}" --color GREEN
         fi
     fi
 #
@@ -303,11 +303,11 @@
         done
         if [ ${FOUND} -eq 1 ]; then
             LogText "Result: rsh client is installed"
-            Display --indent 2 --text "- Checking rsh client installation" --result "${STATUS_SUGGESTION}" --color YELLOW
+            Display --indent 2 --text "- Installed rsh client package" --result "${STATUS_SUGGESTION}" --color YELLOW
             ReportSuggestion ${TEST_NO} "Remove rsh client when it is not in use or replace with the more secure SSH package"
         else
             LogText "Result: rsh client is NOT installed"
-            Display --indent 2 --text "- Checking rsh client installation" --result "${STATUS_OK}" --color GREEN
+            Display --indent 2 --text "- Installed rsh client package" --result "${STATUS_OK}" --color GREEN
         fi
     fi
 #
@@ -360,12 +360,12 @@
         done
         if [ ${FOUND} -eq 1 ]; then
             LogText "Result: rsh server is installed"
-            Display --indent 2 --text "- Checking rsh server installation" --result "${STATUS_SUGGESTION}" --color YELLOW
+            Display --indent 2 --text "- Installed rsh server package" --result "${STATUS_SUGGESTION}" --color YELLOW
             ReportSuggestion ${TEST_NO} "Remove the rsh-server package and replace with a more secure alternative like SSH"
             Report "insecure_service[]=rsh-server"
         else
             LogText "Result: rsh server is NOT installed"
-            Display --indent 2 --text "- Checking rsh server installation" --result "${STATUS_OK}" --color GREEN
+            Display --indent 2 --text "- Installed rsh server package" --result "${STATUS_OK}" --color GREEN
         fi
     fi
 #
@@ -380,12 +380,12 @@
         if PackageIsInstalled "${PACKAGE}"; then FOUND=1; fi
         if [ ${FOUND} -eq 1 ]; then
             LogText "Result: telnet client is installed"
-            Display --indent 2 --text "- Checking telnet client installation" --result "${STATUS_FOUND}" --color YELLOW
+            Display --indent 2 --text "- Installed telnet client package" --result "${STATUS_FOUND}" --color YELLOW
             # Telnet client usage might be used for troubleshooting instead of system administration
             #ReportSuggestion ${TEST_NO} "telnet client contain numerous security exposures and have been replaced with the more secure SSH package"
         else
             LogText "Result: telnet client is NOT installed"
-            Display --indent 2 --text "- Checking telnet client installation" --result "${STATUS_OK}" --color GREEN
+            Display --indent 2 --text "- Installed telnet client package" --result "${STATUS_OK}" --color GREEN
         fi
     fi
 #
@@ -404,12 +404,12 @@
         done
         if [ ${FOUND} -eq 1 ]; then
             LogText "Result: telnet server is installed"
-            Display --indent 2 --text "- Checking telnet server installation" --result "${STATUS_FOUND}" --color YELLOW
+            Display --indent 2 --text "- Installed telnet server package" --result "${STATUS_FOUND}" --color YELLOW
             ReportSuggestion ${TEST_NO} "Removing the ${FOUND} package and replace with SSH when possible"
             Report "insecure_service[]=telnet-server"
         else
             LogText "Result: telnet server is NOT installed"
-            Display --indent 2 --text "- Checking telnet server installation" --result "${STATUS_OK}" --color GREEN
+            Display --indent 2 --text "- Installed telnet server package" --result "${STATUS_NOT_FOUND}" --color GREEN
         fi
     fi
 #

From 1e134bc1b36cbdadf3d42a8c0b3a0016318550c8 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 7 Apr 2019 15:52:52 +0200
Subject: [PATCH 074/679] Extended function with more package managers

---
 include/functions | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/include/functions b/include/functions
index e8965986..c1df0fbf 100644
--- a/include/functions
+++ b/include/functions
@@ -1714,11 +1714,20 @@
             Fatal "Incorrect usage of PackageIsInstalled function"
         fi
 
-        if [ ! -z "${RPMBINARY}" ]; then
-            output=$(${RPMBINARY} --quiet -q ${package} 2> /dev/null)
+        if [ ! -z "${DNFBINARY}" ]; then
+            output=$(${DNFBINARY} --quiet --cacheonly --noplugins --assumeno info --installed ${package} > /dev/null 2>&1)
             exit_code=$?
         elif [ ! -z "${DPKGBINARY}" ]; then
-            output=$(${DPKGBINARY} -l ${package} 2> /dev/null)
+            output=$(${DPKGBINARY} -l ${package} > /dev/null 2>&1)
+            exit_code=$?
+        elif [ ! -z "${EQUERYBINARY}" ]; then
+            output=$(${EQUERYBINARY} --quiet ${package} > /dev/null 2>&1)
+            exit_code=$?  # 0=package installed, 3=package not installed
+        elif [ ! -z "${PKG_BINARY}" ]; then
+            output=$(${PKG_BINARY} -N info ${package} >& /dev/null)
+            exit_code=$?  # 0=package installed, 70=invalid package
+        elif [ ! -z "${RPMBINARY}" ]; then
+            output=$(${RPMBINARY} --quiet -q ${package} > /dev/null 2>&1)
             exit_code=$?
         elif [ ! -z "${ZYPPERBINARY}" ]; then
             output=$(${ZYPPERBINARY} --quiet --non-interactive search --installed -i ${PACKAGE} 2> /dev/null | grep "^i")

From 1a1d736fa7baee2983ae7b8452c64fb342313c32 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 7 Apr 2019 15:53:04 +0200
Subject: [PATCH 075/679] Updated log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a6a5e11d..0d0187d7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,12 +12,14 @@
 - INSE-8200 - Usage of TCP wrappers
 - INSE-8300 - Presence of rsh client
 - INSE-8302 - Presence of rsh server
+- Detect equery binary detection
 
 ### Changed
 - AUTH-9278 - Test LDAP in all PAM components on Red Hat and other systems
 - PKGS-7410 - Add support for DPKG-based systems to gather installed kernel packages
 - PKGS-7420 - Detect toolkit to automatically download and apply upgrades
 - Improve text output for AIX systems
+- Extended PackageIsInstalled function
 
 ---------------------------------------------------------------------------------
 

From 08ecd911801dd90215ab885e690dec3686cf1d36 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 7 Apr 2019 19:03:21 +0200
Subject: [PATCH 076/679] Use ps instead of pgrep on AIX

---
 include/functions | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/functions b/include/functions
index c1df0fbf..e3a09c0c 100644
--- a/include/functions
+++ b/include/functions
@@ -1284,7 +1284,8 @@
 
         if [ -z "${search}" ]; then ExitFatal "Missing process to search for when using IsRunning function"; fi
         RUNNING=0
-        if [ ! -z "${PGREPBINARY}" ]; then
+        # AIX does not fully support pgrep options, so using ps instead
+        if [ ! -z "${PGREPBINARY}" -a ! "${OS}" = "AIX" ]; then
             FIND=$(${PGREPBINARY} ${pgrep_options} "${search}" | ${TRBINARY} '\n' ' ')
         else
             if [ -z "${PSOPTIONS}" ]; then

From 3516ce9de10528f08f949b09daa179e949b0596c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 7 Apr 2019 19:03:28 +0200
Subject: [PATCH 077/679] Updated log

---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0d0187d7..c7c09fc0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,8 +18,9 @@
 - AUTH-9278 - Test LDAP in all PAM components on Red Hat and other systems
 - PKGS-7410 - Add support for DPKG-based systems to gather installed kernel packages
 - PKGS-7420 - Detect toolkit to automatically download and apply upgrades
-- Improve text output for AIX systems
+- AIX enhancement for IsRunning function
 - Extended PackageIsInstalled function
+- Improve text output on AIX systems
 
 ---------------------------------------------------------------------------------
 

From 71a0c79053119fedfcb68d47c7b4483b16a8ec1c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 8 Apr 2019 07:53:04 +0200
Subject: [PATCH 078/679] Corrected stdout/stderr redirection for FreeBSD pkg
 tool

---
 include/functions | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/functions b/include/functions
index e3a09c0c..26d8c378 100644
--- a/include/functions
+++ b/include/functions
@@ -1700,7 +1700,7 @@
 
     ################################################################################
     # Name        : PackageIsInstalled()
-    # Description : Add a separator to log file between sections, tests etc
+    # Description : Determines if a package is installed
     # Returns     : exit code
     # Notes       : this function is not used yet, but created in advance to allow
     #               the addition of support for all operating systems
@@ -1725,7 +1725,7 @@
             output=$(${EQUERYBINARY} --quiet ${package} > /dev/null 2>&1)
             exit_code=$?  # 0=package installed, 3=package not installed
         elif [ ! -z "${PKG_BINARY}" ]; then
-            output=$(${PKG_BINARY} -N info ${package} >& /dev/null)
+            output=$(${PKG_BINARY} -N info ${package} >/dev/null 2>&1)
             exit_code=$?  # 0=package installed, 70=invalid package
         elif [ ! -z "${RPMBINARY}" ]; then
             output=$(${RPMBINARY} --quiet -q ${package} > /dev/null 2>&1)

From 137dc6f0ccb1abe91c6102362209c274e6897ec7 Mon Sep 17 00:00:00 2001
From: Capashenn <37273010+Capashenn@users.noreply.github.com>
Date: Mon, 8 Apr 2019 10:36:17 +0200
Subject: [PATCH 079/679] fix FILE-6374 (#672)

---
 include/tests_filesystems | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_filesystems b/include/tests_filesystems
index 43b9e7ec..8bf47685 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -560,7 +560,7 @@
     #            ---------------------------------------------------------
 
     FILESYSTEMS_TO_CHECK="/boot:nodev,noexec,nosuid /dev/shm:nosuid,nodev,noexec /home:nodev,nosuid /tmp:nodev,noexec,nosuid /var:nosuid /var/log:nodev,noexec,nosuid /var/log/audit:nodev,noexec,nosuid /var/tmp:nodev,noexec,nosuid"
-    Register --test-no FILE-6374 --os Linux --weight L --network NO --category security --description "Checking /boot mount options"
+    Register --test-no FILE-6374 --os Linux --weight L --network NO --category security --description "Checking partitions mount options"
     if [ ${SKIPTEST} -eq 0 ]; then
         if [ -f /etc/fstab ]; then
             for I in ${FILESYSTEMS_TO_CHECK}; do
@@ -574,7 +574,7 @@
                     fi
                 fi
                 if [ ! -z "${FS_FSTAB}" ]; then
-                    FOUND_FLAGS=$(${AWKBINARY} -v fs=${FILESYSTEM} '{ if ($2==fs) { print $4 } }' /etc/fstab | ${SEDBINARY} 's/,/ /g' | ${TRBINARY} '\n' ' ')
+                    FOUND_FLAGS=$(${AWKBINARY} -v fs=${FILESYSTEM} '{ if ($2==fs) { print $4 } }' /etc/fstab | ${SEDBINARY} 's/,/ /g' | ${TRBINARY} -d '\n')
                     LogText "File system:    ${FILESYSTEM}"
                     LogText "Expected flags: ${EXPECTED_FLAGS}"
                     LogText "Found flags:    ${FOUND_FLAGS}"

From 256bc1da0fec522dc6cce84bba499416c367f6d8 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 8 Apr 2019 11:07:41 +0200
Subject: [PATCH 080/679] Undoed submitted pull request as it breaks testing at
 least on Ubuntu system

---
 include/tests_filesystems | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/tests_filesystems b/include/tests_filesystems
index 8bf47685..7dc61933 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -566,7 +566,7 @@
             for I in ${FILESYSTEMS_TO_CHECK}; do
                 FILESYSTEM=$(echo ${I} | ${CUTBINARY} -d: -f1)
                 EXPECTED_FLAGS=$(echo ${I} | ${CUTBINARY} -d: -f2 | ${SEDBINARY} 's/,/ /g')
-                FS_FSTAB=$(${AWKBINARY} -v fs=${FILESYSTEM} '{ if ($2==fs) { print $3 } }' /etc/fstab)
+                FS_FSTAB=$(${AWKBINARY} -v fs=${FILESYSTEM} '{ if ($2==fs) { print $3 } }' ${ROOTDIR}etc/fstab)
                 if [ "${FS_FSTAB}" = "glusterfs" ]; then
                     EXPECTED_FLAGS=$(echo ${EXPECTED_FLAGS} | ${SEDBINARY} 's/\<\(nodev\|nosuid\)\> *//g')
                     if [ -z "${EXPECTED_FLAGS}" ]; then
@@ -574,7 +574,7 @@
                     fi
                 fi
                 if [ ! -z "${FS_FSTAB}" ]; then
-                    FOUND_FLAGS=$(${AWKBINARY} -v fs=${FILESYSTEM} '{ if ($2==fs) { print $4 } }' /etc/fstab | ${SEDBINARY} 's/,/ /g' | ${TRBINARY} -d '\n')
+                    FOUND_FLAGS=$(${AWKBINARY} -v fs=${FILESYSTEM} '{ if ($2==fs) { print $4 } }' ${ROOTDIR}etc/fstab | ${SEDBINARY} 's/,/ /g' | ${TRBINARY} '\n' ' ')
                     LogText "File system:    ${FILESYSTEM}"
                     LogText "Expected flags: ${EXPECTED_FLAGS}"
                     LogText "Found flags:    ${FOUND_FLAGS}"
@@ -582,7 +582,7 @@
                     FULLY_HARDENED=1
                     for FLAG in ${EXPECTED_FLAGS}; do
                         FLAG_AVAILABLE=$(echo ${FOUND_FLAGS} | ${GREPBINARY} ${FLAG})
-                        if [ "${FLAG_AVAILABLE}" = "" ]; then
+                        if [ -z "${FLAG_AVAILABLE}" ]; then
                             LogText "Result: Could not find mount option ${FLAG} on file system ${FILESYSTEM}"
                             FULLY_HARDENED=0
                         else

From fd8b1e790d3eb7e3d98b89fc66edd392862f8430 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 8 Apr 2019 15:09:18 +0200
Subject: [PATCH 081/679] Improved PackageIsInstalled function and its usage

---
 include/functions               |  2 +-
 include/tests_insecure_services | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/include/functions b/include/functions
index 26d8c378..b15bda88 100644
--- a/include/functions
+++ b/include/functions
@@ -1719,7 +1719,7 @@
             output=$(${DNFBINARY} --quiet --cacheonly --noplugins --assumeno info --installed ${package} > /dev/null 2>&1)
             exit_code=$?
         elif [ ! -z "${DPKGBINARY}" ]; then
-            output=$(${DPKGBINARY} -l ${package} > /dev/null 2>&1)
+            output=$(${DPKGBINARY} -l ${package} 2> /dev/null | ${GREPBINARY} "^ii")
             exit_code=$?
         elif [ ! -z "${EQUERYBINARY}" ]; then
             output=$(${EQUERYBINARY} --quiet ${package} > /dev/null 2>&1)
diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index 2b673072..841189d8 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -138,8 +138,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check for installed xinetd daemon
         LogText "Test: Checking for installed xinetd daemon"
-        PackageIsInstalled xinetd
-        if [ $? -eq 0 ]; then
+        if PackageIsInstalled "xinetd"; then
             LogText "Result: xinetd is installed"
             Display --indent 2 --text "- Installed xinetd package" --result "${STATUS_FOUND}" --color YELLOW
             ReportSuggestion ${TEST_NO} "If there are no xinetd services required, it is recommended that the daemon be removed"
@@ -277,7 +276,7 @@
         FOUND=0
         PACKAGES="tcp_wrappers tcpd"
         for PACKAGE in ${PACKAGES}; do
-            if PackageIsInstalled ${PACKAGE}; then FOUND=1; fi
+            if PackageIsInstalled "${PACKAGE}"; then LogText "Package '${PACKAGE}' is installed"; FOUND=1; fi
         done
         if [ ${FOUND} -eq 1 ]; then
             LogText "Result: tcp_wrappers is installed"
@@ -299,7 +298,7 @@
         FOUND=0
         PACKAGES="rsh rsh-client rsh-redone-client"
         for PACKAGE in ${PACKAGES}; do
-            if PackageIsInstalled "${PACKAGE}"; then FOUND=1; fi
+            if PackageIsInstalled "${PACKAGE}"; then LogText "Package '${PACKAGE}' is installed"; FOUND=1; fi
         done
         if [ ${FOUND} -eq 1 ]; then
             LogText "Result: rsh client is installed"
@@ -356,7 +355,7 @@
         FOUND=0
         PACKAGES="rsh-server rsh-redone-server"
         for PACKAGE in ${PACKAGES}; do
-            if PackageIsInstalled "${PACKAGE}"; then FOUND=1; fi
+            if PackageIsInstalled "${PACKAGE}"; then LogText "Package '${PACKAGE}' is installed"; FOUND=1; fi
         done
         if [ ${FOUND} -eq 1 ]; then
             LogText "Result: rsh server is installed"
@@ -377,7 +376,8 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if telnet client is installed
         LogText "Test: Checking if telnet client is installed"
-        if PackageIsInstalled "${PACKAGE}"; then FOUND=1; fi
+        if PackageIsInstalled "${PACKAGE}"; then LogText "Package '${PACKAGE}' is installed"; FOUND=1; fi
+
         if [ ${FOUND} -eq 1 ]; then
             LogText "Result: telnet client is installed"
             Display --indent 2 --text "- Installed telnet client package" --result "${STATUS_FOUND}" --color YELLOW
@@ -400,7 +400,7 @@
         FOUND=0
         PACKAGES="telnetd telnet-server"
         for PACKAGE in ${PACKAGES}; do
-            if PackageIsInstalled "${PACKAGE}"; then FOUND=1; fi
+            if PackageIsInstalled "${PACKAGE}"; then LogText "Package '${PACKAGE}' is installed"; FOUND=1; fi
         done
         if [ ${FOUND} -eq 1 ]; then
             LogText "Result: telnet server is installed"

From fe09e4ebaa8f52cd6b7c01bc2088001cce4a7afe Mon Sep 17 00:00:00 2001
From: Capashenn <37273010+Capashenn@users.noreply.github.com>
Date: Tue, 9 Apr 2019 06:49:34 +0200
Subject: [PATCH 082/679] fix SHLL-6220 description (#673)

---
 include/tests_shells | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_shells b/include/tests_shells
index 8f9763b4..80735064 100644
--- a/include/tests_shells
+++ b/include/tests_shells
@@ -99,7 +99,7 @@
 #
     # Test        : SHLL-6220
     # Description : check for idle session killing tools or settings
-    Register --test-no SHLL-6220 --weight L --network NO --category security --description "Checking available and valid shells"
+    Register --test-no SHLL-6220 --weight L --network NO --category security --description "check for idle session killing tools or settings"
     if [ ${SKIPTEST} -eq 0 ]; then
 
         IDLE_TIMEOUT_METHOD=""

From 15c942ac24adbac67f13f97d554a6e97986507c2 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 9 Apr 2019 06:51:47 +0200
Subject: [PATCH 083/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c7c09fc0..fa67946f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,7 @@
 - AUTH-9278 - Test LDAP in all PAM components on Red Hat and other systems
 - PKGS-7410 - Add support for DPKG-based systems to gather installed kernel packages
 - PKGS-7420 - Detect toolkit to automatically download and apply upgrades
+- Minor changes to improve text output and test descriptions
 - AIX enhancement for IsRunning function
 - Extended PackageIsInstalled function
 - Improve text output on AIX systems

From d90c43d06cbf10b90da61593beac6bb85d7be083 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 9 Apr 2019 06:52:00 +0200
Subject: [PATCH 084/679] Updated descriptions

---
 include/tests_shells | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/include/tests_shells b/include/tests_shells
index 80735064..3a094ad8 100644
--- a/include/tests_shells
+++ b/include/tests_shells
@@ -31,9 +31,10 @@
     # Files (interactive login shells):     /etc/profile $HOME/.bash_profile
     #                                       $HOME/.bash_login $HOME/.profile
     # Files (interactive non-login shells): $HOME/.bash_rc
-
+    #
     # csh/tcsh
     # Files: /etc/csh.cshrc /etc/csh.login
+    #
     # zsh
     # Files: /etc/zshenv /etc/zsh/zshenv $HOME/.zshenv /etc/zprofile
     #        /etc/zsh/zprofile $HOME/.zprofile /etc/zshrc /etc/zsh/zshrc
@@ -68,8 +69,8 @@
 #################################################################################
 #
     # Test        : SHLL-6211
-    # Description : which shells are available according /etc/shells
-    Register --test-no SHLL-6211 --weight L --network NO --category security --description "Checking available and valid shells"
+    # Description : Determine available shell according /etc/shells
+    Register --test-no SHLL-6211 --weight L --network NO --category security --description "Available and valid shells"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Searching for ${ROOTDIR}etc/shells"
         if [ -f ${ROOTDIR}etc/shells ]; then
@@ -98,8 +99,8 @@
 #################################################################################
 #
     # Test        : SHLL-6220
-    # Description : check for idle session killing tools or settings
-    Register --test-no SHLL-6220 --weight L --network NO --category security --description "check for idle session killing tools or settings"
+    # Description : Check for idle session killing tools or settings
+    Register --test-no SHLL-6220 --weight L --network NO --category security --description "Idle session killing tools or settings"
     if [ ${SKIPTEST} -eq 0 ]; then
 
         IDLE_TIMEOUT_METHOD=""

From e195e7c8e0be65491745a4a89b559d60c5106ed7 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 9 Apr 2019 08:26:16 +0200
Subject: [PATCH 085/679] Corrected lsvg binary detection

---
 include/binaries | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/binaries b/include/binaries
index 2ba93cfa..7bf0d233 100644
--- a/include/binaries
+++ b/include/binaries
@@ -166,7 +166,7 @@
                             lsattr)                 LSATTRBINARY="${BINARY}";          LogText "  Found known binary: lsattr (file attributes) - ${BINARY}" ;;
                             lsmod)                  LSMODBINARY="${BINARY}";           LogText "  Found known binary: lsmod (kernel modules) - ${BINARY}" ;;
                             lsof)                   LSOFBINARY="${BINARY}";            LogText "  Found known binary: lsof (open files) - ${BINARY}" ;;
-                            lsvg)                   LVSGBINARY=${BINARY};              LogText "  Found known binary: lsvg (volume manager) - ${BINARY}" ;;
+                            lsvg)                   LSVGBINARY=${BINARY};              LogText "  Found known binary: lsvg (volume manager) - ${BINARY}" ;;
                             lvdisplay)              LVDISPLAYBINARY="${BINARY}";       LogText "  Found known binary: lvdisplay (LVM tool) - ${BINARY}" ;;
                             lynx)                   LYNXBINARY="${BINARY}";            LYNXVERSION=$(${BINARY} -version | grep "^Lynx Version" | cut -d ' ' -f3); LogText "Found known binary: lynx (browser) - ${BINARY} (version ${LYNXVERSION})" ;;
                             maldet)                 LMDBINARY="${BINARY}";             MALWARE_SCANNER_INSTALLED=1;           LogText "  Found known binary: maldet (Linux Malware Detect, malware scanner) - ${BINARY}" ;;

From 6bc2aefbd4ef905e48c86f416b95eb919da3511e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 9 Apr 2019 08:26:24 +0200
Subject: [PATCH 086/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fa67946f..8d73513c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,7 @@
 - AIX enhancement for IsRunning function
 - Extended PackageIsInstalled function
 - Improve text output on AIX systems
+- Corrected lsvg binary detection
 
 ---------------------------------------------------------------------------------
 

From 2d0c68493154e8dfee061f7a101a3a689a29097f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 13 Apr 2019 13:26:56 +0200
Subject: [PATCH 087/679] Added new 'generate' command

---
 include/consts          |  2 +
 include/functions       | 22 ++++++++--
 include/helper_generate | 89 +++++++++++++++++++++++++++++++++++++++++
 include/helper_show     | 12 ++++++
 include/parameters      | 18 +++++++++
 5 files changed, 140 insertions(+), 3 deletions(-)
 create mode 100644 include/helper_generate

diff --git a/include/consts b/include/consts
index fa923c99..24a32167 100644
--- a/include/consts
+++ b/include/consts
@@ -251,8 +251,10 @@ unset LANG
     SHOW_REPORT_SOLUTION=1
     SHOW_TOOL_TIPS=1                    # Show inline tool tips (default true)
     SHOW_WARNINGS_ONLY=0
+    SKIP_GETHOSTID=0
     SKIP_PLUGINS=0
     SKIP_TESTS=""
+    SKIP_VM_DETECTION=0
     SKIPREASON=""
     SKIPPED_TESTS_ROOTONLY=""
     SMTPCTLBINARY=""
diff --git a/include/functions b/include/functions
index b15bda88..35cb6b00 100644
--- a/include/functions
+++ b/include/functions
@@ -805,15 +805,26 @@
     # Name        : GetHostID()
     # Description : Create an unique id for the system
     #
-    # Returns     : optional value
+    # Returns     : 0 = fetched or created IDs, 1 = failed, 2 = skipped
     # Usage       : GetHostID
     ################################################################################
 
     GetHostID() {
 
+        if [ ${SKIP_GETHOSTID} -eq 1 ]; then
+            return 2
+        fi
+
         if [ ! -z "${HOSTID}" -a ! -z "${HOSTID2}" ]; then
             Debug "Skipping creation of host identifiers, as they are already configured (via profile)"
-            return 1
+            return 2
+        fi
+
+        if [ -f "${ROOTDIR}etc/lynis/hostids" ]; then
+            Debug "Used hostids file to fetch values"
+            HOSTID=$(grep "^hostid=" ${ROOTDIR}etc/lynis/hostids | awk -F= '{print $2}')
+            HOSTID2=$(grep "^hostid2=" ${ROOTDIR}etc/lynis/hostids | awk -F= '{print $2}')
+            return 0
         fi
 
         FIND=""
@@ -1110,8 +1121,9 @@
         fi
 
         # Show an exception if no HostID could be created, to ensure each system (and scan) has one
-        if [ "${HOSTID}" = "" ]; then
+        if [ -z "${HOSTID}" ]; then
             ReportException "GetHostID" "No unique host identifier could be created."
+            return 1
         elif [ ! -z "${HOSTID2}" ]; then
             return 0
         fi
@@ -1393,6 +1405,10 @@
         ISVIRTUALMACHINE=2; VMTYPE="unknown"; VMFULLTYPE="Unknown"
         SHORT=""
 
+        if [ ${SKIP_VM_DETECTION} -eq 1 ]; then
+            return 2
+        fi
+
         # lxc environ detection
         if [ -z "${SHORT}" ]; then
             if [ -f /proc/1/environ ]; then
diff --git a/include/helper_generate b/include/helper_generate
new file mode 100644
index 00000000..bdcfb44d
--- /dev/null
+++ b/include/helper_generate
@@ -0,0 +1,89 @@
+#!/bin/sh
+
+#################################################################################
+#
+#   Lynis
+# ------------------
+#
+# Copyright 2007-2013, Michael Boelen
+# Copyright 2007-2019, CISOfy
+#
+# Website  : https://cisofy.com
+# Blog     : http://linux-audit.com
+# GitHub   : https://github.com/CISOfy/lynis
+#
+# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
+# welcome to redistribute it under the terms of the GNU General Public License.
+# See LICENSE file for usage of this software.
+#
+######################################################################
+#
+# Helper program to generate specific details such as host IDs
+#
+######################################################################
+#
+# How to use:
+# ------------
+# Run: lynis generate <option>
+#
+######################################################################
+
+SAVEFILE=0
+GENERATE_ARGS="hostids"
+
+if [ $# -gt 0 ]; then
+    case $1 in
+        "hostids")
+
+            if [ $# -gt 1 ]; then
+                shift
+                if [ $1 = "--save" ]; then
+                    SAVEFILE=1
+                fi
+            fi
+
+            # Generate random host IDs
+            HOSTID=$(head -c20 < /dev/urandom | xxd -c 20 -p)
+            HOSTID2=$(head -c32 < /dev/urandom | xxd -c 32 -p)
+
+            ${ECHOCMD} "Generated host identifiers"
+            ${ECHOCMD} "- hostid: ${HOSTID}"
+            ${ECHOCMD} "- hostid2: ${HOSTID2}"
+
+            if [ ${SAVEFILE} -eq 1 ]; then
+                FILE="${ROOTDIR}etc/lynis/hostids"
+                if [ -f ${FILE} ]; then
+                    ${ECHOCMD} "Error: hostids file already exists (${FILE})"
+                    ${ECHOCMD} "Remove the file first and rerun command"
+                    ExitFatal
+                else
+                    OUTPUT=$(touch ${FILE} 2> /dev/null)
+                    if [ $? -eq 0 ]; then
+                        ${ECHOCMD} "Created hostids file (${FILE})"
+                        echo "# generated using 'lynis generate hostids --save'" > ${FILE}
+                        echo "hostid=${HOSTID}" >> ${FILE}
+                        echo "hostid2=${HOSTID2}" >> ${FILE}
+                    else
+                        ExitFatal "Error: could not created hostids file (${FILE}). Issue with permissions?"
+                    fi
+                fi
+            fi
+
+            ExitClean
+            ;;
+        *)                      ${ECHOCMD} "Unknown argument '${RED}$1${NORMAL}' for lynis generate" ;;
+    esac
+else
+    ${ECHOCMD} "\n  ${WHITE}Provide an additional argument${NORMAL}\n\n"
+    for ITEM in ${GENERATE_ARGS}; do
+        ${ECHOCMD} "    lynis generate ${BROWN}${ITEM}${NORMAL}"
+    done
+    ${ECHOCMD} "\n"
+    ${ECHOCMD} ""
+    ${ECHOCMD} "Extended help about the generate command can be provided with: $0 show commands generate"
+fi
+
+
+ExitClean
+
+# The End
diff --git a/include/helper_show b/include/helper_show
index 6e0738e6..a696b0e7 100644
--- a/include/helper_show
+++ b/include/helper_show
@@ -94,6 +94,17 @@ AUDIT_HELP="
 
 "
 
+GENERATE_ARGS="( --save )"
+GENERATE_HELP="
+  Generate random value for hostid and hostid2
+  ${WHITE}lynis generate hostids${NORMAL}
+
+  Generate and save values
+  ${WHITE}lynis generate hostids --save${NORMAL}
+
+"
+
+
 UPDATE_ARGS="check info"
 UPDATE_HELP="
   ${CYAN}update info${NORMAL}
@@ -274,6 +285,7 @@ if [ $# -gt 0 ]; then
                 shift
                 case $1 in
                    "audit") ${ECHOCMD} "${AUDIT_HELP}" ;;
+                   "generate") ${ECHOCMD} "${GENERATE_HELP}" ;;
                    "show") ${ECHOCMD} "${SHOW_HELP}" ;;
                    "update") ${ECHOCMD} "${UPDATE_HELP}" ;;
                    "upload-only") ${ECHOCMD} "${UPLOAD_ONLY_HELP}" ;;
diff --git a/include/parameters b/include/parameters
index 96d63524..f3845526 100644
--- a/include/parameters
+++ b/include/parameters
@@ -111,6 +111,24 @@
                 break
             ;;
 
+            # Generate data
+            generate)
+                CHECK_BINARIES=0
+                HELPER="generate"
+                LOGTEXT=0
+                QUIET=1
+                RUN_HELPERS=1
+                RUN_TESTS=0
+                RUN_UPDATE_CHECK=0
+                SKIP_GETHOSTID=1
+                SKIP_PLUGINS=1
+                SKIP_VM_DETECTION=1
+                SHOW_PROGRAM_DETAILS=0
+                SHOW_TOOL_TIPS=0
+                shift; HELPER_PARAMS="$@"
+                break
+            ;;
+
             # Show Lynis details
             show)
                 CHECK_BINARIES=0

From a881c803e2566c5859724c7c4c081bf73044feeb Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 13 Apr 2019 13:28:13 +0200
Subject: [PATCH 088/679] Updated date and log

---
 CHANGELOG.md | 1 +
 lynis        | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8d73513c..98ee90d3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@
 - INSE-8300 - Presence of rsh client
 - INSE-8302 - Presence of rsh server
 - Detect equery binary detection
+- New 'generate' command
 
 ### Changed
 - AUTH-9278 - Test LDAP in all PAM components on Red Hat and other systems
diff --git a/lynis b/lynis
index e6263074..66aa36e4 100755
--- a/lynis
+++ b/lynis
@@ -35,8 +35,8 @@
     PROGRAM_AUTHOR_CONTACT="lynis-dev@cisofy.com"
 
     # Version details
-    PROGRAM_RELEASE_DATE="2019-03-29"
-    PROGRAM_RELEASE_TIMESTAMP=1553157295
+    PROGRAM_RELEASE_DATE="2019-04-13"
+    PROGRAM_RELEASE_TIMESTAMP=1555154865
     PROGRAM_RELEASE_TYPE="dev" # dev or final
     PROGRAM_VERSION="2.7.4"
 

From dba2dcb91881438eabdf54d47c56506f640fcb12 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Apr 2019 19:20:31 +0200
Subject: [PATCH 089/679] Added missing variables

---
 include/consts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/include/consts b/include/consts
index 24a32167..207cde8c 100644
--- a/include/consts
+++ b/include/consts
@@ -71,6 +71,7 @@ unset LANG
     CHKCONFIGBINARY=""
     CLAMCONF_BINARY=""
     CLAMSCANBINARY=""
+    CLANGBINARY=""
     COLORS=1
     COMPLIANCE_ENABLE_CIS=0
     COMPLIANCE_ENABLE_HIPAA=0
@@ -104,6 +105,7 @@ unset LANG
     ECHOCMD=""
     ERROR_ON_WARNINGS=0
     EQUERYBINARY=""
+    EXIMBINARY=""
     FAIL2BANBINARY=""
     FILEBINARY=""
     FILEVALUE=""
@@ -275,6 +277,7 @@ unset LANG
     TESTS_EXECUTED=""
     TESTS_SKIPPED=""
     TMPFILE=""
+    TOMOYOINITBINARY=""
     TOOLTIP_SHOWED=0
     TOTAL_SUGGESTIONS=0
     TOTAL_WARNINGS=0

From 2855e8503e67b4d2775df6c2bb177826d04004b6 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Apr 2019 19:20:43 +0200
Subject: [PATCH 090/679] Corrected CentOS entries

---
 db/software-eol.db | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/db/software-eol.db b/db/software-eol.db
index 39edb2da..df2ae36a 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -11,9 +11,9 @@
 #
 # CentOS
 #
-os:CentOS 5:2017-03-31:1490911200:
-os:CentOS 6:2020-11-30:1606690800:
-os:CentOS 7:2024-06-30:1719698400:
+os:CentOS Linux release 5:2017-03-31:1490911200:
+os:CentOS Linux release 6:2020-11-30:1606690800:
+os:CentOS Linux release 7:2024-06-30:1719698400:
 #
 # FreeBSD - https://www.freebsd.org/security/unsupported.html
 #

From 1d829294d384aef7ccd26ef0061f642b3e47320f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Apr 2019 19:20:51 +0200
Subject: [PATCH 091/679] Enhanced logging

---
 lynis | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lynis b/lynis
index 66aa36e4..d7121e5a 100755
--- a/lynis
+++ b/lynis
@@ -613,6 +613,9 @@ ${NORMAL}
         if [ ${EOL} -eq 1 ]; then
             echo "  End-of-life:               ${WARNING}YES${NORMAL}"
             ReportWarning "GEN-0010" "This version ${OS_VERSION} is marked end-of-life as of ${EOL_DATE}"
+        elif [ ${EOL} -eq 255 ]; then
+            # TODO - mark as item where community can provide help
+            LogText "Note: the end-of-life of '${OS_FULLNAME}' could not be checked. Entry missing in software-eol.db?"
         fi
 
         if [ ! -z "${OS_MODE}" ]; then echo "  Operating system mode:     ${OS_MODE}"; fi

From 5e8e2c5f832eb64176c7bc663607441302221a1d Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Apr 2019 19:21:51 +0200
Subject: [PATCH 092/679] Updated log

---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 98ee90d3..bfae40f4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,7 +19,8 @@
 - AUTH-9278 - Test LDAP in all PAM components on Red Hat and other systems
 - PKGS-7410 - Add support for DPKG-based systems to gather installed kernel packages
 - PKGS-7420 - Detect toolkit to automatically download and apply upgrades
-- Minor changes to improve text output and test descriptions
+- Minor changes to improve text output, test descriptions, and logging
+- Changed CentOS identifiers in end-of-life database
 - AIX enhancement for IsRunning function
 - Extended PackageIsInstalled function
 - Improve text output on AIX systems

From bf5219d9b9984888412387dd6adfd67976599688 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Apr 2019 19:30:21 +0200
Subject: [PATCH 093/679] [PKGS-7328/PKGS-7330] added non-interactive global
 option

---
 include/tests_ports_packages | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 09243391..dd1a391b 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -344,7 +344,7 @@
         COUNT=0
         PACKAGE_AUDIT_TOOL_FOUND=1
         PACKAGE_AUDIT_TOOL="zypper"
-        FIND=$(${ZYPPERBINARY} -n se -t package -i | ${AWKBINARY} '{ if ($1=="i") { print $3 } }')
+        FIND=$(${ZYPPERBINARY} --non-interactive -n se -t package -i | ${AWKBINARY} '{ if ($1=="i") { print $3 } }')
         if [ ! -z "${FIND}" ]; then
             for PKG in ${FIND}; do
                 COUNT=$((COUNT + 1))
@@ -365,7 +365,7 @@
     if [ ! -z "${ZYPPERBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7330 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Querying Zypper for vulnerable packages"
     if [ ${SKIPTEST} -eq 0 ]; then
-        FIND=$(${ZYPPERBINARY} -n pchk | ${GREPBINARY} "(0 security patches)")
+        FIND=$(${ZYPPERBINARY} --non-interactive -n pchk | ${GREPBINARY} "(0 security patches)")
         if [ ! -z "${FIND}" ]; then
             LogText "Result: No security updates found with Zypper"
             Display --indent 2 --text "- Using Zypper to find vulnerable packages" --result "${STATUS_NONE}" --color GREEN

From 7c03e5b8b68bbd3c731651224c514b5a0ccfde3f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Apr 2019 19:30:31 +0200
Subject: [PATCH 094/679] Updated log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bfae40f4..d659a81e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,8 @@
 - AUTH-9278 - Test LDAP in all PAM components on Red Hat and other systems
 - PKGS-7410 - Add support for DPKG-based systems to gather installed kernel packages
 - PKGS-7420 - Detect toolkit to automatically download and apply upgrades
+- PKGS-7328 - Added global Zypper option --non-interactive
+- PKGS-7330 - Added global Zypper option --non-interactive
 - Minor changes to improve text output, test descriptions, and logging
 - Changed CentOS identifiers in end-of-life database
 - AIX enhancement for IsRunning function

From 121c86144643973c71690c690b983ad2482ff9fd Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 17 Apr 2019 15:07:07 +0200
Subject: [PATCH 095/679] Non-interactive mode for zypper

---
 include/tests_ports_packages | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index dd1a391b..85509218 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -365,7 +365,7 @@
     if [ ! -z "${ZYPPERBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7330 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Querying Zypper for vulnerable packages"
     if [ ${SKIPTEST} -eq 0 ]; then
-        FIND=$(${ZYPPERBINARY} --non-interactive -n pchk | ${GREPBINARY} "(0 security patches)")
+        FIND=$(${ZYPPERBINARY} --non-interactive pchk | ${GREPBINARY} "(0 security patches)")
         if [ ! -z "${FIND}" ]; then
             LogText "Result: No security updates found with Zypper"
             Display --indent 2 --text "- Using Zypper to find vulnerable packages" --result "${STATUS_NONE}" --color GREEN
@@ -374,7 +374,7 @@
             LogText "Result: Zypper found one or more installed packages which are vulnerable."
             ReportWarning ${TEST_NO} "Found one or more vulnerable packages installed"
             # Unfortunately zypper does not properly give back which package it is. Usually best guess is last word on the line
-            FIND=$(${ZYPPERBINARY} -n lp | ${AWKBINARY} '{ if ($5=="security" || $7=="security") { print $NF }}' | ${SEDBINARY} 's/:$//' | ${GREPBINARY} -v "^$" | ${SORTBINARY} -u)
+            FIND=$(${ZYPPERBINARY} --non-interactive lp | ${AWKBINARY} '{ if ($5=="security" || $7=="security") { print $NF }}' | ${SEDBINARY} 's/:$//' | ${GREPBINARY} -v "^$" | ${SORTBINARY} -u)
             LogText "List of vulnerable packages/version:"
             for PKG in ${FIND}; do
                 VULNERABLE_PACKAGES_FOUND=1

From 017103e20cdfff205f8f4547dd360fc64fed9403 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 17 Apr 2019 15:26:43 +0200
Subject: [PATCH 096/679] [PKGS-7392] - Skip test for Zypper-based systems

---
 include/tests_ports_packages | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 85509218..17ff4065 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -1055,7 +1055,8 @@
 #
     # Test        : PKGS-7392
     # Description : Check Debian/Ubuntu vulnerable packages
-    if [ -x ${ROOTDIR}usr/bin/apt-get ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    # Note        : Skip for zypper-based systems
+    if [ -x ${ROOTDIR}usr/bin/apt-get -a -z "${ZYPPERBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7392 --os Linux --preqs-met ${PREQS_MET} --root-only YES --weight L --network YES --category security --description "Check for Debian/Ubuntu security updates"
     if [ ${SKIPTEST} -eq 0 ]; then
         VULNERABLE_PACKAGES_FOUND=0

From 70e985bfcb366ccd34e7474fbeb15e705e2f8fa6 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 17 Apr 2019 15:26:54 +0200
Subject: [PATCH 097/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d659a81e..ab960e7a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,7 @@
 - PKGS-7420 - Detect toolkit to automatically download and apply upgrades
 - PKGS-7328 - Added global Zypper option --non-interactive
 - PKGS-7330 - Added global Zypper option --non-interactive
+- PKGS-7392 - Skip test for Zypper-based systems
 - Minor changes to improve text output, test descriptions, and logging
 - Changed CentOS identifiers in end-of-life database
 - AIX enhancement for IsRunning function

From 96c1ea8b0e204428393fcb7fcc17d021521fc6ef Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 20 Apr 2019 14:31:11 +0200
Subject: [PATCH 098/679] [PKGS-7386] Removed suggestion as a warning is
 already displayed when vulnerable packages were discovered

---
 include/tests_ports_packages | 1 -
 1 file changed, 1 deletion(-)

diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 17ff4065..4bc75faa 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -930,7 +930,6 @@
                     AddHP 1 2
                 done
                 ReportWarning ${TEST_NO} "Found one or more vulnerable packages."
-                ReportSuggestion ${TEST_NO} "Use 'yum --security update' to update your system"
             fi
         else
             LogText "Result: yum-security package not found"

From b4f29924767cc3a7732ebd286c1f24582489c8ea Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 20 Apr 2019 14:31:41 +0200
Subject: [PATCH 099/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ab960e7a..39761be4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,7 @@
 - PKGS-7420 - Detect toolkit to automatically download and apply upgrades
 - PKGS-7328 - Added global Zypper option --non-interactive
 - PKGS-7330 - Added global Zypper option --non-interactive
+- PKGS-7386 - Only show warning when vulnerable packages were discovered
 - PKGS-7392 - Skip test for Zypper-based systems
 - Minor changes to improve text output, test descriptions, and logging
 - Changed CentOS identifiers in end-of-life database

From ae1a6d1e9d0bab87c2b3fd5d506cfefda4ccb22b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 21 Apr 2019 16:19:12 +0200
Subject: [PATCH 100/679] Release 2.7.4

---
 CHANGELOG.md | 6 +++++-
 lynis        | 6 +++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 39761be4..6d2cc671 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,10 @@
 # Lynis Changelog
 
-## Lynis 2.7.4 (not released yet)
+## Lynis 2.7.4 (2019-04-21)
+
+This is a bigger release than usual, including several new tests created by
+Capashenn (GitHub). It is a coincidence that it is released exactly one more
+after the previous version and on Easter. No easter eggs, only improvements!
 
 ### Added
 - FILE-6324 - Discover XFS mount points
diff --git a/lynis b/lynis
index d7121e5a..a6620452 100755
--- a/lynis
+++ b/lynis
@@ -35,9 +35,9 @@
     PROGRAM_AUTHOR_CONTACT="lynis-dev@cisofy.com"
 
     # Version details
-    PROGRAM_RELEASE_DATE="2019-04-13"
-    PROGRAM_RELEASE_TIMESTAMP=1555154865
-    PROGRAM_RELEASE_TYPE="dev" # dev or final
+    PROGRAM_RELEASE_DATE="2019-04-21"
+    PROGRAM_RELEASE_TIMESTAMP=1555856327
+    PROGRAM_RELEASE_TYPE="final" # dev or final
     PROGRAM_VERSION="2.7.4"
 
     # Source, documentation and license

From dc2962955e2e2a4a257b7b45799c7c9426e85721 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 21 Apr 2019 16:30:04 +0200
Subject: [PATCH 101/679] Updated log

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6d2cc671..e9bfd2ac 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,7 +3,7 @@
 ## Lynis 2.7.4 (2019-04-21)
 
 This is a bigger release than usual, including several new tests created by
-Capashenn (GitHub). It is a coincidence that it is released exactly one more
+Capashenn (GitHub). It is a coincidence that it is released exactly one month
 after the previous version and on Easter. No easter eggs, only improvements!
 
 ### Added

From 10b8da1c6a50ccd0598324dfa108c4a6ec46c25a Mon Sep 17 00:00:00 2001
From: bcs016 <mike.beijerbacht@gmail.com>
Date: Mon, 29 Apr 2019 11:47:11 +0200
Subject: [PATCH 102/679] Update tests_authentication

Update AUTH-9402, change name to check in etc/passwd file when device is a QNAP
---
 include/tests_authentication | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 2ede2b7d..fc785121 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -40,7 +40,12 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Search accounts with UID 0
         LogText "Test: Searching accounts with UID 0"
-        FIND=$(${GREPBINARY} ':0:' ${ROOTDIR}etc/passwd | ${EGREPBINARY} -v '^#|^root:|^(\+:\*)?:0:0:::' | ${CUTBINARY} -d ":" -f1,3 | ${GREPBINARY} ':0')
+        # Check if device is a QNAP, as the root user is called admin, and not root
+        if [ ${QNAP_DEVICE} -eq 1 ]; then
+            FIND=$(${GREPBINARY} ':0:' ${ROOTDIR}etc/passwd | ${EGREPBINARY} -v '^#|^admin:|^(\+:\*)?:0:0:::' | ${CUTBINARY} -d ":" -f1,3 | ${GREPBINARY} ':0')
+        else
+            FIND=$(${GREPBINARY} ':0:' ${ROOTDIR}etc/passwd | ${EGREPBINARY} -v '^#|^root:|^(\+:\*)?:0:0:::' | ${CUTBINARY} -d ":" -f1,3 | ${GREPBINARY} ':0')
+        fi
         if [ ! -z "${FIND}" ]; then
             Display --indent 2 --text "- Administrator accounts" --result "${STATUS_WARNING}" --color RED
             LogText "Result: Found more than one administrator accounts"

From 6ca24aae8baadd38bd9b797d547414d108e3adfc Mon Sep 17 00:00:00 2001
From: Nicolas CARPi <nicolas.carpi@curie.fr>
Date: Wed, 8 May 2019 01:01:43 +0200
Subject: [PATCH 103/679] Add PHP ini file locations for Ubuntu 18.04. Fix #628

---
 include/tests_php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/include/tests_php b/include/tests_php
index 363321cf..76606c64 100644
--- a/include/tests_php
+++ b/include/tests_php
@@ -42,6 +42,9 @@
                 ${ROOTDIR}etc/php5/apache2/php.ini \
                 ${ROOTDIR}etc/php5/fpm/php.ini \
                 ${ROOTDIR}private/etc/php.ini \
+                ${ROOTDIR}etc/php/7.2/apache2/php.ini \
+                ${ROOTDIR}etc/php/7.1/apache2/php.ini \
+                ${ROOTDIR}etc/php/7.0/apache2/php.ini \
                 ${ROOTDIR}etc/php/7.2/cli/php.ini ${ROOTDIR}etc/php/7.2/fpm/php.ini \
                 ${ROOTDIR}etc/php/7.1/cli/php.ini ${ROOTDIR}etc/php/7.1/fpm/php.ini \
                 ${ROOTDIR}etc/php/7.0/cli/php.ini ${ROOTDIR}etc/php/7.0/fpm/php.ini \

From 8e61275ff496c4b2170379410106ebc5e903e1ef Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 16 May 2019 15:23:23 +0200
Subject: [PATCH 104/679] Move state recording to report section

---
 include/report               | 114 +++++++++++++++++++++--------------
 include/tests_firewalls      |   5 --
 include/tests_networking     |   3 -
 include/tests_ports_packages |   7 ---
 4 files changed, 69 insertions(+), 60 deletions(-)

diff --git a/include/report b/include/report
index b200f6be..2df666e4 100644
--- a/include/report
+++ b/include/report
@@ -22,55 +22,79 @@
 #
 #################################################################################
 #
+
+    # Add data fields to report file
+    Report "dhcp_client_running=${DHCP_CLIENT_RUNNING}"
+    Report "arpwatch_running=${ARPWATCH_RUNNING}"
+
+    # Report firewall installed for now, if we found one active. Next step would be determining binaries first and apply additional checks.
+    Report "firewall_active=${FIREWALL_ACTIVE}"
+    Report "firewall_empty_ruleset=${FIREWALL_EMPTY_RULESET}"
+    Report "firewall_installed=${FIREWALL_ACTIVE}"
+
+    if [ ! -z "${INSTALLED_PACKAGES}" ]; then Report "installed_packages_array=${INSTALLED_PACKAGES}"; fi
+
+    Report "package_audit_tool=${PACKAGE_AUDIT_TOOL}"
+    Report "package_audit_tool_found=${PACKAGE_AUDIT_TOOL_FOUND}"
+    Report "vulnerable_packages_found=${VULNERABLE_PACKAGES_FOUND}"
+
+
     # Hardening Index
-    # Define approximately how strong a machine has been hardened
 
-        # If no hardening has been found, set value to 1
-        if [ ${HPPOINTS} -eq 0 ]; then HPPOINTS=1; HPTOTAL=100; fi
-        HPINDEX=$((HPPOINTS * 100 / HPTOTAL))
-        HPAOBLOCKS=$((HPPOINTS * 20 / HPTOTAL))
-        # Set color related to rating
-        if [ ${HPINDEX} -lt 50 ]; then
-            HPCOLOR="${RED}"
-            HIDESCRIPTION="System has not or a low amount been hardened"
-        elif [ ${HPINDEX} -gt 49 -a ${HPINDEX} -lt 80 ]; then
-            HPCOLOR="${YELLOW}"
-            HIDESCRIPTION="System has been hardened, but could use additional hardening"
-        elif [ ${HPINDEX} -gt 79 -a ${HPINDEX} -lt 90 ]; then
-            HPCOLOR="${GREEN}"
-            HIDESCRIPTION="System seem to be decent hardened"
-        elif [ ${HPINDEX} -gt 89 ]; then
-            HPCOLOR="${GREEN}"
-            HIDESCRIPTION="System seem to be well hardened"
-        fi
+    # Goal:
+    # Provide a visual way to show how much the system is hardened
+    #
+    # Important:
+    # The index gives a simplified version of the measures taken on the system.
+    # It should be used to get a first impression about the state of the system or to compare similar systems.
+    # Getting the maximum score (100 or full bar) does not indicate that the system is fully secured.
 
-        case ${HPAOBLOCKS} in
-            0)  HPBLOCKS="#"; HPEMPTY="                   " ;;
-            1)  HPBLOCKS="#"; HPEMPTY="                   " ;;
-            2)  HPBLOCKS="##"; HPEMPTY="                  " ;;
-            3)  HPBLOCKS="###"; HPEMPTY="                 " ;;
-            4)  HPBLOCKS="####"; HPEMPTY="                " ;;
-            5)  HPBLOCKS="#####"; HPEMPTY="               " ;;
-            6)  HPBLOCKS="######"; HPEMPTY="              " ;;
-            7)  HPBLOCKS="#######"; HPEMPTY="             " ;;
-            8)  HPBLOCKS="########"; HPEMPTY="            " ;;
-            9)  HPBLOCKS="#########"; HPEMPTY="           " ;;
-            10) HPBLOCKS="##########"; HPEMPTY="          " ;;
-            11) HPBLOCKS="###########"; HPEMPTY="         " ;;
-            12) HPBLOCKS="############"; HPEMPTY="        " ;;
-            13) HPBLOCKS="#############"; HPEMPTY="       " ;;
-            14) HPBLOCKS="##############"; HPEMPTY="      " ;;
-            15) HPBLOCKS="###############"; HPEMPTY="     " ;;
-            16) HPBLOCKS="################"; HPEMPTY="    " ;;
-            17) HPBLOCKS="#################"; HPEMPTY="   " ;;
-            18) HPBLOCKS="##################"; HPEMPTY="  " ;;
-            19) HPBLOCKS="###################"; HPEMPTY=" " ;;
-            20) HPBLOCKS="####################"; HPEMPTY="" ;;
-        esac
+    # If no hardening has been found, set value to 1
+    if [ ${HPPOINTS} -eq 0 ]; then HPPOINTS=1; HPTOTAL=100; fi
+    HPINDEX=$((HPPOINTS * 100 / HPTOTAL))
+    HPAOBLOCKS=$((HPPOINTS * 20 / HPTOTAL))
+    # Set color related to rating
+    if [ ${HPINDEX} -lt 50 ]; then
+        HPCOLOR="${RED}"
+        HIDESCRIPTION="System has not or a low amount been hardened"
+    elif [ ${HPINDEX} -gt 49 -a ${HPINDEX} -lt 80 ]; then
+        HPCOLOR="${YELLOW}"
+        HIDESCRIPTION="System has been hardened, but could use additional hardening"
+    elif [ ${HPINDEX} -gt 79 -a ${HPINDEX} -lt 90 ]; then
+        HPCOLOR="${GREEN}"
+        HIDESCRIPTION="System seem to be decent hardened"
+    elif [ ${HPINDEX} -gt 89 ]; then
+        HPCOLOR="${GREEN}"
+        HIDESCRIPTION="System seem to be well hardened"
+    fi
 
-        HPGRAPH="[${HPCOLOR}${HPBLOCKS}${NORMAL}${HPEMPTY}]"
-        LogText "Hardening index : [${HPINDEX}] [${HPBLOCKS}${HPEMPTY}]"
-        LogText "Hardening strength: ${HIDESCRIPTION}"
+    case ${HPAOBLOCKS} in
+        0)  HPBLOCKS="#"; HPEMPTY="                   " ;;
+        1)  HPBLOCKS="#"; HPEMPTY="                   " ;;
+        2)  HPBLOCKS="##"; HPEMPTY="                  " ;;
+        3)  HPBLOCKS="###"; HPEMPTY="                 " ;;
+        4)  HPBLOCKS="####"; HPEMPTY="                " ;;
+        5)  HPBLOCKS="#####"; HPEMPTY="               " ;;
+        6)  HPBLOCKS="######"; HPEMPTY="              " ;;
+        7)  HPBLOCKS="#######"; HPEMPTY="             " ;;
+        8)  HPBLOCKS="########"; HPEMPTY="            " ;;
+        9)  HPBLOCKS="#########"; HPEMPTY="           " ;;
+        10) HPBLOCKS="##########"; HPEMPTY="          " ;;
+        11) HPBLOCKS="###########"; HPEMPTY="         " ;;
+        12) HPBLOCKS="############"; HPEMPTY="        " ;;
+        13) HPBLOCKS="#############"; HPEMPTY="       " ;;
+        14) HPBLOCKS="##############"; HPEMPTY="      " ;;
+        15) HPBLOCKS="###############"; HPEMPTY="     " ;;
+        16) HPBLOCKS="################"; HPEMPTY="    " ;;
+        17) HPBLOCKS="#################"; HPEMPTY="   " ;;
+        18) HPBLOCKS="##################"; HPEMPTY="  " ;;
+        19) HPBLOCKS="###################"; HPEMPTY=" " ;;
+        20) HPBLOCKS="####################"; HPEMPTY="" ;;
+    esac
+
+    HPGRAPH="[${HPCOLOR}${HPBLOCKS}${NORMAL}${HPEMPTY}]"
+    LogText "Hardening index : [${HPINDEX}] [${HPBLOCKS}${HPEMPTY}]"
+    LogText "Hardening strength: ${HIDESCRIPTION}"
 
 
     # Only show overview if not running in quiet mode
diff --git a/include/tests_firewalls b/include/tests_firewalls
index 85f2b150..735059fe 100644
--- a/include/tests_firewalls
+++ b/include/tests_firewalls
@@ -596,11 +596,6 @@
 #################################################################################
 #
 
-# Report firewall installed for now, if we found one active. Next step would be determining binaries first and apply additional checks.
-Report "firewall_active=${FIREWALL_ACTIVE}"
-Report "firewall_empty_ruleset=${FIREWALL_EMPTY_RULESET}"
-Report "firewall_installed=${FIREWALL_ACTIVE}"
-
 WaitForKeyPress
 
 #
diff --git a/include/tests_networking b/include/tests_networking
index 3986220b..5d5df2f6 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -634,9 +634,6 @@
 #################################################################################
 #
 
-Report "dhcp_client_running=${DHCP_CLIENT_RUNNING}"
-Report "arpwatch_running=${ARPWATCH_RUNNING}"
-
 WaitForKeyPress
 
 #
diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 4bc75faa..2d8b997e 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -1340,13 +1340,6 @@
 #################################################################################
 #
 
-
-if [ ! -z "${INSTALLED_PACKAGES}" ]; then Report "installed_packages_array=${INSTALLED_PACKAGES}"; fi
-
-Report "package_audit_tool=${PACKAGE_AUDIT_TOOL}"
-Report "package_audit_tool_found=${PACKAGE_AUDIT_TOOL_FOUND}"
-Report "vulnerable_packages_found=${VULNERABLE_PACKAGES_FOUND}"
-
 WaitForKeyPress
 
 #

From a271cb90c89a22da56b344d4bf7787c426d97f4a Mon Sep 17 00:00:00 2001
From: lowkey <dvehrs@gmail.com>
Date: Thu, 23 May 2019 14:31:36 -0600
Subject: [PATCH 105/679] Added certificate tests for Exim

---
 include/tests_mail_messaging | 77 ++++++++++++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)

diff --git a/include/tests_mail_messaging b/include/tests_mail_messaging
index b74a7c5e..e740eaf8 100644
--- a/include/tests_mail_messaging
+++ b/include/tests_mail_messaging
@@ -161,6 +161,83 @@
                 LogText "Result: Private Key not set."
                 Display --indent 4 --text "- Private Key not set" --result "${STATUS_WARNING}" --color WHITE
             fi
+
+            LogText "Test: Exim Verify Certificates"
+
+            case "${EXIM_TYPE}" in
+                "INTERNET HOST" | "SMARTHOST" )
+                    EXIM_CERTIFICATES=$(exim -bP tls_verify_certificate | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
+                    ;;
+                "SATELLITE" )
+                    EXIM_CERTIFICATES=$(exim -bP transport remote_smtp_smarthost | grep tls_verify_certificate | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
+                    ;;
+            esac
+
+            case "${EXIM_CERTIFICATES}" in
+                "")
+                    # This condition results in a RED warning because it should
+                    # never be hit.
+                    LogText "Result: Verify Certificates not set"
+                    Display --indent 4 --text "- Verify Certificates not set" --result "${STATUS_WARNING}" --color RED
+                    ;;
+                "system")
+                    # This is the default setting and should be the most common.
+                    LogText "Result: Verify Certificates set to system default"
+                    Display --indent 4 --text "- Verify Certificates" --result "DEFAULT" --color WHITE
+                    ;;
+                *)
+                    # This condition should only be hit when it has been set to
+                    # a custom value.
+                    LogText "Result: Verify Certificates set to \"${EXIM_CERTIFICATES}\""
+                    Display --indent 4 --text "- Verify Certificates" --result "CUSTOM" --color GREEN
+                    ;;
+            esac
+
+
+            case "${EXIM_TYPE}" in
+                "INTERNET HOST" | "SMARTHOST" )
+                    EXIM_VERIFY_HOSTS=$(exim -bP tls_verify_hosts | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
+                    EXIM_TRY_VERIFY_HOSTS=$(exim -bP tls_try_verify_hosts | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
+                    ;;
+                "SATELLITE" )
+                    EXIM_VERIFY_HOSTS=$(exim -bP transport remote_smtp_smarthost | grep tls_verify_hosts | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
+                    EXIM_TRY_VERIFY_HOSTS=$(exim -bP transport remote_smtp_smarthost | grep tls_try_verify_hosts | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
+                    ;;
+            esac
+
+            LogText "Test: Exim Try Verify Hosts"
+            if [ ! -z "${EXIM_TRY_VERIFY_HOSTS}" ]; then
+                case "${EXIM_TYPE}" in
+                    "INTERNET HOST" )
+                        LogText "Result: Try Verify Hosts enabled."
+                        Display --indent 4 --text "- Try Verify Hosts" --result "ENABLED" --color GREEN
+                        ;;
+                    "SATELLITE" | "SMARTHOST" )
+                        LogText "Result: Try Verify Hosts."
+                        Display --indent 4 --text "- Try Verify Hosts" --result "ENABLED" --color YELLOW
+                        ;;
+                esac
+            else
+                LogText "Result: Try Verify Hosts not enabled."
+                Display --indent 4 --text "- Try Verify Hosts" --result "NOT ENABLED" --color WHITE
+            fi
+
+            LogText "Test: Exim Verify Hosts"
+            if [ ! -z "${EXIM_VERIFY_HOSTS}" ]; then
+                case "${EXIM_TYPE}" in
+                    "INTERNET HOST" )
+                        LogText "Result: Verify Hosts."
+                        Display --indent 4 --text "- Verify Hosts" --result "ENABLED" --color YELLOW
+                        ;;
+                    "SATELLITE" | "SMARTHOST" )
+                        LogText "Result: Verify Hosts."
+                        Display --indent 4 --text "- Verify Hosts" --result "ENABLED" --color GREEN
+                        ;;
+                esac
+            else
+                LogText "Result: Verify Hosts."
+                Display --indent 4 --text "- Verify Hosts" --result "NOT ENABLED" --color WHITE
+            fi
         fi
     fi
 

From 4370c4a2417bb3a5a27aa6725fb3dac9e84f5742 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
 <konstruktoid@users.noreply.github.com>
Date: Thu, 30 May 2019 10:36:26 +0000
Subject: [PATCH 106/679] update CentOS releases in software-eol.db (#721)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
 db/software-eol.db | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/db/software-eol.db b/db/software-eol.db
index df2ae36a..525920a5 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -11,8 +11,8 @@
 #
 # CentOS
 #
-os:CentOS Linux release 5:2017-03-31:1490911200:
-os:CentOS Linux release 6:2020-11-30:1606690800:
+os:CentOS release 5:2017-03-31:1490911200:
+os:CentOS release 6:2020-11-30:1606690800:
 os:CentOS Linux release 7:2024-06-30:1719698400:
 #
 # FreeBSD - https://www.freebsd.org/security/unsupported.html
@@ -43,4 +43,4 @@ os:Ubuntu 17.04:2018-01-01:1514761200:
 os:Ubuntu 17.10:2018-07-01:1530396000:
 os:Ubuntu 18.04:2023-05-01:1682892000:
 os:Ubuntu 18.10:2019-07-01:1561932000:
-os:Ubuntu 19.04:2020-01-01:1577833200:
\ No newline at end of file
+os:Ubuntu 19.04:2020-01-01:1577833200:

From a64e3966c9cc419bcbe86806a11a1d1daf054409 Mon Sep 17 00:00:00 2001
From: Patark <Patark@users.noreply.github.com>
Date: Thu, 30 May 2019 12:38:11 +0200
Subject: [PATCH 107/679] Add danish language support (#718)

---
 db/languages/da | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 db/languages/da

diff --git a/db/languages/da b/db/languages/da
new file mode 100644
index 00000000..d26c1220
--- /dev/null
+++ b/db/languages/da
@@ -0,0 +1,41 @@
+ERROR_NO_LICENSE="Ingen licensnøgle konfigureret"
+ERROR_NO_UPLOAD_SERVER="Ingen upload server konfigureret"
+GEN_CHECKING="Tjekker"
+GEN_CURRENT_VERSION="Nuværende version"
+GEN_DEBUG_MODE="Fejlfindingstilstand"
+GEN_INITIALIZE_PROGRAM="Initialiserer program"
+GEN_LATEST_VERSION="Seneste version"
+GEN_PHASE="Fase"
+GEN_PLUGINS_ENABLED="Plugins aktiverede"
+GEN_UPDATE_AVAILABLE="opdatering tilgængelig"
+GEN_VERBOSE_MODE="Detaljeret tilstand"
+GEN_WHAT_TO_DO="At gøre"
+NOTE_EXCEPTIONS_FOUND="Undtagelser fundet"
+NOTE_EXCEPTIONS_FOUND_DETAILED="Nogle usædvanlige hændelser eller information var fundet"
+NOTE_PLUGINS_TAKE_TIME="Bemærk: plugins har mere omfattende tests og kan tage flere minutter at fuldføre"
+NOTE_SKIPPED_TESTS_NON_PRIVILEGED="Sprang over tests på grund af ikke-privilegeret tilstand"
+SECTION_CUSTOM_TESTS="Brugerdefinerede Tests"
+SECTION_MALWARE="Malware"
+SECTION_MEMORY_AND_PROCESSES="Hukommelse og Processer"
+STATUS_DISABLED="DEAKTIVERET"
+STATUS_DONE="FÆRDIG"
+STATUS_ENABLED="AKTIVERET"
+STATUS_NOT_ENABLED="IKKE AKTIVERET"
+STATUS_ERROR="FEJL"
+STATUS_FOUND="FUNDET"
+STATUS_YES="JA"
+STATUS_NO="NEJ"
+STATUS_OFF="FRA"
+STATUS_OK="OK"
+STATUS_ON="TIL"
+STATUS_NONE="INGEN"
+STATUS_NOT_FOUND="IKKE FUNDET"
+STATUS_NOT_RUNNING="KØRER IKKE"
+STATUS_RUNNING="KØRER"
+STATUS_SKIPPED="SPRUNGET OVER"
+STATUS_SUGGESTION="FORSLAG"
+STATUS_UNKNOWN="UKENDT"
+STATUS_WARNING="ADVARSEL"
+STATUS_WEAK="SVAG"
+TEXT_YOU_CAN_HELP_LOGFILE="Du kan hjælpe ved at bidrage med din logfil"
+TEXT_UPDATE_AVAILABLE="opdatering tilgængelig"

From 59b102989f95c245da9814dd417f570a061344dc Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 6 Jun 2019 14:13:05 +0200
Subject: [PATCH 108/679] [AUTH-9268] AIX find does not support maxdepth

---
 include/tests_authentication | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 2ede2b7d..7b8bacda 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -669,8 +669,8 @@
             if [ -d ${DIR} -a ! -L ${DIR} ]; then
                 LogText "Result: directory ${DIR} exists"
                 # Search in the specified directory
-                if [ "${OS}" = "Solaris" ]; then
-                    # Solaris does not support -maxdepth
+                if [ "${OS}" = "AIX" -o "${OS}" = "Solaris" ]; then
+                    # AIX/Solaris does not support -maxdepth
                     FIND=$(find ${DIR} -type f -name "pam_*.so" -print | sort)
                 else
                     FIND=$(find ${DIR} -maxdepth 1 -type f -name "pam_*.so" -print | sort)

From 61d8c91eebee5471e6fd16c8d1cdf01542ccb3cb Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 6 Jun 2019 14:20:12 +0200
Subject: [PATCH 109/679] [FILE-6310] filter on correct field for AIX

---
 include/tests_filesystems | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/include/tests_filesystems b/include/tests_filesystems
index 7dc61933..4e52ea5e 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -48,7 +48,11 @@
                 Display --indent 4 --text "- Checking ${I} mount point" --result SYMLINK --color WHITE
             elif [ -d ${I} ]; then
                 LogText "Result: directory ${I} exists"
-                FIND=$(${MOUNTBINARY} | ${AWKBINARY} -v MP=${I} '{ if ($3==MP) { print $3 }}')
+                case "${OS}" in
+                    "AIX") FIND=$(${MOUNTBINARY} | ${AWKBINARY} -v MP=${I} '{ if ($2==MP) { print $2 }}') ;;
+                    *) FIND=$(${MOUNTBINARY} | ${AWKBINARY} -v MP=${I} '{ if ($3==MP) { print $3 }}') ;;
+                esac
+
                 if IsEmpty "${FIND}"; then
                     LogText "Result: ${I} not found in mount list. Directory most likely stored on / file system"
                     Display --indent 4 --text "- Checking ${I} mount point" --result "${STATUS_SUGGESTION}" --color YELLOW

From 9b02934339e7bf593de3fb8112e8a7e7d1ba1b1d Mon Sep 17 00:00:00 2001
From: pyllyukko <pyllyukko@maimed.org>
Date: Thu, 6 Jun 2019 15:41:29 +0300
Subject: [PATCH 110/679] Detect BSD-style (rc.d) init in Linux systems

---
 include/tests_boot_services | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/include/tests_boot_services b/include/tests_boot_services
index 5495938c..42b8dab1 100644
--- a/include/tests_boot_services
+++ b/include/tests_boot_services
@@ -96,7 +96,11 @@
                                 ;;
 
                                 "init" | "initsplash")
-                                    SERVICE_MANAGER="SysV Init"
+                                    if [ -d ${ROOTDIR}etc/rc.d ]; then
+                                        SERVICE_MANAGER="bsdrc.d"
+                                    else
+                                        SERVICE_MANAGER="SysV Init"
+                                    fi
                                 ;;
                                 systemd)
                                     SERVICE_MANAGER="systemd"

From 2065b06e9550feaa085e140bdd9cdb61ed951524 Mon Sep 17 00:00:00 2001
From: pyllyukko <pyllyukko@maimed.org>
Date: Wed, 12 Jun 2019 11:44:22 +0300
Subject: [PATCH 111/679] Added Slackware Linux EOLs

---
 db/software-eol.db | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/db/software-eol.db b/db/software-eol.db
index 525920a5..084a5815 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -44,3 +44,19 @@ os:Ubuntu 17.10:2018-07-01:1530396000:
 os:Ubuntu 18.04:2023-05-01:1682892000:
 os:Ubuntu 18.10:2019-07-01:1561932000:
 os:Ubuntu 19.04:2020-01-01:1577833200:
+#
+# Slackware - https://en.wikipedia.org/wiki/Slackware#Releases
+#
+os:Slackware Linux 8.1:2012-08-01:1343768400:
+os:Slackware Linux 9.0:2012-08-01:1343768400:
+os:Slackware Linux 9.1:2012-08-01:1343768400:
+os:Slackware Linux 10.0:2012-08-01:1343768400:
+os:Slackware Linux 10.1:2012-08-01:1343768400:
+os:Slackware Linux 10.2:2012-08-01:1343768400:
+os:Slackware Linux 11.0:2012-08-01:1343768400:
+os:Slackware Linux 12.0:2012-08-01:1343768400:
+os:Slackware Linux 12.1:2013-12-09:1386540000:
+os:Slackware Linux 12.2:2013-12-09:1386540000:
+os:Slackware Linux 13.0:2018-07-05:1530738000:
+os:Slackware Linux 13.1:2018-07-05:1530738000:
+os:Slackware Linux 13.37:2018-07-05:1530738000:

From 6d55767c18041d8bcc9add0a7633c754248816fc Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 17 Jun 2019 12:16:29 +0200
Subject: [PATCH 112/679] Include 'generate' command

---
 include/helper_show | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/helper_show b/include/helper_show
index a696b0e7..874b3e1b 100644
--- a/include/helper_show
+++ b/include/helper_show
@@ -28,7 +28,7 @@
 #
 ######################################################################
 
-COMMANDS="audit configure show update upload-only"
+COMMANDS="audit configure generate show update upload-only"
 HELPERS="audit configure show update"
 OPTIONS="--auditor\n--cronjob (--cron)\n--debug\n--developer\n--help (-h)\n--license-key\n--log-file\n--manpage (--man)\n--no-colors\n--no-log\n--pentest\n--profile\n--plugin-dir\n--quick (-Q)\n--quiet (-q)\n--report-file\n--reverse-colors\n--skip-plugins\n--tests\n--tests-from-category\n--tests-from-group\n--upload\n--verbose\n--version (-V)\n--wait\n--warnings-only"
 

From cf57424f1a419e50079d805dab4e4e2205b29918 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 17 Jun 2019 12:18:08 +0200
Subject: [PATCH 113/679] Preparing 2.7.5 release

---
 CHANGELOG.md | 14 ++++++++++++++
 lynis        |  8 ++++----
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e9bfd2ac..a6604115 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Lynis Changelog
 
+## Lynis 2.7.5 (not released yet)
+
+### Added
+- Danish translation
+
+### Changed
+- Corrected end-of-life entries for CentOS 5 and 6
+- AUTH-9268 - AIX enhancement to use correct find statement
+- FILE-6310 - Filter on correct field for AIX
+- Extended help
+
+---------------------------------------------------------------------------------
+
+
 ## Lynis 2.7.4 (2019-04-21)
 
 This is a bigger release than usual, including several new tests created by
diff --git a/lynis b/lynis
index a6620452..800c3b7b 100755
--- a/lynis
+++ b/lynis
@@ -35,10 +35,10 @@
     PROGRAM_AUTHOR_CONTACT="lynis-dev@cisofy.com"
 
     # Version details
-    PROGRAM_RELEASE_DATE="2019-04-21"
-    PROGRAM_RELEASE_TIMESTAMP=1555856327
-    PROGRAM_RELEASE_TYPE="final" # dev or final
-    PROGRAM_VERSION="2.7.4"
+    PROGRAM_RELEASE_DATE="2019-06-17"
+    PROGRAM_RELEASE_TIMESTAMP=1560766656
+    PROGRAM_RELEASE_TYPE="dev" # dev or final
+    PROGRAM_VERSION="2.7.5"
 
     # Source, documentation and license
     PROGRAM_SOURCE="https://github.com/CISOfy/lynis"

From ef89ee3fc9341cff19bb08d7580904199020274b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 24 Jun 2019 13:39:30 +0200
Subject: [PATCH 114/679] [NETW-3012] make ss command output preferred for
 Linux system and changed output format

---
 include/tests_networking | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/include/tests_networking b/include/tests_networking
index 5d5df2f6..b43970ce 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -370,6 +370,7 @@
     # Description : Check listening ports
     Register --test-no NETW-3012 --weight L --network NO --category security --description "Check listening ports"
     if [ ${SKIPTEST} -eq 0 ]; then
+        DATA=""
         FIND=""; FIND2=""
         COUNT=0
         case ${OS} in
@@ -381,24 +382,19 @@
                     FIND=""
                 fi
                 FIND2=""
-                ;;
+            ;;
             Linux)
-                if [ ! -z "${NETSTATBINARY}" ]; then
+                if [ -n "${SSBINARY}" ]; then
+                    DATA=$(${SSBINARY} --query=udp,tcp -plnt | awk '{ if ($1!="Netid") { print "raw,ss,v1|"$1"|"$5"|"$7"|" }}' | sed 's/pid=[0-9]\{1,\},fd=[0-9]\{1,\}//g' | sed 's/users://' | sed 's/,)//g' | tr -d '()"')
+                elif [ -n "${NETSTATBINARY}" ]; then
                     # UDP
                     FIND=$(${NETSTATBINARY} -nlp 2> /dev/null | ${GREPBINARY} "^udp" | ${AWKBINARY} '{ print $4"|"$1"|"$6"|" }' | ${SEDBINARY} 's:|[0-9]*/:|:')
                     # TCP
                     FIND2=$(${NETSTATBINARY} -nlp 2> /dev/null  | ${GREPBINARY} "^tcp" | ${AWKBINARY} '{ if($6=="LISTEN") { print $4"|"$1"|"$7"|" }}' | ${SEDBINARY} 's:|[0-9]*/:|:')
                 else
-                    if [ ! "${SSBINARY}" = "" ]; then
-                        # UDP
-                        FIND=$(${SSBINARY} -u -a -n 2> /dev/null | ${AWKBINARY} '{ print $4 }' | ${GREPBINARY} -v Local)
-                        # TCP
-                        FIND2=$(${SSBINARY} -t -a -n 2> /dev/null | ${AWKBINARY} '{ print $4 }' | ${GREPBINARY} -v Local)
-                    else
-                        ReportException "${TEST_NO}:1" "netstat and ss binary missing to gather listening ports"
-                    fi
+                    ReportException "${TEST_NO}:1" "netstat and ss binary missing to gather listening ports"
                 fi
-                ;;
+            ;;
 
             macOS)
                 if [ ! "${LSOFBINARY}" = "" ]; then
@@ -409,9 +405,7 @@
                 fi
                 # Not needed as we have a combined test
                 FIND2=""
-                ;;
-
-
+            ;;
             NetBSD)
                 if [ ! "${SOCKSTATBINARY}" = "" ]; then
                     FIND=$(${SOCKSTATBINARY} 2> /dev/null | ${AWKBINARY} '{ if ($7 ~ /\*.\*/) print $5"|"$6"|"$2"|" }' | ${SORTBINARY} -u)
@@ -419,7 +413,7 @@
                     FIND=""
                 fi
                 FIND2=""
-                ;;
+            ;;
             OpenBSD)
                 if [ ! "${NETSTATBINARY}" = "" ]; then
                     # UDP
@@ -429,13 +423,20 @@
                 else
                     ReportException "${TEST_NO}:3" "netstat missing to gather listening ports"
                 fi
-                ;;
+            ;;
             *)
                 # Got this exception? Provide your details and output of netstat or any other tool to determine this information.
                 ReportException "${TEST_NO}:2" "Unclear what method to use, to determine listening port information"
-                ;;
+            ;;
         esac
 
+        if HasData "${DATA}"; then
+            for ITEM in ${DATA}; do
+                COUNT=$((COUNT + 1))
+                Report "network_listen[]=${ITEM}"
+            done
+        fi
+
         # Retrieve information from sockstat, when available
         LogText "Test: Retrieving sockstat information to find listening ports"
         if HasData "${FIND}"; then
@@ -453,11 +454,10 @@
                 Report "network_listen_port[]=${ITEM}"
             done
         fi
-        if [ "${FIND}" = "" -a "${FIND2}" = "" ]; then
+        if [ -z "${DATA}" -a -z "${FIND}" ]; then
             Display --indent 2 --text "- Getting listening ports (TCP/UDP)" --result "${STATUS_SKIPPED}" --color YELLOW
         else
             Display --indent 2 --text "- Getting listening ports (TCP/UDP)" --result "${STATUS_DONE}" --color GREEN
-            Display --indent 6 --text "* Found ${COUNT} ports"
         fi
     fi
 #

From 6f3c268c57ae196ccfc4f0c4b3f620f20653d642 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 24 Jun 2019 15:23:30 +0200
Subject: [PATCH 115/679] Non-functional code removed as it does not work as
 intended and lacks required validation controls - Thanks to Sander Bos for
 reporting

---
 include/helper_audit_dockerfile | 25 +++++++------------------
 1 file changed, 7 insertions(+), 18 deletions(-)

diff --git a/include/helper_audit_dockerfile b/include/helper_audit_dockerfile
index efe73d28..273bb347 100644
--- a/include/helper_audit_dockerfile
+++ b/include/helper_audit_dockerfile
@@ -19,25 +19,14 @@
 #################################################################################
 
 if [ $# -eq 0 ]; then
-    Display --indent 2 --text "${RED}Error: ${WHITE}Provide URL or file${NORMAL}"
+    Display --indent 2 --text "${RED}Error: ${WHITE}Provide a file${NORMAL}"
     Display --text " "; Display --text " "
     ExitFatal
 else
     FILE=$(echo $1 | egrep "^http|https")
     if HasData "${FILE}"; then
-        CreateTempFile
-        TMP_FILE="${TEMP_FILE}"
-        Display --indent 2 --text "Downloading URL ${FILE} with wget"
-        wget -o ${TMP_FILE} ${FILE}
-        if [ $? -gt 0 ]; then
-            AUDIT_FILE="${TMP_FILE}"
-        else
-            if [ -f ${TMP_FILE} ]; then
-                rm -f ${TMP_FILE}
-            fi
-            Display --indent 2 --text "${RED}Error: ${WHITE}can not download file${NORMAL}"
-            ExitFatal
-        fi
+        echo "Provide a file (not a URL)"
+        ExitFatal
     else
         if [ -f $1 ]; then
             AUDIT_FILE="$1"
@@ -110,14 +99,14 @@ InsertSection "Basics"
 
     #FIND=$(egrep "^MAINTAINER" ${AUDIT_FILE} | sed 's/ /:space:/g')
     FIND=$(egrep -i "*MAINTAINER" ${AUDIT_FILE}  |  sed 's/=/ /g' | cut -d'"' -f 2)
-    if [ "${FIND}" = "" ]; then
+    if [ -z "${FIND}" ]; then
         ReportWarning "dockerfile" "No maintainer found. Unclear who created this file."
     else
         #MAINTAINER=$(echo ${FIND} | sed 's/:space:/ /g' | awk '{ if($1=="MAINTAINER") { print }}')
         MAINTAINER=$(echo ${FIND})
         Display --indent 2 --text "Maintainer" --result "${MAINTAINER}"
     fi
-    
+
     FIND=$(grep "^ENTRYPOINT" ${AUDIT_FILE} | cut -d' ' -f2 )
     if [ "${FIND}" = "" ]; then
         ReportWarning "dockerfile" "No ENTRYPOINT defined in Dockerfile."
@@ -127,7 +116,7 @@ InsertSection "Basics"
     fi
 
     FIND=$(grep "^CMD" ${AUDIT_FILE} | cut -d' ' -f2 )
-    if [ "${FIND}" = "" ]; then
+    if [ -z "${FIND}" ]; then
         ReportWarning "dockerfile" "No CMD defines in Dockerfile."
     else
         CMD=$(echo ${FIND})
@@ -135,7 +124,7 @@ InsertSection "Basics"
     fi
 
     FIND=$(grep "^USER" ${AUDIT_FILE} | cut -d' ' -f2 )
-    if [ "${FIND}" = "" ]; then
+    if [ -z "${FIND}" ]; then
         ReportWarning "dockerfile" "No user declared in Dockerfile. Container will execute command as root"
     else
         USER=$(echo ${FIND})

From b0f966ae48591adf07c8261b6881e87571c97cd0 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 24 Jun 2019 15:33:42 +0200
Subject: [PATCH 116/679] Check number of arguments for 'audit dockerfile'

---
 include/parameters | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/parameters b/include/parameters
index f3845526..53eeecb3 100644
--- a/include/parameters
+++ b/include/parameters
@@ -36,12 +36,13 @@
                 if [ $# -gt 1 ]; then
                     case $2 in
                         "dockerfile")
-                            if [ "$3" = "" ]; then
+                            if [ $# = 2 ]; then
                                 echo "${RED}Error: ${WHITE}Missing file name or URL${NORMAL}"
-                                echo "Example: $0 audit dockerfile /root/Dockerfile"
+                                echo "Example: $0 audit dockerfile /path/to/Dockerfile"
                                 ExitFatal
                             else
                                 shift; shift
+                                CHECK_BINARIES=1
                                 HELPER_PARAMS="$1"
                                 HELPER="audit_dockerfile"
                                 break

From 8d16a62bbd4fb486f9b5fcdf79c5735d84d3e078 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 24 Jun 2019 15:37:40 +0200
Subject: [PATCH 117/679] Added Bro (IDS)

---
 include/binaries | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/binaries b/include/binaries
index 7bf0d233..f5a80095 100644
--- a/include/binaries
+++ b/include/binaries
@@ -110,6 +110,7 @@
                             base64)                 BASE64BINARY="${BINARY}";          LogText "  Found known binary: base64 (encoding tool) - ${BINARY}" ;;
                             blkid)                  BLKIDBINARY="${BINARY}";           LogText "  Found known binary: blkid (information about block devices) - ${BINARY}" ;;
                             bootctl)                BOOTCTLBINARY="${BINARY}";         LogText "  Found known binary: bootctl (systemd-boot manager utility) - ${BINARY}" ;;
+                            bro)                    BROBINARY="${BINARY}";             LogText "  Found known binary: bro (IDS) - ${BINARY}" ;;
                             cat)                    CAT_BINARY="${BINARY}";            LogText "  Found known binary: cat (generic file handling) - ${BINARY}" ;;
                             cc)                     CCBINARY="${BINARY}";              COMPILER_INSTALLED=1;  LogText "  Found known binary: cc (compiler) - ${BINARY}" ;;
                             chkconfig)              CHKCONFIGBINARY=${BINARY};         LogText "  Found known binary: chkconfig (administration tool) - ${BINARY}" ;;

From 94e0a4e40dd6bc9c21415cfb1819d3f68b126de3 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 24 Jun 2019 15:38:34 +0200
Subject: [PATCH 118/679] Added Suricata (IDS)

---
 include/binaries | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/binaries b/include/binaries
index f5a80095..89b29b07 100644
--- a/include/binaries
+++ b/include/binaries
@@ -228,6 +228,7 @@
                             sha1|sha1sum|shasum)    SHA1SUMBINARY="${BINARY}";         LogText "  Found known binary: sha1/sha1sum/shasum (crypto hashing) - ${BINARY}" ;;
                             sha256|sha256sum)       SHA256SUMBINARY="${BINARY}";       LogText "  Found known binary: sha256/sha256sum (crypto hashing) - ${BINARY}" ;;
                             ssh-keyscan)            SSHKEYSCANBINARY="${BINARY}";      LogText "  Found known binary: ssh-keyscan (scanner for SSH keys) - ${BINARY}" ;;
+                            suricata)               SURICATABINARY="${BINARY}";        LogText "  Found known binary: suricata (IDS) - ${BINARY}" ;;
                             sysctl)                 SYSCTLBINARY="${BINARY}";          LogText "  Found known binary: sysctl (kernel parameters) - ${BINARY}" ;;
                             syslog-ng)              SYSLOGNGBINARY="${BINARY}";        SYSLOGNGVERSION=$(${BINARY} -V 2>&1 | grep "^syslog-ng" | awk '{ print $2 }'); LogText "Found ${BINARY} (version ${SYSLOGNGVERSION})" ;;
                             systemctl)              SYSTEMCTLBINARY="${BINARY}";       LogText "  Found known binary: systemctl (client to systemd) - ${BINARY}" ;;

From d0377c563dd2e69da3c86b475237409d44809eb8 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 24 Jun 2019 15:40:18 +0200
Subject: [PATCH 119/679] Added TLSv1 as weak protocol (nginx)

---
 include/functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/functions b/include/functions
index 35cb6b00..6f067761 100644
--- a/include/functions
+++ b/include/functions
@@ -2009,7 +2009,7 @@
                     for ITEM in ${VALUE}; do
                         LogText "Result: found protocol ${ITEM}"
                         case ${ITEM} in
-                            "sslv2" | "sslv3")
+                            "sslv2" | "sslv3" | "tlsv1")
                                 NGINX_WEAK_SSL_PROTOCOL_FOUND=1
                             ;;
                         esac

From ec519dc976c5a16a3e6c8bf81cd8c7052b7cec22 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 24 Jun 2019 15:40:38 +0200
Subject: [PATCH 120/679] Minor cleanups

---
 include/helper_audit_dockerfile | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/include/helper_audit_dockerfile b/include/helper_audit_dockerfile
index 273bb347..3d18556f 100644
--- a/include/helper_audit_dockerfile
+++ b/include/helper_audit_dockerfile
@@ -59,13 +59,12 @@ fi
         IS_ALPINE=$(echo ${IMAGE} | grep -i alpine)
         IS_LATEST=$(echo ${TAG} | grep -i latest)
 
-        if [ ! "${IS_DEBIAN}" = "" ]; then IMAGE="debian"; fi
-        if [ ! "${IS_FEDORA}" = "" ]; then IMAGE="fedora"; fi
-        if [ ! "${IS_UBUNTU}" = "" ]; then IMAGE="ubuntu"; fi
-        if [ ! "${IS_ALPINE}" = "" ]; then IMAGE="alpine"; fi
-        
-        if [ ! "${IS_LATEST}" = "" ]; then 
-            ReportWarning "dockerfile" "latest TAG used. Specifying the version is better."
+        if [ ! -z "${IS_DEBIAN}" ]; then IMAGE="debian"; fi
+        if [ ! -z "${IS_FEDORA}" ]; then IMAGE="fedora"; fi
+        if [ ! -z "${IS_UBUNTU}" ]; then IMAGE="ubuntu"; fi
+        if [ ! -z "${IS_ALPINE}" ]; then IMAGE="alpine"; fi
+        if [ ! -z "${IS_LATEST}" ]; then
+            ReportWarning "dockerfile" "latest TAG used. Specifying a targeted OS image and version is better for reproducible results."
         fi
 
         case ${IMAGE} in

From 901e697fc2327b05080306656ab38f4ac426d266 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 24 Jun 2019 15:47:07 +0200
Subject: [PATCH 121/679] Release 2.7.5

---
 CHANGELOG.md | 9 ++++++++-
 lynis        | 6 +++---
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a6604115..039f8cd4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,14 +1,21 @@
 # Lynis Changelog
 
-## Lynis 2.7.5 (not released yet)
+## Lynis 2.7.5 (2019-06-24)
 
 ### Added
 - Danish translation
+- Slackware end-of-life information
+- Detect BSD-style (rc.d) init in Linux systems
+- Detection of Bro and Suricata (IDS)
 
 ### Changed
 - Corrected end-of-life entries for CentOS 5 and 6
+- AUTH-9204 - change name to check in /etc/passwd file for QNAP devices
 - AUTH-9268 - AIX enhancement to use correct find statement
 - FILE-6310 - Filter on correct field for AIX
+- NETW-3012 - set ss command as preferred option for Linux and changed output format
+- List of PHP ini file locations has been extended
+- Removed several pieces of the code as part of cleanup and code health
 - Extended help
 
 ---------------------------------------------------------------------------------
diff --git a/lynis b/lynis
index 800c3b7b..8c016110 100755
--- a/lynis
+++ b/lynis
@@ -35,9 +35,9 @@
     PROGRAM_AUTHOR_CONTACT="lynis-dev@cisofy.com"
 
     # Version details
-    PROGRAM_RELEASE_DATE="2019-06-17"
-    PROGRAM_RELEASE_TIMESTAMP=1560766656
-    PROGRAM_RELEASE_TYPE="dev" # dev or final
+    PROGRAM_RELEASE_DATE="2019-06-24"
+    PROGRAM_RELEASE_TIMESTAMP=1561383761
+    PROGRAM_RELEASE_TYPE="final" # dev or final
     PROGRAM_VERSION="2.7.5"
 
     # Source, documentation and license

From 81c8f1f2a6a4c2b554853ca15fda2ee2cf2e52d2 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 29 Jun 2019 19:29:42 +0200
Subject: [PATCH 122/679] Security: don't allow uninitialized variables (set as
 a strict default now)

---
 lynis | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/lynis b/lynis
index 8c016110..727e2894 100755
--- a/lynis
+++ b/lynis
@@ -22,6 +22,9 @@
 #
 #################################################################################
 #
+    # Code quality: don't allow using undefined variables
+    set -o nounset
+
     # In Solaris /bin/sh is not POSIX, but /usr/xpg4/bin/sh is.
     # Switch to /usr/xpg4/bin/sh if it exists and we are not already running it.
     test "$_" != "/usr/xpg4/bin/sh" && test -f /usr/xpg4/bin/sh && exec /usr/xpg4/bin/sh "$0" "$@"
@@ -35,10 +38,10 @@
     PROGRAM_AUTHOR_CONTACT="lynis-dev@cisofy.com"
 
     # Version details
-    PROGRAM_RELEASE_DATE="2019-06-24"
+    PROGRAM_RELEASE_DATE="2019-06-29"
     PROGRAM_RELEASE_TIMESTAMP=1561383761
-    PROGRAM_RELEASE_TYPE="final" # dev or final
-    PROGRAM_VERSION="2.7.5"
+    PROGRAM_RELEASE_TYPE="dev" # dev or final
+    PROGRAM_VERSION="3.0.0"
 
     # Source, documentation and license
     PROGRAM_SOURCE="https://github.com/CISOfy/lynis"
@@ -55,11 +58,6 @@
 
     DISPLAY_LANG="${LANG}"  # required by function Display to deal with multi-bytes characters.
 
-    # Code quality:
-    # Set strict checking for development version for first part of code. After
-    # initialization this is checked with strict profile option.
-    if [ ${PROGRAM_RELEASE_TYPE} = "dev" ]; then set -u; fi
-
 #
 #################################################################################
 #

From 08e8e59197e76f177457b4e1850236224e605fa0 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 29 Jun 2019 19:34:12 +0200
Subject: [PATCH 123/679] New function: SafeInput

---
 include/functions | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/include/functions b/include/functions
index 6f067761..3d43f7c1 100644
--- a/include/functions
+++ b/include/functions
@@ -86,6 +86,7 @@
 #    ReportSuggestion           Add a suggestion to report file
 #    ReportWarning              Add a warning and priority to report file
 #    SafePerms                  Check if a file has safe permissions
+#    SafeInput                  Test provided string to see if it contains unwanted characters
 #    SearchItem                 Search a string in a file
 #    ShowComplianceFinding      Display a particular finding regarding compliance or a security standard
 #    ShowSymlinkPath            Show a path behind a symlink
@@ -2510,6 +2511,37 @@
     }
 
 
+    ################################################################################
+    # Name        : SafeInput()
+    # Description : Test provided string to see if it contains unwanted characters
+    #
+    # Input       : string + optional class (parameter 2)
+    # Returns     : 0 (input considered to be safe) or 1 (validation failed)
+    ################################################################################
+
+    SafeInput() {
+        exitcode=1
+        # By default remove only control characters
+        if [ $# -eq 1 ]; then
+            input="$1"
+            cleaned=$(echo ${input} | tr -d '[:cntrl:]')
+        # If know what to test against, then see if input matches the specified class
+        elif [ $# -eq 2 ]; then
+            input="$1"
+            testchars="$2"
+            cleaned=$(echo $1 | tr -cd "${testchars}")
+        else
+            ExitFatal "No argument or too many arguments provided to SafeInput()"
+        fi
+
+        if [ "${cleaned}" = "${input}" ]; then
+            exitcode=0
+        fi
+        return ${exitcode}
+    }
+
+
+
     ################################################################################
     # Name        : SafePerms()
     # Return      : 0 (file OK) or break

From 5e4e44bdf3113b6978396f556beb4b4c21a05b78 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 30 Jun 2019 18:27:31 +0200
Subject: [PATCH 124/679] Added check to ensure that common system tools are
 defined as extra safety measure

---
 include/binaries | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/include/binaries b/include/binaries
index 89b29b07..33251431 100644
--- a/include/binaries
+++ b/include/binaries
@@ -269,6 +269,28 @@
         LogText "Result: checking of binaries skipped in this mode"
     fi
 
+    # Test if the basic system tools are defined. These will be used during the audit.
+    [ "${AWKBINARY:-}" ] || ExitFatal "awk binary not found"
+    [ "${CUTBINARY:-}" ] || ExitFatal "cut binary not found"
+    [ "${EGREPBINARY:-}" ] || ExitFatal "grep binary not found"
+    [ "${FINDBINARY:-}" ] || ExitFatal "find binary not found"
+    [ "${GREPBINARY:-}" ] || ExitFatal "grep binary not found"
+    [ "${HEADBINARY:-}" ] || ExitFatal "head binary not found"
+    [ "${LSBINARY:-}" ] || ExitFatal "ls binary not found"
+    [ "${PSBINARY:-}" ] || ExitFatal "ps binary not found"
+    [ "${SEDBINARY:-}" ] || ExitFatal "sed binary not found"
+    [ "${SORTBINARY:-}" ] || ExitFatal "sort binary not found"
+    [ "${TRBINARY:-}" ] || ExitFatal "tr binary not found"
+    [ "${UNIQBINARY:-}" ] || ExitFatal "uniq binary not found"
+    [ "${WCBINARY:-}" ] || ExitFatal "wc binary not found"
+
+    # Test a few other tools that we did not specifically define (yet)
+    TOOLS="xxd"
+    for T in ${TOOLS}; do
+        DATA=$(type ${T})
+        if [ $? -gt 0 ]; then ExitFatal "${T} binary not found"; fi
+    done
+
 #
 #================================================================================
 # Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com

From fdacc00b453b451a6983d6a18819e1158ef32553 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 30 Jun 2019 19:21:07 +0200
Subject: [PATCH 125/679] Security: test PATH and warn or exit on discovery of
 dangerous location

---
 include/binaries | 35 ++++++++++++++++++++++++++++-------
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/include/binaries b/include/binaries
index 33251431..201a07ab 100644
--- a/include/binaries
+++ b/include/binaries
@@ -42,18 +42,39 @@
         Display --indent 2 --text "- Checking system binaries..."
         LogText "Status: Starting binary scan..."
 
-        # Test if our PATH variable provides a set of paths
-        # If so, reverse the order. If we discover the same binary multiple times, the one first in PATH
-        # should be used.
-        # If PATH is empty, we use the predefined list in include/consts. Common paths first, then followed
-        # by more specific paths. This helps on the slightly ancient UNIX derivatives.
+        # Notes:
+        # - If PATH is empty, we use the predefined list in include/consts
+        # - Common paths first, then followed by more specific paths. This helps on the slightly ancient UNIX derivatives.
+        # - Avoid sorting the path list, as this might result in incorrect order of finding binaries (e.g. awk binary)
+
+        # Test if our PATH variable provides a set of paths. If so, reverse the order. If we discover the same binary
+        # multiple times, the one first in PATH should be used.
         if [ ! -z "${PATH}" ]; then
             PATH_REVERSED=$(echo ${PATH} | awk -F: '{ for (i=NF; i>1; i--) printf("%s ",$i); print $1; }')
             BIN_PATHS=$(echo "${PATH_REVERSED} ${BIN_PATHS}" | tr ':' ' ')
         fi
 
-        # Avoid sorting, as this might result in incorrect order of finding binaries (e.g. awk binary)
-        #SORTED_BIN_PATHS=$(echo ${BIN_PATHS} | tr ' ' '\n' | sort | uniq | tr '\n' ' ')
+        # First test available locations that may be suspicious or dangerous
+        for SCANDIR in ${BIN_PATHS}; do
+            FOUND=0
+            if [ "${SCANDIR}" = "." ]; then FOUND=1; MSG="Found single dot (.) in PATH"
+            elif [ "${SCANDIR}" = ".." ]; then FOUND=1; MSG="Found double dot (..) in PATH"
+            elif echo ${SCANDIR} | grep '^\.\.' > /dev/null; then FOUND=1; MSG="Found path starting with double dot (..) in PATH"
+            elif echo ${SCANDIR} | grep '^[a-zA-Z]' > /dev/null; then FOUND=1; MSG="Found relative path in PATH"
+            fi
+            if [ ${FOUND} -eq 1 ]; then
+                # Stop execution if privileged, otherwise continue but warn user
+                if [ ${PRIVILEGED} -eq 1 ]; then
+                    ExitFatal "Possible riskful location (${SCANDIR}) in PATH discovered. Quitting..."
+                else
+                    Display --indent 4 --text "Warning: suspicious location (${SCANDIR}) in PATH"
+                    ReportWarning "${TEST_NO}" "Possible riskful location in PATH discovered" "text:${MSG}"
+                    sleep 1
+                fi
+            fi
+        done
+
+        # Now perform binary detection
         for SCANDIR in ${BIN_PATHS}; do
             LogText "Test: Checking binaries in directory ${SCANDIR}"
             ORGPATH=""

From cfaea214306f38f958bc3589e60adcf591f64e21 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 30 Jun 2019 19:29:48 +0200
Subject: [PATCH 126/679] Security: test all parameters and arguments for the
 presence of control characters

---
 include/parameters | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/include/parameters b/include/parameters
index 53eeecb3..c0048f72 100644
--- a/include/parameters
+++ b/include/parameters
@@ -22,8 +22,21 @@
 #
 #################################################################################
 #
-    # Check number of parameters submitted (at least one is needed)
     PARAMCOUNT=$#
+
+
+    # Input validation on provided parameters and their arguments
+    COUNT=0
+    for I in "$@"; do
+        COUNT=$((COUNT + 1))
+        if ! SafeInput "${I}"; then
+            echo "Execution of ${PROGRAM_NAME} stopped as we found unexpected input or invalid characters in argument ${COUNT}"
+            echo "Do you believe this is in error? Let us know: ${PROGRAM_AUTHOR_CONTACT}"
+            ExitFatal
+        fi
+    done
+
+    # Parse arguments
     while [ $# -ge 1 ]; do
         case $1 in
             # Helpers first

From cb77d5a3f7d5018fc8f4f5c88e80b8273fbb735e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 30 Jun 2019 20:37:33 +0200
Subject: [PATCH 127/679] Show text when stopping execution

---
 include/parameters | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/parameters b/include/parameters
index c0048f72..0798224e 100644
--- a/include/parameters
+++ b/include/parameters
@@ -32,7 +32,7 @@
         if ! SafeInput "${I}"; then
             echo "Execution of ${PROGRAM_NAME} stopped as we found unexpected input or invalid characters in argument ${COUNT}"
             echo "Do you believe this is in error? Let us know: ${PROGRAM_AUTHOR_CONTACT}"
-            ExitFatal
+            ExitFatal "Program execution stopped due to security measure"
         fi
     done
 

From 76c3ea0edb43d7977e1085ddba5dfc687e7eb12a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 30 Jun 2019 20:38:05 +0200
Subject: [PATCH 128/679] Fall back to echo if ECHOCMD is empty early during
 execution of program

---
 include/functions | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/functions b/include/functions
index 3d43f7c1..26d5d502 100644
--- a/include/functions
+++ b/include/functions
@@ -660,9 +660,9 @@
         RemoveTempFiles
         LogText "${PROGRAM_NAME} ended with exit code 1."
         if [ $# -eq 1 ]; then
-            ${ECHOCMD} ""
-            ${ECHOCMD} "${RED}Fatal error${NORMAL}: ${WHITE}$1${NORMAL}"
-            ${ECHOCMD} ""
+            ${ECHOCMD:-echo} ""
+            ${ECHOCMD:-echo} "${RED}Fatal error${NORMAL}: ${WHITE}$1${NORMAL}"
+            ${ECHOCMD:-echo} ""
         fi
         exit 1
     }

From bc88775d0e23daa111f67aa6d705d629228c6498 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 1 Jul 2019 07:39:32 +0200
Subject: [PATCH 129/679] When PATH is defined, only locations from variable

---
 include/binaries | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/binaries b/include/binaries
index 201a07ab..c3e5dff9 100644
--- a/include/binaries
+++ b/include/binaries
@@ -51,7 +51,7 @@
         # multiple times, the one first in PATH should be used.
         if [ ! -z "${PATH}" ]; then
             PATH_REVERSED=$(echo ${PATH} | awk -F: '{ for (i=NF; i>1; i--) printf("%s ",$i); print $1; }')
-            BIN_PATHS=$(echo "${PATH_REVERSED} ${BIN_PATHS}" | tr ':' ' ')
+            BIN_PATHS=$(echo "${PATH_REVERSED}" | tr ':' ' ')
         fi
 
         # First test available locations that may be suspicious or dangerous

From 2e1ec2c32f903aa53444798a47b52c57bed9ddb9 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 3 Jul 2019 15:07:46 +0200
Subject: [PATCH 130/679] Change variable name to better indicate what it does

---
 include/functions | 126 +++++++++++++++++++++++++++-------------------
 lynis             |  13 ++---
 2 files changed, 79 insertions(+), 60 deletions(-)

diff --git a/include/functions b/include/functions
index 26d5d502..a0246d68 100644
--- a/include/functions
+++ b/include/functions
@@ -2544,74 +2544,96 @@
 
     ################################################################################
     # Name        : SafePerms()
-    # Return      : 0 (file OK) or break
+    # Description :
+    # Returns     : 0 (file permissions OK) or break
     ################################################################################
 
     SafePerms() {
-        if [ ${WARN_ON_FILE_ISSUES} -eq 1 ]; then
+        exitcode=1
+        IS_PARAMETERS=0
+        IS_PROFILE=0
+
+        if [ ${IGNORE_FILE_PERMISSION_ISSUES} -eq 0 ]; then
             PERMS_OK=0
             LogText "Checking permissions of $1"
-            if [ $# -eq 1 ]; then
-                IS_PARAMETERS_FILE=$(echo $1 | grep "/parameters")
+
+            if [ $# -gt 0 ]; then
+
+                if [ $# -eq 2 ]; then
+                    case "$2" in
+                        "parameters")
+                            IS_PARAMETERS=1
+                        ;;
+                        "profile")
+                            IS_PROFILE=1
+                        ;;
+                    esac
+                else
+                    FIND=$(echo $1 | grep "/parameters")
+                    if [ $? -eq 0 ]; then IS_PARAMETERS=1; fi
+                fi
                 # Check file permissions
-                  if [ ! -f "$1" ]; then
-                      LogText "Fatal error: file $1 does not exist. Quitting."
-                      echo "Fatal error: file $1 does not exist"
-                      ExitFatal
-                    else
-                      PERMS=$(ls -l $1)
-                      # Owner permissions
-                      OWNER=$(echo ${PERMS} | awk -F" " '{ print $3 }')
-                      OWNERID=$(ls -n $1 | awk -F" " '{ print $3 }')
-                      if [ ${PENTESTINGMODE} -eq 0 -a "${IS_PARAMETERS_FILE}" = "" ]; then
-                          if [ ! "${OWNER}" = "root" -a ! "${OWNERID}" = "0" ]; then
-                              echo "Fatal error: file $1 should be owned by user 'root' when running it as root (found: ${OWNER})."
-                              ExitFatal
-                          fi
-                      fi
-                      # Group permissions
-                      GROUP=$(echo ${PERMS} | awk -F" " '{ print $4 }')
-                      GROUPID=$(ls -n $1 | awk -F" " '{ print $4 }')
+                if [ ! -f "$1" ]; then
+                    LogText "Fatal error: file $1 does not exist. Quitting."
+                    echo "Fatal error: file $1 does not exist"
+                    ExitFatal
+                else
+                    PERMS=$(ls -l $1)
 
-                      if [ ${PENTESTINGMODE} -eq 0 -a "${IS_PARAMETERS_FILE}" = "" ]; then
-                          if [ ! "${GROUP}" = "root" -a ! "${GROUP}" = "wheel" -a ! "${GROUPID}" = "0" ]; then
-                              echo "Fatal error: group owner of directory $1 should be owned by root user, wheel or similar (found: ${GROUP})."
-                              ExitFatal
-                          fi
-                      fi
+                    # Owner permissions
+                    OWNER=$(echo ${PERMS} | awk -F" " '{ print $3 }')
+                    OWNERID=$(ls -n $1 | awk -F" " '{ print $3 }')
+                    if [ ${PENTESTINGMODE} -eq 0 -a ${IS_PARAMETERS} -eq 0 ]; then
+                        if [ ! "${OWNER}" = "root" -a ! "${OWNERID}" = "0" ]; then
+                            echo "Fatal error: file $1 should be owned by user 'root' when running it as root (found: ${OWNER})."
+                            ExitFatal
+                        fi
+                    fi
+                    # Group permissions
+                    GROUP=$(echo ${PERMS} | awk -F" " '{ print $4 }')
+                    GROUPID=$(ls -n $1 | awk -F" " '{ print $4 }')
 
-                      # Owner permissions
-                      OWNER_PERMS=$(echo ${PERMS} | cut -c2-4)
-                      if [ ! "${OWNER_PERMS}" = "rw-" -a ! "${OWNER_PERMS}" = "r--" ]; then
-                          echo "Fatal error: permissions of file $1 are not strict enough. Access to 'owner' should be read-write, or read. Change with: chmod 600 $1"
-                          ExitFatal
-                      fi
+                    if [ ${PENTESTINGMODE} -eq 0 -a ${IS_PARAMETERS} -eq 0 ]; then
+                        if [ ! "${GROUP}" = "root" -a ! "${GROUP}" = "wheel" -a ! "${GROUPID}" = "0" ]; then
+                            echo "Fatal error: group owner of directory $1 should be owned by root user, wheel or similar (found: ${GROUP})."
+                            ExitFatal
+                        fi
+                    fi
 
-                      # Owner permissions
-                      GROUP_PERMS=$(echo ${PERMS} | cut -c5-7)
-                      if [ ! "${GROUP_PERMS}" = "rw-" -a ! "${GROUP_PERMS}" = "r--" -a ! "${GROUP_PERMS}" = "---" ]; then
-                          echo "Fatal error: permissions of file $1 are not strict enough. Access to 'group' should be read-write, read, or none. Change with: chmod 600 $1"
-                          ExitFatal
-                      fi
+                    # Owner permissions
+                    OWNER_PERMS=$(echo ${PERMS} | cut -c2-4)
+                    if [ ! "${OWNER_PERMS}" = "rw-" -a ! "${OWNER_PERMS}" = "r--" ]; then
+                        echo "Fatal error: permissions of file $1 are not strict enough. Access to 'owner' should be read-write, or read. Change with: chmod 600 $1"
+                        ExitFatal
+                    fi
 
-                      # Other permissions
-                      OTHER_PERMS=$(echo ${PERMS} | cut -c8-10)
-                      if [ ! "${OTHER_PERMS}" = "---" -a ! "${OTHER_PERMS}" = "r--" ]; then
-                          echo "Fatal error: permissions of file $1 are not strict enough. Access to 'other' should be denied or read-only. Change with: chmod 600 $1"
-                          ExitFatal
-                      fi
-                      # Set PERMS_OK to 1 if no fatal errors occurred
-                      PERMS_OK=1
-                      LogText "File permissions are OK"
-                      return 0
-                  fi
+                    # Owner permissions
+                    GROUP_PERMS=$(echo ${PERMS} | cut -c5-7)
+                    if [ ! "${GROUP_PERMS}" = "rw-" -a ! "${GROUP_PERMS}" = "r--" -a ! "${GROUP_PERMS}" = "---" ]; then
+                        echo "Fatal error: permissions of file $1 are not strict enough. Access to 'group' should be read-write, read, or none. Change with: chmod 600 $1"
+                        ExitFatal
+                    fi
+
+                    # Other permissions
+                    OTHER_PERMS=$(echo ${PERMS} | cut -c8-10)
+                    if [ ! "${OTHER_PERMS}" = "---" -a ! "${OTHER_PERMS}" = "r--" ]; then
+                        echo "Fatal error: permissions of file $1 are not strict enough. Access to 'other' should be denied or read-only. Change with: chmod 600 $1"
+                        ExitFatal
+                    fi
+                    # Set PERMS_OK to 1 if no fatal errors occurred
+                    PERMS_OK=1
+                    LogText "File permissions are OK"
+                    exitcode=0
+                fi
             else
                 ReportException "SafePerms()" "Invalid number of arguments for function"
             fi
         else
             PERMS_OK=1
-            return 0
+            exitcode=0
         fi
+        return ${exitcode}
+
     }
 
 
diff --git a/lynis b/lynis
index 727e2894..8cacca37 100755
--- a/lynis
+++ b/lynis
@@ -24,7 +24,9 @@
 #
     # Code quality: don't allow using undefined variables
     set -o nounset
-
+#
+#################################################################################
+#
     # In Solaris /bin/sh is not POSIX, but /usr/xpg4/bin/sh is.
     # Switch to /usr/xpg4/bin/sh if it exists and we are not already running it.
     test "$_" != "/usr/xpg4/bin/sh" && test -f /usr/xpg4/bin/sh && exec /usr/xpg4/bin/sh "$0" "$@"
@@ -137,8 +139,7 @@ Make sure to execute ${PROGRAM_NAME} from untarred directory or check your insta
 #################################################################################
 #
     # Perform a basic check for permissions. After including functions, using SafePerms()
-    WARN_ON_FILE_ISSUES=1
-    WARN_ON_FILE_ISSUES_ASKED=0
+    IGNORE_FILE_PERMISSION_ISSUES=0
 
     FILES_TO_CHECK="consts functions"
 
@@ -190,14 +191,10 @@ Make sure to execute ${PROGRAM_NAME} from untarred directory or check your insta
             printf "\n    Option 2) Change ownership of the related files (or full directory).\n\n       Commands (full directory):\n         # cd ..\n         # chown -R 0:0 lynis\n         # cd lynis\n         # ./lynis audit system"
         fi
         printf "\n\n[ Press ENTER to continue, or CTRL+C to cancel ]"
-        WARN_ON_FILE_ISSUES_ASKED=1
+        IGNORE_FILE_PERMISSION_ISSUES=1
         read DUMMY
     fi
 
-    if [ ${WARN_ON_FILE_ISSUES_ASKED} -eq 1 ]; then
-        WARN_ON_FILE_ISSUES=0
-    fi
-
     # Now include files if permissions are correct, or user decided to continue
     . ${INCLUDEDIR}/consts
     . ${INCLUDEDIR}/functions

From 1f0c31fcad5f747a9402683c09e6352d72712ee1 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 3 Jul 2019 15:08:35 +0200
Subject: [PATCH 131/679] Preparing for release 3.0.0

---
 CHANGELOG.md | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 039f8cd4..0d9a969c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,29 @@
 # Lynis Changelog
 
+## Lynis 3.0.0 (not released yet)
+
+This is a major release of Lynis and includes several big changes.
+Some of these changes may break your current usage of the tool, so test before
+deployment.
+
+Breaking changes:
+- Some of the old and deprecated commands or switches are removed
+
+An important focus area for this release is on security. We added several
+measures to further tighten any possible misuse.
+
+### Added
+- Test PATH and warn or exit on discovery of dangerous location (security)
+- Additional safeguard by testing if common system tools are available (security)
+- Test parameters and arguments for presence of control characters (security)
+- New function SafeInput (security)
+
+### Changed
+- The 'nounset' (set -u) parameter is now activated by default (security)
+- Use locations from PATH environment variable, unless it is empty
+
+---------------------------------------------------------------------------------
+
 ## Lynis 2.7.5 (2019-06-24)
 
 ### Added

From ade3117307930cda0e9ab2460a08c0cf9b653f35 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 3 Jul 2019 15:39:26 +0200
Subject: [PATCH 132/679] New option to disable plugins via profile

---
 default.prf      | 114 ++++++++++++++++++-----------------------------
 include/consts   |   1 +
 include/profiles |   5 +++
 lynis            |  13 +++++-
 4 files changed, 61 insertions(+), 72 deletions(-)

diff --git a/default.prf b/default.prf
index ef474b1f..d460a682 100644
--- a/default.prf
+++ b/default.prf
@@ -9,11 +9,11 @@
 #################################################################################
 #
 #
-# SUGGESTION
+# WARNING
 # ----------
 #
-# Do NOT make changes to this file, instead copy your preferred settings to
-# custom.prf and put it in the same directory as default.prf
+# Do NOT make changes to this file. Instead, copy only your changes into
+# the file custom.prf and put it in the same directory as default.prf
 #
 # To discover where your profiles are located: lynis show profiles
 #
@@ -22,9 +22,6 @@
 #
 # All empty lines or with the # prefix will be skipped
 #
-# More information about this plugin can be found in the documentation:
-# https://cisofy.com/documentation/lynis/
-#
 #################################################################################
 
 # Use colored output
@@ -42,19 +39,26 @@ error-on-warnings=no
 # Use Lynis in your own language (by default auto-detected)
 language=
 
-# Lynis Enterprise license key
-license-key=
+# Log tests from another guest operating system (default: yes)
+#log-tests-incorrect-os=yes
+
+# Define if available NTP daemon is configured as a server or client on the network
+# values: server or client (default: client)
+#ntpd-role=client
 
 # Defines the role of the system (personal, workstation or server)
 machine-role=server
 
+# Ignore some stratum 16 hosts (for example when running as time source itself)
+#ntp-ignore-stratum-16-peer=127.0.0.1
+
 # Profile name, will be used as title/description
 profile-name=Default Audit Template
 
 # Number of seconds to pause between every test (0 is no pause)
 pause-between-tests=0
 
-# Enable quick mode (no waiting for keypresses, same as --quick option)
+# Quick mode (no waiting for keypresses)
 quick=no
 
 # Refresh software repositories to help detecting vulnerable packages
@@ -76,39 +80,19 @@ skip-plugins=no
 #skip-test=SSH-7408:loglevel
 #skip-test=SSH-7408:permitrootlogin
 
+# Skip Lynis upgrade availability test (default: no)
+#skip-upgrade-test=yes
+
+# Locations where to search for SSL certificates
+ssl-certificate-paths=/etc/apache2:/etc/dovecot:/etc/httpd:/etc/letsencrypt:/etc/pki:/etc/postfix:/etc/ssl:/opt/psa/var/certificates:/usr/local/psa/var/certificates:/usr/local/share/ca-certificates:/var/www:/srv/www
+
 # Scan type - how deep the audit should be (light, normal or full)
 test-scan-mode=full
 
-# Upload data to central server
-upload=no
-
-# The hostname/IP address to receive the data
-upload-server=
-
-# Provide options to cURL (or other upload tool) when uploading data.
-# upload-options=--insecure   --> use HTTPS, but skip certificate check (e.g. self-signed)
-upload-options=
-
 # Verbose output
 verbose=no
 
 
-#################################################################################
-#
-# Upgrade and updating
-# --------------------
-#
-# The old settings to do automatic updating are deprecated. It is suggested to
-# use a package or deploy your the tarball via a custom script.
-#
-# The latest packages can be found at: https://packages.cisofy.com
-#
-#################################################################################
-
-# Skip Lynis upgrade availability test (default: no)
-#skip-upgrade-test=yes
-
-
 #################################################################################
 #
 # Plugins
@@ -119,10 +103,11 @@ verbose=no
 # - Nothing happens if plugin isn't available
 # - There is no order in execution of plugins
 # - See documentation about how to use plugins and phases
+# - Some are for Lynis Enterprise users only
 #
 #################################################################################
 
-# Lynis Plugins (some are for Lynis Enterprise users only)
+# Lynis plugins to enable
 plugin=authentication
 plugin=compliance
 plugin=configuration
@@ -149,17 +134,22 @@ plugin=system-integrity
 plugin=systemd
 plugin=users
 
+# Disable a particular plugin (will overrule an enabled plugin)
+#disable-plugin=authentication
 
 #################################################################################
 #
 # Kernel options
 # ---------------
-# sysctl:<sysctl Key>:<Expected Value>:<Hardening Points>:<Description>:
+# configdate=, followed by:
 #
-# Sysctl key       = name
-# Expected value   = value of sysctl key
-# Hardening points = Number of hardening points. For most keys 1 HP will be suitable
-# Description      = Text description of key
+# - Type                     = Set to 'sysctl'
+# - Setting                  = value of sysctl key (e.g. kernel.sysrq)
+# - Expected value           = Preferred value for key (e.g. 0)
+# - Hardening Points         = Number of hardening points (typically 1 point per key) (1)
+# - Description              = Textual description about the sysctl key(Disable magic SysRQ)
+# - Related file or command  = For example, sysctl -a to retrieve more details
+# - Solution field           = Specifies more details or where to find them (url:URL, text:TEXT, or -)
 #
 #################################################################################
 
@@ -290,18 +280,6 @@ openldap:slapd.conf:permissions:640-600:
 openldap:slapd.conf:owner:ldap-root:
 
 
-
-
-#################################################################################
-#
-# NTP options
-#
-#################################################################################
-
-# Ignore some stratum 16 hosts (for example when running as time source itself)
-#ntp-ignore-stratum-16-peer=127.0.0.1
-
-
 #################################################################################
 #
 # File/directories permissions (currently not used yet)
@@ -356,12 +334,6 @@ permdir:/root/.ssh:rwx------:root:-:WARN:
 # checks, like file permissions, SSH and other configuration files
 #ignore-home-dir=/home/user
 
-# Do not log tests with another guest operating system (default: yes)
-#log-tests-incorrect-os=no
-
-# Define if available NTP daemon is configured as a server or client on the network
-# values: server or client (default: client)
-#ntpd-role=client
 
 # Allow promiscuous interfaces
 #   <option>:<promiscuous interface name>:<description>:
@@ -395,17 +367,6 @@ permdir:/root/.ssh:rwx------:root:-:WARN:
 
 
 
-#################################################################################
-#
-# SSL certificates
-#
-#################################################################################
-
-# Locations where to search for SSL certificates
-ssl-certificate-paths=/etc/apache2:/etc/dovecot:/etc/httpd:/etc/letsencrypt:/etc/pki:/etc/postfix:/etc/ssl:/opt/psa/var/certificates:/usr/local/psa/var/certificates:/usr/local/share/ca-certificates:/var/www:/srv/www
-
-
-
 #################################################################################
 #
 # Lynis Enterprise options
@@ -423,6 +384,9 @@ ssl-certificate-paths=/etc/apache2:/etc/dovecot:/etc/httpd:/etc/letsencrypt:/etc
 #hostid=40-char-hash
 #hostid2=64-char-hash
 
+# Lynis Enterprise license key
+license-key=
+
 # Proxy settings
 # Protocol (http, https, socks5)
 #proxy-protocol=https
@@ -443,6 +407,16 @@ compliance-standards=cis,hipaa,iso27001,pci-dss
 # Provide the name of the customer/client
 #system-customer-name=mycustomer
 
+# Upload data to central server
+upload=no
+
+# The hostname/IP address to receive the data
+upload-server=
+
+# Provide options to cURL (or other upload tool) when uploading data.
+# upload-options=--insecure (use HTTPS, but skip certificate check for self-signed certificates)
+upload-options=
+
 # Link one or more tags to a system
 #tags=db,production,ssn-1304
 
diff --git a/include/consts b/include/consts
index 207cde8c..0bbde60c 100644
--- a/include/consts
+++ b/include/consts
@@ -96,6 +96,7 @@ unset LANG
     DEBSECANBINARY=""
     DEBSUMSBINARY=""
     DEVELOPER_MODE=0
+    DISABLED_PLUGINS=""
     DISCOVERED_BINARIES=""
     DMIDECODEBINARY=""
     DNFBINARY=""
diff --git a/include/profiles b/include/profiles
index eba67427..2840ed3b 100644
--- a/include/profiles
+++ b/include/profiles
@@ -239,6 +239,11 @@
                     LogText "Plugin '${VALUE}' enabled according profile (${PROFILE})"
                 ;;
 
+                disable-plugin)
+                    LogText "Plugin '${VALUE}' disabled according profile (${PROFILE})"
+                    DISABLED_PLUGINS="${DISABLED_PLUGINS} ${VALUE}"
+                ;;
+
                 # Plugin directory
                 plugindir | plugin-dir)
                     if IsEmpty "${PLUGINDIR}"; then
diff --git a/lynis b/lynis
index 8cacca37..e5faf06f 100755
--- a/lynis
+++ b/lynis
@@ -851,8 +851,17 @@ ${NORMAL}
                             LogText "Action: checking plugin status in profile: ${PROFILE}"
                             FIND3=$(grep "^plugin=${FIND2}" ${PROFILE})
                             if [ ! -z "${FIND3}" ]; then
-                                LogText "Result: plugin enabled in profile (${PROFILE})"
-                                PLUGIN_ENABLED_STATE=1
+                                FOUND=0
+                                for I in ${DISABLED_PLUGINS}; do
+                                    if [ "${I}" = "${FIND2}" ]; then
+                                        FOUND=1
+                                        LogText "Result: plugin ${FIND2} is specifically disabled"
+                                    fi
+                                done
+                                if [ ${FOUND} -eq 0 ]; then
+                                    LogText "Result: plugin enabled in profile (${PROFILE})"
+                                    PLUGIN_ENABLED_STATE=1
+                                fi
                             fi
                         done
                         if [ ${PLUGIN_ENABLED_STATE} -eq 1 ]; then

From 13fbfff8bcc38453522c235472d4e14af2adda6d Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 3 Jul 2019 15:40:16 +0200
Subject: [PATCH 133/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0d9a969c..4c19f47d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@ measures to further tighten any possible misuse.
 - Additional safeguard by testing if common system tools are available (security)
 - Test parameters and arguments for presence of control characters (security)
 - New function SafeInput (security)
+- New option to disable a single plugin: disable-plugin=pluginname
 
 ### Changed
 - The 'nounset' (set -u) parameter is now activated by default (security)

From 0443d643da1c76515fb2fb5d102d13ba25f5cb36 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 5 Jul 2019 18:35:10 +0200
Subject: [PATCH 134/679] Show tip to use 'lynis generate hostids' when they
 are missing

---
 include/data_upload | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/include/data_upload b/include/data_upload
index 5bc8e839..7698d13a 100644
--- a/include/data_upload
+++ b/include/data_upload
@@ -242,13 +242,9 @@
             fi
         else
             echo "${RED}Error${NORMAL}: No hostid and/or hostid2 found. Can not upload report file."
-            echo "Suggested command: lynis show hostids"
+            echo "Suggested command: lynis generate hostids --save"
             echo ""
-            echo "If hostid2 is the only ID that is missing, use the following step:"
-            echo "Create hash and add it to custom.prf"
-            echo "echo \"hostid2=\$(cat /dev/urandom | tr -dc 'a-f0-9' | fold -w 64 | head -n 1)\" >> /etc/lynis/custom.prf" 
-            echo ""
-            echo "Note: do not replicate this ID to other systems, as it needs to be unique per system"
+            echo "Note: do not replicate the values to other systems, as it needs to be unique per system"
 
             # Quit
             ExitFatal

From 8d4fd1a7aa47a39375b2b6bcdab810b51b75ca01 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 5 Jul 2019 18:35:45 +0200
Subject: [PATCH 135/679] Add Readonly() function

---
 include/functions | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/include/functions b/include/functions
index a0246d68..66b6abb4 100644
--- a/include/functions
+++ b/include/functions
@@ -74,6 +74,7 @@
 #    ParseTestValues            Parse a set of values
 #    PortIsListening            Check if machine is listening on specified protocol and port
 #    Progress                   Show progress on screen
+#    Readonly                   Mark a variable as read-only data
 #    Register                   Register a test (for logging and execution)
 #    RandomString               Show a random string
 #    RemoveColors               Reset all colors
@@ -2116,6 +2117,24 @@
     }
 
 
+    ################################################################################
+    # Name        : Readonly()
+    # Description : Mark a variable as read-only data
+    # Returns     : nothing
+    ################################################################################
+
+    Readonly() {
+        if [ $# -eq 1 ]; then
+            if type -t typeset; then
+                typeset -r $1
+            else
+                Debug "No typeset available to mark variable '$1' as read-only variable"
+            fi
+        else
+            ExitFatal "Expected 1 parameter, received none or multiple"
+        fi
+    }
+
 
     ################################################################################
     # Name        : Register()

From c639cb4f6e30f2fef49cefd55eb2fd99044cc3fe Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 5 Jul 2019 18:37:10 +0200
Subject: [PATCH 136/679] Only check empty binaries when we did a full scan, as
 for some commands the binary scanning is not performed

---
 include/binaries | 46 +++++++++++++++++++++++++---------------------
 1 file changed, 25 insertions(+), 21 deletions(-)

diff --git a/include/binaries b/include/binaries
index c3e5dff9..d894caf9 100644
--- a/include/binaries
+++ b/include/binaries
@@ -279,6 +279,7 @@
                 LogText "Result: Directory ${SCANDIR} does NOT exist"
             fi
         done
+
         # unset SORTED_BIN_PATHS
         BINARY_SCAN_FINISHED=1
         BINARY_PATHS_FOUND=$(echo ${BINARY_PATHS_FOUND} | sed 's/^, //g' | sed 's/ //g')
@@ -286,31 +287,34 @@
         LogText "Result: found ${COUNT} binaries"
         Report "binaries_count=${COUNT}"
         Report "binary_paths=${BINARY_PATHS_FOUND}"
+
+        # Test if the basic system tools are defined. These will be used during the audit.
+        [ "${AWKBINARY:-}" ] || ExitFatal "awk binary not found"
+        [ "${CUTBINARY:-}" ] || ExitFatal "cut binary not found"
+        [ "${EGREPBINARY:-}" ] || ExitFatal "grep binary not found"
+        [ "${FINDBINARY:-}" ] || ExitFatal "find binary not found"
+        [ "${GREPBINARY:-}" ] || ExitFatal "grep binary not found"
+        [ "${HEADBINARY:-}" ] || ExitFatal "head binary not found"
+        [ "${LSBINARY:-}" ] || ExitFatal "ls binary not found"
+        [ "${PSBINARY:-}" ] || ExitFatal "ps binary not found"
+        [ "${SEDBINARY:-}" ] || ExitFatal "sed binary not found"
+        [ "${SORTBINARY:-}" ] || ExitFatal "sort binary not found"
+        [ "${TRBINARY:-}" ] || ExitFatal "tr binary not found"
+        [ "${UNIQBINARY:-}" ] || ExitFatal "uniq binary not found"
+        [ "${WCBINARY:-}" ] || ExitFatal "wc binary not found"
+
+        # Test a few other tools that we did not specifically define (yet)
+        TOOLS="xxd"
+        for T in ${TOOLS}; do
+            DATA=$(type ${T})
+            if [ $? -gt 0 ]; then ExitFatal "${T} binary not found"; fi
+        done
+
+
     else
         LogText "Result: checking of binaries skipped in this mode"
     fi
 
-    # Test if the basic system tools are defined. These will be used during the audit.
-    [ "${AWKBINARY:-}" ] || ExitFatal "awk binary not found"
-    [ "${CUTBINARY:-}" ] || ExitFatal "cut binary not found"
-    [ "${EGREPBINARY:-}" ] || ExitFatal "grep binary not found"
-    [ "${FINDBINARY:-}" ] || ExitFatal "find binary not found"
-    [ "${GREPBINARY:-}" ] || ExitFatal "grep binary not found"
-    [ "${HEADBINARY:-}" ] || ExitFatal "head binary not found"
-    [ "${LSBINARY:-}" ] || ExitFatal "ls binary not found"
-    [ "${PSBINARY:-}" ] || ExitFatal "ps binary not found"
-    [ "${SEDBINARY:-}" ] || ExitFatal "sed binary not found"
-    [ "${SORTBINARY:-}" ] || ExitFatal "sort binary not found"
-    [ "${TRBINARY:-}" ] || ExitFatal "tr binary not found"
-    [ "${UNIQBINARY:-}" ] || ExitFatal "uniq binary not found"
-    [ "${WCBINARY:-}" ] || ExitFatal "wc binary not found"
-
-    # Test a few other tools that we did not specifically define (yet)
-    TOOLS="xxd"
-    for T in ${TOOLS}; do
-        DATA=$(type ${T})
-        if [ $? -gt 0 ]; then ExitFatal "${T} binary not found"; fi
-    done
 
 #
 #================================================================================

From 3c7576f36bcfae8834b85c65d3df9177603ed60d Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 7 Jul 2019 16:19:10 +0200
Subject: [PATCH 137/679] Changed description and added note about strict
 checking

---
 default.prf | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/default.prf b/default.prf
index 2e89fb57..b9011d0e 100644
--- a/default.prf
+++ b/default.prf
@@ -1,15 +1,17 @@
 #################################################################################
 #
 #
-# Lynis - Scan Profile (default)
-#
-# This is the default profile and contains default values.
+# Lynis - Default scan profile
 #
 #
 #################################################################################
 #
 #
-# WARNING
+# This profile provides Lynis with most of its initial values to perform a
+# system audit.
+#
+#
+# WARNINGS
 # ----------
 #
 # Do NOT make changes to this file. Instead, copy only your changes into
@@ -18,6 +20,10 @@
 # To discover where your profiles are located: lynis show profiles
 #
 #
+# Lynis performs a strict check on profiles to avoid the inclusion of
+# possibly harmful injections. See include/profiles for details.
+#
+#
 #################################################################################
 #
 # All empty lines or with the # prefix will be skipped

From 007faf47c35ad4606af8d1340674c46b09079fd5 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 7 Jul 2019 18:46:23 +0200
Subject: [PATCH 138/679] Cleanup of default profile and migration of
 permdir/permfile

---
 default.prf                    | 118 +++++++++++----------------------
 include/tests_file_permissions |   2 +-
 2 files changed, 40 insertions(+), 80 deletions(-)

diff --git a/default.prf b/default.prf
index b9011d0e..98f3e20d 100644
--- a/default.prf
+++ b/default.prf
@@ -36,6 +36,9 @@ colors=yes
 # Compressed uploads (set to zero when errors with uploading occur)
 compressed-uploads=yes
 
+# Amount of connections in WAIT state before reporting it as a suggestion
+#connections-max-wait-state=5000
+
 # Debug mode (for debugging purposes, extra data logged to screen)
 #debug=yes
 
@@ -265,100 +268,58 @@ config-data=sysctl;security.bsd.hardlink_check_gid;1;1;Unprivileged processes ar
 config-data=sysctl;security.bsd.hardlink_check_uid;1;1;Unprivileged processes are not allowed to create hard links to files which are owned by other users;-;category:security;
 
 
-#################################################################################
-#
-# Apache options
-# columns: (1)apache : (2)option : (3)value
-#
-#################################################################################
-
-apache:ServerTokens:Prod:
-
-
-#################################################################################
-#
-# OpenLDAP options
-# columns: (1)openldap : (2)file : (3)option : (4)expected value(s)
-#
-#################################################################################
-
-openldap:slapd.conf:permissions:640-600:
-openldap:slapd.conf:owner:ldap-root:
-
-
-#################################################################################
-#
-# File/directories permissions (currently not used yet)
-#
-#################################################################################
-
-# Scan for exact file name match
-#[scanfiles]
-#scanfile:/etc/rc.conf:FreeBSD configuration:
-
-# Scan for exact directory name match
-#[scandirs]
-#scandir:/etc:/etc directory:
-
-
 #################################################################################
 #
 # permfile
 # ---------------
-# permfile:file name:file permissions:owner:group:action:
+# permfile=file name:file permissions:owner:group:action:
 # Action = NOTICE or WARN
 # Examples:
-# permfile:/etc/test1.dat:600:root:wheel:NOTICE:
-# permfile:/etc/test1.dat:640:root:-:WARN:
+# permfile=/etc/test1.dat:600:root:wheel:NOTICE:
+# permfile=/etc/test1.dat:640:root:-:WARN:
 #
 #################################################################################
 
-#permfile:/etc/inetd.conf:rw-------:root:-:WARN:
-#permfile:/etc/fstab:rw-r--r--:root:-:WARN:
-permfile:/etc/lilo.conf:rw-------:root:-:WARN:
-permfile:/boot/grub2/grub.cfg:rw-------:root:root:WARN:
-permfile:/boot/grub/grub.cfg:rw-------:root:root:WARN:
-permfile:/boot/grub2/user.cfg:rw-------:root:root:WARN:
-permfile:/etc/motd:rw-r--r--:root:root:WARN:
-permfile:/etc/issue:rw-r--r--:root:root:WARN:
-permfile:/etc/issue.net:rw-r--r--:root:root:WARN:
-permfile:/etc/hosts.allow:rw-r--r--:root:root:WARN:
-permfile:/etc/hosts.deny:rw-r--r--:root:root:WARN:
-permfile:/etc/crontab:rw-------:root:-:WARN:
-permfile:/etc/cron.allow:rw-------:root:-:WARN:
-permfile:/etc/cron.deny:rw-------:root:-:WARN:
-permfile:/etc/at.allow:rw-------:root:-:WARN:
-permfile:/etc/at.deny:rw-------:root:-:WARN:
-permfile:/etc/ssh/sshd_config:rw-------:root:-:WARN:
-permfile:/etc/passwd:rw-r--r--:root:-:WARN:
-permfile:/etc/shadow:---------:root:-:WARN:
-permfile:/etc/group:rw-r--r--:root:-:WARN:
-permfile:/etc/gshadow:---------:root:-:WARN:
-permfile:/etc/passwd-:rw-r--r--:root:-:WARN:
-permfile:/etc/shadow-:---------:root:-:WARN:
-permfile:/etc/group-:rw-r--r--:root:-:WARN:
-permfile:/etc/gshadow-:---------:root:-:WARN:
+#permfile=/etc/inetd.conf:rw-------:root:-:WARN:
+#permfile=/etc/fstab:rw-r--r--:root:-:WARN:
+permfile=/boot/grub2/grub.cfg:rw-------:root:root:WARN:
+permfile=/boot/grub/grub.cfg:rw-------:root:root:WARN:
+permfile=/boot/grub2/user.cfg:rw-------:root:root:WARN:
+permfile=/etc/at.allow:rw-------:root:-:WARN:
+permfile=/etc/at.deny:rw-------:root:-:WARN:
+permfile=/etc/cron.allow:rw-------:root:-:WARN:
+permfile=/etc/cron.deny:rw-------:root:-:WARN:
+permfile=/etc/crontab:rw-------:root:-:WARN:
+permfile=/etc/group:rw-r--r--:root:-:WARN:
+permfile=/etc/group-:rw-r--r--:root:-:WARN:
+permfile=/etc/gshadow:---------:root:-:WARN:
+permfile=/etc/gshadow-:---------:root:-:WARN:
+permfile=/etc/hosts.allow:rw-r--r--:root:root:WARN:
+permfile=/etc/hosts.deny:rw-r--r--:root:root:WARN:
+permfile=/etc/issue:rw-r--r--:root:root:WARN:
+permfile=/etc/issue.net:rw-r--r--:root:root:WARN:
+permfile=/etc/lilo.conf:rw-------:root:-:WARN:
+permfile=/etc/motd:rw-r--r--:root:root:WARN:
+permfile=/etc/passwd:rw-r--r--:root:-:WARN:
+permfile=/etc/passwd-:rw-r--r--:root:-:WARN:
+permfile=/etc/shadow:---------:root:-:WARN:
+permfile=/etc/shadow-:---------:root:-:WARN:
+permfile=/etc/ssh/sshd_config:rw-------:root:-:WARN:
 
 #################################################################################
 #
 # permdir
 # ---------------
-# permdir:directory name:file permissions:owner:group:action when permissions are different:
+# permdir=directory name:file permissions:owner:group:action when permissions are different:
 #
 #################################################################################
 
-permdir:/root/.ssh:rwx------:root:-:WARN:
-permdir:/etc/cron.hourly:rwx------:root:root:WARN:
-permdir:/etc/cron.daily:rwx------:root:root:WARN:
-permdir:/etc/cron.weekly:rwx------:root:root:WARN:
-permdir:/etc/cron.monthly:rwx------:root:root:WARN:
-permdir:/etc/cron.d:rwx------:root:root:WARN:
-
-# Scan for a program/binary in BINPATHs
-#scanbinary:Rootkit Hunter:rkhunter:
-
-# Amount of connections in WAIT state before reporting it as a suggestion
-#connections-max-wait-state=5000
+permdir=/root/.ssh:rwx------:root:-:WARN:
+permdir=/etc/cron.d:rwx------:root:root:WARN:
+permdir=/etc/cron.daily:rwx------:root:root:WARN:
+permdir=/etc/cron.hourly:rwx------:root:root:WARN:
+permdir=/etc/cron.weekly:rwx------:root:root:WARN:
+permdir=/etc/cron.monthly:rwx------:root:root:WARN:
 
 
 # Ignore some specific home directories
@@ -402,7 +363,7 @@ permdir:/etc/cron.d:rwx------:root:root:WARN:
 #################################################################################
 #
 # Lynis Enterprise options
-# -----------------
+# ------------------------
 #
 #################################################################################
 
@@ -453,5 +414,4 @@ upload-options=
 #tags=db,production,ssn-1304
 
 
-
 #EOF
diff --git a/include/tests_file_permissions b/include/tests_file_permissions
index 20136488..aac166ac 100644
--- a/include/tests_file_permissions
+++ b/include/tests_file_permissions
@@ -34,7 +34,7 @@
         LogText "Test: Checking file permissions"
         for PROFILE in ${PROFILES}; do
             LogText "Using profile ${PROFILE} for baseline."
-            FIND=$(${EGREPBINARY} '^permfile:|^permdir:' ${PROFILE} | ${CUTBINARY} -d: -f2)
+            FIND=$(${EGREPBINARY} '^permfile=|^permdir=' ${PROFILE} | ${CUTBINARY} -d= -f2)
             for I in ${FIND}; do
                 LogText "Checking ${I}"
                 CheckFilePermissions ${I}

From 05012f60fd5b7cfa902aa8964d0f9bcf98281ca1 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 7 Jul 2019 18:46:55 +0200
Subject: [PATCH 139/679] Added new colors and regrouping

---
 include/consts | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/include/consts b/include/consts
index 0bbde60c..b29c4d67 100644
--- a/include/consts
+++ b/include/consts
@@ -349,7 +349,8 @@ unset LANG
 #################################################################################
 #
 
-    # Normal color names
+    # Normal color names (BG will color background)
+    BG_BLUE="$(printf '\033[0;44m')"
     CYAN="$(printf '\033[0;36m')"
     BLUE="$(printf '\033[0;34m')"
     BROWN="$(printf '\033[0;33m')"
@@ -363,15 +364,13 @@ unset LANG
     YELLOW="$(printf '\033[1;33m')"
     WHITE="$(printf '\033[1;37m')"
 
-    # Markup
+    # Special markup
     BOLD="${WHITE}"
-
-    # With background
-    BG_BLUE="$(printf '\033[0;44m')"
+    NORMAL="$(printf '\033[0m')"
 
     # Semantic names
+    BG_WARNING="$(printf '\033[30;43m')"  # Yellow background with grey text
     HEADER="${WHITE}"
-    NORMAL="$(printf '\033[0m')"
     WARNING="${RED}"
     SECTION="${YELLOW}"
     NOTICE="${YELLOW}"

From a49ea33fea9e6bf6ddcf7bcb7711c7bb79bdf62c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 7 Jul 2019 18:47:35 +0200
Subject: [PATCH 140/679] Changed Ubuntu 18.10 period

---
 db/software-eol.db | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/db/software-eol.db b/db/software-eol.db
index 084a5815..7b511237 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -42,7 +42,7 @@ os:Ubuntu 16.10:2017-07-01:1498860000:
 os:Ubuntu 17.04:2018-01-01:1514761200:
 os:Ubuntu 17.10:2018-07-01:1530396000:
 os:Ubuntu 18.04:2023-05-01:1682892000:
-os:Ubuntu 18.10:2019-07-01:1561932000:
+os:Ubuntu 18.10:2019-07-18:1563400800:
 os:Ubuntu 19.04:2020-01-01:1577833200:
 #
 # Slackware - https://en.wikipedia.org/wiki/Slackware#Releases

From 7a816ece8ab503e16250946712a95657155480a8 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 7 Jul 2019 18:47:55 +0200
Subject: [PATCH 141/679] Added DisplayWarning function

---
 include/functions | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/include/functions b/include/functions
index 66b6abb4..4f3b15a9 100644
--- a/include/functions
+++ b/include/functions
@@ -42,6 +42,7 @@
 #    DisplayError               Show an error on screen
 #    DisplayManual              Output text to screen without any layout
 #    DisplayToolTip             Show a tip for improving usage of the tool
+#    DisplayWarning             Show a clear warning on screen
 #    ExitClean                  Stop the program (cleanly), with exit code 0
 #    ExitCustom                 Stop the program (cleanly), with custom exit code
 #    ExitFatal                  Stop the program (cleanly), with exit code 1
@@ -607,6 +608,25 @@
     }
 
 
+    ################################################################################
+    # Name        : DisplayWarning
+    # Description : Show a warning on the screen
+    #
+    # Input       : $1 = text
+    # Returns     : <nothing>
+    ################################################################################
+
+    DisplayWarning() {
+        if [ ${CRONJOB} -eq 0 ]; then
+            printf "\n"
+            ${ECHOCMD:-echo} "  ${BG_WARNING}[WARNING]${NORMAL}: $1${NORMAL}"
+            printf "\n"
+        else
+            ${ECHOCMD} "  [WARNING]: $1"
+        fi
+    }
+
+
     ################################################################################
     # Name        : ExitClean()
     # Description : Perform a normal exit of the program, and clean up resources

From 5217db95b15e992b4a18d40ff3daec6987a65af9 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 7 Jul 2019 18:49:01 +0200
Subject: [PATCH 142/679] Add deprecation message for old format and added
 check for unexpected/invalid characters in profile (additional security
 measure)

---
 include/profiles | 33 +++++++++++++++++++++++++++++++--
 1 file changed, 31 insertions(+), 2 deletions(-)

diff --git a/include/profiles b/include/profiles
index 2840ed3b..101a8a77 100644
--- a/include/profiles
+++ b/include/profiles
@@ -32,8 +32,37 @@
     for PROFILE in ${PROFILES}; do
 
         LogText "Reading profile/configuration ${PROFILE}"
-        FIND=$(egrep "^config:|^[a-z-].*=" ${PROFILE} | sed 's/ /!space!/g')
-        for CONFIGOPTION in ${FIND}; do
+
+        # Show deprecation message for old config entries
+        FOUND=0
+        #DATA=$(egrep "^config:" ${PROFILE} | od --address-radix=none -t a | sed 's/ /!space!/g')
+        #if ! IsEmpty "${DATA}"; then FOUND=1; fi
+        # Items such as 'apache:'
+        DATA=$(egrep "^[a-z-]{1,}:" ${PROFILE} | od --address-radix=none -t a | sed 's/ /!space!/g')
+        if ! IsEmpty "${DATA}"; then FOUND=1; fi
+
+        if [ ${FOUND} -eq 1 ]; then
+            DisplayWarning "Your profile contains old-style configuration entries. See log file for more details and how to convert these entries"
+            LogText "Your profile has one or more configuration items that are in an old format (lines starting with key:value). They need to be converted into the new format (key=value)."
+            LogText "Tip: Use egrep to see the relevant matches (egrep \"^[a-z-]{1,}:\" custom.prf)"
+            sleep 30
+        fi
+
+        # Security check for unexpected and possibly harmful escape characters
+        DATA=$(grep -v '^$\|^ \|^#\|^config:'  ${PROFILE} | tr -d '[:alnum:]/\[\]\(\)\-_\|,\.:;= \n\r' | od --address-radix=none -t a | sed 's/ /!space!/g')
+        if ! IsEmpty "${DATA}"; then
+            DisplayWarning "Your profile '${PROFILE}' contains unexpected characters. See the log file for more information."
+            LogText "Found unexpected or possibly harmful characters in the profile. See output below."
+            for I in "${DATA}"; do
+                I=$(echo ${I} | sed 's/!space!/ /g')
+                LogText "Output: ${I}"
+            done
+            sleep 30
+        fi
+
+        # Now parse the profile and filter out unwanted characters
+        DATA=$(egrep "^config:|^[a-z-].*=" ${PROFILE} | tr -dc '[:alnum:]/\[\]\(\)\-_\|,\.:;= \n\r' | sed 's/ /!space!/g')
+        for CONFIGOPTION in ${DATA}; do
             if ContainsString "config:" "${CONFIGOPTION}"; then
                 # Old style configuration
                 OPTION=$(echo ${CONFIGOPTION} | cut -d ':' -f2)

From 9364baa4fa9d9c1f7a183a9b353c7552b3e3568e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 7 Jul 2019 18:51:49 +0200
Subject: [PATCH 143/679] Updated log

---
 CHANGELOG.md | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4c19f47d..456c42b0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,24 +4,31 @@
 
 This is a major release of Lynis and includes several big changes.
 Some of these changes may break your current usage of the tool, so test before
-deployment.
+deployment!
 
 Breaking changes:
-- Some of the old and deprecated commands or switches are removed
+- Some commands or switches are removed
+- Format of profile options changed (from key:value to key=value)
 
 An important focus area for this release is on security. We added several
 measures to further tighten any possible misuse.
 
 ### Added
-- Test PATH and warn or exit on discovery of dangerous location (security)
-- Additional safeguard by testing if common system tools are available (security)
-- Test parameters and arguments for presence of control characters (security)
-- New function SafeInput (security)
-- New option to disable a single plugin: disable-plugin=pluginname
+- Security: test PATH and warn or exit on discovery of dangerous location
+- Security: additional safeguard by testing if common system tools are available
+- Security: aest parameters and arguments for presence of control characters
+- Security: strict checking enabled, filtering out unexpected characters
+- New option: disable-plugin=pluginname - Disables a single plugin
+- New function: Readonly (security)
+- New function: SafeInput (security)
+- New function: DisplayWarning
 
 ### Changed
-- The 'nounset' (set -u) parameter is now activated by default (security)
+- Profiles: unused options removed
+- Profiles: message is displayed when old format "key:value" is used
+- Security: the 'nounset' (set -u) parameter is now activated by default
 - Use locations from PATH environment variable, unless it is empty
+- Show 'lynis generate hostids' when they are missing
 
 ---------------------------------------------------------------------------------
 

From 16146aabc0023a10e3f83c8d27860323080297c3 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 8 Jul 2019 14:27:40 +0200
Subject: [PATCH 144/679] Added option: ssl-certificate-paths-to-ignore

---
 include/profiles | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/include/profiles b/include/profiles
index 101a8a77..42562c80 100644
--- a/include/profiles
+++ b/include/profiles
@@ -362,6 +362,13 @@
                     AddSetting "ssl-certificate-paths" "${SSL_CERTIFICATE_PATHS}" "Paths for SSL certificates"
                 ;;
 
+                ssl-certificate-paths-to-ignore)
+                    # Retrieve paths to ignore when searching for certificates. Strip special characters, replace possible spaces
+                    SSL_CERTIFICATE_PATHS_TO_IGNORE=$(echo ${VALUE} | tr -d '[:cntrl:]' | sed 's/ /:space:/g')
+                    Debug "SSL paths to ignore: ${SSL_CERTIFICATE_PATHS_TO_IGNORE}"
+                    AddSetting "ssl-certificate-paths-to-ignore" "${SSL_CERTIFICATE_PATHS_TO_IGNORE}" "Paths that should be ignored for SSL certificates"
+                ;;
+
                 # Set strict mode for development and quality purposes
                 strict)
                     FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)") && SET_STRICT=1

From 1854e51e7e116c2fe3322ed53bf38e6ce27787e0 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 8 Jul 2019 15:05:28 +0200
Subject: [PATCH 145/679] New function: Equals

---
 include/functions | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/include/functions b/include/functions
index 4f3b15a9..e0149b45 100644
--- a/include/functions
+++ b/include/functions
@@ -43,6 +43,7 @@
 #    DisplayManual              Output text to screen without any layout
 #    DisplayToolTip             Show a tip for improving usage of the tool
 #    DisplayWarning             Show a clear warning on screen
+#    Equals                     Compares two strings
 #    ExitClean                  Stop the program (cleanly), with exit code 0
 #    ExitCustom                 Stop the program (cleanly), with custom exit code
 #    ExitFatal                  Stop the program (cleanly), with exit code 1
@@ -627,6 +628,27 @@
     }
 
 
+    ################################################################################
+    # Name        : Equals()
+    # Description : Compare two strings
+    #
+    # Returns     : (0 - True, 1 - False)
+    # Usage       : if Equals "${MYDIR}" "/etc"; then echo "Found"; else "Not found"; fi
+    ################################################################################
+
+    Equals() {
+        RETVAL=1
+        if [ $# -ne 2 ]; then ReportException "Equals" "Incorrect number of arguments for $0 function"; fi
+
+        # Strip any strange control characters
+        INPUT1=$(echo $1 | tr -d '[:cntrl:]<>' | ${SEDBINARY} 's/__space__/ /g' | ${SEDBINARY} 's/:space:/ /g')
+        INPUT2=$(echo $2 | tr -d '[:cntrl:]<>' | ${SEDBINARY} 's/__space__/ /g' | ${SEDBINARY} 's/:space:/ /g')
+        if [ "${INPUT1}" = "${INPUT2}" ]; then RETVAL=0; fi
+
+        return ${RETVAL}
+    }
+
+
     ################################################################################
     # Name        : ExitClean()
     # Description : Perform a normal exit of the program, and clean up resources

From 2c17c14c3b8235c906e3435369b278e95f09b1ad Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 8 Jul 2019 15:08:56 +0200
Subject: [PATCH 146/679] New profile option to ignore specified certificate
 directories

---
 default.prf          |  3 +-
 include/consts       |  1 +
 include/profiles     | 18 ++++++-----
 include/tests_crypto | 73 ++++++++++++++++++++++++++------------------
 4 files changed, 57 insertions(+), 38 deletions(-)

diff --git a/default.prf b/default.prf
index 98f3e20d..befd40d0 100644
--- a/default.prf
+++ b/default.prf
@@ -92,8 +92,9 @@ skip-plugins=no
 # Skip Lynis upgrade availability test (default: no)
 #skip-upgrade-test=yes
 
-# Locations where to search for SSL certificates
+# Locations where to search for SSL certificates (separate paths with a colon)
 ssl-certificate-paths=/etc/apache2:/etc/dovecot:/etc/httpd:/etc/letsencrypt:/etc/pki:/etc/postfix:/etc/ssl:/opt/psa/var/certificates:/usr/local/psa/var/certificates:/usr/local/share/ca-certificates:/var/www:/srv/www
+ssl-certificate-paths-to-ignore=/etc/letsencrypt/archive:
 
 # Scan type - how deep the audit should be (light, normal or full)
 test-scan-mode=full
diff --git a/include/consts b/include/consts
index b29c4d67..a03f2708 100644
--- a/include/consts
+++ b/include/consts
@@ -265,6 +265,7 @@ unset LANG
     SSHKEYSCANBINARY=""
     SSHKEYSCANFOUND=0
     SSL_CERTIFICATE_PATHS=""
+    SSL_CERTIFICATE_PATHS_TO_IGNORE=""
     STUNNELBINARY=""
     SYSLOGNGBINARY=""
     SYSTEMCTLBINARY=""
diff --git a/include/profiles b/include/profiles
index 42562c80..71e05b1a 100644
--- a/include/profiles
+++ b/include/profiles
@@ -63,7 +63,7 @@
         # Now parse the profile and filter out unwanted characters
         DATA=$(egrep "^config:|^[a-z-].*=" ${PROFILE} | tr -dc '[:alnum:]/\[\]\(\)\-_\|,\.:;= \n\r' | sed 's/ /!space!/g')
         for CONFIGOPTION in ${DATA}; do
-            if ContainsString "config:" "${CONFIGOPTION}"; then
+            if ContainsString "^config:" "${CONFIGOPTION}"; then
                 # Old style configuration
                 OPTION=$(echo ${CONFIGOPTION} | cut -d ':' -f2)
                 VALUE=$(echo ${CONFIGOPTION} | cut -d ':' -f3 | sed 's/!space!/ /g')
@@ -119,7 +119,7 @@
                 ;;
 
                 # Ignore configuration data
-                config-data)
+                config-data | permdir | permfile)
                     Debug "Ignoring configuration option, as it will be used by a specific test"
                 ;;
 
@@ -364,7 +364,7 @@
 
                 ssl-certificate-paths-to-ignore)
                     # Retrieve paths to ignore when searching for certificates. Strip special characters, replace possible spaces
-                    SSL_CERTIFICATE_PATHS_TO_IGNORE=$(echo ${VALUE} | tr -d '[:cntrl:]' | sed 's/ /:space:/g')
+                    SSL_CERTIFICATE_PATHS_TO_IGNORE=$(echo ${VALUE} | tr -d '[:cntrl:]' | sed 's/ /__space__/g')
                     Debug "SSL paths to ignore: ${SSL_CERTIFICATE_PATHS_TO_IGNORE}"
                     AddSetting "ssl-certificate-paths-to-ignore" "${SSL_CERTIFICATE_PATHS_TO_IGNORE}" "Paths that should be ignored for SSL certificates"
                 ;;
@@ -482,10 +482,14 @@
                 # Catch all bad options and bail out
                 *)
                     LogText "Unknown option ${OPTION} (with value: ${VALUE})"
-                    ${ECHOCMD} ""
-                    ${ECHOCMD} "${RED}Error${NORMAL}: found one or more errors in profile ${PROFILE}"
-                    ${ECHOCMD} "${WHITE}Details${NORMAL}: Unknown option '${YELLOW}${OPTION}${NORMAL}' found (with value: ${VALUE})"
-                    ${ECHOCMD} ""
+
+                    ${ECHOCMD:-echo} ""
+                    ${ECHOCMD:-echo} "${RED}Error${NORMAL}: found one or more errors in profile ${PROFILE}"
+                    ${ECHOCMD:-echo} ""
+                    ${ECHOCMD:-echo} ""
+                    ${ECHOCMD:-echo} "Full line: ${CONFIGOPTION}"
+                    ${ECHOCMD:-echo} "${WHITE}Details${NORMAL}: Unknown option '${YELLOW}${OPTION}${NORMAL}' found (with value: ${VALUE})"
+                    ${ECHOCMD:-echo} ""
                     ExitFatal
                 ;;
 
diff --git a/include/tests_crypto b/include/tests_crypto
index 4188dea9..2d064b5f 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -34,10 +34,13 @@
         COUNT_EXPIRED=0
         COUNT_TOTAL=0
         FOUNDPROBLEM=0
-        sSSL_PATHS=$(echo ${SSL_CERTIFICATE_PATHS} | ${SEDBINARY} 's/:/ /g')
-        sSSL_PATHS=$(echo ${sSSL_PATHS} | ${SEDBINARY} 's/^ //' | ${TRBINARY} " " "\n" | ${SORTBINARY} | uniq | ${TRBINARY} "\n" " ")
+        sSSL_PATHS=$(echo ${SSL_CERTIFICATE_PATHS} | ${SEDBINARY} 's/:space:/__space__/g' | ${SEDBINARY} 's/:/ /g')
+        sSSL_PATHS=$(echo ${sSSL_PATHS} | ${SEDBINARY} 's/^ //' | ${SORTBINARY} | ${UNIQBINARY})
         LogText "Paths to scan: ${sSSL_PATHS}"
 
+        IGNORE_PATHS_PRINT=$(echo ${SSL_CERTIFICATE_PATHS_TO_IGNORE} | ${SEDBINARY} 's/:/, /g' | ${SEDBINARY} 's/__space__/ /g' | ${SEDBINARY} 's/^ //' | ${SORTBINARY} | ${UNIQBINARY})
+        LogText "Paths to ignore: ${IGNORE_PATHS_PRINT}"
+
         for DIR in ${sSSL_PATHS}; do
             COUNT_DIR=0
             if [ -d ${DIR} ]; then
@@ -45,43 +48,53 @@
                 if [ ${CANREAD} -eq 1 ]; then
                     LogText "Result: found directory ${DIR}"
                     # Search for certificate files
-                    FILES=$(${FINDBINARY} ${DIR} -type f 2> /dev/null | ${EGREPBINARY} ".crt$|.pem$|^cert" | ${SORTBINARY} | ${SEDBINARY} 's/ /:space:/g')
+                    FILES=$(${FINDBINARY} ${DIR} -type f 2> /dev/null | ${EGREPBINARY} ".crt$|.pem$|^cert" | ${SORTBINARY} | ${SEDBINARY} 's/ /__space__/g')
                     for FILE in ${FILES}; do
-                        FILE=$(echo ${FILE} |${SEDBINARY} 's/:space:/ /g')
-                        COUNT_DIR=$((COUNT_DIR + 1))
-                        FileIsReadable "${FILE}"
-                        if [ ${CANREAD} -eq 1 ]; then
-                            # Only check the files that are not installed by a package
-                            if ! FileInstalledByPackage "${FILE}"; then
-                                LogText "Test: test if file is a certificate"
-                                OUTPUT=$(${GREPBINARY} -q 'BEGIN CERT' "${FILE}")
-                                if [ $? -eq 0 ]; then
-                                    LogText "Result: file is a certificate"
-                                    LogText "Test: checking certificate details"
-                                    FIND=$(${OPENSSLBINARY} x509 -noout -in "${FILE}" -enddate 2> /dev/null | ${GREPBINARY} "^notAfter")
+                        SKIP=0
+                        FILE=$(echo ${FILE} | ${SEDBINARY} 's/__space__/ /g')
+                        # See if we need to skip this path
+                        SUBDIR=$(echo ${FILE} | ${AWKBINARY} -F/ '{print $NF}' | ${SEDBINARY} 's/__space__/ /g')
+                        for D in ${SSL_CERTIFICATE_PATHS_TO_IGNORE}; do
+                            if Equals "${D}" "${SUBDIR}"; then
+                                SKIP=1
+                            fi
+                        done
+                        if [ ${SKIP} -eq 0 ]; then
+                            COUNT_DIR=$((COUNT_DIR + 1))
+                            FileIsReadable "${FILE}"
+                            if [ ${CANREAD} -eq 1 ]; then
+                                # Only check the files that are not installed by a package
+                                if ! FileInstalledByPackage "${FILE}"; then
+                                    OUTPUT=$(${GREPBINARY} -q 'BEGIN CERT' "${FILE}")
                                     if [ $? -eq 0 ]; then
-                                        # Check certificate where 'end date' has been expired
-                                        FIND=$(${OPENSSLBINARY} x509 -noout -checkend 0 -in "${FILE}" -enddate 2> /dev/null)
-                                        EXIT_CODE=$?
-                                        CERT_CN=$(${OPENSSLBINARY} x509 -noout -subject -in "${FILE}" 2> /dev/null | ${SEDBINARY} -e 's/^subject.*CN=\([a-zA-Z0-9\.\-\*]*\).*$/\1/')
-                                        CERT_NOTAFTER=$(${OPENSSLBINARY} x509 -noout -enddate -in "${FILE}" 2> /dev/null | ${AWKBINARY} -F= '{if ($1=="notAfter") { print $2 }}')
-                                        Report "certificate[]=${FILE}|${EXIT_CODE}|cn:${CERT_CN};notafter:${CERT_NOTAFTER};|"
-                                        if [ ${EXIT_CODE} -eq 0 ]; then 
-                                            LogText "Result: certificate ${FILE} seems to be correct and still valid"
+                                        LogText "Result: file is a certificate file"
+                                        FIND=$(${OPENSSLBINARY} x509 -noout -in "${FILE}" -enddate 2> /dev/null | ${GREPBINARY} "^notAfter")
+                                        if [ $? -eq 0 ]; then
+                                            # Check certificate where 'end date' has been expired
+                                            FIND=$(${OPENSSLBINARY} x509 -noout -checkend 0 -in "${FILE}" -enddate 2> /dev/null)
+                                            EXIT_CODE=$?
+                                            CERT_CN=$(${OPENSSLBINARY} x509 -noout -subject -in "${FILE}" 2> /dev/null | ${SEDBINARY} -e 's/^subject.*CN=\([a-zA-Z0-9\.\-\*]*\).*$/\1/')
+                                            CERT_NOTAFTER=$(${OPENSSLBINARY} x509 -noout -enddate -in "${FILE}" 2> /dev/null | ${AWKBINARY} -F= '{if ($1=="notAfter") { print $2 }}')
+                                            Report "certificate[]=${FILE}|${EXIT_CODE}|cn:${CERT_CN};notafter:${CERT_NOTAFTER};|"
+                                            if [ ${EXIT_CODE} -eq 0 ]; then 
+                                                LogText "Result: certificate ${FILE} seems to be correct and still valid"
+                                            else
+                                                FOUNDPROBLEM=1
+                                                COUNT_EXPIRED=$((COUNT_EXPIRED + 1))
+                                                LogText "Result: certificate ${FILE} has been expired"
+                                            fi
                                         else
-                                            FOUNDPROBLEM=1
-                                            COUNT_EXPIRED=$((COUNT_EXPIRED + 1))
-                                            LogText "Result: certificate ${FILE} has been expired"
+                                            LogText "Result: skipping tests for this file (${FILE}) as it is most likely not a certificate (is it a key file?)"
                                         fi
                                     else
-                                        LogText "Result: skipping tests for this file (${FILE}) as it is most likely not a certificate (a key file?)"
+                                        LogText "Result: skipping test for this file (${FILE}) as we could not find 'BEGIN CERT'"
                                     fi
-                                else
-                                    LogText "Result: skipping test for this file (${FILE}) as we could not find 'BEGIN CERT'"
                                 fi
+                            else
+                                LogText "Result: can not read file ${FILE} (no permission)"
                             fi
                         else
-                            LogText "Result: can not read file ${FILE} (no permission)"
+                            LogText "Result: path ${SUBDIR} skipped according to profile"
                         fi
                     done
                     COUNT_TOTAL=$((COUNT_TOTAL + COUNT_DIR))

From 841509465b03e7a538649cb5fe94c9def7c40075 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 8 Jul 2019 15:10:32 +0200
Subject: [PATCH 147/679] Updated log

---
 CHANGELOG.md | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 456c42b0..996aa597 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,12 +16,14 @@ measures to further tighten any possible misuse.
 ### Added
 - Security: test PATH and warn or exit on discovery of dangerous location
 - Security: additional safeguard by testing if common system tools are available
-- Security: aest parameters and arguments for presence of control characters
-- Security: strict checking enabled, filtering out unexpected characters
-- New option: disable-plugin=pluginname - Disables a single plugin
-- New function: Readonly (security)
-- New function: SafeInput (security)
-- New function: DisplayWarning
+- Security: test parameters and arguments for presence of control characters
+- Security: filtering out unexpected characters from profiles
+- New function: DisplayWarning - show a warning on the screen
+- New function: Equals - compare two strings
+- New function: Readonly - mark variable read-only (security)
+- New function: SafeInput - check for safe input (security)
+- New profile option: disable-plugin - disables a single plugin
+- New profile option: ssl-certificate-paths-to-ignore - ignore a path
 
 ### Changed
 - Profiles: unused options removed

From 054ca21ee34475ae123570b110aedbb7f5221af9 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 8 Jul 2019 21:19:28 +0200
Subject: [PATCH 148/679] Fix: split directories

---
 include/profiles | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/profiles b/include/profiles
index 71e05b1a..a2d36bb4 100644
--- a/include/profiles
+++ b/include/profiles
@@ -364,7 +364,7 @@
 
                 ssl-certificate-paths-to-ignore)
                     # Retrieve paths to ignore when searching for certificates. Strip special characters, replace possible spaces
-                    SSL_CERTIFICATE_PATHS_TO_IGNORE=$(echo ${VALUE} | tr -d '[:cntrl:]' | sed 's/ /__space__/g')
+                    SSL_CERTIFICATE_PATHS_TO_IGNORE=$(echo ${VALUE} | tr -d '[:cntrl:]' | sed 's/ /__space__/g' | tr ':' ' ')
                     Debug "SSL paths to ignore: ${SSL_CERTIFICATE_PATHS_TO_IGNORE}"
                     AddSetting "ssl-certificate-paths-to-ignore" "${SSL_CERTIFICATE_PATHS_TO_IGNORE}" "Paths that should be ignored for SSL certificates"
                 ;;

From f3f6be6630f3b3ecfa40daf99e2e8ea81022849c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 8 Jul 2019 21:20:45 +0200
Subject: [PATCH 149/679] Fix for incorrect subdirectory retrieval and adding
 enhancement to reduce number of evaluations needed

---
 include/tests_crypto | 28 +++++++++++++++++++---------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/include/tests_crypto b/include/tests_crypto
index 2d064b5f..9be27b6f 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -34,6 +34,7 @@
         COUNT_EXPIRED=0
         COUNT_TOTAL=0
         FOUNDPROBLEM=0
+        SKIP=0
         sSSL_PATHS=$(echo ${SSL_CERTIFICATE_PATHS} | ${SEDBINARY} 's/:space:/__space__/g' | ${SEDBINARY} 's/:/ /g')
         sSSL_PATHS=$(echo ${sSSL_PATHS} | ${SEDBINARY} 's/^ //' | ${SORTBINARY} | ${UNIQBINARY})
         LogText "Paths to scan: ${sSSL_PATHS}"
@@ -46,20 +47,30 @@
             if [ -d ${DIR} ]; then
                 FileIsReadable ${DIR}
                 if [ ${CANREAD} -eq 1 ]; then
+                    LASTSUBDIR=""
                     LogText "Result: found directory ${DIR}"
                     # Search for certificate files
                     FILES=$(${FINDBINARY} ${DIR} -type f 2> /dev/null | ${EGREPBINARY} ".crt$|.pem$|^cert" | ${SORTBINARY} | ${SEDBINARY} 's/ /__space__/g')
                     for FILE in ${FILES}; do
-                        SKIP=0
                         FILE=$(echo ${FILE} | ${SEDBINARY} 's/__space__/ /g')
                         # See if we need to skip this path
-                        SUBDIR=$(echo ${FILE} | ${AWKBINARY} -F/ '{print $NF}' | ${SEDBINARY} 's/__space__/ /g')
-                        for D in ${SSL_CERTIFICATE_PATHS_TO_IGNORE}; do
-                            if Equals "${D}" "${SUBDIR}"; then
-                                SKIP=1
-                            fi
-                        done
+                        SUBDIR=$(echo ${FILE} | ${AWKBINARY} -F/ 'sub(FS $NF,x)' | ${SEDBINARY} 's/__space__/ /g')
+                        # If we discover a new directory, do evaluation
+                        #Debug "File   : ${FILE}"
+                        #Debug "Lastdir: ${LASTSUBDIR}"
+                        #Debug "Curdir : ${SUBDIR}"
+                        if [ ! "${SUBDIR}" = "${LASTSUBDIR}" ]; then
+                            SKIP=0
+                            # Now check if this path is on the to-be-ignored list
+                            for D in ${SSL_CERTIFICATE_PATHS_TO_IGNORE}; do
+                                if Equals "${D}" "${SUBDIR}"; then
+                                    SKIP=1
+                                    LogText "Result: skipping directory (${SUBDIR}) as it is on ignore list"
+                                fi
+                            done
+                        fi
                         if [ ${SKIP} -eq 0 ]; then
+                            #Debug "Testing ${FILE} in path: $SUBDIR"
                             COUNT_DIR=$((COUNT_DIR + 1))
                             FileIsReadable "${FILE}"
                             if [ ${CANREAD} -eq 1 ]; then
@@ -93,9 +104,8 @@
                             else
                                 LogText "Result: can not read file ${FILE} (no permission)"
                             fi
-                        else
-                            LogText "Result: path ${SUBDIR} skipped according to profile"
                         fi
+                        LASTSUBDIR="${SUBDIR}"
                     done
                     COUNT_TOTAL=$((COUNT_TOTAL + COUNT_DIR))
                     LogText "Result: found ${COUNT_DIR} certificates in ${DIR}"

From 6891f64c393efdfe3d9157b0d4a4bd84ff0c6298 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 9 Jul 2019 10:33:51 +0200
Subject: [PATCH 150/679] Added CRYP-7930

---
 db/tests.db          |  1 +
 include/tests_crypto | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/db/tests.db b/db/tests.db
index 215c3595..6be553f0 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -84,6 +84,7 @@ CONT-8107:test:performance:containers::Check number of unused Docker containers:
 CONT-8108:test:security:containers::Check file permissions for Docker files:
 CORE-1000:test:performance:system_integrity::Check all system binaries:
 CRYP-7902:test:security:crypto::Check expire date of SSL certificates:
+CRYP-7930:test:security:crypto::Determine if system uses disk or file encryption:
 DNS-1600:test:security:dns::Validating that the DNSSEC signatures are checked:
 DBS-1804:test:security:databases::Checking active MySQL process:
 DBS-1816:test:security:databases::Checking MySQL root password:
diff --git a/include/tests_crypto b/include/tests_crypto
index 9be27b6f..22199016 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -128,6 +128,27 @@
     fi
 #
 #################################################################################
+#
+    # Test        : CRYP-7930
+    # Description : Determine if system uses disk or file encryption
+    Register --test-no CRYP-7930 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determine if system uses disk or file encryption"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        FILE="${ROOTDIR}etc/crypttab"
+        if [ -f ${FILE} ]; then
+            DATA=$(${GREPBINARY} "^[a-z]" ${ROOTDIR}etc/crypttab | ${SEDBINARY} 's/[:blank:]/__space__/g' | ${TRBINARY} -d '[:cntrl:]')
+            for LINE in ${DATA}; do
+                LINE=$(echo ${LINE} | ${SEDBINARY} 's/__space__/ /g')
+                if ContainsString "luks," "${LINE}"; then
+                    PARTITION=$(echo ${LINE} | ${AWKBINARY} '{print $1}' | ${AWKBINARY} -F_ '{print $1}')
+                    LogText "Result: Found LUKS encryption on partition ${PARTITION}"
+                    Report "encryption[]=luks,partition,${PARTITION}"
+                fi
+            done
+            unset DATA LINE PARTITION
+        fi
+    fi
+#
+#################################################################################
 #
 
 WaitForKeyPress

From 9533d6fc7af7e668e12e56c7b0fe39abc8684cc7 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 9 Jul 2019 10:34:07 +0200
Subject: [PATCH 151/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 996aa597..baa645db 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,6 +24,7 @@ measures to further tighten any possible misuse.
 - New function: SafeInput - check for safe input (security)
 - New profile option: disable-plugin - disables a single plugin
 - New profile option: ssl-certificate-paths-to-ignore - ignore a path
+- New test: CRYP-7930 - disk or file system encryption testing
 
 ### Changed
 - Profiles: unused options removed

From ae474c72c6566f86d738897cfdd78c979377eb14 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 9 Jul 2019 11:16:59 +0200
Subject: [PATCH 152/679] [SSH-7402] detect other SSH daemons like dropbear and
 split SSH daemon from OpenSSH daemon

---
 include/tests_ssh | 49 ++++++++++++++++++++++++++---------------------
 1 file changed, 27 insertions(+), 22 deletions(-)

diff --git a/include/tests_ssh b/include/tests_ssh
index fe303778..6e35e608 100644
--- a/include/tests_ssh
+++ b/include/tests_ssh
@@ -27,6 +27,7 @@
     SSH_DAEMON_PORT=""
     SSH_DAEMON_RUNNING=0
     SSH_DAEMON_OPTIONS_FILE=""
+    OPENSSHD_RUNNING=0
     OPENSSHD_VERSION=0
     OPENSSHD_VERSION_MAJOR=0
     OPENSSHD_VERSION_MINOR=0
@@ -42,8 +43,8 @@
     Register --test-no SSH-7402 --weight L --network NO --category security --description "Check for running SSH daemon"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Searching for a SSH daemon"
-        IsRunning sshd
-        if [ ${RUNNING} -eq 1 ] || PortIsListening "TCP" 22; then
+        if IsRunning "sshd"; then
+            OPENSSHD_RUNNING=1
             SSH_DAEMON_RUNNING=1
             Display --indent 2 --text "- Checking running SSH daemon" --result "${STATUS_FOUND}" --color GREEN
             # Store settings in a temporary file
@@ -51,6 +52,9 @@
             SSH_DAEMON_OPTIONS_FILE="${TEMP_FILE}"
             # Use a non-existing user, to ensure that systems that have a Match block configured, will be evaluated as well
             ${SSHDBINARY} -T -C user=doesnotexist,host=none,addr=none 2> /dev/null > ${SSH_DAEMON_OPTIONS_FILE}
+        elif PortIsListening "TCP" 22; then
+            Display --indent 2 --text "- Checking running SSH daemon" --result "${STATUS_FOUND}" --color GREEN
+            SSH_DAEMON_RUNNING=1
         else
             Display --indent 2 --text "- Checking running SSH daemon" --result "${STATUS_NOT_FOUND}" --color WHITE
         fi
@@ -60,7 +64,7 @@
 #
     # Test        : SSH-7404
     # Description : Determine SSH daemon configuration file location
-    if [ ${SSH_DAEMON_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${OPENSSHD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SSH-7404 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check SSH daemon file location"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
@@ -95,7 +99,7 @@
 #
     # Test        : SSH-7406
     # Description : Check OpenSSH version
-    if [ ${SSH_DAEMON_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${OPENSSHD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SSH-7406 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determine OpenSSH version"
     if [ ${SKIPTEST} -eq 0 ]; then
         OPENSSHD_VERSION=$(sshd -t -d 2>&1 | ${GREPBINARY} 'sshd version' | ${AWKBINARY} '{if($4~OpenSSH_){print $4}}' | ${AWKBINARY} -F_ '{print $2}' | ${TRBINARY} -d ',')
@@ -113,7 +117,7 @@
     # Test        : SSH-7408
     # Description : Check SSH specific defined options
     # Notes       : Instead of parsing the configuration file, we query the SSH daemon itself
-    if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! -z "${SSH_DAEMON_OPTIONS_FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${OPENSSHD_RUNNING} -eq 1 -a ! -z "${SSH_DAEMON_OPTIONS_FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SSH-7408 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check SSH specific defined options"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking specific defined options in ${SSH_DAEMON_OPTIONS_FILE}"
@@ -258,31 +262,31 @@
                 fi
 
                 if [ "${RESULT}" = "GOOD" ]; then
-                    LogText "Result: SSH option ${OPTIONNAME} is configured very well"
-                    Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "${STATUS_OK}" --color GREEN
+                    LogText "Result: OpenSSH option ${OPTIONNAME} is configured very well"
+                    Display --indent 4 --text "- OpenSSH option: ${OPTIONNAME}" --result "${STATUS_OK}" --color GREEN
                     AddHP 3 3
                 elif [ "${RESULT}" = "MIDSCORED" ]; then
-                    LogText "Result: SSH option ${OPTIONNAME} is configured reasonably"
+                    LogText "Result: OpenSSH option ${OPTIONNAME} is configured reasonably"
                     ReportSuggestion ${TEST_NO} "Consider hardening SSH configuration" "${OPTIONNAME} (${FOUNDVALUE} --> ${EXPECTEDVALUE})" "-"
                     ReportDetails --test "${TEST_NO}" --service "sshd" --field "${OPTIONNAME}" --value "${FOUNDVALUE}" --preferredvalue "${EXPECTEDVALUE}" --description "sshd option ${OPTIONNAME}"
-                    Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "${STATUS_SUGGESTION}" --color YELLOW
+                    Display --indent 4 --text "- OpenSSH option: ${OPTIONNAME}" --result "${STATUS_SUGGESTION}" --color YELLOW
                     AddHP 1 3
                 elif [ "${RESULT}" = "WEAK" ]; then
-                    LogText "Result: SSH option ${OPTIONNAME} is in a weak configuration state and should be fixed"
+                    LogText "Result: OpenSSH option ${OPTIONNAME} is in a weak configuration state and should be fixed"
                     ReportSuggestion ${TEST_NO} "Consider hardening SSH configuration" "${OPTIONNAME} (${FOUNDVALUE} --> ${EXPECTEDVALUE})" "-"
                     ReportDetails --test "${TEST_NO}" --service "sshd" --field "${OPTIONNAME}" --value "${FOUNDVALUE}" --preferredvalue "${EXPECTEDVALUE}" --description "sshd option ${OPTIONNAME}"
-                    Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "${STATUS_SUGGESTION}" --color YELLOW
+                    Display --indent 4 --text "- OpenSSH option: ${OPTIONNAME}" --result "${STATUS_SUGGESTION}" --color YELLOW
                     AddHP 0 3
                 elif [ "${RESULT}" = "UNKNOWN" ]; then
-                    LogText "Result: Value of SSH option ${OPTIONNAME} is unknown (not defined)"
-                    Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result DEFAULT --color WHITE
+                    LogText "Result: Value of OpenSSH option ${OPTIONNAME} is unknown (not defined)"
+                    Display --indent 4 --text "- OpenSSH option: ${OPTIONNAME}" --result DEFAULT --color WHITE
                     Report "unknown_config_option[]=ssh|$SSH_DAEMON_CONFIG}|${OPTIONNAME}|"
                 else
                     LogText "Result: Option ${OPTIONNAME} not found in output"
-                    Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "${STATUS_NOT_FOUND}" --color WHITE
+                    Display --indent 4 --text "- OpenSSH option: ${OPTIONNAME}" --result "${STATUS_NOT_FOUND}" --color WHITE
                 fi
             else
-                if IsVerbose; then Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "SKIPPED (via config)" --color WHITE; fi
+                if IsVerbose; then Display --indent 4 --text "- OpenSSH option: ${OPTIONNAME}" --result "SKIPPED (via config)" --color WHITE; fi
             fi
         done
     fi
@@ -290,32 +294,32 @@
 #################################################################################
 #
     # Test        : SSH-7440
-    # Description : AllowUsers / AllowGroups
+    # Description : OpenSSH - AllowUsers / AllowGroups
     # Goal        : Check if only a specific amount of users/groups can log in to the system
-    if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! -z "${SSH_DAEMON_OPTIONS_FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no SSH-7440 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check SSH option: AllowUsers and AllowGroups"
+    if [ ${OPENSSHD_RUNNING} -eq 1 -a ! -z "${SSH_DAEMON_OPTIONS_FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no SSH-7440 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check OpenSSH option: AllowUsers and AllowGroups"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
         # AllowUsers
         FIND=$(${EGREPBINARY} -i "^AllowUsers" ${SSH_DAEMON_OPTIONS_FILE} | ${AWKBINARY} '{ print $2 }')
         if [ ! -z "${FIND}" ]; then
             LogText "Result: AllowUsers set, with value ${FIND}"
-            Display --indent 4 --text "- SSH option: AllowUsers" --result "${STATUS_FOUND}" --color GREEN
+            Display --indent 4 --text "- OpenSSH option: AllowUsers" --result "${STATUS_FOUND}" --color GREEN
             FOUND=1
         else
             LogText "Result: AllowUsers is not set"
-            Display --indent 4 --text "- SSH option: AllowUsers" --result "${STATUS_NOT_FOUND}" --color WHITE
+            Display --indent 4 --text "- OpenSSH option: AllowUsers" --result "${STATUS_NOT_FOUND}" --color WHITE
         fi
 
         # AllowGroups
         FIND=$(${EGREPBINARY} -i "^AllowGroups" ${SSH_DAEMON_OPTIONS_FILE} | ${AWKBINARY} '{ print $2 }')
         if [ ! -z "${FIND}" ]; then
             LogText "Result: AllowUsers set ${FIND}"
-            Display --indent 4 --text "- SSH option: AllowGroups" --result "${STATUS_FOUND}" --color GREEN
+            Display --indent 4 --text "- OpenSSH option: AllowGroups" --result "${STATUS_FOUND}" --color GREEN
             FOUND=1
         else
             LogText "Result: AllowGroups is not set"
-            Display --indent 4 --text "- SSH option: AllowGroups" --result "${STATUS_NOT_FOUND}" --color WHITE
+            Display --indent 4 --text "- OpenSSH option: AllowGroups" --result "${STATUS_NOT_FOUND}" --color WHITE
         fi
 
         if [ ${FOUND} -eq 1 ]; then
@@ -331,6 +335,7 @@
 #
 
 Report "ssh_daemon_running=${SSH_DAEMON_RUNNING}"
+Report "openssh_daemon_running=${OPENSSHD_RUNNING}"
 
 WaitForKeyPress
 

From 7650dd441d67962cd3643833a60c872ce85deba2 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 9 Jul 2019 11:18:12 +0200
Subject: [PATCH 153/679] Updated log

---
 CHANGELOG.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index baa645db..65dffde0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,13 +25,15 @@ measures to further tighten any possible misuse.
 - New profile option: disable-plugin - disables a single plugin
 - New profile option: ssl-certificate-paths-to-ignore - ignore a path
 - New test: CRYP-7930 - disk or file system encryption testing
+- New report key: openssh_daemon_running
 
 ### Changed
 - Profiles: unused options removed
 - Profiles: message is displayed when old format "key:value" is used
 - Security: the 'nounset' (set -u) parameter is now activated by default
-- Use locations from PATH environment variable, unless it is empty
+- Use only locations from PATH environment variable, unless it is not defined
 - Show 'lynis generate hostids' when they are missing
+- SSH-7402 - detect other SSH daemons like dropbear
 
 ---------------------------------------------------------------------------------
 

From 09d8832a0b4b922e90b37c358afdeceda2b603c3 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 9 Jul 2019 11:42:04 +0200
Subject: [PATCH 154/679] [CRYP-7903] enhanced test to properly work

---
 include/tests_crypto | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/include/tests_crypto b/include/tests_crypto
index 22199016..6d0d5384 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -131,11 +131,12 @@
 #
     # Test        : CRYP-7930
     # Description : Determine if system uses disk or file encryption
-    Register --test-no CRYP-7930 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determine if system uses disk or file encryption"
+    Register --test-no CRYP-7930 --weight L --network NO --category security --description "Determine if system uses disk or file encryption"
     if [ ${SKIPTEST} -eq 0 ]; then
         FILE="${ROOTDIR}etc/crypttab"
         if [ -f ${FILE} ]; then
-            DATA=$(${GREPBINARY} "^[a-z]" ${ROOTDIR}etc/crypttab | ${SEDBINARY} 's/[:blank:]/__space__/g' | ${TRBINARY} -d '[:cntrl:]')
+            LogText "Result: crypttab file (${FILE}) exists"
+            DATA=$(${GREPBINARY} "^[a-z]" ${FILE} | ${TRBINARY} -cd '[:alnum:]_\-=,\n\t ' | ${SEDBINARY} 's/[[:blank:]]/__space__/g')
             for LINE in ${DATA}; do
                 LINE=$(echo ${LINE} | ${SEDBINARY} 's/__space__/ /g')
                 if ContainsString "luks," "${LINE}"; then
@@ -145,6 +146,8 @@
                 fi
             done
             unset DATA LINE PARTITION
+        else
+            LogText "Result: crypttab file (${FILE}) does not exist"
         fi
     fi
 #

From d41b1d9c5fc265c327c65fc85d01a2430216f5c1 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 10 Jul 2019 19:28:26 +0200
Subject: [PATCH 155/679] Check if setuid bit is set

---
 lynis | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lynis b/lynis
index e5faf06f..d486520a 100755
--- a/lynis
+++ b/lynis
@@ -67,6 +67,9 @@
 #
 #################################################################################
 #
+    # Check setuid bit
+    if [ -u "$0" ]; then echo "The called binary has the set-user-id bit - As this is unusual, execution will be stopped."; exit 1; fi
+
     # Work directory
     WORKDIR=$(pwd)
 

From c97dc3044a0883533a8b36f8eb0e39426aa2ddb4 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 10 Jul 2019 19:35:51 +0200
Subject: [PATCH 156/679] Use exit code instead of ITEM_FOUND value

---
 include/tests_ports_packages | 10 ++++------
 include/tests_webservers     |  9 +++------
 2 files changed, 7 insertions(+), 12 deletions(-)

diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 2d8b997e..6b6b2ed9 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -879,8 +879,7 @@
         if [ ${DO_TEST} -eq 0 ]; then
             FileExists ${ROOTDIR}usr/share/yum-cli/cli.py
             if [ ${FILE_FOUND} -eq 1 ]; then
-                SearchItem "\-\-security" "${ROOTDIR}usr/share/yum-cli/cli.py"
-                if [ ${ITEM_FOUND} -eq 1 ]; then
+                if SearchItem "\-\-security" "${ROOTDIR}usr/share/yum-cli/cli.py"; then
                     DO_TEST=1
                     LogText "Result: found built-in security in yum"
                 else
@@ -892,8 +891,7 @@
         if [ ${DO_TEST} -eq 0 ]; then
             FileExists ${ROOTDIR}etc/yum/pluginconf.d/security.conf
             if [ ${FILE_FOUND} -eq 1 ]; then
-                SearchItem "^enabled=1$" "${ROOTDIR}etc/yum/pluginconf.d/security.conf"
-                if [ ${ITEM_FOUND} -eq 1 ]; then
+                if SearchItem "^enabled=1$" "${ROOTDIR}etc/yum/pluginconf.d/security.conf"; then
                     DO_TEST=1
                     LogText "Result: found enabled plugin"
                 else
@@ -967,8 +965,8 @@
         FOUND=0
         FileExists ${ROOTDIR}etc/yum.conf
         if [ ${FILE_FOUND} -eq 1 ]; then
-            SearchItem "^gpgenabled\s*=\s*1$" "${ROOTDIR}etc/yum.conf"; if [ ${ITEM_FOUND} -eq 1 ]; then FOUND=1; fi
-            SearchItem "^gpgcheck\s*=\s*1$" "${ROOTDIR}etc/yum.conf"; if [ ${ITEM_FOUND} -eq 1 ]; then FOUND=1; fi
+            if SearchItem "^gpgenabled\s*=\s*1$" "${ROOTDIR}etc/yum.conf"; then FOUND=1; fi
+            if SearchItem "^gpgcheck\s*=\s*1$" "${ROOTDIR}etc/yum.conf"; then FOUND=1; fi
             if [ ${FOUND} -eq 1 ]; then
                 LogText "Result: GPG check is enabled"
                 Display --indent 2 --text "- Checking GPG checks (yum.conf)" --result "${STATUS_OK}" --color GREEN
diff --git a/include/tests_webservers b/include/tests_webservers
index 5d0907b9..dfe8aabc 100644
--- a/include/tests_webservers
+++ b/include/tests_webservers
@@ -251,8 +251,7 @@
     Register --test-no HTTP-6640 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determining existence of specific Apache modules"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check modules, module
-        CheckItem "apache_module" "/mod_evasive([0-9][0-9])?.so"
-        if [ ${ITEM_FOUND} -eq 1 ]; then
+        if CheckItem "apache_module" "/mod_evasive([0-9][0-9])?.so"; then
             Display --indent 10 --text "mod_evasive: anti-DoS/brute force" --result "${STATUS_FOUND}" --color GREEN
             AddHP 3 3
         else
@@ -271,8 +270,7 @@
     Register --test-no HTTP-6641 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determining existence of specific Apache modules"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check modules, module
-        CheckItem "apache_module" "/mod_(reqtimeout|qos).so"
-        if [ ${ITEM_FOUND} -eq 1 ]; then
+        if CheckItem "apache_module" "/mod_(reqtimeout|qos).so"; then
             Display --indent 10 --text "mod_reqtimeout/mod_qos" --result "${STATUS_FOUND}" --color GREEN
             AddHP 3 3
         else
@@ -290,8 +288,7 @@
     Register --test-no HTTP-6643 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determining existence of specific Apache modules"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check modules, module
-        CheckItem "apache_module" "/mod_security2.so"
-        if [ ${ITEM_FOUND} -eq 1 ]; then
+        if CheckItem "apache_module" "/mod_security2.so"; then
             Display --indent 10 --text "ModSecurity: web application firewall" --result "${STATUS_FOUND}" --color GREEN
             AddHP 3 3
         else

From 83d510934df7734e5b883643ec7ddc5a7dadb9be Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 10 Jul 2019 19:36:19 +0200
Subject: [PATCH 157/679] Quote file name as it may include spaces

---
 include/tests_file_permissions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_file_permissions b/include/tests_file_permissions
index aac166ac..2c43fc0e 100644
--- a/include/tests_file_permissions
+++ b/include/tests_file_permissions
@@ -37,7 +37,7 @@
             FIND=$(${EGREPBINARY} '^permfile=|^permdir=' ${PROFILE} | ${CUTBINARY} -d= -f2)
             for I in ${FIND}; do
                 LogText "Checking ${I}"
-                CheckFilePermissions ${I}
+                CheckFilePermissions "${I}"
                 LogText "  Expected permissions: ${PROFILEVALUE}"
                 LogText "  Actual permissions: ${FILEVALUE}"
                 LogText "  Result: $PERMS"

From f5adb68e00795218391c107bc04b24bc7711c952 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 10 Jul 2019 19:36:51 +0200
Subject: [PATCH 158/679] First round of cleanups and textual improvements

---
 include/functions | 111 ++++++++++++++++++++++++----------------------
 1 file changed, 58 insertions(+), 53 deletions(-)

diff --git a/include/functions b/include/functions
index e0149b45..f5b67fba 100644
--- a/include/functions
+++ b/include/functions
@@ -118,7 +118,8 @@
     # Name        : AddHP()
     # Description : Add hardening points and count them
     #
-    # Input       : $1 = points to add, $2 = maximum points for this item
+    # Parameters  : $1 = points to add (0 or higher)
+    #               $2 = maximum points (at least value of $1 or higher)
     # Returns     : <nothing>
     # Usage       : AddHP 1 3
     ################################################################################
@@ -139,7 +140,9 @@
     # Name        : AddSetting()
     # Description : Addition of a setting for display with 'lynis show settings'
     #
-    # Input       : $1 = setting, $2 = value, $3 description
+    # Parameters  : $1 = setting
+    #               $2 = value
+    #               $3 = description
     # Returns     : <nothing>
     # Usage       : AddSetting debug 1 'Debug mode'
     ################################################################################
@@ -163,7 +166,7 @@
                 TEMP_SETTINGS_FILE="${TEMP_FILE}"
                 cat ${SETTINGS_FILE} > ${TEMP_SETTINGS_FILE}
                 sed -e '/^'"${SETTING}"';/d' ${TEMP_SETTINGS_FILE} > ${SETTINGS_FILE}
-                rm ${TEMP_SETTINGS_FILE}
+                rm "${TEMP_SETTINGS_FILE}"
                 echo "${SETTING};${VALUE};${DESCRIPTION};" >> ${SETTINGS_FILE}
             fi
         else
@@ -176,7 +179,7 @@
     # Name        : AddSystemGroup()
     # Description : Adds a system to a group, which can be used for categorizing
     #
-    # Input       : Group name
+    # Parameters  : $1 = group name
     # Returns     : <nothing>
     # Usage       : AddSystemGroup "test"
     ################################################################################
@@ -190,13 +193,13 @@
     # Name        : CheckFilePermissions()
     # Description : Check file permissions
     #
-    # Input       : full path to file or directory
+    # Parameters  : Full path to file or directory
     # Returns     : PERMS (FILE_NOT_FOUND | OK | BAD)
     # Notes       : This function might be replaced in future
     ################################################################################
 
     CheckFilePermissions() {
-        CHECKFILE=$1
+        CHECKFILE="$1"
         if [ ! -d ${CHECKFILE} -a ! -f ${CHECKFILE} ]; then
             PERMS="FILE_NOT_FOUND"
         else
@@ -217,13 +220,13 @@
     # Name        : CheckItem()
     # Description : Check if a specific item exists in the report
     #
-    # Input       : $1 = key, $2 = value
-    # Returns     : ITEM_FOUND
-    # Usage       : CheckItem "key" "value"
+    # Parameters  : $1 = key
+    #               $2 = value
+    # Returns     : True (0) or False (1)
+    # Usage       : if CheckItem "key" "value"; then ....; fi
     ################################################################################
 
     CheckItem() {
-        ITEM_FOUND=0
         RETVAL=255
         if [ $# -eq 2 ]; then
             # Don't search in /dev/null, it's too empty there
@@ -232,7 +235,6 @@
                 LogText "Test: search string $2 in earlier discovered results"
                 FIND=$(egrep "^$1(\[\])?=" ${REPORTFILE} | egrep "$2")
                 if HasData "${FIND}"; then
-                    ITEM_FOUND=1
                     RETVAL=0
                     LogText "Result: found search string (result: $FIND)"
                 else
@@ -2350,6 +2352,7 @@
 
         # Colors with background
         BG_BLUE=""
+        BG_WARNING=""
 
         # Semantic names
         BAD=""
@@ -2364,14 +2367,15 @@
 
     ################################################################################
     # Name        : RemovePIDFile()
+    # Description : When defined, remove the file storing the process ID
     ################################################################################
 
     # Remove PID file
     RemovePIDFile() {
         # Test if PIDFILE is defined, before checking file presence
-        if [ ! "${PIDFILE}" = "" ]; then
-            if [ -f ${PIDFILE} ]; then
-                rm -f $PIDFILE;
+        if [ ! -z "${PIDFILE}" ]; then
+            if [ -f "${PIDFILE}" ]; then
+                rm -f "${PIDFILE}"
                 LogText "PID file removed (${PIDFILE})"
             else
                 LogText "PID file not found (${PIDFILE})"
@@ -2382,6 +2386,7 @@
 
     ################################################################################
     # Name        : RemoveTempFiles()
+    # Description : When created, delete any temporary file
     ################################################################################
 
     # Remove any temporary files
@@ -2392,10 +2397,10 @@
             for FILE in ${TEMP_FILES}; do
                 # Temporary files should be in /tmp
                 TMPFILE=$(echo ${FILE} | egrep "^/tmp/lynis" | grep -v "\.\.")
-                if [ ! "${TMPFILE}" = "" ]; then
-                    if [ -f ${TMPFILE} ]; then
+                if [ ! -z "${TMPFILE}" ]; then
+                    if [ -f "${TMPFILE}" ]; then
                         LogText "Action: removing temporary file ${TMPFILE}"
-                        rm -f ${TMPFILE}
+                        rm -f "${TMPFILE}"
                     else
                         LogText "Info: temporary file ${TMPFILE} was already removed"
                     fi
@@ -2411,6 +2416,7 @@
 
     ################################################################################
     # Name        : Report()
+    # Description : Store data in the report file
     ################################################################################
 
     Report() {
@@ -2485,12 +2491,14 @@
 
     ################################################################################
     # Name        : ReportException()
+    # Description : Store an exceptional event in the report
+    #
+    # Parameters  : $1 = test ID + colon + 2 numeric characters (TEST-1234:01)
+    #               $2 = string (text)
     ################################################################################
 
     # Log exceptions
     ReportException() {
-        # 1 parameters
-        # <ID>:<2 char numeric>|text|
         Report "exception_event[]=$1|$2|"
         LogText "Exception: test has an exceptional event ($1) with text $2"
     }
@@ -2498,11 +2506,12 @@
 
     ################################################################################
     # Name        : ReportManual()
+    # Description : Add an item to the report that requires manual intervention
+    #
+    # Parameters  : $1 = string (text)
     ################################################################################
 
-    # Log manual actions to report file
     ReportManual() {
-        # 1 parameter: Text
         Report "manual_event[]=$1"
         LogText "Manual: one or more manual actions are required for further testing of this control/plugin"
     }
@@ -2510,20 +2519,20 @@
 
     ################################################################################
     # Name        : ReportSuggestion()
+    # Description : Log a suggestion to the report file
+    #
+    # Parameters  : <ID> <Suggestion> <Details> <Solution>
+    #               $1 = Test ID - Lynis ID (use CUST-.... for your own tests)
+    #               $2 = Suggestion - Suggestion text to be displayed
+    #               $3 = Details - Specific item or details
+    #               $4 = Solution - Optional link for additional information:
+    #                    * url:https://example.org/how-to-solve-link
+    #                    * text:Additional explanation
+    #                    * - (dash) for none
     ################################################################################
 
-    # Log suggestions to report file
     ReportSuggestion() {
         TOTAL_SUGGESTIONS=$((TOTAL_SUGGESTIONS + 1))
-        # 4 parameters
-        # <ID> <Suggestion> <Details> <Solution>
-        # <ID>         Lynis ID (use CUST-.... for your own tests)
-        # <Suggestion> Suggestion text to be displayed
-        # <Details>    Specific item or details
-        # <Solution>   Optional link for additional information:
-        #              * url:http://site/link
-        #              * text:Additional explanation
-        #              * - for none
         if [ $# -eq 0 ]; then echo "Not enough arguments provided for function ReportSuggestion"; ExitFatal; fi
         if [ $# -ge 1 ]; then TEST="$1"; else TEST="UNKNOWN"; fi
         if [ $# -ge 2 ]; then MESSAGE="$2"; else MESSAGE="UNKNOWN"; fi
@@ -2537,9 +2546,9 @@
 
     ################################################################################
     # Name        : ReportWarning()
+    # Description : Log a warning to the report file
     ################################################################################
 
-    # Log warning to report file
     ReportWarning() {
         TOTAL_WARNINGS=$((TOTAL_WARNINGS + 1))
         # Old style
@@ -2605,7 +2614,8 @@
 
     ################################################################################
     # Name        : SafePerms()
-    # Description :
+    # Description : Check if a file has safe permissions to be used
+    #
     # Returns     : 0 (file permissions OK) or break
     ################################################################################
 
@@ -2702,14 +2712,15 @@
     # Name        : SearchItem()
     # Description : Search if a specific string exists in in a file
     #
-    # Input       : $1 = search key (string), $2 = file (string), $3 and later
-    #               are optional arguments
+    # Parameters  : $1 = search key (string)
+    #               $2 = file (string)
+    #               $3 = optional arguments:
+    #                    --sensitive - don't store results in log
     # Returns     : True (0) or False (1)
     ################################################################################
 
     SearchItem()  {
         PERFORM_SCAN=0
-        ITEM_FOUND=0
         MASK_LOG=0
         RETVAL=1
         if [ $# -lt 2 ]; then
@@ -2737,8 +2748,7 @@
                 # Check if we can find the main type (with or without brackets)
                 LogText "Test: search string ${STRING} in file ${FILE}"
                 FIND=$(egrep "${STRING}" ${FILE})
-                if [ ! "${FIND}" = "" ]; then
-                    ITEM_FOUND=1
+                if [ ! -z "${FIND}" ]; then
                     LogText "Result: found search string '${STRING}'"
                     if [ ${MASK_LOG} -eq 0 ]; then LogText "Full string returned: ${FIND}"; fi
                     RETVAL=0
@@ -2757,21 +2767,6 @@
     }
 
 
-    # Show result code (to be removed)
-    ShowResult() {
-        case $1 in
-        OK)
-            echo "[ ${OK}OK${NORMAL} ]"
-        ;;
-        WARNING)
-            echo "[ ${WARNING}WARNING${NORMAL} ]"
-            # log the warning to our log file
-            #LogText "Warning: $2"
-            # add the warning to our report file
-            #Report "warning=$2"
-        ;;
-        esac
-    }
 
 
     ################################################################################
@@ -3337,30 +3332,40 @@
     ################################################################################
 
     counttests() {
+        DisplayWarning "Deprecated function used"
         if IsDeveloperMode; then Debug "Warning: old counttests function is used. Please replace any reference with CountTests."; fi
         CountTests
     }
 
     logtext() {
+        DisplayWarning "Deprecated function used"
         if IsDeveloperMode; then Debug "Warning: old logtext function is used. Please replace any reference with LogText."; fi
         LogText "$1"
     }
 
     logtextbreak() {
+        DisplayWarning "Deprecated function used"
         if IsDeveloperMode; then Debug "Warning: old logtextbreak function is used. Please replace any reference with LogTextBreak."; fi
         LogTextBreak "$1"
     }
 
     report() {
+        DisplayWarning "Deprecated function used"
         if IsDeveloperMode; then Debug "Warning: old report function is used. Please replace any reference with Report."; fi
         Report "$1"
     }
 
     wait_for_keypress() {
+        DisplayWarning "Deprecated function used"
         if IsDeveloperMode; then Debug "Warning: old wait_for_keypress function is used. Please replace any reference with WaitForKeyPress."; fi
         WaitForKeyPress
     }
 
+    ShowResult() {
+        DisplayWarning "Deprecated function used: ShowResult()"
+        if IsDeveloperMode; then Debug "Warning: old ShowResult() function is used. Please replace any reference with WaitForKeyPress."; fi
+    }
+
 
 
 #================================================================================

From 1a57b41bddb07e0ee122e1fe685d7d01b329a649 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 10 Jul 2019 20:00:52 +0200
Subject: [PATCH 159/679] [PROC-3602] Use ROOTDIR

---
 include/tests_memory_processes | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/tests_memory_processes b/include/tests_memory_processes
index 71c0fc42..49fbd7c4 100644
--- a/include/tests_memory_processes
+++ b/include/tests_memory_processes
@@ -30,17 +30,17 @@
     # Description : Query /proc/meminfo
     Register --test-no PROC-3602 --os Linux --weight L --network NO --category security --description "Checking /proc/meminfo for memory details"
     if [ ${SKIPTEST} -eq 0 ]; then
-        if [ -f /proc/meminfo ]; then
-            LogText "Result: found /proc/meminfo"
-            Display --indent 2 --text "- Checking /proc/meminfo" --result "${STATUS_FOUND}" --color GREEN
-            FIND=$(${AWKBINARY} '/^MemTotal/ { print $2, $3 }' /proc/meminfo)
+        if [ -f ${ROOTDIR}proc/meminfo ]; then
+            LogText "Result: found ${ROOTDIR}proc/meminfo"
+            Display --indent 2 --text "- Checking ${ROOTDIR}proc/meminfo" --result "${STATUS_FOUND}" --color GREEN
+            FIND=$(${AWKBINARY} '/^MemTotal/ { print $2, $3 }' ${ROOTDIR}proc/meminfo)
             MEMORY_SIZE=$(echo ${FIND} | ${AWKBINARY} '{ print $1 }')
             MEMORY_UNITS=$(echo ${FIND} | ${AWKBINARY} '{ print $2 }')
             LogText "Result: Found ${MEMORY_SIZE} ${MEMORY_UNITS} memory"
             Report "memory_size=${MEMORY_SIZE}"
             Report "memory_units=${MEMORY_UNITS}"
         else
-            LogText "Result: /proc/meminfo file not found on this system"
+            LogText "Result: ${ROOTDIR}proc/meminfo file not found on this system"
         fi
     fi
 #

From afba58e7433140e76736bc9dc539e8b7cb7e6756 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 10 Jul 2019 20:10:31 +0200
Subject: [PATCH 160/679] [PROC-3802] test for presence of prelink tooling

---
 include/tests_memory_processes | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/include/tests_memory_processes b/include/tests_memory_processes
index 49fbd7c4..cde405c3 100644
--- a/include/tests_memory_processes
+++ b/include/tests_memory_processes
@@ -116,6 +116,27 @@
 #
 #################################################################################
 #
+    # Test        : PROC-3802
+    # Description : Check presence of prelink tooling
+    Register --test-no PROC-3802 --weight L --network NO --category security --description "Check presence of prelink tooling"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        if PackageIsInstalled "prelink"; then
+            LogText "Result: prelink packages is installed"
+            # TODO
+            # - Add item to website with rationale
+            #ReportSuggestion "${TEST_NO}" "Disable and remove prelinking of binaries"
+            AddHP 1 3
+            Display --indent 2 --text "- Search prelink tooling" --result "${STATUS_FOUND}" --color YELLOW
+        else
+            Display --indent 2 --text "- Search prelink tooling" --result "${STATUS_NOT_FOUND}" --color GREEN
+            LogText "Result: prelink package is NOT installed"
+            AddHP 3 3
+        fi
+    fi
+#
+#################################################################################
+#
+
 
 WaitForKeyPress
 

From f40b4287eb5bf5e01e8741353a37e5ab1b69e0b3 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 10 Jul 2019 20:12:17 +0200
Subject: [PATCH 161/679] Show 'Not found' instead of 'OK'

---
 include/tests_memory_processes | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_memory_processes b/include/tests_memory_processes
index cde405c3..fc1789dc 100644
--- a/include/tests_memory_processes
+++ b/include/tests_memory_processes
@@ -80,7 +80,7 @@
         fi
         if [ -z "${FIND}" ]; then
             LogText "Result: no zombie processes found"
-            Display --indent 2 --text "- Searching for dead/zombie processes" --result "${STATUS_OK}" --color GREEN
+            Display --indent 2 --text "- Searching for dead/zombie processes" --result "${STATUS_NOT_FOUND}" --color GREEN
         else
             LogText "Result: found one or more dead or zombie processes"
             LogText "Output: PIDs ${FIND}"
@@ -104,7 +104,7 @@
         fi
         if [ -z "${FIND}" ]; then
             LogText "Result: No processes were waiting for IO requests to be handled first"
-            Display --indent 2 --text "- Searching for IO waiting processes" --result "${STATUS_OK}" --color GREEN
+            Display --indent 2 --text "- Searching for IO waiting processes" --result "${STATUS_NOT_FOUND}" --color GREEN
         else
             LogText "Result: found one or more processes which were waiting to get IO requests handled first"
             LogText "More info: processes which show up with the status flag 'D' are often stuck, until a disk IO event finished. This can happen for example with network storage, where the connection or protocol settings are not logtext well configured."

From e4498be840cb7deed7745c248fe78c0b1f9f9979 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 10 Jul 2019 20:12:43 +0200
Subject: [PATCH 162/679] Added new test: PROC-3802

---
 db/tests.db | 1 +
 1 file changed, 1 insertion(+)

diff --git a/db/tests.db b/db/tests.db
index 6be553f0..cd978c50 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -340,6 +340,7 @@ PROC-3602:test:security:memory_processes:Linux:Checking /proc/meminfo for memory
 PROC-3604:test:security:memory_processes:Solaris:Query prtconf for memory details:
 PROC-3612:test:security:memory_processes::Check dead or zombie processes:
 PROC-3614:test:security:memory_processes::Check heavy IO waiting based processes:
+PROC-3802:test:security:memory_processes::Check presence of prelink tooling:
 RBAC-6272:test:security:mac_frameworks::Check grsecurity presence:
 SCHD-7702:test:security:scheduling::Check status of cron daemon:
 SCHD-7704:test:security:scheduling::Check crontab/cronjobs:

From ce263f8cd655c9ef252ec2aa909909539890cf29 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 10 Jul 2019 20:22:31 +0200
Subject: [PATCH 163/679] Textual changes

---
 include/functions | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/include/functions b/include/functions
index f5b67fba..140e7d9d 100644
--- a/include/functions
+++ b/include/functions
@@ -254,6 +254,7 @@
     ################################################################################
     # Name        : CheckUpdates()
     # Description : Determine if there is an update available
+    #
     # Returns     : <nothing>
     # Usage       : CheckUpdates
     #               Use PROGRAM_LV (latest version) and compare it with actual version (PROGRAM_AC)
@@ -288,8 +289,9 @@
 
     ################################################################################
     # Name        : CleanUp()
-    # Description : Cleanup service
-    # Returns     : <nothing>
+    # Description : Delete PID and temporary files, stop execution (exit code 1)
+    #
+    # Usage       : this function is triggered by a manual break by user
     ################################################################################
 
     CleanUp() {
@@ -304,7 +306,8 @@
     ################################################################################
     # Name        : ContainsString()
     # Description : Search a specific string (or regular expression) in another
-    # Returns     : (0 - True, 1 - False)
+    #
+    # Returns     : True (0) or False (1)
     # Usage       : if ContainsString "needle" "there is a needle in the haystack"; echo "Found"; else "Not found"; fi
     ################################################################################
 
@@ -319,11 +322,9 @@
 
     ################################################################################
     # Name        : CountTests()
-    # Description : Count the number of tests performed
+    # Description : Counter for the number of tests performed
     #
-    # Input       : <nothing>
-    # Returns     : <nothing>
-    # Usage       : CountTests
+    # Usage       : Call CountTests to increase number by 1
     ################################################################################
 
     CountTests() {
@@ -335,7 +336,6 @@
     # Name        : CreateTempFile()
     # Description : Creates a temporary file
     #
-    # Input       : <nothing>
     # Returns     : TEMP_FILE (variable)
     # Usage       : CreateTempFile
     #               if [ ! "${TEMP_FILE}" = "" ]; then
@@ -367,7 +367,7 @@
     # Name        : DirectoryExists()
     # Description : Check if a directory exists
     #
-    # Returns     : 0 (directory exists), 1 (directory does not exist)
+    # Returns     : True (0) or False (1)
     # Usage       : if DirectoryExists; then echo "it exists"; else echo "It does not exist"; fi
     ################################################################################
 

From 21f9a18e8b4bf8441e1fb9d07bba414f97013840 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 10 Jul 2019 20:22:38 +0200
Subject: [PATCH 164/679] Updated log

---
 CHANGELOG.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 65dffde0..75a17f95 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,7 @@ measures to further tighten any possible misuse.
 - Security: additional safeguard by testing if common system tools are available
 - Security: test parameters and arguments for presence of control characters
 - Security: filtering out unexpected characters from profiles
+- Security: test if setuid bit is set on Lynis binary
 - New function: DisplayWarning - show a warning on the screen
 - New function: Equals - compare two strings
 - New function: Readonly - mark variable read-only (security)
@@ -25,14 +26,20 @@ measures to further tighten any possible misuse.
 - New profile option: disable-plugin - disables a single plugin
 - New profile option: ssl-certificate-paths-to-ignore - ignore a path
 - New test: CRYP-7930 - disk or file system encryption testing
+- New test: PROC-3802 - Check presence of prelink tooling
 - New report key: openssh_daemon_running
 
+
 ### Changed
+- Function: CheckItem - returns only exit code (ITEM_FOUND value is dropped)
 - Profiles: unused options removed
 - Profiles: message is displayed when old format "key:value" is used
 - Security: the 'nounset' (set -u) parameter is now activated by default
 - Use only locations from PATH environment variable, unless it is not defined
 - Show 'lynis generate hostids' when they are missing
+- PROC-3602 - allow different root directory
+- PROC-3612 - show 'Not found' instead of 'OK'
+- PROC-3614 - show 'Not found' instead of 'OK'
 - SSH-7402 - detect other SSH daemons like dropbear
 
 ---------------------------------------------------------------------------------

From 6e144d309b96b1aaa6a46c316463267044bd398f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 11 Jul 2019 10:55:54 +0200
Subject: [PATCH 165/679] Create SECURITY.md file

Initial version
---
 SECURITY.md | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..7f5895cd
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,27 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 3.x.x   | :white_check_mark: |
+| 2.x.x   | :white_check_mark: |
+| < 2.x   | :x:                |
+
+## Reporting a Vulnerability
+
+To report a vulnerability, use security@cisofy.com
+
+See our [security page](https://cisofy.com/security/) for more details.
+
+## Preferred language
+
+English
+
+## Acknowledgments
+
+https://cisofy.com/security/#thanks
+
+## Other
+
+See the latest 'security.txt' at https://cisofy.com/.well-known/security.txt

From 0f80fa07aa3ef9f412a3d72cda433839fe8238df Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 12 Jul 2019 13:05:43 +0200
Subject: [PATCH 166/679] New function SafeFile

---
 include/functions | 51 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/include/functions b/include/functions
index 140e7d9d..06f77c67 100644
--- a/include/functions
+++ b/include/functions
@@ -88,6 +88,7 @@
 #    ReportManual               Log manual actions to report file
 #    ReportSuggestion           Add a suggestion to report file
 #    ReportWarning              Add a warning and priority to report file
+#    SafeFile                   Security tests to perform on a file before using it
 #    SafePerms                  Check if a file has safe permissions
 #    SafeInput                  Test provided string to see if it contains unwanted characters
 #    SearchItem                 Search a string in a file
@@ -2611,6 +2612,56 @@
     }
 
 
+    ################################################################################
+    # Name        : SafeFile()
+    # Description : Check if a file is safe to use
+    #
+    ################################################################################
+
+    SafeFile() {
+        unsafe=0
+        if [ $# -ne 1 ]; then
+            ExitFatal "No argument or too many arguments provided to SafeFile()"
+        else
+            FILE="$1"
+
+            # Generic checks
+            if [ -g "${FILE}" ]; then
+                LogText "Security alert: file has setgid attribute"
+                unsafe=1
+            # sticky bit
+            elif [ -k "${FILE}" ]; then
+                LogText "Security alert: file has sticky bit"
+                unsafe=1
+            # symbolic link
+            elif [ -L "${FILE}" ]; then
+                LogText "Security alert: file is a symbolic link"
+                unsafe=1
+            elif [ -f "${FILE}" ]; then
+                LogText "Security check: file is normal"
+            else
+                unsafe=1
+            fi
+
+            # Perform additional checks based on privilege level
+            if [ ${PRIVILEGED} -eq 0 ]; then
+                # File is not owned by active user, but still able to write
+                if [ ! -O "${FILE}" -a -w "${FILE}" ]; then
+                    unsafe=1
+                    LogText "Security alert: file is not owned by active user, but can write to it"
+                fi
+            fi
+
+            # Check file permissions
+            if ! SafePerms "${FILE}"; then
+                unsafe=1
+            fi
+
+        fi
+
+        return ${unsafe}
+    }
+
 
     ################################################################################
     # Name        : SafePerms()

From b9a13893b9f1c9e61b5633763fd93e31f3a7bf66 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 12 Jul 2019 13:12:59 +0200
Subject: [PATCH 167/679] [NAME-4408] corrected Report function call

---
 include/tests_nameservices | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/tests_nameservices b/include/tests_nameservices
index 19189898..2ae503e3 100644
--- a/include/tests_nameservices
+++ b/include/tests_nameservices
@@ -644,15 +644,15 @@
         if [ "${FIND}" = "127.0.0.1" ]; then
             LogText "Result: localhost mapped to 127.0.0.1"
             Display --indent 4 --text "- Checking /etc/hosts (localhost to IP)" --result "${STATUS_OK}" --color GREEN
-            report "localhost-mapped-to=${FIND}"
+            Report "localhost-mapped-to=${FIND}"
         elif [ "${FIND}" = "::1" ]; then
             LogText "Result: localhost mapped to ::1"
             Display --indent 4 --text "- Checking /etc/hosts (localhost to IP)" --result "${STATUS_OK}" --color GREEN
-            report "localhost-mapped-to=${FIND}"
+            Report "localhost-mapped-to=${FIND}"
         elif [ "${FIND}" = "127.0.0.1::1" ]; then
             LogText "Result: localhost mapped to 127.0.0.1 and ::1"
             Display --indent 4 --text "- Checking /etc/hosts (localhost to IP)" --result "${STATUS_OK}" --color GREEN
-            report "localhost-mapped-to=${FIND}"
+            Report "localhost-mapped-to=${FIND}"
         else
             LogText "Output: ${FIND}"
             LogText "Result: this server hostname is not mapped to a local address"

From aaba4932b034177188d0974580c806f4e741138d Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 12 Jul 2019 13:13:39 +0200
Subject: [PATCH 168/679] Show name of deprecated function on screen output

---
 include/functions | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/include/functions b/include/functions
index 06f77c67..039a1a4c 100644
--- a/include/functions
+++ b/include/functions
@@ -3378,42 +3378,41 @@
     #
     ################################################################################
     # For compatibility reasons they are listed here, but will be phased out in
-    # steps. If they still get used, they will trigger an alert when using the
-    # developer mode. In a later phase they will trigger errors on screen.
+    # steps. If they still get used, they will trigger errors on screen.
     ################################################################################
 
     counttests() {
-        DisplayWarning "Deprecated function used"
+        DisplayWarning "Deprecated function used (counttests)"
         if IsDeveloperMode; then Debug "Warning: old counttests function is used. Please replace any reference with CountTests."; fi
         CountTests
     }
 
     logtext() {
-        DisplayWarning "Deprecated function used"
+        DisplayWarning "Deprecated function used (logtext)"
         if IsDeveloperMode; then Debug "Warning: old logtext function is used. Please replace any reference with LogText."; fi
         LogText "$1"
     }
 
     logtextbreak() {
-        DisplayWarning "Deprecated function used"
+        DisplayWarning "Deprecated function used (logtextbreak)"
         if IsDeveloperMode; then Debug "Warning: old logtextbreak function is used. Please replace any reference with LogTextBreak."; fi
         LogTextBreak "$1"
     }
 
     report() {
-        DisplayWarning "Deprecated function used"
+        DisplayWarning "Deprecated function used (report)"
         if IsDeveloperMode; then Debug "Warning: old report function is used. Please replace any reference with Report."; fi
         Report "$1"
     }
 
     wait_for_keypress() {
-        DisplayWarning "Deprecated function used"
+        DisplayWarning "Deprecated function used (wait_for_keypress)"
         if IsDeveloperMode; then Debug "Warning: old wait_for_keypress function is used. Please replace any reference with WaitForKeyPress."; fi
         WaitForKeyPress
     }
 
     ShowResult() {
-        DisplayWarning "Deprecated function used: ShowResult()"
+        DisplayWarning "Deprecated function used (ShowResult)"
         if IsDeveloperMode; then Debug "Warning: old ShowResult() function is used. Please replace any reference with WaitForKeyPress."; fi
     }
 

From 585ddc391edd2cba77c0f829170b9b1a51e54640 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 12 Jul 2019 13:14:41 +0200
Subject: [PATCH 169/679] More extensive file check

---
 lynis | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lynis b/lynis
index d486520a..0914f9c4 100755
--- a/lynis
+++ b/lynis
@@ -958,7 +958,7 @@ ${NORMAL}
         for INCLUDE_TEST in ${INCLUDE_TESTS}; do
             INCLUDE_FILE="${INCLUDEDIR}/tests_${INCLUDE_TEST}"
             if [ -f ${INCLUDE_FILE} ]; then
-                if SafePerms ${INCLUDE_FILE}; then
+                if SafeFile ${INCLUDE_FILE}; then
                     . ${INCLUDE_FILE}
                 else
                     LogText "Exception: skipping test category ${INCLUDE_TEST}, file ${INCLUDE_FILE} has bad permissions (should be 640, 600 or 400)"

From 7506fd4af8bc83d743cfc0894a814bdce4c07cc1 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 12 Jul 2019 13:25:29 +0200
Subject: [PATCH 170/679] Adjusted text and use 'audit system' instead of
 deprecated -c option

---
 extras/systemd/lynis.service | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/extras/systemd/lynis.service b/extras/systemd/lynis.service
index 7ecc36ad..c49fdf12 100644
--- a/extras/systemd/lynis.service
+++ b/extras/systemd/lynis.service
@@ -5,7 +5,8 @@
 #################################################################################
 #
 # - Adjust path to link to location where Lynis binary is installed
-# - Place this file together with the timer file in systemd directory
+# - Place this file and the timer file together in the systemd directory
+#   (e.g. /etc/systemd/system/)
 # - Run: systemctl enable lynis.service
 #
 #################################################################################
@@ -18,6 +19,6 @@ Nice=19
 IOSchedulingClass=best-effort
 IOSchedulingPriority=7
 Type=simple
-ExecStart=/path/to/lynis -c --cronjob
+ExecStart=/path/to/lynis audit system --cronjob
 
 #EOF

From c31c6a5a9eb6d4a197b3774de2fe95b50e7928d3 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 12 Jul 2019 14:20:32 +0200
Subject: [PATCH 171/679] Add timing measurement of individual tests and report
 them

---
 include/consts    |  3 +++
 include/functions | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+)

diff --git a/include/consts b/include/consts
index a03f2708..67a18733 100644
--- a/include/consts
+++ b/include/consts
@@ -86,6 +86,7 @@ unset LANG
     CONTAINER_TYPE=""
     CREATE_REPORT_FILE=1
     CSUMBINARY=""
+    CURRENT_TS=0
     CUSTOM_URL_APPEND=""
     CUSTOM_URL_PREPEND=""
     CUSTOM_URL_PROTOCOL=""
@@ -216,6 +217,8 @@ unset LANG
     PLUGIN_PHASE=0
     POSTFIXBINARY=""
     POSTGRES_RUNNING=0
+    PREVIOUS_TEST="No test ID"
+    PREVIOUS_TS=0
     PRIVILEGED=0
     PROFILES=""
     PROFILEVALUE=""
diff --git a/include/functions b/include/functions
index 039a1a4c..16cef804 100644
--- a/include/functions
+++ b/include/functions
@@ -2187,6 +2187,19 @@
     # Returns     : SKIPTEST (0 or 1)
     ################################################################################
 
+    GetTimestamp() {
+        ts=0
+        case "${OS}" in
+            "Linux")
+                ts=$(date "+%s%N")
+            ;;
+            *)
+                ts=$(date "+%s")
+            ;;
+        esac
+        echo $ts
+    }
+
     Register() {
         # Do not insert a log break, if previous test was not logged
         if [ ${SKIPLOGTEST} -eq 0 ]; then LogTextBreak; fi
@@ -2254,6 +2267,35 @@
             shift
         done
 
+        # Measure timing
+        CURRENT_TS=$(GetTimestamp)
+        if [ ${PREVIOUS_TS} -gt 0 ]; then
+            SLOW_TEST=0
+            TIME_THRESHOLD=10  # seconds
+
+            # Calculate timing and determine if we use seconds or nanoseconds (more precise)
+            TIME_DIFF=$((${CURRENT_TS} - ${PREVIOUS_TS}))
+            if [ ${CURRENT_TS} -gt 1000000000000000000 ]; then
+                TIME_DIFF_FORMAT="nanoseconds"
+                TIME_THRESHOLD=$((${TIME_THRESHOLD} * 1000000000))
+                if [ ${TIME_DIFF} -gt ${TIME_THRESHOLD} ]; then
+                    SLOW_TEST=1
+                    # Convert back to seconds for readability
+                    TIME_DIFF_FORMAT="seconds"
+                    TIME_DIFF=$(echo ${TIME_DIFF} | ${AWKBINARY} '{printf "%f",$1/1000000000}')
+                fi
+            else
+                TIME_DIFF_FORMAT="seconds"
+                if [ ${TIME_DIFF} -gt ${TIME_THRESHOLD} ]; then
+                    SLOW_TEST=1
+                fi
+            fi
+            if [ ${SLOW_TEST} -eq 1 ]; then
+                DisplayWarning "Test ${PREVIOUS_TEST} had a long execution: ${TIME_DIFF} ${TIME_DIFF_FORMAT}"
+                Report "slow_test[]=${PREVIOUS_TEST},${TIME_DIFF}"
+            fi
+        fi
+
         # Skip test if it's configured in profile (old style)
         if [ ${SKIPTEST} -eq 0 ]; then
             FIND=$(echo "${TEST_SKIP_ALWAYS}" | grep "${TEST_NO}" | tr '[:lower:]' '[:upper:]')
@@ -2326,6 +2368,10 @@
             TESTS_SKIPPED="${TEST_NO}|${TESTS_SKIPPED}"
         fi
         unset SKIPREASON
+
+        # Save timestamp for next time the Register function is called
+        PREVIOUS_TEST="${TEST_NO}"
+        PREVIOUS_TS="${CURRENT_TS}"
     }
 
 

From 76e84f4b566531dce3bc1ff9bce7722718df2df3 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 12 Jul 2019 14:38:52 +0200
Subject: [PATCH 172/679] Run non-interactive by default, use --wait to enforce
 waiting after finishing a group of tests

---
 default.prf        |  4 ++--
 developer.prf      |  1 -
 include/parameters | 14 +++++++++++---
 include/profiles   |  6 +++---
 4 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/default.prf b/default.prf
index befd40d0..1431beb6 100644
--- a/default.prf
+++ b/default.prf
@@ -67,8 +67,8 @@ profile-name=Default Audit Template
 # Number of seconds to pause between every test (0 is no pause)
 pause-between-tests=0
 
-# Quick mode (no waiting for keypresses)
-quick=no
+# Quick mode (do not wait for keypresses)
+quick=yes
 
 # Refresh software repositories to help detecting vulnerable packages
 refresh-repositories=yes
diff --git a/developer.prf b/developer.prf
index 856596a8..624e06e6 100644
--- a/developer.prf
+++ b/developer.prf
@@ -3,6 +3,5 @@
 
 debug=yes
 developer-mode=yes
-quick=yes
 strict=yes
 verbose=yes
diff --git a/include/parameters b/include/parameters
index 0798224e..001044a5 100644
--- a/include/parameters
+++ b/include/parameters
@@ -233,7 +233,7 @@
             # Cronjob support
             --cron-job | --cronjob | --cron)
                 CRONJOB=1
-                CHECK=1; QUICKMODE=1; COLORS=0; NEVERBREAK=1 # Use some defaults (-c, -Q, no colors)
+                CHECK=1; COLORS=0; NEVERBREAK=1 # Use some defaults ('audit system', -Q, no colors)
                 RemoveColors
             ;;
 
@@ -345,7 +345,6 @@
             # Quiet mode
             --quiet | -q | --silent)
                 QUIET=1
-                QUICKMODE=1 # Run non-interactive
             ;;
 
             # Non-interactive mode
@@ -444,7 +443,6 @@
             # Warnings
             --warnings-only | --show-warnings-only)
                 SHOW_WARNINGS_ONLY=1
-                QUICKMODE=1
                 QUIET=1
             ;;
 
@@ -465,5 +463,15 @@
 
     done
 
+    # Ensure non-interactive mode when running quietly or as cronjob
+    if [ ${CRONJOB} -eq 1 -o ${QUIET} -eq 1 ]; then
+        if [ ${QUICKMODE} -eq 0 ]; then
+            if [ ${QUIET} -eq 0 ]; then
+                echo "Switched back to quick mode (cron/non-interactive/quiet)"
+            fi
+            QUICKMODE=1
+        fi
+    fi
+
 #================================================================================
 # Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com
diff --git a/include/profiles b/include/profiles
index a2d36bb4..f8935ece 100644
--- a/include/profiles
+++ b/include/profiles
@@ -290,9 +290,9 @@
 
                 # Quick (no waiting for keypresses)
                 quick)
-                    # Quick mode (SKIP_PLUGINS) might already be set outside profile, so store in different variable
-                    SETTING_QUICK_MODE=0 # default is no
-                    FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && QUICKMODE=1
+                    # Quick mode might already be set outside profile, so store in different variable
+                    SETTING_QUICK_MODE=1 # default is yes
+                    FIND=$(echo "${VALUE}" | egrep "^(0|false|no)$") && QUICKMODE=0
                     if [ ! -z "${FIND}" ]; then SETTING_QUICK_MODE=1; fi
                     Debug "Quickmode set to ${SETTING_QUICK_MODE}"
                     AddSetting "quick" "${SETTING_QUICK_MODE}" "Quick mode (non-interactive)"

From f8e9c7bd91bfe8b20c7bb16d6f256a9ec35456ba Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 12 Jul 2019 14:39:05 +0200
Subject: [PATCH 173/679] Updated log

---
 CHANGELOG.md | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 75a17f95..1f36522a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,8 +7,9 @@ Some of these changes may break your current usage of the tool, so test before
 deployment!
 
 Breaking changes:
-- Some commands or switches are removed
-- Format of profile options changed (from key:value to key=value)
+- Some commands or switches are deprecated or removed
+- Format of all profile options converted (from key:value to key=value)
+- Non-interactive by default (use --wait option to pause between groups of tests)
 
 An important focus area for this release is on security. We added several
 measures to further tighten any possible misuse.
@@ -22,13 +23,14 @@ measures to further tighten any possible misuse.
 - New function: DisplayWarning - show a warning on the screen
 - New function: Equals - compare two strings
 - New function: Readonly - mark variable read-only (security)
+- New function: SafeFile - test file type and call permission check
 - New function: SafeInput - check for safe input (security)
 - New profile option: disable-plugin - disables a single plugin
 - New profile option: ssl-certificate-paths-to-ignore - ignore a path
 - New test: CRYP-7930 - disk or file system encryption testing
 - New test: PROC-3802 - Check presence of prelink tooling
 - New report key: openssh_daemon_running
-
+- Measure timing of tests and report slow tests (10+ seconds)
 
 ### Changed
 - Function: CheckItem - returns only exit code (ITEM_FOUND value is dropped)
@@ -37,10 +39,12 @@ measures to further tighten any possible misuse.
 - Security: the 'nounset' (set -u) parameter is now activated by default
 - Use only locations from PATH environment variable, unless it is not defined
 - Show 'lynis generate hostids' when they are missing
+- NAME-4408 - corrected Report function call
 - PROC-3602 - allow different root directory
 - PROC-3612 - show 'Not found' instead of 'OK'
 - PROC-3614 - show 'Not found' instead of 'OK'
 - SSH-7402 - detect other SSH daemons like dropbear
+- systemd service file adjusted
 
 ---------------------------------------------------------------------------------
 

From 2dcf816e867aed02ab113a5301e20aa05f01992c Mon Sep 17 00:00:00 2001
From: David <2069735+Marzal@users.noreply.github.com>
Date: Sat, 13 Jul 2019 12:41:10 +0200
Subject: [PATCH 174/679] Prepend sed to discard '## ' in CHANGELOG.md

Since version 2.6.6 CHANGELOG.md has markdown formatting. This breaks the show changelog command.
This is a workaound to "fix" the issue without changing all the versions in CHANGELOG.md
---
 include/helper_show | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/helper_show b/include/helper_show
index 874b3e1b..0ef6af82 100644
--- a/include/helper_show
+++ b/include/helper_show
@@ -160,15 +160,15 @@ if [ $# -gt 0 ]; then
                 if [ ! -z "${CHANGELOG}" ]; then LogText "Result: found changelog file: ${CHANGELOG}"; break; fi
             done
             if [ ! -z "${CHANGELOG}" ]; then
-                SEARCH=$(egrep "^${PROGRAM_NAME} ${SEARCH_VERSION}" ${CHANGELOG})
+                SEARCH=$(sed 's/^## //' ${CHANGELOG} | grep -E "^${PROGRAM_NAME} ${SEARCH_VERSION}")
                 if [ $? -eq 0 ]; then
                     while read -r LINE; do
                         if [ ${STARTED} -eq 0 ]; then
-                            SEARCH=$(echo ${LINE} | egrep "^${PROGRAM_NAME} ${SEARCH_VERSION}")
+                            SEARCH=$(echo ${LINE} | sed 's/^## //' | grep -E "^${PROGRAM_NAME} ${SEARCH_VERSION}")
                             if [ $? -eq 0 ]; then STARTED=1; ${ECHOCMD} "${BOLD}${LINE}${NORMAL}"; fi
                         else
                             # Stop if we find the next Lynis version
-                            SEARCH=$(echo ${LINE} | egrep "^${PROGRAM_NAME} [0-9]\.[0-9]\.[0-9]")
+                            SEARCH=$(echo ${LINE} | sed 's/^## //' | grep -E "^${PROGRAM_NAME} [0-9]\.[0-9]\.[0-9]")
                             if [ $? -eq 0 ]; then
                                 break
                             else
@@ -183,7 +183,7 @@ if [ $# -gt 0 ]; then
                     ${ECHOCMD} "$0 lynis show changelog [version]"
                     ${ECHOCMD} ""
                     ${ECHOCMD} "${HEADER}${PROGRAM_NAME} versions:${NORMAL}"
-                    SEARCH=$(egrep "^Lynis [0-9]\.[0-9]\.[0-9] " ${CHANGELOG} | awk '{print $2}' | sort -n)
+                    SEARCH=$(sed 's/^## //' ${CHANGELOG} | grep -E "^Lynis [0-9]\.[0-9]\.[0-9] " | awk '{print $2}' | sort -n)
                     ${ECHOCMD} ${SEARCH}
                     ExitFatal
                 fi

From 63a66a971cbf2ef98453ac77aacb27269132b10b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 13 Jul 2019 15:49:04 +0200
Subject: [PATCH 175/679] Extended completion script with show commands

---
 extras/bash_completion.d/lynis | 124 +++++++++++++++++++++++++++++++--
 1 file changed, 117 insertions(+), 7 deletions(-)

diff --git a/extras/bash_completion.d/lynis b/extras/bash_completion.d/lynis
index 235a848a..8732ede3 100644
--- a/extras/bash_completion.d/lynis
+++ b/extras/bash_completion.d/lynis
@@ -1,6 +1,6 @@
 # bash completion for lynis
 
-# version 1.0.0 (22 September 2014)
+# version 1.0.1 (2019-07-13)
 # Michael Boelen <michael.boelen@cisofy.com>
 
 # lynis(8) completion
@@ -10,7 +10,7 @@ _lynis()
     # opts nodig nosig
 
     COMPREPLY=()
-    _get_comp_words_by_ref cur prev
+    _get_comp_words_by_ref cur prev words
 
     if [ $COMP_CWORD -eq 1 ]; then
         # first parameter on line
@@ -19,24 +19,134 @@ _lynis()
                 COMPREPLY=( $( compgen -W '--help --info --version' -- "$cur" ) )
                 ;;
             *)
-                COMPREPLY=( $( compgen -W 'audit --help --info --version' -- "$cur" ) )
+                COMPREPLY=( $( compgen -W 'audit generate show' -- "$cur" ) )
                 ;;
         esac
-
-    return 0
+        return 0
+    elif [ $COMP_CWORD -eq 4 ]; then
+        # Stop after some specifics
+        if [ "${COMP_WORDS[1]}" = "show" -a "${COMP_WORDS[2]}" = "details" ]; then
+            return 0
+        fi
     fi
 
+    # Check previous argument to share the available options
     case $prev in
         audit)
             COMPREPLY=( $( compgen -W 'dockerfile system ' -- "$cur" ) )
             ;;
+
         show)
-            COMPREPLY=( $( compgen -W 'help version ' -- "$cur" ) )
+            COMPREPLY=( $( compgen -W 'categories changelog commands dbdir details environment eol groups help hostids includedir language license logfile man options os pidfile plugindir profiles release releasedate report settings tests  version workdir ' -- "$cur" ) )
             ;;
 
+        # Related items to show (lynis show XYZ)
+        categories)
+            return 0
+            ;;
+        changelog)
+            return 0
+            ;;
+        commands)
+            return 0
+            ;;
+        dbdir)
+            return 0
+            ;;
+        details)
+            local dbfile=""
+            local dirs="/data/development/lynis /usr/local/lynis /usr/share/lynis"
+            for d in ${dirs}; do
+                if [ -f "${d}/db/tests.db" ]; then
+                    local dbfile="/data/development/lynis/db/tests.db"
+                fi
+            done
+            if [ -f "${dbfile}" ]; then
+                local suggestions=($(compgen -W "$(awk -F: '$1 ~ /^[A-Z]/ {print $1}' ${dbfile})" -- "${cur}"))
+                COMPREPLY=("${suggestions[@]}")
+            else
+                COMPREPLY=($(compgen -W "TEST-1234" -- "$cur"))
+            fi
+            ;;
+        environment)
+            return 0
+            ;;
+        eol)
+            return 0
+            ;;
+        groups)
+            return 0
+            ;;
+        help)
+            return 0
+            ;;
+        hostids)
+            if [ "${COMP_WORDS[1]}" = "generate" -a "${COMP_WORDS[2]}" = "hostids" ]; then
+                COMPREPLY=($(compgen -W "save" -- "$cur"))
+            else
+                return 0
+            fi
+            ;;
+        includedir)
+            return 0
+            ;;
+        language)
+            return 0
+            ;;
+        license)
+            return 0
+            ;;
+        logfile)
+            return 0
+            ;;
+        man)
+            return 0
+            ;;
+        options)
+            return 0
+            ;;
+        os)
+            return 0
+            ;;
+        pidfile)
+            return 0
+            ;;
+        plugindir)
+            return 0
+            ;;
+        profiles)
+            return 0
+            ;;
+        release)
+            return 0
+            ;;
+        releasedate)
+            return 0
+            ;;
+        report)
+            return 0
+            ;;
+        settiings)
+            return 0
+            ;;
+        tests)
+            return 0
+            ;;
+        version)
+            return 0
+            ;;
+        workdir)
+            return 0
+            ;;
+
+        generate)
+            COMPREPLY=( $( compgen -W 'hostids ' -- "$cur" ) )
+            ;;
+
+        # Options
         --auditor)
             COMPREPLY=( '"Mr. Auditor"' )
-            return 0
+            #return 0
             ;;
         --check-update|--help|--info|--version)
             # all other options are noop with this command

From 9f7e0775a57781ae6e7a247e71a149f25ef7a02d Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 13 Jul 2019 20:03:30 +0200
Subject: [PATCH 176/679] New command: lynis generate systemd-units

---
 include/helper_generate | 89 ++++++++++++++++++++++++++++++++++++++++-
 include/helper_show     |  3 ++
 2 files changed, 91 insertions(+), 1 deletion(-)

diff --git a/include/helper_generate b/include/helper_generate
index bdcfb44d..8641be2d 100644
--- a/include/helper_generate
+++ b/include/helper_generate
@@ -29,7 +29,7 @@
 ######################################################################
 
 SAVEFILE=0
-GENERATE_ARGS="hostids"
+GENERATE_ARGS="hostids systemd-units"
 
 if [ $# -gt 0 ]; then
     case $1 in
@@ -71,6 +71,93 @@ if [ $# -gt 0 ]; then
 
             ExitClean
             ;;
+
+        "cronjob")
+            ${ECHOCMD} "Not implemented yet"
+            ;;
+
+        "systemd-units")
+
+            ${ECHOCMD} ""
+
+            ${ECHOCMD} "${BG_BLUE}Step 1: create service unit (/etc/systemd/system/lynis.service)${NORMAL}"
+
+            ${ECHOCMD} ""
+            ${ECHOCMD} "#################################################################################"
+            ${ECHOCMD} "#"
+            ${ECHOCMD} "# Lynis service file for systemd"
+            ${ECHOCMD} "#"
+            ${ECHOCMD} "#################################################################################"
+            ${ECHOCMD} ""
+            ${ECHOCMD} "[Unit]"
+            ${ECHOCMD} "Description=Security audit and vulnerability scanner"
+            ${ECHOCMD} "Documentation=https://cisofy.com/docs/"
+            ${ECHOCMD} ""
+            ${ECHOCMD} "[Service]"
+            ${ECHOCMD} "Nice=19"
+            ${ECHOCMD} "IOSchedulingClass=best-effort"
+            ${ECHOCMD} "IOSchedulingPriority=7"
+            ${ECHOCMD} "Type=simple"
+            MYBINARY=$(which lynis 2>/dev/null)
+            MOREOPTIONS=""
+            if [ -n "${LICENSE_KEY}" ]; then
+                MOREOPTIONS=" --upload"
+            fi
+            ${ECHOCMD} "ExecStart=${MYBINARY:-/path/to/lynis} audit system --cronjob${MOREOPTIONS}"
+            ${ECHOCMD} ""
+            ${ECHOCMD} "[Install]"
+            ${ECHOCMD} "WantedBy=multi-user.target"
+            ${ECHOCMD} ""
+            ${ECHOCMD} "#################################################################################"
+            ${ECHOCMD} ""
+            ${ECHOCMD} ""
+
+            ${ECHOCMD} "${BG_BLUE}Step 2: create timer unit (/etc/systemd/system/lynis.timer)${NORMAL}"
+            ${ECHOCMD} ""
+
+            ${ECHOCMD} "#################################################################################"
+            ${ECHOCMD} "#"
+            ${ECHOCMD} "# Lynis timer file for systemd"
+            ${ECHOCMD} "#"
+            ${ECHOCMD} "#################################################################################"
+            ${ECHOCMD} "# Do not remove, so Lynis can provide advice if a newer unit is available"
+            ${ECHOCMD} "# Generator=lynis"
+            ${ECHOCMD} "# Version=1"
+            ${ECHOCMD} "#################################################################################"
+            ${ECHOCMD} ""
+            ${ECHOCMD} "[Unit]"
+            ${ECHOCMD} "Description=Daily timer for the Lynis security audit and vulnerability scanner"
+            ${ECHOCMD} ""
+            ${ECHOCMD} "[Timer]"
+            ${ECHOCMD} "OnCalendar=daily"
+            ${ECHOCMD} "RandomizedDelaySec=1800"
+            ${ECHOCMD} "Persistent=false"
+            ${ECHOCMD} ""
+            ${ECHOCMD} "[Install]"
+            ${ECHOCMD} "WantedBy=timers.target"
+            ${ECHOCMD} ""
+            ${ECHOCMD} "#################################################################################"
+            ${ECHOCMD} ""
+            ${ECHOCMD} ""
+
+            ${ECHOCMD} "${BG_BLUE}Step 3 - Enable the timer${NORMAL}"
+
+            ${ECHOCMD} ""
+            ${ECHOCMD} "Tell systemd you made changes: systemctl daemon-reload"
+            ${ECHOCMD} ""
+            ${ECHOCMD} "Enable and start the timer (so no reboot is needed): systemctl enable --now lynis.timer"
+            ${ECHOCMD} ""
+            ${ECHOCMD} ""
+            ${ECHOCMD} "${BG_BLUE}Optional - Customize${NORMAL}"
+            ${ECHOCMD} ""
+            ${ECHOCMD} "Want to override the timer? Run: systemctl edit lynis.timer"
+            ${ECHOCMD} "Note: set the timer by first resetting it, then set the preferred value"
+            ${ECHOCMD} ""
+            ${ECHOCMD} "[Timer]"
+            ${ECHOCMD} "OnCalendar="
+            ${ECHOCMD} "OnCalendar=*-*-* 03:00:00"
+            ${ECHOCMD} ""
+            ;;
         *)                      ${ECHOCMD} "Unknown argument '${RED}$1${NORMAL}' for lynis generate" ;;
     esac
 else
diff --git a/include/helper_show b/include/helper_show
index 874b3e1b..cd7d9a73 100644
--- a/include/helper_show
+++ b/include/helper_show
@@ -102,6 +102,9 @@ GENERATE_HELP="
   Generate and save values
   ${WHITE}lynis generate hostids --save${NORMAL}
 
+  Generate systemd units to run Lynis on a schedule (e.g. daily)
+  ${WHITE}lynis generate systemd-units${NORMAL}
+
 "
 
 

From 67eae302e1a7b1bf665d46f0e15b612a10b40626 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 13 Jul 2019 20:03:53 +0200
Subject: [PATCH 177/679] Updated systemd units

---
 extras/systemd/lynis.service | 14 ++++++++++----
 extras/systemd/lynis.timer   | 14 ++++++++++----
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/extras/systemd/lynis.service b/extras/systemd/lynis.service
index c49fdf12..21432c22 100644
--- a/extras/systemd/lynis.service
+++ b/extras/systemd/lynis.service
@@ -5,14 +5,17 @@
 #################################################################################
 #
 # - Adjust path to link to location where Lynis binary is installed
-# - Place this file and the timer file together in the systemd directory
-#   (e.g. /etc/systemd/system/)
-# - Run: systemctl enable lynis.service
+#
+# - Place this file together with the lynis.timer file in the related
+#   systemd directory (e.g. /etc/systemd/system/)
+#
+# - See details in lynis.timer file
 #
 #################################################################################
 
 [Unit]
-Description=Lynis security audit and vulnerability scan
+Description=Security audit and vulnerability scanner
+Documentation=https://cisofy.com/docs/
 
 [Service]
 Nice=19
@@ -21,4 +24,7 @@ IOSchedulingPriority=7
 Type=simple
 ExecStart=/path/to/lynis audit system --cronjob
 
+[Install]
+WantedBy=multi-user.target
+
 #EOF
diff --git a/extras/systemd/lynis.timer b/extras/systemd/lynis.timer
index 169b3c17..83f5c144 100644
--- a/extras/systemd/lynis.timer
+++ b/extras/systemd/lynis.timer
@@ -4,17 +4,23 @@
 #
 #################################################################################
 #
-# - Place this file together with the service file in systemd directory
-# - Run: systemctl enable lynis.timer
-#        systemctl start lynis.service
+# - Place this file together with the lynis.service file in the related
+#   systemd directory (e.g. /etc/systemd/system)
+#
+# - Tell systemd you made changes
+#   systemctl daemon-reload
+#
+# - Enable and start the timer (so no reboot is needed):
+#   systemctl enable --now lynis.timer
 #
 #################################################################################
 
 [Unit]
-Description=Daily run for Lynis security audit and vulnerability scan
+Description=Daily timer for the Lynis security audit and vulnerability scanner
 
 [Timer]
 OnCalendar=daily
+RandomizedDelaySec=1800
 Persistent=false
 
 [Install]

From 960011967750365144ab6c1de15cae3160bb86fd Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 13 Jul 2019 20:04:36 +0200
Subject: [PATCH 178/679] Updated log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1f36522a..6b9e9d8e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -30,6 +30,7 @@ measures to further tighten any possible misuse.
 - New test: CRYP-7930 - disk or file system encryption testing
 - New test: PROC-3802 - Check presence of prelink tooling
 - New report key: openssh_daemon_running
+- New command: lynis generate systemd-units
 - Measure timing of tests and report slow tests (10+ seconds)
 
 ### Changed
@@ -45,6 +46,7 @@ measures to further tighten any possible misuse.
 - PROC-3614 - show 'Not found' instead of 'OK'
 - SSH-7402 - detect other SSH daemons like dropbear
 - systemd service file adjusted
+- bash completion script extended
 
 ---------------------------------------------------------------------------------
 

From 3c076fd8debeb3c58f6ce87ef1677580688e0ea1 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 13 Jul 2019 20:09:32 +0200
Subject: [PATCH 179/679] Updated log

---
 CHANGELOG.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6b9e9d8e..d6894fc1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,11 +6,12 @@ This is a major release of Lynis and includes several big changes.
 Some of these changes may break your current usage of the tool, so test before
 deployment!
 
-Breaking changes:
+### Breaking changes
 - Some commands or switches are deprecated or removed
 - Format of all profile options converted (from key:value to key=value)
 - Non-interactive by default (use --wait option to pause between groups of tests)
 
+### Security
 An important focus area for this release is on security. We added several
 measures to further tighten any possible misuse.
 
@@ -45,6 +46,7 @@ measures to further tighten any possible misuse.
 - PROC-3612 - show 'Not found' instead of 'OK'
 - PROC-3614 - show 'Not found' instead of 'OK'
 - SSH-7402 - detect other SSH daemons like dropbear
+- Whow changelog works again for newer versions
 - systemd service file adjusted
 - bash completion script extended
 

From 96b9fc33e49a42efd2f25e1bccb880e51c67c143 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 13 Jul 2019 20:12:38 +0200
Subject: [PATCH 180/679] Add generator/version for future

---
 include/helper_generate | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/include/helper_generate b/include/helper_generate
index 8641be2d..31dba7ec 100644
--- a/include/helper_generate
+++ b/include/helper_generate
@@ -88,6 +88,10 @@ if [ $# -gt 0 ]; then
             ${ECHOCMD} "# Lynis service file for systemd"
             ${ECHOCMD} "#"
             ${ECHOCMD} "#################################################################################"
+            ${ECHOCMD} "# Do not remove, so Lynis can provide a hint when a newer unit is available"
+            ${ECHOCMD} "# Generator=lynis"
+            ${ECHOCMD} "# Version=1"
+            ${ECHOCMD} "#################################################################################"
             ${ECHOCMD} ""
             ${ECHOCMD} "[Unit]"
             ${ECHOCMD} "Description=Security audit and vulnerability scanner"
@@ -120,7 +124,7 @@ if [ $# -gt 0 ]; then
             ${ECHOCMD} "# Lynis timer file for systemd"
             ${ECHOCMD} "#"
             ${ECHOCMD} "#################################################################################"
-            ${ECHOCMD} "# Do not remove, so Lynis can provide advice if a newer unit is available"
+            ${ECHOCMD} "# Do not remove, so Lynis can provide a hint when a newer unit is available"
             ${ECHOCMD} "# Generator=lynis"
             ${ECHOCMD} "# Version=1"
             ${ECHOCMD} "#################################################################################"

From 82b1c63341620741bc940996d9dd5bf8847dca5a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 08:28:49 +0200
Subject: [PATCH 181/679] [NETW-3032] small rewrite of test and extended with
 addrwatch

---
 include/tests_networking | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/include/tests_networking b/include/tests_networking
index b43970ce..8c895c4e 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -610,24 +610,28 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
 
+        # addrwatch
+        if IsRunning "addrwatch"; then
+            FOUND=1
+        fi
+
         # arpwatch
-        IsRunning arpwatch
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "arpwatch"; then
             FOUND=1
             ARPWATCH_RUNNING=1
-            Display --indent 2 --text "- Checking for ARP monitoring software" --result "${STATUS_RUNNING}" --color GREEN
         fi
 
         # arpon
-        IsRunning arpon
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "arpon"; then
             FOUND=1
             ARPON_RUNNING=1
-            Display --indent 2 --text "- Checking for ARP monitoring software" --result "${STATUS_RUNNING}" --color GREEN
         fi
-        if [ ${FOUND} -eq 0 ]; then
+
+        if [ ${FOUND} -eq 1 ]; then
+            Display --indent 2 --text "- Checking for ARP monitoring software" --result "${STATUS_RUNNING}" --color GREEN
+        else
             Display --indent 2 --text "- Checking for ARP monitoring software" --result "${STATUS_NOT_FOUND}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Consider running ARP monitoring software (arpwatch,arpon)"
+            ReportSuggestion "${TEST_NO}" "Consider running ARP monitoring software (addrwatch,arpwatch,arpon)"
         fi
     fi
 #

From f588e3af4e52bea2509d6caf531024d305f68b5e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 08:28:58 +0200
Subject: [PATCH 182/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d6894fc1..2d4d7ad8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -42,6 +42,7 @@ measures to further tighten any possible misuse.
 - Use only locations from PATH environment variable, unless it is not defined
 - Show 'lynis generate hostids' when they are missing
 - NAME-4408 - corrected Report function call
+- NETW-3032 - small rewrite of test and extended with addrwatch
 - PROC-3602 - allow different root directory
 - PROC-3612 - show 'Not found' instead of 'OK'
 - PROC-3614 - show 'Not found' instead of 'OK'

From 1a512984c152f0ff0a45fe1f40884fd91c865293 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 08:43:06 +0200
Subject: [PATCH 183/679] [SSH-7406] instead of just carriage return, strip all
 control characters

---
 include/tests_ssh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_ssh b/include/tests_ssh
index 852e2db5..dde395e3 100644
--- a/include/tests_ssh
+++ b/include/tests_ssh
@@ -102,7 +102,7 @@
     if [ ${OPENSSHD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SSH-7406 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determine OpenSSH version"
     if [ ${SKIPTEST} -eq 0 ]; then
-        OPENSSHD_VERSION=$(${SSHDBINARY} -t -d 2>&1 | ${GREPBINARY} 'sshd version' | ${AWKBINARY} '{if($4~OpenSSH_){print $4}}' | ${AWKBINARY} -F_ '{print $2}' | ${TRBINARY} -d ',' | ${TRBINARY} -d '\r')
+        OPENSSHD_VERSION=$(${SSHDBINARY} -t -d 2>&1 | ${GREPBINARY} 'sshd version' | ${AWKBINARY} '{if($4~OpenSSH_){print $4}}' | ${AWKBINARY} -F_ '{print $2}' | ${TRBINARY} -d '[:cntrl:],')
         LogText "Result: discovered OpenSSH version is ${OPENSSHD_VERSION}"
         if [ ! -z ${OPENSSHD_VERSION} ]; then
             OPENSSHD_VERSION_MAJOR=$(echo ${OPENSSHD_VERSION%%p*} | ${AWKBINARY} -F. '{print $1}')

From 6b21bead532e3e4eb964c521428a90d352b6d69b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 08:43:13 +0200
Subject: [PATCH 184/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2d4d7ad8..1430528e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -47,6 +47,7 @@ measures to further tighten any possible misuse.
 - PROC-3612 - show 'Not found' instead of 'OK'
 - PROC-3614 - show 'Not found' instead of 'OK'
 - SSH-7402 - detect other SSH daemons like dropbear
+- SSH-7406 - strip OpenSSH patch version and remove characters (carriage return)
 - Whow changelog works again for newer versions
 - systemd service file adjusted
 - bash completion script extended

From 65e288b3c70397b3061d94f8350b0a8254377383 Mon Sep 17 00:00:00 2001
From: David <2069735+Marzal@users.noreply.github.com>
Date: Sun, 14 Jul 2019 11:46:25 +0200
Subject: [PATCH 185/679] Fix typo in changelog

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1430528e..17c5492b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -48,7 +48,7 @@ measures to further tighten any possible misuse.
 - PROC-3614 - show 'Not found' instead of 'OK'
 - SSH-7402 - detect other SSH daemons like dropbear
 - SSH-7406 - strip OpenSSH patch version and remove characters (carriage return)
-- Whow changelog works again for newer versions
+- Show changelog works again for newer versions
 - systemd service file adjusted
 - bash completion script extended
 

From 26fca99c40f6aeaca7a5e38db61fc197383d6b36 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 11:49:14 +0200
Subject: [PATCH 186/679] Textual changes

---
 include/functions | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/include/functions b/include/functions
index 16cef804..794abcc4 100644
--- a/include/functions
+++ b/include/functions
@@ -2742,9 +2742,8 @@
                 fi
                 # Check file permissions
                 if [ ! -f "$1" ]; then
-                    LogText "Fatal error: file $1 does not exist. Quitting."
-                    echo "Fatal error: file $1 does not exist"
-                    ExitFatal
+                    LogText "Fatal error: file $1 does not exist."
+                    ExitFatal "Fatal error: file $1 does not exist"
                 else
                     PERMS=$(ls -l $1)
 
@@ -2771,21 +2770,22 @@
                     # Owner permissions
                     OWNER_PERMS=$(echo ${PERMS} | cut -c2-4)
                     if [ ! "${OWNER_PERMS}" = "rw-" -a ! "${OWNER_PERMS}" = "r--" ]; then
-                        echo "Fatal error: permissions of file $1 are not strict enough. Access to 'owner' should be read-write, or read. Change with: chmod 600 $1"
+                        echo "Fatal error: permissions of file $1 are not strict enough. Access to 'owner' should be read-write, or read. Change with: chmod u=rw $1"
                         ExitFatal
                     fi
 
-                    # Owner permissions
+                    # Group permissions
+                    # TODO - harden this even more by setting default to read-only for group (like 'other')
                     GROUP_PERMS=$(echo ${PERMS} | cut -c5-7)
                     if [ ! "${GROUP_PERMS}" = "rw-" -a ! "${GROUP_PERMS}" = "r--" -a ! "${GROUP_PERMS}" = "---" ]; then
-                        echo "Fatal error: permissions of file $1 are not strict enough. Access to 'group' should be read-write, read, or none. Change with: chmod 600 $1"
+                        echo "Fatal error: permissions of file $1 are not strict enough. Access to 'group' should be read-write, read, or none. Change with: chmod g=r $1"
                         ExitFatal
                     fi
 
                     # Other permissions
                     OTHER_PERMS=$(echo ${PERMS} | cut -c8-10)
                     if [ ! "${OTHER_PERMS}" = "---" -a ! "${OTHER_PERMS}" = "r--" ]; then
-                        echo "Fatal error: permissions of file $1 are not strict enough. Access to 'other' should be denied or read-only. Change with: chmod 600 $1"
+                        echo "Fatal error: permissions of file $1 are not strict enough. Access to 'other' should be denied or read-only. Change with: chmod o=r $1"
                         ExitFatal
                     fi
                     # Set PERMS_OK to 1 if no fatal errors occurred

From 34f306eb0bc5502535ca85f5700fa083ab6c9443 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 11:50:02 +0200
Subject: [PATCH 187/679] Internal reorganization

---
 include/consts |   1 -
 lynis          | 143 +++++++++++++++++++++++++++----------------------
 2 files changed, 80 insertions(+), 64 deletions(-)

diff --git a/include/consts b/include/consts
index 67a18733..343567df 100644
--- a/include/consts
+++ b/include/consts
@@ -327,7 +327,6 @@ unset LANG
     HPTOTAL=0                   # Maximum number of hardening points
     LOG_INCORRECT_OS=1          # Log tests with incorrect OS
     NEVERBREAK=0                # Don't wait for user input
-    PENTESTINGMODE=0            # Try tests without root privileges
     QUICKMODE=1                 # Don't wait for user input
     QUIET=0                     # Show normal messages and warnings as well
     SKIPLOGTEST=0               # Skip logging for one test
diff --git a/lynis b/lynis
index 0914f9c4..1324b4d5 100755
--- a/lynis
+++ b/lynis
@@ -21,27 +21,29 @@
 # Lynis is an automated auditing tool for Unix based operating systems.
 #
 #################################################################################
+#
+    # In Solaris /bin/sh is not POSIX, but /usr/xpg4/bin/sh is.
+    # Switch to /usr/xpg4/bin/sh if it exists and we are not already running it.
+    if [ "$(uname)" = "SunOS" ]; then
+        test "$_" != "/usr/xpg4/bin/sh" && test -f /usr/xpg4/bin/sh && exec /usr/xpg4/bin/sh "$0" "$@"
+    fi
+#
+#################################################################################
 #
     # Code quality: don't allow using undefined variables
+    # Notes: $_ may be empty on FreeBSD
     set -o nounset
 #
 #################################################################################
 #
-    # In Solaris /bin/sh is not POSIX, but /usr/xpg4/bin/sh is.
-    # Switch to /usr/xpg4/bin/sh if it exists and we are not already running it.
-    test "$_" != "/usr/xpg4/bin/sh" && test -f /usr/xpg4/bin/sh && exec /usr/xpg4/bin/sh "$0" "$@"
-#
-#################################################################################
-#
-
     # Program information
     PROGRAM_NAME="Lynis"
     PROGRAM_AUTHOR="CISOfy"
     PROGRAM_AUTHOR_CONTACT="lynis-dev@cisofy.com"
 
     # Version details
-    PROGRAM_RELEASE_DATE="2019-06-29"
-    PROGRAM_RELEASE_TIMESTAMP=1561383761
+    PROGRAM_RELEASE_DATE="2019-07-14"
+    PROGRAM_RELEASE_TIMESTAMP=1563094548
     PROGRAM_RELEASE_TYPE="dev" # dev or final
     PROGRAM_VERSION="3.0.0"
 
@@ -58,7 +60,6 @@
     REPORT_version_major="1"; REPORT_version_minor="0"
     REPORT_version="${REPORT_version_major}.${REPORT_version_minor}"
 
-    DISPLAY_LANG="${LANG}"  # required by function Display to deal with multi-bytes characters.
 
 #
 #################################################################################
@@ -74,53 +75,31 @@
     WORKDIR=$(pwd)
 
     # Test from which directories we can use all functions and tests
-
-        INCLUDEDIR=""  # Set default include directory to none
-        tINCLUDE_TARGETS="/usr/local/include/lynis /usr/local/lynis/include /usr/share/lynis/include ./include"  # Default paths to check (CWD as last option, in case we run from standalone)
-        for I in ${tINCLUDE_TARGETS}; do
-            if [ "${I}" = "./include" ]; then
-                if [ -d "${WORKDIR}/include" ]; then INCLUDEDIR="${WORKDIR}/include"; fi
-            elif [ -d ${I} -a -z "${INCLUDEDIR}" ]; then
-                INCLUDEDIR=${I}
-            fi
-        done
+    INCLUDEDIR=""
+    tINCLUDE_TARGETS="/usr/local/include/lynis /usr/local/lynis/include /usr/share/lynis/include ./include"  # Default paths to check (CWD as last option, in case we run from standalone)
+    for I in ${tINCLUDE_TARGETS}; do
+        if [ "${I}" = "./include" ]; then
+            if [ -d "${WORKDIR}/include" ]; then INCLUDEDIR="${WORKDIR}/include"; fi
+        elif [ -d ${I} -a -z "${INCLUDEDIR}" ]; then
+            INCLUDEDIR=${I}
+        fi
+    done
 
     # Drop out if our include directory can't be found
-        if [ -z "${INCLUDEDIR}" ]; then
-            printf "%s" "
-Fatal error: can't find include directory
-Make sure to execute ${PROGRAM_NAME} from untarred directory or check your installation."
-            exit 1
-        fi
+    if [ -z "${INCLUDEDIR}" ]; then
+        printf "%s" "\nFatal error: can't find include directory\nMake sure to execute ${PROGRAM_NAME} from untarred directory or check your installation."
+        exit 1
+    fi
 
     # Test for database directory
-
-        DBDIR=""; tDB_TARGETS="/usr/local/share/lynis/db /usr/local/lynis/db /usr/share/lynis/db ./db"
-        for I in ${tDB_TARGETS}; do
-            if [ "${I}" = "./db" ]; then
-                if [ -d "${WORKDIR}/db" ]; then DBDIR="${WORKDIR}/db"; fi
-            elif [ -d ${I} -a -z "${DBDIR}" ]; then
-                DBDIR="${I}"
-            fi
-        done
-
-    # Import translations. First import English to prefill all texts
-    if [ ! -f ${DBDIR}/languages/en ]; then
-        echo "Could not find languages directory (file: ${DBDIR}/languages/en)"
-        exit 1
-    else
-        . ${DBDIR}/languages/en
-    fi
-
-    # Auto detection of language based on locale (first two characters). Set to English when nothing found.
-    if [ -x "$(command -v locale 2> /dev/null)" ]; then
-        LANGUAGE=$(locale | egrep "^LANG=" | cut -d= -f2 | cut -d_ -f1 | egrep "^[a-z]{2}$")
-    fi
-    if [ -z "${LANGUAGE}" ]; then
-        #Debug "Result: no (valid) language found, setting to default language (en)"
-        LANGUAGE="en"
-    fi
-
+    DBDIR=""; tDB_TARGETS="/usr/local/share/lynis/db /usr/local/lynis/db /usr/share/lynis/db ./db"
+    for I in ${tDB_TARGETS}; do
+        if [ "${I}" = "./db" ]; then
+            if [ -d "${WORKDIR}/db" ]; then DBDIR="${WORKDIR}/db"; fi
+        elif [ -d ${I} -a -z "${DBDIR}" ]; then
+            DBDIR="${I}"
+        fi
+    done
 #
 #################################################################################
 #
@@ -128,7 +107,7 @@ Make sure to execute ${PROGRAM_NAME} from untarred directory or check your insta
     # Check user to determine file permissions later on. If we encounter Solaris, use related id binary instead
     if [ -x /usr/xpg4/bin/id ]; then
         MYID=$(/usr/xpg4/bin/id -u 2> /dev/null)
-    elif [ $(uname) = "SunOS" ]; then
+    elif [ "$(uname)" = "SunOS" ]; then
         MYID=$(id | tr '=' ' ' | tr '(' ' ' | awk '{ print $2 }' 2> /dev/null)
     else
         MYID=$(id -u 2> /dev/null)
@@ -137,10 +116,21 @@ Make sure to execute ${PROGRAM_NAME} from untarred directory or check your insta
 #
 #################################################################################
 #
-# Consts (bin paths, text strings, colors)
+# Set basic values and test permissions of the files to include, such as:
+# - consts: bin paths, text strings, colors
+# - functions: function library
 #
 #################################################################################
 #
+    # Determine if we are root (UID = 0)
+    if [ ${MYID} -eq 0 ]; then
+        PRIVILEGED=1
+        PENTESTINGMODE=0
+    else
+        # Set to pentesting mode if scan is with root privileges
+        PENTESTINGMODE=1
+    fi
+
     # Perform a basic check for permissions. After including functions, using SafePerms()
     IGNORE_FILE_PERMISSION_ISSUES=0
 
@@ -204,6 +194,41 @@ Make sure to execute ${PROGRAM_NAME} from untarred directory or check your insta
 #
 #################################################################################
 #
+# Language settings
+#
+#################################################################################
+#
+    # Auto detection of language based on shell LANG variable. This is required by the Display() function to deal with multi-bytes characters.
+    DISPLAY_LANG="${LANG:-}"
+    # Try locale command if shell variable had no value
+    if [ -z "${DISPLAY_LANG}" ]; then
+        DISPLAY_LANG=$(locale | egrep "^LANG=" | cut -d= -f2)
+    fi
+
+    # Extract the short notation of the language (first two characters).
+    if [ -x "$(command -v locale 2> /dev/null)" ]; then
+        LANGUAGE=$(locale | egrep "^LANG=" | cut -d= -f2 | cut -d_ -f1 | egrep "^[a-z]{2}$")
+    fi
+
+    # Set default language: 'en' (English) if no value is set
+    if [ -z "${LANGUAGE}" ]; then
+        LANGUAGE="en"
+    fi
+
+    # Import translations. First import English to prefill all texts
+    if [ -f ${DBDIR}/languages/en ]; then
+        if SafeFile "${DBDIR}/languages/en"; then
+            . ${DBDIR}/languages/en
+        else
+            ExitFatal "Incorrect ownership or permissions of language file (${DBDIR}/languages/en)"
+        fi
+    else
+        echo "Could not find languages directory (file: ${DBDIR}/languages/en)"
+        exit 1
+    fi
+#
+#################################################################################
+#
 # Traps
 #
 #################################################################################
@@ -222,14 +247,6 @@ Make sure to execute ${PROGRAM_NAME} from untarred directory or check your insta
     SafePerms ${INCLUDEDIR}/parameters
     . ${INCLUDEDIR}/parameters
 
-    # Now determine if we are root (UID = 0)
-    if [ ${MYID} -eq 0 ]; then
-        PRIVILEGED=1
-    else
-        Debug "Starting Lynis non-privileged"
-        # Implied pentesting mode if not performed by root user
-        PENTESTINGMODE=1
-    fi
 
     # Disable logging if no alternative was provided
     if [ ${PRIVILEGED} -eq 0 ]; then

From 4829ae97221336f10ef2369b6cbf7929a62a8fb8 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 11:57:44 +0200
Subject: [PATCH 188/679] Long format for od does not exist on BSD

---
 include/profiles | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/include/profiles b/include/profiles
index f8935ece..ad5e6b07 100644
--- a/include/profiles
+++ b/include/profiles
@@ -35,10 +35,8 @@
 
         # Show deprecation message for old config entries
         FOUND=0
-        #DATA=$(egrep "^config:" ${PROFILE} | od --address-radix=none -t a | sed 's/ /!space!/g')
-        #if ! IsEmpty "${DATA}"; then FOUND=1; fi
-        # Items such as 'apache:'
-        DATA=$(egrep "^[a-z-]{1,}:" ${PROFILE} | od --address-radix=none -t a | sed 's/ /!space!/g')
+        # Items such as 'config:' and 'apache:'
+        DATA=$(egrep "^[a-z-]{1,}:" ${PROFILE} | od -An -ta | sed 's/ /!space!/g')  # od -An (no file offset), -ta (named character, to be on safe side)
         if ! IsEmpty "${DATA}"; then FOUND=1; fi
 
         if [ ${FOUND} -eq 1 ]; then
@@ -49,7 +47,7 @@
         fi
 
         # Security check for unexpected and possibly harmful escape characters
-        DATA=$(grep -v '^$\|^ \|^#\|^config:'  ${PROFILE} | tr -d '[:alnum:]/\[\]\(\)\-_\|,\.:;= \n\r' | od --address-radix=none -t a | sed 's/ /!space!/g')
+        DATA=$(grep -v '^$\|^ \|^#\|^config:'  ${PROFILE} | tr -d '[:alnum:]/\[\]\(\)\-_\|,\.:;= \n\r' | od -An -ta | sed 's/ /!space!/g')
         if ! IsEmpty "${DATA}"; then
             DisplayWarning "Your profile '${PROFILE}' contains unexpected characters. See the log file for more information."
             LogText "Found unexpected or possibly harmful characters in the profile. See output below."

From ba32b1a001b703fe99fcf74da80816ac31245a74 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 12:18:05 +0200
Subject: [PATCH 189/679] Use xxd or hexdump, depending on OS

---
 include/helper_generate | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/include/helper_generate b/include/helper_generate
index 31dba7ec..30044705 100644
--- a/include/helper_generate
+++ b/include/helper_generate
@@ -43,8 +43,18 @@ if [ $# -gt 0 ]; then
             fi
 
             # Generate random host IDs
-            HOSTID=$(head -c20 < /dev/urandom | xxd -c 20 -p)
-            HOSTID2=$(head -c32 < /dev/urandom | xxd -c 32 -p)
+            case "${OS}" in
+                "AIX")
+                    # hexdump does not exist on AIX
+                    HOSTID=$(head -c20 < /dev/urandom | xxd -c 20 -p)
+                    HOSTID2=$(head -c32 < /dev/urandom | xxd -c 32 -p)
+                ;;
+                *)
+                    # xxd does not exist on FreeBSD
+                    HOSTID=$(head -c20 < /dev/urandom | hexdump -ve '"%.2x"')
+                    HOSTID2=$(head -c32 < /dev/urandom | hexdump -ve '"%.2x"')
+                ;;
+            esac
 
             ${ECHOCMD} "Generated host identifiers"
             ${ECHOCMD} "- hostid: ${HOSTID}"

From 96434508d40fe1d86f67874682645511b739b6ed Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 12:18:22 +0200
Subject: [PATCH 190/679] Disable testing for other tools, as xxd is not
 present on all systems by default

---
 include/binaries | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/include/binaries b/include/binaries
index d894caf9..0fbefe46 100644
--- a/include/binaries
+++ b/include/binaries
@@ -304,12 +304,11 @@
         [ "${WCBINARY:-}" ] || ExitFatal "wc binary not found"
 
         # Test a few other tools that we did not specifically define (yet)
-        TOOLS="xxd"
-        for T in ${TOOLS}; do
-            DATA=$(type ${T})
-            if [ $? -gt 0 ]; then ExitFatal "${T} binary not found"; fi
-        done
-
+        #TOOLS="xxd"
+        #for T in ${TOOLS}; do
+        #    DATA=$(type ${T})
+        #    if [ $? -gt 0 ]; then ExitFatal "${T} binary not found"; fi
+        #done
 
     else
         LogText "Result: checking of binaries skipped in this mode"

From e91c0a6f894b734ba96cb4115d33f2d2f7e284b0 Mon Sep 17 00:00:00 2001
From: David <2069735+Marzal@users.noreply.github.com>
Date: Sun, 14 Jul 2019 13:00:55 +0200
Subject: [PATCH 191/679] Add missing commands to man

---
 lynis.8 | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lynis.8 b/lynis.8
index f1c313eb..1c65a7b5 100644
--- a/lynis.8
+++ b/lynis.8
@@ -41,6 +41,10 @@ When running \fBLynis\fP for the first time, run: lynis audit system
 .SH "COMMANDS"
 .IP "audit \<type\>"
 Perform an audit of the selected type
+.IP "configure \<parameters\>"
+Change or add settings to the config file
+.IP "generate \<parameter\>"
+Generate specific details such as host IDs
 .IP "show \<parameter\>"
 Show information, such as configuration and paths
 .IP "update \<parameter\>"

From 3f042353535e12972449c06a8193ebfd467349f8 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 13:06:23 +0200
Subject: [PATCH 192/679] [INSE-8116] added rsync service

---
 include/tests_insecure_services | 22 +---------------------
 1 file changed, 1 insertion(+), 21 deletions(-)

diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index 841189d8..0560a3ea 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -213,7 +213,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         XINETD_INSECURE_SERVICE_FOUND=0
 
-        ITEMS="chargen chargen-dgram chargen-stream daytime daytime-dgram daytime-stream discard discard-dgram discard-stream echo echo-dgram echo-stream time time-dgram time-stream ntalk rexec rlogin rsh talk telnet tftp"
+        ITEMS="chargen chargen-dgram chargen-stream daytime daytime-dgram daytime-stream discard discard-dgram discard-stream echo echo-dgram echo-stream time time-dgram time-stream ntalk rexec rlogin rsh rsync talk telnet tftp"
 
         for SERVICE in ${ITEMS}; do
             LogText "Test: checking service ${SERVICE}"
@@ -246,26 +246,6 @@
     fi
 #
 #################################################################################
-#
-    # Test        : INSE-8150
-    # Description : Check for rsync enabled via xinetd
-    #RSYNC_XINETD_CONFIG_FILE="${XINETD_CONFIG_DIR}/rsync"
-    #if [ ${XINETD_ACTIVE} -eq 1 -a -f ${RSYNC_XINETD_CONFIG_FILE} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    #Register --test-no INSE-8150 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for rsync via xinetd"
-    #if [ ${SKIPTEST} -eq 0 ]; then
-    #    LogText "Test: checking rsync presence in xinetd configuration"
-    #    FIND=$(${GREPBINARY} "disable\s*=\s*no" ${RSYNC_XINETD_CONFIG_FILE})
-    #    if [ "${FIND}" = "" ]; then
-    #        LogText "Result: rsync not enabled in ${RSYNC_XINETD_CONFIG_FILE}"
-    #        Display --indent 6 --text "- Checking xinetd (rsync)" --result "${STATUS_DISABLED}" --color GREEN
-    #    else
-    #        LogText "Result: rsync enabled in ${RSYNC_XINETD_CONFIG_FILE}"
-    #        Display --indent 6 --text "- Checking xinetd (rsync)" --result "${STATUS_ENABLED}" --color RED
-    #        ReportSuggestion "${TEST_NO}" "Disable rsync in xinetd configuration"
-    #    fi
-    #fi
-#
-#################################################################################
 #
     # Test        : INSE-8200
     # Description : Check if tcp_wrappers is installed when inetd/xinetd is active

From 819f310750700988e70b9d791d3f4e0b2f3b730c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 13:06:53 +0200
Subject: [PATCH 193/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1430528e..21966be2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -41,6 +41,7 @@ measures to further tighten any possible misuse.
 - Security: the 'nounset' (set -u) parameter is now activated by default
 - Use only locations from PATH environment variable, unless it is not defined
 - Show 'lynis generate hostids' when they are missing
+- INSE-8116 - added rsync service
 - NAME-4408 - corrected Report function call
 - NETW-3032 - small rewrite of test and extended with addrwatch
 - PROC-3602 - allow different root directory

From 93e311e52e9c5c2671e0e3030fb4fd9634d9ded6 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 13:13:02 +0200
Subject: [PATCH 194/679] Added INSE-8314 and INSE-8316 for NIS client and
 server

---
 include/tests_insecure_services | 51 +++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index 0560a3ea..a52037a1 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -392,6 +392,57 @@
             Display --indent 2 --text "- Installed telnet server package" --result "${STATUS_NOT_FOUND}" --color GREEN
         fi
     fi
+
+#
+#################################################################################
+#
+    # Test        : INSE-8314
+    # Description : Check if NIS client is installed
+    Register --test-no INSE-8314 --weight L --network NO --category security --description "Check if NIS client is installed"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        FOUND=""
+        LogText "Test: Checking if NIS client is installed"
+        PACKAGES="nis ypbind"
+        for PACKAGE in ${PACKAGES}; do
+            PackageIsInstalled "${PACKAGE}"
+            if [ $? -eq 0 ]; then
+                FOUND="${PACKAGE}"
+            fi
+        done
+        if [ ${FOUND} ]; then
+            LogText "Result: NIS client is installed"
+            Display --indent 2 --text "- Checking NIS client installation" --result "${STATUS_SUGGESTION}" --color YELLOW
+            ReportSuggestion ${TEST_NO} "NIS client should be removed as it contains numerous security exposures and have been replaced with the more secure SSH package"
+        else
+            LogText "Result: NIS client is NOT installed"
+            Display --indent 2 --text "- Checking NIS client installation" --result "${STATUS_OK}" --color GREEN
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8316
+    # Description : Check if NIS server is installed
+    Register --test-no INSE-8316 --weight L --network NO --category security --description "Check if NIS server is installed"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        FOUND=""
+        LogText "Test: Checking if NIS server is installed"
+        PACKAGES="nis ypserv"
+        for PACKAGE in ${PACKAGES}; do
+            PackageIsInstalled "${PACKAGE}"
+            if [ $? -eq 0 ]; then
+                FOUND="${PACKAGE}"
+            fi
+        done
+        if [ ${FOUND} ]; then
+            LogText "Result: NIS server is installed"
+            Display --indent 2 --text "- Checking NIS server installation" --result "${STATUS_SUGGESTION}" --color YELLOW
+            ReportSuggestion ${TEST_NO} "Removing the ${FOUND} package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services"
+        else
+            LogText "Result: NIS server is NOT installed"
+            Display --indent 2 --text "- Checking NIS server installation" --result "${STATUS_OK}" --color GREEN
+        fi
+    fi
 #
 #################################################################################
 #

From ceb9ea193da6cba11f5cee37f05066afbbba4150 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 13:16:48 +0200
Subject: [PATCH 195/679] Renamed INSE-8342 to INSE-8304

---
 include/tests_insecure_services | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index a52037a1..c446705f 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -328,7 +328,7 @@
 #
     # Test        : INSE-8304
     # Description : Check if rsh server is installed
-    Register --test-no INSE-8342 --weight L --network NO --category security --description "Check if rsh server is installed"
+    Register --test-no INSE-8304 --weight L --network NO --category security --description "Check if rsh server is installed"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if rsh server is installed
         LogText "Test: Checking if rsh server is installed"

From 7d33b59b0c21f1713011968e90914f390b0083ab Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 13:19:11 +0200
Subject: [PATCH 196/679] Added tests

---
 db/tests.db | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/db/tests.db b/db/tests.db
index cd978c50..56faba09 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -181,6 +181,10 @@ INSE-8116:test:security:insecure_services::Insecure services enabled via xinetd:
 INSE-8200:test:security:insecure_services::Usage of TCP wrappers:
 INSE-8300:test:security:insecure_services::Presence of rsh client:
 INSE-8302:test:security:insecure_services::Presence of rsh server:
+INSE-8310:test:security:insecure_services::Presence of telnet client:
+INSE-8312:test:security:insecure_services::Presence of telnet server:
+INSE-8314:test:security:insecure_services::Presence of NIS client:
+INSE-8316:test:security:insecure_services::Presence of NIS server:
 KRNL-5622:test:security:kernel:Linux:Determine Linux default run level:
 KRNL-5677:test:security:kernel:Linux:Check CPU options and support:
 KRNL-5695:test:security:kernel:Linux:Determine Linux kernel version and release number:

From ea67b779c7c2b0161bbee38966669de57a453d01 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 13:19:18 +0200
Subject: [PATCH 197/679] Updated log

---
 CHANGELOG.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 21966be2..63f26f84 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,7 +29,9 @@ measures to further tighten any possible misuse.
 - New profile option: disable-plugin - disables a single plugin
 - New profile option: ssl-certificate-paths-to-ignore - ignore a path
 - New test: CRYP-7930 - disk or file system encryption testing
-- New test: PROC-3802 - Check presence of prelink tooling
+- New test: INSE-8314 - test for NIS client
+- New test: INSE-8316 - test for NIS server
+- New test: PROC-3802 - check presence of prelink tooling
 - New report key: openssh_daemon_running
 - New command: lynis generate systemd-units
 - Measure timing of tests and report slow tests (10+ seconds)
@@ -42,6 +44,7 @@ measures to further tighten any possible misuse.
 - Use only locations from PATH environment variable, unless it is not defined
 - Show 'lynis generate hostids' when they are missing
 - INSE-8116 - added rsync service
+- INSE-8342 - renamed to INSE-8304
 - NAME-4408 - corrected Report function call
 - NETW-3032 - small rewrite of test and extended with addrwatch
 - PROC-3602 - allow different root directory

From 8400849c58ef05b6a045d6d43013e85e66beaa60 Mon Sep 17 00:00:00 2001
From: David <2069735+Marzal@users.noreply.github.com>
Date: Sun, 14 Jul 2019 13:26:03 +0200
Subject: [PATCH 198/679] Add missing commands to show command helper

configure,generate,update,upload-only
---
 include/helper_show | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/include/helper_show b/include/helper_show
index 94d839be..d1086378 100644
--- a/include/helper_show
+++ b/include/helper_show
@@ -108,11 +108,15 @@ GENERATE_HELP="
 "
 
 
-UPDATE_ARGS="check info"
+UPDATE_ARGS="check | info"
 UPDATE_HELP="
   ${CYAN}update info${NORMAL}
 
-  Check version information
+  Check and show version information
+  
+  ${CYAN}update check${NORMAL}
+
+  Just check if version is up-to-date  
 
 "
 
@@ -207,8 +211,11 @@ if [ $# -gt 0 ]; then
                 if [ $# -eq 1 ]; then
                     case $1 in
                         "audit") ${ECHOCMD} "${AUDIT_HELP}" ;;
+                        "configure") ${ECHOCMD} "No help available yet" ;;
+                        "generate") ${ECHOCMD} "${GENERATE_HELP}" ;;
                         "show") ${ECHOCMD} "${SHOW_HELP}" ;;
-                        "update") ${ECHOCMD} "No help available yet" ;;
+                        "update")  ${ECHOCMD} "${UPDATE_HELP}" ;;
+                        "upload-only") ${ECHOCMD} "${UPLOAD_ONLY_HELP}" ;;                        
                         *) DisplayError "Unknown argument for 'commands'"
                     esac
                 else
@@ -288,6 +295,7 @@ if [ $# -gt 0 ]; then
                 shift
                 case $1 in
                    "audit") ${ECHOCMD} "${AUDIT_HELP}" ;;
+                   "configure") ${ECHOCMD} "No help available yet" ;;
                    "generate") ${ECHOCMD} "${GENERATE_HELP}" ;;
                    "show") ${ECHOCMD} "${SHOW_HELP}" ;;
                    "update") ${ECHOCMD} "${UPDATE_HELP}" ;;

From 4b68c22f306e62d64b1ffc78eac91646c5210c3d Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 13:27:08 +0200
Subject: [PATCH 199/679] Use relative paths

---
 include/tests_homedirs | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/tests_homedirs b/include/tests_homedirs
index 1c850105..9570816b 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -37,8 +37,8 @@
     Register --test-no HOME-9302 --weight L --network NO --category security --description "Create list with home directories"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Read sixth field of /etc/passwd
-        LogText "Test: query /etc/passwd to obtain home directories"
-        FIND=$(${AWKBINARY} -F: '{ if ($1 !~ "#") print $6 }' /etc/passwd | ${SORTBINARY} -u)
+        LogText "Test: query ${ROOTDIR}etc/passwd to obtain home directories"
+        FIND=$(${AWKBINARY} -F: '{ if ($1 !~ "#") print $6 }' ${ROOTDIR}etc/passwd | ${SORTBINARY} -u)
         for I in ${FIND}; do
             if [ -d ${I} ]; then
                 LogText "Result: found home directory: ${I} (directory exists)"
@@ -57,7 +57,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users' home directories permissions are 750 or more restrictive
         FOUND=0
-        for LINE in "$(${CAT_BINARY} /etc/passwd | ${EGREPBINARY} -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }')"; do
+        for LINE in "$(${CAT_BINARY} ${ROOTDIR}etc/passwd | ${EGREPBINARY} -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }')"; do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
             DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
             if [ -d ${DIR} ]; then
@@ -69,7 +69,7 @@
                 fi
             fi
         done
-        # Result
+
         if [ ${FOUND} -eq 1 ]; then
             Display --indent 2 --text "- Checking users' home directories permissions" --result "${STATUS_WARNING}" --color RED
             ReportWarning ${TEST_NO} "Permissions of some users' home directories are not strict enough. Should be 750 or more restrictive."
@@ -87,7 +87,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users own their home directories
         FOUND=0
-        for LINE in "$(${CAT_BINARY} /etc/passwd | ${EGREPBINARY} -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }')"; do
+        for LINE in "$(${CAT_BINARY} ${ROOTDIR}etc/passwd | ${EGREPBINARY} -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }')"; do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
             DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
             if [ -d ${DIR} ]; then
@@ -98,7 +98,7 @@
                 fi
             fi
         done
-        # Result
+
         if [ ${FOUND} -eq 1 ]; then
             Display --indent 2 --text "- Checking users' home directories ownership" --result "${STATUS_WARNING}" --color RED
             ReportWarning ${TEST_NO} "Owner of some users' home directories are not correctly set"

From b025b3301a85fd13f554c41a3d9c5105bb0b542f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 13:36:45 +0200
Subject: [PATCH 200/679] Define relative or absolute path, depending on
 directory/file or being a binary

---
 include/tests_kernel | 41 +++++++++++++++++------------------------
 1 file changed, 17 insertions(+), 24 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index 66a80214..7a542c3d 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -235,18 +235,18 @@
     # Description : Checking for available Linux kernel configuration file in /boot
     Register --test-no KRNL-5728 --os Linux --weight L --network NO --category security --description "Checking Linux kernel config"
     if [ ${SKIPTEST} -eq 0 ]; then
-        CHECKFILE="/boot/config-$(uname -r)"
+        CHECKFILE="${ROOTDIR}boot/config-$(uname -r)"
         if [ -f ${CHECKFILE} ]; then
             LINUXCONFIGFILE="${CHECKFILE}"
             LogText "Result: found config (${LINUXCONFIGFILE})"
             Display --indent 2 --text "- Checking Linux kernel configuration file" --result "${STATUS_FOUND}" --color GREEN
-        elif [ -f /proc/config.gz ]; then
+        elif [ -f ${ROOTDIR}proc/config.gz ]; then
             LINUXCONFIGFILE="${CHECKFILE}"
             LINUXCONFIGFILE_ZIPPED=1
-            LogText "Result: found config: /proc/config.gz (compressed)"
+            LogText "Result: found config: ${ROOTDIR}proc/config.gz (compressed)"
             Display --indent 2 --text "- Checking Linux kernel configuration file" --result "${STATUS_FOUND}" --color GREEN
         else
-            LogText "Result: no Linux kernel configuration file found in /boot"
+            LogText "Result: no Linux kernel configuration file found in ${ROOTDIR}boot"
             Display --indent 2 --text "- Checking Linux kernel configuration file" --result "${STATUS_NOT_FOUND}" --color WHITE
         fi
         if HasData "${LINUXCONFIGFILE}"; then
@@ -267,15 +267,15 @@
     Register --test-no KRNL-5730 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking disk I/O kernel scheduler"
     if [ ${SKIPTEST} -eq 0 ]; then
         if [ ${LINUXCONFIGFILE_ZIPPED} -eq 1 ]; then GREPTOOL="${ZGREPBINARY}"; else GREPTOOL="${GREPBINARY}"; fi
-        if [ ! "${GREPTOOL}" = "" ]; then
+        if [ -n "${GREPTOOL}" ]; then
             LogText "Test: Checking the default I/O kernel scheduler"
             LINUX_KERNEL_IOSCHED=$(${GREPTOOL} "CONFIG_DEFAULT_IOSCHED" ${LINUXCONFIGFILE} | ${AWKBINARY} -F= '{ print $2 }' | ${SEDBINARY} s/\"//g)
-            if [ ! "${LINUX_KERNEL_IOSCHED}" = "" ]; then
+            if [ -n "${LINUX_KERNEL_IOSCHED}" ]; then
                 LogText "Result: found IO scheduler '${LINUX_KERNEL_IOSCHED}'"
                 Display --indent 2 --text "- Checking default I/O kernel scheduler" --result "${STATUS_FOUND}" --color GREEN
                 Report "linux_kernel_io_scheduler[]=${LINUX_KERNEL_IOSCHED}"
             else
-                LogText "Result: no default i/o kernel scheduler found"
+                LogText "Result: no default I/O kernel scheduler found"
                 Display --indent 2 --text "- Checking default I/O kernel scheduler" --result "${STATUS_NOT_FOUND}" --color WHITE
             fi
         else
@@ -323,8 +323,8 @@
         LogText "Test: Active kernel modules (KLDs)"
         LogText "Description: View all active kernel modules (including kernel)"
         LogText "Test: Checking modules"
-        if [ -f ${ROOTDIR}sbin/kldstat ]; then
-            FIND=$(${ROOTDIR}sbin/kldstat | ${GREPBINARY} -v 'Name' | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f6)
+        if [ -x /sbin/kldstat ]; then
+            FIND=$(/sbin/kldstat | ${GREPBINARY} -v 'Name' | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f6)
             if [ $? -eq 0 ]; then
                 LogText "Loaded modules according kldstat:"
                 COUNT=0
@@ -340,7 +340,7 @@
             fi
         else
             echo "[ ${WHITE}SKIPPED${NORMAL} ]"
-            LogText "Result: no results, can NOT find ${ROOTDIR}sbin/kldstat"
+            LogText "Result: no results, can NOT find /sbin/kldstat"
         fi
     fi
 #
@@ -438,12 +438,12 @@
     Register --test-no KRNL-5820 --os Linux --weight L --network NO --category security --description "Checking core dumps configuration"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Limits option
-        LogText "Test: Checking presence /etc/security/limits.conf"
-        if [ -f /etc/security/limits.conf ]; then
-            LogText "Result: file /etc/security/limits.conf exists"
-            LogText "Test: Checking if core dumps are disabled in /etc/security/limits.conf and /etc/security/limits.d/*"
-            FIND1=$(${GREPBINARY} -r -v "^#" /etc/security/limits.conf ${LIMITS_DIRECTORY} | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="soft" && $3=="core" && $4=="0") { print "soft core disabled" } else if ($1=="*" && $2=="soft" && $3=="core" && $4!="0") { print "soft core enabled" } }')
-            FIND2=$(${GREPBINARY} -r -v "^#" /etc/security/limits.conf ${LIMITS_DIRECTORY} | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="hard" && $3=="core" && $4=="0") { print "hard core disabled" } else if ($1=="*" && $2=="hard" && $3=="core" && $4!="0") { print "hard core enabled" } }')
+        LogText "Test: Checking presence ${ROOTDIR}etc/security/limits.conf"
+        if [ -f ${ROOTDIR}etc/security/limits.conf ]; then
+            LogText "Result: file ${ROOTDIR}etc/security/limits.conf exists"
+            LogText "Test: Checking if core dumps are disabled in ${ROOTDIR}etc/security/limits.conf and ${ROOTDIR}etc/security/limits.d/*"
+            FIND1=$(${GREPBINARY} -r -v "^#" ${ROOTDIR}etc/security/limits.conf ${LIMITS_DIRECTORY} | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="soft" && $3=="core" && $4=="0") { print "soft core disabled" } else if ($1=="*" && $2=="soft" && $3=="core" && $4!="0") { print "soft core enabled" } }')
+            FIND2=$(${GREPBINARY} -r -v "^#" ${ROOTDIR}etc/security/limits.conf ${LIMITS_DIRECTORY} | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="hard" && $3=="core" && $4=="0") { print "hard core disabled" } else if ($1=="*" && $2=="hard" && $3=="core" && $4!="0") { print "hard core enabled" } }')
             if [ "${FIND2}" = "hard core disabled" ]; then
                 LogText "Result: core dumps (soft and hard) are both disabled"
                 Display --indent 2 --text "- Checking core dumps configuration" --result "${STATUS_DISABLED}" --color GREEN
@@ -461,7 +461,7 @@
                 AddHP 2 3
             fi
         else
-            LogText "Result: file /etc/security/limits.conf does not exist, skipping test"
+            LogText "Result: file ${ROOTDIR}etc/security/limits.conf does not exist, skipping test"
         fi
         # TODO: Check ulimit settings in /etc/profile and /etc/profile.d
 
@@ -490,13 +490,6 @@
     fi
 #
 #################################################################################
-#
-    # Test        : KRNL-5826
-    # Description : Checking core dumps configuration (Solaris)
-    #Register --test-no KRNL-5826 --os Linux --weight L --network NO --category security --description "Checking core dumps configuration"
-    #if [ ${SKIPTEST} -eq 0 ]; then
-#
-#################################################################################
 #
     # Test        : KRNL-5830
     # Description : Check if system needs a reboot (Linux only)

From c179a0e563b6f25ceacfbae55d15919d10e8ca82 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 13:36:56 +0200
Subject: [PATCH 201/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 63f26f84..ab6d1b78 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -45,6 +45,7 @@ measures to further tighten any possible misuse.
 - Show 'lynis generate hostids' when they are missing
 - INSE-8116 - added rsync service
 - INSE-8342 - renamed to INSE-8304
+- KRNL-5820 - extended check to include limits.d directory
 - NAME-4408 - corrected Report function call
 - NETW-3032 - small rewrite of test and extended with addrwatch
 - PROC-3602 - allow different root directory

From dbc6f9bc4cff8ea958e7bad923533a7f6db5a3bc Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 13:40:55 +0200
Subject: [PATCH 202/679] [SCHD-7702] removed hardening points

---
 include/tests_scheduling | 1 -
 1 file changed, 1 deletion(-)

diff --git a/include/tests_scheduling b/include/tests_scheduling
index f0f54b5b..91a89c63 100644
--- a/include/tests_scheduling
+++ b/include/tests_scheduling
@@ -38,7 +38,6 @@
         FIND=$(${PSBINARY} aux | ${EGREPBINARY} "( cron$|/cron(d)? )")
         if IsEmpty "${FIND}"; then
             LogText "Result: no cron daemon found"
-            AddHP 3 3
         else
             LogText "Result: cron daemon running"
             CROND_RUNNING=1

From 5fdd00783e1cc508197924a3a73c15ac414dd26e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 13:41:02 +0200
Subject: [PATCH 203/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ab6d1b78..8161d49b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -51,6 +51,7 @@ measures to further tighten any possible misuse.
 - PROC-3602 - allow different root directory
 - PROC-3612 - show 'Not found' instead of 'OK'
 - PROC-3614 - show 'Not found' instead of 'OK'
+- SCHD-7702 - removed hardening points
 - SSH-7402 - detect other SSH daemons like dropbear
 - SSH-7406 - strip OpenSSH patch version and remove characters (carriage return)
 - Whow changelog works again for newer versions

From 591bc05f4d8b8b73941823ae804630e646ef1393 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 14:43:35 +0200
Subject: [PATCH 204/679] [SSH-7408] changed text in suggestion and report

---
 include/tests_ssh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_ssh b/include/tests_ssh
index dde395e3..8a55eabf 100644
--- a/include/tests_ssh
+++ b/include/tests_ssh
@@ -267,13 +267,13 @@
                     AddHP 3 3
                 elif [ "${RESULT}" = "MIDSCORED" ]; then
                     LogText "Result: OpenSSH option ${OPTIONNAME} is configured reasonably"
-                    ReportSuggestion ${TEST_NO} "Consider hardening SSH configuration" "${OPTIONNAME} (${FOUNDVALUE} --> ${EXPECTEDVALUE})" "-"
+                    ReportSuggestion ${TEST_NO} "Consider hardening SSH configuration" "${OPTIONNAME} (set ${FOUNDVALUE} to ${EXPECTEDVALUE})" "-"
                     ReportDetails --test "${TEST_NO}" --service "sshd" --field "${OPTIONNAME}" --value "${FOUNDVALUE}" --preferredvalue "${EXPECTEDVALUE}" --description "sshd option ${OPTIONNAME}"
                     Display --indent 4 --text "- OpenSSH option: ${OPTIONNAME}" --result "${STATUS_SUGGESTION}" --color YELLOW
                     AddHP 1 3
                 elif [ "${RESULT}" = "WEAK" ]; then
                     LogText "Result: OpenSSH option ${OPTIONNAME} is in a weak configuration state and should be fixed"
-                    ReportSuggestion ${TEST_NO} "Consider hardening SSH configuration" "${OPTIONNAME} (${FOUNDVALUE} --> ${EXPECTEDVALUE})" "-"
+                    ReportSuggestion ${TEST_NO} "Consider hardening SSH configuration" "${OPTIONNAME} (set ${FOUNDVALUE} to ${EXPECTEDVALUE})" "-"
                     ReportDetails --test "${TEST_NO}" --service "sshd" --field "${OPTIONNAME}" --value "${FOUNDVALUE}" --preferredvalue "${EXPECTEDVALUE}" --description "sshd option ${OPTIONNAME}"
                     Display --indent 4 --text "- OpenSSH option: ${OPTIONNAME}" --result "${STATUS_SUGGESTION}" --color YELLOW
                     AddHP 0 3

From ced78b52b0f757821b88d9a0c04bcf9a1f83b914 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 15:11:45 +0200
Subject: [PATCH 205/679] Small markup changes

---
 include/report | 36 ++++++++++++++++--------------------
 1 file changed, 16 insertions(+), 20 deletions(-)

diff --git a/include/report b/include/report
index 2df666e4..88d75ce0 100644
--- a/include/report
+++ b/include/report
@@ -22,8 +22,7 @@
 #
 #################################################################################
 #
-
-    # Add data fields to report file
+    # Add additional data fields to the report file at the end of the scan
     Report "dhcp_client_running=${DHCP_CLIENT_RUNNING}"
     Report "arpwatch_running=${ARPWATCH_RUNNING}"
 
@@ -37,10 +36,11 @@
     Report "package_audit_tool=${PACKAGE_AUDIT_TOOL}"
     Report "package_audit_tool_found=${PACKAGE_AUDIT_TOOL_FOUND}"
     Report "vulnerable_packages_found=${VULNERABLE_PACKAGES_FOUND}"
-
-
+#
+#################################################################################
+#
     # Hardening Index
-
+    #
     # Goal:
     # Provide a visual way to show how much the system is hardened
     #
@@ -95,8 +95,9 @@
     HPGRAPH="[${HPCOLOR}${HPBLOCKS}${NORMAL}${HPEMPTY}]"
     LogText "Hardening index : [${HPINDEX}] [${HPBLOCKS}${HPEMPTY}]"
     LogText "Hardening strength: ${HIDESCRIPTION}"
-
-
+#
+#################################################################################
+#
     # Only show overview if not running in quiet mode
     if [ ${QUIET} -eq 0 ]; then
         echo ""; echo "================================================================================"
@@ -108,19 +109,14 @@
 
         LogTextBreak
 
-        #
-        #################################################################################
-        #
         # Show test results overview
-        #
-        #################################################################################
-        #
-            if [ "${CONTROL_URL_PROTOCOL}" = "" ]; then CONTROL_URL_PROTOCOL="https"; fi
-            if [ "${CONTROL_URL_PREPEND}" = "" ]; then CONTROL_URL_PREPEND="cisofy.com/lynis/controls/"; fi
-            if [ "${CONTROL_URL_APPEND}" = "" ]; then CONTROL_URL_APPEND="/"; fi
-            if [ "${CUSTOM_URL_PROTOCOL}" = "" ]; then CUSTOM_URL_PROTOCOL="https"; fi
-            if [ "${CUSTOM_URL_PREPEND}" = "" ]; then CUSTOM_URL_PREPEND="your-domain.example.org/controls/"; fi
-            if [ "${CUSTOM_URL_APPEND}" = "" ]; then CUSTOM_URL_APPEND="/"; fi
+
+            if [ -z "${CONTROL_URL_PROTOCOL}" ]; then CONTROL_URL_PROTOCOL="https"; fi
+            if [ -z "${CONTROL_URL_PREPEND}" ]; then CONTROL_URL_PREPEND="cisofy.com/lynis/controls/"; fi
+            if [ -z "${CONTROL_URL_APPEND}" ]; then CONTROL_URL_APPEND="/"; fi
+            if [ -z "${CUSTOM_URL_PROTOCOL}" ]; then CUSTOM_URL_PROTOCOL="https"; fi
+            if [ -z "${CUSTOM_URL_PREPEND}" ]; then CUSTOM_URL_PREPEND="your-domain.example.org/controls/"; fi
+            if [ -z "${CUSTOM_URL_APPEND}" ]; then CUSTOM_URL_APPEND="/"; fi
 
             # Show warnings from logfile
             SWARNINGS=$(${GREPBINARY} 'Warning: ' ${LOGFILE} | sed 's/ /!space!/g')
@@ -249,7 +245,7 @@
                 if [ ! "${PROGRAM_LV}" = "0" -a ! "${REPORTFILE}" = "" -a ! "${REPORTFILE}" = "/dev/null" ]; then
                     # Determine if the quality of the program can be increased by filtering out the exceptions
                     FIND=$(${GREPBINARY} "^exception" ${REPORTFILE})
-                    if [ ! "${FIND}" = "" ]; then
+                    if [ -n "${FIND}" ]; then
                         echo ""
                         echo "  ${RED}${NOTE_EXCEPTIONS_FOUND}${NORMAL}"
                         echo "  ${WHITE}${NOTE_EXCEPTIONS_FOUND_DETAILED}!${NORMAL}"

From c074c81897d1b5c4ef60447971a8d25505681bd8 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 15:12:25 +0200
Subject: [PATCH 206/679] Initial work on GetReportData function

---
 include/functions | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/include/functions b/include/functions
index 794abcc4..c8f689e7 100644
--- a/include/functions
+++ b/include/functions
@@ -52,6 +52,7 @@
 #    FileIsEmpty                Check if a file is empty
 #    FileIsReadable             Check if a file is readable or directory accessible
 #    GetHostID                  Retrieve an unique ID for this host
+#    GetReportData              Request data from report
 #    HasData                    Checks for data in variable
 #    InsertSection              Insert a section block
 #    InsertPluginSection        Insert a section block for plugins
@@ -1176,6 +1177,47 @@
         fi
     }
 
+
+    ################################################################################
+    # Name        : GetReportData()
+    # Description : Request data from report
+    # Returns     : Data (when matches were found)
+    #               Exit code: True (0) or False (1) when search was cancelled
+    ################################################################################
+
+    GetReportData() {
+        KEY=""
+        VALID_CHARS="[:alnum:]/:;\-,\._\[\]\n "
+        if [ $# -eq 0 ]; then ExitFatal "No parameters provided to GetReportData() function"; fi
+
+        while [ $# -ge 1 ]; do
+            case $1 in
+                --key)
+                    shift
+                    KEY="$1"
+                ;;
+                --valid-chars)
+                    shift
+                    VALID_CHARS="$1"
+                ;;
+                *)
+                    ExitFatal "Invalid option provided to GetReportData() function"
+                ;;
+            esac
+            # Go to next parameter
+            shift
+        done
+
+        if [ "${REPORTFILE}" = "/dev/null" ]; then
+            return 1
+        else
+            ${AWKBINARY} -v pattern="^${KEY}" -F= '$1 ~ pattern {print $2}' ${REPORTFILE} | ${TRBINARY} -cd "${VALID_CHARS}" | ${TRBINARY} '[:blank:]' '__space__'
+
+        fi
+        return 0
+    }
+
+
     ################################################################################
     # Name        : HasData()
     # Description : Check for a filled variable

From 5cc5ecf534371b7eea6f7666b7b6e798d5d10de2 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 14 Jul 2019 15:13:02 +0200
Subject: [PATCH 207/679] Updated log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8161d49b..95664374 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,6 +23,7 @@ measures to further tighten any possible misuse.
 - Security: test if setuid bit is set on Lynis binary
 - New function: DisplayWarning - show a warning on the screen
 - New function: Equals - compare two strings
+- New function: GetReportData - retrieve earlier stored data
 - New function: Readonly - mark variable read-only (security)
 - New function: SafeFile - test file type and call permission check
 - New function: SafeInput - check for safe input (security)
@@ -54,6 +55,7 @@ measures to further tighten any possible misuse.
 - SCHD-7702 - removed hardening points
 - SSH-7402 - detect other SSH daemons like dropbear
 - SSH-7406 - strip OpenSSH patch version and remove characters (carriage return)
+- SSH-7408 - changed text in suggestion and report
 - Whow changelog works again for newer versions
 - systemd service file adjusted
 - bash completion script extended

From c1cf106d031e149406658a76e41267a19a7fcb01 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Jul 2019 19:05:57 +0200
Subject: [PATCH 208/679] Show location for Lynis package and new documentation

---
 include/helper_update | 4 +++-
 lynis                 | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/include/helper_update b/include/helper_update
index d15ac5ef..dedbed4d 100644
--- a/include/helper_update
+++ b/include/helper_update
@@ -77,7 +77,9 @@ elif [ "$1" = "info" ]; then
             echo "${GREEN}Up-to-date${NORMAL}"
         fi
         echo "  Release date       : ${PROGRAM_RELEASE_DATE}"
-        echo "  Update location    : ${PROGRAM_WEBSITE}"
+        echo "  Project page       : ${PROGRAM_WEBSITE}"
+        echo "  Source code        : ${PROGRAM_SOURCE}"
+        echo "  Latest package     : ${PROGRAM_PACKAGE}"
         echo ""; echo ""
         echo "${PROGRAM_COPYRIGHT}"
         echo ""
diff --git a/lynis b/lynis
index 1324b4d5..8476efe0 100755
--- a/lynis
+++ b/lynis
@@ -40,6 +40,7 @@
     PROGRAM_NAME="Lynis"
     PROGRAM_AUTHOR="CISOfy"
     PROGRAM_AUTHOR_CONTACT="lynis-dev@cisofy.com"
+    PROGRAM_WEBSITE="https://cisofy.com/lynis/"
 
     # Version details
     PROGRAM_RELEASE_DATE="2019-07-14"
@@ -49,7 +50,8 @@
 
     # Source, documentation and license
     PROGRAM_SOURCE="https://github.com/CISOfy/lynis"
-    PROGRAM_WEBSITE="https://cisofy.com/lynis/"
+    PROGRAM_PACKAGE="https://packages.cisofy.com/"
+    PROGRAM_DOCUMENTATION="https://cisofy.com/docs/"
     PROGRAM_COPYRIGHT="2007-2019, ${PROGRAM_AUTHOR} - ${PROGRAM_WEBSITE}"
     PROGRAM_LICENSE="${PROGRAM_NAME} comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
   welcome to redistribute it under the terms of the GNU General Public License.

From 07185a0ac2716775d9f56600c757e56ccf9d60ee Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Jul 2019 19:12:37 +0200
Subject: [PATCH 209/679] Updated with missing entries and minor changes

---
 lynis.8 | 36 +++++++++++++++++-------------------
 1 file changed, 17 insertions(+), 19 deletions(-)

diff --git a/lynis.8 b/lynis.8
index 1c65a7b5..b4fba8ff 100644
--- a/lynis.8
+++ b/lynis.8
@@ -1,4 +1,4 @@
-.TH Lynis 8 "27 Aug 2018" "1.27" "Unix System Administrator's Manual"
+.TH Lynis 8 "15 Jul 2019" "1.28" "Unix System Administrator's Manual"
 
 
 .SH "NAME"
@@ -41,17 +41,11 @@ When running \fBLynis\fP for the first time, run: lynis audit system
 .SH "COMMANDS"
 .IP "audit \<type\>"
 Perform an audit of the selected type
-.IP "configure \<parameters\>"
-Change or add settings to the config file
-.IP "generate \<parameter\>"
-Generate specific details such as host IDs
-.IP "show \<parameter\>"
-Show information, such as configuration and paths
-.IP "update \<parameter\>"
-Perform activities regarding updating
 .IP "upload-only"
 Upload the available report data file
 
+See HELPERS section for more commands.
+
 .SH "SCAN TYPES"
 
 .IP "audit system"
@@ -76,7 +70,7 @@ breaks).
 Display debug information to screen for troubleshooting purposes.
 .TP
 .B \-\-developer
-Display developer information when creating tests.
+Display detailed information useful for developers when creating tests.
 .TP
 .B \-\-help
 Show available commands and most-used options.
@@ -91,7 +85,7 @@ Show the man page. Useful for systems that do not have the man page installed.
 Disable colored output.
 .TP
 .B \-\-no\-log
-Redirect all logging information to /dev/null, prevent sensitive information to
+Redirect all logging information to /dev/null, prevents sensitive information to
 be written to disk.
 .TP
 .B \-\-pentest
@@ -105,7 +99,7 @@ Define location where plugins can be found.
 Provide alternative profile to perform the scan.
 .TP
 .B \-\-quick (\-Q)
-Do a quick scan (don't wait for user input).
+Do a quick scan (default: don't wait for user input).
 .TP
 .B \-\-quiet (\-q)
 Run quietly and do not show anything to the screen. Will also enable quick mode.
@@ -159,12 +153,16 @@ file. This speeds up execution and keeps the code clean.
 
 .IP "audit"
 Run audit on the system or on other targets
-.IP "show"
-Provide details about Lynis
-.IP "update"
-Run updater utility
+.IP "configure \<parameter\>"
+Change or add settings to the config file
+.IP "generate \<parameter\>"
+Generate specific details such as host IDs
+.IP "show \<parameter\>"
+Show information, such as configuration and paths
+.IP "update \<parameter\>"
+Perform activities regarding updating
 .PP
-To use a helper, run Lynis followed by the helper name.
+To use a helper, run 'lynis' followed by the helper name.
 
 .SH "EXIT CODES"
 Lynis uses exit codes to signal any invoking script. Currently the following codes are used:
@@ -182,13 +180,13 @@ Can't open file or directory
 Lynis found 1 or more warnings or configurations errors (with error-on-warnings=yes)
 
 .SH "BUGS"
-Bugs can be reported via GitHub at https://github.com/CISOfy/lynis
+Bugs can be reported via GitHub at https://github.com/CISOfy/lynis or via support@cisofy.com
 
 .SH "DOCUMENTATION"
 Supporting documentation can be found via https://cisofy.com/support/
 
 .SH "LICENSING"
-Lynis is licensed as GPLv3. It was created by Michael Boelen in 2007. Development has been taken over by CISOfy. Plugins may have a different license.
+Lynis is licensed as GPLv3. It was created by Michael Boelen in 2007. Since 2013 its development has been taken over by CISOfy under the management of Michael Boelen. Plugins may have a different license.
 
 .SH "CONTACT INFORMATION"
 Support requests and project related questions can be addressed via e-mail: lynis-dev@cisofy.com.

From 0d21ba5e52f45e6929e239c2d33e5c7c3ea85bf5 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Jul 2019 19:12:46 +0200
Subject: [PATCH 210/679] Updated log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 47215980..687b448e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -56,9 +56,11 @@ measures to further tighten any possible misuse.
 - SSH-7402 - detect other SSH daemons like dropbear
 - SSH-7406 - strip OpenSSH patch version and remove characters (carriage return)
 - SSH-7408 - changed text in suggestion and report
+- Extended output of 'lynis update info'
 - Show changelog works again for newer versions
 - systemd service file adjusted
 - bash completion script extended
+- Updated man page
 
 ---------------------------------------------------------------------------------
 

From 2e7c6c781677d7dd017b64a9c44e51347429bb9c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Jul 2019 19:34:37 +0200
Subject: [PATCH 211/679] [FINT-4328] correct text in log

---
 include/tests_file_integrity | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/include/tests_file_integrity b/include/tests_file_integrity
index b6ae7950..da578971 100644
--- a/include/tests_file_integrity
+++ b/include/tests_file_integrity
@@ -161,15 +161,14 @@
     Register --test-no FINT-4328 --weight L --network NO --category security --description "OSSEC syscheck daemon running"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking if OSSEC syscheck daemon is running"
-        IsRunning ossec-syscheckd
-        if [ ${RUNNING} -eq 1 ]; then
-            LogText "Result: syscheck (OSSEC) installed"
+        if IsRunning "ossec-syscheckd"; then
+            LogText "Result: syscheck (OSSEC) active"
             Report "file_integrity_tool[]=ossec"
             FILE_INT_TOOL="ossec-syscheck"
             FILE_INT_TOOL_FOUND=1
             Display --indent 4 --text "- OSSEC (syscheck)" --result "${STATUS_FOUND}" --color GREEN
         else
-            LogText "Result: syscheck (OSSEC) not installed"
+            LogText "Result: syscheck (OSSEC) is not active"
             if IsVerbose; then Display --indent 4 --text "- OSSEC" --result "${STATUS_NOT_FOUND}" --color WHITE; fi
         fi
     fi

From 455fc26bf7dc243f7cf580107a34c7602671a886 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Jul 2019 19:39:04 +0200
Subject: [PATCH 212/679] Small code enhancements

---
 include/tests_file_integrity | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/include/tests_file_integrity b/include/tests_file_integrity
index da578971..097cb138 100644
--- a/include/tests_file_integrity
+++ b/include/tests_file_integrity
@@ -35,7 +35,7 @@
     Register --test-no FINT-4310 --weight L --network NO --category security --description "AFICK availability"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking AFICK binary"
-        if [ ! -z "${AFICKBINARY}" ]; then
+        if [ -n "${AFICKBINARY}" ]; then
             LogText "Result: AFICK is installed (${AFICKBINARY})"
             Report "file_integrity_tool[]=afick"
             FILE_INT_TOOL="afick"
@@ -54,7 +54,7 @@
     Register --test-no FINT-4314 --weight L --network NO --category security --description "AIDE availability"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking AIDE binary"
-        if [ ! -z "${AIDEBINARY}" ]; then
+        if [ -n "${AIDEBINARY}" ]; then
             LogText "Result: AIDE is installed (${AIDEBINARY})"
             Report "file_integrity_tool[]=aide"
             FILE_INT_TOOL="aide"
@@ -73,10 +73,10 @@
     if [ ! -z "${AIDEBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no FINT-4315 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check AIDE configuration file"
     if [ ${SKIPTEST} -eq 0 ]; then
-        AIDE_CONFIG_LOCS="/etc /etc/aide /usr/local/etc"
+        AIDE_CONFIG_LOCS="${ROOTDIR}etc ${ROOTDIR}etc/aide ${ROOTDIR}usr/local/etc"
         LogText "Test: search for aide.conf in ${AIDE_CONFIG_LOCS}"
         for I in ${AIDE_CONFIG_LOCS}; do
-            if [ -f ${I}/aide.conf ]; then
+            if [ -f "${I}/aide.conf" ]; then
                 LogText "Result: found aide.conf in directory ${I}"
                 AIDECONFIG="${I}/aide.conf"
             fi
@@ -181,7 +181,7 @@
     Register --test-no FINT-4330 --weight L --network NO --category security --description "mtree availability"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking mtree binary"
-        if [ ! -z "${MTREEBINARY}" ]; then
+        if [ -n "${MTREEBINARY}" ]; then
             LogText "Result: mtree is installed (${MTREEBINARY})"
             Report "file_integrity_tool[]=mtree"
             FILE_INT_TOOL="mtree"
@@ -201,8 +201,7 @@
     Register --test-no FINT-4334 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check lfd daemon status"
     if [ ${SKIPTEST} -eq 0 ]; then
         Display --indent 4 --text "- lfd (CSF)" --result "${STATUS_FOUND}" --color GREEN
-        IsRunning 'lfd '
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning 'lfd '; then
             LogText "Result: lfd daemon is running (CSF)"
             Report "file_integrity_tool[]=csf-lfd"
             Display --indent 6 --text "- LFD (CSF) daemon" --result "${STATUS_RUNNING}" --color GREEN
@@ -222,7 +221,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # LFD configuration parameters
         ENABLED=$(${GREPBINARY} "^LF_DAEMON = \"1\"" ${CSF_CONFIG})
-        if [ ! -z "${ENABLED}" ]; then
+        if [ -n "${ENABLED}" ]; then
             LogText "Result: lfd service is configured to run"
             Display --indent 6 --text "- Configuration status" --result "${STATUS_ENABLED}" --color GREEN
         else
@@ -252,8 +251,7 @@
     Register --test-no FINT-4338 --weight L --network NO --category security --description "osqueryd syscheck daemon running"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking if osqueryd syscheck daemon is running"
-        IsRunning osqueryd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "osqueryd"; then
             LogText "Result: syscheck (osquery) installed"
             Report "file_integrity_tool[]=osquery"
             FILE_INT_TOOL="osquery"

From b1937029fe92c522f830a5d2d6795d682f6d4dbc Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Jul 2019 19:39:14 +0200
Subject: [PATCH 213/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 687b448e..82207299 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -44,6 +44,7 @@ measures to further tighten any possible misuse.
 - Security: the 'nounset' (set -u) parameter is now activated by default
 - Use only locations from PATH environment variable, unless it is not defined
 - Show 'lynis generate hostids' when they are missing
+- FINT-4328 - corrected text in log
 - INSE-8116 - added rsync service
 - INSE-8342 - renamed to INSE-8304
 - KRNL-5820 - extended check to include limits.d directory

From 7ec81715aab4e92d88c3ac1df0460230e713fe59 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Jul 2019 19:57:23 +0200
Subject: [PATCH 214/679] Minor cleanup

---
 include/tests_usb | 37 ++++++++++++++++++-------------------
 1 file changed, 18 insertions(+), 19 deletions(-)

diff --git a/include/tests_usb b/include/tests_usb
index 6c874364..4f5eff59 100644
--- a/include/tests_usb
+++ b/include/tests_usb
@@ -130,7 +130,6 @@
 #
 #################################################################################
 #
-
     # Test        : USB-3000
     # Description : Perform USBGuard check
     Register --test-no USB-3000  --os Linux --weight L --network NO --category security --description "Check for presence of USBGuard"
@@ -141,8 +140,8 @@
             AddHP 1 1
 
             LogText "Checking USBGuard configuration file"
-            if [ -f /etc/usbguard/usbguard-daemon.conf ]; then
-                USBGUARD_CONFIG="/etc/usbguard/usbguard-daemon.conf"
+            if [ -f ${ROOTDIR}etc/usbguard/usbguard-daemon.conf ]; then
+                USBGUARD_CONFIG="${ROOTDIR}etc/usbguard/usbguard-daemon.conf"
             else
                 USBGUARD_CONFIG=""
             fi
@@ -160,7 +159,7 @@
                         "true")
                             Display --indent 6 --text "- Restore controller device state" --result "${USBGUARD_RESTORE_POLICY}" --color YELLOW
                             LogText "  Consider changing RestoreControllerDeviceState to \"false\""
-                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # TODO: assign TEST_NO, create documentation, and enable the suggestion
                             # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "RestoreControllerDeviceState (${USBGUARD_RESTORE_POLICY} --> false)"
                             AddHP 0 1
                             ;;
@@ -171,7 +170,7 @@
                         *)
                             LogText "Result: Invalid configuration for RestoreControllerDeviceState"
                             Display --indent 6 --text "- Restore controller device state" --result "Invalid" --color RED
-                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # TODO: assign TEST_NO, create documentation, and enable the suggestion
                             # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "RestoreControllerDeviceState invalid \"${USBGUARD_RESTORE_POLICY}\""
                             AddHP 0 1
                             ;;
@@ -188,21 +187,21 @@
                 if [ ! -z "${USBGUARD_CONTROLLER_POLICY}" ]; then
                     LogText "Result: PresentControllerPolicy = ${USBGUARD_CONTROLLER_POLICY}"
                     case "${USBGUARD_CONTROLLER_POLICY}" in
-                        "allow"|"keep")
+                        "allow" | "keep")
                             Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "${USBGUARD_CONTROLLER_POLICY}" --color YELLOW
                             LogText "  Consider changing PresentControllerPolicy to \"apply-policy\", \"block\" or \"reject\""
-                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # TODO: assign TEST_NO, create documentation, and enable the suggestion
                             # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "PresentControllerPolicy (${USBGUARD_CONTROLLER_POLICY} --> (apply-policy|block|reject)"
                             AddHP 0 1
                             ;;
-                        "apply-policy"|"block"|"reject")
+                        "apply-policy" | "block" | "reject")
                             Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "${USBGUARD_CONTROLLER_POLICY}" --color GREEN
                             AddHP 1 1
                             ;;
                         *)
                             LogText "Result: Invalid configuration for PresentControllerPolicy"
                             Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "Invalid" --color RED
-                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # TODO: assign TEST_NO, create documentation, and enable the suggestion
                             # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "PresentControllerPolicy invalid \"${USBGUARD_CONTROLLER_POLICY}\""
                             AddHP 0 1
                             ;;
@@ -218,21 +217,21 @@
                 if [ ! -z "${USBGUARD_DEVICE_POLICY}" ]; then
                     LogText "Result: PresentDevicePolicy = ${USBGUARD_DEVICE_POLICY}"
                     case "${USBGUARD_DEVICE_POLICY}" in
-                        "allow"|"keep")
+                        "allow" | "keep")
                             Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "${USBGUARD_DEVICE_POLICY}" --color YELLOW
                             LogText "  Consider changing PresentDevicePolicy to \"apply-policy\", \"block\" or \"reject\""
-                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # TODO: assign TEST_NO, create documentation, and enable the suggestion
                             # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "PresentDevicePolicy (${USBGUARD_DEVICE_POLICY} --> (apply-policy|block|reject)"
                             AddHP 0 1
                             ;;
-                        "apply-policy"|"block"|"reject")
+                        "apply-policy" | "block" | "reject")
                             Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "${USBGUARD_DEVICE_POLICY}" --color GREEN
                             AddHP 1 1
                             ;;
                         *)
                             LogText "Result: Invalid configuration for PresentDevicePolicy"
                             Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "Invalid" --color RED
-                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # TODO: assign TEST_NO, create documentation, and enable the suggestion
                             # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "PresentDevicePolicy invalid \"${USBGUARD_DEVICE_POLICY}\""
                             AddHP 0 1
                             ;;
@@ -248,21 +247,21 @@
                 if [ ! -z "${USBGUARD_INSERTED_POLICY}" ]; then
                     LogText "Result: InsertedDevicePolicy = ${USBGUARD_INSERTED_POLICY}"
                     case "${USBGUARD_INSERTED_POLICY}" in
-                        "allow"|"keep")
+                        "allow" | "keep")
                             Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "${USBGUARD_INSERTED_POLICY}" --color YELLOW
                             LogText "  Consider changing InsertedDevicePolicy to \"apply-policy\", \"block\" or \"reject\""
-                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # TODO: assign TEST_NO, create documentation, and enable the suggestion
                             # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "InsertedDevicePolicy (${USBGUARD_INSERTED_POLICY} --> (apply-policy|block|reject)"
                             AddHP 0 1
                             ;;
-                        "apply-policy"|"block"|"reject")
+                        "apply-policy" | "block" | "reject")
                             Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "${USBGUARD_INSERTED_POLICY}" --color GREEN
                             AddHP 1 1
                             ;;
                         *)
                             LogText "Result: Invalid configuration for InsertedDevicePolicy"
                             Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "Invalid" --color RED
-                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # TODO: assign TEST_NO, create documentation, and enable the suggestion
                             # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "InsertedDevicePolicy invalid \"${USBGUARD_INSERTED_POLICY}\""
                             AddHP 0 1
                             ;;
@@ -281,7 +280,7 @@
                         "allow")
                             Display --indent 6 --text "- Rule for devices not in RuleFile" --result "${USBGUARD_DEFAULT_POLICY}" --color YELLOW
                             LogText "  Consider changing ImplicitPolicyTarget to \"block\" or \"reject\""
-                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # TODO: assign TEST_NO, create documentation, and enable the suggestion
                             # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "ImplicitPolicyTarget (${USBGUARD_DEFAULT_POLICY} --> (block|reject)"
                             AddHP 0 1
                             ;;
@@ -292,7 +291,7 @@
                         *)
                             LogText "Result: Invalid configuration for ImplicitPolicyTarget"
                             Display --indent 6 --text "- Rule for devices not in RuleFile" --result "Invalid" --color RED
-                            # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
+                            # TODO: assign TEST_NO, create documentation, and enable the suggestion
                             # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "ImplicitPolicyTarget invalid \"${USBGUARD_DEFAULT_POLICY}\""
                             AddHP 0 1
                             ;;

From 52610e1abed9234cb7162bfe2f8f1ebfa711fc63 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Jul 2019 20:00:14 +0200
Subject: [PATCH 215/679] [STRG-1842] renamed to USB-2000

---
 include/tests_usb | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/tests_usb b/include/tests_usb
index 4f5eff59..ef92efd2 100644
--- a/include/tests_usb
+++ b/include/tests_usb
@@ -87,15 +87,15 @@
 #
 #################################################################################
 #
-    # Test        : STRG-1842 (future ID: USB-2000)
+    # Test        : USB-2000 (was STRG-1842)
     # Description : Check USB authorizations
-    Register --test-no STRG-1842 --os Linux --weight L --network NO --category security --description "Check USB authorizations"
+    Register --test-no USB-2000 --os Linux --weight L --network NO --category security --description "Check USB authorizations"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking USB devices authorization to connect to the system"
         FOUND=0
-        USBDEVICESPATH="/sys/bus/usb/devices/usb"
+        USBDEVICESPATH="${ROOTDIR}sys/bus/usb/devices/usb"
         for device in "${USBDEVICESPATH}"*; do
-            if [ -e "${device}/authorized" ] || [ -e "${device}/authorized_default" ]; then
+            if [ -e "${device}/authorized" -o -e "${device}/authorized_default" ]; then
                 if [ $(cat "${device}/authorized_default") -eq 1 ]; then
                     FOUND=1
                     LogText "Test: ${device} is authorized by default"

From f8564f29230b52ecb80b15677876604eb8afe6d7 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Jul 2019 20:04:38 +0200
Subject: [PATCH 216/679] [STRG-1840] renamed to USB-1000

---
 include/tests_usb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_usb b/include/tests_usb
index ef92efd2..eada5d12 100644
--- a/include/tests_usb
+++ b/include/tests_usb
@@ -45,9 +45,9 @@
 #
 #################################################################################
 #
-    # Test        : STRG-1840 (future ID: USB-1200)
+    # Test        : USB-1000 (was STRG-1840)
     # Description : Check for disabled USB storage
-    Register --test-no STRG-1840 --os Linux --weight L --network NO --category security --description "Check if USB storage is disabled"
+    Register --test-no USB-1000 --os Linux --weight L --network NO --category security --description "Check if USB storage is disabled"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
         LogText "Test: Checking USB storage driver in directory /etc/modprobe.d and configuration file /etc/modprobe.conf"

From 27b2a4dc7a4c1a3cbcb775e9b35810e2b075a2c6 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Jul 2019 20:04:59 +0200
Subject: [PATCH 217/679] Renamed STRG-1840 and STRG-1842

---
 db/tests.db | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/db/tests.db b/db/tests.db
index 56faba09..ec7dfde6 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -375,8 +375,6 @@ SSH-7404:test:security:ssh::Check SSH daemon file location:
 SSH-7406:test:security:ssh::Detection of OpenSSH server version:
 SSH-7408:test:security:ssh::Check SSH specific defined options:
 SSH-7440:test:security:ssh::AllowUsers and AllowGroups:
-STRG-1840:test:security:storage:Linux:Check if USB storage is disabled:
-STRG-1842:test:security:storage:Linux:Check USB authorizations:
 STRG-1846:test:security:storage:Linux:Check if firewire storage is disabled:
 STRG-1902:test:security:storage_nfs::Check rpcinfo registered programs:
 STRG-1904:test:security:storage_nfs::Check nfs rpc:
@@ -404,5 +402,7 @@ TOOL-5120:test:security:tooling::Presence of Snort IDS:
 TOOL-5122:test:security:tooling::Snort IDS configuration file:
 TOOL-5160:test:security:tooling::Check for active OSSEC analysis daemon:
 TOOL-5190:test:security:tooling::Check presence of available IDS/IPS tooling:
+USB-1000:test:security:storage:Linux:Check if USB storage is disabled:
+USB-2000:test:security:storage:Linux:Check USB authorizations:
 USB-3000:test:security:storage:Linux:Check for presence of USBGuard:
 # EOF

From 95db1dc145faf570738fa274671aaaf36981926a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 15 Jul 2019 20:05:08 +0200
Subject: [PATCH 218/679] Updated log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 82207299..419c1885 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -57,6 +57,8 @@ measures to further tighten any possible misuse.
 - SSH-7402 - detect other SSH daemons like dropbear
 - SSH-7406 - strip OpenSSH patch version and remove characters (carriage return)
 - SSH-7408 - changed text in suggestion and report
+- STRG-1840 - renamed to USB-1000
+- STRG-1842 - added default authorized devices and renamed to USB-2000
 - Extended output of 'lynis update info'
 - Show changelog works again for newer versions
 - systemd service file adjusted

From 2e192788bbece6ec4c0902eb4059cdf8b9ac74ba Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 16 Jul 2019 13:12:17 +0200
Subject: [PATCH 219/679] Added new tests INSE-8318 and INSE-8320

---
 include/tests_insecure_services | 63 +++++++++++++++++++++++++++------
 1 file changed, 53 insertions(+), 10 deletions(-)

diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index c446705f..c958d432 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -404,12 +404,11 @@
         LogText "Test: Checking if NIS client is installed"
         PACKAGES="nis ypbind"
         for PACKAGE in ${PACKAGES}; do
-            PackageIsInstalled "${PACKAGE}"
-            if [ $? -eq 0 ]; then
+            if PackageIsInstalled "${PACKAGE}"; then
                 FOUND="${PACKAGE}"
             fi
         done
-        if [ ${FOUND} ]; then
+        if [ -n "${FOUND}" ]; then
             LogText "Result: NIS client is installed"
             Display --indent 2 --text "- Checking NIS client installation" --result "${STATUS_SUGGESTION}" --color YELLOW
             ReportSuggestion ${TEST_NO} "NIS client should be removed as it contains numerous security exposures and have been replaced with the more secure SSH package"
@@ -429,12 +428,11 @@
         LogText "Test: Checking if NIS server is installed"
         PACKAGES="nis ypserv"
         for PACKAGE in ${PACKAGES}; do
-            PackageIsInstalled "${PACKAGE}"
-            if [ $? -eq 0 ]; then
+            if PackageIsInstalled "${PACKAGE}"
                 FOUND="${PACKAGE}"
             fi
         done
-        if [ ${FOUND} ]; then
+        if [ -n "${FOUND}" ]; then
             LogText "Result: NIS server is installed"
             Display --indent 2 --text "- Checking NIS server installation" --result "${STATUS_SUGGESTION}" --color YELLOW
             ReportSuggestion ${TEST_NO} "Removing the ${FOUND} package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services"
@@ -445,13 +443,61 @@
     fi
 #
 #################################################################################
+#
+    # Test        : INSE-8318
+    # Description : Check if TFTP client is installed
+    Register --test-no INSE-8318 --weight L --network NO --category security --description "Check if TFTP client is installed"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: Checking if TFTP client is installed"
+        FOUND=""
+        PACKAGES="atftp tftp tftp-hpa"
+        for PACKAGE in ${PACKAGES}; do
+            if PackageIsInstalled "${PACKAGE}"; then
+                FOUND="${PACKAGE}"
+            fi
+        done
+        if [ -n "${FOUND}" ]; then
+            LogText "Result: TFTP client is installed"
+            Display --indent 2 --text "- Checking TFTP client installation" --result "${STATUS_SUGGESTION}" --color YELLOW
+            ReportSuggestion ${TEST_NO} "It is recommended that TFTP be removed, unless there is a specific need for TFTP (such as a boot server)"
+        else
+            LogText "Result: TFTP client is NOT installed"
+            Display --indent 2 --text "- Checking TFTP client installation" --result "${STATUS_OK}" --color GREEN
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : INSE-8320
+    # Description : Check if TFTP server is installed
+    Register --test-no INSE-8320 --weight L --network NO --category security --description "Check if TFTP server is installed"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: Checking if TFTP server is installed"
+        FOUND=""
+        PACKAGES="atftpd tftpd tftp-server tftpd-hpa"
+        for PACKAGE in ${PACKAGES}; do
+            if PackageIsInstalled ${PACKAGE}; then
+                FOUND="${PACKAGE}"
+            fi
+        done
+        if [ -n "${FOUND}" ]; then
+            LogText "Result: TFTP server is installed"
+            Display --indent 2 --text "- Checking TFTP server installation" --result "${STATUS_SUGGESTION}" --color YELLOW
+            ReportSuggestion ${TEST_NO} "Removing the ${FOUND} package decreases the risk of the accidental (or intentional) activation of tftp services"
+        else
+            LogText "Result: TFTP server is NOT installed"
+            Display --indent 2 --text "- Checking TFTP server installation" --result "${STATUS_OK}" --color GREEN
+        fi
+    fi
+#
+#################################################################################
 #
     if [ ! -z "${LAUNCHCTL_BINARY}" ]; then PREQS_MET="YES"; SKIPREASON=""; else PREQS_MET="NO"; SKIPREASON="No launchctl binary on this system"; fi
     Register --test-no INSE-8050 --os "macOS" --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight M --network NO --category security --description "Check for insecure services on macOS"
     if [ ${SKIPTEST} -eq 0 ]; then
         TEST_SERVICES="com.apple.fingerd"
         for ITEM in ${TEST_SERVICES}; do
-            if ${LAUNCHCTL_BINARY} print-enabled system | grep -sq ${ITEM}; then
+            if ${LAUNCHCTL_BINARY} print-enabled system | ${GREPBINARY} -sq ${ITEM}; then
                 Display --indent 2 --text "- $text" --result "${STATUS_NO}" --color RED
                 LogText "Result: found ${ITEM}, which is considered an insecure service"
                 AddSuggestion "${TEST_NO}" "Consider disabling service ${ITEM}" "launchctl" "-"
@@ -467,9 +513,6 @@
 #################################################################################
 #
 
-# To do:
-# - mark in report when a system was tested for any insecure services
-
 WaitForKeyPress
 
 #

From a12aaa2d3a0ccc7f39937174f4fedd8727ab62fe Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 16 Jul 2019 13:13:15 +0200
Subject: [PATCH 220/679] Added quotes

---
 include/tests_insecure_services | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index c958d432..df616e56 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -476,7 +476,7 @@
         FOUND=""
         PACKAGES="atftpd tftpd tftp-server tftpd-hpa"
         for PACKAGE in ${PACKAGES}; do
-            if PackageIsInstalled ${PACKAGE}; then
+            if PackageIsInstalled "${PACKAGE}"; then
                 FOUND="${PACKAGE}"
             fi
         done

From 3213cadd5a389156a03d45c633ba6fdce9bfd30b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 16 Jul 2019 13:13:25 +0200
Subject: [PATCH 221/679] Added new tests INSE-8318 and INSE-8320

---
 db/tests.db | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/db/tests.db b/db/tests.db
index ec7dfde6..fe73dfc0 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -185,6 +185,8 @@ INSE-8310:test:security:insecure_services::Presence of telnet client:
 INSE-8312:test:security:insecure_services::Presence of telnet server:
 INSE-8314:test:security:insecure_services::Presence of NIS client:
 INSE-8316:test:security:insecure_services::Presence of NIS server:
+INSE-8318:test:security:insecure_services::Presence of TFTP client:
+INSE-8320:test:security:insecure_services::Presence of TFTP server:
 KRNL-5622:test:security:kernel:Linux:Determine Linux default run level:
 KRNL-5677:test:security:kernel:Linux:Check CPU options and support:
 KRNL-5695:test:security:kernel:Linux:Determine Linux kernel version and release number:

From 2777caf6d218aeb40c2ebd8af2564be8201eeff1 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 16 Jul 2019 13:13:35 +0200
Subject: [PATCH 222/679] Updated log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 419c1885..a1162fb5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -47,6 +47,8 @@ measures to further tighten any possible misuse.
 - FINT-4328 - corrected text in log
 - INSE-8116 - added rsync service
 - INSE-8342 - renamed to INSE-8304
+- INSE-8318 - test for TFTP client tools
+- INSE-8320 - test for TFTP server tools
 - KRNL-5820 - extended check to include limits.d directory
 - NAME-4408 - corrected Report function call
 - NETW-3032 - small rewrite of test and extended with addrwatch

From fa8bad20db100d95cf089b0b2d897c339327215c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 16 Jul 2019 13:20:30 +0200
Subject: [PATCH 223/679] Use -n instead of ! -z

---
 include/binaries                |  8 ++--
 include/functions               | 80 ++++++++++++++++-----------------
 include/helper_audit_dockerfile | 10 ++---
 include/helper_show             |  8 ++--
 include/osdetection             |  8 ++--
 include/profiles                | 34 +++++++-------
 include/report                  |  6 +--
 include/tests_accounting        | 26 +++++------
 include/tests_authentication    | 32 ++++++-------
 include/tests_boot_services     | 42 ++++++++---------
 include/tests_containers        |  8 ++--
 include/tests_crypto            |  2 +-
 include/tests_databases         | 10 ++---
 include/tests_dns               |  8 ++--
 include/tests_file_integrity    | 14 +++---
 include/tests_filesystems       | 32 ++++++-------
 include/tests_firewalls         | 26 +++++------
 include/tests_hardening         |  2 +-
 include/tests_homedirs          |  4 +-
 include/tests_insecure_services |  4 +-
 include/tests_kernel            | 16 +++----
 include/tests_kernel_hardening  |  6 +--
 include/tests_ldap              |  2 +-
 include/tests_logging           | 24 +++++-----
 include/tests_mac_frameworks    |  6 +--
 include/tests_mail_messaging    | 36 +++++++--------
 include/tests_malware           |  6 +--
 include/tests_nameservices      | 22 ++++-----
 include/tests_networking        | 34 +++++++-------
 include/tests_php               | 24 +++++-----
 include/tests_ports_packages    | 68 ++++++++++++++--------------
 include/tests_printers_spools   |  4 +-
 include/tests_scheduling        |  4 +-
 include/tests_shells            | 14 +++---
 include/tests_snmp              |  2 +-
 include/tests_squid             | 26 +++++------
 include/tests_ssh               | 16 +++----
 include/tests_storage           |  6 +--
 include/tests_storage_nfs       | 10 ++---
 include/tests_time              | 38 ++++++++--------
 include/tests_tooling           | 24 +++++-----
 include/tests_usb               | 22 ++++-----
 include/tests_webservers        | 26 +++++------
 include/tool_tips               |  2 +-
 lynis                           | 12 ++---
 45 files changed, 407 insertions(+), 407 deletions(-)

diff --git a/include/binaries b/include/binaries
index 0fbefe46..5812003f 100644
--- a/include/binaries
+++ b/include/binaries
@@ -49,7 +49,7 @@
 
         # Test if our PATH variable provides a set of paths. If so, reverse the order. If we discover the same binary
         # multiple times, the one first in PATH should be used.
-        if [ ! -z "${PATH}" ]; then
+        if [ -n "${PATH}" ]; then
             PATH_REVERSED=$(echo ${PATH} | awk -F: '{ for (i=NF; i>1; i--) printf("%s ",$i); print $1; }')
             BIN_PATHS=$(echo "${PATH_REVERSED}" | tr ':' ' ')
         fi
@@ -84,7 +84,7 @@
                     LogText "Result: directory exists, but is actually a symlink"
                     ShowSymlinkPath ${SCANDIR}
                     if [ ${FOUNDPATH} -eq 1 ]; then
-                        if [ ! -z "${SYMLINK}" -a -d ${SYMLINK} ]; then
+                        if [ -n "${SYMLINK}" -a -d ${SYMLINK} ]; then
                             # Set path to new location
                             LogText "Result: found the path behind this symlink (${SCANDIR} --> ${sFILE})"
                             ORGPATH="${SCANDIR}"
@@ -100,7 +100,7 @@
                 # Add a space to make sure we discover a related directory if it was already scanned
                 # The grep -v is to prevent a match /usr/bin in something like /usr/bin/core_perl
                 FIND=$(echo ${BINARY_PATHS_FOUND} | grep ", ${SCANDIR}" | grep -v ", ${SCANDIR}/")
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     SKIPDIR=1; LogText "Result: Skipping this directory as it was already scanned"
                 fi
 
@@ -273,7 +273,7 @@
                     done
                 else
                     LogText "Result: Directory ${SCANDIR} skipped"
-                    if [ ! -z "${ORGPATH}" ]; then TEXT="${ORGPATH} (links to ${SCANDIR})"; else TEXT="${SCANDIR}"; fi
+                    if [ -n "${ORGPATH}" ]; then TEXT="${ORGPATH} (links to ${SCANDIR})"; else TEXT="${SCANDIR}"; fi
                 fi
             else
                 LogText "Result: Directory ${SCANDIR} does NOT exist"
diff --git a/include/functions b/include/functions
index c8f689e7..80096f50 100644
--- a/include/functions
+++ b/include/functions
@@ -267,16 +267,16 @@
         if [ ${RUN_UPDATE_CHECK} -eq 1 ]; then
             LYNIS_LV_RECORD="lynis-latest-version.cisofy.com."
             FIND=$(which dig 2> /dev/null | grep -v "no [^ ]* in")
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 PROGRAM_LV=$(dig +short +time=3 -t txt lynis-latest-version.cisofy.com 2> /dev/null | grep -v "connection timed out" | sed 's/[".]//g' | grep "^[1-9][0-9][0-9]$")
             else
                 FIND=$(which host 2> /dev/null | grep -v "no [^ ]* in ")
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     PROGRAM_LV=$(host -t txt -W 3 lynis-latest-version.cisofy.com 2> /dev/null | grep -v "connection timed out" | awk '{ if ($1=="lynis-latest-version.cisofy.com" && $3=="text") { print $4 }}' | sed 's/"//g' | grep "^[1-9][0-9][0-9]$")
                     if [ "${PROGRAM_LV}" = "" ]; then PROGRAM_LV=0; fi
                 else
                     FIND=$(which drill 2> /dev/null | grep -v "no [^ ]* in ")
-                    if [ ! -z "${FIND}" ]; then
+                    if [ -n "${FIND}" ]; then
                         PROGRAM_LV=$(drill txt ${LYNIS_LV_RECORD} | awk '{ if ($1=="lynis-latest-version.cisofy.com." && $4=="TXT") { print $5 }}' | tr -d '"' | grep "^[1-9][0-9][0-9]$")
                         if [ -z "${PROGRAM_LV}" ]; then PROGRAM_LV=0; fi
                     else
@@ -530,7 +530,7 @@
             fi
         fi
 
-        if [ ! -z "${TEXT}" ]; then
+        if [ -n "${TEXT}" ]; then
             SHOW=0
             if [ ${SHOW_WARNINGS_ONLY} -eq 1 ]; then
                 if [ "${RESULT}" = "WARNING" ]; then SHOW=1; fi
@@ -571,7 +571,7 @@
         ${ECHOCMD} ""
         ${ECHOCMD} "${WARNING}Error${NORMAL}: ${BOLD}$1${NORMAL}"
         ${ECHOCMD} ""
-        if [ ! -z "${EXITCODE}" ]; then ExitCustom ${EXITCODE}; fi
+        if [ -n "${EXITCODE}" ]; then ExitCustom ${EXITCODE}; fi
     }
 
 
@@ -747,12 +747,12 @@
         exitcode=1
         file=$1
         find=""
-        if [ ! -z "${DPKGBINARY}" ]; then
+        if [ -n "${DPKGBINARY}" ]; then
             find=$(${DPKGBINARY} -S "${file}" 2> /dev/null | ${AWKBINARY} -F: '{print $1}')
-        elif [ ! -z "${RPMBINARY}" ]; then
+        elif [ -n "${RPMBINARY}" ]; then
             find=$(${RPMBINARY} -qf "${file}" 2> /dev/null | ${AWKBINARY} -F- '{print $1}')
         fi
-        if [ ! -z "${find}" ]; then
+        if [ -n "${find}" ]; then
             LogText "Result: file '${file}' belongs to package (${find})"
             exitcode=0
         else
@@ -805,7 +805,7 @@
         # Check for symlink
         if [ -L "${escaped_file}" ]; then
             ShowSymlinkPath ${escaped_file}
-            if [ ! -z "${SYMLINK}" ]; then escaped_file="${SYMLINK}"; fi
+            if [ -n "${SYMLINK}" ]; then escaped_file="${SYMLINK}"; fi
         fi
 
         # Only check the file if it isn't a symlink (after previous check)
@@ -863,7 +863,7 @@
             return 2
         fi
 
-        if [ ! -z "${HOSTID}" -a ! -z "${HOSTID2}" ]; then
+        if [ -n "${HOSTID}" -a -n "${HOSTID2}" ]; then
             Debug "Skipping creation of host identifiers, as they are already configured (via profile)"
             return 2
         fi
@@ -936,7 +936,7 @@
                 "HP-UX")
                     FIND=$(nwmgr -q info -c lan0 2> /dev/null | awk '{ if ($1=="MAC" && $2=="Address") { print $4 }}')
                     if HasData "${FIND}"; then
-                        if [ ! -z "${OPENSSLBINARY}" ]; then
+                        if [ -n "${OPENSSLBINARY}" ]; then
                             HOSTID=$(echo ${FIND} | ${OPENSSLBINARY} sha -sha1 | awk '{ print $2 }')
                         else
                             ReportException "GetHostID" "No openssl binary available on this HP-UX system"
@@ -954,7 +954,7 @@
                     # ip -br link show up | sort | awk '$2=="UP" && $3 ~ /^[a-f0-9][a-f0-9]:/ {print $3}'
 
                     # Use ifconfig
-                    if [ ! -z "${IFCONFIGBINARY}" ]; then
+                    if [ -n "${IFCONFIGBINARY}" ]; then
                         # Determine if we have the eth0 interface (not all Linux distro have this, e.g. Arch)
                         HASETH0=$(${IFCONFIGBINARY} | grep "^eth0")
                         # Check if we can find it with HWaddr on the line
@@ -982,7 +982,7 @@
                             fi
                         fi
 
-                    elif [ ! -z "${IPBINARY}" ]; then
+                    elif [ -n "${IPBINARY}" ]; then
                         # Determine if we have the common available eth0 interface
                         FIND=$(${IPBINARY} addr show eth0 2> /dev/null | egrep "link/ether " | head -1 | awk '{ print $2 }' | tr '[:upper:]' '[:lower:]')
                         if IsEmpty "${FIND}"; then
@@ -1015,10 +1015,10 @@
                         ReportException "GetHostID" "No MAC address returned on macOS"
                     fi
                     LYNIS_HOSTID2_PART1=$(hostname -s)
-                    if [ ! -z "${LYNIS_HOSTID2_PART1}" ]; then
+                    if [ -n "${LYNIS_HOSTID2_PART1}" ]; then
                         LogText "Info: using hostname ${LYNIS_HOSTID2_PART1}"
                         LYNIS_HOSTID2_PART2=$(sysctl -n kern.uuid 2> /dev/null)
-                        if [ ! -z "${LYNIS_HOSTID2_PART2}" ]; then
+                        if [ -n "${LYNIS_HOSTID2_PART2}" ]; then
                             LogText "Info: using UUID ${LYNIS_HOSTID2_PART2}"
                         else
                             LogText "Info: could not create HOSTID2 as kern.uuid sysctl key is missing"
@@ -1143,17 +1143,17 @@
             fi
 
             STRING_TO_HASH=""
-            if [ ${FOUND} -eq 1 -a ! -z "${DATA_SSH}" ]; then
+            if [ ${FOUND} -eq 1 -a -n "${DATA_SSH}" ]; then
                 LogText "Using SSH public key to create the second host identifier"
                 STRING_TO_HASH="${DATA_SSH}"
             else
-                if [ ! -z "${MACHINEID}" ]; then
+                if [ -n "${MACHINEID}" ]; then
                     LogText "Using the machine ID to create the second host identifier"
                     STRING_TO_HASH="${MACHINEID}"
                 fi
             fi
             # Check if we have a string to turn into a host identifier
-            if [ ! -z "${STRING_TO_HASH}" ]; then
+            if [ -n "${STRING_TO_HASH}" ]; then
                 # Create hashes
                 if [ ! "${SHA256SUMBINARY}" = "" ]; then
                     HASH2=$(echo ${STRING_TO_HASH} | ${SHA256SUMBINARY} | awk '{ print $1 }')
@@ -1172,7 +1172,7 @@
         if [ -z "${HOSTID}" ]; then
             ReportException "GetHostID" "No unique host identifier could be created."
             return 1
-        elif [ ! -z "${HOSTID2}" ]; then
+        elif [ -n "${HOSTID2}" ]; then
             return 0
         fi
     }
@@ -1228,7 +1228,7 @@
 
     HasData() {
         if [ $# -eq 1 ]; then
-            if [ ! -z "$1" ]; then return 0; else return 1; fi
+            if [ -n "$1" ]; then return 0; else return 1; fi
         else
             ExitFatal "Function HasData called without parameters - look in log to determine where this happened, or use sh -x lynis to see all details."
         fi
@@ -1386,7 +1386,7 @@
         if [ -z "${search}" ]; then ExitFatal "Missing process to search for when using IsRunning function"; fi
         RUNNING=0
         # AIX does not fully support pgrep options, so using ps instead
-        if [ ! -z "${PGREPBINARY}" -a ! "${OS}" = "AIX" ]; then
+        if [ -n "${PGREPBINARY}" -a ! "${OS}" = "AIX" ]; then
             FIND=$(${PGREPBINARY} ${pgrep_options} "${search}" | ${TRBINARY} '\n' ' ')
         else
             if [ -z "${PSOPTIONS}" ]; then
@@ -1402,7 +1402,7 @@
             FIND=$(${PSBINARY} ${PSOPTIONS} | egrep "( |/)${search}" | grep -v "grep")
         fi
 
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             RUNNING=1
             LogText "IsRunning: process '${search}' found (${FIND})"
             return 0
@@ -1421,7 +1421,7 @@
 
     IsNotebook() {
         FIND=$(which laptop-detect 2> /dev/null | grep -v "no [^ ]* in ")
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             Debug "Testing if we are a notebook"
             laptop-detect
             if [ $? -eq 0 ]; then SYSTEM_IS_NOTEBOOK=1; Debug "System is a notebook according to laptop-detect"
@@ -1535,7 +1535,7 @@
             if [ -x /usr/bin/systemd-detect-virt ]; then
                 LogText "Test: trying to guess virtualization technology with systemd-detect-virt"
                 FIND=$(/usr/bin/systemd-detect-virt)
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     LogText "Result: found ${FIND}"
                     SHORT="${FIND}"
                 fi
@@ -1552,7 +1552,7 @@
             if [ -x /usr/bin/lscpu ]; then
                 LogText "Test: trying to guess virtualization with lscpu"
                 FIND=$(lscpu | grep -i "^Hypervisor Vendor" | awk -F: '{ print $2 }' | sed 's/ //g')
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     LogText "Result: found ${FIND}"
                     SHORT="${FIND}"
                 else
@@ -1576,7 +1576,7 @@
             if [ ! "${DMIDECODE_BINARY}" = "" -a ${PRIVILEGED} -eq 1 ]; then
                 LogText "Test: trying to guess virtualization with dmidecode"
                 FIND=$(/usr/sbin/dmidecode -s system-product-name | awk '{ print $1 }')
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     LogText "Result: found ${FIND}"
                     SHORT="${FIND}"
                 else
@@ -1820,24 +1820,24 @@
             Fatal "Incorrect usage of PackageIsInstalled function"
         fi
 
-        if [ ! -z "${DNFBINARY}" ]; then
+        if [ -n "${DNFBINARY}" ]; then
             output=$(${DNFBINARY} --quiet --cacheonly --noplugins --assumeno info --installed ${package} > /dev/null 2>&1)
             exit_code=$?
-        elif [ ! -z "${DPKGBINARY}" ]; then
+        elif [ -n "${DPKGBINARY}" ]; then
             output=$(${DPKGBINARY} -l ${package} 2> /dev/null | ${GREPBINARY} "^ii")
             exit_code=$?
-        elif [ ! -z "${EQUERYBINARY}" ]; then
+        elif [ -n "${EQUERYBINARY}" ]; then
             output=$(${EQUERYBINARY} --quiet ${package} > /dev/null 2>&1)
             exit_code=$?  # 0=package installed, 3=package not installed
-        elif [ ! -z "${PKG_BINARY}" ]; then
+        elif [ -n "${PKG_BINARY}" ]; then
             output=$(${PKG_BINARY} -N info ${package} >/dev/null 2>&1)
             exit_code=$?  # 0=package installed, 70=invalid package
-        elif [ ! -z "${RPMBINARY}" ]; then
+        elif [ -n "${RPMBINARY}" ]; then
             output=$(${RPMBINARY} --quiet -q ${package} > /dev/null 2>&1)
             exit_code=$?
-        elif [ ! -z "${ZYPPERBINARY}" ]; then
+        elif [ -n "${ZYPPERBINARY}" ]; then
             output=$(${ZYPPERBINARY} --quiet --non-interactive search --installed -i ${PACKAGE} 2> /dev/null | grep "^i")
-            if [ ! -z "${output}" ]; then exit_code=0; else exit_code=1; fi
+            if [ -n "${output}" ]; then exit_code=0; else exit_code=1; fi
         else
             ReportException "PackageIsInstalled:01"
         fi
@@ -2363,7 +2363,7 @@
         if [ ${SKIPTEST} -eq 0 -a "${TEST_WEIGHT}" = "M" -a "${SCAN_TEST_MEDIUM}" = "NO" ]; then SKIPTEST=1; SKIPREASON="Test to system intensive for scan mode (M)"; fi
 
         # Test if our OS is the same as the requested OS (can be multiple values)
-        if [ ${SKIPTEST} -eq 0 -a ! -z "${TEST_NEED_OS}" ]; then
+        if [ ${SKIPTEST} -eq 0 -a -n "${TEST_NEED_OS}" ]; then
             HASMATCH=0
             for I in ${TEST_NEED_OS}; do
                 if [ "${I}" = "${OS}" ]; then HASMATCH=1; fi
@@ -2375,12 +2375,12 @@
         fi
 
         # Skip test when it belongs to another category (default is 'all')
-        if [ ${SKIPTEST} -eq 0 -a ! -z "${TEST_CATEGORY_TO_CHECK}" -a ! "${TEST_CATEGORY_TO_CHECK}" = "all" -a ! "${TEST_CATEGORY}" = "${TEST_CATEGORY_TO_CHECK}" ]; then
+        if [ ${SKIPTEST} -eq 0 -a -n "${TEST_CATEGORY_TO_CHECK}" -a ! "${TEST_CATEGORY_TO_CHECK}" = "all" -a ! "${TEST_CATEGORY}" = "${TEST_CATEGORY_TO_CHECK}" ]; then
             SKIPTEST=1; SKIPREASON="Incorrect category (${TEST_CATEGORY_TO_CHECK} only)"
         fi
 
         # Check for correct hardware platform
-        if [ ${SKIPTEST} -eq 0 -a ! -z "${TEST_NEED_PLATFORM}" -a ! "${HARDWARE}" = "${TEST_NEED_PLATFORM}" ]; then SKIPTEST=1; SKIPREASON="Incorrect hardware platform"; fi
+        if [ ${SKIPTEST} -eq 0 -a -n "${TEST_NEED_PLATFORM}" -a ! "${HARDWARE}" = "${TEST_NEED_PLATFORM}" ]; then SKIPTEST=1; SKIPREASON="Incorrect hardware platform"; fi
 
         # Not all prerequisites met, like missing tool
         if [ ${SKIPTEST} -eq 0 -a "${PREQS_MET}" = "NO" ]; then SKIPTEST=1; if [ -z "${SKIPREASON}" ]; then SKIPREASON="Prerequisites not met (ie missing tool, other type of Linux distribution)"; fi; fi
@@ -2462,7 +2462,7 @@
     # Remove PID file
     RemovePIDFile() {
         # Test if PIDFILE is defined, before checking file presence
-        if [ ! -z "${PIDFILE}" ]; then
+        if [ -n "${PIDFILE}" ]; then
             if [ -f "${PIDFILE}" ]; then
                 rm -f "${PIDFILE}"
                 LogText "PID file removed (${PIDFILE})"
@@ -2486,7 +2486,7 @@
             for FILE in ${TEMP_FILES}; do
                 # Temporary files should be in /tmp
                 TMPFILE=$(echo ${FILE} | egrep "^/tmp/lynis" | grep -v "\.\.")
-                if [ ! -z "${TMPFILE}" ]; then
+                if [ -n "${TMPFILE}" ]; then
                     if [ -f "${TMPFILE}" ]; then
                         LogText "Action: removing temporary file ${TMPFILE}"
                         rm -f "${TMPFILE}"
@@ -2887,7 +2887,7 @@
                 # Check if we can find the main type (with or without brackets)
                 LogText "Test: search string ${STRING} in file ${FILE}"
                 FIND=$(egrep "${STRING}" ${FILE})
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     LogText "Result: found search string '${STRING}'"
                     if [ ${MASK_LOG} -eq 0 ]; then LogText "Full string returned: ${FIND}"; fi
                     RETVAL=0
@@ -3285,7 +3285,7 @@
     ################################################################################
 
     ViewGroups() {
-        if [ ! -z "${INCLUDEDIR}" ]; then
+        if [ -n "${INCLUDEDIR}" ]; then
             for I in $(ls ${INCLUDEDIR}/tests_* | xargs -n 1 basename | sed 's/tests_//' | grep -v "custom.template"); do
               echo "${I}"
             done
diff --git a/include/helper_audit_dockerfile b/include/helper_audit_dockerfile
index 3d18556f..b3eff024 100644
--- a/include/helper_audit_dockerfile
+++ b/include/helper_audit_dockerfile
@@ -59,11 +59,11 @@ fi
         IS_ALPINE=$(echo ${IMAGE} | grep -i alpine)
         IS_LATEST=$(echo ${TAG} | grep -i latest)
 
-        if [ ! -z "${IS_DEBIAN}" ]; then IMAGE="debian"; fi
-        if [ ! -z "${IS_FEDORA}" ]; then IMAGE="fedora"; fi
-        if [ ! -z "${IS_UBUNTU}" ]; then IMAGE="ubuntu"; fi
-        if [ ! -z "${IS_ALPINE}" ]; then IMAGE="alpine"; fi
-        if [ ! -z "${IS_LATEST}" ]; then
+        if [ -n "${IS_DEBIAN}" ]; then IMAGE="debian"; fi
+        if [ -n "${IS_FEDORA}" ]; then IMAGE="fedora"; fi
+        if [ -n "${IS_UBUNTU}" ]; then IMAGE="ubuntu"; fi
+        if [ -n "${IS_ALPINE}" ]; then IMAGE="alpine"; fi
+        if [ -n "${IS_LATEST}" ]; then
             ReportWarning "dockerfile" "latest TAG used. Specifying a targeted OS image and version is better for reproducible results."
         fi
 
diff --git a/include/helper_show b/include/helper_show
index d1086378..8f906d99 100644
--- a/include/helper_show
+++ b/include/helper_show
@@ -154,7 +154,7 @@ if [ $# -gt 0 ]; then
                 # Check also for gzipped changelog
                 elif [ -f ${FILEPATH}/changelog.gz ]; then
                     ZCAT=$(which zcat 2> /dev/null | grep -v "no [^ ]* in ")
-                    if [ ! -z "${ZCAT}" ]; then
+                    if [ -n "${ZCAT}" ]; then
                         CreateTempFile
                         CHANGELOG="${TEMP_FILE}"
                         LogText "Result: found gzipped changelog in ${FILEPATH}"
@@ -164,9 +164,9 @@ if [ $# -gt 0 ]; then
                         DisplayError "Could not find zcat utility to use on gzipped changelog"
                     fi
                 fi
-                if [ ! -z "${CHANGELOG}" ]; then LogText "Result: found changelog file: ${CHANGELOG}"; break; fi
+                if [ -n "${CHANGELOG}" ]; then LogText "Result: found changelog file: ${CHANGELOG}"; break; fi
             done
-            if [ ! -z "${CHANGELOG}" ]; then
+            if [ -n "${CHANGELOG}" ]; then
                 SEARCH=$(sed 's/^## //' ${CHANGELOG} | grep -E "^${PROGRAM_NAME} ${SEARCH_VERSION}")
                 if [ $? -eq 0 ]; then
                     while read -r LINE; do
@@ -358,7 +358,7 @@ if [ $# -gt 0 ]; then
                 VALUE=$(echo ${LINE} | awk -F';' '{print $2}')
                 DESCRIPTION=$(echo ${LINE} | awk -F';' '{print $3}' | sed 's/:space:/ /g')
                 if [ -z "${VALUE}" -a ${CONFIGURED_ONLY_OUTPUT} -eq 0 ]; then VALUE="${GRAY}[not configured]${NORMAL}"; fi
-                if [ ! -z "${VALUE}" ]; then
+                if [ -n "${VALUE}" ]; then
                     if [ ${BRIEF_OUTPUT} -eq 0 ]; then ${ECHOCMD} "${GRAY}# ${DESCRIPTION}${NORMAL}"; fi
                     ${ECHOCMD} "${WHITE}${SETTING}${NORMAL}=${CYAN}${VALUE}${NORMAL}"
                     if [ ${BRIEF_OUTPUT} -eq 0 ]; then ${ECHOCMD} ""; fi
diff --git a/include/osdetection b/include/osdetection
index a6c18bb5..95f2e014 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -139,7 +139,7 @@
             # Generic
             if [ -e /etc/os-release ]; then
                 OS_ID=$(grep "^ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
-                if [ ! -z "${OS_ID}" ]; then
+                if [ -n "${OS_ID}" ]; then
                     case ${OS_ID} in
                         "arch")
                             LINUX_VERSION="Arch Linux"
@@ -513,14 +513,14 @@
     EOL=255
     EOL_DATE=""
     EOL_TIMESTAMP=0
-    if [ ! -z "${OS_VERSION}" ]; then
+    if [ -n "${OS_VERSION}" ]; then
         if [ -f "${DBDIR}/software-eol.db" ]; then
             FIND="${OS_FULLNAME}"
             EOL_TIMESTAMP=$(awk -v value="${FIND}" -F: '{if ($1=="os" && value ~ $2){print $4}}' ${DBDIR}/software-eol.db | head -n 1)
-            if [ ! -z "${EOL_TIMESTAMP}" ]; then
+            if [ -n "${EOL_TIMESTAMP}" ]; then
                 EOL_DATE=$(awk -v value="${FIND}" -F: '{if ($1=="os" && value ~ $2){print $3}}' ${DBDIR}/software-eol.db | head -n 1)
                 NOW=$(date "+%s")
-                if [ ! -z "${NOW}" ]; then
+                if [ -n "${NOW}" ]; then
                     if [ ${NOW} -gt ${EOL_TIMESTAMP} ]; then
                         EOL=1
                     else
diff --git a/include/profiles b/include/profiles
index ad5e6b07..e27c84cd 100644
--- a/include/profiles
+++ b/include/profiles
@@ -77,7 +77,7 @@
                 # Is Lynis Enterprise allowed to purge this system when it is becomes outdated?
                 allow-auto-purge)
                     FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$")
-                    if [ ! -z "${FIND}" ]; then
+                    if [ -n "${FIND}" ]; then
                         Report "allow-auto-purge=1"
                     else
                         Report "allow-auto-purge=0"
@@ -110,7 +110,7 @@
                     # Quick mode (SKIP_PLUGINS) might already be set outside profile, so store in different variable
                     SETTING_COLORS=1 # default is yes
                     FIND=$(echo "${VALUE}" | egrep "^(0|false|no)$") && COLORS=0
-                    if [ ! -z "${FIND}" ]; then SETTING_COLORS=0; RemoveColors; fi
+                    if [ -n "${FIND}" ]; then SETTING_COLORS=0; RemoveColors; fi
                     Debug "Colors set to ${SETTING_COLORS}"
                     AddSetting "colors" "${SETTING_COLORS}" "Colored screen output"
                     unset SETTING_COLORS
@@ -204,7 +204,7 @@
                 ;;
 
                 hostalias | host-alias)
-                    if [ ! -z "${VALUE}" ]; then Report "hostname_alias=${VALUE}"; fi
+                    if [ -n "${VALUE}" ]; then Report "hostname_alias=${VALUE}"; fi
                 ;;
 
                 hostid)
@@ -223,13 +223,13 @@
                 # Language
                 language | lang)
                     LogText "Language set via profile to '${VALUE}'"
-                    if [ ! -z "${VALUE}" ]; then LANGUAGE="${VALUE}"; fi
+                    if [ -n "${VALUE}" ]; then LANGUAGE="${VALUE}"; fi
                     AddSetting "language" "${LANGUAGE}" "Language"
                 ;;
 
                 # Lynis Enterprise license key
                 license-key | license_key)
-                    if [ ! -z "${VALUE}" ]; then
+                    if [ -n "${VALUE}" ]; then
                         LICENSE_KEY="${VALUE}"
                         Report "license_key=${VALUE}"
                     fi
@@ -291,7 +291,7 @@
                     # Quick mode might already be set outside profile, so store in different variable
                     SETTING_QUICK_MODE=1 # default is yes
                     FIND=$(echo "${VALUE}" | egrep "^(0|false|no)$") && QUICKMODE=0
-                    if [ ! -z "${FIND}" ]; then SETTING_QUICK_MODE=1; fi
+                    if [ -n "${FIND}" ]; then SETTING_QUICK_MODE=1; fi
                     Debug "Quickmode set to ${SETTING_QUICK_MODE}"
                     AddSetting "quick" "${SETTING_QUICK_MODE}" "Quick mode (non-interactive)"
                 ;;
@@ -300,7 +300,7 @@
                 refresh-repositories)
                     SETTING_REFRESH_REPOSITORIES=1 # default is yes
                     FIND=$(echo "${VALUE}" | egrep "^(0|false|no)$") && REFRESH_REPOSITORIES=0
-                    if [ ! -z "${FIND}" ]; then SETTING_REFRESH_REPOSITORIES=0; fi
+                    if [ -n "${FIND}" ]; then SETTING_REFRESH_REPOSITORIES=0; fi
                     Debug "Refreshing repositories set to ${SETTING_REFRESH_REPOSITORIES}"
                     AddSetting "refresh-repositories" "${SETTING_REFRESH_REPOSITORIES}" "Refresh repositories (for vulnerable package detection)"
                 ;;
@@ -309,7 +309,7 @@
                 show-report-solution)
                     SETTING_SHOW_REPORT_SOLUTION=${SHOW_REPORT_SOLUTION}
                     FIND=$(echo "${VALUE}" | egrep "^(0|false|no)$") && SHOW_REPORT_SOLUTION=0
-                    if [ ! -z "${FIND}" ]; then SETTING_SHOW_REPORT_SOLUTION=0; fi
+                    if [ -n "${FIND}" ]; then SETTING_SHOW_REPORT_SOLUTION=0; fi
                     Debug "Show report details (solution) set to ${SETTING_SHOW_REPORT_SOLUTION}"
                 ;;
 
@@ -317,7 +317,7 @@
                 show_tool_tips | show-tool-tips)
                     SETTING_SHOW_TOOL_TIPS=1 # default is yes
                     FIND=$(echo "${VALUE}" | egrep "^(0|false|no)$") && SHOW_TOOL_TIPS=0
-                    if [ ! -z "${FIND}" ]; then SETTING_SHOW_TOOL_TIPS=0; fi
+                    if [ -n "${FIND}" ]; then SETTING_SHOW_TOOL_TIPS=0; fi
                     Debug "Show tool tips set to ${SETTING_SHOW_TOOL_TIPS}"
                     AddSetting "show-tool-tips" "${SETTING_SHOW_TOOL_TIPS}" "Show tool tips"
                 ;;
@@ -336,7 +336,7 @@
                     # Skip plugins (SKIP_PLUGINS) might already be set, so store in different variable
                     SETTING_SKIP_PLUGINS=0 # default is no
                     FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SKIP_PLUGINS=1
-                    if [ ! -z "${FIND}" ]; then SETTING_SKIP_PLUGINS=1; fi
+                    if [ -n "${FIND}" ]; then SETTING_SKIP_PLUGINS=1; fi
                     Debug "Skip plugins is set to ${SETTING_SKIP_PLUGINS}"
                     AddSetting "skip-plugins" "${SETTING_SKIP_PLUGINS}" "Skip plugins"
                 ;;
@@ -374,17 +374,17 @@
 
                 # The name of the customer/client that uses this system
                 system-customer-name)
-                    if [ ! -z "${VALUE}" ]; then Report "system-customer-name=${VALUE}"; fi
+                    if [ -n "${VALUE}" ]; then Report "system-customer-name=${VALUE}"; fi
                 ;;
 
                 # The groups linked to a system (system-groups=customers,webservers,production)
                 system-groups)
-                    if [ ! -z "${VALUE}" ]; then Report "system-groups=${VALUE}"; fi
+                    if [ -n "${VALUE}" ]; then Report "system-groups=${VALUE}"; fi
                 ;;
 
                 # Tags (tags=db,production,ssn-1304)
                 tags)
-                    if [ ! -z "${VALUE}" ]; then Report "tags=${VALUE}"; fi
+                    if [ -n "${VALUE}" ]; then Report "tags=${VALUE}"; fi
                 ;;
 
                 # Define what kind of scan we are performing
@@ -399,7 +399,7 @@
                 upload)
                     SETTING_UPLOAD=no # default
                     FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && UPLOAD_DATA=1
-                    if [ ! -z "${FIND}" ]; then SETTING_UPLOAD=1; fi
+                    if [ -n "${FIND}" ]; then SETTING_UPLOAD=1; fi
                     Debug "Upload set to ${SETTING_UPLOAD}"
                     AddSetting "upload" "${SETTING_UPLOAD}" "Data upload after scanning"
                     unset SETTING_UPLOAD
@@ -499,12 +499,12 @@
 #################################################################################
 #
     SKIP_TESTS=$(echo ${SKIP_TESTS} | sed "s/^ //")
-    if [ ! -z "${SKIP_TESTS}" ]; then LogText "Skip tests: ${SKIP_TESTS}"; fi
+    if [ -n "${SKIP_TESTS}" ]; then LogText "Skip tests: ${SKIP_TESTS}"; fi
 #
 #################################################################################
 #
     # Add group name to report - deprecated
-    if [ ! -z "${GROUP_NAME}" ]; then Report "group=${GROUP_NAME}"; fi
+    if [ -n "${GROUP_NAME}" ]; then Report "group=${GROUP_NAME}"; fi
 #
 #################################################################################
 #
@@ -531,7 +531,7 @@
 #
 #################################################################################
 #
-    if [ ! -z "${DEPRECATED_OPTION}" ]; then
+    if [ -n "${DEPRECATED_OPTION}" ]; then
         ReportWarning "LYNIS" "One or more deprecated options used" "${DEPRECATED_OPTION}" "Update your profile"
     fi
 #
diff --git a/include/report b/include/report
index 88d75ce0..c340da53 100644
--- a/include/report
+++ b/include/report
@@ -31,7 +31,7 @@
     Report "firewall_empty_ruleset=${FIREWALL_EMPTY_RULESET}"
     Report "firewall_installed=${FIREWALL_ACTIVE}"
 
-    if [ ! -z "${INSTALLED_PACKAGES}" ]; then Report "installed_packages_array=${INSTALLED_PACKAGES}"; fi
+    if [ -n "${INSTALLED_PACKAGES}" ]; then Report "installed_packages_array=${INSTALLED_PACKAGES}"; fi
 
     Report "package_audit_tool=${PACKAGE_AUDIT_TOOL}"
     Report "package_audit_tool_found=${PACKAGE_AUDIT_TOOL_FOUND}"
@@ -139,7 +139,7 @@
                     done
                     IS_CUSTOM=$(echo ${ADDLINK} | grep "^CUST")
                     echo "  ${RED}!${NORMAL} ${SHOWWARNING}"
-                    if [ ! "${DETAILS}" = "-" -a ! -z "${DETAILS}" ]; then echo "    - Details  : ${CYAN}${DETAILS}${NORMAL}"; fi
+                    if [ ! "${DETAILS}" = "-" -a -n "${DETAILS}" ]; then echo "    - Details  : ${CYAN}${DETAILS}${NORMAL}"; fi
                     if [ ${SHOW_REPORT_SOLUTION} -eq 1 -a ! "${SOLUTION}" = "-" ]; then echo "    - Solution : ${SOLUTION}"; fi
                     if [ -z "${IS_CUSTOM}" ]; then
                         echo "      ${CONTROL_URL_PROTOCOL}://${CONTROL_URL_PREPEND}${ADDLINK}${CONTROL_URL_APPEND}"
@@ -172,7 +172,7 @@
                     done
                     IS_CUSTOM=$(echo ${ADDLINK} | grep "^CUST")
                     echo "  ${YELLOW}*${NORMAL} ${SHOWSUGGESTION}"
-                    if [ ! "${DETAILS}" = "-" -a ! -z "${DETAILS}" ]; then echo "    - Details  : ${CYAN}${DETAILS}${NORMAL}"; fi
+                    if [ ! "${DETAILS}" = "-" -a -n "${DETAILS}" ]; then echo "    - Details  : ${CYAN}${DETAILS}${NORMAL}"; fi
                     if [ ${SHOW_REPORT_SOLUTION} -eq 1 -a ! "${SOLUTION}" = "-" ]; then echo "    - Solution : ${SOLUTION}"; fi
                     if [ -z "${IS_CUSTOM}" ]; then
                         echo "      ${GRAY}${CONTROL_URL_PROTOCOL}://${CONTROL_URL_PREPEND}${ADDLINK}${CONTROL_URL_APPEND}${NORMAL}"
diff --git a/include/tests_accounting b/include/tests_accounting
index 827f412a..2b2ceb46 100644
--- a/include/tests_accounting
+++ b/include/tests_accounting
@@ -105,7 +105,7 @@
         if [ -f ${ROOTDIR}etc/default/sysstat ]; then
             LogText "Result: ${ROOTDIR}etc/default/sysstat found"
             FIND=$(${GREPBINARY} "^ENABLED" ${ROOTDIR}etc/default/sysstat | ${GREPBINARY} -i true)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: sysstat enabled via ${ROOTDIR}etc/default/sysstat"
                 Display --indent 2 --text "- Checking sysstat accounting data" --result "${STATUS_ENABLED}" --color GREEN
             else
@@ -115,7 +115,7 @@
             fi
         elif [ -f ${ROOTDIR}etc/cron.d/sysstat ]; then
             FIND=$(${GREPBINARY} -v '^[[:space:]]*\(#\|$\)' ${ROOTDIR}etc/cron.d/sysstat)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: sysstat enabled via ${ROOTDIR}etc/cron.d/sysstat"
                 Display --indent 2 --text "- Checking sysstat accounting data" --result "${STATUS_ENABLED}" --color GREEN
             else
@@ -134,7 +134,7 @@
 #
     # Test        : ACCT-9628
     # Description : Check auditd status
-    if [ ! -z "${AUDITDBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${AUDITDBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no ACCT-9628 --os Linux --weight L --network NO --category security --description "Check for auditd"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Check auditd status"
@@ -163,7 +163,7 @@
 #
     # Test        : ACCT-9630
     # Description : Check auditd rules
-    if [ ! -z "${AUDITDBINARY}" -a ! -z "${AUDITCTLBINARY}" -a ${LINUX_AUDITD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${AUDITDBINARY}" -a -n "${AUDITCTLBINARY}" -a ${LINUX_AUDITD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no ACCT-9630 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --root-only YES --category security --description "Check for auditd rules"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking auditd rules"
@@ -189,7 +189,7 @@
 #
     # Test        : ACCT-9632
     # Description : Check auditd configuration file
-    if [ ! -z "${AUDITDBINARY}" -a ${LINUX_AUDITD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${AUDITDBINARY}" -a ${LINUX_AUDITD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no ACCT-9632 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for auditd configuration file"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking auditd configuration file"
@@ -202,7 +202,7 @@
             fi
         done
         # Check if we discovered the configuration file. It should be there is the binaries are available and process is running
-        if [ ! -z "${AUDITD_CONF_FILE}" ]; then
+        if [ -n "${AUDITD_CONF_FILE}" ]; then
             Display --indent 4 --text "- Checking audit configuration file" --result "${STATUS_OK}" --color GREEN
         else
             LogText "Result: could not find auditd configuration file"
@@ -215,12 +215,12 @@
 #
     # Test        : ACCT-9634
     # Description : Check auditd log file
-    if [ ! -z "${AUDITDBINARY}" -a ${LINUX_AUDITD_RUNNING} -eq 1 -a ! -z "${AUDITD_CONF_FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${AUDITDBINARY}" -a ${LINUX_AUDITD_RUNNING} -eq 1 -a -n "${AUDITD_CONF_FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no ACCT-9634 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for auditd log file"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking auditd log file"
         FIND=$(${GREPBINARY} "^log_file" ${AUDITD_CONF_FILE} | ${AWKBINARY} '{ if ($1=="log_file" && $2=="=") { print $3 } }')
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Result: log file is defined"
             LogText "Defined value: ${FIND}"
             if [ -f ${FIND} ]; then
@@ -252,7 +252,7 @@
             if [ -f ${ROOTDIR}etc/ld.so.preload ]; then
                 LogText "Result: found ${ROOTDIR}etc/ld.so.preload, testing if snoopy.so is listed"
                 FIND=$(${GREPBINARY} ${FILE} ${ROOTDIR}etc/ld.so.preload)
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     LogText "Result: found snoopy in ld.so.preload"
                     LogText "Output: ${FIND}"
                     Display --indent 6 --text "- Library in ld.so.preload" --result "LOADED" --color GREEN
@@ -298,7 +298,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: check if auditd service is enabled and online"
         FIND=$(${ROOTDIR}usr/bin/svcs svc:/system/auditd:default | ${GREPBINARY} "^online")
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Result: auditd service is online"
             Display --indent 4 --text "- Checking Solaris audit daemon status" --result "${STATUS_ON}"LINE --color GREEN
         else
@@ -317,7 +317,7 @@
         LogText "Test: check if BSM is enabled in ${ROOTDIR}etc/system"
         if [ -f ${ROOTDIR}etc/system ]; then
             FIND=$(${GREPBINARY} 'set c2audit:audit_load = 1' ${ROOTDIR}etc/system)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: BSM is enabled in ${ROOTDIR}etc/system"
                 Display --indent 4 --text "- Checking Solaris BSM (${ROOTDIR}etc/system)" --result "${STATUS_ENABLED}" --color GREEN
             else
@@ -339,7 +339,7 @@
         LogText "Test: check if c2audit module is active"
         if [ -x ${ROOTDIR}usr/sbin/modinfo ]; then
             FIND=$(${ROOTDIR}usr/sbin/modinfo | ${GREPBINARY} c2audit)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: c2audit found in modinfo output"
                 Display --indent 4 --text "- Checking Solaris BSM (modules list)" --result "${STATUS_ENABLED}" --color GREEN
             else
@@ -362,7 +362,7 @@
         if [ -f ${ROOTDIR}etc/security/audit_control ]; then
             LogText "Result: file ${ROOTDIR}etc/security/audit_control found"
             FIND=$(${GREPBINARY} "^dir" ${ROOTDIR}etc/security/audit_control | ${AWKBINARY} -F: '{ print $2 }')
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: found location ${FIND}"
                 LogText "Test: Checking if location is a valid directory"
                 if [ -d ${FIND} ]; then
diff --git a/include/tests_authentication b/include/tests_authentication
index 6c867da6..c931ab77 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -46,7 +46,7 @@
         else
             FIND=$(${GREPBINARY} ':0:' ${ROOTDIR}etc/passwd | ${EGREPBINARY} -v '^#|^root:|^(\+:\*)?:0:0:::' | ${CUTBINARY} -d ":" -f1,3 | ${GREPBINARY} ':0')
         fi
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             Display --indent 2 --text "- Administrator accounts" --result "${STATUS_WARNING}" --color RED
             LogText "Result: Found more than one administrator accounts"
             ReportWarning "${TEST_NO}" "Multiple users with UID 0 found in passwd file"
@@ -124,7 +124,7 @@
     # Test        : AUTH-9216
     # Description : Check /etc/group and shadow group files
     # Notes       : Run grpck to test group files (most likely /etc/group and shadow group files)
-    if [ ! -z "${GRPCKBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${GRPCKBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no AUTH-9216 --preqs-met ${PREQS_MET} --weight L --network NO --root-only YES --category security --description "Check group and shadow group files"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking for grpck binary output"
@@ -363,7 +363,7 @@
             "macOS")
                 LogText "macOS real users output (ID = 0, or 500-599) using dscacheutil"
                 FIND_USERS=$(dscacheutil -q user | ${GREPBINARY} -A 3 -B 2 -e "^uid: 5[0-9][0-9]" | ${GREPBINARY} "^name: " | ${AWKBINARY} '{print $2}')
-                if [ ! -z "${FIND_USERS}" ]; then
+                if [ -n "${FIND_USERS}" ]; then
                     for FUSERNAME in ${FIND_USERS}; do
                         FDETAILS=$(dscacheutil -q user -a name ${FUSERNAME} | ${GREPBINARY} "^uid: " | ${AWKBINARY} '{print $2}')
                         FIND="${FUSERNAME},${FDETAILS} ${FIND}"
@@ -397,7 +397,7 @@
         else
             Display --indent 2 --text "- Query system users (non daemons)" --result "${STATUS_DONE}" --color GREEN
             for I in ${FIND}; do
-                if [ ! -z "${I}" ]; then
+                if [ -n "${I}" ]; then
                     LogText "Real user: ${I}"
                     Report "real_user[]=${I}"
                 fi
@@ -419,7 +419,7 @@
             else
                 FIND2=$(${EGREPBINARY} "^passwd_compat" ${ROOTDIR}etc/nsswitch.conf | ${GREPBINARY} "nisplus")
                 FIND3=$(${EGREPBINARY} "^passwd" ${ROOTDIR}etc/nsswitch.conf | ${GREPBINARY} "nisplus")
-                if [ ! -z "${FIND2}" -o ! -z "${FIND3}" ]; then
+                if [ -n "${FIND2}" -o -n "${FIND3}" ]; then
                     LogText "Result: NIS+ authentication enabled"
                     Display --indent 2 --text "- NIS+ authentication support" --result "${STATUS_ENABLED}" --color GREEN
                 else
@@ -446,7 +446,7 @@
             else
                 FIND2=$(${EGREPBINARY} "^passwd_compat" /etc/nsswitch.conf | ${GREPBINARY} "nis" | ${GREPBINARY} -v "nisplus")
                 FIND3=$(${EGREPBINARY} "^passwd" /etc/nsswitch.conf | ${GREPBINARY} "nis" | ${GREPBINARY} -v "nisplus")
-                if [ ! -z "${FIND2}" -o ! -z "${FIND3}" ]; then
+                if [ -n "${FIND2}" -o -n "${FIND3}" ]; then
                     LogText "Result: NIS authentication enabled"
                     Display --indent 2 --text "- NIS authentication support" --result "${STATUS_ENABLED}" --color GREEN
                 else
@@ -489,7 +489,7 @@
 #
     # Test        : AUTH-9252
     # Description : Check ownership and permissions for sudo configuration files
-    if [ ! -z "${SUDOERS_FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${SUDOERS_FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no AUTH-9252 --preqs-met ${PREQS_MET} --weight L --network NO --root-only YES --category security --description "Check ownership and permissions for sudo configuration files"
     if [ ${SKIPTEST} -eq 0 ]; then
         SUDO_CONFIG_FILES="${SUDOERS_FILE}"
@@ -680,7 +680,7 @@
                 else
                     FIND=$(find ${DIR} -maxdepth 1 -type f -name "pam_*.so" -print | sort)
                 fi
-                if [ ! -z "${FIND}" ]; then FOUND=1; fi
+                if [ -n "${FIND}" ]; then FOUND=1; fi
                 for FILE in ${FIND}; do
                     LogText "Found file: ${FILE}"
                     Report "pam_module[]=${FILE}"
@@ -712,7 +712,7 @@
                 LogText "Result: file ${FILE} exists"
                 LogText "Test: checking presence LDAP module"
                 FIND=$(${GREPBINARY} "^auth.*ldap" ${FILE})
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     LogText "Result: LDAP module present"
                     LogText "Output: ${FIND}"
                     LDAP_AUTH_ENABLED=1
@@ -868,7 +868,7 @@
             LogText "Test: collecting accounts which have an expired password (last day changed + maximum change time)"
             # Skip fields with a !, *, or x, or !* (field $3 is last changed, $5 is maximum changed)
             FIND=$(${EGREPBINARY} -v ":[\!\*x]([\*\!])?:" /etc/shadow | ${AWKBINARY} -v today=${DAYS_SINCE_EPOCH} -F: '{ if (($5!="") && (today>$3+$5)) { print $1 }}')
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 for ACCOUNT in ${FIND}; do
                     LogText "Result: password of user ${ACCOUNT} has been expired"
                     Report "account_password_expired[]=${ACCOUNT}"
@@ -961,7 +961,7 @@
                 LogText "Test: checking presence sulogin for single user mode"
                 FIND=$(${EGREPBINARY} "^[a-zA-Z0-9~]+:S:(respawn|wait):/sbin/sulogin" /etc/inittab)
                 FIND2=$(${EGREPBINARY} "^su:S:(respawn|wait):/sbin/sulogin" /etc/inittab)
-                if [ ! -z "${FIND}" -o ! -z "${FIND2}" ]; then
+                if [ -n "${FIND}" -o -n "${FIND2}" ]; then
                     FOUND=1
                     LogText "Result: found sulogin, so single user is protected"
                 fi
@@ -976,7 +976,7 @@
                 LogText "Result: file ${ROOTDIR}etc/sysconfig/init exists"
                 LogText "Test: checking presence sulogin for single user mode"
                 FIND=$(${GREPBINARY} "^SINGLE=/sbin/sulogin" ${ROOTDIR}etc/sysconfig/init)
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     FOUND=1
                     LogText "Result: found sulogin, so single user is protected"
                 fi
@@ -1045,7 +1045,7 @@
         if [ -d ${ROOTDIR}etc/profile.d ]; then
             FOUND=0
             FIND=$(ls ${ROOTDIR}etc/profile.d/* 2> /dev/null)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: found /etc/profile.d, with one or more files in it"
                 for FILE in ${FIND}; do
                     HAS_MASK=$(${GREPBINARY} umask ${FILE} | ${SEDBINARY} 's/^[ \t]*//' | ${GREPBINARY} -v "^#" | ${AWKBINARY} '{ print $2 }')
@@ -1309,7 +1309,7 @@
             if [ -f ${ROOTDIR}etc/default/login ]; then
                 LogText "Result: file ${ROOTDIR}etc/default/login exists"
                 FIND=$(${GREPBINARY} "^RETRIES" ${ROOTDIR}etc/default/login)
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     FOUND=1
                     LogText "Result: retries option configured"
                     LogText "Output: ${FIND}"
@@ -1429,7 +1429,7 @@
 #
     # Test        : AUTH-9410
     # Description : Check for doas file permissions
-    if [ ! -z "${DOAS_FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${DOAS_FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no AUTH-9410 --os OpenBSD --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check /etc/doas.conf file permissions"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: checking /etc/doas.conf permissions"
@@ -1450,7 +1450,7 @@
 Report "auth_failed_logins_logged=${AUTH_FAILED_LOGINS_LOGGED}"
 Report "ldap_auth_enabled=${LDAP_AUTH_ENABLED}"
 Report "ldap_pam_enabled=${LDAP_PAM_ENABLED}"
-if [ ! -z "${LDAP_CLIENT_CONFIG_FILE}" ]; then Report "ldap_config_file=${LDAP_CLIENT_CONFIG_FILE}"; fi
+if [ -n "${LDAP_CLIENT_CONFIG_FILE}" ]; then Report "ldap_config_file=${LDAP_CLIENT_CONFIG_FILE}"; fi
 Report "password_min_days=${PASSWORD_MINIMUM_DAYS}"
 Report "password_max_days=${PASSWORD_MAXIMUM_DAYS}"
 
diff --git a/include/tests_boot_services b/include/tests_boot_services
index 42b8dab1..2fee353f 100644
--- a/include/tests_boot_services
+++ b/include/tests_boot_services
@@ -46,7 +46,7 @@
         LogText "Test: Query bootinfo for AIX boot device"
         if [ -x /usr/sbin/bootinfo ]; then
             FIND=$(/usr/sbin/bootinfo -b)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: found boot device ${FIND}"
                 Display --indent 2 --text "- Checking boot device (bootinfo)" --result "${STATUS_FOUND}" --color GREEN
                 BOOT_LOADER="ROS"
@@ -76,7 +76,7 @@
                     FILENAME=$(echo "${OUTPUT}" | ${AWKBINARY} '{print $1}')
                     LogText "Result: file on disk = ${FILENAME}"
                     ISFILE=$(echo ${FILENAME} | ${GREPBINARY} "^/")
-                    if [ ! -z "${ISFILE}" ]; then
+                    if [ -n "${ISFILE}" ]; then
                         if [ -L ${ISFILE} ]; then
                             ShowSymlinkPath ${ISFILE}
                             FILENAME="${SYMLINK}"
@@ -86,7 +86,7 @@
                             LogText "Result: cmdline of PID 1 is not a file"
                         fi
                     fi
-                    if [ ! -z "${FILENAME}" ]; then
+                    if [ -n "${FILENAME}" ]; then
                         SHORTNAME=$(echo ${FILENAME} | ${AWKBINARY} -F/ '{ print $NF }')
                         LogText "Found: ${SHORTNAME}"
                         if [ "${SERVICE_MANAGER}" = "unknown" ]; then
@@ -110,7 +110,7 @@
                                 ;;
                                 *)
                                     CONTAINS_SYSTEMD=$(echo ${SHORTNAME} | ${GREPBINARY} "systemd")
-                                    if [ ! -z "${CONTAINS_SYSTEMD}" ]; then
+                                    if [ -n "${CONTAINS_SYSTEMD}" ]; then
                                         SERVICE_MANAGER="systemd"
                                     else
                                         LogText "Found ${SHORTNAME}. Unclear what service manager this is"
@@ -204,7 +204,7 @@
                 LogText "Test: determine if Secure Boot is used"
                 if [ -d ${ROOTDIR}sys/firmware/efi/efivars ]; then
                     FIND=$(${LSBINARY} ${ROOTDIR}sys/firmware/efi/efivars/SecureBoot-* 2> /dev/null)
-                    if [ ! -z "${FIND}" ]; then
+                    if [ -n "${FIND}" ]; then
                         for FILE in ${FIND}; do
                             LogText "Test: checking file ${FILE}"
                             # TODO: add detection for od
@@ -295,7 +295,7 @@
         # Some OSes like Gentoo do not have /boot mounted by default
         # TODO: root directory and rewrite ls statement
         if [ -d /boot ]; then
-            if [ "$(ls /boot/* 2> /dev/null)" = "" -a ! -z "${GRUB2INSTALLBINARY}" ]; then
+            if [ "$(ls /boot/* 2> /dev/null)" = "" -a -n "${GRUB2INSTALLBINARY}" ]; then
                 BOOT_LOADER_FOUND=1
                 LogText "Result: found empty /boot, however with GRUB2 binary installed. Best guess is that GRUB2 is actually installed, but /boot not mounted"
                 Display --indent 2 --text "- Checking presence GRUB2" --result "POSSIBLE MATCH" --color YELLOW
@@ -312,7 +312,7 @@
 #
     # Test        : BOOT-5122
     # Description : Check for GRUB boot loader configuration
-    if [ ! -z "${GRUBCONFFILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${GRUBCONFFILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no BOOT-5122 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for GRUB boot password"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
@@ -325,11 +325,11 @@
             FIND4=$(${GREPBINARY} 'password_pbkdf2' ${GRUBCONFFILE} | ${GREPBINARY} -v '^#')
             FIND5=$(${GREPBINARY} 'grub.pbkdf2' ${GRUBCONFFILE} | ${GREPBINARY} -v '^#')
             # GRUB1: Password should be set (MD5 or SHA1)
-            if [ ! -z "${FIND}" -o ! -z "${FIND2}" ]; then
+            if [ -n "${FIND}" -o -n "${FIND2}" ]; then
                 FOUND=1
             # GRUB2: Superusers AND password should be defined
-            elif [ ! -z "${FIND3}" ]; then
-                if [ ! -z "${FIND4}" -o ! -z "${FIND5}" ]; then FOUND=1; fi
+            elif [ -n "${FIND3}" ]; then
+                if [ -n "${FIND4}" -o -n "${FIND5}" ]; then FOUND=1; fi
             fi
             if [ ${FOUND} -eq 1 ]; then
                 Display --indent 4 --text "- Checking for password protection" --result "${STATUS_OK}" --color GREEN
@@ -599,7 +599,7 @@
         else
 
             LogText "Result: systemctl binary not found, checking chkconfig binary"
-            if [ ! -z "${CHKCONFIGBINARY}" ]; then
+            if [ -n "${CHKCONFIGBINARY}" ]; then
                 LogText "Result: chkconfig binary found, trying that to discover information"
                 LogText "Searching for services at startup (chkconfig, runlevel 3 and 5)"
                 FIND=$(${CHKCONFIGBINARY} --list | ${EGREPBINARY} '3:on|5:on' | ${AWKBINARY} '{ print $1 }')
@@ -634,7 +634,7 @@
         if [ "${sRUNLEVEL}" = "2" ]; then
             LogText "Result: performing find in /etc/rc2.d as runlevel 2 is found"
             FIND=$(${FINDBINARY} ${ROOTDIR}etc/rc2.d -type l -print | ${CUTBINARY} -d '/' -f4 | ${SEDBINARY} "s/S[0-9][0-9]//g" | sort)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 COUNT=0
                 for SERVICE in ${FIND}; do
                     LogText "Found service (at boot, runlevel 2): ${SERVICE}"
@@ -667,7 +667,7 @@
                 LogText "Result: directory ${DIR} found"
                 LogText "Test: checking for available files in directory"
                 FIND=$(${FINDBINARY} ${DIR} -type f -print | ${SORTBINARY})
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     LogText "Result: found files in directory, checking permissions now"
                     for FILE in ${FIND}; do
                         LogText "Test: checking permissions of file ${FILE}"
@@ -757,12 +757,12 @@
                 ;;
 
              DragonFly | FreeBSD | macOS)
-                if [ ! -z "${SYSCTLBINARY}" ]; then
+                if [ -n "${SYSCTLBINARY}" ]; then
                     TIME_BOOT=$(${SYSCTLBINARY} kern.boottime | ${AWKBINARY} '{ print $5 }' | ${SEDBINARY} -e 's/,//' | ${GREPBINARY} "[0-9]")
                     TIME_NOW=$(date "+%s")
                     LogText "Boot time: ${TIME_BOOT}"
                     LogText "Current time: ${TIME_NOW}"
-                    if [ ! -z "${TIME_BOOT}" -a ! -z "${TIME_NOW}" ]; then
+                    if [ -n "${TIME_BOOT}" -a -n "${TIME_NOW}" ]; then
                         UPTIME_IN_SECS=$((TIME_NOW - TIME_BOOT))
                     else
                         ReportException "${TEST_NO}:5" "Most likely kern.boottime empty, unable to determine uptime"
@@ -774,12 +774,12 @@
                 ;;
 
              NetBSD | OpenBSD)
-                if [ ! -z "${SYSCTLBINARY}" ]; then
+                if [ -n "${SYSCTLBINARY}" ]; then
                     TIME_BOOT=$(${SYSCTLBINARY} -n kern.boottime)
                     TIME_NOW=$(date "+%s")
                     LogText "Boot time: ${TIME_BOOT}"
                     LogText "Current time: ${TIME_NOW}"
-                    if [ ! -z "${TIME_BOOT}" -a ! -z "${TIME_NOW}" ]; then
+                    if [ -n "${TIME_BOOT}" -a -n "${TIME_NOW}" ]; then
                         UPTIME_IN_SECS=$((TIME_NOW - TIME_BOOT))
                     else
                         ReportException "${TEST_NO}:5" "Most likely kern.boottime empty, unable to determine uptime"
@@ -791,7 +791,7 @@
                 ;;
 
             Solaris)
-                if [ ! -z "${KSTATBINARY}" ]; then
+                if [ -n "${KSTATBINARY}" ]; then
                     UPTIME_IN_SECS=$(${KSTATBINARY} -p unix:0:system_misc:snaptime | ${GREPBINARY} "^unix" | ${AWKBINARY} '{print $2}' | ${CUTBINARY} -d "." -f1)
                 else
                     Display --indent 2 --text "- Checking uptime" --result "${STATUS_SKIPPED}" --color YELLOW
@@ -806,7 +806,7 @@
                 ReportException "${TEST_NO}:3" "No uptime test available yet for this operating system"
                 ;;
         esac
-        if [ ! -z "${UPTIME_IN_SECS}" ]; then
+        if [ -n "${UPTIME_IN_SECS}" ]; then
             UPTIME_IN_DAYS=$((UPTIME_IN_SECS / 60 / 60 / 24))
             LogText "Uptime (in seconds): ${UPTIME_IN_SECS}"
             LogText "Uptime (in days): ${UPTIME_IN_DAYS}"
@@ -828,7 +828,7 @@
             LogText "Result: file /usr/lib/systemd/system/rescue.service"
             LogText "Test: checking presence sulogin for single user mode"
             FIND=$(${EGREPBINARY} "^ExecStart=.*sulogin" ${ROOTDIR}usr/lib/systemd/system/rescue.service)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 FOUND=1
                 LogText "Result: found sulogin, so single user is protected"
                 AddHP 3 3
@@ -898,7 +898,7 @@
             LogText "Test: checking for available files in directory"
             # OpenBSD uses symlinks to create another instance of daemons
             FIND=$(${FINDBINARY} ${CHECKDIR} \( -type f -o -type l \) -print | ${SORTBINARY})
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: found files in directory, checking permissions now"
                 for FILE in ${FIND}; do
                     LogText "Test: checking permissions of file ${FILE}"
diff --git a/include/tests_containers b/include/tests_containers
index 97351d92..4d722e52 100644
--- a/include/tests_containers
+++ b/include/tests_containers
@@ -40,7 +40,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: query zoneadm to list all running zones"
         FIND=$(${ROOTDIR}usr/sbin/zoneadm list -p | ${AWKBINARY} -F: '{ if ($2!="global") print $0 }')
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             COUNT=0
             for ITEM in ${FIND}; do
                 COUNT=$((COUNT + 1))
@@ -131,7 +131,7 @@
     # Test        : CONT-8106
     # Description : Checking Docker containers (basic stats)
     # Notes       : Hardening points are awarded, if there aren't a lot of stopped containers
-    if [ ! -z "${DOCKERBINARY}" -a ${RUN_DOCKER_TESTS} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${DOCKERBINARY}" -a ${RUN_DOCKER_TESTS} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no CONT-8106 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Gather basic stats from Docker"
     if [ ${SKIPTEST} -eq 0 ]; then
         Display --indent 6 --text "- Containers"
@@ -171,7 +171,7 @@
     # Test        : CONT-8107
     # Description : Checking Docker number of unused containers
     # Notes       : Hardening points are awarded, if there aren't a lot of stopped containers
-    if [ ! -z "${DOCKERBINARY}" -a ${RUN_DOCKER_TESTS} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${DOCKERBINARY}" -a ${RUN_DOCKER_TESTS} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no CONT-8107 --preqs-met ${PREQS_MET} --weight L --network NO --category performance --description "Check number of Docker containers"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if there aren't too many unused containers on the system
@@ -194,7 +194,7 @@
     # Test        : CONT-8108
     # Description : Checking Docker file permissions
     # Notes       : /var/run/docker.sock - Usually root as owner, docker as group - should not be world writable
-    if [ ! -z "${DOCKERBINARY}" -a ${RUN_DOCKER_TESTS} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${DOCKERBINARY}" -a ${RUN_DOCKER_TESTS} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no CONT-8108 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check file permissions for Docker files"
     if [ ${SKIPTEST} -eq 0 ]; then
         NOT_WORLD_WRITABLE="${ROOTDIR}var/run/docker.sock"
diff --git a/include/tests_crypto b/include/tests_crypto
index 6d0d5384..ecb19d2f 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -28,7 +28,7 @@
 #
     # Test        : CRYP-7902
     # Description : check for expired SSL certificates
-    if [ ! -z "${OPENSSLBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${OPENSSLBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no CRYP-7902 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check expire date of SSL certificates"
     if [ ${SKIPTEST} -eq 0 ]; then
         COUNT_EXPIRED=0
diff --git a/include/tests_databases b/include/tests_databases
index d3bd2777..43d0d025 100644
--- a/include/tests_databases
+++ b/include/tests_databases
@@ -71,7 +71,7 @@
     # Test        : DBS-1816
     # Description : Check empty MySQL root password
     # Notes       : Only perform test when MySQL is running and client is available
-    if [ ! -z "${MYSQLCLIENTBINARY}" -a ${MYSQL_RUNNING} -eq 1 ]; then PREQS_MET="YES"; SKIPREASON=""; else PREQS_MET="NO"; SKIPREASON="MySQL not installed, or not running"; fi
+    if [ -n "${MYSQLCLIENTBINARY}" -a ${MYSQL_RUNNING} -eq 1 ]; then PREQS_MET="YES"; SKIPREASON=""; else PREQS_MET="NO"; SKIPREASON="MySQL not installed, or not running"; fi
     Register --test-no DBS-1816 --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight L --network NO --category security --description "Checking MySQL root password"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Trying to login to local MySQL server without password"
@@ -144,7 +144,7 @@
             if [ ${MONGODB_AUTHORIZATION_ENABLED} -eq 0 ]; then
                 if HasData "${PGREPBINARY}"; then
                     AUTH_ON_CMDLINE=$(for I in $(${PGREPBINARY} mongo); do cat /proc/${I}/cmdline | xargs -0 echo | ${GREPBINARY} -E "\-\-auth( |$)"; done)
-                    if [ ! -z "${AUTH_ON_CMDLINE}" ]; then LogText "Result: found authorization enabled via mongod parameter"; MONGODB_AUTHORIZATION_ENABLED=1; fi
+                    if [ -n "${AUTH_ON_CMDLINE}" ]; then LogText "Result: found authorization enabled via mongod parameter"; MONGODB_AUTHORIZATION_ENABLED=1; fi
                 else
                     LogText "Result: skipped this part of the test, as pgrep is not available"
                 fi
@@ -268,7 +268,7 @@
         for DIR in ${PATHS}; do
             LogText "Action: scanning directory (${DIR}) for Redis configuration files"
             FILES=$(${LSBINARY} ${DIR}/*.conf 2> /dev/null)
-            if [ ! -z "${FILES}" ]; then
+            if [ -n "${FILES}" ]; then
                 ALLFILES="${ALLFILES} ${FILES}"
             else
                 LogText "Result: no configuration files found in this directory"
@@ -279,12 +279,12 @@
                 LogText "Action: checking if ${CONFFILE} is a Sentinel configuration file"
                 # Exclude Sentinel configuration file
                 FIND=$(${GREPBINARY} "^sentinel " ${CONFFILE})
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     LogText "Result: file is a Sentinel configuration file, skipping it"
                 else
                     LogText "Result: file is NOT a Sentinel configuration file. Now scanning if it is a Redis configuration file"
                     FIND=$(${GREPBINARY} "Redis" ${CONFFILE})
-                    if [ ! -z "${FIND}" ]; then
+                    if [ -n "${FIND}" ]; then
                         REDIS_CONFIGURATION_FILES="${REDIS_CONFIGURATION_FILES} ${CONFFILE}"
                         REDIS_CONFIGURATION_FOUND=1
                         LogText "Result: found a Redis configuration file (${CONFFILE})"
diff --git a/include/tests_dns b/include/tests_dns
index a2732b16..b7cf2ba8 100644
--- a/include/tests_dns
+++ b/include/tests_dns
@@ -38,7 +38,7 @@
 #    # Description : Validate DNSSEC signiture is checked
 #    Register --test-no DNS-1600 --weight L --network YES --category security --description "Validate DNSSEC igniture is checked"
 #    if [ "${SKIPTEST}" -eq 0 ]; then
-#        if [ ! -z "${DIGBINARY}" ]; then
+#        if [ -n "${DIGBINARY}" ]; then
 #
 #            GOOD=$("${DIGBINARY}" +short +time=1 $SIGOKDNS)
 #            BAD=$("${DIGBINARY}" +short +time=1 $SIGFAILDNS)
@@ -47,16 +47,16 @@
 #                LogText "Result: received timeout, can't determine DNSSEC validation"
 #                Display --indent 4 --text "- Checking DNSSEC validation" --result "${STATUS_UNKOWN}" --color YELLOW
 #                #ReportException "${TEST_NO}" "Exception found, both query failed, due to connection timeout"
-#            elif [ -z "${GOOD}" -a ! -z "${BAD}" ]; then
+#            elif [ -z "${GOOD}" -a -n "${BAD}" ]; then
 #                LogText "Result: good signature failed, yet bad signature was accepted"
 #                Display --indent 4 --text "- Checking DNSSEC validation" --result "${STATUS_UNKOWN}" --color YELLOW
 #                #ReportException "${TEST_NO}" "Exception found, OK failed, bad signature was accepted"
-#            elif [ ! -z "${GOOD}" -a ! -z "${BAD}" ]; then
+#            elif [ -n "${GOOD}" -a -n "${BAD}" ]; then
 #                Display --indent 4 --text "- Checking DNSSEC validation" --result "${STATUS_SUGGESTION}" --color YELLOW
 #                LogText "Note: Using DNSSEC validation can protect from DNS hijacking"
 #                #ReportSuggestion "${TEST_NO}" "Altered DNS queries are accepted, configure DNSSEC valdating name servers"
 #                AddHP 2 2
-#            elif [ ! -z "${GOOD}" -a -z "${BAD}" ]; then
+#            elif [ -n "${GOOD}" -a -z "${BAD}" ]; then
 #                Display --indent 4 --text "- Checking DNSSEC validation" --result "${STATUS_OK}" --color GREEN
 #                LogText "Result: altered DNS responses were ignored"
 #                AddHP 0 2
diff --git a/include/tests_file_integrity b/include/tests_file_integrity
index 097cb138..6a527e75 100644
--- a/include/tests_file_integrity
+++ b/include/tests_file_integrity
@@ -70,7 +70,7 @@
 #
     # Test        : FINT-4315
     # Description : Check AIDE configuration file
-    if [ ! -z "${AIDEBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${AIDEBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no FINT-4315 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check AIDE configuration file"
     if [ ${SKIPTEST} -eq 0 ]; then
         AIDE_CONFIG_LOCS="${ROOTDIR}etc ${ROOTDIR}etc/aide ${ROOTDIR}usr/local/etc"
@@ -104,7 +104,7 @@
     Register --test-no FINT-4318 --weight L --network NO --category security --description "Osiris availability"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking Osiris binary"
-        if [ ! -z "${OSIRISBINARY}" ]; then
+        if [ -n "${OSIRISBINARY}" ]; then
             LogText "Result: Osiris is installed (${OSIRISBINARY})"
             Report "file_integrity_tool[]=osiris"
             FILE_INT_TOOL="osiris"
@@ -123,7 +123,7 @@
     Register --test-no FINT-4322 --weight L --network NO --category security --description "Samhain availability"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking Samhain binary"
-        if [ ! -z "${SAMHAINBINARY}" ]; then
+        if [ -n "${SAMHAINBINARY}" ]; then
             LogText "Result: Samhain is installed (${SAMHAINBINARY})"
             Report "file_integrity_tool[]=samhain"
             FILE_INT_TOOL="samhain"
@@ -142,7 +142,7 @@
     Register --test-no FINT-4326 --weight L --network NO --category security --description "Tripwire availability"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking Tripwire binary"
-        if [ ! -z "${TRIPWIREBINARY}" ]; then
+        if [ -n "${TRIPWIREBINARY}" ]; then
             LogText "Result: Tripwire is installed (${TRIPWIREBINARY})"
             Report "file_integrity_tool[]=tripwire"
             FILE_INT_TOOL="tripwire"
@@ -229,7 +229,7 @@
             Display --indent 6 --text "- Configuration status" --result "${STATUS_DISABLED}" --color YELLOW
         fi
         ENABLED=$(${GREPBINARY} "^LF_DIRWATCH =" ${CSF_CONFIG} | ${AWKBINARY} '{ print $3 }' | ${SEDBINARY} 's/\"//g')
-        if [ ! "${ENABLED}" = "0" -a ! -z "${ENABLED}" ]; then
+        if [ ! "${ENABLED}" = "0" -a -n "${ENABLED}" ]; then
             LogText "Result: lfd directory watching is enabled (value: ${ENABLED})"
             Display --indent 6 --text "- Temporary directory watches" --result "${STATUS_ENABLED}" --color GREEN
         else
@@ -237,7 +237,7 @@
             Display --indent 6 --text "- Temporary directory watches" --result "${STATUS_DISABLED}" --color YELLOW
         fi
         ENABLED=$(${GREPBINARY} "^LF_DIRWATCH_FILE =" ${CSF_CONFIG} | ${AWKBINARY} '{ print $3 }' | ${SEDBINARY} 's/\"//g')
-        if [ ! "${ENABLED}" = "0" -a ! -z "${ENABLED}" ]; then
+        if [ ! "${ENABLED}" = "0" -a -n "${ENABLED}" ]; then
             Display --indent 6 --text "- Directory/File watches" --result "${STATUS_ENABLED}" --color GREEN
         else
             Display --indent 6 --text "- Directory/File watches" --result "${STATUS_DISABLED}" --color YELLOW
@@ -267,7 +267,7 @@
 #
     # Test        : FINT-4402 (was FINT-4316)
     # Description : Check if AIDE is configured to use SHA256 or SHA512 checksums
-    if [ ! "${AIDEBINARY}" = "" -a ! -z "${AIDECONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ! "${AIDEBINARY}" = "" -a -n "${AIDECONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no FINT-4402 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "AIDE configuration: Checksums (SHA256 or SHA512)"
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${GREPBINARY} -v "^#" ${AIDECONFIG} | ${EGREPBINARY} "= .*(sha256|sha512)")
diff --git a/include/tests_filesystems b/include/tests_filesystems
index 4e52ea5e..ac0c1d3c 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -89,7 +89,7 @@
                  ReportException "${TEST_NO}:1" "Don't know this specific operating system yet, while volume group manager was found"
             ;;
         esac
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Result: found one or more volume groups"
             for I in ${FIND}; do
                 LogText "Found LVM volume group: ${I}"
@@ -152,7 +152,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking for Linux EXT file systems"
         FIND=$(${MOUNTBINARY} -t ext2,ext3,ext4 | ${AWKBINARY} '{ print $3","$5 }')
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Result: found one or more EXT file systems"
             for I in ${FIND}; do
                 FILESYSTEM=$(echo ${I} | ${CUTBINARY} -d ',' -f1)
@@ -173,7 +173,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking for Linux XFS file systems"
         FIND=$(${MOUNTBINARY} -t xfs | ${AWKBINARY} '{ print $3","$5 }')
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Result: found one or more XFS file systems"
             for I in ${FIND}; do
                 FILESYSTEM=$(echo ${I} | ${CUTBINARY} -d ',' -f1)
@@ -272,12 +272,12 @@
 
             # Test for UUID usage (e.g. UUID=uuid --> /dev/disk/by-uuid/<uuid>)
             HAS_UUID=$(echo ${I} | ${GREPBINARY} "^UUID=")
-            if [ ! -z "${HAS_UUID}" ]; then
+            if [ -n "${HAS_UUID}" ]; then
                 UUID=$(echo ${HAS_UUID} | ${AWKBINARY} -F= '{ print $2 }')
                 LogText "Result: Using ${UUID} as UUID"
-                if [ ! -z "${BLKIDBINARY}" ]; then
+                if [ -n "${BLKIDBINARY}" ]; then
                     FIND2=$(${BLKIDBINARY} | ${AWKBINARY} '{ if ($2=="UUID=\"${UUID}\"") print $1 }' | ${SEDBINARY} 's/:$//')
-                    if [ ! -z "${FIND2}" ]; then
+                    if [ -n "${FIND2}" ]; then
                         REAL="${FIND2}"
                     fi
                 else
@@ -286,7 +286,7 @@
                     if [ -L /dev/disk/by-uuid/${UUID} ]; then
                         LogText "Result: found disk via /dev/disk/by-uuid listing"
                         ShowSymlinkPath /dev/disk/by-uuid/${UUID}
-                        if [ ! -z "${sFILE}" ]; then
+                        if [ -n "${sFILE}" ]; then
                             REAL="${sFILE}"
                             LogText "Result: disk is ${REAL}"
                         fi
@@ -342,7 +342,7 @@
     if [ "${OS}" = "Linux" -a -f ${ROOTDIR}proc/version ]; then
         LINUX_KERNEL_MAJOR=$(echo $OS_KERNELVERSION | ${AWKBINARY} -F. '{print $1}')
         LINUX_KERNEL_MINOR=$(echo $OS_KERNELVERSION | ${AWKBINARY} -F. '{print $2}')
-        if [ ! -z "${LINUX_KERNEL_MAJOR}" -a ! -z "${LINUX_KERNEL_MINOR}" ]; then
+        if [ -n "${LINUX_KERNEL_MAJOR}" -a -n "${LINUX_KERNEL_MINOR}" ]; then
             if [ ${LINUX_KERNEL_MAJOR} -ge 3 -a ${LINUX_KERNEL_MINOR} -ge 3 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
         else
             PREQS_MET="NO";
@@ -464,7 +464,7 @@
         FOUND=0
         LogText "Test: Checking acl option on ext[2-4] root file system"
         FIND=$(${MOUNTBINARY} | ${AWKBINARY} '{ if ($3=="/" && $5~/ext[2-4]/) { print $6 } }' | ${GREPBINARY} acl)
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Result: found ACL option"
             FOUND=1
         else
@@ -480,11 +480,11 @@
                 FIND1=$(${MOUNTBINARY} -t ext2,ext3,ext4 | ${GREPBINARY} "on / " | ${AWKBINARY} '{ print $1 }')
             fi
             # Trying to determine default mount options from EXT2/EXT3/EXT4 file systems
-            if [ ! -z "${FIND1}" ]; then
+            if [ -n "${FIND1}" ]; then
                 LogText "Result: found ${FIND1}"
                 LogText "Test: Checking default options on ${FIND1}"
                 FIND2=$(${TUNE2FSBINARY} -l ${FIND1} 2> /dev/null | ${GREPBINARY} "^Default mount options" | ${GREPBINARY} "acl")
-                if [ ! -z "${FIND2}" ]; then
+                if [ -n "${FIND2}" ]; then
                     LogText "Result: found ACL option in default mount options"
                     FOUND=1
                 else
@@ -528,7 +528,7 @@
             NOEXEC=$(echo ${FIND} | ${AWKBINARY} '{ if ($1 ~ "noexec") { print "YES" } else { print "NO" } }')
             NOSUID=$(echo ${FIND} | ${AWKBINARY} '{ if ($1 ~ "nosuid") { print "YES" } else { print "NO" } }')
 
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: mount system / is configured with options: ${FIND}"
                 if [ "${FIND}" = "defaults" ]; then
                     Display --indent 2 --text "- Mount options of /" --result "${STATUS_OK}" --color GREEN
@@ -577,7 +577,7 @@
                         FS_FSTAB=""
                     fi
                 fi
-                if [ ! -z "${FS_FSTAB}" ]; then
+                if [ -n "${FS_FSTAB}" ]; then
                     FOUND_FLAGS=$(${AWKBINARY} -v fs=${FILESYSTEM} '{ if ($2==fs) { print $4 } }' ${ROOTDIR}etc/fstab | ${SEDBINARY} 's/,/ /g' | ${TRBINARY} '\n' ' ')
                     LogText "File system:    ${FILESYSTEM}"
                     LogText "Expected flags: ${EXPECTED_FLAGS}"
@@ -629,7 +629,7 @@
         if [ -f ${ROOTDIR}etc/fstab ]; then
             FIND=$(${AWKBINARY} '{ if ($2=="/var/tmp") { print $4 } }' ${ROOTDIR}etc/fstab)
             BIND=$(echo ${FIND} | ${AWKBINARY} '{ if ($1 ~ "bind") { print "YES" } else { print "NO" } }')
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: mount system /var/tmp is configured with options: ${FIND}"
                 if [ "${BIND}" = "YES" ]; then
                     Display --indent 2 --text "- /var/tmp is bound to /tmp" --result "${STATUS_OK}" --color GREEN
@@ -760,7 +760,7 @@
     # Data        : cramfs freevxfs hfs hfsplus jffs2 squashfs udf 
     Register --test-no FILE-6430 --weight L --network NO --category security --description "Disable mounting of some filesystems"
     if [ ${SKIPTEST} -eq 0 ]; then
-        if [ ! -z "${LSMODBINARY}" -a -f /proc/modules ]; then
+        if [ -n "${LSMODBINARY}" -a -f /proc/modules ]; then
             Display --indent 2 --text "- Disable kernel support of some filesystems"
             LIST_FS_NOT_SUPPORTED="cramfs freevxfs hfs hfsplus jffs2 squashfs udf"
             FOUND=0
@@ -769,7 +769,7 @@
             for FS in ${LIST_FS_NOT_SUPPORTED}; do
                 # Check if filesystem is present in modprobe output
                 FIND=$(${MODPROBEBINARY} -v -n $FS 2>/dev/null | ${EGREPBINARY} "/${FS}.ko" | tail -1)
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     LogText "Result: found module support in kernel: ${FIND}"
                     Debug "Module ${FS} present in the kernel"
                     LogText "Test: Checking if ${FS} is active"
diff --git a/include/tests_firewalls b/include/tests_firewalls
index 735059fe..99a9bc2a 100644
--- a/include/tests_firewalls
+++ b/include/tests_firewalls
@@ -41,7 +41,7 @@
     Register --test-no FIRE-4502 --os Linux --weight L --network NO --category security --description "Check iptables kernel module"
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${LSMODBINARY} | ${AWKBINARY} '{ print $1 }' | ${GREPBINARY} "^ip*_tables")
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             FIREWALL_ACTIVE=1
             IPTABLES_ACTIVE=1
             IPTABLES_MODULE_ACTIVE=1
@@ -73,11 +73,11 @@
             # If we have a kernel configuration file, use it for testing
             # Do not perform test if we already found it in kernel module list, to avoid triggered it in the upcoming
             # tests, when using iptables --list
-            if [ ! -z "${LINUXCONFIGFILE}" ]; then
+            if [ -n "${LINUXCONFIGFILE}" ]; then
                 if [ -f ${LINUXCONFIGFILE} -a ${IPTABLES_MODULE_ACTIVE} -eq 0 ]; then
                     LogText "Result: found kernel configuration file (${LINUXCONFIGFILE})"
                     FIND=$(${tCATCMD} ${LINUXCONFIGFILE} | ${GREPBINARY} -v '^#' | ${GREPBINARY} "CONFIG_IP_NF_IPTABLES" | head -n 1)
-                    if [ ! -z "${FIND}" ]; then
+                    if [ -n "${FIND}" ]; then
                         HAVEMOD=$(echo ${FIND} | ${CUTBINARY} -d '=' -f2)
                         # Do not use iptables if it's compiled as a module (=m), since we already tested for it in the
                         # active list.
@@ -151,11 +151,11 @@
 #
     # Test        : FIRE-4512
     # Description : Check iptables for empty ruleset (should have at least 5 or more rules)
-    if [ ! -z "${IPTABLESBINARY}" -a ${IPTABLES_ACTIVE} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${IPTABLESBINARY}" -a ${IPTABLES_ACTIVE} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no FIRE-4512 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --root-only YES --category security --description "Check iptables for empty ruleset"
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${IPTABLESBINARY} --list --numeric 2> /dev/null | ${EGREPBINARY} -v "^(Chain|target|$)" | ${WCBINARY} -l | ${TRBINARY} -d ' ')
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             FIREWALL_ACTIVE=1
             if [ ${FIND} -le 5 ]; then
                 # Firewall is active, but needs configuration
@@ -174,7 +174,7 @@
 #
     # Test        : FIRE-4513
     # Description : Check iptables for unused rules
-    if [ ! -z "${IPTABLESBINARY}" -a ${IPTABLES_ACTIVE} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${IPTABLESBINARY}" -a ${IPTABLES_ACTIVE} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no FIRE-4513 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --root-only YES --category security --description "Check iptables for unused rules"
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${IPTABLESBINARY} --list --numeric --line-numbers --verbose | ${AWKBINARY} '{ if ($2=="0") print $1 }' | ${XARGSBINARY})
@@ -212,7 +212,7 @@
 
         # Check status with pfctl
         LogText "Test: checking pf status via pfctl"
-        if [ ! -z "${PFCTLBINARY}" ]; then
+        if [ -n "${PFCTLBINARY}" ]; then
             FIND=$(${PFCTLBINARY} -sa 2>&1 | ${GREPBINARY} "^Status" | ${HEADBINARY} -1 | ${AWKBINARY} '{ print $2 }')
             if [ "${FIND}" = "Disabled" ]; then
                 if IsVerbose; then Display --indent 2 --text "- Checking pf status (pfctl)" --result "${STATUS_DISABLED}" --color RED; fi
@@ -233,7 +233,7 @@
         if [ ${PFFOUND} -eq 0 ]; then
             # Check for pf kernel module (FreeBSD and similar)
             LogText "Test: searching for pf kernel module"
-            if [ ! -z "${KLDSTATBINARY}" ]; then
+            if [ -n "${KLDSTATBINARY}" ]; then
                 FIND=$(${KLDSTATBINARY} | ${GREPBINARY} 'pf.ko')
                 if [ -z "${FIND}" ]; then
                     LogText "Result: Can not find pf KLD"
@@ -353,7 +353,7 @@
     # Description : Check IPFW (FreeBSD)
     Register --test-no FIRE-4530 --os FreeBSD --weight L --network NO --category security --description "Check IPFW status"
     if [ ${SKIPTEST} -eq 0 ]; then
-        if [ ! -z "${SYSCTLBINARY}" ]; then
+        if [ -n "${SYSCTLBINARY}" ]; then
             # For now, only check for IPv4.
             FIND=$(${SYSCTLBINARY} net.inet.ip.fw.enable 2> /dev/null | ${AWKBINARY} '{ print $2 }')
             if [ "${FIND}" = "1" ]; then
@@ -386,7 +386,7 @@
     Register --test-no FIRE-4532 --weight L --os "macOS" --preqs-met ${PREQS_MET} --network NO --category security --description "Check macOS application firewall"
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate 2> /dev/null | ${GREPBINARY} "Firewall is enabled")
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             Display --indent 2 --text "- Checking macOS: Application Firewall" --result "${STATUS_ENABLED}" --color GREEN
             AddHP 3 3
             LogText "Result: application firewall of macOS is enabled"
@@ -478,7 +478,7 @@
     Register --test-no FIRE-4536 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check nftables status"
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${LSMODBINARY} | ${AWKBINARY} '{ print $1 }' | ${GREPBINARY} "^nf*_tables")
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Result: found nftables kernel module"
             FIREWALL_ACTIVE=1
             NFTABLES_ACTIVE=1
@@ -526,7 +526,7 @@
     Register --test-no FIRE-4586 --preqs-met ${PREQS_MET} --weight L --network NO --root-only YES --category security --description "Check firewall logging"
     if [ ${SKIPTEST} -eq 0 ]; then
         if [ ${IPTABLES_ACTIVE} -eq 1 ]; then
-            if [ ! -z "${IPTABLESSAVEBINARY}" ]; then
+            if [ -n "${IPTABLESSAVEBINARY}" ]; then
                 HAS_LOGGING=$(${IPTABLESSAVEBINARY} | ${GREPBINARY} "\-j LOG")
                 if [ -z "${HAS_LOGGING}" ]; then
                     Report "firewall_no_logging[]=iptables"
@@ -563,7 +563,7 @@
     # Test        : FIRE-4594
     # Description : Check for APF (Advanced Policy Firewall)
     Register --test-no FIRE-4594 --weight L --network NO --category security --description "Check for APF presence"
-    if [ ! -z "${IPTABLESBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${IPTABLESBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     if [ ${SKIPTEST} -eq 0 ]; then
         FILE="/etc/apf/conf.apf"
         LogText "Test: check ${FILE}"
diff --git a/include/tests_hardening b/include/tests_hardening
index 0719cf8e..006df683 100644
--- a/include/tests_hardening
+++ b/include/tests_hardening
@@ -59,7 +59,7 @@
                 FILE="${ITEM}"
                 LogText "Test: Check file permissions for ${ITEM}"
                 ShowSymlinkPath ${ITEM}
-                if [ ! -z "${SYMLINK}" ]; then
+                if [ -n "${SYMLINK}" ]; then
                     FILE="${SYMLINK}"
                 fi
 
diff --git a/include/tests_homedirs b/include/tests_homedirs
index 9570816b..e51cf3d9 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -114,7 +114,7 @@
     # Description : Check for suspicious shell history files
     Register --test-no HOME-9310 --weight L --network NO --category security --description "Checking for suspicious shell history files"
     if [ ${SKIPTEST} -eq 0 ]; then
-        if [ ! -z "${HOMEDIRS}" ]; then
+        if [ -n "${HOMEDIRS}" ]; then
             if [ "${OS}" = "Solaris" ]; then
                 # Solaris doesn't support -maxdepth
                 FIND=$(${FINDBINARY} ${HOMEDIRS} -name ".*history" ! -type f -print)
@@ -152,7 +152,7 @@
     # Notes       : For performance reasons we combine the scanning of different files, so inode caching is used
     #               as much as possible for every find command
     # Profile opt : ignore-home-dir (multiple lines allowed), ignores home directory
-    if [ ! -z "${REPORTFILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${REPORTFILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no HOME-9350 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Collecting information from home directories"
     if [ ${SKIPTEST} -eq 0 ]; then
         IGNORE_HOME_DIRS=$(${GREPBINARY} "^ignore-home-dir=" ${REPORTFILE} | ${AWKBINARY} -F= '{ print $2 }')
diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index df616e56..3ba08570 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -222,7 +222,7 @@
                 if [ -f "${FILE}" ]; then
                     LogText "Test: checking status in xinetd configuration file (${FILE})"
                     FIND=$(${GREPBINARY} "disable\s*=\s*no" ${FILE})
-                    if [ ! -z "${FIND}" ]; then
+                    if [ -n "${FIND}" ]; then
                         LogText "Result: found insecure service enabled: ${SERVICE}"
                         XINETD_INSECURE_SERVICE_FOUND=1
                         ReportSuggestion "${TEST_NO}" "Disable or remove any insecure services in the xinetd configuration" "${SERVICE}" "text:See log file for more details"
@@ -492,7 +492,7 @@
 #
 #################################################################################
 #
-    if [ ! -z "${LAUNCHCTL_BINARY}" ]; then PREQS_MET="YES"; SKIPREASON=""; else PREQS_MET="NO"; SKIPREASON="No launchctl binary on this system"; fi
+    if [ -n "${LAUNCHCTL_BINARY}" ]; then PREQS_MET="YES"; SKIPREASON=""; else PREQS_MET="NO"; SKIPREASON="No launchctl binary on this system"; fi
     Register --test-no INSE-8050 --os "macOS" --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight M --network NO --category security --description "Check for insecure services on macOS"
     if [ ${SKIPTEST} -eq 0 ]; then
         TEST_SERVICES="com.apple.fingerd"
diff --git a/include/tests_kernel b/include/tests_kernel
index 7a542c3d..2ffd8df9 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -183,7 +183,7 @@
     # Description : Check if Linux is build as a monolithic kernel or not
     Register --test-no KRNL-5723 --os Linux --weight L --network NO --category security --description "Determining if Linux kernel is monolithic"
     if [ ${SKIPTEST} -eq 0 ]; then
-        if [ ! -z "${LSMODBINARY}" -a -f /proc/modules ]; then
+        if [ -n "${LSMODBINARY}" -a -f /proc/modules ]; then
             LogText "Test: checking if kernel is monolithic or modular"
             # Checking if any modules are loaded
             FIND=$(${LSMODBINARY} | ${GREPBINARY} -v "^Module" | wc -l | ${TRBINARY} -s ' ' | ${TRBINARY} -d ' ')
@@ -208,7 +208,7 @@
     # Description : Checking Linux loaded kernel modules
     Register --test-no KRNL-5726 --os Linux --weight L --network NO --category security --description "Checking Linux loaded kernel modules"
     if [ ${SKIPTEST} -eq 0 ]; then
-        if [ ! -z "${LSMODBINARY}" -a -f /proc/modules ]; then
+        if [ -n "${LSMODBINARY}" -a -f /proc/modules ]; then
             FIND=$(${LSMODBINARY} | ${AWKBINARY} '{ if ($1!="Module") print $1 }' | sort)
             Display --indent 2 --text "- Checking loaded kernel modules" --result "${STATUS_DONE}" --color GREEN
             if HasData "${FIND}"; then
@@ -519,7 +519,7 @@
         if [ -d ${ROOTDIR}boot ]; then
             LogText "Result: /boot exists, performing more tests from here"
             FIND=$(${LSBINARY} ${ROOTDIR}boot/* 2> /dev/null)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 if [ -f ${ROOTDIR}boot/vmlinuz -a ! -L ${ROOTDIR}boot/vmlinuz ]; then
                     LogText "Result: found /boot/vmlinuz (not symlinked)"
                     NEXTLINE=0
@@ -532,7 +532,7 @@
                             if [ "${I}" = "version" ]; then NEXTLINE=1; fi
                         fi
                     done
-                    if [ ! -z "${FINDVERSION}" ]; then
+                    if [ -n "${FINDVERSION}" ]; then
                         CURRENT_KERNEL=$(uname -r)
                         if [ ! "${CURRENT_KERNEL}" = "${FINDVERSION}" ]; then
                             LogText "Result: reboot needed, as current kernel is different than the one loaded"
@@ -545,7 +545,7 @@
                     LogText "Result: /found /boot/vmlinuz-linux (usually Arch Linux or similar)"
                     LogText "Test: checking kernel version on disk"
                     VERSION_ON_DISK=$(${FILEBINARY} -b ${ROOTDIR}boot/vmlinuz-linux | ${AWKBINARY} '{ if ($1=="Linux" && $7=="version") { print $8 }}')
-                    if [ ! -z "${VERSION_ON_DISK}" ]; then
+                    if [ -n "${VERSION_ON_DISK}" ]; then
                         LogText "Result: found version ${VERSION_ON_DISK}"
                         ACTIVE_KERNEL=$(uname -r)
                         LogText "Result: active kernel version ${ACTIVE_KERNEL}"
@@ -570,7 +570,7 @@
                     MYKERNEL=$(${UNAMEBINARY} -r | ${SEDBINARY} 's/\.[a-z].*.//g' | ${SEDBINARY} 's/-[a-z].*.//g' | ${SEDBINARY} 's/-/./g')
                     LogText "Result: using ${MYKERNEL} as my kernel version (stripped)"
                     FIND=$(ls ${ROOTDIR}boot/vmlinuz* 2> /dev/null)
-                    if [ ! -z "${FIND}" ]; then
+                    if [ -n "${FIND}" ]; then
                         for ITEM in ${FIND}; do
                             LogText "Result: found ${ITEM}"
                         done
@@ -586,11 +586,11 @@
                         # Examples:
                         # /boot/kernel-genkernel-x86_64-3.14.14-gentoo
                         KERNELS=$(${LSBINARY} ${ROOTDIR}boot/kernel* | ${AWKBINARY} -F- '{ if ($2=="genkernel") { print $4 }}' | ${GREPBINARY} "^[0-9]" | ${SORTBINARY} -n -k1,1 -k2,2 -k3,3 -k4,4 -k5,5 -k6,6 -t \.)
-                        if [ ! -z "${KERNELS}" ]; then LogText "Output: ${KERNELS}"; fi
+                        if [ -n "${KERNELS}" ]; then LogText "Output: ${KERNELS}"; fi
                     else
                         ReportException "${TEST_NO}:2" "Can not find any vmlinuz or kernel files in /boot, which is unexpected"
                     fi
-                    if [ ! -z "${KERNELS}" ]; then
+                    if [ -n "${KERNELS}" ]; then
                         FOUND_KERNEL=0
                         for I in ${KERNELS}; do
                             # Check if we already found a kernel and it is not equal to what we run (e.g. double versions may exist)
diff --git a/include/tests_kernel_hardening b/include/tests_kernel_hardening
index 71ed901e..eba7504d 100644
--- a/include/tests_kernel_hardening
+++ b/include/tests_kernel_hardening
@@ -47,7 +47,7 @@
         done
 
         # Scan custom profile
-        if [ ! -z "${CUSTOM_PROFILE}" ]; then
+        if [ -n "${CUSTOM_PROFILE}" ]; then
             FIND=$(${GREPBINARY} "^config-data=sysctl;" ${CUSTOM_PROFILE} | ${SEDBINARY} 's/ /-space-/g')
             for LINE in ${FIND}; do
                 SYSCTLKEY=$(echo ${LINE} | ${AWKBINARY} -F\; '{ print $2 }')
@@ -57,7 +57,7 @@
         fi
 
         # Last, use data from default profile
-        if [ ! -z "${DEFAULT_PROFILE}" ]; then
+        if [ -n "${DEFAULT_PROFILE}" ]; then
             FIND=$(${GREPBINARY} "^config-data=sysctl;" ${DEFAULT_PROFILE} | ${SEDBINARY} 's/ /-space-/g')
             for LINE in ${FIND}; do
                 SYSCTLKEY=$(echo ${LINE} | ${AWKBINARY} -F\; '{ print $2 }')
@@ -76,7 +76,7 @@
                 tFINDhp=$(echo ${line} | ${AWKBINARY} -F\; '{ print $4 }' | ${GREPBINARY} "[0-9]")
                 tFINDdesc=$(echo ${line} | ${AWKBINARY} -F\; '{ print $5 }' | ${SEDBINARY} 's/-space-/ /g')
                 tFINDcurvalue=$(${SYSCTL_READKEY} ${tFINDkey} 2> /dev/null)
-                if [ ! -z "${tFINDcurvalue}" ]; then
+                if [ -n "${tFINDcurvalue}" ]; then
                     positive_match=0
                     for value in ${tFINDexpvalue}; do
                         if [ "${value}" = "${tFINDcurvalue}" ]; then
diff --git a/include/tests_ldap b/include/tests_ldap
index ae4a9599..0c6ae10e 100644
--- a/include/tests_ldap
+++ b/include/tests_ldap
@@ -66,7 +66,7 @@
             fi
         done
         # Check if we found a valid location
-        if [ ! -z "${SLAPD_CONF_LOCATION}" ]; then
+        if [ -n "${SLAPD_CONF_LOCATION}" ]; then
             Display --indent 4 --text "- Checking slapd.conf" --result "${STATUS_FOUND}" --color GREEN
         else
             Display --indent 4 --text "- Checking slapd.conf" --result "${STATUS_NOT_FOUND}" --color YELLOW
diff --git a/include/tests_logging b/include/tests_logging
index c7995b47..f8492c90 100644
--- a/include/tests_logging
+++ b/include/tests_logging
@@ -262,7 +262,7 @@
 #
     # Test        : LOGG-2148
     # Description : Checking log files rotated with logrotate
-    if [ ! -z "${LOGROTATEBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${LOGROTATEBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no LOGG-2148 --weight L --preqs-met ${PREQS_MET} --network NO --category security --description "Checking logrotated files"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking which files are rotated with logrotate and if they exist"
@@ -311,7 +311,7 @@
         # Try local hosts file
         LogText "Result: Checking for loghost in /etc/inet/hosts"
         FIND=$(${GREPBINARY} loghost /etc/inet/hosts | ${GREPBINARY} -v "^#")
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             SOLARIS_LOGHOST_FOUND=1
             LogText "Result: Found loghost entry in /etc/inet/hosts"
         else
@@ -320,7 +320,7 @@
             # Try name resolving if no entry is present in local host file
             LogText "Result: Checking for loghost via name resolving"
             FIND=$(getent hosts loghost | ${GREPBINARY} loghost)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 SOLARIS_LOGHOST_FOUND=1
                 LogText "Result: name resolving was successful"
                 LogText "Output: ${FIND}"
@@ -356,7 +356,7 @@
         if [ -f ${SYSLOGD_CONF} ]; then
             LogText "Test: check if logs are also logged to a remote logging host"
             FIND=$(${EGREPBINARY} "@[a-zA-Z0-9]|destination\s.+(udp|tcp).+\sport" ${SYSLOGD_CONF} | ${GREPBINARY} -v "^#" | ${GREPBINARY} -v "[a-zA-Z0-9]@")
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: remote logging enabled"
                 REMOTE_LOGGING_ENABLED=1
             else
@@ -364,7 +364,7 @@
                 DESTINATIONS=$(${GREPBINARY} "^destination" ${SYSLOGD_CONF} | ${EGREPBINARY} "(udp|tcp)" | ${GREPBINARY} "port" | ${AWKBINARY} '{print $2}')
                 for DESTINATION in ${DESTINATIONS}; do
                     FIND2=$(${GREPBINARY} "log" ${SYSLOGD_CONF} | ${GREPBINARY} "source" | ${EGREPBINARY} "destination\(${DESTINATION}\)")
-                    if [ ! -z "${FIND2}" = "" ]; then
+                    if [ -n "${FIND2}" = "" ]; then
                         LogText "Result: found destination ${DESTINATION} configured for remote logging"
                         REMOTE_LOGGING_ENABLED=1
                     fi
@@ -461,7 +461,7 @@
     Register --test-no LOGG-2180 --weight L --network NO --category security --description "Checking open log files"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: checking open log files with lsof"
-        if [ ! -z "${LSOFBINARY}" ]; then
+        if [ -n "${LSOFBINARY}" ]; then
             FIND=$(${LSOFBINARY} -n 2>&1 | ${GREPBINARY} "log$" | ${EGREPBINARY} -v "WARNING|Output information" | ${AWKBINARY} '{ if ($5=="REG") { print $9 } }' | ${SORTBINARY} -u | ${GREPBINARY} -v "^$")
             for I in ${FIND}; do
                 LogText "Found logfile: ${I}"
@@ -477,7 +477,7 @@
 #
     # Test        : LOGG-2190
     # Description : Checking deleted files
-    if [ ! -z "${LSOFBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${LSOFBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no LOGG-2190 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking for deleted files in use"
     if [ ${SKIPTEST} -eq 0 ]; then
         EARLY_MYSQL=""
@@ -486,12 +486,12 @@
         LSOF_GREP="WARNING|Output information"
 
         # MySQL versions prior to 5.6 leave lots of deleted in-use files in /tmp, ignoring those
-        if [ ! -z "${DPKGBINARY}" ]; then
+        if [ -n "${DPKGBINARY}" ]; then
             EARLY_MYSQL=$(${DPKGBINARY} -l | ${EGREPBINARY} mysql-server-5.[0-5])
-        elif [ ! -z "${RPMBINARY}" ]; then
+        elif [ -n "${RPMBINARY}" ]; then
             EARLY_MYSQL=$(${RPMBINARY} -qa mariadb | ${EGREPBINARY} mariadb-5.[0-5])
         fi
-        if [ ! -z "${EARLY_MYSQL}" ]; then LSOF_GREP="${LSOF_GREP}|mysqld"; fi
+        if [ -n "${EARLY_MYSQL}" ]; then LSOF_GREP="${LSOF_GREP}|mysqld"; fi
 
         # grsecurity causes Fail2Ban to hold onto deleted in-use files in /var/tmp
         if [ ${GRSEC_FOUND} -eq 1 ]; then LSOF_GREP="${LSOF_GREP}|fail2ban"; fi
@@ -501,7 +501,7 @@
         fi
 
         FIND=$(${LSOFBINARY} -n +L 1 2>&1 | ${EGREPBINARY} -vw "${LSOF_GREP}" | ${EGREPBINARY} -v '/dev/zero|/\[aio\]' | ${AWKBINARY} '{ if ($5=="REG") { printf "%s(%s)\n", $10, $1 } }' | ${GREPBINARY} -v "^$" | ${SORTBINARY} -u)
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Result: found one or more files which are deleted, but still in use"
             for I in ${FIND}; do
                 LogText "Found deleted file: ${I}"
@@ -523,7 +523,7 @@
     Register --test-no LOGG-2192 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking for open log files that are empty"
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${LSOFBINARY} -n -w | ${AWKBINARY} '{if ($5=="REG" && $7=="0" && $9 ~ /log$/) {print $1","$9}}' | ${SORTBINARY} | uniq)
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             for I in ${FIND}; do
                 LogText "Found an opened logfile that is empty: ${I}"
                 Report "open_empty_log_file[]=${I}"
diff --git a/include/tests_mac_frameworks b/include/tests_mac_frameworks
index 516a501e..14b34e4a 100644
--- a/include/tests_mac_frameworks
+++ b/include/tests_mac_frameworks
@@ -50,7 +50,7 @@
     if [ ${APPARMORFOUND} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no MACF-6208 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check if AppArmor is enabled"
     if [ ${SKIPTEST} -eq 0 ]; then
-        if [ ! -z "${AASTATUSBINARY}" ]; then
+        if [ -n "${AASTATUSBINARY}" ]; then
             CAN_READ_FILE=0
             FILE="/sys/kernel/security/apparmor/profiles"
             if [ -f ${FILE} ]; then
@@ -114,7 +114,7 @@
     Register --test-no MACF-6232 --weight L --network NO --category security --description "Check SELINUX presence"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: checking if we have sestatus binary"
-        if [ ! -z "${SESTATUSBINARY}" ]; then
+        if [ -n "${SESTATUSBINARY}" ]; then
             LogText "Result: found sestatus binary (${SESTATUSBINARY})"
             Display --indent 2 --text "- Checking presence SELinux" --result "${STATUS_FOUND}" --color GREEN
         else
@@ -206,7 +206,7 @@
     Register --test-no RBAC-6272 --weight L --network NO --category security --description "Check grsecurity presence"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check Linux kernel configuration
-        if [ ! -z "${LINUXCONFIGFILE}" -a -f "${LINUXCONFIGFILE}" ]; then
+        if [ -n "${LINUXCONFIGFILE}" -a -f "${LINUXCONFIGFILE}" ]; then
             FIND=$(${GREPBINARY} ^CONFIG_GRKERNSEC=y ${LINUXCONFIGFILE})
             if [ ! "${FIND}" = "" ]; then
                 LogText "Result: grsecurity available (in kernel config)"
diff --git a/include/tests_mail_messaging b/include/tests_mail_messaging
index b74a7c5e..f5770bc2 100644
--- a/include/tests_mail_messaging
+++ b/include/tests_mail_messaging
@@ -77,20 +77,20 @@
         # Smarthost or Satellite
         FIND3=$(echo "${EXIM_ROUTERS}" | ${EGREPBINARY} '^smarthost')
 
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             EXIM_TYPE="LOCAL ONLY"
-        elif [ ! -z "${FIND2}" ]; then
+        elif [ -n "${FIND2}" ]; then
             EXIM_TYPE="INTERNET HOST"
-        elif [ ! -z "${FIND3}" ]; then
+        elif [ -n "${FIND3}" ]; then
             FIND4=$(echo "${EXIM_ROUTERS}" | ${EGREPBINARY} '^hub_user_smarthost')
-            if [ ! -z "${FIND4}" ]; then
+            if [ -n "${FIND4}" ]; then
                 EXIM_TYPE="SATELLITE"
             else
                 EXIM_TYPE="SMARTHOST"
             fi
         fi
 
-        if [ ! -z "${EXIM_TYPE}" ]; then
+        if [ -n "${EXIM_TYPE}" ]; then
             LogText "Result: Exim Type - ${EXIM_TYPE}"
             Display --indent 4 --text "- Type" --result "${EXIM_TYPE}" --color GREEN
         else
@@ -101,7 +101,7 @@
         if [ "${EXIM_TYPE}" = "INTERNET HOST" -o "${EXIM_TYPE}" = "SMARTHOST" ]; then
             LogText "Test: Exim Public Interfaces"
             EXIM_IP=$(exim -bP local_interfaces | cut -d '=' -f2 | sed -e 's/\s*<\s*\;\?//' -e 's/\s*::0\s*\;\?//' -e 's/\s*127.0.0.1\s*\;\?//' -e 's/^\s*//' -e 's/\s*$//')
-            if [ ! -z "${EXIM_IP}" ]; then
+            if [ -n "${EXIM_IP}" ]; then
                 LogText "Result: ${EXIM_IP}"
                 Display --indent 4 --text "- Public Interface(s)" --result "${EXIM_IP}" --color GREEN
             else
@@ -111,7 +111,7 @@
 
             LogText "Test: Exim TLS State"
             EXIM_TLS=$(exim -bP tls_advertise_hosts | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
-            if [ ! -z "${EXIM_TLS}" ]; then
+            if [ -n "${EXIM_TLS}" ]; then
                 LogText "Result: Enabled"
                 Display --indent 4 --text "- TLS" --result "ENABLED" --color GREEN
             else
@@ -120,7 +120,7 @@
             fi
         fi
 
-        if [ ! -z "${EXIM_TYPE}" -a "${EXIM_TYPE}" != "LOCAL ONLY" ]; then
+        if [ -n "${EXIM_TYPE}" -a "${EXIM_TYPE}" != "LOCAL ONLY" ]; then
             LogText "Test: Exim Certificate and Private Key"
 
             case "${EXIM_TYPE}" in
@@ -134,7 +134,7 @@
                     ;;
             esac
 
-            if [ ! -z "${EXIM_CERTIFICATE}" ]; then
+            if [ -n "${EXIM_CERTIFICATE}" ]; then
                 LogText "Result: ${EXIM_CERTIFICATE}"
                 if [ -f "${EXIM_CERTIFICATE}" ]; then
                     Display --indent 4 --text "- Certificate" --result "${STATUS_FOUND}" --color GREEN
@@ -148,7 +148,7 @@
                 Display --indent 4 --text "- Certificate not set" --result "${STATUS_WARNING}" --color WHITE
             fi
 
-            if [ ! -z "${EXIM_PRIVATEKEY}" ]; then
+            if [ -n "${EXIM_PRIVATEKEY}" ]; then
                 LogText "Result: ${EXIM_PRIVATEKEY}"
                 if [ -f "${EXIM_PRIVATEKEY}" ]; then
                     LogText "Result: Private Key found."
@@ -175,7 +175,7 @@
         LogText "Test: check Postfix status"
         # Some other processes also use master, therefore it should include both master and postfix
         FIND1=$(${PSBINARY} ax | ${GREPBINARY} "master" | ${GREPBINARY} "postfix" | ${GREPBINARY} -v "grep")
-        if [ ! -z "${FIND1}" ]; then
+        if [ -n "${FIND1}" ]; then
             LogText "Result: found running Postfix process"
             Display --indent 2 --text "- Postfix status" --result "${STATUS_RUNNING}" --color GREEN
             POSTFIX_RUNNING=1
@@ -210,7 +210,7 @@
     if [ ${SKIPTEST} -eq 0  ]; then
         LogText "Test: using postconf to see if Postfix configuration has errors"
         FIND=$(${POSTCONFBINARY} 2>&1 | ${GREPBINARY} "warning:")
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             Report "postfix_config_error=1"
             Display --indent 6 --text "- Postfix configuration errors" --result "${STATUS_WARNING}" --color RED
             LogText "Result: found an error or warning in the Postfix configuration. Manual check suggested."
@@ -233,21 +233,21 @@
         FIND2=$(${POSTCONFBINARY} 2> /dev/null | ${GREPBINARY} '^smtpd_banner' | ${GREPBINARY} '$mail_name')
         FIND3=$(${POSTCONFBINARY} 2> /dev/null | ${GREPBINARY} '^mail_name' | ${GREPBINARY} -i 'postfix')
         FIND4=$(${POSTCONFBINARY} 2> /dev/null | ${GREPBINARY} '^smtpd_banner' | ${GREPBINARY} -i "${OS}")
-        if [ ! -z "${LINUX_VERSION}" ]; then
+        if [ -n "${LINUX_VERSION}" ]; then
             FIND5=$(${POSTCONFBINARY} 2> /dev/null | ${GREPBINARY} '^smtpd_banner' | ${GREPBINARY} -i "${LINUX_VERSION}")
         fi
         SHOWWARNING=0
 
-        if [ ! -z "${FIND1}" ]; then
+        if [ -n "${FIND1}" ]; then
             SHOWWARNING=1
             Report "banner_software_disclosure[]=${FIND1}"
-        elif [ ! -z "${FIND2}" -a ! -z "${FIND3}" ]; then
+        elif [ -n "${FIND2}" -a -n "${FIND3}" ]; then
             SHOWWARNING=1
             Report "banner_software_disclosure[]=${FIND2}"
-        elif [ ! -z "${FIND4}" ]; then
+        elif [ -n "${FIND4}" ]; then
             SHOWWARNING=1
             Report "banner_os_disclosure[]=${FIND4}"
-        elif [ ! -z "${FIND5}" ]; then
+        elif [ -n "${FIND5}" ]; then
             SHOWWARNING=1
             Report "banner_os_disclosure[]=${FIND5}"
         fi
@@ -342,7 +342,7 @@
 #
     # Test        : MAIL-8920
     # Description : Check OpenSMTPD process status
-    if [ ! -z "${SMTPCTLBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${SMTPCTLBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no MAIL-8920 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check OpenSMTPD status"
     if [ ${SKIPTEST} -eq 0  ]; then
         LogText "Test: check smtpd status"
diff --git a/include/tests_malware b/include/tests_malware
index 340224ce..19172ca6 100644
--- a/include/tests_malware
+++ b/include/tests_malware
@@ -45,7 +45,7 @@
     Register --test-no MALW-3275 --weight L --network NO --category security --description "Check for chkrootkit"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: checking presence chkrootkit"
-        if [ ! -z "${CHKROOTKITBINARY}" ]; then
+        if [ -n "${CHKROOTKITBINARY}" ]; then
             Display --indent 2 --text "- ${GEN_CHECKING} chkrootkit" --result "${STATUS_FOUND}" --color GREEN
             LogText "Result: Found ${CHKROOTKITBINARY}"
             MALWARE_SCANNER_INSTALLED=1
@@ -63,7 +63,7 @@
     Register --test-no MALW-3276 --weight L --network NO --category security --description "Check for Rootkit Hunter"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: checking presence Rootkit Hunter"
-        if [ ! -z "${RKHUNTERBINARY}" ]; then
+        if [ -n "${RKHUNTERBINARY}" ]; then
             Display --indent 2 --text "- ${GEN_CHECKING} Rootkit Hunter" --result "${STATUS_FOUND}" --color GREEN
             LogText "Result: Found ${RKHUNTERBINARY}"
             MALWARE_SCANNER_INSTALLED=1
@@ -307,7 +307,7 @@
     Register --test-no MALW-3288 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for ClamXav"
     if [ ${SKIPTEST} -eq 0 ]; then
         CLAMSCANBINARY=$(${LSBINARY} /Applications/ClamXav.app/Contents/Resources/ScanningEngine/bin/ 2> /dev/null | ${GREPBINARY} 'clamscan')
-        if [ ! -z "${CLAMSCANBINARY}" ]; then
+        if [ -n "${CLAMSCANBINARY}" ]; then
             LogText "Result: Found ClamXav clamscan installed"
             Display --indent 2 --text "- ${GEN_CHECKING} ClamXav AV scanner" --result "${STATUS_FOUND}" --color GREEN
             MALWARE_SCANNER_INSTALLED=1
diff --git a/include/tests_nameservices b/include/tests_nameservices
index 2ae503e3..4b4b1ac8 100644
--- a/include/tests_nameservices
+++ b/include/tests_nameservices
@@ -188,7 +188,7 @@
 
         # If files and commands can't be found, use defined value from resolv.conf
         if [ -z "${DOMAINNAME}" ]; then
-            if [ ! -z "${RESOLV_DOMAINNAME}" ]; then
+            if [ -n "${RESOLV_DOMAINNAME}" ]; then
                 LogText "Result: using domain name from ${ROOTDIR}etc/resolv.conf"
                 DOMAINNAME=${RESOLV_DOMAINNAME}
             else
@@ -197,7 +197,7 @@
             fi
         fi
 
-        if [ ! -z "${DOMAINNAME}" ]; then
+        if [ -n "${DOMAINNAME}" ]; then
             LogText "Result: found domain name"
             Report "domainname=${DOMAINNAME}"
             Display --indent 2 --text "- Searching DNS domain name" --result "${STATUS_FOUND}" --color GREEN
@@ -303,7 +303,7 @@
                 LogText "Result: found configuration file (${BIND_CONFIG_LOCATION})"
             fi
         done
-        if [ ! -z "${BIND_CONFIG_LOCATION}" ]; then
+        if [ -n "${BIND_CONFIG_LOCATION}" ]; then
             Display --indent 4 --text "- Checking BIND configuration file" --result "${STATUS_FOUND}" --color GREEN
         else
             Display --indent 4 --text "- Checking BIND configuration file" --result "${STATUS_NOT_FOUND}" --color YELLOW
@@ -449,12 +449,12 @@
 #
     # Test        : NAME-4238
     # Description : Check PowerDNS authoritative status
-    if [ ${POWERDNS_RUNNING} -eq 1 -a ! -z "${POWERDNS_AUTH_CONFIG_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${POWERDNS_RUNNING} -eq 1 -a -n "${POWERDNS_AUTH_CONFIG_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no NAME-4238 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PowerDNS authoritative status"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking for PowerDNS master status"
         FIND=$(${GREPBINARY} "^master=yes" ${POWERDNS_AUTH_CONFIG_LOCATION})
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Found master=yes in configuration file"
             Display --indent 4 --text "- PowerDNS authoritative master: YES"
             POWERDNS_AUTH_MASTER=1
@@ -464,7 +464,7 @@
         fi
         LogText "Test: Checking for PowerDNS slave status"
         FIND=$(${GREPBINARY} "^slave=yes" ${POWERDNS_AUTH_CONFIG_LOCATION})
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Found slave=yes in configuration file"
             Display --indent 4 --text "- PowerDNS authoritative slave: YES"
             POWERDNS_AUTH_SLAVE=1
@@ -509,7 +509,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking $(domainname) for NIS domain value"
         FIND=$(${DOMAINNAMEBINARY} | ${GREPBINARY} -v "(none)")
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Value: ${FIND}"
             NISDOMAIN="${FIND}"
         else
@@ -520,7 +520,7 @@
         if [ -f ${ROOTDIR}etc/defaultdomain ]; then
             LogText "Result: file ${ROOTDIR}etc/defaultdomain exists"
             FIND2=$(cat ${ROOTDIR}etc/defaultdomain)
-            if [ ! -z "${FIND2}" ]; then
+            if [ -n "${FIND2}" ]; then
                 LogText "Output: ${FIND2}"
                 NISDOMAIN="${FIND2}"
             else
@@ -533,7 +533,7 @@
             LogText "Result: file ${ROOTDIR}etc/sysconfig/network exists"
             LogText "Test: checking NISDOMAIN value in file"
             FIND3=$(${GREPBINARY} "^NISDOMAIN" ${ROOTDIR}etc/sysconfig/network | ${AWKBINARY} -F= '{ print $2 }' | ${SEDBINARY} 's/"//g')
-            if [ ! -z "${FIND3}" ]; then
+            if [ -n "${FIND3}" ]; then
                 LogText "Found NIS domain: ${FIND3}"
                 NISDOMAIN="${FIND3}"
             else
@@ -553,7 +553,7 @@
             fi
         fi
         # Check if we found any NIS domain
-        if [ ! -z "${NISDOMAIN}" ]; then
+        if [ -n "${NISDOMAIN}" ]; then
             LogText "Found NIS domain: ${NISDOMAIN}"
             Report "nisdomain=${NISDOMAIN}"
             Display --indent 4 --text "- Checking NIS domain" --result "${STATUS_FOUND}" --color GREEN
@@ -636,7 +636,7 @@
 #
     # Test        : NAME-4408
     # Description : Check localhost entry
-    if [ ! -z "${GETENT_BINARY}" ]; then PREQS_MET="YES"; SKIPREASON="No getent binary"; else PREQS_MET="NO"; SKIPREASON=""; fi
+    if [ -n "${GETENT_BINARY}" ]; then PREQS_MET="YES"; SKIPREASON="No getent binary"; else PREQS_MET="NO"; SKIPREASON=""; fi
     Register --test-no NAME-4408 --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight L --network NO --category security --description "Check localhost entry"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Check server hostname not locally mapped in /etc/hosts"
diff --git a/include/tests_networking b/include/tests_networking
index 8c895c4e..23067c57 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -47,7 +47,7 @@
         IPV6_MISCONFIGURED=0
         IPV6_MISCONFIGURED_MTU=0
         FIND=$(sysctl -a 2> /dev/null | ${GREPBINARY} "^net.ipv6" | ${SEDBINARY} "s/ = /=/")
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             IPV6_CONFIGURED=1
             for I in ${FIND}; do
                 SYSCTL_KEY=$(echo ${I} | ${AWKBINARY} -F= '{ print $1 }')
@@ -124,7 +124,7 @@
         if [ -f /etc/resolv.conf ]; then
             LogText "Result: Found /etc/resolv.conf file"
             FIND=$(${GREPBINARY} '^nameserver' /etc/resolv.conf | ${TRBINARY} -d '\t' | ${SEDBINARY} 's/nameserver*//g' | uniq | ${CUTBINARY} -d# -f1)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 Display --indent 4 --text "- Testing nameservers"
                 LogText "Test: Querying nameservers"
                 for I in ${FIND}; do
@@ -134,7 +134,7 @@
                     if [ "${I}" = "::1" -o "${I}" = "127.0.0.1" -o "${I}" = "127.0.0.53" -o "${I}" = "127.0.1.1" -o "${I}" = "0.0.0.0" ]; then
                         LOCAL_DNSRESOLVER_FOUND=1
                     fi
-                    if [ ! -z "${DIGBINARY}" ]; then
+                    if [ -n "${DIGBINARY}" ]; then
                         # See if we can query something at the nameserver
                         # 0=good, other=bad
                         DNSRESPONSE=$(${DIGBINARY} +noall +time=3 +retry=0 @${I} ${FQDN} > /dev/null ; echo $?)
@@ -167,7 +167,7 @@
     Register --test-no NETW-2705 --preqs-met ${PREQS_MET} --weight L --network YES --category security --description "Check availability two nameservers"
     if [ ${SKIPTEST} -eq 0 ]; then
         SKIP=0
-        if [ ! -z "${DIGBINARY}" ]; then
+        if [ -n "${DIGBINARY}" ]; then
             if [ ${NUMBERACTIVENS} -lt 2 ]; then
                 Display --indent 4 --text "- Minimal of 2 responsive nameservers" --result "${STATUS_WARNING}" --color RED
                 LogText "Result: less than 2 responsive nameservers found"
@@ -193,12 +193,12 @@
     # Test        : NETW-3001
     # Description : Find default gateway (route)
     # More info   : BSD: ^default   Linux: 0.0.0.0
-    if [ ! -z "${NETSTATBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${NETSTATBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no NETW-3001 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Find default gateway (route)"
     if [ $SKIPTEST -eq 0 ]; then
         LogText "Test: Searching default gateway(s)"
         FIND=$(${NETSTATBINARY} -rn | ${EGREPBINARY} "^0.0.0.0|default" | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f2)
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             for I in ${FIND}; do
                 LogText "Result: Found default gateway ${I}"
                 Report "default_gateway[]=${I}"
@@ -222,9 +222,9 @@
                 FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${GREPBINARY} "flags=" | ${AWKBINARY} -F ":" '{ print  $1 }')
             ;;
             Linux)
-                if [ ! -z "${IPBINARY}" ]; then
+                if [ -n "${IPBINARY}" ]; then
                     FIND=$(${IPBINARY} link show 2> /dev/null | ${GREPBINARY} "^[0-9]" | ${AWKBINARY} '{ print $2 }' | ${SEDBINARY} 's/://g')
-                elif [ ! -z "${IFCONFIGBINARY}" ]; then
+                elif [ -n "${IFCONFIGBINARY}" ]; then
                     FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ( $2 == "Link" ) { print  $1 }}')
                 fi
             ;;
@@ -265,14 +265,14 @@
                 FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="ether") print $2 }' | ${SORTBINARY} -u)
                 ;;
             Linux)
-                if [ ! -z "${IFCONFIGBINARY}" ]; then
+                if [ -n "${IFCONFIGBINARY}" ]; then
                     FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${GREPBINARY} "HWaddr" | ${AWKBINARY} '{ if ($4=="HWaddr") print $5 }' | ${SORTBINARY} -u)
                     # CentOS 7.x and others may return nothing. Let's retry with 'ether' field.
                     if [ -z "${FIND}" ]; then
                         FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="ether") print $2 }' | ${SORTBINARY} -u)
                     fi
                 else
-                    if [ ! -z "${IPBINARY}" ]; then
+                    if [ -n "${IPBINARY}" ]; then
                         LogText "Test: Using ip binary to gather hardware addresses"
                         FIND=$(${IPBINARY} link 2> /dev/null | ${GREPBINARY} "link/ether" | ${AWKBINARY} '{ print $2 }')
                     else
@@ -320,12 +320,12 @@
                 FIND2=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6") print $2 }')
                 ;;
             Linux)
-                if [ ! -z "${IFCONFIGBINARY}" ]; then
+                if [ -n "${IFCONFIGBINARY}" ]; then
                     FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet") print $2 }' | ${CUTBINARY} -d ':' -f2)
                     # Version which works for multiple types of ifconfig (e.g. Slackware)
                     FIND2=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6" && $2=="addr:") { print $3 } else { if ($1=="inet6" && $3=="prefixlen") { print $2 } } }')
                 else
-                    if [ ! -z "${IPBINARY}" ]; then
+                    if [ -n "${IPBINARY}" ]; then
                         LogText "Test: Using ip binary to gather IP addresses"
                         FIND=$(${IPBINARY} addr 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet") { print $2 }}' | ${SEDBINARY} 's/\/.*//')
                         FIND2=$(${IPBINARY} addr 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6") { print $2 }}' | ${SEDBINARY} 's/\/.*//')
@@ -375,7 +375,7 @@
         COUNT=0
         case ${OS} in
             DragonFly|FreeBSD)
-                if [ ! -z "${SOCKSTATBINARY}" ]; then
+                if [ -n "${SOCKSTATBINARY}" ]; then
                     FIND=$(${SOCKSTATBINARY} | ${AWKBINARY} '{ if ($7 ~ /\*:\*/) print $5"|"$6"|"$2"|" }' | ${SORTBINARY} -u)
                     # To strip off IP's: ${SEDBINARY} 's/|.*:/|/'
                 else
@@ -513,17 +513,17 @@
         NETWORK=""
         USE_IP_INSTEAD_IFCONFIG=0
 
-        if [ ! -z "${IPBINARY}" ]; then
+        if [ -n "${IPBINARY}" ]; then
             LogText "Test: Using ip binary to retrieve network interfaces"
             NETWORK=$(${IPBINARY} -o link 2> /dev/null | ${GREPBINARY} "^[0-9]" | ${AWKBINARY} '{print $2 }' | ${TRBINARY} -d ':')
             USE_IP_INSTEAD_IFCONFIG=1
-        elif [ ! -z "${IFCONFIGBINARY}" ]; then
+        elif [ -n "${IFCONFIGBINARY}" ]; then
             LogText "Test: Using ifconfig binary to retrieve network interfaces"
             NETWORK=$(${IFCONFIGBINARY} 2> /dev/null | ${GREPBINARY} Link | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f1)
         fi
 
         LogText "Test: Checking all interfaces to discover any with promiscuous mode enabled"
-        if [ ! -z "${NETWORK}" ]; then
+        if [ -n "${NETWORK}" ]; then
             FOUNDPROMISC=0
             for I in ${NETWORK}; do
                 if [ ${USE_IP_INSTEAD_IFCONFIG} -eq 1 ]; then
@@ -531,7 +531,7 @@
                 else
                     FIND=$(${IFCONFIGBINARY} ${I} 2> /dev/null | ${GREPBINARY} PROMISC)
                 fi
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     LogText "Result: Promiscuous interface: ${I}"
                     ISWHITELISTED=$(${GREPBINARY} "^if_promisc:${I}:" ${PROFILE})
                     if [ -z "${ISWHITELISTED}" ]; then
diff --git a/include/tests_php b/include/tests_php
index 76606c64..ef43f282 100644
--- a/include/tests_php
+++ b/include/tests_php
@@ -139,7 +139,7 @@
             fi
         done
 
-        if [ ! -z "${PHPINIFILE}" ]; then
+        if [ -n "${PHPINIFILE}" ]; then
             Display --indent 2 --text "- Checking PHP" --result "${STATUS_FOUND}" --color GREEN
             LogText "Result: using single file ${PHPINIFILE} for main php.ini tests"
             LogText "Result: using php.ini array ${PHPINI_ALLFILES} for further tests"
@@ -154,7 +154,7 @@
 #
     # Test        : PHP-2320
     # Description : Check php disable functions option
-    if [ ! -z "${PHPINI_ALLFILES}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${PHPINI_ALLFILES}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PHP-2320 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP disabled functions"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
@@ -194,7 +194,7 @@
     # Test        : PHP-2368
     # Description : Check php register_globals option
     # Notes       : Don't test for it if PHP version is 5.4.0 or later (it has been removed)
-    if [ ! -z "${PHPINIFILE}" -a ! -z "${PHPVERSION}" -a ! -z "${EGREPBINARY}" ]; then
+    if [ -n "${PHPINIFILE}" -a -n "${PHPVERSION}" -a -n "${EGREPBINARY}" ]; then
         if [ -f "${PHPINIFILE}" ]; then
             FIND=$(echo ${PHPVERSION} | ${EGREPBINARY} "^(4.|5.[0-3])")
             if [ -z "${FIND}" ]; then
@@ -215,7 +215,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking PHP register_globals option"
         FIND=$(${EGREPBINARY} -i 'register_globals.*(on|yes|1)' ${PHPINIFILE} | ${GREPBINARY} -v '^;')
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             Display --indent 4 --text "- Checking register_globals option" --result "${STATUS_WARNING}" --color RED
             ReportWarning ${TEST_NO} "PHP option register_globals option is turned on, which can be a risk for variable value overwriting"
             ReportSuggestion ${TEST_NO} "Change the register_globals line to: register_globals = Off"
@@ -235,7 +235,7 @@
     # Description : Check PHP expose_php option
     # Background  : When this option is turned on, PHP will show its version number in the HTTP headers
     # Notes       : TODO - Extend test to check all PHP files
-    if [ ! -z "${PHPINI_ALLFILES}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${PHPINI_ALLFILES}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PHP-2372 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP expose_php option"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
@@ -266,12 +266,12 @@
     # Test        : PHP-2374
     # Description : Check PHP enable_dl option
     # Notes       : Extend test to check all PHP files
-    if [ ! -z "${PHPINIFILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${PHPINIFILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PHP-2374 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP enable_dl option"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking PHP enable_dl option"
         FIND=$(${EGREPBINARY} -i 'enable_dl.*(on|yes|1)' ${PHPINIFILE} | ${GREPBINARY} -v '^;')
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             Display --indent 4 --text "- Checking enable_dl option" --result "${STATUS_ON}" --color YELLOW
             Report "Result: enable_dl option is turned on, which can be used to enable more modules dynamically and circumventing security controls"
             ReportSuggestion ${TEST_NO} "Change the enable_dl line to: enable_dl = Off, to disable dynamically loading new modules"
@@ -288,7 +288,7 @@
     # Test        : PHP-2376
     # Description : Check PHP allow_url_fopen option
     # Notes       : Extend test to check all PHP files YYY
-    if [ ! -z "${PHPINIFILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${PHPINIFILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PHP-2376 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP allow_url_fopen option"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking PHP allow_url_fopen option"
@@ -311,7 +311,7 @@
     # Test        : PHP-2378
     # Description : Check PHP allow_url_include option
     # Notes       : Extend test to check all PHP files YYY
-    if [ ! -z "${PHPINIFILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${PHPINIFILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PHP-2378 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP allow_url_include option"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking PHP allow_url_include option"
@@ -333,7 +333,7 @@
     # - test disabled for time being, as newer suhosin7 work is not stable enough -
     # Test        : PHP-2379
     # Description : Check PHP suhosin extension status
-    #if [ ! -z "${PHPINI_ALLFILES}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    #if [ -n "${PHPINI_ALLFILES}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     #Register --test-no PHP-2379 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP suhosin extension status"
 
     #if [ ${SKIPTEST} -eq 0 ]; then
@@ -365,14 +365,14 @@
     #    fi
 
     #    # Check Suhosin for PHP 7
-    #    if [ ! -z "${MAJOR_VERSION}" -a ${FOUND} -eq 1 ]; then
+    #    if [ -n "${MAJOR_VERSION}" -a ${FOUND} -eq 1 ]; then
     #        LogText "Test: Check Suhosin for PHP 7 is not enabled"
     #        LogText "Result: Suhosin for PHP 7 is in alpha stage and should not be used in production"
     #        ReportSuggestion ${TEST_NO} "Disable Suhosin for PHP 7"
     #        Display --indent 4 --text "- Checking PHP suhosin extension status" --result "${STATUS_WARNING}" --color RED
     #        Display --indent 6 --text "- Suhosin is enabled for PHP 7" --result "${STATUS_WARNING}" --color RED
     #        AddHP 0 1
-    #    elif [ ! -z "${MAJOR_VERSION}" -a ${FOUND} -eq 0 ]; then
+    #    elif [ -n "${MAJOR_VERSION}" -a ${FOUND} -eq 0 ]; then
     #        LogText "Test: Check Suhosin for PHP 7 is not enabled"
     #        LogText "Result: Suhosin for PHP 7 is not enabled"
     #        Display --indent 4 --text "- Checking PHP suhosin extension status" --result "${STATUS_OK}" --color GREEN
diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 6b6b2ed9..e82c8eaf 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -88,7 +88,7 @@
     # Test        : PKGS-7303
     # Description : Query brew package manager
     FIND=$(which brew 2> /dev/null | grep -v "no [^ ]* in ")
-    if [ ! -z "${FIND}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${FIND}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7303 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Query brew package manager"
     if [ ${SKIPTEST} -eq 0 ]; then
         Display --indent 4 --text "- Searching brew" --result "${STATUS_FOUND}" --color GREEN
@@ -158,7 +158,7 @@
 #
     # Test        : PKGS-7308
     # Description : RPM package based systems
-    if [ ! -z "${RPMBINARY}" -a -z "${DNFBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${RPMBINARY}" -a -z "${DNFBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7308 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking package list with RPM"
     if [ ${SKIPTEST} -eq 0 ]; then
         COUNT=0
@@ -191,7 +191,7 @@
 #
     # Test        : PKGS-7310
     # Description : pacman package based systems
-    if [ ! -z "${PACMANBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${PACMANBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7310 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking package list with pacman"
     if [ ${SKIPTEST} -eq 0 ]; then
         COUNT=0
@@ -222,12 +222,12 @@
 #
     # Test        : PKGS-7312
     # Description : Check for available package updates when pacman package is used
-    if [ ! -z "${PACMANBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${PACMANBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7312 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking available updates for pacman based system"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
         FIND=$(which checkupdates 2> /dev/null | grep -v "no [^ ]* in ")
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             FIND=$(checkupdates)
             for I in ${FIND}; do
                 LogText "Result: update available for ${I}"
@@ -252,7 +252,7 @@
     # Test        : PKGS-7314
     # Description : Check pacman.conf options
     PACMANCONF="/etc/pacman.conf"
-    if [ ! -z "${PACMANBINARY}" -a -f ${PACMANCONF} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${PACMANBINARY}" -a -f ${PACMANCONF} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7314 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking pacman configuration options"
     if [ ${SKIPTEST} -eq 0 ]; then
         COUNT=0
@@ -315,7 +315,7 @@
 #
     # Test        : PKGS-7322
     # Description : Discover vulnerable packages with arch-audit
-    if [ ! -z "${ARCH_AUDIT_BINARY}" ]; then PREQS_MET="YES"; SKIPREASON=""; else PREQS_MET="NO"; SKIPREASON="arch-audit not found"; fi
+    if [ -n "${ARCH_AUDIT_BINARY}" ]; then PREQS_MET="YES"; SKIPREASON=""; else PREQS_MET="NO"; SKIPREASON="arch-audit not found"; fi
     Register --test-no PKGS-7322 --os "Linux" --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight L --network NO --category security --description "Discover vulnerable packages with arch-audit"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: checking arch-audit output for vulnerable packages"
@@ -338,14 +338,14 @@
 #
     # Test        : PKGS-7328
     # Description : Check installed packages with Zypper
-    if [ ! -z "${ZYPPERBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${ZYPPERBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7328 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Querying Zypper for installed packages"
     if [ ${SKIPTEST} -eq 0 ]; then
         COUNT=0
         PACKAGE_AUDIT_TOOL_FOUND=1
         PACKAGE_AUDIT_TOOL="zypper"
         FIND=$(${ZYPPERBINARY} --non-interactive -n se -t package -i | ${AWKBINARY} '{ if ($1=="i") { print $3 } }')
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             for PKG in ${FIND}; do
                 COUNT=$((COUNT + 1))
                 LogText "Installed package: ${PKG}"
@@ -362,11 +362,11 @@
 #
     # Test        : PKGS-7330
     # Description : Check vulnerable packages with Zypper
-    if [ ! -z "${ZYPPERBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${ZYPPERBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7330 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Querying Zypper for vulnerable packages"
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${ZYPPERBINARY} --non-interactive pchk | ${GREPBINARY} "(0 security patches)")
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Result: No security updates found with Zypper"
             Display --indent 2 --text "- Using Zypper to find vulnerable packages" --result "${STATUS_NONE}" --color GREEN
         else
@@ -520,7 +520,7 @@
     # Test        : PKGS-7350
     # Description : Use Dandified YUM to gather installed packages
     # Notes       : Possible replacement for YUM in the long term
-    if [ ! -z "${DNFBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${DNFBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no "PKGS-7350" --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking for installed packages with DNF utility"
     if [ ${SKIPTEST} -eq 0 ]; then
         COUNT=0
@@ -546,13 +546,13 @@
 #
     # Test        : PKGS-7352
     # Description : Use Dandified YUM to detect security updates
-    if [ ! -z "${DNFBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${DNFBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no "PKGS-7352" --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking for security updates with DNF utility"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check for security updates
         LogText "Action: checking updateinfo for security updates"
         FIND=$(${DNFBINARY} -q updateinfo list sec 2> /dev/null | ${AWKBINARY} '{ if ($2=="security") { print $3 }}')
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             VULNERABLE_PACKAGES_FOUND=1
             LogText "Result: found vulnerable packages, upgrade of system needed."
             for PKG in ${FIND}; do
@@ -574,20 +574,20 @@
 #
     # Test        : PKGS-7354
     # Description : Perform integrity tests for package database
-    if [ ! -z "${DNFBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${DNFBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no "PKGS-7354" --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking package database integrity"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if repoquery plugin is available
         FIND=$(${DNFBINARY} 2>&1 | ${GREPBINARY} "^repoquery")
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Action: checking integrity of package database"
             FIND=$(${DNFBINARY} -q repoquery --duplicated)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: found unexpected result on repoquery --duplicated"
                 ReportSuggestion "${TEST_NO}" "Check output of: dnf repoquery --duplicated"
             fi
             FIND=$(${DNFBINARY} -q repoquery --unsatisfied)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: found unexpected result on repoquery --unsatisfied"
                 ReportSuggestion "${TEST_NO}" "Check output of: dnf repoquery --unsatisfied"
             fi
@@ -600,17 +600,17 @@
 #
     # Test        : PKGS-7366
     # Description : Checking if debsecan is installed and enabled on Debian systems
-    if [ ! -z "${DEBSECANBINARY}" -a "${OS}" = "Linux" -a "${LINUX_VERSION}" = "Debian" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${DEBSECANBINARY}" -a "${OS}" = "Linux" -a "${LINUX_VERSION}" = "Debian" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no "PKGS-7366" --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking for debsecan utility"
     if [ ${SKIPTEST} -eq 0 ]; then
-        if [ ! -z "${DEBSECANBINARY}" ]; then
+        if [ -n "${DEBSECANBINARY}" ]; then
             LogText "Result: debsecan utility is installed"
             Display --indent 4 --text "- debsecan utility" --result "${STATUS_FOUND}" --color GREEN
             AddHP 3 3
             PACKAGE_AUDIT_TOOL_FOUND=1
             PACKAGE_AUDIT_TOOL="debsecan"
             FIND=$(${FINDBINARY} ${ROOTDIR}etc/cron* -name debsecan)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: cron job is configured for debsecan"
                 Display --indent 6 --text "- debsecan cron job" --result "${STATUS_FOUND}" --color GREEN
                 AddHP 3 3
@@ -633,10 +633,10 @@
     # Test        : PKGS-7370
     # Description : Checking debsums installation status and presence in cron job
     # Note        : Run this only when it is a DPKG based system
-    if [ ! -z "${DPKGBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${DPKGBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no "PKGS-7370" --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking for debsums utility"
     if [ ${SKIPTEST} -eq 0 ]; then
-        if [ ! -z "${DEBSUMSBINARY}" ]; then
+        if [ -n "${DEBSUMSBINARY}" ]; then
             LogText "Result: debsums utility is installed"
             Display --indent 4 --text "- debsums utility" --result "${STATUS_FOUND}" --color GREEN
             AddHP 1 1
@@ -728,7 +728,7 @@
     # Description : Check for vulnerable FreeBSD packages (with pkg)
     # Notes       : Related vulnerability file is /var/db/pkg/vuln.xml
     # TODO        : Run this in any jail
-    if [ ! -z "${PKG_BINARY}" ]; then PREQS_MET="YES"; SKIPREASON=""; else PREQS_MET="NO"; SKIPREASON="pkg tool not available"; fi
+    if [ -n "${PKG_BINARY}" ]; then PREQS_MET="YES"; SKIPREASON=""; else PREQS_MET="NO"; SKIPREASON="pkg tool not available"; fi
     Register --test-no PKGS-7381 --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight L --network NO --category security --description "Check for vulnerable FreeBSD packages with pkg"
     if [ ${SKIPTEST} -eq 0 ]; then
         COUNT=0
@@ -746,7 +746,7 @@
                 Display --indent 2 --text "- Checking pkg audit to obtain vulnerable packages" --result "${STATUS_NONE}" --color GREEN
                 AddHP 10 10
             elif [ $? -eq 1 ]; then
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     VULNERABLE_PACKAGES_FOUND=1
                     Display --indent 2 --text "- Checking pkg audit to obtain vulnerable packages" --result "${STATUS_FOUND}" --color YELLOW
                     for ITEM in ${FIND}; do
@@ -804,7 +804,7 @@
     # Test        : PKGS-7383
     # Description : Check for YUM package Update management
     # Notes       : Skip if DNF is used as package manager
-    if [ ! -z "${YUMBINARY}" -a -z "${DNFBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${YUMBINARY}" -a -z "${DNFBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7383 --preqs-met ${PREQS_MET} --os Linux --weight M --network NO --category security --description "Check for YUM package update management"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: YUM package update management"
@@ -823,7 +823,7 @@
 #
     # Test        : PKGS-7384
     # Description : Search for YUM utils package
-    if [ ! -z "${YUMBINARY}" -a -z "${DNFBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${YUMBINARY}" -a -z "${DNFBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7384 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --category security --description "Check for YUM utils package"
     if [ ${SKIPTEST} -eq 0 ]; then
         # package-cleanup tool can be found in different locations
@@ -903,7 +903,7 @@
         # Check if it's installed as package (this is old style)
         if [ ${DO_TEST} -eq 0 ]; then
             FIND=$(rpm -q yum-security yum-plugin-security | ${GREPBINARY} -v "not installed")
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: found yum-plugin-security package"
                 DO_TEST=1
             fi
@@ -943,7 +943,7 @@
     if [ -x ${ROOTDIR}usr/bin/yum -a -z "${DNFBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7387 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --category security --description "Check for GPG signing in YUM security package"
     if [ ${SKIPTEST} -eq 0 ]; then
-        if [ ! -z "${PYTHONBINARY}" ]; then
+        if [ -n "${PYTHONBINARY}" ]; then
             LogText "Test: checking enabled repositories"
             REPOS=$(${PYTHONBINARY} -c 'import yum ; yb = yum.YumBase() ; yb.conf ; print [(r.id + "=" + str(r.gpgcheck)) for r in yb.repos.listEnabled()]' | ${GREPBINARY} "^\[" | ${TRBINARY} -d '[] ' | ${TRBINARY} -d "'" | ${SEDBINARY} 's/,/ /g')
             if [ -z "${REPOS}" ]; then LogText "Result: found no repositories"; fi
@@ -991,7 +991,7 @@
             if [ -f ${ROOTDIR}etc/apt/sources.list ]; then
                 LogText "Searching for security.debian.org/security.ubuntu.com or security repositories in /etc/apt/sources.list file"
                 FIND=$(${EGREPBINARY} "security.debian.org|security.ubuntu.com|security/? " ${ROOTDIR}etc/apt/sources.list | ${GREPBINARY} -v '#' | ${SEDBINARY} 's/ /!space!/g')
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     FOUND=1
                     Display --indent 2 --text "- Checking security repository in sources.list file" --result "${STATUS_OK}" --color GREEN
                     LogText "Result: Found security repository in ${ROOTDIR}etc/apt/sources.list"
@@ -1004,7 +1004,7 @@
             if [ -d /etc/apt/sources.list.d ]; then
                 LogText "Searching for security.debian.org/security.ubuntu.com or security repositories in /etc/apt/sources.list.d directory"
                 FIND=$(${EGREPBINARY} -r "security.debian.org|security.ubuntu.com|security/? " /etc/apt/sources.list.d | ${GREPBINARY} -v '#' | ${SEDBINARY} 's/ /!space!/g')
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     FOUND=1
                     Display --indent 2 --text "- Checking security repository in sources.list.d directory" --result "${STATUS_OK}" --color GREEN
                     LogText "Result: Found security repository in one or more files in directory /etc/apt/sources.list.d"
@@ -1100,7 +1100,7 @@
         # Trying also with apt-get directly (does not always work, as updates are distributed on both -security and -updates)
         # Show packages which would be upgraded and match 'security' in repository name
         FIND=$(${ROOTDIR}usr/bin/apt-get --dry-run --show-upgraded upgrade 2> /dev/null | ${GREPBINARY} '-security' | ${GREPBINARY} "^Inst" | ${CUTBINARY} -d ' ' -f2 | ${SORTBINARY} -u)
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             VULNERABLE_PACKAGES_FOUND=1
             SCAN_PERFORMED=1
             LogText "Result: found vulnerable package(s) via apt-get (-security channel)"
@@ -1247,7 +1247,7 @@
         KERNELS=0
         LogText "Test: Checking how many kernel packages are installed"
 
-        if [ ! -z "${DPKGBINARY}" ]; then
+        if [ -n "${DPKGBINARY}" ]; then
             KERNELS=$(${DPKGBINARY} -l 2> /dev/null | ${GREPBINARY} "linux-image-[0-9]" | ${WCBINARY} -l)
             if [ ${KERNELS} -eq 0 ]; then
                 LogText "Result: found no kernels from dpkg -l output, which is unexpected"
@@ -1258,7 +1258,7 @@
             else
                 LogText "Result: found ${KERNELS} kernel packages on the system, which is fine"
             fi
-        elif [ ! -z "${RPMBINARY}" ]; then
+        elif [ -n "${RPMBINARY}" ]; then
             KERNELS=$(${RPMBINARY} -q kernel 2> /dev/null | ${WCBINARY} -l)
             if [ ${KERNELS} -eq 0 ]; then
                 LogText "Result: found no kernels from rpm -q kernel output, which is unexpected"
diff --git a/include/tests_printers_spools b/include/tests_printers_spools
index 5c492a9e..5786f4c7 100644
--- a/include/tests_printers_spools
+++ b/include/tests_printers_spools
@@ -211,7 +211,7 @@
         FileIsReadable ${QDAEMON_CONFIG_FILE}
         if [ ${CANREAD} -eq 1 ]; then
             FIND=$(${GREPBINARY} -v "^\*" ${QDAEMON_CONFIG_FILE} | ${EGREPBINARY} "backend|device")
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: printers are defined in ${QDAEMON_CONFIG_FILE}"
                 Display --indent 2 --text "- Checking /etc/qconfig file" --result "${STATUS_FOUND}" --color GREEN
                 QDAEMON_CONFIG_ENABLED=1
@@ -279,7 +279,7 @@
 #################################################################################
 #
 
-if [ ! -z ${PRINTING_DAEMON} ]; then Report "printing_daemon=${PRINTING_DAEMON}"; fi
+if [ -n ${PRINTING_DAEMON} ]; then Report "printing_daemon=${PRINTING_DAEMON}"; fi
 
 WaitForKeyPress
 
diff --git a/include/tests_scheduling b/include/tests_scheduling
index 91a89c63..98b29932 100644
--- a/include/tests_scheduling
+++ b/include/tests_scheduling
@@ -170,7 +170,7 @@
             if [ -f /etc/anacrontab ]; then
                 LogText "Test: checking anacrontab"
                 sANACRONJOBS=$(${EGREPBINARY} '^([0-9@])' /etc/anacrontab | ${TRBINARY} '\t' ' ' | ${TRBINARY} -s ' ' | ${TRBINARY} ' ' ',' | ${SORTBINARY})
-                if [ ! -z "${sANACRONJOBS}" ]; then
+                if [ -n "${sANACRONJOBS}" ]; then
                     Report "scheduler[]=anacron"
                     for I in ${sANACRONJOBS}; do
                         LogText "Found anacron job (/etc/anacrontab): ${I}"
@@ -201,7 +201,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking atd status"
         FIND=$(${PSBINARY} ax | ${GREPBINARY} "/atd" | ${GREPBINARY} -v "grep")
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Result: at daemon active"
             Display --indent 2 --text "- Checking atd status" --result "${STATUS_RUNNING}" --color GREEN
             ATD_RUNNING=1
diff --git a/include/tests_shells b/include/tests_shells
index 3a094ad8..8e97ae86 100644
--- a/include/tests_shells
+++ b/include/tests_shells
@@ -126,7 +126,7 @@
             FIND=$(${GREPBINARY} 'TMOUT=' ${ROOTDIR}etc/profile | ${TRBINARY} -d ' ' | ${TRBINARY} -d '\t' | ${GREPBINARY} -v "^#" | ${SEDBINARY} 's/export//' | ${SEDBINARY} 's/#.*//' | ${AWKBINARY} -F= '{ print $2 }')
             # Determine if the value is exported (with export, readonly, or typeset)
             FIND2=$(${GREPBINARY} '\(export\|readonly\|typeset -r\)[ \t]*TMOUT' ${ROOTDIR}etc/profile | ${GREPBINARY} -v "^#" | ${SEDBINARY} 's/#.*//' | ${AWKBINARY} '{ print $1 }')
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 N=0; IDLE_TIMEOUT=1
                 for I in ${FIND}; do
                     LogText "Output: ${I}"
@@ -143,7 +143,7 @@
                 LogText "Result: could not find TMOUT setting in ${ROOTDIR}etc/profile"
             fi
 
-            if [ ! -z "${FIND2}" ]; then
+            if [ -n "${FIND2}" ]; then
                 N=0;
                 for I in ${FIND2}; do
                     LogText "Output: ${I}"
@@ -167,12 +167,12 @@
 
         if [ -d ${ROOTDIR}etc/profile.d ]; then
             FIND=$(${LSBINARY} ${ROOTDIR}etc/profile.d/*.sh 2> /dev/null)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 # Determine if we can find a TMOUT value
                 FIND=$(${FINDBINARY} ${ROOTDIR}etc/profile.d -name "*.sh" -type f -exec cat {} \; 2> /dev/null | ${GREPBINARY} 'TMOUT=' | ${TRBINARY} -d ' ' | ${TRBINARY} -d '\t' | ${GREPBINARY} -v "^#" | ${SEDBINARY} 's/export//' | ${SEDBINARY} 's/#.*//' | ${AWKBINARY} -F= '{ print $2 }')
                 # Determine if the value is exported (with export, readonly, or typeset)
                 FIND2=$(${FINDBINARY} ${ROOTDIR}etc/profile.d -name "*.sh" -type f -exec cat {} \; 2> /dev/null | ${GREPBINARY} '\(export\|readonly\|typeset -r\)[ \t]*TMOUT' | ${GREPBINARY} -v "^#" | ${SEDBINARY} 's/#.*//' | ${AWKBINARY} '{ print $1 }')
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     N=0; IDLE_TIMEOUT=1
                     for I in ${FIND}; do
                         LogText "Output: ${I}"
@@ -189,7 +189,7 @@
                     LogText "Result: could not find TMOUT setting in ${ROOTDIR}etc/profile.d/*.sh"
                 fi
                 # Check for readonly
-                if [ ! -z "${FIND2}" ]; then
+                if [ -n "${FIND2}" ]; then
                     N=0;
                     for I in ${FIND2}; do
                         LogText "Output: ${I}"
@@ -212,10 +212,10 @@
             LogText "Result: skip ${ROOTDIR}etc/profile.d directory test, directory not available on this system"
         fi
 
-        if [ ! -z "${IDLE_TIMEOUT_METHOD}" ]; then
+        if [ -n "${IDLE_TIMEOUT_METHOD}" ]; then
             Report "session_timeout_method[]=${IDLE_TIMEOUT_METHOD}"
         fi
-        if [ ! -z "${IDLE_TIMEOUT_READONLY}" ]; then
+        if [ -n "${IDLE_TIMEOUT_READONLY}" ]; then
             Report "session_timeout_set_readonly=${IDLE_TIMEOUT_READONLY}"
         fi
 
diff --git a/include/tests_snmp b/include/tests_snmp
index 5140555f..8b82d9e8 100644
--- a/include/tests_snmp
+++ b/include/tests_snmp
@@ -74,7 +74,7 @@
 #
     # Test        : SNMP-3306
     # Description : Determine SNMP communities
-    if [ ! -z "${SNMP_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${SNMP_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SNMP-3306 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check SNMP communities"
     if [ ${SKIPTEST} -eq 0 ]; then
         WARN=0
diff --git a/include/tests_squid b/include/tests_squid
index c9eb1b71..bfb699f0 100644
--- a/include/tests_squid
+++ b/include/tests_squid
@@ -43,7 +43,7 @@
         FOUND=0
         # Check running processes
         FIND=$(${PSBINARY} ax | ${EGREPBINARY} "(squid|squid3) " | ${GREPBINARY} -v "grep")
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             SQUID_DAEMON_RUNNING=1
             LogText "Result: Squid daemon is running"
             Display --indent 2 --text "- Checking running Squid daemon" --result "${STATUS_FOUND}" --color GREEN
@@ -86,10 +86,10 @@
 #
     # Test        : SQD-3606
     # Description : Check Squid version
-    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! -z "${SQUID_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a -n "${SQUID_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SQD-3606 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check Squid version"
     if [ ${SKIPTEST} -eq 0 ]; then
-        if [ ! -z "${SQUIDBINARY}" ]; then
+        if [ -n "${SQUIDBINARY}" ]; then
             LogText "Result: Squid binary found (${SQUIDBINARY})"
             # Skip check if a setuid/setgid bit is found
             FIND=$(${FINDBINARY} ${SQUIDBINARY} \( -perm 4000 -o -perm 2000 \) -print)
@@ -110,7 +110,7 @@
 #
     # Test        : SQD-3610
     # Description : Check Squid configuration options
-    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! -z "${SQUID_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a -n "${SQUID_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SQD-3610 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Gather Squid settings"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking all specific defined options in ${SQUID_DAEMON_CONFIG}"
@@ -127,12 +127,12 @@
 #
     # Test        : SQD-3613
     # Description : Check Squid configuration file permissions
-    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! -z "${SQUID_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a -n "${SQUID_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SQD-3613 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check Squid file permissions"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking file permissions of ${SQUID_DAEMON_CONFIG}"
         FIND=$(find ${SQUID_DAEMON_CONFIG} -type f -a \( -perm -004 -o -perm -002 -o -perm -001 \))
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Result: file ${SQUID_DAEMON_CONFIG} is world readable, writable or executable and could leak information or passwords"
             Display --indent 4 --text "- Checking Squid configuration file permissions" --result "${STATUS_WARNING}" --color RED
             ReportSuggestion ${TEST_NO} "Check file permissions of ${SQUID_DAEMON_CONFIG} to limit access"
@@ -147,7 +147,7 @@
 #
 #################################################################################
 #
-    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! -z "${SQUID_DAEMON_CONFIG}" ]; then
+    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a -n "${SQUID_DAEMON_CONFIG}" ]; then
         Display --indent 4 --text "- Checking Squid access control"
     fi
 #
@@ -155,7 +155,7 @@
 #
     # Test        : SQD-3614
     # Description : Check Squid authentication
-    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! -z "${SQUID_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a -n "${SQUID_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SQD-3614 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check Squid authentication methods"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: check auth_param option for authentication methods"
@@ -176,7 +176,7 @@
 #
     # Test        : SQD-3616
     # Description : Check external Squid authentication
-    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! -z "${SQUID_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a -n "${SQUID_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SQD-3616 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check external Squid authentication"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: check external_acl_type option for external authentication helpers"
@@ -265,7 +265,7 @@
 #
 #################################################################################
 #
-    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! -z "${SQUID_DAEMON_CONFIG}" ]; then
+    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a -n "${SQUID_DAEMON_CONFIG}" ]; then
         Display --indent 4 --text "- Checking Squid Denial of Service tuning options"
     fi
 #
@@ -273,7 +273,7 @@
 #
     # Test        : SQD-3630 [T]
     # Description : Check reply_body_max_size value
-    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! -z "${SQUID_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a -n "${SQUID_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SQD-3630 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check Squid reply_body_max_size option"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: checking option reply_body_max_size"
@@ -293,7 +293,7 @@
 #
 #################################################################################
 #
-    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! -z "${SQUID_DAEMON_CONFIG}" ]; then
+    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a -n "${SQUID_DAEMON_CONFIG}" ]; then
         Display --indent 4 --text "- Checking Squid general options"
     fi
 #
@@ -301,7 +301,7 @@
 #
     # Test        : SQD-3680
     # Description : Check httpd_suppress_version_string
-    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! -z "${SQUID_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a -n "${SQUID_DAEMON_CONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SQD-3680 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check Squid version suppression"
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${GREPBINARY} "^httpd_suppress_version_string " ${SQUID_DAEMON_CONFIG} | ${GREPBINARY} " on")
diff --git a/include/tests_ssh b/include/tests_ssh
index 8a55eabf..377d043f 100644
--- a/include/tests_ssh
+++ b/include/tests_ssh
@@ -104,7 +104,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         OPENSSHD_VERSION=$(${SSHDBINARY} -t -d 2>&1 | ${GREPBINARY} 'sshd version' | ${AWKBINARY} '{if($4~OpenSSH_){print $4}}' | ${AWKBINARY} -F_ '{print $2}' | ${TRBINARY} -d '[:cntrl:],')
         LogText "Result: discovered OpenSSH version is ${OPENSSHD_VERSION}"
-        if [ ! -z ${OPENSSHD_VERSION} ]; then
+        if [ -n ${OPENSSHD_VERSION} ]; then
             OPENSSHD_VERSION_MAJOR=$(echo ${OPENSSHD_VERSION%%p*} | ${AWKBINARY} -F. '{print $1}')
             LogText "Result: OpenSSH major version: ${OPENSSHD_VERSION_MAJOR}"
             OPENSSHD_VERSION_MINOR=$(echo ${OPENSSHD_VERSION%%p*} | ${AWKBINARY} -F. '{print $2}')
@@ -117,7 +117,7 @@
     # Test        : SSH-7408
     # Description : Check SSH specific defined options
     # Notes       : Instead of parsing the configuration file, we query the SSH daemon itself
-    if [ ${OPENSSHD_RUNNING} -eq 1 -a ! -z "${SSH_DAEMON_OPTIONS_FILE}" -a ${OPENSSHD_VERSION_MAJOR} -ge 5 -a ${OPENSSHD_VERSION_MINOR} -ge 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${OPENSSHD_RUNNING} -eq 1 -a -n "${SSH_DAEMON_OPTIONS_FILE}" -a ${OPENSSHD_VERSION_MAJOR} -ge 5 -a ${OPENSSHD_VERSION_MINOR} -ge 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SSH-7408 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check SSH specific defined options"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking specific defined options in ${SSH_DAEMON_OPTIONS_FILE}"
@@ -189,7 +189,7 @@
                 FOUNDVALUE=$(${AWKBINARY} -v OPT="${OPTIONNAME_LOWER}" 'index($0, OPT) == 1 { print toupper($2) }' ${SSH_DAEMON_OPTIONS_FILE} | tail -1)
                 LogText "Test: Checking ${OPTIONNAME} in ${SSH_DAEMON_OPTIONS_FILE}"
 
-                if [ ! -z "${FOUNDVALUE}" ]; then
+                if [ -n "${FOUNDVALUE}" ]; then
                     LogText "Result: Option ${OPTIONNAME} found"
                     LogText "Result: Option ${OPTIONNAME} value is ${FOUNDVALUE}"
 
@@ -201,7 +201,7 @@
                         elif [ "${FOUNDVALUE}" = "${WEAKVALUE}" ]; then
                             RESULT="WEAK"
                         else
-                            if [ ! -z "${EXPECTEDVALUE}" ]; then
+                            if [ -n "${EXPECTEDVALUE}" ]; then
                                 LogText "Expected value has multiple values, testing if active value is in list (${EXPECTEDVALUE})"
                                 FIND=$(echo ${FOUNDVALUE} | ${GREPBINARY} -E "${EXPECTEDVALUE}")
                                 if [ $? -eq 0 ]; then
@@ -211,7 +211,7 @@
                                     LogText "Result: not found"
                                 fi
                             fi
-                            if [ ! -z "${MEDIUMSCOREDVALUE}" ]; then
+                            if [ -n "${MEDIUMSCOREDVALUE}" ]; then
                                 LogText "Medium scored value has multiple values, testing if active value is in list (${MEDIUMSCOREDVALUE})"
                                 FIND=$(echo ${FOUNDVALUE} | ${GREPBINARY} -E "${MEDIUMSCOREDVALUE}")
                                 if [ $? -eq 0 ]; then
@@ -296,13 +296,13 @@
     # Test        : SSH-7440
     # Description : OpenSSH - AllowUsers / AllowGroups
     # Goal        : Check if only a specific amount of users/groups can log in to the system
-    if [ ${OPENSSHD_RUNNING} -eq 1 -a ! -z "${SSH_DAEMON_OPTIONS_FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${OPENSSHD_RUNNING} -eq 1 -a -n "${SSH_DAEMON_OPTIONS_FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SSH-7440 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check OpenSSH option: AllowUsers and AllowGroups"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
         # AllowUsers
         FIND=$(${EGREPBINARY} -i "^AllowUsers" ${SSH_DAEMON_OPTIONS_FILE} | ${AWKBINARY} '{ print $2 }')
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Result: AllowUsers set, with value ${FIND}"
             Display --indent 4 --text "- OpenSSH option: AllowUsers" --result "${STATUS_FOUND}" --color GREEN
             FOUND=1
@@ -313,7 +313,7 @@
 
         # AllowGroups
         FIND=$(${EGREPBINARY} -i "^AllowGroups" ${SSH_DAEMON_OPTIONS_FILE} | ${AWKBINARY} '{ print $2 }')
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             LogText "Result: AllowUsers set ${FIND}"
             Display --indent 4 --text "- OpenSSH option: AllowGroups" --result "${STATUS_FOUND}" --color GREEN
             FOUND=1
diff --git a/include/tests_storage b/include/tests_storage
index 34a92ec3..a9029852 100644
--- a/include/tests_storage
+++ b/include/tests_storage
@@ -37,10 +37,10 @@
         LogText "Test: Checking firewire storage driver in directory /etc/modprobe.d and configuration file /etc/modprobe.conf"
         if [ -d ${ROOTDIR}etc/modprobe.d ]; then
             FIND=$(${LSBINARY} ${ROOTDIR}etc/modprobe.d/* 2> /dev/null)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 FIND1=$(${EGREPBINARY} "blacklist (ohci1394|firewire[-_]ohci|firewire-core)" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#")
                 FIND2=$(${EGREPBINARY} "install (ohci1394|firewire[-_]ohci|firewire-core) /bin/(false|true)" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#")
-                if [ ! -z "${FIND1}" -o ! -z "${FIND2}" ]; then
+                if [ -n "${FIND1}" -o -n "${FIND2}" ]; then
                     FOUND=1
                     LogText "Result: found firewire ohci driver in disabled state"
                 fi
@@ -51,7 +51,7 @@
         if [ -f ${ROOTDIR}etc/modprobe.conf ]; then
             FIND1=$(${EGREPBINARY} -r "blacklist (ohci1394|firewire[-_]ohci|firewire-core)" ${ROOTDIR}etc/modprobe.conf | ${GREPBINARY} -v "#")
             FIND2=$(${EGREPBINARY} -r "install (ohci1394|firewire[-_]ohci|firewire-core) /bin/(false|true)" ${ROOTDIR}etc/modprobe.conf | ${GREPBINARY} -v "#")
-            if [ ! -z "${FIND1}" -o ! -z "${FIND2}" ]; then
+            if [ -n "${FIND1}" -o -n "${FIND2}" ]; then
                 FOUND=1
                 LogText "Result: found firewire ohci driver in disabled state"
             fi
diff --git a/include/tests_storage_nfs b/include/tests_storage_nfs
index 4c0e39ef..bfc5192d 100644
--- a/include/tests_storage_nfs
+++ b/include/tests_storage_nfs
@@ -33,7 +33,7 @@
 #
     # Test        : STRG-1902
     # Description : Check rpcinfo
-    if [ ! -z "${RPCINFOBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${RPCINFOBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no STRG-1902 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check rpcinfo registered programs"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking rpcinfo registered programs"
@@ -48,7 +48,7 @@
 #
     # Test        : STRG-1904
     # Description : Check nfs versions in rpcinfo
-    if [ ! -z "${RPCINFOBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${RPCINFOBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no STRG-1904 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check nfs rpc"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking NFS registered versions"
@@ -63,7 +63,7 @@
 #
     # Test        : STRG-1906
     # Description : Check nfs protocols (TCP/UDP) and port in rpcinfo
-    if [ ! -z "${RPCINFOBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${RPCINFOBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no STRG-1906 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check nfs rpc"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking NFS registered protocols"
@@ -123,7 +123,7 @@
         if [ -f ${ROOTDIR}etc/exports ]; then
             LogText "Result: ${ROOTDIR}etc/exports exists"
             FIND=$(${GREPBINARY} -v "^$" ${ROOTDIR}etc/exports | ${GREPBINARY} -v "^#" | ${SEDBINARY} 's/ /!space!/g')
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 for I in ${FIND}; do
                     I=$(echo ${I} | ${SEDBINARY} 's/!space!/ /g')
                     LogText "Found line: ${I}"
@@ -161,7 +161,7 @@
     Register --test-no STRG-1930 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check client access to nfs share"
     if [ ${SKIPTEST} -eq 0 ]; then
         sFIND=$(${SHOWMOUNTBINARY} -e | ${AWKBINARY} '{ print $2 }' | ${SEDBINARY} '1d' | ${GREPBINARY} "\*")
-        if [ ! -z "${sFIND}" ]; then
+        if [ -n "${sFIND}" ]; then
             LogText "Result: all client are allowed to access a NFS share in /etc/exports"
             Display --indent 4 --text "- Checking NFS client access" --result "ALL CLIENTS" --color YELLOW
             ReportSuggestion ${TEST_NO} "Specify clients that are allowed to access a NFS share /etc/exports"
diff --git a/include/tests_time b/include/tests_time
index d67580b8..27693236 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -62,7 +62,7 @@
         for FILE in ${SEARCH_FILES}; do
             if [ -f ${FILE} ]; then LogText "result: found chrony configuration: ${FILE}"; CHRONY_CONF_FILE="${FILE}"; fi
         done
-        if [ ! -z "${CHRONY_CONF_FILE}" ]; then
+        if [ -n "${CHRONY_CONF_FILE}" ]; then
             IsRunning chronyd
             if [ ${RUNNING} -eq 1 ]; then
                 FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="chronyd"
@@ -83,7 +83,7 @@
 
         # Check running processes
         FIND=$(${PSBINARY} ax | ${GREPBINARY} "ntpd" | ${GREPBINARY} -v "dntpd" | ${GREPBINARY} -v "grep")
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             FOUND=1; NTPD_RUNNING=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1
             NTP_DAEMON="ntpd"
             LogText "Result: found running NTP daemon in process list"
@@ -98,9 +98,9 @@
         fi
 
         # Check timedate daemon (systemd)
-        if [ ! -z "${TIMEDATECTL}" ]; then
+        if [ -n "${TIMEDATECTL}" ]; then
             FIND=$(${TIMEDATECTL} status | ${EGREPBINARY} "(NTP|System clock) synchronized: yes")
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 # Check for systemd-timesyncd
                 if [ -f ${ROOTDIR}etc/systemd/timesyncd.conf ]; then
                     LogText "Result: found ${ROOTDIR}etc/systemd/timesyncd.conf"
@@ -124,7 +124,7 @@
             if [ -f ${I} ]; then
                 LogText "Test: checking for ntpdate or rdate in crontab file ${I}"
                 FIND=$(${EGREPBINARY} "ntpdate|rdate" ${I} | ${GREPBINARY} -v '^#')
-                if [ ! -z "${FIND}" ]; then
+                if [ -n "${FIND}" ]; then
                     FOUND=1; NTP_CONFIG_TYPE_SCHEDULED=1
                     Display --indent 2 --text "- Checking NTP client in crontab file (${I})" --result "${STATUS_FOUND}" --color GREEN
                     LogText "Result: found ntpdate or rdate reference in crontab file ${I}"
@@ -146,11 +146,11 @@
             if [ -d ${I} ]; then
                 if FileIsReadable ${I}; then
                     FIND=$(${LSBINARY} ${I} | ${GREPBINARY} -v FIFO)
-                    if [ ! -z "${FIND}" ]; then
+                    if [ -n "${FIND}" ]; then
                         for J in ${FIND}; do
                             LogText "Test: checking for ntpdate or rdate in ${I}/${J}"
                             FIND2=$(${EGREPBINARY} "rdate|ntpdate" ${I}/${J} | ${GREPBINARY} -v "^#")
-                            if [ ! -z "${FIND2}" ]; then
+                            if [ -n "${FIND2}" ]; then
                                 LogText "Positive match found: ${FIND2}"
                                 FOUND=1; FOUND_IN_CRON=1; NTP_CONFIG_TYPE_SCHEDULED=1
                             fi
@@ -186,7 +186,7 @@
         if [ -f /etc/rc.conf ]; then
             LogText "Test: Checking if ntpdate is enabled at startup in *BSD"
             FIND=$(${GREPBINARY} 'ntpdate_enable="YES"' /etc/rc.conf)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 LogText "Result: ntpdate is enabled in rc.conf"
                 FOUND=1
                 NTP_CONFIG_TYPE_STARTUP=1
@@ -219,7 +219,7 @@
 #
     # Test        : TIME-3106
     # Description : Check status of systemd time synchronization
-    if [ ${SYSTEMD_NTP_ENABLED} -eq 1 -a ! -z "${TIMEDATECTL}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${SYSTEMD_NTP_ENABLED} -eq 1 -a -n "${TIMEDATECTL}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no TIME-3106 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check systemd NTP time synchronization status"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Check the status of time synchronization via timedatectl"
@@ -234,7 +234,7 @@
 #
     # Test        : TIME-3112
     # Description : Check for valid associations from ntpq peers list
-    if [ ${NTPD_RUNNING} -eq 1 -a ! -z "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no TIME-3112 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check active NTP associations ID's"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking for NTP association ID's from ntpq peers list"
@@ -252,7 +252,7 @@
 #
     # Test        : TIME-3116
     # Description : Check for stratum 16 peers
-    if [ ${NTPD_RUNNING} -eq 1 -a ! -z "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no TIME-3116 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check peers with stratum value of 16"
     if [ ${SKIPTEST} -eq 0 ]; then
         COUNT=0
@@ -290,7 +290,7 @@
     # Description : Check unreliable peers from peer list
     # Notes       : Items with # are too far away (network distance)
     #               Items with - are not chosen due clustering algorithm
-    if [ ${NTPD_RUNNING} -eq 1 -a ! -z "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no TIME-3120 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check unreliable NTP peers"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking unreliable ntp peers"
@@ -313,13 +313,13 @@
 #
     # Test        : TIME-3124
     # Description : Check selected time source
-    if [ ${NTPD_RUNNING} -eq 1 -a ! -z "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no TIME-3124 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check selected time source"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking selected time source"
         FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} '^*' | ${AWKBINARY} '{ if ($4=="l") { print $1 } }')
         FIND2=$(${NTPQBINARY} -p -n | ${GREPBINARY} '^*' | ${AWKBINARY} '{ print $1 }')
-        if [ -z "${FIND}" -a ! -z "${FIND2}" ]; then
+        if [ -z "${FIND}" -a -n "${FIND2}" ]; then
             Display --indent 2 --text "- Checking selected time source" --result "${STATUS_OK}" --color GREEN
             FIND2=$(echo ${FIND2} | ${SEDBINARY} 's/*//g')
             LogText "Result: Found selected time source (value: ${FIND2})"
@@ -335,7 +335,7 @@
 #
     # Test        : TIME-3128
     # Description : Check time source candidates
-    if [ ${NTPD_RUNNING} -eq 1 -a ! -z "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no TIME-3128 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check preferred time source"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking preferred time source"
@@ -358,7 +358,7 @@
 #
     # Test        : TIME-3132
     # Description : Check ntpq falsetickers
-    if [ ${NTPD_RUNNING} -eq 1 -a ! -z "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no TIME-3132 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check NTP falsetickers"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking preferred time source"
@@ -382,7 +382,7 @@
 #
     # Test        : TIME-3136
     # Description : Check ntpq reported ntp version (Linux)
-    if [ ${NTPD_RUNNING} -eq 1 -a ! -z "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no TIME-3136 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check NTP protocol version"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking NTP protocol version (ntpq -c ntpversion)"
@@ -403,7 +403,7 @@
     # Test        : TIME-3146
     # Description : Check /etc/default/ntpdate (Linux)
     # Notes       : ntpdate-debian binary
-    #if [ ${NTPD_RUNNING} -eq 1 -a ! -z "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    #if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     #Register --test-no TIME-3146 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check /etc/default/ntpdate"
     #if [ ${SKIPTEST} -eq 0 ]; then
 #
@@ -428,7 +428,7 @@
     # Description : Check empty NTP step-tickers
     # Notes       : Mostly applies to Red Hat and clones
     FILE="${ROOTDIR}etc/ntp/step-tickers"
-    if [ "${NTPD_RUNNING}" -eq 1 -a ! -z "${NTPQBINARY}" -a -f "${FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ "${NTPD_RUNNING}" -eq 1 -a -n "${NTPQBINARY}" -a -f "${FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no TIME-3160 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check empty NTP step-tickers"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
diff --git a/include/tests_tooling b/include/tests_tooling
index c752dbde..f07bcdac 100644
--- a/include/tests_tooling
+++ b/include/tests_tooling
@@ -71,7 +71,7 @@
         fi
 
         # Cfengine
-        if [ ! -z "${CFAGENTBINARY}" ]; then
+        if [ -n "${CFAGENTBINARY}" ]; then
             LogText "Result: CFEngine (cfagent) is installed (${CFAGENTBINARY})"
             AUTOMATION_TOOL_FOUND=1
             CFENGINE_AGENT_FOUND=1
@@ -129,7 +129,7 @@
             fi
         fi
 
-        if [ ! -z "${PUPPETBINARY}" ]; then
+        if [ -n "${PUPPETBINARY}" ]; then
             LogText "Result: Puppet is installed (${PUPPETBINARY})"
             AUTOMATION_TOOL_FOUND=1
             Report "automation_tool_running[]=puppet-agent"
@@ -145,14 +145,14 @@
         fi
 
         # SaltStack
-        if [ ! -z "${SALTMINIONBINARY}" ]; then
+        if [ -n "${SALTMINIONBINARY}" ]; then
             LogText "Result: SaltStack (salt-minion) is installed (${SALTMINIONBINARY})"
             AUTOMATION_TOOL_FOUND=1
             SALT_MINION_RUNNING=1
             Report "automation_tool_running[]=saltstack-minion"
             Display --indent 4 --text "- SaltStack minion (salt-minion)" --result "${STATUS_FOUND}" --color GREEN
         fi
-        if [ ! -z "${SALTMASTERBINARY}" ]; then
+        if [ -n "${SALTMASTERBINARY}" ]; then
             LogText "Result: SaltStack (salt-master) is installed (${SALTMASTERBINARY})"
             AUTOMATION_TOOL_FOUND=1
             SALT_MASTER_RUNNING=1
@@ -188,7 +188,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
 
         # Fail2ban presence
-        if [ ! -z "${FAIL2BANBINARY}" ]; then
+        if [ -n "${FAIL2BANBINARY}" ]; then
             FAIL2BAN_FOUND=1
             IDS_IPS_TOOL_FOUND=1
             LogText "Result: Fail2ban is installed (${FAIL2BANBINARY})"
@@ -209,10 +209,10 @@
         fi
 
         # Continue if tooling is available and configuration file found
-        if [ ${FAIL2BAN_FOUND} -eq 1 -a ! -z "${FAIL2BAN_CONFIG}" ]; then
+        if [ ${FAIL2BAN_FOUND} -eq 1 -a -n "${FAIL2BAN_CONFIG}" ]; then
             Report "fail2ban_config=${FAIL2BAN_CONFIG}"
             FAIL2BANCLIENT=$(which fail2ban-client 2> /dev/null | grep -v "no [^ ]* in ")
-            if [ ! -z "${FAIL2BANCLIENT}" ]; then PERFORM_FAIL2BAN_TESTS=1; fi
+            if [ -n "${FAIL2BANCLIENT}" ]; then PERFORM_FAIL2BAN_TESTS=1; fi
         fi
     fi
 #
@@ -224,7 +224,7 @@
     Register --test-no TOOL-5104 --weight L --network NO --preqs-met ${PREQS_MET} --category security --description "Enabled tests in Fail2ban"
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${FAIL2BANCLIENT} -d | ${TRBINARY} -d '[]' | ${TRBINARY} -d "'" | ${AWKBINARY} -F, '{ if ($1=="add") { print $2 }}' | ${TRBINARY} -d ' ')
-        if [ ! -z "${FIND}" ]; then
+        if [ -n "${FIND}" ]; then
             for F2BSERVICE in ${FIND}; do
                 LogText "Result: service '${F2BSERVICE}' enabled"
                 Report "fail2ban_enabled_service[]=${F2BSERVICE}"
@@ -252,12 +252,12 @@
     #            FIND=$(${EGREPBINARY} "^action = \%\(action_m.*\)s" ${FAIL2BAN_CONFIG})
     #            FIND2=$(${EGREPBINARY} "^action = \%\(action_\)s" ${FAIL2BAN_CONFIG})
     #
-    #            if [ ! -z "${FIND}" ]; then
+    #            if [ -n "${FIND}" ]; then
     #                FAIL2BAN_EMAIL=1
     #                LogText "Result: found at least one jail which sends an email alert"
     #            fi
     #
-    #            if [ ! -z "${FIND2}" ]; then
+    #            if [ -n "${FIND2}" ]; then
     #                FAIL2BAN_SILENT=1
     #                LogText "Result: found at least one jail which does NOT send an email alert"
     #            fi
@@ -298,9 +298,9 @@
     #
     #            LogText "Checking for fail2ban iptables chains"
     #
-    #            if [ ! -z "${IPTABLESBINARY}" ]; then
+    #            if [ -n "${IPTABLESBINARY}" ]; then
     #                CHECK_CHAINS=$(${IPTABLESBINARY} -L 2>&1 | ${GREPBINARY} fail2ban)
-    #                if [ ! -z "${CHECK_CHAINS}" ]; then
+    #                if [ -n "${CHECK_CHAINS}" ]; then
     #                    LogText "Result: found at least one iptables chain for fail2ban"
     #                    Display --indent 4 --text "- Checking for Fail2ban iptables chain" --result "${STATUS_OK}" --color GREEN
     #                else
diff --git a/include/tests_usb b/include/tests_usb
index eada5d12..3ba19cc9 100644
--- a/include/tests_usb
+++ b/include/tests_usb
@@ -39,7 +39,7 @@
 #
     # Test to determine if USBGuard is installed.  If it is, we will limit
     # suggestions from other tests.
-    if [ ! -z "${USBGUARDBINARY}" ]; then
+    if [ -n "${USBGUARDBINARY}" ]; then
         USBGUARD_FOUND=1
     fi
 #
@@ -53,10 +53,10 @@
         LogText "Test: Checking USB storage driver in directory /etc/modprobe.d and configuration file /etc/modprobe.conf"
         if [ -d /etc/modprobe.d ]; then
             FIND=$(${LSBINARY} ${ROOTDIR}etc/modprobe.d/* 2> /dev/null)
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 FIND=$(${EGREPBINARY} -r "install usb[-_]storage /bin/(false|true)" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#")
                 FIND2=$(${EGREPBINARY} -r "^blacklist usb[-_]storage" ${ROOTDIR}etc/modprobe.d/*)
-                if [ ! -z "${FIND}" -o ! -z "${FIND2}" ]; then
+                if [ -n "${FIND}" -o -n "${FIND2}" ]; then
                     FOUND=1
                     LogText "Result: found usb-storage driver in disabled state (blacklisted)"
                 fi
@@ -66,7 +66,7 @@
         fi
         if [ -f ${ROOTDIR}etc/modprobe.conf ]; then
             FIND=$(${EGREPBINARY} "install usb[-_]storage /bin/(false|true)" ${ROOTDIR}etc/modprobe.conf | ${GREPBINARY} "usb-storage" | ${GREPBINARY} -v "#")
-            if [ ! -z "${FIND}" ]; then
+            if [ -n "${FIND}" ]; then
                 FOUND=1
                 LogText "Result: found usb-storage driver in disabled state"
             fi
@@ -146,14 +146,14 @@
                 USBGUARD_CONFIG=""
             fi
 
-            if [ ! -z "${USBGUARD_CONFIG}" ]; then
+            if [ -n "${USBGUARD_CONFIG}" ]; then
                 LogText "Result: USBGuard configuration found (${USBGUARD_CONFIG})"
                 Display --indent 4 --text "- Configuration" --result "${STATUS_FOUND}" --color GREEN
                 AddHP 1 1
 
                 LogText "Checking USBGuard restore controller device state (RestoreControllerDeviceState)"
                 USBGUARD_RESTORE_POLICY=$(${AWKBINARY} -F '=' -v OPT="RestoreControllerDeviceState" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG})
-                if [ ! -z "${USBGUARD_RESTORE_POLICY}" ]; then
+                if [ -n "${USBGUARD_RESTORE_POLICY}" ]; then
                     LogText "Result: RestoreControllerDeviceState = ${USBGUARD_RESTORE_POLICY}"
                     case "${USBGUARD_RESTORE_POLICY}" in
                         "true")
@@ -184,7 +184,7 @@
 
                 LogText "Checking USBGuard rule for controllers connected before daemon starts (PresentControllerPolicy)"
                 USBGUARD_CONTROLLER_POLICY=$(${AWKBINARY} -F '=' -v OPT="PresentControllerPolicy" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG})
-                if [ ! -z "${USBGUARD_CONTROLLER_POLICY}" ]; then
+                if [ -n "${USBGUARD_CONTROLLER_POLICY}" ]; then
                     LogText "Result: PresentControllerPolicy = ${USBGUARD_CONTROLLER_POLICY}"
                     case "${USBGUARD_CONTROLLER_POLICY}" in
                         "allow" | "keep")
@@ -214,7 +214,7 @@
 
                 LogText "Checking USBGuard rule for devices connected before daemon starts (PresentDevicePolicy)"
                 USBGUARD_DEVICE_POLICY=$(${AWKBINARY} -F '=' -v OPT="PresentDevicePolicy" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG})
-                if [ ! -z "${USBGUARD_DEVICE_POLICY}" ]; then
+                if [ -n "${USBGUARD_DEVICE_POLICY}" ]; then
                     LogText "Result: PresentDevicePolicy = ${USBGUARD_DEVICE_POLICY}"
                     case "${USBGUARD_DEVICE_POLICY}" in
                         "allow" | "keep")
@@ -244,7 +244,7 @@
 
                 LogText "Checking USBGuard rule for devices inserted after daemon starts (InsertedDevicePolicy)"
                 USBGUARD_INSERTED_POLICY=$(${AWKBINARY} -F '=' -v OPT="InsertedDevicePolicy" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG})
-                if [ ! -z "${USBGUARD_INSERTED_POLICY}" ]; then
+                if [ -n "${USBGUARD_INSERTED_POLICY}" ]; then
                     LogText "Result: InsertedDevicePolicy = ${USBGUARD_INSERTED_POLICY}"
                     case "${USBGUARD_INSERTED_POLICY}" in
                         "allow" | "keep")
@@ -274,7 +274,7 @@
 
                 LogText "Checking USBGuard rule for devices not in RuleFile (ImplicitPolicyTarget)"
                 USBGUARD_DEFAULT_POLICY=$(${AWKBINARY} -F '=' -v OPT="ImplicitPolicyTarget" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG})
-                if [ ! -z "${USBGUARD_DEFAULT_POLICY}" ]; then
+                if [ -n "${USBGUARD_DEFAULT_POLICY}" ]; then
                     LogText "Result: ImplicitPolicyTarget = ${USBGUARD_DEFAULT_POLICY}"
                     case "${USBGUARD_DEFAULT_POLICY}" in
                         "allow")
@@ -304,7 +304,7 @@
 
                 LogText "Checking RuleFile"
                 USBGUARD_RULES=$(${AWKBINARY} -F '=' -v OPT="RuleFile" 'index($0, OPT) == 1 {print $2}' ${USBGUARD_CONFIG})
-                if [ ! -z "${USBGUARD_RULES}" ] && [ -f "${USBGUARD_RULES}" ]; then
+                if [ -n "${USBGUARD_RULES}" ] && [ -f "${USBGUARD_RULES}" ]; then
                     LogText "Result: RuleFile found (${USBGUARD_RULES})"
                     Display --indent 4 --text "- RuleFile" --result "${STATUS_FOUND}" --color GREEN
                     AddHP 1 1
diff --git a/include/tests_webservers b/include/tests_webservers
index dfe8aabc..be78fb11 100644
--- a/include/tests_webservers
+++ b/include/tests_webservers
@@ -157,7 +157,7 @@
                 done
                 # Search Server aliases
                 for J in $(${GREPBINARY} "ServerAlias" ${I} | ${GREPBINARY} -v "^#" | ${SEDBINARY} "s/\s*ServerAlias //g" | ${SEDBINARY} "s/#.*//g"); do
-                    if [ ! -z ${J} ]; then
+                    if [ -n ${J} ]; then
                         tVHOSTS="${tVHOSTS} ${J}"
                         cVHOSTS=$((cVHOSTS + 1))
                     fi
@@ -170,7 +170,7 @@
 
         # Log all virtual hosts we found
             for J in ${tVHOSTS}; do
-                if [ ! -z ${J} ]; then
+                if [ -n ${J} ]; then
                     LogText "Virtual host: ${J}"
                     #Report "apache_vhost_name[]=${J}"
                 fi
@@ -186,10 +186,10 @@
     fi
 
     # Remove temp files
-    if [ -f ${TMPFILE} -a ! -z "${TMPFILE}" ]; then
+    if [ -f ${TMPFILE} -a -n "${TMPFILE}" ]; then
         rm -f ${TMPFILE}
     fi
-    if [ ! -z "${TMPFILE2}" ]; then if [ -f ${TMPFILE2} ]; then rm -f ${TMPFILE2}; fi; fi
+    if [ -n "${TMPFILE2}" ]; then if [ -f ${TMPFILE2} ]; then rm -f ${TMPFILE2}; fi; fi
 #
 #################################################################################
 #
@@ -351,7 +351,7 @@
     # Test        : HTTP-6706
     # Description : Search for includes within nginx configuration file
     # Notes       : Daemon nginx should be running, nginx.conf should be found
-    if [ ${NGINX_RUNNING} -eq 1 -a ! -z "${NGINX_CONF_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${NGINX_RUNNING} -eq 1 -a -n "${NGINX_CONF_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no HTTP-6706 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for additional nginx configuration files"
     if [ ${SKIPTEST} -eq 0 ]; then
         CreateTempFile || ExitFatal
@@ -402,7 +402,7 @@
     # Test        : HTTP-6708
     # Description : Check discovered nginx configuration settings for further hardening
     # Notes       : Daemon of nginx should be running, nginx.conf should be found
-    if [ ${NGINX_RUNNING} -eq 1 -a ! -z "${NGINX_CONF_FILES}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${NGINX_RUNNING} -eq 1 -a -n "${NGINX_CONF_FILES}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no HTTP-6708 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check discovered nginx configuration settings"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: start parsing all discovered nginx options"
@@ -420,7 +420,7 @@
                 LogText "Result: this configuration file is skipped, as it contains usually no interesting details"
             fi
         done
-        if [ ! -z "${NGINX_CONF_FILES_ADDITIONS}" ]; then
+        if [ -n "${NGINX_CONF_FILES_ADDITIONS}" ]; then
             for I in ${NGINX_CONF_FILES_ADDITIONS}; do
                 FILENAME=$(echo ${I} | ${AWKBINARY} -F/ '{print $NF}')
                 if [ ! "${FILENAME}" = "mime.types" ]; then
@@ -442,7 +442,7 @@
     # Test        : HTTP-6710
     # Description : Check SSL configuration of nginx
     # Notes       : Daemon of nginx should be running, nginx.conf should be found
-    if [ ${NGINX_RUNNING} -eq 1 -a ! -z "${NGINX_CONF_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${NGINX_RUNNING} -eq 1 -a -n "${NGINX_CONF_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no HTTP-6710 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check nginx SSL configuration settings"
     if [ ${SKIPTEST} -eq 0 ]; then
         NGINX_SSL_SUGGESTION=0
@@ -494,7 +494,7 @@
     # Test        : HTTP-6712
     # Description : Check logging configuration of nginx
     # Notes       : Daemon of nginx should be running, nginx.conf should be found
-    if [ ${NGINX_RUNNING} -eq 1 -a ! -z "${NGINX_CONF_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${NGINX_RUNNING} -eq 1 -a -n "${NGINX_CONF_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no HTTP-6712 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check nginx access logging"
     if [ ${SKIPTEST} -eq 0 ]; then
         NGINX_LOG_SUGGESTION=0
@@ -528,7 +528,7 @@
 #
     # Test        : HTTP-6714
     # Description : Check missing error logs in nginx
-    if [ ${NGINX_RUNNING} -eq 1 -a ! -z "${NGINX_CONF_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${NGINX_RUNNING} -eq 1 -a -n "${NGINX_CONF_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no HTTP-6714 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for missing error logs in nginx"
     if [ ${SKIPTEST} -eq 0 ]; then
         NGINX_LOG_SUGGESTION=0
@@ -549,7 +549,7 @@
 #
     # Test        : HTTP-6716
     # Description : Check debug mode on error log in nginx
-    if [ ${NGINX_RUNNING} -eq 1 -a ! -z "${NGINX_CONF_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${NGINX_RUNNING} -eq 1 -a -n "${NGINX_CONF_LOCATION}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no HTTP-6716 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for debug mode on error log in nginx"
     if [ ${SKIPTEST} -eq 0 ]; then
         NGINX_LOG_SUGGESTION=0
@@ -606,8 +606,8 @@
 #################################################################################
 #
     # Remove temp file (double check)
-    if [ ! -z "${TMPFILE}" ]; then if [ -f ${TMPFILE} ]; then rm -f ${TMPFILE}; fi; fi
-    if [ ! -z "${TMPFILE2}" ]; then if [ -f ${TMPFILE2} ]; then rm -f ${TMPFILE2}; fi; fi
+    if [ -n "${TMPFILE}" ]; then if [ -f ${TMPFILE} ]; then rm -f ${TMPFILE}; fi; fi
+    if [ -n "${TMPFILE2}" ]; then if [ -f ${TMPFILE2} ]; then rm -f ${TMPFILE2}; fi; fi
 
     WaitForKeyPress
 
diff --git a/include/tool_tips b/include/tool_tips
index bf529ca2..4f2f3b6e 100644
--- a/include/tool_tips
+++ b/include/tool_tips
@@ -48,7 +48,7 @@
         # Bash completion support
         #
         # Detect if bash is used for active user
-        #if [ ! -z "${ETC_PATHS}" ]; then
+        #if [ -n "${ETC_PATHS}" ]; then
         #    for I in ${ETC_PATHS}; do
         #        if [ -d ${I}/bash_completion.d ]; then
         #            if [ ! -f ${ETC_PATHS}/bash_completion.d/lynis ]; then
diff --git a/lynis b/lynis
index 8476efe0..35a023ef 100755
--- a/lynis
+++ b/lynis
@@ -538,8 +538,8 @@ ${NORMAL}
     Report "os_fullname=${OS_FULLNAME}"
     Report "os_version=${OS_VERSION}"
     if [ "${OS}" = "Linux" ]; then Report "linux_version=${LINUX_VERSION}"; fi
-    if [ ! -z "${OS_KERNELVERSION}" ]; then Report "os_kernel_version=${OS_KERNELVERSION}"; fi
-    if [ ! -z "${OS_KERNELVERSION_FULL}" ]; then Report "os_kernel_version_full=${OS_KERNELVERSION_FULL}"; fi
+    if [ -n "${OS_KERNELVERSION}" ]; then Report "os_kernel_version=${OS_KERNELVERSION}"; fi
+    if [ -n "${OS_KERNELVERSION_FULL}" ]; then Report "os_kernel_version_full=${OS_KERNELVERSION_FULL}"; fi
 
     Report "hostname=${HOSTNAME}"
 
@@ -635,7 +635,7 @@ ${NORMAL}
             LogText "Note: the end-of-life of '${OS_FULLNAME}' could not be checked. Entry missing in software-eol.db?"
         fi
 
-        if [ ! -z "${OS_MODE}" ]; then echo "  Operating system mode:     ${OS_MODE}"; fi
+        if [ -n "${OS_MODE}" ]; then echo "  Operating system mode:     ${OS_MODE}"; fi
         echo "  Kernel version:            ${OS_KERNELVERSION}"
         echo "  Hardware platform:         ${HARDWARE}"
         echo "  Hostname:                  ${HOSTNAME}"
@@ -658,9 +658,9 @@ ${NORMAL}
     LogText "Operating system:          ${OS}"
     LogText "Operating system name:     ${OS_NAME}"
     LogText "Operating system version:  ${OS_VERSION}"
-    if [ ! -z "${OS_MODE}" ]; then LogText "Operating system mode:     ${OS_MODE}"; fi
+    if [ -n "${OS_MODE}" ]; then LogText "Operating system mode:     ${OS_MODE}"; fi
     LogText "Kernel version:            ${OS_KERNELVERSION}"
-    if [ ! -z "${OS_KERNELVERSION_FULL}" ]; then
+    if [ -n "${OS_KERNELVERSION_FULL}" ]; then
         LogText "Kernel version (full):     ${OS_KERNELVERSION_FULL}"
     fi
     LogText "Hardware platform:         ${HARDWARE}"
@@ -872,7 +872,7 @@ ${NORMAL}
                         for PROFILE in ${PROFILES}; do
                             LogText "Action: checking plugin status in profile: ${PROFILE}"
                             FIND3=$(grep "^plugin=${FIND2}" ${PROFILE})
-                            if [ ! -z "${FIND3}" ]; then
+                            if [ -n "${FIND3}" ]; then
                                 FOUND=0
                                 for I in ${DISABLED_PLUGINS}; do
                                     if [ "${I}" = "${FIND2}" ]; then

From a2c57e0b7525517603f5585c788442ae4af3309e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 16 Jul 2019 13:21:32 +0200
Subject: [PATCH 224/679] Added missing 'then'

---
 include/tests_insecure_services | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index 3ba08570..25c82626 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -428,7 +428,7 @@
         LogText "Test: Checking if NIS server is installed"
         PACKAGES="nis ypserv"
         for PACKAGE in ${PACKAGES}; do
-            if PackageIsInstalled "${PACKAGE}"
+            if PackageIsInstalled "${PACKAGE}"; then
                 FOUND="${PACKAGE}"
             fi
         done

From b935ab8b6a77a9bba368b43229bce77e3073f237 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 16 Jul 2019 13:23:00 +0200
Subject: [PATCH 225/679] Updated log

---
 CHANGELOG.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a1162fb5..f437b4e3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -46,9 +46,9 @@ measures to further tighten any possible misuse.
 - Show 'lynis generate hostids' when they are missing
 - FINT-4328 - corrected text in log
 - INSE-8116 - added rsync service
-- INSE-8342 - renamed to INSE-8304
 - INSE-8318 - test for TFTP client tools
 - INSE-8320 - test for TFTP server tools
+- INSE-8342 - renamed to INSE-8304
 - KRNL-5820 - extended check to include limits.d directory
 - NAME-4408 - corrected Report function call
 - NETW-3032 - small rewrite of test and extended with addrwatch
@@ -61,8 +61,9 @@ measures to further tighten any possible misuse.
 - SSH-7408 - changed text in suggestion and report
 - STRG-1840 - renamed to USB-1000
 - STRG-1842 - added default authorized devices and renamed to USB-2000
+- The 'show changelog' command works again for newer versions
+- Several code cleanups and standardization
 - Extended output of 'lynis update info'
-- Show changelog works again for newer versions
 - systemd service file adjusted
 - bash completion script extended
 - Updated man page

From 5869fa4eb122076091038951c5e4a7d98b694240 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 16 Jul 2019 14:35:00 +0200
Subject: [PATCH 226/679] [INSE-8050] added com.apple.ftp-proxy and improved
 text output

---
 include/tests_insecure_services | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index 25c82626..f9ea8e07 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -495,16 +495,16 @@
     if [ -n "${LAUNCHCTL_BINARY}" ]; then PREQS_MET="YES"; SKIPREASON=""; else PREQS_MET="NO"; SKIPREASON="No launchctl binary on this system"; fi
     Register --test-no INSE-8050 --os "macOS" --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight M --network NO --category security --description "Check for insecure services on macOS"
     if [ ${SKIPTEST} -eq 0 ]; then
-        TEST_SERVICES="com.apple.fingerd"
-        for ITEM in ${TEST_SERVICES}; do
-            if ${LAUNCHCTL_BINARY} print-enabled system | ${GREPBINARY} -sq ${ITEM}; then
-                Display --indent 2 --text "- $text" --result "${STATUS_NO}" --color RED
+        TEST_SERVICES="com.apple.fingerd com.apple.ftp-proxy"
+        for ITEM in "${TEST_SERVICES}"; do
+            if ${LAUNCHCTL_BINARY} list | ${GREPBINARY} -sq ${ITEM}; then
+                Display --indent 2 --text "- ${ITEM}" --result "${STATUS_NO}" --color RED
                 LogText "Result: found ${ITEM}, which is considered an insecure service"
                 AddSuggestion "${TEST_NO}" "Consider disabling service ${ITEM}" "launchctl" "-"
                 AddHP 0 1
             else
-                Display --indent 2 --text "- $text" --result "${STATUS_OK}" --color GREEN
-                LogText "Result: $text, OK"
+                Display --indent 2 --text "- ${ITEM}" --result "${STATUS_OK}" --color GREEN
+                LogText "Result: did not find ${ITEM}, which is fine"
                 AddHP 1 1
             fi
         done

From d696d521c1fa1103214ac73a6fb534b537071b35 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 16 Jul 2019 19:04:53 +0200
Subject: [PATCH 227/679] Extended IsRunning function to allow for searching by
 a combination of process name and user.

---
 include/functions | 61 +++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 57 insertions(+), 4 deletions(-)

diff --git a/include/functions b/include/functions
index 80096f50..d8c39740 100644
--- a/include/functions
+++ b/include/functions
@@ -1362,6 +1362,9 @@
     ################################################################################
     # Name        : IsRunning()
     # Description : Check if a process is running
+    #
+    # Parameters  : $1 = search argument
+    #               $2 = optional arguments
     # Returns     : 0 (process is running), 1 (process not running)
     #               RUNNING (1 = running, 0 = not running) - will be deprecated
     # Notes       : PSOPTIONS are declared globally, to prevent testing each call
@@ -1371,10 +1374,19 @@
         if [ $# -eq 0 ]; then ExitFatal "Missing parameter when calling IsRunning function"; fi
         pgrep_options="-x"
         search=""
+        FIND=""
+        PSOPTIONS=""
+        PARTIAL_SEARCH=1
+
         while [ $# -ge 1 ]; do
             case $1 in
                 --full)
                     pgrep_options="-f" # replace -x with -f
+                    PARTIAL_SEARCH=0
+                ;;
+                --user)
+                    shift
+                    users="$1"
                 ;;
                 *)
                     search="$1"
@@ -1387,19 +1399,60 @@
         RUNNING=0
         # AIX does not fully support pgrep options, so using ps instead
         if [ -n "${PGREPBINARY}" -a ! "${OS}" = "AIX" ]; then
-            FIND=$(${PGREPBINARY} ${pgrep_options} "${search}" | ${TRBINARY} '\n' ' ')
+            # When --user is used, perform a search using the -u option
+            if [ -n "${users}" ]; then
+                for u in "${users}"; do
+                    user_uid=$(getent passwd ${u} 2> /dev/null | ${AWKBINARY} -F: '{print $3}')
+                    # Only perform search if user exists and we had no match yet
+                    if [ -n "${user_uid}" ]; then
+                        if [ -z "${FIND}" ]; then
+                            LogText "Performing pgrep scan using uid ${user_uid}"
+                            FIND=$(${PGREPBINARY} ${pgrep_options} -u ${user_uid} "${search}" | ${TRBINARY} '\n' ' ')
+                        fi
+                    fi
+                done
+            else
+                LogText "Performing pgrep scan without uid"
+                FIND=$(${PGREPBINARY} ${pgrep_options} "${search}" | ${TRBINARY} '\n' ' ')
+            fi
         else
-            if [ -z "${PSOPTIONS}" ]; then
+            if [ ${SHELL_IS_BUSYBOX} -eq 1 ]; then
+                # This search is not foolproof
+                LogText "Performing simple ps scan (busybox)"
                 PSOPTIONS=" -o args="
-                if [ ${SHELL_IS_BUSYBOX} -eq 0 ]; then
+                FIND=$(${PSBINARY} ${PSOPTIONS} | ${EGREPBINARY} "( |/)${search}" | ${GREPBINARY} -v "grep")
+            else
+                if [ -n "${users}" ]; then
+                    for u in "${users}"; do
+                        user_uid=$(getent passwd ${u} 2> /dev/null | ${AWKBINARY} -F: '{print $3}')
+                        # Only perform search if user exists and we had no match yet
+                        if [ -n "${user_uid}" ]; then
+                            if [ -z "${FIND}" ]; then
+                                if [ ${PARTIAL_SEARCH} -eq 1 ]; then
+                                    LogText "Performing ps scan using partial match and for uid ${user_uid}"
+                                    FIND=$(${PSBINARY} -u ${user_uid} -o comm= "${search}" | ${AWKBINARY} -v pattern="${search}" '$0 ~ pattern {print}')
+                                else
+                                    LogText "Performing ps scan using exact match and for uid ${user_uid}"
+                                    FIND=$(${PSBINARY} -u ${user_uid} -o comm= "${search}" | ${AWKBINARY} -v pattern="^${search}$" '$0 ~ pattern {print}')
+                                fi
+                            fi
+                        fi
+                    done
+                else
                     case "${OS}" in
                         "Linux")
                             PSOPTIONS=" -o args= -C ${search}"
                         ;;
                     esac
+                    if [ ${PARTIAL_SEARCH} -eq 1 ]; then
+                        LogText "Performing ps scan using partial match and without uid"
+                        FIND=$(${PSBINARY} ${PSOPTIONS} | ${AWKBINARY} -v pattern="${search}" '$0 ~ pattern {print}')
+                    else
+                        LogText "Performing ps scan using exact match and without uid"
+                        FIND=$(${PSBINARY} ${PSOPTIONS} | ${AWKBINARY} -v pattern="^${search}$" '$0 ~ pattern {print}')
+                    fi
                 fi
             fi
-            FIND=$(${PSBINARY} ${PSOPTIONS} | egrep "( |/)${search}" | grep -v "grep")
         fi
 
         if [ -n "${FIND}" ]; then

From 2bd1b1b590a36ec6888c178ca4d2e517bbf7feca Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 16 Jul 2019 19:05:28 +0200
Subject: [PATCH 228/679] Format change

---
 include/tests_authentication | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index c931ab77..819dfcc9 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -820,7 +820,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking PASS_MIN_DAYS option in ${ROOTDIR}etc/login.defs"
         FIND=$(${GREPBINARY} "^PASS_MIN_DAYS" ${ROOTDIR}etc/login.defs | ${AWKBINARY} '{ if ($1=="PASS_MIN_DAYS") { print $2 } }')
-        if [ "${FIND}" = "" -o "${FIND}" = "0" ]; then
+        if [ -z "${FIND}" -o "${FIND}" = "0" ]; then
             LogText "Result: password minimum age is not configured"
             Display --indent 2 --text "- Checking user password aging (minimum)" --result "${STATUS_DISABLED}" --color YELLOW
             ReportSuggestion ${TEST_NO} "Configure minimum password age in /etc/login.defs"

From 9e56706aa67d3e7bc019ab17b451d801b0b7c4d3 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 16 Jul 2019 19:06:31 +0200
Subject: [PATCH 229/679] Formatting and improved logging

---
 include/tests_networking | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/include/tests_networking b/include/tests_networking
index 23067c57..82ec452a 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -374,7 +374,7 @@
         FIND=""; FIND2=""
         COUNT=0
         case ${OS} in
-            DragonFly|FreeBSD)
+            DragonFly | FreeBSD)
                 if [ -n "${SOCKSTATBINARY}" ]; then
                     FIND=$(${SOCKSTATBINARY} | ${AWKBINARY} '{ if ($7 ~ /\*:\*/) print $5"|"$6"|"$2"|" }' | ${SORTBINARY} -u)
                     # To strip off IP's: ${SEDBINARY} 's/|.*:/|/'
@@ -385,8 +385,10 @@
             ;;
             Linux)
                 if [ -n "${SSBINARY}" ]; then
-                    DATA=$(${SSBINARY} --query=udp,tcp -plnt | awk '{ if ($1!="Netid") { print "raw,ss,v1|"$1"|"$5"|"$7"|" }}' | sed 's/pid=[0-9]\{1,\},fd=[0-9]\{1,\}//g' | sed 's/users://' | sed 's/,)//g' | tr -d '()"')
+                    LogText "Test: Retrieving ss information to find listening ports"
+                    DATA=$(${SSBINARY} --query=udp,tcp -plnt | ${AWKBINARY} '{ if ($1!="Netid") { print "raw,ss,v1|"$1"|"$5"|"$7"|" }}' | ${SEDBINARY} 's/pid=[0-9]\{1,\},fd=[0-9]\{1,\}//g' | ${SEDBINARY} 's/users://' | ${SEDBINARY} 's/,)//g' | ${TRBINARY} -d '()"')
                 elif [ -n "${NETSTATBINARY}" ]; then
+                    LogText "Test: Retrieving netstat information to find listening ports"
                     # UDP
                     FIND=$(${NETSTATBINARY} -nlp 2> /dev/null | ${GREPBINARY} "^udp" | ${AWKBINARY} '{ print $4"|"$1"|"$6"|" }' | ${SEDBINARY} 's:|[0-9]*/:|:')
                     # TCP
@@ -397,7 +399,8 @@
             ;;
 
             macOS)
-                if [ ! "${LSOFBINARY}" = "" ]; then
+                if [ -n "${LSOFBINARY}" ]; then
+                    LogText "Test: Retrieving lsof information to find listening ports"
                     # UDP and TCP combined
                     FIND=$(${LSOFBINARY} -i -P | ${AWKBINARY} '{ print $9"|"$8"|"$1"|" }' | ${SEDBINARY} 's/\(.*\)\-\>.*\(\|.*\)/\1\2/' | ${SEDBINARY} 's/\*/'$IP'/' | ${SORTBINARY} -u | ${GREPBINARY} -v "NAME")
                 else
@@ -407,7 +410,8 @@
                 FIND2=""
             ;;
             NetBSD)
-                if [ ! "${SOCKSTATBINARY}" = "" ]; then
+                if [ -n "${SOCKSTATBINARY}" ]; then
+                    LogText "Test: Retrieving sockstat information to find listening ports"
                     FIND=$(${SOCKSTATBINARY} 2> /dev/null | ${AWKBINARY} '{ if ($7 ~ /\*.\*/) print $5"|"$6"|"$2"|" }' | ${SORTBINARY} -u)
                 else
                     FIND=""
@@ -415,7 +419,8 @@
                 FIND2=""
             ;;
             OpenBSD)
-                if [ ! "${NETSTATBINARY}" = "" ]; then
+                if [ -n "${NETSTATBINARY}" ]; then
+                    LogText "Test: Retrieving netstat information to find listening ports"
                     # UDP
                     FIND=$(${NETSTATBINARY} -an 2> /dev/null | ${GREPBINARY} "^udp" | ${AWKBINARY} '{ print $4"|"$1"||" }')
                     # TCP
@@ -430,25 +435,23 @@
             ;;
         esac
 
-        if HasData "${DATA}"; then
-            for ITEM in ${DATA}; do
+        if [ -n "${DATA}" ]; then
+            for ITEM in "${DATA}"; do
                 COUNT=$((COUNT + 1))
                 Report "network_listen[]=${ITEM}"
             done
         fi
 
-        # Retrieve information from sockstat, when available
-        LogText "Test: Retrieving sockstat information to find listening ports"
-        if HasData "${FIND}"; then
-            for ITEM in ${FIND}; do
+        if [ -n "${FIND}" ]; then
+            for ITEM in "${FIND}"; do
                 COUNT=$((COUNT + 1))
                 LogText "Found listening info: ${ITEM}"
                 Report "network_listen_port[]=${ITEM}"
             done
         fi
 
-        if [ ! "${FIND2}" = "" ]; then
-            for ITEM in ${FIND2}; do
+        if [ -n "${FIND2}" ]; then
+            for ITEM in "${FIND2}"; do
                 COUNT=$((COUNT + 1))
                 LogText "Found listening info: ${ITEM}"
                 Report "network_listen_port[]=${ITEM}"

From a4d15f77b5d62743c97613476dec6cea208c98a0 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 16 Jul 2019 19:10:04 +0200
Subject: [PATCH 230/679] Differentiate between a discovered binary and running
 process

---
 include/tests_tooling | 30 ++++++++++++++++++++----------
 1 file changed, 20 insertions(+), 10 deletions(-)

diff --git a/include/tests_tooling b/include/tests_tooling
index f07bcdac..2090e99e 100644
--- a/include/tests_tooling
+++ b/include/tests_tooling
@@ -146,25 +146,35 @@
 
         # SaltStack
         if [ -n "${SALTMINIONBINARY}" ]; then
+            Display --indent 4 --text "- SaltStack minion" --result "${STATUS_FOUND}" --color GREEN
             LogText "Result: SaltStack (salt-minion) is installed (${SALTMINIONBINARY})"
             AUTOMATION_TOOL_FOUND=1
-            SALT_MINION_RUNNING=1
-            Report "automation_tool_running[]=saltstack-minion"
-            Display --indent 4 --text "- SaltStack minion (salt-minion)" --result "${STATUS_FOUND}" --color GREEN
+            Report "automation_tool_installed[]=saltstack-minion"
+
+            if IsRunning "salt-minion" --user "root salt"; then
+                Display --indent 6 --text "- Minion process" --result "${STATUS_RUNNING}" --color GREEN
+                LogText "Result: found SaltStack (master)"
+                SALT_MINION_RUNNING=1
+                Report "automation_tool_running[]=saltstack-minion"
+            else
+                Display --indent 6 --text "- Minion process" --result "${STATUS_NOT_RUNNING}" --color YELLOW
+            fi
+
         fi
+
         if [ -n "${SALTMASTERBINARY}" ]; then
+            Display --indent 4 --text "- SaltStack master (salt-master)" --result "${STATUS_FOUND}" --color GREEN
             LogText "Result: SaltStack (salt-master) is installed (${SALTMASTERBINARY})"
             AUTOMATION_TOOL_FOUND=1
-            SALT_MASTER_RUNNING=1
-            Report "automation_tool_running[]=saltstack-minion"
-            Display --indent 4 --text "- SaltStack master (salt-master)" --result "${STATUS_FOUND}" --color GREEN
-        else
-            if IsRunning "salt-master"; then
+            Report "automation_tool_installed[]=saltstack-master"
+
+            if IsRunning "salt-master" --user "root salt"; then
+                Display --indent 6 --text "- Master process" --result "${STATUS_RUNNING}" --color GREEN
                 LogText "Result: found SaltStack (master)"
-                AUTOMATION_TOOL_FOUND=1
                 SALT_MASTER_RUNNING=1
                 Report "automation_tool_running[]=saltstack-master"
-                Display --indent 4 --text "- SaltStack (master)" --result "${STATUS_FOUND}" --color GREEN
+            else
+                Display --indent 6 --text "- Master process" --result "${STATUS_NOT_RUNNING}" --color YELLOW
             fi
         fi
 

From 2576bc8fcafaf2a0bfe6342d25a4dbff91987e2b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 16 Jul 2019 19:11:07 +0200
Subject: [PATCH 231/679] Updated log

---
 CHANGELOG.md | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f437b4e3..cd6e8fab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -38,13 +38,13 @@ measures to further tighten any possible misuse.
 - Measure timing of tests and report slow tests (10+ seconds)
 
 ### Changed
-- Function: CheckItem - returns only exit code (ITEM_FOUND value is dropped)
+- Function: CheckItem() now returns only exit code (ITEM_FOUND is dropped)
+- Function: IsRunning supports the --user flag to define a related user
 - Profiles: unused options removed
 - Profiles: message is displayed when old format "key:value" is used
 - Security: the 'nounset' (set -u) parameter is now activated by default
-- Use only locations from PATH environment variable, unless it is not defined
-- Show 'lynis generate hostids' when they are missing
 - FINT-4328 - corrected text in log
+- INSE-8050 - added com.apple.ftp-proxy and improved text output
 - INSE-8116 - added rsync service
 - INSE-8318 - test for TFTP client tools
 - INSE-8320 - test for TFTP server tools
@@ -61,6 +61,9 @@ measures to further tighten any possible misuse.
 - SSH-7408 - changed text in suggestion and report
 - STRG-1840 - renamed to USB-1000
 - STRG-1842 - added default authorized devices and renamed to USB-2000
+- TOOL-5002 - differentiate between a discovered binary and running process
+- Use only locations from PATH environment variable, unless it is not defined
+- Show tip to use 'lynis generate hostids' when host IDs are missing
 - The 'show changelog' command works again for newer versions
 - Several code cleanups and standardization
 - Extended output of 'lynis update info'

From 250fb965d3e2a20695cde104579dacff292f9031 Mon Sep 17 00:00:00 2001
From: David <2069735+Marzal@users.noreply.github.com>
Date: Wed, 17 Jul 2019 23:08:20 +0200
Subject: [PATCH 232/679] Strict mode needs this vars initialized

---
 include/consts | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/include/consts b/include/consts
index 343567df..4f8c5246 100644
--- a/include/consts
+++ b/include/consts
@@ -313,6 +313,16 @@ unset LANG
     XARGSBINARY=""
     YUMBINARY=""
     ZYPPERBINARY=""
+
+# == Variables for strict mode ==
+    IFCONFIGBINARY=""
+    LOCATEBINARY=""
+    SEARCH_VERSION=""
+    SHA1SUMBINARY=""
+    SHA256SUMBINARY=""
+    OPENSSLBINARY=""
+    LICENSE_KEY=""
+
 #
 #################################################################################
 #

From 06413994cfaa2281567d7482c5da29dedf1ce383 Mon Sep 17 00:00:00 2001
From: David <2069735+Marzal@users.noreply.github.com>
Date: Wed, 17 Jul 2019 23:16:47 +0200
Subject: [PATCH 233/679] Initialize some vars to allow strict mode to work

IsRunning():
To check if $users is empty in strict mode we need the var to be initializez

ReportException:
Some test call this function without the second parameter, this is not allowed in strict mode if we don't initialize the variable
---
 include/functions | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/include/functions b/include/functions
index d8c39740..a48c338d 100644
--- a/include/functions
+++ b/include/functions
@@ -1400,7 +1400,8 @@
         # AIX does not fully support pgrep options, so using ps instead
         if [ -n "${PGREPBINARY}" -a ! "${OS}" = "AIX" ]; then
             # When --user is used, perform a search using the -u option
-            if [ -n "${users}" ]; then
+                            # Initialize users for strict mode
+            if [ -n "${users:-}" ]; then
                 for u in "${users}"; do
                     user_uid=$(getent passwd ${u} 2> /dev/null | ${AWKBINARY} -F: '{print $3}')
                     # Only perform search if user exists and we had no match yet
@@ -2641,8 +2642,9 @@
 
     # Log exceptions
     ReportException() {
-        Report "exception_event[]=$1|$2|"
-        LogText "Exception: test has an exceptional event ($1) with text $2"
+        # Allow this function with only 1 parameter in strict mode with ${2-Text}
+        Report "exception_event[]=$1|${2-NoInfo}|"
+        LogText "Exception: test has an exceptional event ($1) with text ${2-NoText}"
     }
 
 

From 8de806c9a7e6eaf69a7c66c191f5c59a782ee7cc Mon Sep 17 00:00:00 2001
From: David <2069735+Marzal@users.noreply.github.com>
Date: Wed, 17 Jul 2019 23:25:40 +0200
Subject: [PATCH 234/679] PRIVILEGED var needs to set in both cases

set PRIVILEGED in both cases, because now this variable is set before ". ${INCLUDEDIR}/consts" and needs not to be set in that file in order to not be reset to a default value.

Also fix typo:
PENTESTINGMODE is set when NO root privileges are used
---
 lynis | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lynis b/lynis
index 35a023ef..992fb3dd 100755
--- a/lynis
+++ b/lynis
@@ -129,7 +129,8 @@
         PRIVILEGED=1
         PENTESTINGMODE=0
     else
-        # Set to pentesting mode if scan is with root privileges
+        PRIVILEGED=0
+        # Set to pentesting mode if scan is without root privileges
         PENTESTINGMODE=1
     fi
 

From d1cb74e7d9c8a6e515cbd2760f552fa11485cccb Mon Sep 17 00:00:00 2001
From: David <2069735+Marzal@users.noreply.github.com>
Date: Wed, 17 Jul 2019 23:28:51 +0200
Subject: [PATCH 235/679] Delete PRIVILEGED var from this file

if PRIVILEGED is set in the file, it will overwrite the value in the main program always to 0.
This change depends in the other commit that set the variable in both cases.
---
 include/consts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/include/consts b/include/consts
index 343567df..6df1ea56 100644
--- a/include/consts
+++ b/include/consts
@@ -219,7 +219,6 @@ unset LANG
     POSTGRES_RUNNING=0
     PREVIOUS_TEST="No test ID"
     PREVIOUS_TS=0
-    PRIVILEGED=0
     PROFILES=""
     PROFILEVALUE=""
     PSBINARY="ps"

From 84dd0248876e99d1c92d8ff64cbd8c6306048356 Mon Sep 17 00:00:00 2001
From: Julian Phillips <phillips.julian@gmail.com>
Date: Wed, 17 Jul 2019 16:18:12 -0700
Subject: [PATCH 236/679] [CRYP-7930] Modify to use 'lsblk' and 'cryptsetup'

There are several challenges with the existing method of using
/etc/crypttab:

1)encrypted rootfs partitions are not typically listed in this
file (users are prompted for password in early boot instead)

2)the 'luks' option is the default option so it is possible for
/etc/crypttab entries to never have this set explicitly and any
block device configured as such will be missed currently

3)any device mounted manually, or using any other mechanism aside
from /etc/crypttab will be missed

This commit executes 'cryptsetup isLuks' on every block device in
the system to determine whether it is a LUKS device. This handles
all 3 cases mentioned above.

Test case wording was also updated to reflect the fact that it
only checks for LUKS entrypted block devices. So, plain dm-crypt
and TrueCrypt/VeraCrypt block device encryption is not detected.
Nor is any file system level encryption such as eCryptfs, EncFs,
gocryptfs.
---
 include/binaries     |  2 ++
 include/tests_crypto | 34 ++++++++++++++--------------------
 2 files changed, 16 insertions(+), 20 deletions(-)

diff --git a/include/binaries b/include/binaries
index 5812003f..1d6977af 100644
--- a/include/binaries
+++ b/include/binaries
@@ -141,6 +141,7 @@
                             cfagent)                CFAGENTBINARY="${BINARY}";         FILE_INT_TOOL_FOUND=1;                 LogText "  Found known binary: cfengine agent (configuration tool) - ${BINARY}" ;;
                             chkrootkit)             CHKROOTKITBINARY="${BINARY}";      MALWARE_SCANNER_INSTALLED=1;           LogText "  Found known binary: chkrootkit (malware scanner) - ${BINARY}" ;;
                             comm)                   COMMBINARY="${BINARY}";            LogText "  Found known binary: comm (file compare) - ${BINARY}" ;;
+                            cryptsetup)             CRYPTSETUPBINARY="${BINARY}";      LogText "  Found known binary: cryptsetup (block device encryption) - ${BINARY}" ;;
                             csum)                   CSUMBINARY="${BINARY}";            LogText "  Found known binary: csum (hashing tool on AIX) - ${BINARY}" ;;
                             curl)                   CURLBINARY="${BINARY}";            CURLVERSION=$(${BINARY} --version | grep "^curl" | awk '{ if ($1=="curl") { print $2 }}'); LogText "  Found known binary: curl (browser, download utility) - ${BINARY}" ;;
                             cut)                    CUTBINARY="${BINARY}";             LogText "  Found known binary: cut (text stream editor) - ${BINARY}" ;;
@@ -186,6 +187,7 @@
                             logrotate)              LOGROTATEBINARY="${BINARY}";       LogText "  Found known binary: logrotate (log rotation tool) - ${BINARY}" ;;
                             ls)                     LSBINARY="${BINARY}";              LogText "  Found known binary: ls (file listing) - ${BINARY}" ;;
                             lsattr)                 LSATTRBINARY="${BINARY}";          LogText "  Found known binary: lsattr (file attributes) - ${BINARY}" ;;
+			    lsblk)		    LSBLKBINARY="${BINARY}";	       LogText "  Found known binary: lsblk (block devices) - ${BINARY}" ;;
                             lsmod)                  LSMODBINARY="${BINARY}";           LogText "  Found known binary: lsmod (kernel modules) - ${BINARY}" ;;
                             lsof)                   LSOFBINARY="${BINARY}";            LogText "  Found known binary: lsof (open files) - ${BINARY}" ;;
                             lsvg)                   LSVGBINARY=${BINARY};              LogText "  Found known binary: lsvg (volume manager) - ${BINARY}" ;;
diff --git a/include/tests_crypto b/include/tests_crypto
index ecb19d2f..4f7f1ff4 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -126,34 +126,28 @@
             ReportSuggestion ${TEST_NO} "Check available certificates for expiration"
         fi
     fi
+
 #
 #################################################################################
 #
     # Test        : CRYP-7930
-    # Description : Determine if system uses disk or file encryption
-    Register --test-no CRYP-7930 --weight L --network NO --category security --description "Determine if system uses disk or file encryption"
+    # Description : Determine if system uses LUKS block device encryption
+    if [ ! "${LSBLKBINARY}" = "" -a ! "${CRYPTSETUPBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no CRYP-7930 --preqs-met ${PREQS_MET} --weight L --network NO --root-only YES --category security --description "Determine if system uses LUKS block device encryption"
     if [ ${SKIPTEST} -eq 0 ]; then
-        FILE="${ROOTDIR}etc/crypttab"
-        if [ -f ${FILE} ]; then
-            LogText "Result: crypttab file (${FILE}) exists"
-            DATA=$(${GREPBINARY} "^[a-z]" ${FILE} | ${TRBINARY} -cd '[:alnum:]_\-=,\n\t ' | ${SEDBINARY} 's/[[:blank:]]/__space__/g')
-            for LINE in ${DATA}; do
-                LINE=$(echo ${LINE} | ${SEDBINARY} 's/__space__/ /g')
-                if ContainsString "luks," "${LINE}"; then
-                    PARTITION=$(echo ${LINE} | ${AWKBINARY} '{print $1}' | ${AWKBINARY} -F_ '{print $1}')
-                    LogText "Result: Found LUKS encryption on partition ${PARTITION}"
-                    Report "encryption[]=luks,partition,${PARTITION}"
-                fi
-            done
-            unset DATA LINE PARTITION
-        else
-            LogText "Result: crypttab file (${FILE}) does not exist"
-        fi
+      FOUND=0
+      for BLOCK_DEV in $(${LSBLKBINARY} --noheadings -o PATH); do
+	if ${CRYPTSETUPBINARY} isLuks ${BLOCK_DEV}; then
+	  LogText "Result: Found LUKS encrypted block device: ${BLOCK_DEV}"
+	  Report "encryption[]=luks,block_device,${BLOCK_DEV}"
+	  ((FOUND++))
+	fi
+      done
+      Display --indent 2 --text "- Found ${FOUND} LUKS encrypted block devices." --result OK --color WHITE
+      unset BLOCK_DEV
     fi
 #
 #################################################################################
-#
-
 WaitForKeyPress
 
 #

From e293af16aab3725ddd21dbecd374e8eb5232afb6 Mon Sep 17 00:00:00 2001
From: Julian Phillips <phillips.julian@gmail.com>
Date: Wed, 17 Jul 2019 18:01:44 -0700
Subject: [PATCH 237/679] Add FOUND var to unset list

---
 include/tests_crypto | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_crypto b/include/tests_crypto
index 4f7f1ff4..e22dcfe1 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -144,7 +144,7 @@
 	fi
       done
       Display --indent 2 --text "- Found ${FOUND} LUKS encrypted block devices." --result OK --color WHITE
-      unset BLOCK_DEV
+      unset BLOCK_DEV FOUND
     fi
 #
 #################################################################################

From 63043b536d7ed8f1c7a03be02e044d23c8382839 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 18 Jul 2019 11:33:28 +0200
Subject: [PATCH 238/679] [AUTH-9408] added support for pam_tally2 to log
 failed logins

---
 include/tests_authentication | 58 ++++++++++++++++++++++++++++--------
 1 file changed, 46 insertions(+), 12 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 819dfcc9..7b146001 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -1381,22 +1381,56 @@
 #
     # Test        : AUTH-9408
     # Description : Logging of failed login attempts
-    if [ -f ${ROOTDIR}etc/login.defs ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no AUTH-9408 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Logging of failed login attempts via /etc/login.defs"
+    Register --test-no AUTH-9408 --weight L --network NO --category security --description "Logging of failed login attempts via /etc/login.defs"
     if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: Checking FAILLOG_ENAB option in ${ROOTDIR}etc/login.defs "
-        FIND=$(${GREPBINARY} "^FAILLOG_ENAB" ${ROOTDIR}etc/login.defs | ${AWKBINARY} '{ if ($1=="FAILLOG_ENAB") { print $2 } }')
-        # Search for enabled status (yes), otherwise consider it to be disabled (e.g. empty, or other value)
-        if [ "${FIND}" = "yes" ]; then
-            AUTH_FAILED_LOGINS_LOGGED=1
-            LogText "Result: failed login attempts are logged in /var/log/faillog"
-            Display --indent 2 --text "- Logging failed login attempts" --result "${STATUS_ENABLED}" --color GREEN
+        if [ -f "${ROOTDIR}etc/pam.conf" ]; then
+            FOUND_PAM_TALLY2=0
+            FOUND_TALLYLOG=0
+            if [ -s "${ROOTDIR}var/log/tallylog" ]; then
+                FOUND_TALLYLOG=1
+                LogText "Result: found ${ROOTDIR}var/log/tallylog with a size bigger than zero"
+            else
+                LogText "Result: did not find ${ROOTDIR}var/log/tallylog on disk or its file size is zero bytes"
+            fi
+            # Determine if pam_tally2 is available
+            for D in $(GetReportData --key "pam_module\[\]"); do
+                if ContainsString "pam_tally2" "${D}"; then
+                    LogText "Result: found pam_tally2 module on disk"
+                    FOUND_PAM_TALLY2=1
+                fi
+            done
+            if [ ${FOUND_PAM_TALLY2} -eq 1 -a ${FOUND_TALLYLOG} -eq 1 ]; then
+                LogText "Outcome: authentication failures are logged using pam_tally2"
+                AUTH_FAILED_LOGINS_LOGGED=1
+                Report "auth_failed_logins_tooling[]=pam_tally2"
+            else
+                LogText "Outcome: it looks like pam_tally2 is not configured to log failed login attempts"
+            fi
+
+            unset FOUND_PAM_TALLY2 FOUND_TALLYLOG
+        fi
+        # Also check /etc/logins.defs, although its usage decreased over the years
+        if [ -f ${ROOTDIR}etc/login.defs ]; then
+            LogText "Test: Checking FAILLOG_ENAB option in ${ROOTDIR}etc/login.defs "
+            FIND=$(${GREPBINARY} "^FAILLOG_ENAB" ${ROOTDIR}etc/login.defs | ${AWKBINARY} '{ if ($1=="FAILLOG_ENAB") { print $2 } }')
+            # Search for enabled status (yes), otherwise consider it to be disabled (e.g. empty, or other value)
+            if [ "${FIND}" = "yes" ]; then
+                AUTH_FAILED_LOGINS_LOGGED=1
+                Report "auth_failed_logins_tooling[]=/etc/login.defs"
+                LogText "Result: FAILLOG_ENAB is set to 'yes'"
+                LogText "Outcome: failed login attempts are logged in ${ROOTDIR}var/log/faillog"
+                Display --indent 2 --text "- Logging failed login attempts" --result "${STATUS_ENABLED}" --color GREEN
+            else
+                LogText "Result: failed login attempts may not logged"
+                Display --indent 2 --text "- Logging failed login attempts" --result "${STATUS_DISABLED}" --color YELLOW
+            fi
+        fi
+
+        if [ ${AUTH_FAILED_LOGINS_LOGGED} -eq 1 ]; then
             AddHP 3 3
         else
-            LogText "Result: failed login attempts are not logged"
-            Display --indent 2 --text "- Logging failed login attempts" --result "${STATUS_DISABLED}" --color YELLOW
-            #ReportSuggestion ${TEST_NO} "Configure failed login attempts to be logged in /var/log/faillog"
             AddHP 0 1
+            #ReportSuggestion ${TEST_NO} "Configure failed login attempts to be logged using pam_tally2 or /etc/login.defs"
         fi
     fi
 #

From 62c5e5b88104fa0cd1d92da11d9ad2391d7118f4 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 18 Jul 2019 11:33:43 +0200
Subject: [PATCH 239/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cd6e8fab..ee332eaa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -43,6 +43,7 @@ measures to further tighten any possible misuse.
 - Profiles: unused options removed
 - Profiles: message is displayed when old format "key:value" is used
 - Security: the 'nounset' (set -u) parameter is now activated by default
+- AUTH-9408 - Added support for pam_tally2 to log failed logins
 - FINT-4328 - corrected text in log
 - INSE-8050 - added com.apple.ftp-proxy and improved text output
 - INSE-8116 - added rsync service

From b7f7179f1ef3287ab529537a4cc659349f007fef Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 18 Jul 2019 11:42:01 +0200
Subject: [PATCH 240/679] Moved variables

---
 include/consts | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/include/consts b/include/consts
index e78ca8e9..ae7df4ee 100644
--- a/include/consts
+++ b/include/consts
@@ -129,6 +129,7 @@ unset LANG
     HOSTID2=""
     HTTPDBINARY=""
     IDS_IPS_TOOL_FOUND=0
+    IFCONFIGBINARY=""
     IPBINARY=""
     IPFBINARY=""
     IPTABLESBINARY=""
@@ -136,11 +137,13 @@ unset LANG
     KLDSTATBINARY=""
     LAUNCHCTL_BINARY=""
     LDAP_CLIENT_CONFIG_FILE=""
+    LICENSE_KEY=""
     LICENSE_SERVER=""
     LINUX_VERSION=""
     LINUXCONFIGFILE=""
     LMDBINARY=""
     LMDFOUND=0
+    LOCATEBINARY=""
     LOGFILE=""
     LOGDIR=""
     LOGTEXT=1
@@ -187,6 +190,7 @@ unset LANG
     NGINX_WEAK_SSL_PROTOCOL_FOUND=0
     NTPD_ROLE=""
     NTPQBINARY=""
+    OPENSSLBINARY=""
     OPTION_DEBIAN_SKIP_SECURITY_REPOSITORY=0
     OPTIONS_CONN_MAX_WAIT_STATE=""
     ORACLE_RUNNING=0
@@ -243,12 +247,15 @@ unset LANG
     SAMHAINBINARY=""
     SCAN_TEST_HEAVY=""; SCAN_TEST_MEDIUM=""; SCAN_TEST_LOW=""
     SEARCH_PROFILES=""
+    SEARCH_VERSION=""
     SESTATUSBINARY=""
     SERVICE_MANAGER=""
     SETBINARY=""
     SETTINGS=""
     SETTINGS_FILE=""
     SET_STRICT=0
+    SHA1SUMBINARY=""
+    SHA256SUMBINARY=""
     SHELL_IS_BUSYBOX=0
     SHOWMOUNTBINARY=""
     SHOW_PROGRAM_DETAILS=1
@@ -313,15 +320,6 @@ unset LANG
     YUMBINARY=""
     ZYPPERBINARY=""
 
-# == Variables for strict mode ==
-    IFCONFIGBINARY=""
-    LOCATEBINARY=""
-    SEARCH_VERSION=""
-    SHA1SUMBINARY=""
-    SHA256SUMBINARY=""
-    OPENSSLBINARY=""
-    LICENSE_KEY=""
-
 #
 #################################################################################
 #

From b53b894f331fa4e005ee1c255471cd4070b0c11f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 18 Jul 2019 11:42:26 +0200
Subject: [PATCH 241/679] Added file check when a profile is provided

---
 include/parameters | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/include/parameters b/include/parameters
index 001044a5..98cd2e2d 100644
--- a/include/parameters
+++ b/include/parameters
@@ -315,7 +315,11 @@
             --profile)
                 if [ $# -gt 1 ]; then
                     shift
-                    SEARCH_PROFILES=$1
+                    if [ ! -r "$1" ]; then
+                        echo "Fatal error: could not find or read the provided profile ($1)"
+                        exit 1
+                    fi
+                    SEARCH_PROFILES="$1"
                 else
                     echo "Specify the profile (lynis audit system --profile /home/michael/myprofile.prf)"
                     exit 1

From 4b0f5517f7986c0000d476dcbf732891f057bcd7 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 18 Jul 2019 11:47:24 +0200
Subject: [PATCH 242/679] Textual change

---
 include/profiles | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/include/profiles b/include/profiles
index e27c84cd..65e3bcee 100644
--- a/include/profiles
+++ b/include/profiles
@@ -33,9 +33,8 @@
 
         LogText "Reading profile/configuration ${PROFILE}"
 
-        # Show deprecation message for old config entries
+        # Show deprecation message for old config entries such as 'config:' and 'apache:'
         FOUND=0
-        # Items such as 'config:' and 'apache:'
         DATA=$(egrep "^[a-z-]{1,}:" ${PROFILE} | od -An -ta | sed 's/ /!space!/g')  # od -An (no file offset), -ta (named character, to be on safe side)
         if ! IsEmpty "${DATA}"; then FOUND=1; fi
 

From dcd829076bb6adfde9c25568ae557cd0491e8e45 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 18 Jul 2019 11:48:00 +0200
Subject: [PATCH 243/679] Move this check to the DiscoverProfiles function

---
 include/parameters | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/include/parameters b/include/parameters
index 98cd2e2d..ede08267 100644
--- a/include/parameters
+++ b/include/parameters
@@ -315,10 +315,6 @@
             --profile)
                 if [ $# -gt 1 ]; then
                     shift
-                    if [ ! -r "$1" ]; then
-                        echo "Fatal error: could not find or read the provided profile ($1)"
-                        exit 1
-                    fi
                     SEARCH_PROFILES="$1"
                 else
                     echo "Specify the profile (lynis audit system --profile /home/michael/myprofile.prf)"

From d6cce1cd08b31458b355c7179817397c36bfe57d Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 18 Jul 2019 11:54:11 +0200
Subject: [PATCH 244/679] Test if profiles provided using the command line are
 readable

---
 include/functions | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/functions b/include/functions
index a48c338d..24facbdc 100644
--- a/include/functions
+++ b/include/functions
@@ -459,9 +459,11 @@
             done
             # Search any profiles defined with --profile
             for FILE in ${SEARCH_PROFILES}; do
-                if [ -r ${FILE} ]; then
+                if [ -r "${FILE}" ]; then
                     Debug "Found profile defined with --profile"
                     PROFILES="${PROFILES} ${FILE}"
+                else
+                    ExitFatal "Could not find or read profile (${FILE})"
                 fi
             done
         fi

From 022f427a69979a76216c6a44d12f980618c54143 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 18 Jul 2019 11:54:29 +0200
Subject: [PATCH 245/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ee332eaa..ef46558d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -68,6 +68,7 @@ measures to further tighten any possible misuse.
 - The 'show changelog' command works again for newer versions
 - Several code cleanups and standardization
 - Extended output of 'lynis update info'
+- Test if profiles are readable
 - systemd service file adjusted
 - bash completion script extended
 - Updated man page

From 4d5a0c59c783d0d644fc8b0dd8fe45745ce2d5a1 Mon Sep 17 00:00:00 2001
From: David <2069735+Marzal@users.noreply.github.com>
Date: Thu, 18 Jul 2019 18:52:36 +0200
Subject: [PATCH 246/679] Fix find fields in new profile format

New format uses permfile= so it needs a new cut to filter the name file
---
 include/tests_file_permissions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_file_permissions b/include/tests_file_permissions
index 2c43fc0e..108b830e 100644
--- a/include/tests_file_permissions
+++ b/include/tests_file_permissions
@@ -34,7 +34,7 @@
         LogText "Test: Checking file permissions"
         for PROFILE in ${PROFILES}; do
             LogText "Using profile ${PROFILE} for baseline."
-            FIND=$(${EGREPBINARY} '^permfile=|^permdir=' ${PROFILE} | ${CUTBINARY} -d= -f2)
+            FIND=$(${EGREPBINARY} '^permfile=|^permdir=' ${PROFILE} | ${CUTBINARY} -d= -f2 | ${CUTBINARY} -d: -f1)
             for I in ${FIND}; do
                 LogText "Checking ${I}"
                 CheckFilePermissions "${I}"

From b8a0190e82125a17eb82a36402cb7ae0321cd6b3 Mon Sep 17 00:00:00 2001
From: David <2069735+Marzal@users.noreply.github.com>
Date: Thu, 18 Jul 2019 18:58:11 +0200
Subject: [PATCH 247/679] Fix grep in PROFILEVALUE

Make it work with new profile format
---
 include/functions | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/functions b/include/functions
index 24facbdc..87286aa1 100644
--- a/include/functions
+++ b/include/functions
@@ -208,10 +208,10 @@
             # If 'file' is an directory, use -d
             if [ -d ${CHECKFILE} ]; then
                 FILEVALUE=$(ls -d -l ${CHECKFILE} | cut -c 2-10)
-                PROFILEVALUE=$(grep '^permdir' ${PROFILE} | grep ":${CHECKFILE}:" | cut -d: -f3)
+                PROFILEVALUE=$(grep '^permdir' ${PROFILE} | grep "=${CHECKFILE}:" | cut -d: -f2)
             else
                 FILEVALUE=$(ls -l ${CHECKFILE} | cut -c 2-10)
-                PROFILEVALUE=$(grep '^permfile' ${PROFILE} | grep ":${CHECKFILE}:" | cut -d: -f3)
+                PROFILEVALUE=$(grep '^permfile' ${PROFILE} | grep "=${CHECKFILE}:" | cut -d: -f2)
             fi
             if [ "${FILEVALUE}" = "${PROFILEVALUE}" ]; then PERMS="OK"; else PERMS="BAD"; fi
         fi

From b384fa2887139a39813cd262cc851335296de672 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 25 Jul 2019 11:34:58 +0200
Subject: [PATCH 248/679] New option: --usecwd to run from current working
 directory

---
 CHANGELOG.md       |  1 +
 include/functions  |  6 +++++-
 include/parameters |  4 ++++
 lynis              | 44 +++++++++++++++++++++++++++-----------------
 4 files changed, 37 insertions(+), 18 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ef46558d..173316bf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -27,6 +27,7 @@ measures to further tighten any possible misuse.
 - New function: Readonly - mark variable read-only (security)
 - New function: SafeFile - test file type and call permission check
 - New function: SafeInput - check for safe input (security)
+- New option: --usecwd - run from the current working directory
 - New profile option: disable-plugin - disables a single plugin
 - New profile option: ssl-certificate-paths-to-ignore - ignore a path
 - New test: CRYP-7930 - disk or file system encryption testing
diff --git a/include/functions b/include/functions
index 24facbdc..fb82e319 100644
--- a/include/functions
+++ b/include/functions
@@ -435,7 +435,11 @@
             DEFAULT_PROFILE=""
             PROFILEDIR=""
             tPROFILE_NAMES="default.prf custom.prf"
-            tPROFILE_TARGETS="/usr/local/etc/lynis /etc/lynis /usr/local/lynis ."
+            if [ ${USE_CWD} -eq 1 ]; then
+                tPROFILE_TARGETS="."
+            else
+                tPROFILE_TARGETS="/usr/local/etc/lynis /etc/lynis /usr/local/lynis ."
+            fi
             for PNAME in ${tPROFILE_NAMES}; do
                 for PLOC in ${tPROFILE_TARGETS}; do
                     # Only use one default.prf
diff --git a/include/parameters b/include/parameters
index ede08267..967f62c0 100644
--- a/include/parameters
+++ b/include/parameters
@@ -414,6 +414,10 @@
                 UPLOAD_DATA=1
             ;;
 
+            --usecwd)
+                return
+            ;;
+
             --verbose)
                 VERBOSE=1
             ;;
diff --git a/lynis b/lynis
index 992fb3dd..eb05bf9e 100755
--- a/lynis
+++ b/lynis
@@ -77,15 +77,21 @@
     WORKDIR=$(pwd)
 
     # Test from which directories we can use all functions and tests
-    INCLUDEDIR=""
-    tINCLUDE_TARGETS="/usr/local/include/lynis /usr/local/lynis/include /usr/share/lynis/include ./include"  # Default paths to check (CWD as last option, in case we run from standalone)
-    for I in ${tINCLUDE_TARGETS}; do
-        if [ "${I}" = "./include" ]; then
-            if [ -d "${WORKDIR}/include" ]; then INCLUDEDIR="${WORKDIR}/include"; fi
-        elif [ -d ${I} -a -z "${INCLUDEDIR}" ]; then
-            INCLUDEDIR=${I}
-        fi
-    done
+    USE_CWD=0
+    if case "$@" in *--usecwd*) true;; *) false;; esac; then
+        USE_CWD=1
+        INCLUDEDIR="./include"
+    else
+        INCLUDEDIR=""
+        tINCLUDE_TARGETS="/usr/local/include/lynis /usr/local/lynis/include /usr/share/lynis/include ./include"  # Default paths to check (CWD as last option, in case we run from standalone)
+        for I in ${tINCLUDE_TARGETS}; do
+            if [ "${I}" = "./include" ]; then
+                if [ -d "${WORKDIR}/include" ]; then INCLUDEDIR="${WORKDIR}/include"; fi
+            elif [ -d ${I} -a -z "${INCLUDEDIR}" ]; then
+                INCLUDEDIR=${I}
+            fi
+        done
+    fi
 
     # Drop out if our include directory can't be found
     if [ -z "${INCLUDEDIR}" ]; then
@@ -94,14 +100,18 @@
     fi
 
     # Test for database directory
-    DBDIR=""; tDB_TARGETS="/usr/local/share/lynis/db /usr/local/lynis/db /usr/share/lynis/db ./db"
-    for I in ${tDB_TARGETS}; do
-        if [ "${I}" = "./db" ]; then
-            if [ -d "${WORKDIR}/db" ]; then DBDIR="${WORKDIR}/db"; fi
-        elif [ -d ${I} -a -z "${DBDIR}" ]; then
-            DBDIR="${I}"
-        fi
-    done
+    if [ ${USE_CWD} -eq 1 ]; then
+        DBDIR="./db"
+    else
+        DBDIR=""; tDB_TARGETS="/usr/local/share/lynis/db /usr/local/lynis/db /usr/share/lynis/db ./db"
+        for I in ${tDB_TARGETS}; do
+            if [ "${I}" = "./db" ]; then
+                if [ -d "${WORKDIR}/db" ]; then DBDIR="${WORKDIR}/db"; fi
+            elif [ -d ${I} -a -z "${DBDIR}" ]; then
+                DBDIR="${I}"
+            fi
+        done
+    fi
 #
 #################################################################################
 #

From d6dab1846d13e756d8444f30afd35c4d6aedd5e0 Mon Sep 17 00:00:00 2001
From: Franciosi <andre@franciosi.org>
Date: Thu, 25 Jul 2019 11:38:58 -0300
Subject: [PATCH 249/679] Update README.md

Small typo fixes
---
 README.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index c60ab786..c4e10b88 100644
--- a/README.md
+++ b/README.md
@@ -57,16 +57,16 @@ If you want to run the software as `root`, we suggest changing the ownership of
 
 ### Package
 
-Stable releases of Lynis are packaged and made available as RPM or DEB package. The [CISOfy software repository](https://packages.cisofy.com) can be used to install Lynis on systems running :
+Stable releases of Lynis are packaged and made available as RPM or DEB package. The [CISOfy software repository](https://packages.cisofy.com) can be used to install Lynis on systems running:
 `CentOS`, `Debian`, `Fedora`, `OEL`, `openSUSE`, `RHEL`, `Ubuntu`, and others.
 
-### Enterprise version
+### Enterprise Version
 
 This software component is also part of an enterprise solution. Same quality, yet with more functionality.
 
 Focus areas include compliance (`PCI DSS`, `HIPAA`, `ISO27001`, and others). The Enterprise version comes with:
-* a web interface and features a dashboard ;
-* hardening snippets ;
+* a web interface and features a dashboard;
+* hardening snippets;
 * and an improvement plan.
 
 ## Documentation

From d621355b7e519867084e771c92cb6cde156dc8b9 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jul 2019 09:00:47 +0200
Subject: [PATCH 250/679] Set variable instead of using return, otherwise other
 parameters won't be checked

---
 include/parameters | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/parameters b/include/parameters
index 967f62c0..49c0f495 100644
--- a/include/parameters
+++ b/include/parameters
@@ -415,7 +415,7 @@
             ;;
 
             --usecwd)
-                return
+                USE_CWD=1
             ;;
 
             --verbose)

From b7fb98a47f65a3eba15ac4222bb3a1e096432402 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jul 2019 10:57:44 +0200
Subject: [PATCH 251/679] [AUTH-9266] skip .pam-old files in /etc/pam.d (used
 by Ubuntu)

---
 include/tests_authentication | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 7b146001..c8c44d3f 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -644,12 +644,12 @@
     # Description : Searching available PAM configurations (/etc/pam.d)
     Register --test-no AUTH-9266 --weight L --network NO --category security --description "Checking presence pam.d files"
     if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: Checking directory /etc/pam.d"
+        LogText "Test: Checking directory ${ROOTDIR}etc/pam.d"
         if [ -d ${ROOTDIR}etc/pam.d ]; then
             LogText "Result: directory /etc/pam.d exists"
             Display --indent 2 --text "- PAM configuration files (pam.d)" --result "${STATUS_FOUND}" --color GREEN
             LogText "Test: searching PAM configuration files"
-            FIND=$(find /etc/pam.d -type f -print | sort)
+            FIND=$(${FINDBINARY} ${ROOTDIR}etc/pam.d -not -name "*.pam-old" -type f -print | sort)
             for FILE in ${FIND}; do
                 LogText "Found file: ${FILE}"
             done

From 8321b986891eae1f928434ea9ac0003ae743ab67 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jul 2019 11:11:03 +0200
Subject: [PATCH 252/679] [AUTH-9408] double escape to prevent error message
 (awk: warning: escape sequence '\[' treated as plain '[')

---
 include/tests_authentication | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index c8c44d3f..87bb96d7 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -1393,7 +1393,7 @@
                 LogText "Result: did not find ${ROOTDIR}var/log/tallylog on disk or its file size is zero bytes"
             fi
             # Determine if pam_tally2 is available
-            for D in $(GetReportData --key "pam_module\[\]"); do
+            for D in $(GetReportData --key "pam_module\\[\\]"); do
                 if ContainsString "pam_tally2" "${D}"; then
                     LogText "Result: found pam_tally2 module on disk"
                     FOUND_PAM_TALLY2=1

From 17137408d29d004e7ec1512ab7e6b7d30ff28ebe Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jul 2019 11:32:48 +0200
Subject: [PATCH 253/679] Use IsRunning exit code instead of variable

---
 include/tests_accounting      |  6 ++---
 include/tests_containers      |  3 +--
 include/tests_firewalls       | 15 ++++--------
 include/tests_ldap            |  4 +---
 include/tests_logging         | 21 ++++++----------
 include/tests_mail_messaging  | 12 ++++------
 include/tests_malware         | 45 ++++++++++++-----------------------
 include/tests_nameservices    | 18 +++++---------
 include/tests_networking      |  3 +--
 include/tests_printers_spools |  9 +++----
 include/tests_shells          |  6 ++---
 include/tests_snmp            |  4 +---
 include/tests_time            |  9 +++----
 13 files changed, 51 insertions(+), 104 deletions(-)

diff --git a/include/tests_accounting b/include/tests_accounting
index 2b2ceb46..93cd2162 100644
--- a/include/tests_accounting
+++ b/include/tests_accounting
@@ -139,8 +139,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Check auditd status"
         # Should not get kauditd
-        IsRunning auditd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "auditd"; then
             LogText "Result: auditd running"
             Display --indent 2 --text "- Checking auditd" --result "${STATUS_ENABLED}" --color GREEN
             LINUX_AUDITD_RUNNING=1
@@ -277,8 +276,7 @@
     Register --test-no ACCT-9650 --os Solaris --weight L --network NO --category security --description "Check Solaris audit daemon"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: check if audit daemon is running"
-        IsRunning auditd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "auditd"; then
             LogText "Result: Solaris audit daemon is running"
             SOLARIS_AUDITD_RUNNING=1
             AUDIT_DAEMON_RUNNING=1
diff --git a/include/tests_containers b/include/tests_containers
index 4d722e52..fb570fdb 100644
--- a/include/tests_containers
+++ b/include/tests_containers
@@ -81,8 +81,7 @@
     # Description : Checking Docker daemon status and basic information for later tests
     Register --test-no CONT-8102 --weight L --network NO --category security --description "Checking Docker status and information"
     if [ ${SKIPTEST} -eq 0 ]; then
-        IsRunning "dockerd"
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "dockerd"; then
             LogText "Result: found Docker daemon running"
             Report "docker_daemon_running=1"
             DOCKER_DAEMON_RUNNING=1
diff --git a/include/tests_firewalls b/include/tests_firewalls
index 99a9bc2a..cb08696e 100644
--- a/include/tests_firewalls
+++ b/include/tests_firewalls
@@ -245,8 +245,7 @@
                 LogText "Result: no kldstat binary, skipping this part"
             fi
 
-            IsRunning pflogd
-            if [ ${RUNNING} -eq 1 ]; then
+            if IsRunning "pflogd"; then
                 LogText "Result: found pflog daemon in process list"
                 Display --indent 4 --text "- Checking pflogd status" --result "ACTIVE" --color GREEN
                 PFFOUND=1
@@ -410,8 +409,7 @@
 
         # Little Snitch Daemon (macOS)
         LogText "Test: checking process Little Snitch Daemon"
-        IsRunning --full "Little Snitch Daemon"
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning --full "Little Snitch Daemon"; then
             Display --indent 2 --text "- Checking Little Snitch Daemon" --result "${STATUS_ENABLED}" --color GREEN
             LogText "Result: Little Snitch found"
             FOUND=1
@@ -423,8 +421,7 @@
 
         # HandsOff! Daemon (macOS)
         LogText "Test: checking process HandsOffDaemon"
-        IsRunning HandsOffDaemon
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "HandsOffDaemon"; then
             Display --indent 2 --text "- Checking Hands Off! Daemon" --result "${STATUS_ENABLED}" --color GREEN
             LogText "Result: Hands Off! found"
             FOUND=1
@@ -436,8 +433,7 @@
 
         # LuLu Daemon (macOS)
         LogText "Test: checking process LuLu"
-        IsRunning LuLu
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "LuLu"; then
             Display --indent 2 --text "- Checking LuLu Daemon" --result "${STATUS_ENABLED}" --color GREEN
             LogText "Result: LuLu found"
             FOUND=1
@@ -449,8 +445,7 @@
 
         # Radio Silence (macOS)
         LogText "Test: checking process Radio Silence"
-        IsRunning --full "Radio Silence"
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning --full "Radio Silence"; then
             Display --indent 2 --text "- Checking Radio Silence" --result "${STATUS_ENABLED}" --color GREEN
             LogText "Result: Radio Silence found"
             FOUND=1
diff --git a/include/tests_ldap b/include/tests_ldap
index 0c6ae10e..cd7be982 100644
--- a/include/tests_ldap
+++ b/include/tests_ldap
@@ -36,9 +36,7 @@
     # Description : Check running OpenLDAP instance
     Register --test-no LDAP-2219 --weight L --network NO --category security --description "Check running OpenLDAP instance"
     if [ ${SKIPTEST} -eq 0 ]; then
-        # TODO adding additional slash needed?
-        IsRunning slapd
-        if [ ${RUNNING} -eq 0 ]; then
+        if IsRunning "slapd"; then
             Display --indent 2 --text "- Checking OpenLDAP instance" --result "${STATUS_NOT_FOUND}" --color WHITE
             LogText "Result: No running slapd process found."
         else
diff --git a/include/tests_logging b/include/tests_logging
index f8492c90..b7bb260e 100644
--- a/include/tests_logging
+++ b/include/tests_logging
@@ -65,8 +65,7 @@
     Register --test-no LOGG-2132 --weight L --network NO --category security --description "Check for running syslog-ng daemon"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Searching for syslog-ng daemon in process list"
-        IsRunning syslog-ng
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "syslog-ng"; then
             LogText "Result: Found syslog-ng in process list"
             Display --indent 4 --text "- Checking Syslog-NG status" --result "${STATUS_FOUND}" --color GREEN
             SYSLOG_DAEMON_PRESENT=1
@@ -104,8 +103,7 @@
     Register --test-no LOGG-2136 --weight L --network NO --category security --description "Check for running systemd journal daemon"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Searching for systemd journal daemon in process list"
-        IsRunning systemd-journal
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "systemd-journal"; then
             Display --indent 4 --text "- Checking systemd journal status" --result "${STATUS_FOUND}" --color GREEN
             SYSTEMD_JOURNAL_RUNNING=1
             Report "syslog_daemon_present=1"
@@ -122,8 +120,7 @@
     Register --test-no LOGG-2210 --weight L --network NO --category security --description "Check for running metalog daemon"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Searching for metalog daemon in process list"
-        IsRunning metalog
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "metalog"; then
             LogText "Result: Found metalog in process list"
             Display --indent 4 --text "- Checking Metalog status" --result "${STATUS_FOUND}" --color GREEN
             SYSLOG_DAEMON_PRESENT=1
@@ -143,8 +140,7 @@
     Register --test-no LOGG-2230 --weight L --network NO --category security --description "Check for running RSyslog daemon"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Searching for RSyslog daemon in process list"
-        IsRunning rsyslogd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "rsyslogd"; then
             LogText "Result: Found rsyslogd in process list"
             Display --indent 4 --text "- Checking RSyslog status" --result "${STATUS_FOUND}" --color GREEN
             SYSLOG_DAEMON_PRESENT=1
@@ -164,8 +160,7 @@
     Register --test-no LOGG-2240 --weight L --network NO --category security --description "Check for running RFC 3195 compliant daemon"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Searching for RFC 3195 daemon (alias syslog reliable) in process list"
-        IsRunning rfc3195d
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "rfc3195d"; then
             LogText "Result: Found rfc3195d in process list"
             Display --indent 4 --text "- Checking RFC 3195 daemon status" --result "${STATUS_FOUND}" --color GREEN
             SYSLOG_DAEMON_PRESENT=1
@@ -190,8 +185,7 @@
         if [ ${RSYSLOG_RUNNING} -eq 0 -a ${SYSTEMD_JOURNAL_RUNNING} -eq 0 ]; then
             # Search for klogd, but ignore other lines related to klogd (like dd with input/output file)
             #FIND=$(${PSBINARY} ax | ${GREPBINARY} "klogd" | ${GREPBINARY} -v "dd" | ${GREPBINARY} -v "grep")
-            IsRunning klogd
-            if [ ${RUNNING} -eq 1 ]; then
+            if IsRunning "klogd"; then
                 LogText "Result: klogd running"
                 Display --indent 4 --text "- Checking klogd" --result "${STATUS_FOUND}" --color GREEN
             else
@@ -212,8 +206,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Result: Checking for unkilled minilogd instances"
         # Search for minilogd. It shouldn't be running normally, if another syslog daemon is started
-        IsRunning minilogd
-        if [ ${RUNNING} -eq 0 ]; then
+        if IsRunning "minilogd"; then
             Display --indent 4 --text "- Checking minilogd instances" --result "${STATUS_NOT_FOUND}" --color WHITE
             LogText "Result: No minilogd is running"
         else
diff --git a/include/tests_mail_messaging b/include/tests_mail_messaging
index f5770bc2..901df6dc 100644
--- a/include/tests_mail_messaging
+++ b/include/tests_mail_messaging
@@ -44,8 +44,7 @@
     Register --test-no MAIL-8802 --weight L --network NO --category security --description "Check Exim status"
     if [ ${SKIPTEST} -eq 0  ]; then
         LogText "Test: check Exim status"
-        IsRunning exim4 || IsRunning exim
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "exim4" || IsRunning "exim"; then
             LogText "Result: found running Exim process"
             Display --indent 2 --text "- Exim status" --result "${STATUS_RUNNING}" --color GREEN
             EXIM_RUNNING=1
@@ -283,8 +282,7 @@
     Register --test-no MAIL-8838 --weight L --network NO --category security --description "Check dovecot process"
     if [ ${SKIPTEST} -eq 0  ]; then
         LogText "Test: check dovecot status"
-        IsRunning dovecot
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "dovecot"; then
             LogText "Result: found running dovecot process"
             Display --indent 2 --text "- Dovecot status" --result "${STATUS_RUNNING}" --color GREEN
             DOVECOT_RUNNING=1
@@ -305,8 +303,7 @@
     Register --test-no MAIL-8860 --weight L --network NO --category security --description "Check Qmail status"
     if [ ${SKIPTEST} -eq 0  ]; then
         LogText "Test: check Qmail status"
-        IsRunning qmail-smtpd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "qmail-smtpd"; then
             LogText "Result: found running Qmail process"
             Display --indent 2 --text "- Qmail status" --result "${STATUS_RUNNING}" --color GREEN
             QMAIL_RUNNING=1
@@ -325,8 +322,7 @@
     Register --test-no MAIL-8880 --weight L --network NO --category security --description "Check Sendmail status"
     if [ ${SKIPTEST} -eq 0  ]; then
         LogText "Test: check sendmail status"
-        IsRunning sendmail
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "sendmail"; then
             LogText "Result: found running Sendmail process"
             Display --indent 2 --text "- Sendmail status" --result "${STATUS_RUNNING}" --color GREEN
             SENDMAIL_RUNNING=1
diff --git a/include/tests_malware b/include/tests_malware
index 19172ca6..b260c488 100644
--- a/include/tests_malware
+++ b/include/tests_malware
@@ -102,8 +102,7 @@
 
         # ESET security products
         LogText "Test: checking process esets_daemon"
-        IsRunning esets_daemon
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "esets_daemon"; then
             FOUND=1
             ESET_DAEMON_RUNNING=1
             MALWARE_SCANNER_INSTALLED=1
@@ -114,8 +113,7 @@
 
         # Bitdefender (macOS)
         LogText "Test: checking process epagd"
-        IsRunning epagd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "epagd"; then
             FOUND=1
             BITDEFENDER_DAEMON_RUNNING=1
             MALWARE_SCANNER_INSTALLED=1
@@ -126,8 +124,7 @@
 
         # Avast (macOS)
         LogText "Test: checking process com.avast.daemon"
-        IsRunning com.avast.daemon
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "com.avast.daemon"; then
             FOUND=1
             AVAST_DAEMON_RUNNING=1
             MALWARE_SCANNER_INSTALLED=1
@@ -138,8 +135,7 @@
 
         # Avira
         LogText "Test: checking process Avira daemon"
-        IsRunning avqmd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "avqmd"; then
             FOUND=1
             AVIRA_DAEMON_RUNNING=1
             MALWARE_SCANNER_INSTALLED=1
@@ -150,8 +146,7 @@
 
         # Cylance (macOS)
         LogText "Test: checking process CylanceSvc"
-        IsRunning CylanceSvc
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "CylanceSvc"; then
             FOUND=1
             if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} CylancePROTECT" --result "${STATUS_FOUND}" --color GREEN; fi
             LogText "Result: found CylancePROTECT service"
@@ -164,11 +159,9 @@
         LogText "Test: checking process cma or cmdagent (McAfee)"
         # cma is too generic to match on, so we want to ensure that it is related to McAfee first
         if [ -x /opt/McAfee/cma/bin/cma ]; then
-            IsRunning cma
-            if [ ${RUNNING} -eq 1 ]; then MCAFEE_SCANNER_RUNNING=1; fi
+            if IsRunning "cma"; then MCAFEE_SCANNER_RUNNING=1; fi
         else
-            IsRunning cmdagent
-            if [ ${RUNNING} -eq 1 ]; then MCAFEE_SCANNER_RUNNING=1; fi
+            if IsRunning "cmdagent"; then MCAFEE_SCANNER_RUNNING=1; fi
         fi
         if [ ${MCAFEE_SCANNER_RUNNING} -eq 1 ]; then
             FOUND=1
@@ -180,14 +173,12 @@
 
         # Sophos savscand/SophosScanD
         LogText "Test: checking process savscand"
-        IsRunning savscand
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "savscand"; then
             FOUND=1
             SOPHOS_SCANNER_RUNNING=1
         fi
         LogText "Test: checking process SophosScanD"
-        IsRunning SophosScanD
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "SophosScanD"; then
             FOUND=1
             SOPHOS_SCANNER_RUNNING=1
         fi
@@ -200,18 +191,15 @@
 
         # Symantec rtvscand/smcd/symcfgd
         LogText "Test: checking process rtvscand"
-        IsRunning rtvscand
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "rtvscand"; then
             SYMANTEC_SCANNER_RUNNING=1
         fi
         LogText "Test: checking process Symantec management client service"
-        IsRunning smcd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "smcd"; then
             SYMANTEC_SCANNER_RUNNING=1
         fi
         LogText "Test: checking process Symantec Endpoint Protection configuration service"
-        IsRunning symcfgd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "symcfgd"; then
             SYMANTEC_SCANNER_RUNNING=1
         fi
         if [ ${SYMANTEC_SCANNER_RUNNING} -eq 1 ]; then
@@ -224,8 +212,7 @@
 
         # TrendMicro (macOS)
         LogText "Test: checking process TmccMac to test for Trend Micro anti-virus (macOS)"
-        IsRunning TmccMac
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "TmccMac"; then
             if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} Trend Micro anti-virus" --result "${STATUS_FOUND}" --color GREEN; fi
             LogText "Result: found Trend Micro component"
             FOUND=1
@@ -267,8 +254,7 @@
     Register --test-no MALW-3284 --weight L --network NO --category security --description "Check for clamd"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: checking running ClamAV daemon (clamd)"
-        IsRunning clamd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "clamd"; then
             Display --indent 2 --text "- ${GEN_CHECKING} ClamAV daemon" --result "${STATUS_FOUND}" --color GREEN
             LogText "Result: found running clamd process"
             MALWARE_SCANNER_INSTALLED=1
@@ -286,8 +272,7 @@
     Register --test-no MALW-3286 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for freshclam"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: checking running freshclam daemon"
-        IsRunning freshclam
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "freshclam"; then
             FRESHCLAM_DAEMON_RUNNING=1
             Display --indent 4 --text "- ${GEN_CHECKING} freshclam" --result "${STATUS_FOUND}" --color GREEN
             LogText "Result: found running freshclam process"
diff --git a/include/tests_nameservices b/include/tests_nameservices
index 4b4b1ac8..fc07eeb8 100644
--- a/include/tests_nameservices
+++ b/include/tests_nameservices
@@ -215,8 +215,7 @@
     Register --test-no NAME-4032 --weight L --network NO --category security --description "Check nscd status"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: checking nscd status"
-        IsRunning nscd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "nscd"; then
             NAME_CACHE_USED=1
             LogText "Result: nscd is running"
             Display --indent 2 --text "- Checking nscd status" --result "${STATUS_RUNNING}" --color GREEN
@@ -233,8 +232,7 @@
     Register --test-no NAME-4034 --weight L --network NO --category security --description "Check Unbound status"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: checking Unbound (unbound) status"
-        IsRunning unbound
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "unbound"; then
             UNBOUND_RUNNING=1
             NAME_CACHE_USED=1
             LogText "Result: Unbound daemon is running"
@@ -278,8 +276,7 @@
     Register --test-no NAME-4202 --weight L --network NO --category security --description "Check BIND status"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking for running BIND instance"
-        IsRunning named
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "named"; then
             LogText "Result: found BIND process"
             Display --indent 2 --text "- Checking BIND status" --result "${STATUS_FOUND}" --color GREEN
             BIND_RUNNING=1
@@ -384,8 +381,7 @@
     Register --test-no NAME-4230 --weight L --network NO --category security --description "Check PowerDNS status"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking for running PowerDNS instance"
-        IsRunning pdns_server
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "pdns_server"; then
             LogText "Result: found PowerDNS process"
             Display --indent 2 --text "- Checking PowerDNS status" --result "${STATUS_RUNNING}" --color GREEN
             POWERDNS_RUNNING=1
@@ -481,13 +477,11 @@
     Register --test-no NAME-4304 --weight L --network NO --category security --description "Check NIS ypbind status"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking status of ypbind daemon"
-        IsRunning ypbind
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "ypbind"; then
             LogText "Result: ypbind is running"
             Display --indent 2 --text "- Checking ypbind status" --result "${STATUS_FOUND}" --color GREEN
             YPBIND_RUNNING=1
-            IsRunning ypldap
-            if [ ${RUNNING} -eq 1 ]; then
+            if IsRunning "ypldap"; then
                 LogText "Result: ypldap is running"
                 Display --indent 2 --text "- Checking ypldap status" --result "${STATUS_FOUND}" --color GREEN
             else
diff --git a/include/tests_networking b/include/tests_networking
index 82ec452a..aa167873 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -596,8 +596,7 @@
     # Description : Checking for DHCP client
     Register --test-no NETW-3030 --weight L --network NO --category security --description "Checking DHCP client status"
     if [ ${SKIPTEST} -eq 0 ]; then
-        IsRunning dhclient || IsRunning dhcpcd || IsRunning udhcpc
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "dhclient" || IsRunning "dhcpcd" || IsRunning "udhcpc"; then
             Display --indent 2 --text "- Checking status DHCP client" --result "${STATUS_RUNNING}" --color WHITE
             DHCP_CLIENT_RUNNING=1
         else
diff --git a/include/tests_printers_spools b/include/tests_printers_spools
index 5786f4c7..a727f9a3 100644
--- a/include/tests_printers_spools
+++ b/include/tests_printers_spools
@@ -69,8 +69,7 @@
     Register --test-no PRNT-2304 --weight L --network NO --category security --description "Check cupsd status"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking cupsd status"
-        IsRunning cupsd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "cupsd"; then
             Display --indent 2 --text "- Checking cups daemon" --result "${STATUS_RUNNING}" --color GREEN
             LogText "Result: cups daemon running"
             CUPSD_RUNNING=1; PRINTING_DAEMON="cups"
@@ -188,8 +187,7 @@
     Register --test-no PRNT-2314 --weight L --network NO --category security --description "Check lpd status"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking lpd status"
-        IsRunning lpd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "lpd"; then
             Display --indent 2 --text "- Checking lp daemon" --result "${STATUS_RUNNING}" --color GREEN
             LogText "Result: lp daemon running"
             LPD_RUNNING=1; PRINTING_DAEMON="lp"
@@ -231,8 +229,7 @@
     Register --test-no PRNT-2418 --os AIX --weight L --network NO --category security --description "Checking qdaemon printer spooler status"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking qdaemon status"
-        IsRunning qdaemon
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "qdaemon"; then
             LogText "Result: qdaemon daemon running"
             Display --indent 2 --text "- Checking qdaemon daemon" --result "${STATUS_RUNNING}" --color GREEN
             QDAEMON_RUNNING=1; PRINTING_DAEMON="qdaemon"
diff --git a/include/tests_shells b/include/tests_shells
index 8e97ae86..37d152b4 100644
--- a/include/tests_shells
+++ b/include/tests_shells
@@ -107,14 +107,12 @@
         IDLE_TIMEOUT_READONLY=""
 
         LogText "Test: Search for session timeout tools or settings in shell"
-        IsRunning timeoutd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "timeoutd"; then
             IDLE_TIMEOUT=1
             LogText "Result: found timeoutd process to kill idle sesions"
             IDLE_TIMEOUT_METHOD="timeout-daemon"
         fi
-        IsRunning autolog
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "autolog"; then
             IDLE_TIMEOUT=1
             LogText "Result: found autolog process to kill idle sesions"
             Report="session_timeout_method[]=autolog"
diff --git a/include/tests_snmp b/include/tests_snmp
index 8b82d9e8..20c61f3b 100644
--- a/include/tests_snmp
+++ b/include/tests_snmp
@@ -35,9 +35,7 @@
     Register --test-no SNMP-3302 --weight L --network NO --category security --description "Check for running SNMP daemon"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Searching for a SNMP daemon"
-        # Check running processes
-        IsRunning snmpd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "snmpd"; then
             SNMP_DAEMON_RUNNING=1
             LogText "Result: SNMP daemon is running"
             Display --indent 2 --text "- Checking running SNMP daemon" --result "${STATUS_FOUND}" --color GREEN
diff --git a/include/tests_time b/include/tests_time
index 27693236..00245ff2 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -63,8 +63,7 @@
             if [ -f ${FILE} ]; then LogText "result: found chrony configuration: ${FILE}"; CHRONY_CONF_FILE="${FILE}"; fi
         done
         if [ -n "${CHRONY_CONF_FILE}" ]; then
-            IsRunning chronyd
-            if [ ${RUNNING} -eq 1 ]; then
+            if IsRunning "chronyd"; then
                 FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="chronyd"
                 Display --indent 2 --text "- NTP daemon found: chronyd" --result "${STATUS_FOUND}" --color GREEN
             else
@@ -75,8 +74,7 @@
         fi
 
         # Check time daemon (eg DragonFly BSD)
-        IsRunning dntpd
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "dntpd"; then
             FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="dntpd"
             Display --indent 2 --text "- NTP daemon found: dntpd" --result "${STATUS_FOUND}" --color GREEN
         fi
@@ -91,8 +89,7 @@
         fi
 
         # Check time daemon (eg NetBSD)
-        IsRunning timed
-        if [ ${RUNNING} -eq 1 ]; then
+        if IsRunning "timed"; then
             FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="timed"
             Display --indent 2 --text "- NTP daemon found: timed" --result "${STATUS_FOUND}" --color GREEN
         fi

From ce8c9f44a09272f5e4208b09aa93767e19ade952 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jul 2019 11:32:55 +0200
Subject: [PATCH 254/679] Updated log

---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 173316bf..a46215e3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -44,7 +44,8 @@ measures to further tighten any possible misuse.
 - Profiles: unused options removed
 - Profiles: message is displayed when old format "key:value" is used
 - Security: the 'nounset' (set -u) parameter is now activated by default
-- AUTH-9408 - Added support for pam_tally2 to log failed logins
+- AUTH-9266 - skip .pam-old files in /etc/pam.d
+- AUTH-9408 - added support for pam_tally2 to log failed logins
 - FINT-4328 - corrected text in log
 - INSE-8050 - added com.apple.ftp-proxy and improved text output
 - INSE-8116 - added rsync service

From 3af72e41c7475821fdc1dcc8e1c90a2cd7fc2a4a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jul 2019 11:59:03 +0200
Subject: [PATCH 255/679] Improved selection of home directories for normal
 users in HOME-9304 and HOME-9306

---
 include/tests_homedirs | 26 +++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/include/tests_homedirs b/include/tests_homedirs
index e51cf3d9..544fa152 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -57,24 +57,26 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users' home directories permissions are 750 or more restrictive
         FOUND=0
-        for LINE in "$(${CAT_BINARY} ${ROOTDIR}etc/passwd | ${EGREPBINARY} -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }')"; do
+        for LINE in "$(${EGREPBINARY} -v '^(daemon|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }')"; do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
             DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
-            if [ -d ${DIR} ]; then
-                WRITE_GROUP_PERM=$(ls -ld ${DIR} | ${CUTBINARY} -f1 -d" " | ${CUTBINARY} -c6)
-                OTHER_PERMS=$(ls -ld ${DIR} | ${CUTBINARY} -f1 -d" " | ${CUTBINARY} -c8-10)
+            if [ -d "${DIR}" ]; then
+                WRITE_GROUP_PERM=$(${LSBINARY} -ld ${DIR} | ${CUTBINARY} -f1 -d" " | ${CUTBINARY} -c6)
+                OTHER_PERMS=$(${LSBINARY} -ld ${DIR} | ${CUTBINARY} -f1 -d" " | ${CUTBINARY} -c8-10)
                 if [ ! ${WRITE_GROUP_PERM} = "-" -o ! ${OTHER_PERMS} = "---" ]; then
-                    LogText "Result: permissions of home directory ${DIR} of user ${USER} are not strict enough. Should be 750 or more restrictive. Change with: chmod 750 ${DIR}" 
+                    LogText "Result: permissions of home directory ${DIR} of user ${USER} are not strict enough. Should be 750 or more restrictive. Change with: chmod 750 ${DIR}"
                     FOUND=1
+                else
+                    LogText "Result: permissions of home directory ${DIR} of user ${USER} are fine"
                 fi
             fi
         done
 
         if [ ${FOUND} -eq 1 ]; then
-            Display --indent 2 --text "- Checking users' home directories permissions" --result "${STATUS_WARNING}" --color RED
+            Display --indent 2 --text "- Permissions of home directories" --result "${STATUS_WARNING}" --color RED
             ReportWarning ${TEST_NO} "Permissions of some users' home directories are not strict enough. Should be 750 or more restrictive."
         else
-            Display --indent 2 --text "- Checking users' home directories permissions" --result "${STATUS_OK}" --color GREEN
+            Display --indent 2 --text "- Permissions of home directories" --result "${STATUS_OK}" --color GREEN
             LogText "Result: Ok, All users' home directories permissions are 750 or more restrictive"
         fi
     fi
@@ -87,23 +89,25 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users own their home directories
         FOUND=0
-        for LINE in "$(${CAT_BINARY} ${ROOTDIR}etc/passwd | ${EGREPBINARY} -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }')"; do
+        for LINE in "$(${EGREPBINARY} -v '^(daemon|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }') { print }')"; do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
             DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
             if [ -d ${DIR} ]; then
                 OWNER=$(ls -ld ${DIR} | awk -F" " '{ print $3 }')
-                if [ ! ${OWNER} = ${USER} ]; then
+                if [ ! "${OWNER}" = "${USER}" ]; then
                     LogText "Result: The home directory ${DIR} of user ${USER} is owned by ${OWNER}. Change with: chown ${USER} ${DIR}" 
                     FOUND=1
+                else
+                    LogText "Result: ownership of home directory ${DIR} for user ${USER} looks to be correct"
                 fi
             fi
         done
 
         if [ ${FOUND} -eq 1 ]; then
-            Display --indent 2 --text "- Checking users' home directories ownership" --result "${STATUS_WARNING}" --color RED
+            Display --indent 2 --text "- Ownership of home directories" --result "${STATUS_WARNING}" --color RED
             ReportWarning ${TEST_NO} "Owner of some users' home directories are not correctly set"
         else
-            Display --indent 2 --text "- Checking users' home directories ownership" --result "${STATUS_OK}" --color GREEN
+            Display --indent 2 --text "- Ownership of home directories" --result "${STATUS_OK}" --color GREEN
             LogText "Result: Ok, All users own their home directories"
         fi
     fi

From f49f0a2029daebcd39090f0013447a5497f93d89 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jul 2019 11:59:19 +0200
Subject: [PATCH 256/679] Altered order of entries

---
 default.prf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/default.prf b/default.prf
index 1431beb6..0c172b4a 100644
--- a/default.prf
+++ b/default.prf
@@ -283,8 +283,8 @@ config-data=sysctl;security.bsd.hardlink_check_uid;1;1;Unprivileged processes ar
 
 #permfile=/etc/inetd.conf:rw-------:root:-:WARN:
 #permfile=/etc/fstab:rw-r--r--:root:-:WARN:
-permfile=/boot/grub2/grub.cfg:rw-------:root:root:WARN:
 permfile=/boot/grub/grub.cfg:rw-------:root:root:WARN:
+permfile=/boot/grub2/grub.cfg:rw-------:root:root:WARN:
 permfile=/boot/grub2/user.cfg:rw-------:root:root:WARN:
 permfile=/etc/at.allow:rw-------:root:-:WARN:
 permfile=/etc/at.deny:rw-------:root:-:WARN:

From 75d75d590be6b11fa7370e2cd1a3b688fad72d1d Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jul 2019 11:59:28 +0200
Subject: [PATCH 257/679] Updated log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a46215e3..df6e6199 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -47,6 +47,8 @@ measures to further tighten any possible misuse.
 - AUTH-9266 - skip .pam-old files in /etc/pam.d
 - AUTH-9408 - added support for pam_tally2 to log failed logins
 - FINT-4328 - corrected text in log
+- HOME-9304 - improved selection for normal users
+- HOME-9306 - improved selection for normal users
 - INSE-8050 - added com.apple.ftp-proxy and improved text output
 - INSE-8116 - added rsync service
 - INSE-8318 - test for TFTP client tools

From 7f1742fc544a560779d14d56f255b17e00e3c6e3 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jul 2019 14:14:54 +0200
Subject: [PATCH 258/679] Replaced direct calls to tools

---
 include/tests_mail_messaging | 34 ++++++++++++++++------------------
 1 file changed, 16 insertions(+), 18 deletions(-)

diff --git a/include/tests_mail_messaging b/include/tests_mail_messaging
index 23b0bf66..76c78dad 100644
--- a/include/tests_mail_messaging
+++ b/include/tests_mail_messaging
@@ -65,7 +65,7 @@
     if [ ${SKIPTEST} -eq 0 -a ${EXIM_RUNNING} -eq 1 ]; then
         LogText "Test: Exim configuration options"
 
-        EXIM_ROUTERS=$(exim -bP router_list)
+        EXIM_ROUTERS=$(${EXIMBINARY} -bP router_list)
 
         unset FIND FIND2 FIND3 FIND4
 
@@ -99,7 +99,7 @@
 
         if [ "${EXIM_TYPE}" = "INTERNET HOST" -o "${EXIM_TYPE}" = "SMARTHOST" ]; then
             LogText "Test: Exim Public Interfaces"
-            EXIM_IP=$(exim -bP local_interfaces | cut -d '=' -f2 | sed -e 's/\s*<\s*\;\?//' -e 's/\s*::0\s*\;\?//' -e 's/\s*127.0.0.1\s*\;\?//' -e 's/^\s*//' -e 's/\s*$//')
+            EXIM_IP=$(${EXIMBINARY} -bP local_interfaces | ${CUTBINARY} -d '=' -f2 | ${SEDBINARY} -e 's/\s*<\s*\;\?//' -e 's/\s*::0\s*\;\?//' -e 's/\s*127.0.0.1\s*\;\?//' -e 's/^\s*//' -e 's/\s*$//')
             if [ -n "${EXIM_IP}" ]; then
                 LogText "Result: ${EXIM_IP}"
                 Display --indent 4 --text "- Public Interface(s)" --result "${EXIM_IP}" --color GREEN
@@ -109,7 +109,7 @@
             fi
 
             LogText "Test: Exim TLS State"
-            EXIM_TLS=$(exim -bP tls_advertise_hosts | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
+            EXIM_TLS=$(${EXIMBINARY} -bP tls_advertise_hosts | ${CUTBINARY} -d '=' -f2 | ${SEDBINARY} -e 's/^\s*//' -e 's/\s*$//')
             if [ -n "${EXIM_TLS}" ]; then
                 LogText "Result: Enabled"
                 Display --indent 4 --text "- TLS" --result "ENABLED" --color GREEN
@@ -124,12 +124,12 @@
 
             case "${EXIM_TYPE}" in
                 "INTERNET HOST" | "SMARTHOST" )
-                    EXIM_CERTIFICATE=$(exim -bP tls_certificate | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
-                    EXIM_PRIVATEKEY=$(exim -bP tls_privatekey | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
+                    EXIM_CERTIFICATE=$(${EXIMBINARY} -bP tls_certificate | ${CUTBINARY} -d '=' -f2 | ${SEDBINARY} -e 's/^\s*//' -e 's/\s*$//')
+                    EXIM_PRIVATEKEY=$(${EXIMBINARY} -bP tls_privatekey | ${CUTBINARY} -d '=' -f2 | ${SEDBINARY} -e 's/^\s*//' -e 's/\s*$//')
                     ;;
                 "SATELLITE" )
-                    EXIM_CERTIFICATE=$(exim -bP transport remote_smtp_smarthost | grep tls_certificate | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
-                    EXIM_PRIVATEKEY=$(exim -bP transport remote_smtp_smarthost | grep tls_privatekey | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
+                    EXIM_CERTIFICATE=$(${EXIMBINARY} -bP transport remote_smtp_smarthost | ${GREPBINARY} tls_certificate | ${CUTBINARY} -d '=' -f2 | ${SEDBINARY} -e 's/^\s*//' -e 's/\s*$//')
+                    EXIM_PRIVATEKEY=$(${EXIMBINARY} -bP transport remote_smtp_smarthost | ${GREPBINARY} tls_privatekey | ${CUTBINARY} -d '=' -f2 | ${SEDBINARY} -e 's/^\s*//' -e 's/\s*$//')
                     ;;
             esac
 
@@ -165,28 +165,26 @@
 
             case "${EXIM_TYPE}" in
                 "INTERNET HOST" | "SMARTHOST" )
-                    EXIM_CERTIFICATES=$(exim -bP tls_verify_certificate | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
+                    EXIM_CERTIFICATES=$(${EXIMBINARY} -bP tls_verify_certificate | ${CUTBINARY} -d '=' -f2 | ${SEDBINARY} -e 's/^\s*//' -e 's/\s*$//')
                     ;;
                 "SATELLITE" )
-                    EXIM_CERTIFICATES=$(exim -bP transport remote_smtp_smarthost | grep tls_verify_certificate | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
+                    EXIM_CERTIFICATES=$(${EXIMBINARY} -bP transport remote_smtp_smarthost | ${GREPBINARY} tls_verify_certificate | ${CUTBINARY} -d '=' -f2 | ${SEDBINARY} -e 's/^\s*//' -e 's/\s*$//')
                     ;;
             esac
 
             case "${EXIM_CERTIFICATES}" in
                 "")
-                    # This condition results in a RED warning because it should
-                    # never be hit.
+                    # This condition results in a RED warning because it should never be hit
                     LogText "Result: Verify Certificates not set"
                     Display --indent 4 --text "- Verify Certificates not set" --result "${STATUS_WARNING}" --color RED
                     ;;
                 "system")
-                    # This is the default setting and should be the most common.
+                    # This is the default setting and should be the most common
                     LogText "Result: Verify Certificates set to system default"
                     Display --indent 4 --text "- Verify Certificates" --result "DEFAULT" --color WHITE
                     ;;
                 *)
-                    # This condition should only be hit when it has been set to
-                    # a custom value.
+                    # This condition should only be hit when it has been set to a custom value
                     LogText "Result: Verify Certificates set to \"${EXIM_CERTIFICATES}\""
                     Display --indent 4 --text "- Verify Certificates" --result "CUSTOM" --color GREEN
                     ;;
@@ -195,12 +193,12 @@
 
             case "${EXIM_TYPE}" in
                 "INTERNET HOST" | "SMARTHOST" )
-                    EXIM_VERIFY_HOSTS=$(exim -bP tls_verify_hosts | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
-                    EXIM_TRY_VERIFY_HOSTS=$(exim -bP tls_try_verify_hosts | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
+                    EXIM_VERIFY_HOSTS=$(${EXIMBINARY} -bP tls_verify_hosts | ${CUTBINARY} -d '=' -f2 | ${SEDBINARY} -e 's/^\s*//' -e 's/\s*$//')
+                    EXIM_TRY_VERIFY_HOSTS=$(${EXIMBINARY} -bP tls_try_verify_hosts | ${CUTBINARY} -d '=' -f2 | ${SEDBINARY} -e 's/^\s*//' -e 's/\s*$//')
                     ;;
                 "SATELLITE" )
-                    EXIM_VERIFY_HOSTS=$(exim -bP transport remote_smtp_smarthost | grep tls_verify_hosts | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
-                    EXIM_TRY_VERIFY_HOSTS=$(exim -bP transport remote_smtp_smarthost | grep tls_try_verify_hosts | cut -d '=' -f2 | sed -e 's/^\s*//' -e 's/\s*$//')
+                    EXIM_VERIFY_HOSTS=$(${EXIMBINARY} -bP transport remote_smtp_smarthost | ${GREPBINARY} tls_verify_hosts | ${CUTBINARY} -d '=' -f2 | ${SEDBINARY} -e 's/^\s*//' -e 's/\s*$//')
+                    EXIM_TRY_VERIFY_HOSTS=$(${EXIMBINARY} -bP transport remote_smtp_smarthost | ${GREPBINARY} tls_try_verify_hosts | ${CUTBINARY} -d '=' -f2 | ${SEDBINARY} -e 's/^\s*//' -e 's/\s*$//')
                     ;;
             esac
 

From 0a6417423f7dad6e6d8c777e70bd9a088736780b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jul 2019 14:15:09 +0200
Subject: [PATCH 259/679] Added HOME-9304 and HOME-9306

---
 db/tests.db | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/db/tests.db b/db/tests.db
index fe73dfc0..2a8ac612 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -149,6 +149,8 @@ FIRE-4586:test:security:firewalls::Check firewall logging:
 FIRE-4590:test:security:firewalls::Check firewall status:
 FIRE-4594:test:security:firewalls::Check for APF presence:
 HOME-9302:test:security:homedirs::Create list with home directories:
+HOME-9304:test:security:homedirs::Test permissions of user home directories:
+HOME-9306:test:security:homedirs::Test ownership of user home directories:
 HOME-9310:test:security:homedirs::Checking for suspicious shell history files:
 HOME-9350:test:security:homedirs::Collecting information from home directories:
 HRDN-7220:test:security:hardening::Check if one or more compilers are installed:

From 9605f0fa80832e70a8ee51b96ff2bba6c04877fd Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jul 2019 15:34:02 +0200
Subject: [PATCH 260/679] Combined sort and uniq to sort -u

---
 include/tests_crypto    | 4 ++--
 include/tests_databases | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/tests_crypto b/include/tests_crypto
index ecb19d2f..db710ad8 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -36,10 +36,10 @@
         FOUNDPROBLEM=0
         SKIP=0
         sSSL_PATHS=$(echo ${SSL_CERTIFICATE_PATHS} | ${SEDBINARY} 's/:space:/__space__/g' | ${SEDBINARY} 's/:/ /g')
-        sSSL_PATHS=$(echo ${sSSL_PATHS} | ${SEDBINARY} 's/^ //' | ${SORTBINARY} | ${UNIQBINARY})
+        sSSL_PATHS=$(echo ${sSSL_PATHS} | ${SEDBINARY} 's/^ //' | ${SORTBINARY} -u)
         LogText "Paths to scan: ${sSSL_PATHS}"
 
-        IGNORE_PATHS_PRINT=$(echo ${SSL_CERTIFICATE_PATHS_TO_IGNORE} | ${SEDBINARY} 's/:/, /g' | ${SEDBINARY} 's/__space__/ /g' | ${SEDBINARY} 's/^ //' | ${SORTBINARY} | ${UNIQBINARY})
+        IGNORE_PATHS_PRINT=$(echo ${SSL_CERTIFICATE_PATHS_TO_IGNORE} | ${SEDBINARY} 's/:/, /g' | ${SEDBINARY} 's/__space__/ /g' | ${SEDBINARY} 's/^ //' | ${SORTBINARY} -u)
         LogText "Paths to ignore: ${IGNORE_PATHS_PRINT}"
 
         for DIR in ${sSSL_PATHS}; do
diff --git a/include/tests_databases b/include/tests_databases
index 43d0d025..01dcfe12 100644
--- a/include/tests_databases
+++ b/include/tests_databases
@@ -297,7 +297,7 @@
             fi
         done
         # Sort the list of discovered configuration files so we can make them unique
-        REDIS_CONFIGURATION_FILES=$(echo ${REDIS_CONFIGURATION_FILES} | ${SEDBINARY} 's/^ //' | ${TRBINARY} ' ' '\n' | ${SORTBINARY} | ${UNIQBINARY} | ${TRBINARY} '\n' ' ')
+        REDIS_CONFIGURATION_FILES=$(echo ${REDIS_CONFIGURATION_FILES} | ${SEDBINARY} 's/^ //' | ${TRBINARY} ' ' '\n' | ${SORTBINARY} -u | ${TRBINARY} '\n' ' ')
         for FILE in ${REDIS_CONFIGURATION_FILES}; do
             if IsWorldReadable ${FILE}; then
                 LogText "Result: configuration file ${FILE} is world readable, this might leak sensitive information!"

From 7d6118f4a6300be3ff6f0f0dde5ee914357e702a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jul 2019 15:34:45 +0200
Subject: [PATCH 261/679] Updated log

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index df6e6199..e629776a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -70,7 +70,7 @@ measures to further tighten any possible misuse.
 - Use only locations from PATH environment variable, unless it is not defined
 - Show tip to use 'lynis generate hostids' when host IDs are missing
 - The 'show changelog' command works again for newer versions
-- Several code cleanups and standardization
+- Several code cleanups, simplification of commands, and code standardization
 - Extended output of 'lynis update info'
 - Test if profiles are readable
 - systemd service file adjusted

From fa064a824b6ba5519296dfd87e4604c2f15be897 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jul 2019 16:14:26 +0200
Subject: [PATCH 262/679] [FINT-4334] improved process detection for lfd

---
 include/tests_file_integrity | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/tests_file_integrity b/include/tests_file_integrity
index 6a527e75..55d95b37 100644
--- a/include/tests_file_integrity
+++ b/include/tests_file_integrity
@@ -201,7 +201,8 @@
     Register --test-no FINT-4334 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check lfd daemon status"
     if [ ${SKIPTEST} -eq 0 ]; then
         Display --indent 4 --text "- lfd (CSF)" --result "${STATUS_FOUND}" --color GREEN
-        if IsRunning 'lfd '; then
+        LogText "Test: determine lfd status"
+        if IsRunning "lfd - sleeping"; then
             LogText "Result: lfd daemon is running (CSF)"
             Report "file_integrity_tool[]=csf-lfd"
             Display --indent 6 --text "- LFD (CSF) daemon" --result "${STATUS_RUNNING}" --color GREEN

From 3859ce90f47b0afca7d9fe88b96c08cf3791d67f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jul 2019 16:14:35 +0200
Subject: [PATCH 263/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e629776a..0f634756 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -47,6 +47,7 @@ measures to further tighten any possible misuse.
 - AUTH-9266 - skip .pam-old files in /etc/pam.d
 - AUTH-9408 - added support for pam_tally2 to log failed logins
 - FINT-4328 - corrected text in log
+- FINT-4334 - improved process detection for lfd
 - HOME-9304 - improved selection for normal users
 - HOME-9306 - improved selection for normal users
 - INSE-8050 - added com.apple.ftp-proxy and improved text output

From 429ad46649f181af32c3d5ead61f79f02a3ef144 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jul 2019 20:07:14 +0200
Subject: [PATCH 264/679] [LOGG-2154] added support for rsyslog configurations

---
 include/tests_logging | 80 ++++++++++++++++++++++++++++++++++---------
 1 file changed, 64 insertions(+), 16 deletions(-)

diff --git a/include/tests_logging b/include/tests_logging
index b7bb260e..d6f18fbf 100644
--- a/include/tests_logging
+++ b/include/tests_logging
@@ -341,11 +341,58 @@
     if [ ${SYSLOG_DAEMON_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no LOGG-2154 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking syslog configuration file"
     if [ ${SKIPTEST} -eq 0 ]; then
-        if [ ${SYSLOG_NG_RUNNING} -eq 1 ]; then
-            SYSLOGD_CONF="/etc/syslog-ng/syslog-ng.conf"
-        else
-            SYSLOGD_CONF="/etc/syslog.conf"
+
+        if [ ${RSYSLOG_RUNNING} -eq 1 ]; then
+            DATA=""
+            TARGET="${ROOTDIR}etc/rsyslog.conf"
+            if [ -f ${TARGET} ]; then
+                LogText "Result: file ${TARGET} exists"
+                LogText "Test: analyzing file for remote target"
+                DATA=$(${EGREPBINARY} "@@?([a-zA-Z0-9\-])+(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?" ${TARGET} | ${GREPBINARY} -v "#" | ${TRBINARY} -cd "[:print:]\n" | ${SEDBINARY} 's/[[:blank:]]\{1,\}/:space:/g')
+                if [ -z "${DATA}" ]; then
+                    LogText "Result: no remote target found"
+                else
+                    LogText "Result: found remote target"
+                    REMOTE_LOGGING_ENABLED=1
+                    for D in ${DATA}; do
+                        if SafeInput "${D}"; then
+                            D=$(echo ${D} | ${SEDBINARY} 's/:space:/ /g')
+                            LogText "Data: ${D}"
+                        fi
+                    done
+                fi
+            fi
+            TARGET="${ROOTDIR}etc/rsyslog.d"
+            if [ -d ${TARGET} ]; then
+                FILES=$(${FINDBINARY} ${TARGET} -type f -print0 | ${TRBINARY} -cd '[:print:]\0' | ${SEDBINARY} 's/[[:blank:]]/:space:/g' | ${SEDBINARY} 's/\0/\n/g')
+                for F in "${FILES}"; do
+                    F=$(echo ${F} | ${SEDBINARY} 's/:space:/ /g')
+                    LogText "Result: found file ${F}"
+                    LogText "Test: analyzing file for remote target"
+                    DATA=$(${EGREPBINARY} "@@?([a-zA-Z0-9\-])+(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?" ${F} | ${GREPBINARY} -v "#" | ${TRBINARY} -cd "[:print:]\n" | ${SEDBINARY} 's/[[:blank:]]\{1,\}/:space:/g')
+                    if [ -z "${DATA}" ]; then
+                        LogText "Result: no remote target found"
+                    else
+                        LogText "Result: found remote target"
+                        REMOTE_LOGGING_ENABLED=1
+                        for D in ${DATA}; do
+                            if SafeInput "${D}"; then
+                                D=$(echo ${D} | ${SEDBINARY} 's/:space:/ /g')
+                                LogText "Data: ${D}"
+                            fi
+                        done
+                    fi
+                done
+            fi
         fi
+
+        # Test generic syslog files (syslog-ng and older syslog daemons)
+        if [ ${SYSLOG_NG_RUNNING} -eq 1 ]; then
+            SYSLOGD_CONF="${ROOTDIR}etc/syslog-ng/syslog-ng.conf"
+        else
+            SYSLOGD_CONF="${ROOTDIR}etc/syslog.conf"
+        fi
+
         if [ -f ${SYSLOGD_CONF} ]; then
             LogText "Test: check if logs are also logged to a remote logging host"
             FIND=$(${EGREPBINARY} "@[a-zA-Z0-9]|destination\s.+(udp|tcp).+\sport" ${SYSLOGD_CONF} | ${GREPBINARY} -v "^#" | ${GREPBINARY} -v "[a-zA-Z0-9]@")
@@ -357,24 +404,25 @@
                 DESTINATIONS=$(${GREPBINARY} "^destination" ${SYSLOGD_CONF} | ${EGREPBINARY} "(udp|tcp)" | ${GREPBINARY} "port" | ${AWKBINARY} '{print $2}')
                 for DESTINATION in ${DESTINATIONS}; do
                     FIND2=$(${GREPBINARY} "log" ${SYSLOGD_CONF} | ${GREPBINARY} "source" | ${EGREPBINARY} "destination\(${DESTINATION}\)")
-                    if [ -n "${FIND2}" = "" ]; then
+                    if [ -n "${FIND2}" ]; then
                         LogText "Result: found destination ${DESTINATION} configured for remote logging"
                         REMOTE_LOGGING_ENABLED=1
                     fi
                 done
             fi
-            if [ ${REMOTE_LOGGING_ENABLED} -eq 0 ]; then
-                LogText "Result: no remote logging found"
-                ReportSuggestion ${TEST_NO} "Enable logging to an external logging host for archiving purposes and additional protection"
-                AddHP 1 3
-                Display --indent 2 --text "- Checking remote logging" --result "NOT ENABLED" --color YELLOW
-            else
-                AddHP 5 5
-                Display --indent 2 --text "- Checking remote logging" --result "${STATUS_ENABLED}" --color GREEN
-            fi
-        else
-            LogText "Result: test skipped, file ${SYSLOGD_CONF} not found"
         fi
+
+        # Show result
+        if [ ${REMOTE_LOGGING_ENABLED} -eq 0 ]; then
+            LogText "Result: no remote logging found"
+            ReportSuggestion ${TEST_NO} "Enable logging to an external logging host for archiving purposes and additional protection"
+            AddHP 1 3
+            Display --indent 2 --text "- Checking remote logging" --result "NOT ENABLED" --color YELLOW
+        else
+            AddHP 5 5
+            Display --indent 2 --text "- Checking remote logging" --result "${STATUS_ENABLED}" --color GREEN
+        fi
+
     fi
 #
 #################################################################################

From fb33112555b41cab32fd550b3ca276ea843c8205 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jul 2019 20:07:24 +0200
Subject: [PATCH 265/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0f634756..5dc4d214 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -56,6 +56,7 @@ measures to further tighten any possible misuse.
 - INSE-8320 - test for TFTP server tools
 - INSE-8342 - renamed to INSE-8304
 - KRNL-5820 - extended check to include limits.d directory
+- LOGG-2154 - added support for rsyslog configurations
 - NAME-4408 - corrected Report function call
 - NETW-3032 - small rewrite of test and extended with addrwatch
 - PROC-3602 - allow different root directory

From 000838b15463193d63464adefa3a817ef3de0a33 Mon Sep 17 00:00:00 2001
From: David Marzal <2069735+Marzal@users.noreply.github.com>
Date: Mon, 29 Jul 2019 15:22:48 +0200
Subject: [PATCH 266/679] Document --usecwd in helper_show and man

---
 include/helper_show | 8 ++++----
 lynis.8             | 3 +++
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/include/helper_show b/include/helper_show
index 8f906d99..260518d6 100644
--- a/include/helper_show
+++ b/include/helper_show
@@ -30,7 +30,7 @@
 
 COMMANDS="audit configure generate show update upload-only"
 HELPERS="audit configure show update"
-OPTIONS="--auditor\n--cronjob (--cron)\n--debug\n--developer\n--help (-h)\n--license-key\n--log-file\n--manpage (--man)\n--no-colors\n--no-log\n--pentest\n--profile\n--plugin-dir\n--quick (-Q)\n--quiet (-q)\n--report-file\n--reverse-colors\n--skip-plugins\n--tests\n--tests-from-category\n--tests-from-group\n--upload\n--verbose\n--version (-V)\n--wait\n--warnings-only"
+OPTIONS="--auditor\n--cronjob (--cron)\n--debug\n--developer\n--help (-h)\n--license-key\n--log-file\n--manpage (--man)\n--no-colors\n--no-log\n--pentest\n--profile\n--plugin-dir\n--quick (-Q)\n--quiet (-q)\n--report-file\n--reverse-colors\n--skip-plugins\n--tests\n--tests-from-category\n--tests-from-group\n--usecwd\n--upload\n--verbose\n--version (-V)\n--wait\n--warnings-only"
 
 SHOW_ARGS="categories changelog commands dbdir details environment eol groups help hostids includedir language license logfile man options os pidfile plugindir profiles release releasedate report settings tests version workdir"
 SHOW_HELP="lynis show ${BROWN}categories${NORMAL}              (display test categories)
@@ -113,10 +113,10 @@ UPDATE_HELP="
   ${CYAN}update info${NORMAL}
 
   Check and show version information
-  
+
   ${CYAN}update check${NORMAL}
 
-  Just check if version is up-to-date  
+  Just check if version is up-to-date
 
 "
 
@@ -215,7 +215,7 @@ if [ $# -gt 0 ]; then
                         "generate") ${ECHOCMD} "${GENERATE_HELP}" ;;
                         "show") ${ECHOCMD} "${SHOW_HELP}" ;;
                         "update")  ${ECHOCMD} "${UPDATE_HELP}" ;;
-                        "upload-only") ${ECHOCMD} "${UPLOAD_ONLY_HELP}" ;;                        
+                        "upload-only") ${ECHOCMD} "${UPLOAD_ONLY_HELP}" ;;
                         *) DisplayError "Unknown argument for 'commands'"
                     esac
                 else
diff --git a/lynis.8 b/lynis.8
index b4fba8ff..2a74c2d1 100644
--- a/lynis.8
+++ b/lynis.8
@@ -125,6 +125,9 @@ Tests are only performed if they belong to the defined category. Use the command
 Similar to \-\-tests\-from\-category. Only perform tests from a particular group.
 Use 'show categories' to determine valid options.
 .TP
+.B \-\-usecwd
+Run from the current working directory.
+.TP
 .B \-\-upload
 Upload data to Lynis Enterprise server (profile option: upload=yes).
 .TP

From f118b19228ff9de26b2568dfa231eabf1dd032d8 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 31 Jul 2019 08:02:08 +0200
Subject: [PATCH 267/679] Increased version with addition of --usecwd

---
 lynis.8 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lynis.8 b/lynis.8
index 2a74c2d1..7f58b1cd 100644
--- a/lynis.8
+++ b/lynis.8
@@ -1,4 +1,4 @@
-.TH Lynis 8 "15 Jul 2019" "1.28" "Unix System Administrator's Manual"
+.TH Lynis 8 "31 Jul 2019" "1.29" "Unix System Administrator's Manual"
 
 
 .SH "NAME"

From 4b77e27495c9447e09f348d191b14b4b72694b33 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 31 Jul 2019 08:03:21 +0200
Subject: [PATCH 268/679] Reversed if/then to show correct status of minilogd

---
 include/tests_logging | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/tests_logging b/include/tests_logging
index d6f18fbf..3f563213 100644
--- a/include/tests_logging
+++ b/include/tests_logging
@@ -207,13 +207,13 @@
         LogText "Result: Checking for unkilled minilogd instances"
         # Search for minilogd. It shouldn't be running normally, if another syslog daemon is started
         if IsRunning "minilogd"; then
-            Display --indent 4 --text "- Checking minilogd instances" --result "${STATUS_NOT_FOUND}" --color WHITE
-            LogText "Result: No minilogd is running"
-        else
             Display --indent 4 --text "- Checking minilogd instances" --result "${STATUS_WARNING}" --color RED
             LogText "Result: minilogd found in process list"
             # minilogd daemon seems to be running
             ReportWarning ${TEST_NO} "minilogd is running, which should normally not be running"
+        else
+            Display --indent 4 --text "- Checking minilogd instances" --result "${STATUS_NOT_FOUND}" --color WHITE
+            LogText "Result: No minilogd is running"
         fi
     fi
 #

From 3ea66d429850373affa0854d4509259d56a4e908 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 31 Jul 2019 08:17:15 +0200
Subject: [PATCH 269/679] [LOGG-2154] corrected output of files in
 /etc/rsyslog.d directory

---
 include/tests_logging | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/include/tests_logging b/include/tests_logging
index 3f563213..8e299ad0 100644
--- a/include/tests_logging
+++ b/include/tests_logging
@@ -346,8 +346,7 @@
             DATA=""
             TARGET="${ROOTDIR}etc/rsyslog.conf"
             if [ -f ${TARGET} ]; then
-                LogText "Result: file ${TARGET} exists"
-                LogText "Test: analyzing file for remote target"
+                LogText "Test: analyzing file ${TARGET} for remote target"
                 DATA=$(${EGREPBINARY} "@@?([a-zA-Z0-9\-])+(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?" ${TARGET} | ${GREPBINARY} -v "#" | ${TRBINARY} -cd "[:print:]\n" | ${SEDBINARY} 's/[[:blank:]]\{1,\}/:space:/g')
                 if [ -z "${DATA}" ]; then
                     LogText "Result: no remote target found"
@@ -364,11 +363,10 @@
             fi
             TARGET="${ROOTDIR}etc/rsyslog.d"
             if [ -d ${TARGET} ]; then
-                FILES=$(${FINDBINARY} ${TARGET} -type f -print0 | ${TRBINARY} -cd '[:print:]\0' | ${SEDBINARY} 's/[[:blank:]]/:space:/g' | ${SEDBINARY} 's/\0/\n/g')
-                for F in "${FILES}"; do
+                FILES=$(${FINDBINARY} ${TARGET} -type f -print0 | ${TRBINARY} -cd '[:print:]\0' | ${SEDBINARY} 's/[[:blank:]]/:space:/g' | ${TRBINARY} '\0' ' ')
+                for F in ${FILES}; do
                     F=$(echo ${F} | ${SEDBINARY} 's/:space:/ /g')
-                    LogText "Result: found file ${F}"
-                    LogText "Test: analyzing file for remote target"
+                    LogText "Test: analyzing file ${F} for remote target"
                     DATA=$(${EGREPBINARY} "@@?([a-zA-Z0-9\-])+(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?" ${F} | ${GREPBINARY} -v "#" | ${TRBINARY} -cd "[:print:]\n" | ${SEDBINARY} 's/[[:blank:]]\{1,\}/:space:/g')
                     if [ -z "${DATA}" ]; then
                         LogText "Result: no remote target found"

From 28801e7ad743dd4512aee1d01468503863eabfc1 Mon Sep 17 00:00:00 2001
From: David Marzal <2069735+Marzal@users.noreply.github.com>
Date: Wed, 31 Jul 2019 22:29:26 +0200
Subject: [PATCH 270/679] Clean up of not used legacy functions and not used
 broken functions

---
 include/functions | 196 ----------------------------------------------
 1 file changed, 196 deletions(-)

diff --git a/include/functions b/include/functions
index 4c363faa..b8a2891a 100644
--- a/include/functions
+++ b/include/functions
@@ -102,17 +102,6 @@
 #    ViewGroups                 Display test groups
 #    WaitForKeyPress            Wait for user to press a key to continue
 #
-#################################################################################
-#
-#    Under Development:
-#    ----------------------
-#    TestCase_Equal             Test case for checking if value is equal to something
-#    TestCase_NotEqual          Test case for checking if value is not equal to something
-#    TestCase_GreaterThan       Test case for checking if value is greater than something
-#    TestCase_GreaterOrEqual    Test case for checking if value is greater or equal to something
-#    TestCase_LessThan          Test case for checking if value is less than something
-#    TestCase_LessOrEqual       Test case for checking if value is less or equal to something
-#
 #################################################################################
 
 
@@ -3372,155 +3361,6 @@
     }
 
 
-    ################################################################################
-    # Name        : TestCase_Equal()
-    # Description : Test case for checking if value whether value is equal to value
-    # Returns     : (0 - SUCCESS; 1 - MEDIUM-VALUED; 2 - FAIL)
-    ################################################################################
-
-    TestCase_Equal() {
-        RETVAL=2
-
-        if [ "$#" -lt "2" ]; then
-            ReportException "${TEST_NO}" "Error in function call to ${FUNCNAME}"
-        else
-            LogText "${FUNCNAME}: checking value for application ${APP}"
-            LogText "${FUNCNAME}: ${OPTION} is set to ${1}"
-            LogText "${FUNCNAME}: check if ${1} is equal to ${2}"
-
-            if [ "$1" = "$2" ]; then
-                LogText "${FUNCNAME}: ${1} is equal to ${2}"
-                RETVAL=0
-            fi
-
-            if ! [ -z ${3+x} ]; then
-                LogText "${FUNCNAME}: ${1} is equal to ${3}"
-                if [ "$2" = "$3" ]; then
-                    LogText "${FUNCNAME}: ${OPTION} is equal to ${3}"
-                    RETVAL=1
-                fi
-            fi
-        fi
-        return ${RETVAL}
-    }
-
-    ################################################################################
-    # Name        : TestCase_ValueNotEqual()
-    # Description : Test case for checking if value is not equal to something
-    # Returns     : (0 - SUCCESS;  1 - FAIL)
-    ################################################################################
-    TestCase_NotEqual() {
-        RETVAL=1
-        if [ "$#" -ne "2" ]; then
-            ReportException "${TEST_NO}" "Error in function call to ${FUNCNAME}"
-        else
-            LogText "${FUNCNAME}: checking value for application ${APP}"
-            LogText "${FUNCNAME}: ${OPTION} is set to ${1}"
-
-            if [ "$1" != "$2" ]; then
-                LogText "${FUNCNAME}: ${1} is not equal to ${2}"
-                RETVAL=0
-            else
-                LogText "${FUNCNAME}: ${1} is equal to ${2}"
-            fi
-        fi
-        return ${RETVAL}
-    }
-
-
-    ################################################################################
-    # Name        : TestCase_GreaterThan()
-    # Description : Test case for checking if value is greater than something
-    # Returns     : (0 - SUCCESS;  1 - FAIL)
-    ################################################################################
-    TestCase_GreaterThan() {
-        RETVAL=1
-        if [ "$#" -ne "2" ]; then
-            ReportException "${TEST_NO}" "Error in function call to ${FUNCNAME}"
-        else
-            LogText "${FUNCNAME}: checking value for application ${APP}"
-            LogText "${FUNCNAME}: ${OPTION} is set to ${1}"
-            LogText "${FUNCNAME}: checking if ${1} is greater than ${2}"
-            if [ "$1" > "$2" ]; then
-                LogText "${FUNCNAME}: ${1} is greater than ${2}"
-                RETVAL=0
-            else
-                LogText "${FUNCNAME}: ${1} is not greater than ${2}"
-            fi
-        fi
-        return ${RETVAL}
-    }
-
-
-    ################################################################################
-    # Name        : TestCase_GreaterOrEqual()
-    # Description : Test case for checking if value is greater than something
-    # Returns     : (0 - SUCCESS;  1 - FAIL)
-    ################################################################################
-
-    TestCase_GreaterOrEqual() {
-        RETVAL=1
-        if [ "$#" -ne "2" ]; then
-            ReportException "${TEST_NO}" "Error in function call to ${FUNCNAME}"
-        else
-            LogText "${FUNCNAME}: checking value for application ${APP}"
-            LogText "${FUNCNAME}: ${OPTION} is set to ${1}"
-            LogText "${FUNCNAME}: checking if ${1} is greater or equal ${2}"
-            if [ TestCase_Equal "${1}" "${2}" ] || [ TestCase_GreaterThan "${1}" "${2}" ]; then
-                RETVAL=0
-            fi
-        fi
-        return ${RETVAL}
-    }
-
-
-    ################################################################################
-    # Name        : TestCase_LessThan()
-    # Description : Test case for checking if value is greater than something
-    # Returns     : (0 - SUCCESS;  1 - FAIL)
-    ################################################################################
-
-    TestCase_LessThan() {
-        RETVAL=1
-        if [ "$#" -ne "2" ]; then
-            ReportException "${TEST_NO}" "Error in function call to TestCase_GreaterOrEqual"
-        else
-            LogText "${FUNCNAME}: checking value for application ${APP}"
-            LogText "${FUNCNAME}: ${OPTION} is set to ${1}"
-
-            LogText "${FUNCNAME}: checking if ${1} is less than ${2}"
-            if ! [ TestCase_GreaterOrEqual "${1}" "${2}"  ]; then
-                LogText "${FUNCNAME}:  ${1} is less than ${2}"
-                RETVAL=0
-            fi
-        fi
-        return ${RETVAL}
-    }
-
-
-    ################################################################################
-    # Name        : TestCase_LessOrEqual()
-    # Description : Test case for checking if value is less or equal something
-    # Returns     : (0 - SUCCESS;  1 - FAIL)
-    ################################################################################
-
-    TestCase_LessOrEqual() {
-        RETVAL=1
-        if [ "$#" -ne "2" ]; then
-            ReportException "${TEST_NO}" "Error in function call to ${FUNCNAME}"
-        else
-            LogText "${FUNCNAME}: checking value for application ${APP}"
-            LogText "${FUNCNAME}: ${OPTION} is set to ${1}"
-            LogText "${FUNCNAME}: checking if ${1} is less or equal ${2}"
-            if [ TestCase_Equal "${1}" "${2}" ] || [ TestCase_LessThan "${1}" "${2}" ]; then
-                LogText "${FUNCNAME}:  ${1} is less than ${2}"
-                RETVAL=0
-            fi
-        fi
-        return ${RETVAL}
-    }
-
-
     ################################################################################
     #
     # Legacy functions - Do not use!
@@ -3530,42 +3370,6 @@
     # steps. If they still get used, they will trigger errors on screen.
     ################################################################################
 
-    counttests() {
-        DisplayWarning "Deprecated function used (counttests)"
-        if IsDeveloperMode; then Debug "Warning: old counttests function is used. Please replace any reference with CountTests."; fi
-        CountTests
-    }
-
-    logtext() {
-        DisplayWarning "Deprecated function used (logtext)"
-        if IsDeveloperMode; then Debug "Warning: old logtext function is used. Please replace any reference with LogText."; fi
-        LogText "$1"
-    }
-
-    logtextbreak() {
-        DisplayWarning "Deprecated function used (logtextbreak)"
-        if IsDeveloperMode; then Debug "Warning: old logtextbreak function is used. Please replace any reference with LogTextBreak."; fi
-        LogTextBreak "$1"
-    }
-
-    report() {
-        DisplayWarning "Deprecated function used (report)"
-        if IsDeveloperMode; then Debug "Warning: old report function is used. Please replace any reference with Report."; fi
-        Report "$1"
-    }
-
-    wait_for_keypress() {
-        DisplayWarning "Deprecated function used (wait_for_keypress)"
-        if IsDeveloperMode; then Debug "Warning: old wait_for_keypress function is used. Please replace any reference with WaitForKeyPress."; fi
-        WaitForKeyPress
-    }
-
-    ShowResult() {
-        DisplayWarning "Deprecated function used (ShowResult)"
-        if IsDeveloperMode; then Debug "Warning: old ShowResult() function is used. Please replace any reference with WaitForKeyPress."; fi
-    }
-
-
 
 #================================================================================
 # Lynis is part of Lynis Enterprise and released under GPLv3 license

From da055ae0aa8b0dede7f8cf1aba5fa6280580a1a3 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 1 Aug 2019 14:59:03 +0200
Subject: [PATCH 271/679] More standardization of text and adding deprecated
 functions for transition period

---
 include/functions | 188 ++++++++++++++++++++++++++++++++--------------
 1 file changed, 133 insertions(+), 55 deletions(-)

diff --git a/include/functions b/include/functions
index b8a2891a..00c0b30d 100644
--- a/include/functions
+++ b/include/functions
@@ -213,7 +213,7 @@
     #
     # Parameters  : $1 = key
     #               $2 = value
-    # Returns     : True (0) or False (1)
+    # Returns     : exit code (0 = True, 1 = False)
     # Usage       : if CheckItem "key" "value"; then ....; fi
     ################################################################################
 
@@ -282,6 +282,8 @@
     # Name        : CleanUp()
     # Description : Delete PID and temporary files, stop execution (exit code 1)
     #
+    # Parameters  : <none>
+    # Returns     : <nothing>
     # Usage       : this function is triggered by a manual break by user
     ################################################################################
 
@@ -298,7 +300,7 @@
     # Name        : ContainsString()
     # Description : Search a specific string (or regular expression) in another
     #
-    # Returns     : True (0) or False (1)
+    # Returns     : exit code (0 = True, 1 = False)
     # Usage       : if ContainsString "needle" "there is a needle in the haystack"; echo "Found"; else "Not found"; fi
     ################################################################################
 
@@ -315,6 +317,8 @@
     # Name        : CountTests()
     # Description : Counter for the number of tests performed
     #
+    # Parameters  : <none>
+    # Returns     : <nothing>
     # Usage       : Call CountTests to increase number by 1
     ################################################################################
 
@@ -358,7 +362,7 @@
     # Name        : DirectoryExists()
     # Description : Check if a directory exists
     #
-    # Returns     : True (0) or False (1)
+    # Returns     : exit code (0 = True, 1 = False)
     # Usage       : if DirectoryExists; then echo "it exists"; else echo "It does not exist"; fi
     ################################################################################
 
@@ -383,7 +387,7 @@
     # Description : Show additional information on screen
     #
     # Input       : $1 = text
-    # Returns     : Nothing
+    # Returns     : <nothing>
     # Usage       : Debug "More details"
     ################################################################################
 
@@ -413,7 +417,7 @@
     # Name        : DiscoverProfiles()
     # Description : Determine which profiles we have available
     #
-    # Returns     : Nothing
+    # Returns     : <nothing>
     # Usage       : DiscoverProfiles
     ################################################################################
 
@@ -612,7 +616,7 @@
     # Name        : DisplayWarning
     # Description : Show a warning on the screen
     #
-    # Input       : $1 = text
+    # Parameters  : $1 = text
     # Returns     : <nothing>
     ################################################################################
 
@@ -629,9 +633,11 @@
 
     ################################################################################
     # Name        : Equals()
-    # Description : Compare two strings
+    # Description : Compare two strings after special characters were stripped
     #
-    # Returns     : (0 - True, 1 - False)
+    # Parameters  : $1 = string1
+    #               $2 = string2
+    # Returns     : exit code (0 = True, 1 = False)
     # Usage       : if Equals "${MYDIR}" "/etc"; then echo "Found"; else "Not found"; fi
     ################################################################################
 
@@ -652,7 +658,7 @@
     # Name        : ExitClean()
     # Description : Perform a normal exit of the program, and clean up resources
     #
-    # Input       : <nothing>
+    # Parameters  : <nothing>
     # Returns     : <nothing>
     # Usage       : ExitClean
     ################################################################################
@@ -669,8 +675,8 @@
     # Name        : ExitCustom()
     # Description : Perform a normal exit of the program, and clean up resources
     #
-    # Input       : $1 = exit code (optional)
-    # Returns     : Nothing
+    # Parameters  : $1 = exit code (optional)
+    # Returns     : <nothing>
     # Usage       : ExitCustom 35
     ################################################################################
 
@@ -692,7 +698,7 @@
     # Name        : ExitFatal()
     # Description : Perform exit of the program (with code 1), clean up resources
     #
-    # Input       : $1 = text string (optional)
+    # Parameters  : $1 = text string (optional)
     # Returns     : <nothing>
     # Usage       : ExitFatal
     ################################################################################
@@ -713,6 +719,8 @@
     ################################################################################
     # Name        : FileExists()
     # Description : Determine if a file exists
+    #
+    # Parameters  : $1 = path
     # Returns     : 0 (found), 1 (not found)
     #               FILE_FOUND (0:found, 1:not found) - deprecated usage
     ################################################################################
@@ -1177,7 +1185,8 @@
     # Name        : GetReportData()
     # Description : Request data from report
     # Returns     : Data (when matches were found)
-    #               Exit code: True (0) or False (1) when search was cancelled
+    # Returns     : exit code (0 = True, 1 = False, meaning search was cancelled)
+    #               stdout (output of search result)
     ################################################################################
 
     GetReportData() {
@@ -1207,7 +1216,6 @@
             return 1
         else
             ${AWKBINARY} -v pattern="^${KEY}" -F= '$1 ~ pattern {print $2}' ${REPORTFILE} | ${TRBINARY} -cd "${VALID_CHARS}" | ${TRBINARY} '[:blank:]' '__space__'
-
         fi
         return 0
     }
@@ -1217,7 +1225,7 @@
     # Name        : HasData()
     # Description : Check for a filled variable
     #
-    # Returns     : 0 = True, 1 = False
+    # Returns     : exit code (0 = True, 1 = False)
     # Usage       : if HasData "${FIND}"; then
     ################################################################################
 
@@ -1234,7 +1242,7 @@
     # Name        : InsertSection()
     # Description : Show a section block on screen
     #
-    # Returns     : Nothing
+    # Returns     : <nothing>
     # Usage       : InsertSection
     ################################################################################
 
@@ -1253,7 +1261,7 @@
     # Name        : InsertPlugionSection()
     # Description : Insert section block for plugins (different color)
     #
-    # Returns     : Nothing
+    # Returns     : <nothing>
     # Usage       : InsertPluginSection
     ################################################################################
 
@@ -1270,8 +1278,10 @@
     ################################################################################
     # Name        : IsContainer()
     # Description : Determine if we are running in a container
-    # Returns     : Exit code (0 = true, 1 = false)
-    #               CONTAINER_TYPE
+    #
+    # Parameters  : <none>
+    # Returns     : exit code (0 = true, 1 = false)
+    #               variable: CONTAINER_TYPE
     ################################################################################
 
     IsContainer() {
@@ -1304,7 +1314,9 @@
     ################################################################################
     # Name        : IsDebug()
     # Description : Check if --debug option is used to show more details
-    # Returns     : 0 (True) or 1 (False)
+    #
+    # Parameters  : <none>
+    # Returns     : exit code (0 = True, 1 = False)
     ################################################################################
 
     IsDebug() {
@@ -1316,7 +1328,8 @@
     # Name        : IsDeveloperMode()
     # Description : Check if we are in development mode (--developer)
     #
-    # Returns     : 0 (True) or 1 (False)
+    # Parameters  : <none>
+    # Returns     : exit code (0 = True, 1 = False)
     # Notes       : This is set with command line option or as a profile setting
     ################################################################################
 
@@ -1329,7 +1342,8 @@
     # Name        : IsDeveloperVersion()
     # Description : Check if this version is development or stable release
     #
-    # Returns     : 0 (True) or 1 (False)
+    # Parameters  : <none>
+    # Returns     : exit code (0 = True, 1 = False)
     ################################################################################
 
     IsDeveloperVersion() {
@@ -1341,7 +1355,7 @@
     # Name        : IsEmpty()
     # Description : Check for variable that has no data in it
     #
-    # Returns     : 0 = True, 1 = False
+    # Returns     : exit code (0 = True, 1 = False)
     # Usage       : if IsEmpty "${FIND}"; then
     ################################################################################
 
@@ -1465,7 +1479,7 @@
     ################################################################################
     # Name        : IsNotebook
     # Description : Check if file or directory is owned by root
-    # Returns     : 0 (true), 1 (false), or 255 (unknown)
+    # Returns     : exit code (0 = True, 1 = False, 255 = Unknown)
     ################################################################################
 
     IsNotebook() {
@@ -1521,7 +1535,9 @@
     ################################################################################
     # Name        : IsVerbose()
     # Description : Check if --verbose option is used to show more details on screen
-    # Returns     : 0 (true) or 1 (false)
+    #
+    # Parameters  : <none>
+    # Returns     : exit code (0 =true, 1 =false)
     ################################################################################
 
     IsVerbose() {
@@ -1532,9 +1548,11 @@
     ################################################################################
     # Name        : IsVirtualMachine()
     # Description : Determine whether it is a virtual machine
-    # Returns     : ISVIRTUALMACHINE (0-2)
-    #               VMTYPE
-    #               VMFULLTYPE
+    # Parameters  : <none>
+    # Returns     : exit code (0 = True, 1 = False, 2 = Unknown)
+    #               variable: ISVIRTUALMACHINE (0-2)
+    #               variable: VMTYPE
+    #               variable: VMFULLTYPE
     ################################################################################
 
     IsVirtualMachine() {
@@ -1750,7 +1768,7 @@
     # Name        : IsWorldReadable()
     # Description : Determines if a file is readable for all users (world)
     #
-    # Input       : path (string)
+    # Input       : $1 = path (string)
     # Returns     : exit code (0 = readable, 1 = not readable, 255 = error)
     # Usage       : if IsWorldReadable /etc/motd; then echo "File is readable"; fi
     ################################################################################
@@ -1776,7 +1794,7 @@
     # Name        : IsWorldExecutable()
     # Description : Determines if a file is executable for all users (world)
     #
-    # Input       : path (string)
+    # Input       : $1 = path (string)
     # Returns     : exit code (0 = executable, 1 = not executable, 255 = error)
     # Usage       : if IsWorldExecutable /bin/ps; then echo "File is executable"; fi
     ################################################################################
@@ -1803,7 +1821,7 @@
     # Name        : IsWorldWritable()
     # Description : Determines if a file is writable for all users
     #
-    # Input       : path
+    # Parameters  : $1 = path
     # Returns     : exit code (0 = writable, 1 = not writable, 255 = error)
     # Usage       : if IsWorldWritable /etc/motd; then echo "File is writable"; fi
     ################################################################################
@@ -1828,8 +1846,8 @@
     # Name        : LogText()
     # Description : Function logtext (redirect data ($1) to log file)
     #
-    # Input       : $1 = text (string)
-    # Returns     : Nothing
+    # Parameters  : $1 = text (string)
+    # Returns     : <nothing>
     # Usage       : LogText "This line goes into the log file"
     ################################################################################
 
@@ -1898,6 +1916,7 @@
     ################################################################################
     # Name        : ParseProfiles()
     # Description : Check file permissions and parse data from profiles
+    # Parameters  : <none>
     # Returns     : <nothing>
     ################################################################################
 
@@ -1910,8 +1929,9 @@
     ################################################################################
     # Name        : ParseTestValues()
     # Description : Parse values from a specific test
-    # Inputs      : service (e.g. ssh)
-    # Returns     : CHECK_VALUES_ARRAY
+    #
+    # Parameters  : $1 = service (e.g. ssh)
+    # Returns     : CHECK_VALUES_ARRAY variable
     ################################################################################
 
     ParseTestValues() {
@@ -1965,7 +1985,8 @@
     ################################################################################
     # Name        : ParseNginx()
     # Description : Parse nginx configuration lines
-    # Input       : $1 = file (should be readable and tested upfront)
+    #
+    # Parameters  : $1 = file (should be readable and tested upfront)
     # Returns     : <nothing>
     ################################################################################
 
@@ -2179,12 +2200,15 @@
     ################################################################################
     # Name        : PortIsListening()
     # Description : Check if machine is listening on specified protocol and port
-    # Returns     : exit code 0 (listening) or 1 (not listening)
+    #
+    # Parameters  : $1 = protocol
+    #               $2 = port
+    # Returns     : exit code (0 = listening, 1 = not listening, 255 = can't perform test)
     # Usage       : if PortIsListening "TCP" 22; then echo "Port is listening"; fi
     ################################################################################
 
     PortIsListening() {
-        if [ "${LSOFBINARY}" = "" ]; then
+        if [ -z "${LSOFBINARY}" ]; then
             return 255
         else
             if [ $# -eq 2 ] && [ $1 = "TCP" -o $1 = "UDP" ]; then
@@ -2209,7 +2233,7 @@
     # Name        : Progress()
     # Description : Displays progress on screen with dots
     #
-    # Input       : --finish or text (string)
+    # Parameters  : $1 = --finish or text (string)
     # Returns     : <nothing>
     # Tip         : Use this function from Register with the --progress parameter
     ################################################################################
@@ -2235,8 +2259,9 @@
     ################################################################################
     # Name        : RandomString()
     # Description : Displays progress on screen with dots
-    # Input       : Amount of characters (optional)
-    # Returns     : RANDOMSTRING
+    #
+    # Parameters  : $1 = number (amount of characters, optional)
+    # Returns     : RANDOMSTRING variable
     # Usage       : RandomString 32
     ################################################################################
 
@@ -2256,7 +2281,9 @@
     ################################################################################
     # Name        : Readonly()
     # Description : Mark a variable as read-only data
-    # Returns     : nothing
+    #
+    # Returns     : <nothing>
+    # Notes       : new function, not in use yet
     ################################################################################
 
     Readonly() {
@@ -2275,6 +2302,8 @@
     ################################################################################
     # Name        : Register()
     # Description : Register a test and see if it has to be run
+    #
+    # Parameters  : multiple, see test
     # Returns     : SKIPTEST (0 or 1)
     ################################################################################
 
@@ -2468,7 +2497,9 @@
 
     ################################################################################
     # Name        : RemoveColors()
-    #    RemoveColors    Clear color settings for --no-colors (see include/consts)
+    # Description : Disabled colors by overriding them (defined in include/consts)
+    #
+    # Notes       : Can be activated using --no-colors
     ################################################################################
 
     RemoveColors() {
@@ -2506,6 +2537,9 @@
     ################################################################################
     # Name        : RemovePIDFile()
     # Description : When defined, remove the file storing the process ID
+    #
+    # Parameters  : <none>
+    # Returns     : <nothing>
     ################################################################################
 
     # Remove PID file
@@ -2555,6 +2589,9 @@
     ################################################################################
     # Name        : Report()
     # Description : Store data in the report file
+    #
+    # Parameters  : $1 = data (format: key=value)
+    # Returns     : <nothing>
     ################################################################################
 
     Report() {
@@ -2568,7 +2605,7 @@
     #               smaller atomic tests are performed. For example sysctl keys,
     #               and SSH settings.
     #
-    # Input       : <multiple fields, see test>
+    # Parameters  : <multiple fields, see test>
     # Returns     : <nothing>
     # Notes       : Need to check for values (strip out semicolons from values)
     #               Only add fields which are filled in
@@ -2633,11 +2670,10 @@
     #
     # Parameters  : $1 = test ID + colon + 2 numeric characters (TEST-1234:01)
     #               $2 = string (text)
+    # Notes       : Allow this function with only 1 parameter in strict mode with ${2-Text}
     ################################################################################
 
-    # Log exceptions
     ReportException() {
-        # Allow this function with only 1 parameter in strict mode with ${2-Text}
         Report "exception_event[]=$1|${2-NoInfo}|"
         LogText "Exception: test has an exceptional event ($1) with text ${2-NoText}"
     }
@@ -2668,6 +2704,7 @@
     #                    * url:https://example.org/how-to-solve-link
     #                    * text:Additional explanation
     #                    * - (dash) for none
+    # Returns     : <nothing>
     ################################################################################
 
     ReportSuggestion() {
@@ -2686,17 +2723,19 @@
     ################################################################################
     # Name        : ReportWarning()
     # Description : Log a warning to the report file
+    #
+    # Parameters  : $1 = test ID
+    #               $2 = message (optional)
+    #               $3 = details (optional)
+    #               $4 = possible solution (optional)
+    # Returns     : <nothing>
     ################################################################################
 
     ReportWarning() {
         TOTAL_WARNINGS=$((TOTAL_WARNINGS + 1))
-        # Old style
-        # <ID> <priority/impact> <warning text>
+        # Old style used L/M/H level as second parameter. This is deprecated as of 3.x
         if [ "$2" = "L" -o "$2" = "M" -o "$2" = "H" ]; then
-            if [ $# -ge 1 ]; then TEST="$1"; fi
-            if [ $# -ge 2 ]; then DETAILS="$2"; fi
-            if [ $# -ge 3 ]; then MESSAGE="$3"; fi
-            SOLUTION="-"
+            ExitFatal "Deprecated usage of ReportWarning() function"
         else
             # New style warning format:
             # <ID> <Warning> <Details> <Solution>
@@ -2725,7 +2764,7 @@
     # Description : Test provided string to see if it contains unwanted characters
     #
     # Input       : string + optional class (parameter 2)
-    # Returns     : 0 (input considered to be safe) or 1 (validation failed)
+    # Returns     : exit code (0 = input considered to be safe, 1 = validation failed)
     ################################################################################
 
     SafeInput() {
@@ -2754,6 +2793,8 @@
     # Name        : SafeFile()
     # Description : Check if a file is safe to use
     #
+    # Parameters  : $1 = file name
+    # Returns     : exit code (0 = OK, 1 = issue)
     ################################################################################
 
     SafeFile() {
@@ -2805,6 +2846,8 @@
     # Name        : SafePerms()
     # Description : Check if a file has safe permissions to be used
     #
+    # Parameters  : $1 = file name
+    #               $2 = type of file (optional)
     # Returns     : 0 (file permissions OK) or break
     ################################################################################
 
@@ -2962,7 +3005,7 @@
     # Name        : ShowComplianceFinding()
     # Description : Display a section of a compliance standard which is not fulfilled
     #
-    # Input       : <several parameters, see test>
+    # Parameters  : <several parameters, see test>
     # Returns     : <nothing>
     ################################################################################
 
@@ -3048,7 +3091,7 @@
     # Name        : ShowSymlinkPath()
     # Description : Check if we can find the path behind a symlink
     #
-    # Input       : $1 = file (string)
+    # Parameters  : $1 = file (string)
     # Returns     : FOUNDPATH (0 not found, 1 found path), SYMLINK (new path)
     ################################################################################
 
@@ -3370,6 +3413,41 @@
     # steps. If they still get used, they will trigger errors on screen.
     ################################################################################
 
+    counttests() {
+        DisplayWarning "Deprecated function used (counttests)"
+        if IsDeveloperMode; then Debug "Warning: old counttests function is used. Please replace any reference with CountTests."; fi
+        CountTests
+    }
+
+     logtext() {
+        DisplayWarning "Deprecated function used (logtext)"
+        if IsDeveloperMode; then Debug "Warning: old logtext function is used. Please replace any reference with LogText."; fi
+        LogText "$1"
+    }
+
+     logtextbreak() {
+        DisplayWarning "Deprecated function used (logtextbreak)"
+        if IsDeveloperMode; then Debug "Warning: old logtextbreak function is used. Please replace any reference with LogTextBreak."; fi
+        LogTextBreak "$1"
+    }
+
+     report() {
+        DisplayWarning "Deprecated function used (report)"
+        if IsDeveloperMode; then Debug "Warning: old report function is used. Please replace any reference with Report."; fi
+        Report "$1"
+    }
+
+     wait_for_keypress() {
+        DisplayWarning "Deprecated function used (wait_for_keypress)"
+        if IsDeveloperMode; then Debug "Warning: old wait_for_keypress function is used. Please replace any reference with WaitForKeyPress."; fi
+        WaitForKeyPress
+    }
+
+     ShowResult() {
+        DisplayWarning "Deprecated function used (ShowResult)"
+        if IsDeveloperMode; then Debug "Warning: old ShowResult() function is used. Please replace any reference with WaitForKeyPress."; fi
+    }
+
 
 #================================================================================
 # Lynis is part of Lynis Enterprise and released under GPLv3 license

From f2b385fbf7017d56759040ae6451e4f829ac1c74 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 4 Aug 2019 19:18:16 +0200
Subject: [PATCH 272/679] Initial support for Clear Linux OS

---
 include/osdetection | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/include/osdetection b/include/osdetection
index 95f2e014..20e50b26 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -146,6 +146,11 @@
                             OS_FULLNAME="Arch Linux"
                             OS_VERSION="Rolling release"
                         ;;
+                        "clear-linux-os")
+                            LINUX_VERSION="Clear Linux OS"
+                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION="Rolling release"
+                        ;;
                         "coreos")
                             LINUX_VERSION="CoreOS"
                             OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')

From d3355937a4a3c73ce62c04e0ea6849e4ab02358e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 4 Aug 2019 19:19:12 +0200
Subject: [PATCH 273/679] Don't quote in for loop to prevent glueing individual
 lines together

---
 include/tests_networking | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/tests_networking b/include/tests_networking
index aa167873..53f74ec8 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -436,14 +436,14 @@
         esac
 
         if [ -n "${DATA}" ]; then
-            for ITEM in "${DATA}"; do
+            for ITEM in ${DATA}; do
                 COUNT=$((COUNT + 1))
                 Report "network_listen[]=${ITEM}"
             done
         fi
 
         if [ -n "${FIND}" ]; then
-            for ITEM in "${FIND}"; do
+            for ITEM in ${FIND}; do
                 COUNT=$((COUNT + 1))
                 LogText "Found listening info: ${ITEM}"
                 Report "network_listen_port[]=${ITEM}"
@@ -451,7 +451,7 @@
         fi
 
         if [ -n "${FIND2}" ]; then
-            for ITEM in "${FIND2}"; do
+            for ITEM in ${FIND2}; do
                 COUNT=$((COUNT + 1))
                 LogText "Found listening info: ${ITEM}"
                 Report "network_listen_port[]=${ITEM}"

From 06f015fbae8f85e14629bac4f7a500cecd36919f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 4 Aug 2019 19:19:22 +0200
Subject: [PATCH 274/679] Updated log

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5dc4d214..d8ce67fd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -37,6 +37,7 @@ measures to further tighten any possible misuse.
 - New report key: openssh_daemon_running
 - New command: lynis generate systemd-units
 - Measure timing of tests and report slow tests (10+ seconds)
+- Initial support for Clear Linux OS
 
 ### Changed
 - Function: CheckItem() now returns only exit code (ITEM_FOUND is dropped)
@@ -57,6 +58,8 @@ measures to further tighten any possible misuse.
 - INSE-8342 - renamed to INSE-8304
 - KRNL-5820 - extended check to include limits.d directory
 - LOGG-2154 - added support for rsyslog configurations
+- NAME-4402 - check if /etc/hosts exists before performing test
+- NAME-4404 - improved screen and log output
 - NAME-4408 - corrected Report function call
 - NETW-3032 - small rewrite of test and extended with addrwatch
 - PROC-3602 - allow different root directory

From 04d2cb838be35cf744e74c6729f6c287000f114f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 4 Aug 2019 19:20:16 +0200
Subject: [PATCH 275/679] Test for presence of /etc/hosts (e.g. Clear Linux
 OS), changed screen and log output

---
 include/tests_nameservices | 68 ++++++++++++++++++++------------------
 1 file changed, 35 insertions(+), 33 deletions(-)

diff --git a/include/tests_nameservices b/include/tests_nameservices
index fc07eeb8..bae149d4 100644
--- a/include/tests_nameservices
+++ b/include/tests_nameservices
@@ -559,27 +559,27 @@
 #
 #################################################################################
 #
-    if [ -f ${ROOTDIR}etc/hosts ]; then Display --indent 2 --text "- Checking ${ROOTDIR}etc/hosts"; fi
+    if [ -f ${ROOTDIR}etc/hosts ]; then
+        Display --indent 2 --text "- Checking /etc/hosts"
+    else
+        LogText "Result: no /etc/hosts file found"
+    fi
 
     # Test        : NAME-4402
     # Description : Check /etc/hosts configuration
-    Register --test-no NAME-4402 --weight L --network NO --category security --description "Check duplicate line in /etc/hosts"
+    if [ -f ${ROOTDIR}etc/hosts ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no NAME-4402 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check duplicate line in /etc/hosts"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: check duplicate line in ${ROOTDIR}etc/hosts"
-        if [ -f ${ROOTDIR}etc/hosts ]; then
-            OUTPUT=$(${AWKBINARY} '{ print $1, $2 }' ${ROOTDIR}etc/hosts | ${EGREPBINARY} -v '^(#|$)' | ${EGREPBINARY} "[a-f0-9]" | ${SORTBINARY} | ${UNIQBINARY} -d)
-            if [ -z "${OUTPUT}" ]; then
-                LogText "Result: OK, no duplicate lines found"
-                Display --indent 4 --text "- Checking ${ROOTDIR}etc/hosts (duplicates)" --result "${STATUS_OK}" --color GREEN
-            else
-                LogText "Found duplicate line: ${OUTPUT}"
-                LogText "Result: found duplicate line"
-                Display --indent 4 --text "- Checking ${ROOTDIR}etc/hosts (duplicates)" --result "${STATUS_SUGGESTION}" --color YELLOW
-                ReportSuggestion "${TEST_NO}" "Remove duplicate lines in ${ROOTDIR}etc/hosts"
-            fi
+        OUTPUT=$(${AWKBINARY} '{ print $1, $2 }' ${ROOTDIR}etc/hosts | ${EGREPBINARY} -v '^(#|$)' | ${EGREPBINARY} "[a-f0-9]" | ${SORTBINARY} | ${UNIQBINARY} -d)
+        if [ -z "${OUTPUT}" ]; then
+            LogText "Result: OK, no duplicate lines found"
+            Display --indent 4 --text "- Duplicate entries in hosts file" --result "${STATUS_NONE}" --color GREEN
         else
-            LogText "Result: ${ROOTDIR}etc/hosts not found, test skipped"
-            Display --indent 4 --text "Searching duplicate line" --result "${STATUS_SKIPPED}" --color YELLOW
+            LogText "Found duplicate line: ${OUTPUT}"
+            LogText "Result: found duplicate line"
+            Display --indent 4 --text "- Duplicate entries in hosts file" --result "$STATUS_FOUND}" --color YELLOW
+            ReportSuggestion "${TEST_NO}" "Remove duplicate lines in ${ROOTDIR}etc/hosts"
         fi
     fi
 #
@@ -587,21 +587,23 @@
 #
     # Test        : NAME-4404
     # Description : Check /etc/hosts contains an entry for this server name
-    if [ ! "${HOSTNAME}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -f ${ROOTDIR}etc/hosts ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no NAME-4404 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check /etc/hosts contains an entry for this server name"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Check /etc/hosts contains an entry for this server name"
-        if [ -f /etc/hosts ]; then
-            sFIND=$(${EGREPBINARY} -v '^(#|$|^::1\s|localhost)' /etc/hosts | ${GREPBINARY} -i ${HOSTNAME})
-            if [ "${sFIND}" != "" ]; then
-                LogText "Result: Found entry for ${HOSTNAME} in /etc/hosts"
-                Display --indent 4 --text "- Checking /etc/hosts (hostname)" --result "${STATUS_OK}" --color GREEN
+        if [ -n "${HOSTNAME}" ]; then
+            DATA=$(${EGREPBINARY} -v '^(#|$|^::1\s|localhost)' ${ROOTDIR}etc/hosts | ${GREPBINARY} -i ${HOSTNAME})
+            if [ -n "${DATA}" ]; then
+                LogText "Result: Found entry for ${HOSTNAME} in ${ROOTDIR}etc/hosts"
+                Display --indent 4 --text "- Presence of configured hostname in /etc/hosts" --result "${STATUS_FOUND}" --color GREEN
             else
-                LogText "Result: No entry found for ${HOSTNAME} in /etc/hosts"
-                Display --indent 4 --text "- Checking /etc/hosts (hostname)" --result "${STATUS_SUGGESTION}" --color YELLOW
+                LogText "Result: No entry found for ${HOSTNAME} in ${ROOTDIR}etc/hosts"
+                Display --indent 4 --text "- Presence of configured hostname in /etc/hosts" --result "${STATUS_NOT_FOUND}" --color YELLOW
                 ReportSuggestion ${TEST_NO} "Add the IP name and FQDN to /etc/hosts for proper name resolving"
                 LogText "Risk: No entry for the server name [hostname] in /etc/hosts may cause unexpected performance problems for local connections"
             fi
+         else
+            LogText "Result: Skipping test, no hostname configured"
          fi
      fi
 #
@@ -609,20 +611,20 @@
 #
     # Test        : NAME-4406
     # Description : Check server hostname mapping
-    if HasData "${HOSTNAME}"; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${HOSTNAME}" -a -f ${ROOTDIR}etc/hosts ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no NAME-4406 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check server hostname mapping"
     if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: Check server hostname not locally mapped in /etc/hosts"
-        sFIND=$(${EGREPBINARY} -v '^(#|$)' /etc/hosts | ${EGREPBINARY} '^(localhost|::1)\s' | ${GREPBINARY} -w ${HOSTNAME})
-        if [ ! "${sFIND}" = "" ]; then
+        LogText "Test: Check server hostname not locally mapped in ${ROOTDIR}etc/hosts"
+        DATA=$(${EGREPBINARY} -v '^(#|$)' ${ROOTDIR}etc/hosts | ${EGREPBINARY} '^(localhost|::1)\s' | ${GREPBINARY} -w ${HOSTNAME})
+        if [ -n "${DATA}" ]; then
             LogText "Result: Found this server hostname mapped to a local address"
             LogText "Output: ${sFIND}"
-            Display --indent 4 --text "- Checking /etc/hosts (localhost)" --result "${STATUS_SUGGESTION}" --color YELLOW
+            Display --indent 4 --text "- Hostname mapped to localhost" --result "${STATUS_FOUND}" --color YELLOW
             LogText "Information: Linking the hostname to the localhost entry may break some resolving. Split resolving so that localhost resolves back to 127.0.0.1 (and ::1) and the hostname of the machine to the real IP address on the network interface."
             ReportSuggestion ${TEST_NO} "Split resolving between localhost and the hostname of the system"
         else
             LogText "Result: this server hostname is not mapped to a local address"
-            Display --indent 4 --text "- Checking /etc/hosts (localhost)" --result "${STATUS_OK}" --color GREEN
+            Display --indent 4 --text "- Hostname mapped to localhost" --result "${STATUS_NOT_FOUND}" --color GREEN
         fi
     fi
 #
@@ -637,20 +639,20 @@
         FIND=$(${GETENT_BINARY} hosts localhost | ${AWKBINARY} '{print $1}' | ${SORTBINARY} | ${TRBINARY} -d '\n')
         if [ "${FIND}" = "127.0.0.1" ]; then
             LogText "Result: localhost mapped to 127.0.0.1"
-            Display --indent 4 --text "- Checking /etc/hosts (localhost to IP)" --result "${STATUS_OK}" --color GREEN
+            Display --indent 4 --text "- Localhost mapping to IP address" --result "${STATUS_OK}" --color GREEN
             Report "localhost-mapped-to=${FIND}"
         elif [ "${FIND}" = "::1" ]; then
             LogText "Result: localhost mapped to ::1"
-            Display --indent 4 --text "- Checking /etc/hosts (localhost to IP)" --result "${STATUS_OK}" --color GREEN
+            Display --indent 4 --text "- Localhost mapping to IP address" --result "${STATUS_OK}" --color GREEN
             Report "localhost-mapped-to=${FIND}"
         elif [ "${FIND}" = "127.0.0.1::1" ]; then
             LogText "Result: localhost mapped to 127.0.0.1 and ::1"
-            Display --indent 4 --text "- Checking /etc/hosts (localhost to IP)" --result "${STATUS_OK}" --color GREEN
+            Display --indent 4 --text "- Localhost mapping to IP address" --result "${STATUS_OK}" --color GREEN
             Report "localhost-mapped-to=${FIND}"
         else
             LogText "Output: ${FIND}"
             LogText "Result: this server hostname is not mapped to a local address"
-            Display --indent 4 --text "- Checking /etc/hosts (localhost to IP)" --result "${STATUS_SUGGESTION}" --color YELLOW
+            Display --indent 4 --text "- Localhost mapping to IP address" --result "${STATUS_SUGGESTION}" --color YELLOW
             LogText "Information: Ensure that localhost resolves back to 127.0.0.1 (and/or ::1)."
             ReportSuggestion ${TEST_NO} "Split resolving between localhost and the hostname of the system" "/etc/hosts" "text:Check your localhost line"
         fi

From 48ba463376971ebc44822a7a5cc96a9c31c0c996 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 4 Aug 2019 19:37:55 +0200
Subject: [PATCH 276/679] Added support for swupd (Clear Linux OS)

---
 include/binaries  | 1 +
 include/consts    | 1 +
 include/functions | 3 +++
 3 files changed, 5 insertions(+)

diff --git a/include/binaries b/include/binaries
index 5812003f..4c67eb75 100644
--- a/include/binaries
+++ b/include/binaries
@@ -250,6 +250,7 @@
                             sha256|sha256sum)       SHA256SUMBINARY="${BINARY}";       LogText "  Found known binary: sha256/sha256sum (crypto hashing) - ${BINARY}" ;;
                             ssh-keyscan)            SSHKEYSCANBINARY="${BINARY}";      LogText "  Found known binary: ssh-keyscan (scanner for SSH keys) - ${BINARY}" ;;
                             suricata)               SURICATABINARY="${BINARY}";        LogText "  Found known binary: suricata (IDS) - ${BINARY}" ;;
+                            swupd)                  SWUPDBINARY="${BINARY}";           LogText "  Found known binary: swupd (package manager) - ${BINARY}" ;;
                             sysctl)                 SYSCTLBINARY="${BINARY}";          LogText "  Found known binary: sysctl (kernel parameters) - ${BINARY}" ;;
                             syslog-ng)              SYSLOGNGBINARY="${BINARY}";        SYSLOGNGVERSION=$(${BINARY} -V 2>&1 | grep "^syslog-ng" | awk '{ print $2 }'); LogText "Found ${BINARY} (version ${SYSLOGNGVERSION})" ;;
                             systemctl)              SYSTEMCTLBINARY="${BINARY}";       LogText "  Found known binary: systemctl (client to systemd) - ${BINARY}" ;;
diff --git a/include/consts b/include/consts
index ae7df4ee..8e98a833 100644
--- a/include/consts
+++ b/include/consts
@@ -276,6 +276,7 @@ unset LANG
     SSL_CERTIFICATE_PATHS=""
     SSL_CERTIFICATE_PATHS_TO_IGNORE=""
     STUNNELBINARY=""
+    SWUPDBINARY=""
     SYSLOGNGBINARY=""
     SYSTEMCTLBINARY=""
     SYSTEM_IS_NOTEBOOK=255
diff --git a/include/functions b/include/functions
index 00c0b30d..74dc33fb 100644
--- a/include/functions
+++ b/include/functions
@@ -1902,6 +1902,9 @@
         elif [ -n "${RPMBINARY}" ]; then
             output=$(${RPMBINARY} --quiet -q ${package} > /dev/null 2>&1)
             exit_code=$?
+        elif [ -n "${SWUPDBINARY}" ]; then
+            output=$(${SWUPDBINARY bundle-list > /dev/null 2>&1 | ${GREPBINARY} "^${package}$")
+            exit_code=$?
         elif [ -n "${ZYPPERBINARY}" ]; then
             output=$(${ZYPPERBINARY} --quiet --non-interactive search --installed -i ${PACKAGE} 2> /dev/null | grep "^i")
             if [ -n "${output}" ]; then exit_code=0; else exit_code=1; fi

From f76cf7065101ac7c16731dbe01d0dd064dd6f5ea Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 4 Aug 2019 19:40:02 +0200
Subject: [PATCH 277/679] Missing }

---
 include/functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/functions b/include/functions
index 74dc33fb..25302432 100644
--- a/include/functions
+++ b/include/functions
@@ -1903,7 +1903,7 @@
             output=$(${RPMBINARY} --quiet -q ${package} > /dev/null 2>&1)
             exit_code=$?
         elif [ -n "${SWUPDBINARY}" ]; then
-            output=$(${SWUPDBINARY bundle-list > /dev/null 2>&1 | ${GREPBINARY} "^${package}$")
+            output=$(${SWUPDBINARY} bundle-list > /dev/null 2>&1 | ${GREPBINARY} "^${package}$")
             exit_code=$?
         elif [ -n "${ZYPPERBINARY}" ]; then
             output=$(${ZYPPERBINARY} --quiet --non-interactive search --installed -i ${PACKAGE} 2> /dev/null | grep "^i")

From c86e24fced57e0e11916e318fc015f70d18ba84f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 8 Aug 2019 12:10:30 +0200
Subject: [PATCH 278/679] Added missing $

---
 include/data_upload | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/data_upload b/include/data_upload
index 7698d13a..8eba1ed2 100644
--- a/include/data_upload
+++ b/include/data_upload
@@ -231,7 +231,7 @@
                     7) echo "${YELLOW}Error (7): ${NORMAL}Could not connect to central server or proxy server." ;;
                     59) echo "${YELLOW}Error (59): ${NORMAL}Could not connect because of used SSL cipher." ;;
                     83) echo "${YELLOW}Error (83): ${NORMAL}Could not check used certificate of server." ;;
-                    *) echo "Related exit code: ${YELLOW}{EXITCODE}${NORMAL}. See man page of cURL for the meaning of this code." ;;
+                    *) echo "Related exit code: ${YELLOW}${EXITCODE}${NORMAL}. See man page of cURL for the meaning of this code." ;;
                 esac
                 if [ ! "${UPLOAD}" = "" ]; then echo ""; echo "Debug:"; echo ${UPLOAD}; fi
                 echo ""

From b9fa5bce14613b49eb03574474a7c9e6bcd9bffc Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 8 Aug 2019 12:38:25 +0200
Subject: [PATCH 279/679] Added more text output for data uploads

---
 include/data_upload | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/include/data_upload b/include/data_upload
index 8eba1ed2..cdc84ff0 100644
--- a/include/data_upload
+++ b/include/data_upload
@@ -22,6 +22,8 @@
 #
 #################################################################################
 #
+    InsertSection "${SECTION_DATA_UPLOAD}"
+
     PROGRAM_VERSION="105"
 
     # Data upload destination
@@ -95,7 +97,6 @@
 
         Output "${WHITE}Report file found.${NORMAL} Starting with connectivity check."
 
-
             if [ ! "${UPLOAD_PROXY_SERVER}" = "" ]; then
                 LogText "Upload: Proxy is configured: ${UPLOAD_SERVER}"
                 # Port is optional
@@ -125,16 +126,17 @@
             #    CURL_OPTIONS="${CURL_OPTIONS} --compressed -H 'Content-Encoding: gzip'"
             #fi
 
-        # Quit if license is not valid, to reduce load on both client and server.
+
+        # License check
+
         LogText "Command used: ${CURLBINARY}${CURL_OPTIONS} -s -S --data-urlencode "licensekey=${LICENSE_KEY}" --data-urlencode "collector_version=${PROGRAM_VERSION}" ${LICENSE_SERVER_URL} 2> /dev/null"
         UPLOAD=$(${CURLBINARY}${CURL_OPTIONS} -s -S --data-urlencode "licensekey=${LICENSE_KEY}" --data-urlencode "collector_version=${PROGRAM_VERSION}" ${LICENSE_SERVER_URL} 2> /dev/null)
         EXITCODE=$?
         LogText "Exit code: ${EXITCODE}"
         if [ ${EXITCODE} -gt 0 ]; then
 
-            echo ""
-            echo "${RED}Upload Error${NORMAL}: License could not be checked. See ${LOGFILE} for details."
-            echo "Suggested command: tail -n 20 ${LOGFILE}"
+            Display --indent 2 --text "- License check" --result "FAILED" --color RED
+
             echo ""
 
             case ${EXITCODE} in
@@ -142,7 +144,7 @@
                         LogText "Result: could not initialize"
                         LogText "Possible cause: most likely your cURL version is too old and does not support the --data-urlencode option."
                         LogText "Suggestion: copy the data to a different server and use a new cURL version there, or use the Lynis Collector tool."
-                        echo "${RED}Error (2)${NORMAL}: could not initialize cURL. See ${LOGFILE} for details."
+                        echo "${RED}Error (2)${NORMAL}: could not initialize cURL."
                         ;;
                     5)
                         LogText "Result: could not resolve the defined proxy server (${UPLOAD_PROXY_SERVER})."
@@ -156,7 +158,7 @@
                         LogText "Result: could not contact license server."
                         LogText "Details: used URL ${LICENSE_SERVER_URL}"
                         LogText "Suggestion: check if the upload host is correctly configured."
-                        echo "${RED}Error (7)${NORMAL}: license server not available. See ${LOGFILE} for details."
+                        echo "${RED}Error (7)${NORMAL}: license server not available."
                         ;;
                     59)
                         echo "${RED}Error (59)${NORMAL}: Could not connect because of used SSL cipher."
@@ -181,14 +183,23 @@
                         LogText "Result: cURL exited with code ${EXITCODE}. See man page of cURL for the meaning of this code."
                         ;;
             esac
+
+            echo ""
+            echo "${RED}Upload Error${NORMAL}: License could not be checked. See ${LOGFILE} for details."
+            echo "Suggested command: tail -n 20 ${LOGFILE}"
+            echo ""
+
             LogText "Suggestion: run the cURL command manually without the options -s and -S"
             LogText "Result: quitting, can't check license"
+            # Quit if license is not valid, to reduce load on both client and server.
             ExitFatal
         fi
+
         UPLOAD_CODE=$(echo ${UPLOAD} | head -n 1 | awk '{ if ($1=="Response") { print $2 }}')
         if [ "${UPLOAD_CODE}" = "100" ]; then
             Output "${WHITE}License is valid${NORMAL}"
             LogText "Result: license is valid"
+            Display --indent 2 --text "- License check" --result "${STATUS_DONE}" --color GREEN
         else
             LogText "Result: error while checking license"
             LogText "Output: ${UPLOAD_CODE}"
@@ -210,7 +221,7 @@
         fi
 
         # Check for host IDs
-        if [ ! "${HOSTID}" = "" -a ! "${HOSTID2}" = "" ]; then
+        if [ -n "${HOSTID}" -a -n "${HOSTID2}" ]; then
             Output "${WHITE}Found hostid: ${HOSTID}${NORMAL}"
             # Try to connect
             Output "Uploading data.."
@@ -221,6 +232,8 @@
             EXITCODE=$?
             LogText "Exit code: ${EXITCODE}"
             if [ ${EXITCODE} -gt 0 ]; then
+                Display --indent 2 --text "- Data upload (${UPLOAD_SERVER})" --result "${STATUS_FAILED}" --color RED
+
                 echo ""
                 echo "${RED}Upload Error${NORMAL}: cURL could not upload data. See ${LOGFILE} for details."
                 echo "Suggested command: tail -n 20 ${LOGFILE}"
@@ -238,7 +251,7 @@
                 # Quit
                 ExitClean
             else
-                Display --indent 2 --text "Data upload status (${UPLOAD_SERVER})" --result OK --color GREEN
+                Display --indent 2 --text "- Data upload (${UPLOAD_SERVER})" --result "${STATUS_DONE}" --color GREEN
             fi
         else
             echo "${RED}Error${NORMAL}: No hostid and/or hostid2 found. Can not upload report file."

From a510c1c13645e3b7cf0b3a06e042f1306ab69108 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 8 Aug 2019 12:38:46 +0200
Subject: [PATCH 280/679] Sorting and added new strings

---
 db/languages/en | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/db/languages/en b/db/languages/en
index fbd62435..34e7f63e 100644
--- a/db/languages/en
+++ b/db/languages/en
@@ -14,19 +14,22 @@ NOTE_EXCEPTIONS_FOUND="Exceptions found"
 NOTE_EXCEPTIONS_FOUND_DETAILED="Some exceptional events or information was found"
 NOTE_PLUGINS_TAKE_TIME="Note: plugins have more extensive tests and may take several minutes to complete"
 NOTE_SKIPPED_TESTS_NON_PRIVILEGED="Skipped tests due to non-privileged mode"
-SECTION_CUSTOM_TESTS="Custom Tests"
+SECTION_CUSTOM_TESTS="Custom tests"
+SECTION_DATA_UPLOAD="Data upload"
+SECTION_INITIALIZING_PROGRAM="Initializing program"
 SECTION_MALWARE="Malware"
 SECTION_MEMORY_AND_PROCESSES="Memory and Processes"
+SECTION_SYSTEM_TOOLS="System tools"
 STATUS_DISABLED="DISABLED"
 STATUS_DONE="DONE"
 STATUS_ENABLED="ENABLED"
 STATUS_ERROR="ERROR"
+STATUS_FAILED="FAILED"
 STATUS_FOUND="FOUND"
-STATUS_YES="YES"
-STATUS_NO="NO"
 STATUS_OFF="OFF"
 STATUS_OK="OK"
 STATUS_ON="ON"
+STATUS_NO="NO"
 STATUS_NONE="NONE"
 STATUS_NOT_FOUND="NOT FOUND"
 STATUS_NOT_RUNNING="NOT RUNNING"
@@ -36,5 +39,6 @@ STATUS_SUGGESTION="SUGGESTION"
 STATUS_UNKNOWN="UNKNOWN"
 STATUS_WARNING="WARNING"
 STATUS_WEAK="WEAK"
+STATUS_YES="YES"
 TEXT_YOU_CAN_HELP_LOGFILE="You can help by providing your log file"
 TEXT_UPDATE_AVAILABLE="update available"

From fdc29775758c385dab43674715be4a44ea3ff810 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 8 Aug 2019 13:28:17 +0200
Subject: [PATCH 281/679] [AUTH-9408] corrected description

---
 include/tests_authentication | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 87bb96d7..b9f714b5 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -1381,7 +1381,7 @@
 #
     # Test        : AUTH-9408
     # Description : Logging of failed login attempts
-    Register --test-no AUTH-9408 --weight L --network NO --category security --description "Logging of failed login attempts via /etc/login.defs"
+    Register --test-no AUTH-9408 --weight L --network NO --category security --description "Logging of failed login attempts"
     if [ ${SKIPTEST} -eq 0 ]; then
         if [ -f "${ROOTDIR}etc/pam.conf" ]; then
             FOUND_PAM_TALLY2=0

From 3006b8dd267a827af1969099134a443cacf61e7a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 8 Aug 2019 15:05:23 +0200
Subject: [PATCH 282/679] [AUTH-9408] both backslash and brackets needs to be
 individually escaped

---
 include/tests_authentication | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index b9f714b5..733dfc4f 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -1393,7 +1393,7 @@
                 LogText "Result: did not find ${ROOTDIR}var/log/tallylog on disk or its file size is zero bytes"
             fi
             # Determine if pam_tally2 is available
-            for D in $(GetReportData --key "pam_module\\[\\]"); do
+            for D in $(GetReportData --key "pam_module\\\[\\\]"); do
                 if ContainsString "pam_tally2" "${D}"; then
                     LogText "Result: found pam_tally2 module on disk"
                     FOUND_PAM_TALLY2=1

From 1930dbe6c2a25495516be55a3db35b27763a8b26 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 13 Aug 2019 20:02:49 +0200
Subject: [PATCH 283/679] Added support for pacman

---
 include/functions | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/include/functions b/include/functions
index 25302432..e803930e 100644
--- a/include/functions
+++ b/include/functions
@@ -1896,6 +1896,9 @@
         elif [ -n "${EQUERYBINARY}" ]; then
             output=$(${EQUERYBINARY} --quiet ${package} > /dev/null 2>&1)
             exit_code=$?  # 0=package installed, 3=package not installed
+        elif [ -n "${PACMANBINARY}" ]; then
+            output=$(PACMANBINARY -Qs ${PKG} | grep "local/${PKG} " >/dev/null 2>&1)
+            exit_code=$?  # 0=package installed, 1=package not installed
         elif [ -n "${PKG_BINARY}" ]; then
             output=$(${PKG_BINARY} -N info ${package} >/dev/null 2>&1)
             exit_code=$?  # 0=package installed, 70=invalid package

From 7dba2dfd9de01d67374cf8c2f5fd3ab0dec8f7f6 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 13 Aug 2019 20:02:56 +0200
Subject: [PATCH 284/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d8ce67fd..ee464897 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -42,6 +42,7 @@ measures to further tighten any possible misuse.
 ### Changed
 - Function: CheckItem() now returns only exit code (ITEM_FOUND is dropped)
 - Function: IsRunning supports the --user flag to define a related user
+- Function: PackageIsInstalled extended with pacman support
 - Profiles: unused options removed
 - Profiles: message is displayed when old format "key:value" is used
 - Security: the 'nounset' (set -u) parameter is now activated by default

From 368989d5c4678f662a127de3a078af67df2dbd39 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 13 Aug 2019 20:04:14 +0200
Subject: [PATCH 285/679] [HOME-9304] Added git-shell to ignore list

---
 include/tests_homedirs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_homedirs b/include/tests_homedirs
index 544fa152..464b7389 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -57,7 +57,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users' home directories permissions are 750 or more restrictive
         FOUND=0
-        for LINE in "$(${EGREPBINARY} -v '^(daemon|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }')"; do
+        for LINE in "$(${EGREPBINARY} -v '^(daemon|git-shell|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }')"; do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
             DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
             if [ -d "${DIR}" ]; then

From 2af2d0a89591a52798a9230b4a56e8a47201b500 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 13 Aug 2019 20:05:09 +0200
Subject: [PATCH 286/679] [HOME-9306] Added git-shell to ignore list

---
 include/tests_homedirs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_homedirs b/include/tests_homedirs
index 464b7389..982fd313 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -89,7 +89,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users own their home directories
         FOUND=0
-        for LINE in "$(${EGREPBINARY} -v '^(daemon|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }') { print }')"; do
+        for LINE in "$(${EGREPBINARY} -v '^(daemon|git-shell|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }') { print }')"; do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
             DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
             if [ -d ${DIR} ]; then

From 914f34363544254a741d9d9c9b0ff829adfcac69 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 13 Aug 2019 21:00:43 +0200
Subject: [PATCH 287/679] Corrected variable

---
 include/functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/functions b/include/functions
index e803930e..4e4c9a00 100644
--- a/include/functions
+++ b/include/functions
@@ -1897,7 +1897,7 @@
             output=$(${EQUERYBINARY} --quiet ${package} > /dev/null 2>&1)
             exit_code=$?  # 0=package installed, 3=package not installed
         elif [ -n "${PACMANBINARY}" ]; then
-            output=$(PACMANBINARY -Qs ${PKG} | grep "local/${PKG} " >/dev/null 2>&1)
+            output=$(${PACMANBINARY} -Qs ${PKG} | grep "local/${PKG} " >/dev/null 2>&1)
             exit_code=$?  # 0=package installed, 1=package not installed
         elif [ -n "${PKG_BINARY}" ]; then
             output=$(${PKG_BINARY} -N info ${package} >/dev/null 2>&1)

From 3e392c8e6c6b9dc4df347180183b29b586b47881 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 13 Aug 2019 21:40:29 +0200
Subject: [PATCH 288/679] Added end-of-life data for Arch Linux (rolling)

---
 CHANGELOG.md       | 1 +
 db/software-eol.db | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ee464897..765f578e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -38,6 +38,7 @@ measures to further tighten any possible misuse.
 - New command: lynis generate systemd-units
 - Measure timing of tests and report slow tests (10+ seconds)
 - Initial support for Clear Linux OS
+- Added end-of-life data of Arch Linux
 
 ### Changed
 - Function: CheckItem() now returns only exit code (ITEM_FOUND is dropped)
diff --git a/db/software-eol.db b/db/software-eol.db
index 7b511237..1d8505fb 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -9,6 +9,10 @@
 #
 # Date can be converted on Linux using: date "+%s" --date=2020-01-01
 #
+# Arch Linux
+#
+os:Arch Linux:2286-11-20:9999999999:
+#
 # CentOS
 #
 os:CentOS release 5:2017-03-31:1490911200:

From e5b8047133a2f5107f4096c265ff075083e31776 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 13 Aug 2019 22:00:30 +0200
Subject: [PATCH 289/679] Added data and detection of Amazon Linux

---
 CHANGELOG.md        | 1 +
 db/software-eol.db  | 5 +++++
 include/osdetection | 6 ++++++
 3 files changed, 12 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 765f578e..9c4b7275 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -39,6 +39,7 @@ measures to further tighten any possible misuse.
 - Measure timing of tests and report slow tests (10+ seconds)
 - Initial support for Clear Linux OS
 - Added end-of-life data of Arch Linux
+- Detection and end-of-life data added for Amazon Linux
 
 ### Changed
 - Function: CheckItem() now returns only exit code (ITEM_FOUND is dropped)
diff --git a/db/software-eol.db b/db/software-eol.db
index 1d8505fb..87f5a065 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -9,6 +9,11 @@
 #
 # Date can be converted on Linux using: date "+%s" --date=2020-01-01
 #
+# Amazon Linux
+#
+os:Amazon Linux:2020-06-30:1593468000:
+os:Amazon Linux 2:2023-06-26:1687730400:
+#
 # Arch Linux
 #
 os:Arch Linux:2286-11-20:9999999999:
diff --git a/include/osdetection b/include/osdetection
index 20e50b26..164a4597 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -141,6 +141,12 @@
                 OS_ID=$(grep "^ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                 if [ -n "${OS_ID}" ]; then
                     case ${OS_ID} in
+                        "amzn")
+                            LINUX_VERSION="Amazon Linux"
+                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_NAME="Amazon Linux"
+                        ;;
                         "arch")
                             LINUX_VERSION="Arch Linux"
                             OS_FULLNAME="Arch Linux"

From a4f13a8ab2c84627278ca7222713c310d21031ac Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 13 Aug 2019 22:09:06 +0200
Subject: [PATCH 290/679] Only do Amazon Linux version detection if
 /etc/os-release does not exist

---
 include/osdetection | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/osdetection b/include/osdetection
index 164a4597..e7a14a3a 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -195,9 +195,9 @@
             fi
 
             # Amazon
-            if [ -e "/etc/system-release" ]; then
-                FIND=$(grep "Amazon" /etc/system-release)
-                if [ ! "${FIND}" = "" ]; then
+            if [ -z "${LINUX_VERSION}" -a -e "/etc/system-release" ]; then
+                FIND=$(grep "^Amazon" /etc/system-release)
+                if [ -n "${FIND}" ]; then
                     OS_REDHAT_OR_CLONE=1
                     OS_FULLNAME=$(grep "^Amazon" /etc/system-release)
                     OS_VERSION=$(grep "^Amazon" /etc/system-release | awk '{ if ($4=="release") { print $5 } }')

From 8c3417dcc2c9009f0d82429a2cf378f70148510f Mon Sep 17 00:00:00 2001
From: Yoni Weill <joweill@icloud.com>
Date: Thu, 15 Aug 2019 13:27:19 +0300
Subject: [PATCH 291/679] [HOME-9304] s/git-shell/git

---
 include/tests_homedirs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_homedirs b/include/tests_homedirs
index 982fd313..85ae4250 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -57,7 +57,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users' home directories permissions are 750 or more restrictive
         FOUND=0
-        for LINE in "$(${EGREPBINARY} -v '^(daemon|git-shell|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }')"; do
+        for LINE in "$(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }')"; do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
             DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
             if [ -d "${DIR}" ]; then

From 6164b41836dad4bdbf046d9c84202427c000497a Mon Sep 17 00:00:00 2001
From: Yoni Weill <joweill@icloud.com>
Date: Thu, 15 Aug 2019 13:27:59 +0300
Subject: [PATCH 292/679] [HOME-9306] s/git-shell/git

---
 include/tests_homedirs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_homedirs b/include/tests_homedirs
index 85ae4250..e20b405f 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -89,7 +89,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users own their home directories
         FOUND=0
-        for LINE in "$(${EGREPBINARY} -v '^(daemon|git-shell|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }') { print }')"; do
+        for LINE in "$(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }') { print }')"; do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
             DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
             if [ -d ${DIR} ]; then

From 0a3f42afbc3b4c325e99696e91b30bcd54001930 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 17 Aug 2019 16:48:46 +0200
Subject: [PATCH 293/679] New function HasCorrectFilePermissions

---
 include/functions | 68 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)

diff --git a/include/functions b/include/functions
index 4e4c9a00..d03a7d1f 100644
--- a/include/functions
+++ b/include/functions
@@ -193,6 +193,7 @@
         CHECKFILE="$1"
         if [ ! -d ${CHECKFILE} -a ! -f ${CHECKFILE} ]; then
             PERMS="FILE_NOT_FOUND"
+            FILEVALUE=""
         else
             # If 'file' is an directory, use -d
             if [ -d ${CHECKFILE} ]; then
@@ -207,6 +208,73 @@
     }
 
 
+    ################################################################################
+    # Name        : HasCorrectFilePermissions()
+    # Description : Check file permissions
+    #
+    # Parameters  : $1 = Full path to file or directory
+    #               $2 = Permissions
+    # Returns     : exit code (0 = correct, 1 = not correct)
+    ################################################################################
+
+    HasCorrectFilePermissions() {
+        if [ $# -ne 2 ]; then Fatal "Incorrect usage of HasCorrectFilePermissions"; fi
+        CHECKFILE="$1"
+        CHECKPERMISSION_FULL="$2"
+        if [ ! -d ${CHECKFILE} -a ! -f ${CHECKFILE} ]; then
+            return 2
+        else
+            for CHECK_PERMISSION in ${CHECKPERMISSION_FULL}; do
+                DATA=$(echo ${CHECK_PERMISSION} | ${EGREPBINARY} "[rwx]")
+                if [ $? -eq 0 ]; then
+                    # add first dummy character
+                    CHECK_PERMISSION=$(echo "-${CHECK_PERMISSION}" | ${AWKBINARY} '{k=0;for(i=0;i<=8;i++)k+=((substr($1,i+2,1)~/[rwx]/)*2^(8-i));if(k)printf("%0o",k)}')
+                fi
+                LogText "Test: checking if file ${CHECKFILE} is ${CHECK_PERMISSION}"
+                if [ -n "${STATBINARY}" ]; then
+                    DATA=$(${STATBINARY} --format=%a ${CHECKFILE})
+                    LogText "Output: ${DATA}"
+                elif [ -n "${FINDBINARY}" ]; then
+                    case ${OS} in
+                        "AIX")
+                            ReportException "HasCorrectFilePermissions:01" "OS not supported yet"
+                        ;;
+                        *)
+                            # Does not work for AIX
+                            DATA=$(${FINDBINARY} ${CHECKFILE} -printf "%m")
+                        ;;
+                    esac
+                else
+                    # If 'file' is an directory, use -d
+                    if [ -d ${CHECKFILE} ]; then
+                        DATA=$(ls -d -l ${CHECKFILE} | cut -c 2-10)
+                    else
+                        DATA=$(ls -l ${CHECKFILE} | cut -c 2-10)
+                    fi
+                    # Convert permissions to octal
+                    LogText "Converting ${DATA} to octal"
+                    DATA=$(echo ${DATA} | ${AWKBINARY} '{k=0;for(i=0;i<=8;i++)k+=((substr($1,i+2,1)~/[rwx]/)*2^(8-i));if(k)printf("%0o",k)}')
+                    LogText "Output: ${DATA}"
+                fi
+
+                if [ -n "${DATA}" ]; then
+                    if [ "${DATA}" = "${CHECK_PERMISSION}" ]; then
+                        LogText "Outcome: correct permissions"
+                        return 0
+                    fi
+                else
+                    ReportException "HasCorrectFilePermissions:02" "No data value found, which is unexpected"
+                fi
+            done
+
+            LogText "Did not find the permissions of file ${CHECKFILE} matching any of the ${CHECKPERMISSION_FULL} values"
+            # No match, return exit code 1
+            return 1
+        fi
+    }
+
+
+
     ################################################################################
     # Name        : CheckItem()
     # Description : Check if a specific item exists in the report

From 3407a1dbe6c1498386f6bfa5ff8f1706e8fbdf9e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 17 Aug 2019 16:49:11 +0200
Subject: [PATCH 294/679] [FILE-7524] optimized test with new function and
 changed warning to suggestion

---
 include/tests_file_permissions | 40 +++++++++++++++++++++-------------
 1 file changed, 25 insertions(+), 15 deletions(-)

diff --git a/include/tests_file_permissions b/include/tests_file_permissions
index 108b830e..35e28753 100644
--- a/include/tests_file_permissions
+++ b/include/tests_file_permissions
@@ -32,27 +32,37 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         Display --indent 2 --text "- Starting file permissions check"
         LogText "Test: Checking file permissions"
+        FOUND=0
         for PROFILE in ${PROFILES}; do
             LogText "Using profile ${PROFILE} for baseline."
-            FIND=$(${EGREPBINARY} '^permfile=|^permdir=' ${PROFILE} | ${CUTBINARY} -d= -f2 | ${CUTBINARY} -d: -f1)
-            for I in ${FIND}; do
-                LogText "Checking ${I}"
-                CheckFilePermissions "${I}"
-                LogText "  Expected permissions: ${PROFILEVALUE}"
-                LogText "  Actual permissions: ${FILEVALUE}"
-                LogText "  Result: $PERMS"
-                if [ "${PERMS}" = "FILE_NOT_FOUND" ]; then
-                    if IsVerbose; then Display --indent 4 --text "${I}" --result "${STATUS_NOT_FOUND}" --color WHITE; fi
-                elif [ "${PERMS}" = "OK" ]; then
-                    Display --indent 4 --text "${I}" --result "${STATUS_OK}" --color GREEN
-                elif [ "${PERMS}" = "BAD" ]; then
-                    Display --indent 4 --text "${I}" --result "${STATUS_WARNING}" --color RED
-                    ReportWarning ${TEST_NO} "Incorrect permissions for file ${I}"
+            FILES=$(${EGREPBINARY} '^permfile=|^permdir=' ${PROFILE} | ${CUTBINARY} -d= -f2 | ${CUTBINARY} -d: -f1)
+            for F in ${FILES}; do
+                LogText "Test: checking file/directory ${F}"
+                if [ -f "${F}" ]; then
+                    PERMS=$(${GREPBINARY} '^permfile=' ${PROFILE} | ${GREPBINARY} "=${F}:" | ${CUTBINARY} -d: -f2)
+                    if HasCorrectFilePermissions "${F}" "${PERMS}"; then
+                        Display --indent 4 --text "File: ${F}" --result "${STATUS_OK}" --color GREEN
+                    else
+                        Display --indent 4 --text "File: ${F}" --result "${STATUS_SUGGESTION}" --color YELLOW
+                        FOUND=1
+                    fi
+                elif [ -d "${F}" ]; then
+                    PERMS=$(${GREPBINARY} '^permdir=' ${PROFILE} | ${GREPBINARY} "=${F}:" | ${CUTBINARY} -d: -f2)
+                    if HasCorrectFilePermissions "${F}" "${PERMS}"; then
+                        Display --indent 4 --text "Directory: ${F}" --result "${STATUS_OK}" --color GREEN
+                    else
+                        Display --indent 4 --text "Directory: ${F}" --result "${STATUS_SUGGESTION}" --color YELLOW
+                        FOUND=1
+                    fi
                 else
-                    LogText "UNKNOWN status for file"
+                    if IsVerbose; then Display --indent 4 --text "${F}" --result "${STATUS_NOT_FOUND}" --color WHITE; fi
+                    LogText "Skipping file/directory ${F} as it does not exist on this system"
                 fi
             done
         done
+        if [ ${FOUND} -eq 1 ]; then
+            ReportSuggestion "${TEST_NO}" "Consider restricting file permissions" "See screen output or log file" "text:Use chmod to change file permissions"
+        fi
     fi
 #
 #################################################################################

From f51f19f621e5f5ff1337a4cd039ce7e9de60a67b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 17 Aug 2019 16:49:23 +0200
Subject: [PATCH 295/679] Updated log

---
 CHANGELOG.md | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9c4b7275..28d51121 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,11 +22,12 @@ measures to further tighten any possible misuse.
 - Security: filtering out unexpected characters from profiles
 - Security: test if setuid bit is set on Lynis binary
 - New function: DisplayWarning - show a warning on the screen
-- New function: Equals - compare two strings
-- New function: GetReportData - retrieve earlier stored data
-- New function: Readonly - mark variable read-only (security)
-- New function: SafeFile - test file type and call permission check
-- New function: SafeInput - check for safe input (security)
+- New function: Equals
+- New function: GetReportData
+- New function: HasCorrectFilePermissions
+- New function: Readonly
+- New function: SafeFile
+- New function: SafeInput
 - New option: --usecwd - run from the current working directory
 - New profile option: disable-plugin - disables a single plugin
 - New profile option: ssl-certificate-paths-to-ignore - ignore a path
@@ -50,6 +51,7 @@ measures to further tighten any possible misuse.
 - Security: the 'nounset' (set -u) parameter is now activated by default
 - AUTH-9266 - skip .pam-old files in /etc/pam.d
 - AUTH-9408 - added support for pam_tally2 to log failed logins
+- FILE-7524 - optimized file permissions testing
 - FINT-4328 - corrected text in log
 - FINT-4334 - improved process detection for lfd
 - HOME-9304 - improved selection for normal users

From e7d6aaa44dd8189cab5d0d001c93864b1ecb0005 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 20 Aug 2019 14:17:05 +0200
Subject: [PATCH 296/679] Stop execution if unexpected characters were found.
 Also move hyphen to end to list, otherwise it may not work as a matchin
 character

---
 include/profiles | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/include/profiles b/include/profiles
index 65e3bcee..26b7b9b1 100644
--- a/include/profiles
+++ b/include/profiles
@@ -45,16 +45,17 @@
             sleep 30
         fi
 
-        # Security check for unexpected and possibly harmful escape characters
-        DATA=$(grep -v '^$\|^ \|^#\|^config:'  ${PROFILE} | tr -d '[:alnum:]/\[\]\(\)\-_\|,\.:;= \n\r' | od -An -ta | sed 's/ /!space!/g')
+        # Security check for unexpected and possibly harmful escape characters (hyphen should be listed as first or last character)
+        DATA=$(grep -v '^$\|^ \|^#\|^config:' ${PROFILE} | tr -d '[:alnum:]/\[\]\(\)_\|,\.:;= \n\r-' | od -An -ta | sed 's/ /!space!/g')
         if ! IsEmpty "${DATA}"; then
             DisplayWarning "Your profile '${PROFILE}' contains unexpected characters. See the log file for more information."
-            LogText "Found unexpected or possibly harmful characters in the profile. See output below."
+            LogText "Found unexpected or possibly harmful characters in profile '${PROFILE}'. See which characters matched in the output below and compare them with your profile."
             for I in "${DATA}"; do
                 I=$(echo ${I} | sed 's/!space!/ /g')
                 LogText "Output: ${I}"
             done
-            sleep 30
+            LogText "Suggestion: comment incorrect lines with a '#' and try again. Open a GitHub issue if valid characters are blocked"
+            ExitFatal "unexpected characters in profile. Stopping execution (security measure)"
         fi
 
         # Now parse the profile and filter out unwanted characters

From c1c23a4cca3116d18e196198176ff9f6b0490a1a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 20 Aug 2019 14:18:15 +0200
Subject: [PATCH 297/679] Only test if we have locale command, which is not
 always available (like Alpine in Docker container)

---
 lynis | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lynis b/lynis
index eb05bf9e..29c28919 100755
--- a/lynis
+++ b/lynis
@@ -213,14 +213,14 @@
 #
     # Auto detection of language based on shell LANG variable. This is required by the Display() function to deal with multi-bytes characters.
     DISPLAY_LANG="${LANG:-}"
-    # Try locale command if shell variable had no value
-    if [ -z "${DISPLAY_LANG}" ]; then
-        DISPLAY_LANG=$(locale | egrep "^LANG=" | cut -d= -f2)
-    fi
 
     # Extract the short notation of the language (first two characters).
     if [ -x "$(command -v locale 2> /dev/null)" ]; then
         LANGUAGE=$(locale | egrep "^LANG=" | cut -d= -f2 | cut -d_ -f1 | egrep "^[a-z]{2}$")
+        # Try locale command if shell variable had no value
+        if [ -z "${DISPLAY_LANG}" ]; then
+            DISPLAY_LANG=$(locale | egrep "^LANG=" | cut -d= -f2)
+        fi
     fi
 
     # Set default language: 'en' (English) if no value is set

From 1823bf10400843abf280766deb639f1fff4b9808 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 20 Aug 2019 14:22:36 +0200
Subject: [PATCH 298/679] Set default language if locale command does not exist

---
 lynis | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lynis b/lynis
index 29c28919..61a15923 100755
--- a/lynis
+++ b/lynis
@@ -221,6 +221,8 @@
         if [ -z "${DISPLAY_LANG}" ]; then
             DISPLAY_LANG=$(locale | egrep "^LANG=" | cut -d= -f2)
         fi
+    else
+        LANGUAGE="en"
     fi
 
     # Set default language: 'en' (English) if no value is set

From a310c43176e22815722608c8dc3e6cd5a42bc091 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 20 Aug 2019 14:24:06 +0200
Subject: [PATCH 299/679] Set hyphen as last character to allow it being
 matched

---
 include/profiles | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/profiles b/include/profiles
index 26b7b9b1..8121cd9a 100644
--- a/include/profiles
+++ b/include/profiles
@@ -59,7 +59,7 @@
         fi
 
         # Now parse the profile and filter out unwanted characters
-        DATA=$(egrep "^config:|^[a-z-].*=" ${PROFILE} | tr -dc '[:alnum:]/\[\]\(\)\-_\|,\.:;= \n\r' | sed 's/ /!space!/g')
+        DATA=$(egrep "^config:|^[a-z-].*=" ${PROFILE} | tr -dc '[:alnum:]/\[\]\(\)_\|,\.:;= \n\r-' | sed 's/ /!space!/g')
         for CONFIGOPTION in ${DATA}; do
             if ContainsString "^config:" "${CONFIGOPTION}"; then
                 # Old style configuration

From e685182b185972be759bda415fbe5fbf920cf7ac Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 20 Aug 2019 14:49:34 +0200
Subject: [PATCH 300/679] Put in fail-safe options for systems using AIX or
 busybox

---
 include/functions | 28 ++++++++++++++++++++--------
 1 file changed, 20 insertions(+), 8 deletions(-)

diff --git a/include/functions b/include/functions
index d03a7d1f..bede7d9a 100644
--- a/include/functions
+++ b/include/functions
@@ -53,6 +53,7 @@
 #    FileIsReadable             Check if a file is readable or directory accessible
 #    GetHostID                  Retrieve an unique ID for this host
 #    GetReportData              Request data from report
+#    HasCorrectFilePermissions  Check file permissions and see if they match expected values
 #    HasData                    Checks for data in variable
 #    InsertSection              Insert a section block
 #    InsertPluginSection        Insert a section block for plugins
@@ -214,7 +215,7 @@
     #
     # Parameters  : $1 = Full path to file or directory
     #               $2 = Permissions
-    # Returns     : exit code (0 = correct, 1 = not correct)
+    # Returns     : exit code (0 = correct, 1 = not correct, 2 = file does not exist)
     ################################################################################
 
     HasCorrectFilePermissions() {
@@ -227,14 +228,22 @@
             for CHECK_PERMISSION in ${CHECKPERMISSION_FULL}; do
                 DATA=$(echo ${CHECK_PERMISSION} | ${EGREPBINARY} "[rwx]")
                 if [ $? -eq 0 ]; then
-                    # add first dummy character
+                    # add a dummy character as first character so it looks like output is a normal file
                     CHECK_PERMISSION=$(echo "-${CHECK_PERMISSION}" | ${AWKBINARY} '{k=0;for(i=0;i<=8;i++)k+=((substr($1,i+2,1)~/[rwx]/)*2^(8-i));if(k)printf("%0o",k)}')
                 fi
+
+                # First try stat command
                 LogText "Test: checking if file ${CHECKFILE} is ${CHECK_PERMISSION}"
                 if [ -n "${STATBINARY}" ]; then
-                    DATA=$(${STATBINARY} --format=%a ${CHECKFILE})
-                    LogText "Output: ${DATA}"
-                elif [ -n "${FINDBINARY}" ]; then
+                    # busybox does not support format
+                    if [ ${SHELL_IS_BUSYBOX} -eq 0 ]; then
+                        DATA=$(${STATBINARY} --format=%a ${CHECKFILE})
+                        LogText "Output: ${DATA}"
+                    fi
+                fi
+
+                # See if we can use the find binary
+                if [ -z "${DATA}" ]; then
                     case ${OS} in
                         "AIX")
                             ReportException "HasCorrectFilePermissions:01" "OS not supported yet"
@@ -244,12 +253,15 @@
                             DATA=$(${FINDBINARY} ${CHECKFILE} -printf "%m")
                         ;;
                     esac
-                else
+                fi
+
+                # Finally use ls command
+                if [ -z "${DATA}" ]; then
                     # If 'file' is an directory, use -d
                     if [ -d ${CHECKFILE} ]; then
-                        DATA=$(ls -d -l ${CHECKFILE} | cut -c 2-10)
+                        DATA=$(${LSBINARY} -d -l ${CHECKFILE} | cut -c 2-10)
                     else
-                        DATA=$(ls -l ${CHECKFILE} | cut -c 2-10)
+                        DATA=$(${LSBINARY} -l ${CHECKFILE} | cut -c 2-10)
                     fi
                     # Convert permissions to octal
                     LogText "Converting ${DATA} to octal"

From 32a895c843eee0b055fcddb995b32e3655177515 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 20 Aug 2019 15:57:04 +0200
Subject: [PATCH 301/679] Do not use find command when busybox is used

---
 include/functions | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/include/functions b/include/functions
index bede7d9a..8baf6562 100644
--- a/include/functions
+++ b/include/functions
@@ -246,11 +246,13 @@
                 if [ -z "${DATA}" ]; then
                     case ${OS} in
                         "AIX")
-                            ReportException "HasCorrectFilePermissions:01" "OS not supported yet"
+                            Debug "Skipping find command, as AIX does not support -printf"
                         ;;
                         *)
-                            # Does not work for AIX
-                            DATA=$(${FINDBINARY} ${CHECKFILE} -printf "%m")
+                            # Only use find when OS is NOT AIX and binaries are NOT busybox
+                            if [ ${SHELL_IS_BUSYBOX} -eq 0 ]; then
+                                DATA=$(${FINDBINARY} ${CHECKFILE} -printf "%m")
+                            fi
                         ;;
                     esac
                 fi

From 8a7f8038b5e4e4c674ae8924a0c551dd53ce8559 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 20 Aug 2019 16:01:10 +0200
Subject: [PATCH 302/679] Do not show a tool tip if quiet option is used

---
 include/functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/functions b/include/functions
index 8baf6562..204d9e55 100644
--- a/include/functions
+++ b/include/functions
@@ -679,7 +679,7 @@
 
     DisplayToolTip() {
         # Display tooltip when enabled and no tip has been displayed yet
-        if [ ${SHOW_TOOL_TIPS} -eq 1 -a ${TOOLTIP_SHOWED} -eq 0 ]; then
+        if [ ${SHOW_TOOL_TIPS} -eq 1 -a ${TOOLTIP_SHOWED} -eq 0 -a ${QUIET} -eq 0 ]; then
             # Check if we already have already discovered a proper echo command tool. It not, set it default to 'echo'.
             if [ "${ECHOCMD}" = "" ]; then ECHOCMD="echo"; fi
             if [ ${CRONJOB} -eq 0 ]; then

From bc6d294b9157e069b41de79b8a8f6e0b15f304c5 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 20 Aug 2019 16:01:18 +0200
Subject: [PATCH 303/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 28d51121..b7d984ff 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -81,6 +81,7 @@ measures to further tighten any possible misuse.
 - Show tip to use 'lynis generate hostids' when host IDs are missing
 - The 'show changelog' command works again for newer versions
 - Several code cleanups, simplification of commands, and code standardization
+- Do not show tool tips when quiet option is used
 - Extended output of 'lynis update info'
 - Test if profiles are readable
 - systemd service file adjusted

From 7dfd580320143e0e8598ecbd9aeb88d3b9e38146 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 20 Aug 2019 16:22:00 +0200
Subject: [PATCH 304/679] Only escape backslash, question mark is not needed

---
 include/functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/functions b/include/functions
index 204d9e55..816d0cd1 100644
--- a/include/functions
+++ b/include/functions
@@ -884,7 +884,7 @@
         sFILE=$1
         CANREAD=0
         RETVAL=1
-        escaped_file=$(echo ${sFILE} | sed 's/\*/\\*/; s/\?/\\?/')
+        escaped_file=$(echo ${sFILE} | sed 's/\*/\\*/; s/?/\\?/')
         LogText "Test: check if we can access ${sFILE} (escaped: ${escaped_file})"
 
         # Check for symlink

From ee18e76e976eef981a36a702b6ee0504f0cce645 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 21 Aug 2019 13:41:23 +0200
Subject: [PATCH 305/679] Preparations for forensics scan mode

---
 include/consts      |  1 +
 include/helper_show |  2 +-
 include/parameters  | 63 +++++++++++++++++++--------------------------
 include/report      | 14 ++++++++++
 lynis               | 11 +++++---
 5 files changed, 50 insertions(+), 41 deletions(-)

diff --git a/include/consts b/include/consts
index 8e98a833..9235b5f4 100644
--- a/include/consts
+++ b/include/consts
@@ -114,6 +114,7 @@ unset LANG
     FIND=""
     FIREWALL_ACTIVE=0
     FOUNDPATH=0
+    FORENSICS=0
     GETENT_BINARY=""
     GRADMBINARY=""
     GREPBINARY="grep"
diff --git a/include/helper_show b/include/helper_show
index 260518d6..594be15b 100644
--- a/include/helper_show
+++ b/include/helper_show
@@ -30,7 +30,7 @@
 
 COMMANDS="audit configure generate show update upload-only"
 HELPERS="audit configure show update"
-OPTIONS="--auditor\n--cronjob (--cron)\n--debug\n--developer\n--help (-h)\n--license-key\n--log-file\n--manpage (--man)\n--no-colors\n--no-log\n--pentest\n--profile\n--plugin-dir\n--quick (-Q)\n--quiet (-q)\n--report-file\n--reverse-colors\n--skip-plugins\n--tests\n--tests-from-category\n--tests-from-group\n--usecwd\n--upload\n--verbose\n--version (-V)\n--wait\n--warnings-only"
+OPTIONS="--auditor\n--cronjob (--cron)\n--debug\n--developer\n--forensics\n--help (-h)\n--log-file\n--manpage (--man)\n--no-colors\n--no-log\n--pentest\n--profile\n--plugin-dir\n--quick (-Q)\n--quiet (-q)\n--report-file\n--reverse-colors\n--skip-plugins\n--tests\n--tests-from-category\n--tests-from-group\n--usecwd\n--upload\n--verbose\n--version (-V)\n--wait\n--warnings-only"
 
 SHOW_ARGS="categories changelog commands dbdir details environment eol groups help hostids includedir language license logfile man options os pidfile plugindir profiles release releasedate report settings tests version workdir"
 SHOW_HELP="lynis show ${BROWN}categories${NORMAL}              (display test categories)
diff --git a/include/parameters b/include/parameters
index 49c0f495..483f2193 100644
--- a/include/parameters
+++ b/include/parameters
@@ -247,29 +247,9 @@
                 DEVELOPER_MODE=1
             ;;
 
-            # Display all available options with short alias
-            --dump-options | --dumpoptions)
-                OPTIONS="--auditor
-                         --check-all_(-c) --cronjob_(--cron)
-                         --debug
-                         --help_(-h)
-                         --info
-                         --license-key --log-file
-                         --manpage_(--man)
-                         --no-colors --no-log
-                         --pentest --profile --plugins-dir
-                         --quiet_(-q) --quick_(-Q)
-                         --report-file --reverse-colors
-                         --tests
-                         --upload
-                         --version_(-V)"
-                for ITEM in ${OPTIONS}; do
-                    echo "${ITEM}" | tr '_' ' '
-                done
-                echo "This option is deprecated"
-                echo "Use: lynis show options"
-
-                ExitClean
+            # Enable forensics mode (gather information from a mounted directory)
+            --forensics)
+                FORENSICS=1
             ;;
 
             # View help
@@ -277,19 +257,6 @@
                 VIEWHELP=1
             ;;
 
-            # View program/database information
-            --check-update | --check-updates | --info)
-                echo "This option is deprecated"
-                echo "Use: lynis update info"
-                ExitClean
-            ;;
-
-            # License key for Lynis Enterprise
-            --license-key)
-                shift
-                LICENSE_KEY=$1
-            ;;
-
             # Adjust default logfile location
             --logfile | --log-file)
                 shift
@@ -455,6 +422,30 @@
                 exit 1
             ;;
 
+            # Soon to be deprecated options
+
+            # View program/database information
+            --check-update | --check-updates | --info)
+                echo "This option is deprecated"
+                echo "Use: lynis update info"
+                ExitFatal
+            ;;
+
+            # Display all available options with short alias
+            --dump-options | --dumpoptions)
+                echo "This option is deprecated"
+                echo "Use: lynis show options"
+                ExitFatal
+            ;;
+
+            # License key for Lynis Enterprise
+            --license-key)
+                echo "This option is deprecated"
+                echo "Define a license key in /etc/lynis/custom.prf"
+                ExitFatal
+            ;;
+
+
             # Drop out when using wrong option(s)
             *)
                 # Wrong option used, we bail out later
diff --git a/include/report b/include/report
index c340da53..1ec93ffa 100644
--- a/include/report
+++ b/include/report
@@ -215,6 +215,20 @@
             echo "  - Malware scanner        [${MALWARE}${NORMAL}]"
 
             echo ""
+            echo "  ${SECTION}Scan mode${NORMAL}:"
+            if [ ${FORENSICS} -eq 1 ]; then
+                echo "  Normal [ ]  Forensics [V]  Pentest [ ]"
+            elif [ ${PENTESTINGMODE} -eq 1 ]; then
+                if [ ${PRIVILEGED} -eq 0 ]; then
+                    echo "  Normal [ ]  Forensics [ ]  Pentest [V] (running non-privileged)"
+                else
+                    echo "  Normal [ ]  Forensics [ ]  Pentest [V] (running privileged)"
+                fi
+            else
+                echo "  Normal [V]  Forensics [ ]  Pentest [ ]"
+            fi
+            echo ""
+
             echo "  ${SECTION}Lynis modules${NORMAL}:"
             if [ ${COMPLIANCE_TESTS_PERFORMED} -eq 1 ]; then
                 if [ ${COMPLIANCE_FINDINGS_FOUND} -eq 0 ]; then COMPLIANCE="${GREEN}V"; else COMPLIANCE="${RED}X"; fi
diff --git a/lynis b/lynis
index 61a15923..335e65d4 100755
--- a/lynis
+++ b/lynis
@@ -429,10 +429,9 @@ ${YELLOW}Note: ${WHITE}Cancelling the program can leave temporary files behind${
 
   ${WHITE}Options:${NORMAL}
 
-    ${GRAY}--no-log${NORMAL}                          : Don't create a log file
-    ${GRAY}--pentest${NORMAL}                         : Non-privileged scan (useful for pentest)
-    ${GRAY}--profile ${BROWN}<profile>${NORMAL}               : Scan the system with the given profile file
-    ${GRAY}--quick (-Q)${NORMAL}                      : Quick mode, don't wait for user input
+    ${WHITE}Alternative system audit modes${NORMAL}
+    ${GRAY}--forensics${NORMAL}                       : Perform forensics on a running or mounted system
+    ${GRAY}--pentest${NORMAL}                         : Non-privileged, show points of interest for pentesting
 
     ${WHITE}Layout options${NORMAL}
     ${GRAY}--no-colors${NORMAL}                       : Don't use colors in output
@@ -441,9 +440,12 @@ ${YELLOW}Note: ${WHITE}Cancelling the program can leave temporary files behind${
 
     ${WHITE}Misc options${NORMAL}
     ${GRAY}--debug${NORMAL}                           : Debug logging to screen
+    ${GRAY}--no-log${NORMAL}                          : Don't create a log file
+    ${GRAY}--profile ${BROWN}<profile>${NORMAL}               : Scan the system with the given profile file
     ${GRAY}--view-manpage (--man)${NORMAL}            : View man page
     ${GRAY}--verbose${NORMAL}                         : Show more details on screen
     ${GRAY}--version (-V)${NORMAL}                    : Display version number and quit
+    ${GRAY}--wait${NORMAL}                            : Wait between a set of tests
 
     ${WHITE}Enterprise options${NORMAL}
     ${GRAY}--plugindir ${BROWN}<path>${NORMAL}                : Define path of available plugins
@@ -451,6 +453,7 @@ ${YELLOW}Note: ${WHITE}Cancelling the program can leave temporary files behind${
 
     More options available. Run '$0 show options', or use the man page.
 
+
 "
 
         if [ ${WRONGOPTION} -eq 1 ]; then

From 2b43ea8d711597784fc3c030aa79eacc3b5180f4 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 21 Aug 2019 13:45:44 +0200
Subject: [PATCH 306/679] Add forensics option

---
 lynis.8 | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lynis.8 b/lynis.8
index 7f58b1cd..2f424209 100644
--- a/lynis.8
+++ b/lynis.8
@@ -1,4 +1,4 @@
-.TH Lynis 8 "31 Jul 2019" "1.29" "Unix System Administrator's Manual"
+.TH Lynis 8 "21 Aug 2019" "1.30" "Unix System Administrator's Manual"
 
 
 .SH "NAME"
@@ -72,6 +72,9 @@ Display debug information to screen for troubleshooting purposes.
 .B \-\-developer
 Display detailed information useful for developers when creating tests.
 .TP
+.B \-\-forensics
+Perform the audit on a running or mounted system (see \-\-rootdir)
+.TP
 .B \-\-help
 Show available commands and most-used options.
 .TP
@@ -189,7 +192,7 @@ Bugs can be reported via GitHub at https://github.com/CISOfy/lynis or via suppor
 Supporting documentation can be found via https://cisofy.com/support/
 
 .SH "LICENSING"
-Lynis is licensed as GPLv3. It was created by Michael Boelen in 2007. Since 2013 its development has been taken over by CISOfy under the management of Michael Boelen. Plugins may have a different license.
+Lynis is licensed as GPLv3. The tool was created by Michael Boelen in 2007. Since 2013 its development has been taken over by CISOfy under the management of Michael Boelen. Plugins may have a different license.
 
 .SH "CONTACT INFORMATION"
 Support requests and project related questions can be addressed via e-mail: lynis-dev@cisofy.com.

From 3db7a3b944ec79e3a6346114f98ecef3c6da8369 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 21 Aug 2019 13:48:36 +0200
Subject: [PATCH 307/679] Move -c also to list of deprecated items

---
 include/parameters | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/include/parameters b/include/parameters
index 483f2193..74f2c9a0 100644
--- a/include/parameters
+++ b/include/parameters
@@ -224,12 +224,6 @@
                 fi
             ;;
 
-            # Perform tests (deprecated, use audit system)
-            --check-all | --checkall | -c)
-                DisplayToolTip "Usage of option -c is deprecated. Please use: lynis audit system [options]"
-                CHECK=1
-            ;;
-
             # Cronjob support
             --cron-job | --cronjob | --cron)
                 CRONJOB=1
@@ -424,16 +418,23 @@
 
             # Soon to be deprecated options
 
+            # Perform tests (deprecated, use audit system)
+            --check-all | --checkall | -c)
+                echo "This option (-c) is deprecated."
+                echo "Use: lynis audit system [options]"
+                ExitFatal
+            ;;
+
             # View program/database information
             --check-update | --check-updates | --info)
-                echo "This option is deprecated"
+                echo "This option (--info) is deprecated"
                 echo "Use: lynis update info"
                 ExitFatal
             ;;
 
             # Display all available options with short alias
             --dump-options | --dumpoptions)
-                echo "This option is deprecated"
+                echo "This option (--dump-options) is deprecated"
                 echo "Use: lynis show options"
                 ExitFatal
             ;;

From d395e1a2da77d3e44a8894039414f10511ef6f9c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 21 Aug 2019 13:50:01 +0200
Subject: [PATCH 308/679] [CRYP-7930] extend test to use cryptsetup/lsblk or
 crypttab file

---
 include/tests_crypto | 49 +++++++++++++++++++++++++++++++++-----------
 1 file changed, 37 insertions(+), 12 deletions(-)

diff --git a/include/tests_crypto b/include/tests_crypto
index 979d2aad..b3524599 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -132,22 +132,47 @@
 #
     # Test        : CRYP-7930
     # Description : Determine if system uses LUKS block device encryption
-    if [ ! "${LSBLKBINARY}" = "" -a ! "${CRYPTSETUPBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no CRYP-7930 --preqs-met ${PREQS_MET} --weight L --network NO --root-only YES --category security --description "Determine if system uses LUKS block device encryption"
+    Register --test-no CRYP-7930 --os Linux --weight L --network NO --root-only YES --category security --description "Determine if system uses LUKS block device encryption"
     if [ ${SKIPTEST} -eq 0 ]; then
-      FOUND=0
-      for BLOCK_DEV in $(${LSBLKBINARY} --noheadings -o PATH); do
-	if ${CRYPTSETUPBINARY} isLuks ${BLOCK_DEV}; then
-	  LogText "Result: Found LUKS encrypted block device: ${BLOCK_DEV}"
-	  Report "encryption[]=luks,block_device,${BLOCK_DEV}"
-	  ((FOUND++))
-	fi
-      done
-      Display --indent 2 --text "- Found ${FOUND} LUKS encrypted block devices." --result OK --color WHITE
-      unset BLOCK_DEV FOUND
+        CRYPTTABFILE="${ROOTDIR}etc/crypttab"
+        FOUND=0
+
+        # cryptsetup only works as root
+        if [ -n "${LSBLKBINARY}" -a -n "${CRYPTSETUPBINARY}" -a ${FORENSICS} -eq 0 ]; then
+            for BLOCK_DEV in $(${LSBLKBINARY} --noheadings -o PATH); do
+                if ${CRYPTSETUPBINARY} isLuks ${BLOCK_DEV}; then
+                    LogText "Result: Found LUKS encrypted block device: ${BLOCK_DEV}"
+                    Report "encryption[]=luks,block_device,${BLOCK_DEV}"
+                    FOUND=$((FOUND +1))
+                else
+                    LogText "Result: block device ${BLOCK_DEV} is not LUKS encrypted"
+                fi
+            done
+            unset BLOCK_DEV
+        # This will enable us to do a test for forensics or when crypsetup/lsblk are not available
+        elif [ -f ${CRYPTTABFILE} ]; then
+            LogText "Result: crypttab (${CRYPTTABFILE}) exists"
+            DATA=$(${GREPBINARY} "^[a-z]" ${CRYPTTABFILE} | ${TRBINARY} -cd '[:alnum:]_\-=,\n\t ' | ${SEDBINARY} 's/[[:blank:]]/__space__/g')
+            for LINE in ${DATA}; do
+                LINE=$(echo ${LINE} | ${SEDBINARY} 's/__space__/ /g')
+                if ContainsString "luks," "${LINE}"; then
+                    PARTITION=$(echo ${LINE} | ${AWKBINARY} '{print $1}' | ${AWKBINARY} -F_ '{print $1}')
+                    LogText "Result: Found LUKS encryption on partition ${PARTITION}"
+                    Report "encryption[]=luks,partition,${PARTITION}"
+                    FOUND=$((FOUND +1))
+                fi
+            done
+            unset DATA LINE PARTITION
+        fi
+
+        if [ ${FOUND} -gt 0 ]; then
+            Display --indent 2 --text "- Found ${FOUND} LUKS encrypted block devices." --result OK --color WHITE
+        fi
+        unset FOUND
     fi
 #
 #################################################################################
+
 WaitForKeyPress
 
 #

From 65f1a5e811fa4b67ed5d591e48a88a3f9532c5b2 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 21 Aug 2019 13:59:28 +0200
Subject: [PATCH 309/679] Added initial support for DevOps mode to improve
 continuous integration

---
 include/consts      |  3 ++-
 include/helper_show |  2 +-
 include/parameters  |  5 +++++
 include/report      | 12 +++++++-----
 4 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/include/consts b/include/consts
index 9235b5f4..47d1bc06 100644
--- a/include/consts
+++ b/include/consts
@@ -97,6 +97,7 @@ unset LANG
     DEBSECANBINARY=""
     DEBSUMSBINARY=""
     DEVELOPER_MODE=0
+    DEVOPS_MODE=0
     DISABLED_PLUGINS=""
     DISCOVERED_BINARIES=""
     DMIDECODEBINARY=""
@@ -114,7 +115,7 @@ unset LANG
     FIND=""
     FIREWALL_ACTIVE=0
     FOUNDPATH=0
-    FORENSICS=0
+    FORENSICS_MODE=0
     GETENT_BINARY=""
     GRADMBINARY=""
     GREPBINARY="grep"
diff --git a/include/helper_show b/include/helper_show
index 594be15b..ec5e7236 100644
--- a/include/helper_show
+++ b/include/helper_show
@@ -30,7 +30,7 @@
 
 COMMANDS="audit configure generate show update upload-only"
 HELPERS="audit configure show update"
-OPTIONS="--auditor\n--cronjob (--cron)\n--debug\n--developer\n--forensics\n--help (-h)\n--log-file\n--manpage (--man)\n--no-colors\n--no-log\n--pentest\n--profile\n--plugin-dir\n--quick (-Q)\n--quiet (-q)\n--report-file\n--reverse-colors\n--skip-plugins\n--tests\n--tests-from-category\n--tests-from-group\n--usecwd\n--upload\n--verbose\n--version (-V)\n--wait\n--warnings-only"
+OPTIONS="--auditor\n--cronjob (--cron)\n--debug\n--developer\n--devops\n--forensics\n--help (-h)\n--log-file\n--manpage (--man)\n--no-colors\n--no-log\n--pentest\n--profile\n--plugin-dir\n--quick (-Q)\n--quiet (-q)\n--report-file\n--reverse-colors\n--skip-plugins\n--tests\n--tests-from-category\n--tests-from-group\n--usecwd\n--upload\n--verbose\n--version (-V)\n--wait\n--warnings-only"
 
 SHOW_ARGS="categories changelog commands dbdir details environment eol groups help hostids includedir language license logfile man options os pidfile plugindir profiles release releasedate report settings tests version workdir"
 SHOW_HELP="lynis show ${BROWN}categories${NORMAL}              (display test categories)
diff --git a/include/parameters b/include/parameters
index 74f2c9a0..836a6aa7 100644
--- a/include/parameters
+++ b/include/parameters
@@ -241,6 +241,11 @@
                 DEVELOPER_MODE=1
             ;;
 
+            # DevOps mode (continuous integration)
+            --devops)
+                DEVOPS_MODE=1
+            ;;
+
             # Enable forensics mode (gather information from a mounted directory)
             --forensics)
                 FORENSICS=1
diff --git a/include/report b/include/report
index 1ec93ffa..815dfd03 100644
--- a/include/report
+++ b/include/report
@@ -216,16 +216,18 @@
 
             echo ""
             echo "  ${SECTION}Scan mode${NORMAL}:"
-            if [ ${FORENSICS} -eq 1 ]; then
-                echo "  Normal [ ]  Forensics [V]  Pentest [ ]"
+            if [ ${DEVOPS_MODE} -eq 1 ]; then
+                echo "  Normal [ ]  Forensics [ ]  Integration [V]  Pentest [ ]"
+            elif [ ${FORENSICS_MODE} -eq 1 ]; then
+                echo "  Normal [ ]  Forensics [V]  Integration [ ]  Pentest [ ]"
             elif [ ${PENTESTINGMODE} -eq 1 ]; then
                 if [ ${PRIVILEGED} -eq 0 ]; then
-                    echo "  Normal [ ]  Forensics [ ]  Pentest [V] (running non-privileged)"
+                    echo "  Normal [ ]  Forensics [ ]  Integration [ ]  Pentest [V] (running non-privileged)"
                 else
-                    echo "  Normal [ ]  Forensics [ ]  Pentest [V] (running privileged)"
+                    echo "  Normal [ ]  Forensics [ ]  Integration [ ]  Pentest [V] (running privileged)"
                 fi
             else
-                echo "  Normal [V]  Forensics [ ]  Pentest [ ]"
+                echo "  Normal [V]  Forensics [ ]  Integration [ ]  Pentest [ ]"
             fi
             echo ""
 

From 605e515c318811923e663a32d32a62792c4b541b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 21 Aug 2019 14:00:20 +0200
Subject: [PATCH 310/679] Updated forensics variable

---
 include/tests_crypto | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_crypto b/include/tests_crypto
index b3524599..c79de525 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -138,7 +138,7 @@
         FOUND=0
 
         # cryptsetup only works as root
-        if [ -n "${LSBLKBINARY}" -a -n "${CRYPTSETUPBINARY}" -a ${FORENSICS} -eq 0 ]; then
+        if [ -n "${LSBLKBINARY}" -a -n "${CRYPTSETUPBINARY}" -a ${FORENSICS_MODE} -eq 0 ]; then
             for BLOCK_DEV in $(${LSBLKBINARY} --noheadings -o PATH); do
                 if ${CRYPTSETUPBINARY} isLuks ${BLOCK_DEV}; then
                     LogText "Result: Found LUKS encrypted block device: ${BLOCK_DEV}"

From d3464d88b117b7fbb164c708b6a889a4391e132b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 21 Aug 2019 14:08:17 +0200
Subject: [PATCH 311/679] [CRYP-7930] changed description

---
 db/tests.db | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/db/tests.db b/db/tests.db
index 2a8ac612..5395c1b4 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -84,7 +84,7 @@ CONT-8107:test:performance:containers::Check number of unused Docker containers:
 CONT-8108:test:security:containers::Check file permissions for Docker files:
 CORE-1000:test:performance:system_integrity::Check all system binaries:
 CRYP-7902:test:security:crypto::Check expire date of SSL certificates:
-CRYP-7930:test:security:crypto::Determine if system uses disk or file encryption:
+CRYP-7930:test:security:crypto:Linux:Determine if system uses LUKS encryption:
 DNS-1600:test:security:dns::Validating that the DNSSEC signatures are checked:
 DBS-1804:test:security:databases::Checking active MySQL process:
 DBS-1816:test:security:databases::Checking MySQL root password:

From 7eba5df9b2017a57d17d9088cdffaad0ebb64593 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 21 Aug 2019 14:08:25 +0200
Subject: [PATCH 312/679] Updated log

---
 CHANGELOG.md | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b7d984ff..f9bc4fa4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,15 +6,29 @@ This is a major release of Lynis and includes several big changes.
 Some of these changes may break your current usage of the tool, so test before
 deployment!
 
-### Breaking changes
-- Some commands or switches are deprecated or removed
-- Format of all profile options converted (from key:value to key=value)
-- Non-interactive by default (use --wait option to pause between groups of tests)
+### Breaking change: Non-interactive by default
+Lynis now runs non-interactive by default, to be more in line with the Unix
+philosophy. So the previously used '--quick' option is now default, and the tool
+will only wait when using the '--wait' option.
+
+### Breaking change: Deprecated options
+- Option: -c
+- Option: --check-update/--info
+- Option: --dump-options
+- Option: --license-key
+
+### Breaking change: Profile options
+The format of all profile options are converted (from key:value to key=value).
+You may have to update the changes you made in your custom.prf.
 
 ### Security
 An important focus area for this release is on security. We added several
 measures to further tighten any possible misuse.
 
+## New: DevOps, Forensics, and pentesting mode
+This release adds initial support to allow defining a specialized type of audit.
+Using the relevant options, the scan will change base on the intended goal.
+
 ### Added
 - Security: test PATH and warn or exit on discovery of dangerous location
 - Security: additional safeguard by testing if common system tools are available
@@ -31,7 +45,7 @@ measures to further tighten any possible misuse.
 - New option: --usecwd - run from the current working directory
 - New profile option: disable-plugin - disables a single plugin
 - New profile option: ssl-certificate-paths-to-ignore - ignore a path
-- New test: CRYP-7930 - disk or file system encryption testing
+- New test: CRYP-7930 - test for LUKS encryption
 - New test: INSE-8314 - test for NIS client
 - New test: INSE-8316 - test for NIS server
 - New test: PROC-3802 - check presence of prelink tooling

From 4e39bafd7850cffc9905a1acd897b6309feadc59 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 21 Aug 2019 14:50:32 +0200
Subject: [PATCH 313/679] New function to display exceptions

---
 include/functions | 40 +++++++++++++++++++++++++++++++++++++++-
 1 file changed, 39 insertions(+), 1 deletion(-)

diff --git a/include/functions b/include/functions
index 816d0cd1..9719b0ae 100644
--- a/include/functions
+++ b/include/functions
@@ -40,6 +40,7 @@
 #    DiscoverProfiles           Determine available profiles on system
 #    Display                    Output text to screen with colors and identation
 #    DisplayError               Show an error on screen
+#    DisplayException           Show an exception on screen
 #    DisplayManual              Output text to screen without any layout
 #    DisplayToolTip             Show a tip for improving usage of the tool
 #    DisplayWarning             Show a clear warning on screen
@@ -656,6 +657,40 @@
     }
 
 
+    ################################################################################
+    # Name        : DisplayException()
+    # Description : Show a discovered exception on screen
+    #
+    # Parameters  : $1 = function or test
+    #               $2 = text
+    # Returns     : <nothing>
+    # Note        : This function is usually triggered by ReportException
+    ################################################################################
+
+    DisplayException() {
+        ${ECHOCMD:-echo} ""
+        ${ECHOCMD:-echo} "================================================================="
+        ${ECHOCMD:-echo} ""
+        ${ECHOCMD:-echo} "  ${WARNING}Exception found!${NORMAL}"
+        ${ECHOCMD:-echo} ""
+        ${ECHOCMD:-echo} "  Function/test:  [$1]"
+        ${ECHOCMD:-echo} "  Message:        ${BOLD}$2${NORMAL}"
+        ${ECHOCMD:-echo} ""
+        ${ECHOCMD:-echo} "  Help improving the Lynis community with your feedback!"
+        ${ECHOCMD:-echo} ""
+        ${ECHOCMD:-echo} "  Steps:"
+        ${ECHOCMD:-echo} "  - Ensure you are running the latest version ($0 update check)"
+        ${ECHOCMD:-echo} "  - If so, create a GitHub issue at ${PROGRAM_SOURCE}"
+        ${ECHOCMD:-echo} "  - Include relevant parts of the log file or configuration file"
+        ${ECHOCMD:-echo} ""
+        ${ECHOCMD:-echo} "  Thanks!"
+        ${ECHOCMD:-echo} ""
+        ${ECHOCMD:-echo} "================================================================="
+        ${ECHOCMD:-echo} ""
+        sleep 5
+    }
+
+
     ################################################################################
     # Name        : DisplayManual()
     # Description : Show text on screen, without any markup
@@ -1429,7 +1464,7 @@
     ################################################################################
 
     IsDeveloperVersion() {
-        if [ "${PROGRAM_RELEASE_TYPE}" = "dev" ]; then return 0; else return 1; fi
+        if [ "${PROGRAM_RELEASE_TYPE}" = "pre-release" ]; then return 0; else return 1; fi
     }
 
 
@@ -2764,6 +2799,9 @@
     ReportException() {
         Report "exception_event[]=$1|${2-NoInfo}|"
         LogText "Exception: test has an exceptional event ($1) with text ${2-NoText}"
+        if [ ${QUIET} -eq 0 ]; then
+            DisplayException "$1" "$2"
+        fi
     }
 
 

From 2c4e7711db0ab965ac78f3c3bba91162bb143e50 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 21 Aug 2019 14:51:20 +0200
Subject: [PATCH 314/679] Added CentOS and trigger an exception when a system
 has /etc/os-release but is not defined yet

---
 include/osdetection | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/include/osdetection b/include/osdetection
index e7a14a3a..de8ebdd5 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -144,24 +144,34 @@
                         "amzn")
                             LINUX_VERSION="Amazon Linux"
                             OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
-                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="Amazon Linux"
+                            OS_REDHAT_OR_CLONE=1
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                         ;;
                         "arch")
                             LINUX_VERSION="Arch Linux"
                             OS_FULLNAME="Arch Linux"
                             OS_VERSION="Rolling release"
                         ;;
+                        "centos")
+                            LINUX_VERSION="CentOS Linux"
+                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_NAME="CentOS Linux"
+                            OS_REDHAT_OR_CLONE=1
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                        ;;
                         "clear-linux-os")
                             LINUX_VERSION="Clear Linux OS"
                             OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_NAME="Clear Linux OS"
+                            OS_REDHAT_OR_CLONE=1
                             OS_VERSION="Rolling release"
                         ;;
                         "coreos")
                             LINUX_VERSION="CoreOS"
                             OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
-                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="CoreOS Linux"
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                         ;;
                         "manjaro")
                             LINUX_VERSION="Manjaro Linux"
@@ -188,7 +198,7 @@
                             OS_NAME="openSUSE"
                         ;;
                         *)
-                            Debug "Unknown OS found in /etc/os-release. Do you know what it is? Create an issue at ${PROGRAM_SOURCE}"
+                            ReportException "OS Detection" "Unknown OS found in /etc/os-release"
                         ;;
                     esac
                 fi
@@ -221,6 +231,7 @@
 
             # Cobalt
             if [ -e "/etc/cobalt-release" ]; then OS_FULLNAME=$(cat /etc/cobalt-release); fi
+
             # CPUBuilders Linux
             if [ -e "/etc/cpub-release" ]; then OS_FULLNAME=$(cat /etc/cpub-release); fi
 
@@ -268,12 +279,11 @@
             if [ -e "/etc/gentoo-release" ]; then LINUX_VERSION="Gentoo"; OS_FULLNAME=$(cat /etc/gentoo-release); fi
 
             # Red Hat and others
-            if [ -e "/etc/redhat-release" ]; then
+            if [ -z "${LINUX_VERSION}" -a -e "/etc/redhat-release" ]; then
                 OS_REDHAT_OR_CLONE=1
 
                 # CentOS
-                FIND=$(grep "CentOS" /etc/redhat-release)
-                if [ ! "${FIND}" = "" ]; then
+                if grep "CentOS" /etc/redhat-release; then
                     OS_FULLNAME=$(grep "CentOS" /etc/redhat-release)
                     LINUX_VERSION="CentOS"
                     OS_VERSION="${OS_FULLNAME}"

From 6480663e6bbf2a3a1cb287afcf13dc0903a6b767 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 21 Aug 2019 14:51:51 +0200
Subject: [PATCH 315/679] Use more clear definition: Lynis is a pre-release or
 release

---
 lynis | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lynis b/lynis
index 335e65d4..c72fc521 100755
--- a/lynis
+++ b/lynis
@@ -45,7 +45,7 @@
     # Version details
     PROGRAM_RELEASE_DATE="2019-07-14"
     PROGRAM_RELEASE_TIMESTAMP=1563094548
-    PROGRAM_RELEASE_TYPE="dev" # dev or final
+    PROGRAM_RELEASE_TYPE="pre-release" # pre-release or release
     PROGRAM_VERSION="3.0.0"
 
     # Source, documentation and license

From b7641cc16af31f5f061f66c5c3ed9540487768a9 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 21 Aug 2019 14:54:01 +0200
Subject: [PATCH 316/679] Updated log

---
 CHANGELOG.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f9bc4fa4..32b6f157 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -35,7 +35,8 @@ Using the relevant options, the scan will change base on the intended goal.
 - Security: test parameters and arguments for presence of control characters
 - Security: filtering out unexpected characters from profiles
 - Security: test if setuid bit is set on Lynis binary
-- New function: DisplayWarning - show a warning on the screen
+- New function: DisplayException
+- New function: DisplayWarning
 - New function: Equals
 - New function: GetReportData
 - New function: HasCorrectFilePermissions
@@ -91,6 +92,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - STRG-1840 - renamed to USB-1000
 - STRG-1842 - added default authorized devices and renamed to USB-2000
 - TOOL-5002 - differentiate between a discovered binary and running process
+- Use 'pre-release/release' (was: 'dev/final') with 'lynis show release'
 - Use only locations from PATH environment variable, unless it is not defined
 - Show tip to use 'lynis generate hostids' when host IDs are missing
 - The 'show changelog' command works again for newer versions
@@ -102,6 +104,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - bash completion script extended
 - Updated man page
 
+
 ---------------------------------------------------------------------------------
 
 ## Lynis 2.7.5 (2019-06-24)

From a72650252f545cafb5fe76e3138560cb2390c773 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 22 Aug 2019 14:11:22 +0200
Subject: [PATCH 317/679] When audit target is missing, stop execution

---
 include/parameters | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/include/parameters b/include/parameters
index 836a6aa7..6309481d 100644
--- a/include/parameters
+++ b/include/parameters
@@ -98,7 +98,14 @@
                             SKIP_PLUGINS=0
                             RUN_TESTS=1
                             shift
-
+                        ;;
+                        *)
+                            echo "${RED}Error: ${WHITE}Need a target to audit${NORMAL}"
+                            echo " "
+                            echo "Examples:"
+                            echo "lynis audit dockerfile"
+                            echo "lynis audit system"
+                            ExitFatal
                         ;;
                     esac
                 else

From d2deb63ebb416b957ba973a014ea6588103f3cfc Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 22 Aug 2019 14:12:53 +0200
Subject: [PATCH 318/679] Added NETW-3200

---
 CHANGELOG.md             |  1 +
 db/tests.db              |  1 +
 include/tests_networking | 59 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 61 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 32b6f157..ef1e3001 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -49,6 +49,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - New test: CRYP-7930 - test for LUKS encryption
 - New test: INSE-8314 - test for NIS client
 - New test: INSE-8316 - test for NIS server
+- New test: NETW-3200 - determine avilable network protocols
 - New test: PROC-3802 - check presence of prelink tooling
 - New report key: openssh_daemon_running
 - New command: lynis generate systemd-units
diff --git a/db/tests.db b/db/tests.db
index 5395c1b4..0eac8186 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -288,6 +288,7 @@ NETW-3015:test:security:networking:Linux:Checking promiscuous interfaces (Linux)
 NETW-3028:test:security:networking::Checking connections in WAIT state:
 NETW-3030:test:security:networking::Checking DHCP client status:
 NETW-3032:test:security:networking:Linux:Checking for ARP monitoring software:
+NETW-3200:test:security:networking::Determine available network protocols:
 PHP-2211:test:security:php::Check php.ini presence:
 PHP-2320:test:security:php::Check PHP disabled functions:
 PHP-2368:test:security:php::Check PHP register_globals option:
diff --git a/include/tests_networking b/include/tests_networking
index 53f74ec8..3da18587 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -639,6 +639,65 @@
 #
 #################################################################################
 #
+    # Test        : NETW-3200
+    # Description : Determine available network protocols
+    Register --test-no NETW-3200 --weight L --network YES --category security --description "Determine available network protocols"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        TESTED=0
+        case ${OS} in
+            Linux)
+                TESTED=1
+                LogText "Test: checking the status of some network protocols that typically are not used"
+                UNCOMMON_PROTOCOLS="dccp sctp rds tipc"
+                for P in ${UNCOMMON_PROTOCOLS}; do
+                    if ! SkipAtomicTest "${TEST_NO}:${P}"; then
+                        FOUND_UNCOMMON_PROTOCOL=0
+                        if [ -f ${ROOTDIR}etc/modprobe.conf ]; then
+                            DATA=$(${GREPBINARY} "^install ${P} /bin/true" ${ROOTDIR}etc/modprobe.conf)
+                            if [ -n "${DATA}" ]; then
+                                LogText "Result: found ${P} module loaded via modprobe.conf"
+                                FOUND_UNCOMMON_PROTOCOL=1
+                            fi
+                        fi
+                        if [ -d ${ROOTDIR}etc/modprobe.d ]; then
+                            DATA=$(${GREPBINARY} --files-with-matches --no-messages "^install ${P} /bin/true" ${ROOTDIR}etc/modprobe.d/*)
+                            if [ -n "${DATA}" ]; then
+                                FOUND_UNCOMMON_PROTOCOL=1
+                                for F in ${DATA}; do
+                                    LogText "Result: found ${P} module loaded via ${F}"
+                                done
+                            fi
+                        fi
+
+                        # Although a protocol may not been enabled using install, it can be loaded. This may be revealed using /proc
+                        #/proc/sys/net/
+
+                        if [ ${FOUND_UNCOMMON_PROTOCOL} -eq 1 ]; then
+                            ReportSuggestion "${TEST_NO}" "Determine if network protocol ${P} needs to be used on this system"
+                            Report "uncommon_network_protocol_enabled=${P}"
+                        fi
+                    fi
+                done
+
+            ;;
+            *)
+                LogText "This test has no routine yet for this operating system."
+                Debug "No routine implemented yet for this operating system to check for available network protocols"
+            ;;
+        esac
+        if [ ${TESTED} -eq 1 ]; then
+            if [ ${FOUND_UNCOMMON_PROTOCOL} -eq 1 ]; then
+                Display --indent 2 --text "- Uncommon network protocols" --result "${FOUND}" --color YELLOW
+            else
+                Display --indent 2 --text "- Uncommon network protocols" --result "${STATUS_NOT_FOUND}" --color GREEN
+            fi
+        fi
+        unset DATA F FOUND TESTED UNCOMMON_PROTOCOLS
+    fi
+#
+#################################################################################
+#
+
 
 WaitForKeyPress
 

From d703d160ff7d713f6f922db7a8e8599fb6d1e6c0 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 22 Aug 2019 14:20:30 +0200
Subject: [PATCH 319/679] Added RHEL, renamed CentOS Linux name, reordered
 items

---
 include/osdetection | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/include/osdetection b/include/osdetection
index de8ebdd5..e1f55350 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -154,7 +154,7 @@
                             OS_VERSION="Rolling release"
                         ;;
                         "centos")
-                            LINUX_VERSION="CentOS Linux"
+                            LINUX_VERSION="CentOS"
                             OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="CentOS Linux"
                             OS_REDHAT_OR_CLONE=1
@@ -174,16 +174,10 @@
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                         ;;
                         "manjaro")
-                            LINUX_VERSION="Manjaro Linux"
+                            LINUX_VERSION="Manjaro"
                             OS_FULLNAME="Manjaro Linux"
                             OS_VERSION="Rolling release"
                         ;;
-                        "ubuntu")
-                            LINUX_VERSION="Ubuntu"
-                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
-                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
-                            OS_NAME="Ubuntu Linux"
-                        ;;
                         "opensuse-tumbleweed")
                             LINUX_VERSION="openSUSE Tumbleweed"
                             OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
@@ -197,6 +191,20 @@
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="openSUSE"
                         ;;
+                        "ubuntu")
+                            LINUX_VERSION="Ubuntu"
+                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_NAME="Ubuntu Linux"
+                        ;;
+                        "rhel")
+                            LINUX_VERSION="RHEL"
+                            OS_NAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_FULLNAME="${OS_NAME} ${OS_VERSION_FULL}"
+                            OS_REDHAT_OR_CLONE=1
+                        ;;
                         *)
                             ReportException "OS Detection" "Unknown OS found in /etc/os-release"
                         ;;

From 22a7f4fd6d73ff8768377c4bf8e302196facbf3c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 26 Aug 2019 08:01:43 +0200
Subject: [PATCH 320/679] Combine multiple unsets into a single command

---
 include/tests_authentication | 2 +-
 include/tests_php            | 2 +-
 include/tests_webservers     | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 733dfc4f..05f107ae 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -696,7 +696,7 @@
         else
             Display --indent 2 --text "- PAM modules" --result "${STATUS_FOUND}" --color GREEN
         fi
-        unset DIR; unset FILE; unset FIND
+        unset DIR FILE FIND
     fi
 #
 #################################################################################
diff --git a/include/tests_php b/include/tests_php
index ef43f282..23ece909 100644
--- a/include/tests_php
+++ b/include/tests_php
@@ -147,7 +147,7 @@
             Display --indent 2 --text "- Checking PHP" --result "${STATUS_NOT_FOUND}" --color WHITE
             LogText "Result: no php.ini file found"
         fi
-        unset DIR; unset FILE; unset FIND
+        unset DIR FILE FIND
     fi
 #
 #################################################################################
diff --git a/include/tests_webservers b/include/tests_webservers
index be78fb11..1e893f26 100644
--- a/include/tests_webservers
+++ b/include/tests_webservers
@@ -600,7 +600,7 @@
                 LogText "Result: directory ${DIR} not found, skipping search in this directory."
             fi
         done
-        unset DIR; unset FILE; unset FIND
+        unset DIR FILE FIND
     fi
 #
 #################################################################################

From f89aa984087c2e22582aa5185855c0e4b5522fb6 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 26 Aug 2019 08:02:11 +0200
Subject: [PATCH 321/679] Added FINT-4316

---
 db/tests.db                  |  1 +
 include/tests_file_integrity | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/db/tests.db b/db/tests.db
index 0eac8186..f7460e6e 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -121,6 +121,7 @@ FILE-7524:test:security:file_permissions::Perform file permissions check:
 FINT-4310:test:security:file_integrity::AFICK availability:
 FINT-4314:test:security:file_integrity::AIDE availability:
 FINT-4315:test:security:file_integrity::Check AIDE configuration file:
+FINT-4316:test:security:file_integirty::Presence of AIDE database and size check:
 FINT-4318:test:security:file_integrity::Osiris availability:
 FINT-4322:test:security:file_integrity::Samhain availability:
 FINT-4326:test:security:file_integrity::Tripwire availability:
diff --git a/include/tests_file_integrity b/include/tests_file_integrity
index 55d95b37..8f97d8c2 100644
--- a/include/tests_file_integrity
+++ b/include/tests_file_integrity
@@ -98,6 +98,38 @@
     fi
 #
 #################################################################################
+#
+    # Test        : FINT-4316
+    # Description : Presence of AIDE database and size check
+    if [ -n "${AIDEBINARY}" -a -n "${AIDECONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no FINT-4316 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Presence of AIDE database and size check"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        AIDE_DB=$(${GREPBINARY} ^database= ${AIDECONFIG} | ${SEDBINARY} "s/.*://")
+        if case ${AIDE_DB} in @@*) ;; *) false;; esac; then
+            I=$(${GREPBINARY} "@@define.*DBDIR" ${AIDECONFIG} | ${AWKBINARY} '{print $3}')
+            AIDE_DB=$(echo ${AIDE_DB} | ${SEDBINARY} "s#.*}#${I}#")
+        fi
+        LogText "Test: search for AIDE database on disk ${AIDE_DB}"
+
+        if [ ! -e "${AIDE_DB}" ]; then
+            Display --indent 6 --text "- AIDE database" --result "${STATUS_NOT_FOUND}" --color RED
+            LogText "Result: AIDE database ${AIDE_DB} does not exist"
+            ReportWarning "${TEST_NO}" "No AIDE database was found, needed for AIDE functionality"
+        else
+            LogText "Checking database size ${AIDE_DB}"
+            if [ -s "${AIDE_DB}" ]; then
+                Display --indent 6 --text "- AIDE database" --result "${STATUS_FOUND}" --color GREEN
+                LogText "Result: AIDE database ${AIDE_DB} exist and has a size greater than zero"
+            else
+                Display --indent 6 --text "- AIDE database" --result "${STATUS_WARNING}" --color YELLOW
+                LogText "Result: AIDE database ${AIDE_DB} exist but has a size of zero"
+                ReportSuggestion "${TEST_NO}" "Check the AIDE database as it may contain errors"
+            fi
+        fi
+        unset AIDE_DB I
+    fi
+#
+#################################################################################
 #
     # Test        : FINT-4318
     # Description : Check if Osiris is installed

From aa58736bd55207f0fc5cbb37dcab69c922983068 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 26 Aug 2019 20:26:23 +0200
Subject: [PATCH 322/679] Updated log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ef1e3001..20247348 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -47,6 +47,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - New profile option: disable-plugin - disables a single plugin
 - New profile option: ssl-certificate-paths-to-ignore - ignore a path
 - New test: CRYP-7930 - test for LUKS encryption
+- New test: FINT-4316 - presence of AIDE database and size test
 - New test: INSE-8314 - test for NIS client
 - New test: INSE-8316 - test for NIS server
 - New test: NETW-3200 - determine avilable network protocols
@@ -67,6 +68,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - Security: the 'nounset' (set -u) parameter is now activated by default
 - AUTH-9266 - skip .pam-old files in /etc/pam.d
 - AUTH-9408 - added support for pam_tally2 to log failed logins
+- CONT-8106 - support newer 'docker info' output
 - FILE-7524 - optimized file permissions testing
 - FINT-4328 - corrected text in log
 - FINT-4334 - improved process detection for lfd

From 7469b4aa7229bfe96e0620bfd0268d5e9dc71843 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 26 Aug 2019 20:27:00 +0200
Subject: [PATCH 323/679] [CONT-8106] support for newer 'docker info' output
 that includes additional space

---
 include/tests_containers | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_containers b/include/tests_containers
index fb570fdb..cda52da7 100644
--- a/include/tests_containers
+++ b/include/tests_containers
@@ -137,7 +137,7 @@
 
         # Check total of containers
         LogText "Test: checking total amount of Docker containers"
-        DOCKER_CONTAINERS_TOTAL=$(${DOCKERBINARY} info 2> /dev/null | ${GREPBINARY} "^Containers: " | ${AWKBINARY} '{ print $2 }')
+        DOCKER_CONTAINERS_TOTAL=$(${DOCKERBINARY} info 2> /dev/null | ${EGREPBINARY} "^[ \t]?Containers: " | ${AWKBINARY} '{ print $2 }')
         if [ -z "${DOCKER_CONTAINERS_TOTAL}" ]; then
             DOCKER_CONTAINERS_TOTAL=0
         fi

From 61404c1bf335c5a1f3a82267346346446589868f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 28 Aug 2019 15:36:59 +0200
Subject: [PATCH 324/679] [TOOL-5160] added support for OSSEC agent daemon

---
 include/tests_tooling | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/include/tests_tooling b/include/tests_tooling
index 2090e99e..15fa3540 100644
--- a/include/tests_tooling
+++ b/include/tests_tooling
@@ -375,17 +375,29 @@
 #
     # Test        : TOOL-5160
     # Description : Check for OSSEC
-    Register --test-no TOOL-5126 --weight L --network NO --category security --description "Check for active OSSEC analysis daemon"
+    Register --test-no TOOL-5126 --weight L --network NO --category security --description "Check for active OSSEC daemon"
     if [ ${SKIPTEST} -eq 0 ]; then
-
+        # Server side
         if IsRunning "ossec-analysisd"; then
             IDS_IPS_TOOL_FOUND=1
-            LogText "Result: OSSEC analysis daemon is active"
             Report "ids_ips_tooling[]=ossec"
-            Display --indent 2 --text "- Checking presence of OSSEC" --result "${STATUS_FOUND}" --color GREEN
+            Report "ids_ips_tooling[]=ossec-analysisd"
+            LogText "Result: OSSEC analysis daemon is active"
+            Display --indent 2 --text "- Checking presence of OSSEC (analysis)" --result "${STATUS_FOUND}" --color GREEN
         else
             LogText "Result: OSSEC analysis daemon not active"
         fi
+
+        # Client side
+        if IsRunning "ossec-agentd"; then
+            IDS_IPS_TOOL_FOUND=1
+            Report "ids_ips_tooling[]=ossec"
+            Report "ids_ips_tooling[]=ossec-agentd"
+            LogText "Result: OSSEC agent daemon is active"
+            Display --indent 2 --text "- Checking presence of OSSEC (agent)" --result "${STATUS_FOUND}" --color GREEN
+        else
+            LogText "Result: OSSEC agent daemon not active"
+        fi
     fi
 #
 #################################################################################

From 1e4e00adeaef0b119c6831c3cd8a1aa5b47e64b9 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 28 Aug 2019 15:37:35 +0200
Subject: [PATCH 325/679] Changed description of TOOL-5160

---
 db/tests.db | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/db/tests.db b/db/tests.db
index f7460e6e..dea85fba 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -406,7 +406,7 @@ TOOL-5102:test:security:tooling::Check for presence of Fail2ban:
 TOOL-5104:test:security:tooling::Enabled tests for Fail2ban:
 TOOL-5120:test:security:tooling::Presence of Snort IDS:
 TOOL-5122:test:security:tooling::Snort IDS configuration file:
-TOOL-5160:test:security:tooling::Check for active OSSEC analysis daemon:
+TOOL-5160:test:security:tooling::Check for active OSSEC daemon:
 TOOL-5190:test:security:tooling::Check presence of available IDS/IPS tooling:
 USB-1000:test:security:storage:Linux:Check if USB storage is disabled:
 USB-2000:test:security:storage:Linux:Check USB authorizations:

From a8898607987758a0854df9cc68a4bc0a4cd38d90 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 28 Aug 2019 15:37:49 +0200
Subject: [PATCH 326/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 20247348..e428ec83 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -95,6 +95,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - STRG-1840 - renamed to USB-1000
 - STRG-1842 - added default authorized devices and renamed to USB-2000
 - TOOL-5002 - differentiate between a discovered binary and running process
+- TOOL-5160 - added support for OSSEC agent daemon
 - Use 'pre-release/release' (was: 'dev/final') with 'lynis show release'
 - Use only locations from PATH environment variable, unless it is not defined
 - Show tip to use 'lynis generate hostids' when host IDs are missing

From 4932ab835150827e6274c114097152cf7bd90714 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 28 Aug 2019 15:43:10 +0200
Subject: [PATCH 327/679] Disabled suggestion for now, as some people will just
 install a suggested tool to comply instead of determining if it really makes
 sense. So this suggestion requires more explanation before people turning it
 on. Also, promisc mode may be impacted, so users see a new issue show up
 while they just resolved another.

---
 include/tests_networking | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_networking b/include/tests_networking
index 3da18587..a04fe393 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -633,7 +633,7 @@
             Display --indent 2 --text "- Checking for ARP monitoring software" --result "${STATUS_RUNNING}" --color GREEN
         else
             Display --indent 2 --text "- Checking for ARP monitoring software" --result "${STATUS_NOT_FOUND}" --color YELLOW
-            ReportSuggestion "${TEST_NO}" "Consider running ARP monitoring software (addrwatch,arpwatch,arpon)"
+            #ReportSuggestion "${TEST_NO}" "Consider running ARP monitoring software (addrwatch,arpwatch,arpon)"
         fi
     fi
 #

From a87c2b10f9ce15d51344c8531e143bbc52a106e7 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 29 Aug 2019 10:39:43 +0200
Subject: [PATCH 328/679] Added CRYP-8002

---
 CHANGELOG.md         |  1 +
 db/tests.db          |  1 +
 include/tests_crypto | 23 +++++++++++++++++++++++
 3 files changed, 25 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e428ec83..fa3d7cb4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -69,6 +69,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - AUTH-9266 - skip .pam-old files in /etc/pam.d
 - AUTH-9408 - added support for pam_tally2 to log failed logins
 - CONT-8106 - support newer 'docker info' output
+- CRYP-8002 - gather kernel entropy on Linux systems
 - FILE-7524 - optimized file permissions testing
 - FINT-4328 - corrected text in log
 - FINT-4334 - improved process detection for lfd
diff --git a/db/tests.db b/db/tests.db
index dea85fba..77ec7fbb 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -85,6 +85,7 @@ CONT-8108:test:security:containers::Check file permissions for Docker files:
 CORE-1000:test:performance:system_integrity::Check all system binaries:
 CRYP-7902:test:security:crypto::Check expire date of SSL certificates:
 CRYP-7930:test:security:crypto:Linux:Determine if system uses LUKS encryption:
+CRYP-8002:test:security:crypto:Linux:Gather kernel entropy:
 DNS-1600:test:security:dns::Validating that the DNSSEC signatures are checked:
 DBS-1804:test:security:databases::Checking active MySQL process:
 DBS-1816:test:security:databases::Checking MySQL root password:
diff --git a/include/tests_crypto b/include/tests_crypto
index c79de525..cf6e0e48 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -149,6 +149,7 @@
                 fi
             done
             unset BLOCK_DEV
+
         # This will enable us to do a test for forensics or when crypsetup/lsblk are not available
         elif [ -f ${CRYPTTABFILE} ]; then
             LogText "Result: crypttab (${CRYPTTABFILE}) exists"
@@ -172,6 +173,28 @@
     fi
 #
 #################################################################################
+#
+    # Test        : CRYP-8002
+    # Description : Gather available kernel entropy
+    Register --test-no CRYP-8002 --os Linux --weight L --network NO --root-only NO --category security --description "Gather available kernel entropy"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        if [ -f ${ROOTDIR}proc/sys/kernel/random/entropy_avail ]; then
+            DATA=$(${AWKBINARY} '$1 ~ /^[0-9]+$/ {print $1}' ${ROOTDIR}proc/sys/kernel/random/entropy_avail)
+            if [ -n "${DATA}" ]; then
+                LogText "Result: found kernel entropy value of ${DATA}"
+                Report "kernel_entropy=${DATA}"
+                if [ ${DATA} -gt 200 ]; then
+                    Display --indent 2 --text "- Kernel entropy is sufficient" --result "${STATUS_YES}" --color GREEN
+                else
+                    Display --indent 2 --text "- Kernel entropy is sufficient" --result "${STATUS_NO}" --color YELLOW
+                    # TODO - enable suggestion when information on website is available
+                fi
+            fi
+        fi
+    fi
+#
+#################################################################################
+#
 
 WaitForKeyPress
 

From 0d58ee77a05d15675bc011244c600293a6ec3cbc Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 2 Sep 2019 19:20:16 +0200
Subject: [PATCH 329/679] [CRYP-7930] replaced incorrect PATH column with
 alternative

---
 include/tests_crypto | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_crypto b/include/tests_crypto
index cf6e0e48..b5f3c7be 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -139,7 +139,7 @@
 
         # cryptsetup only works as root
         if [ -n "${LSBLKBINARY}" -a -n "${CRYPTSETUPBINARY}" -a ${FORENSICS_MODE} -eq 0 ]; then
-            for BLOCK_DEV in $(${LSBLKBINARY} --noheadings -o PATH); do
+            for BLOCK_DEV in $(${LSBLKBINARY} --noheadings --list --paths -o NAME); do
                 if ${CRYPTSETUPBINARY} isLuks ${BLOCK_DEV}; then
                     LogText "Result: Found LUKS encrypted block device: ${BLOCK_DEV}"
                     Report "encryption[]=luks,block_device,${BLOCK_DEV}"

From 9041517e2a53ea137a2a2c0f570bc5dc0501c8e9 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 3 Sep 2019 10:06:26 +0200
Subject: [PATCH 330/679] Added Debian and standardized others

---
 include/osdetection | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/include/osdetection b/include/osdetection
index e1f55350..3e4b8610 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -173,9 +173,17 @@
                             OS_NAME="CoreOS Linux"
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                         ;;
+                        "debian")
+                            LINUX_VERSION="Debian"
+                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_NAME="Debian"
+                        ;;
                         "manjaro")
                             LINUX_VERSION="Manjaro"
                             OS_FULLNAME="Manjaro Linux"
+                            OS_NAME="Manjaro"
                             OS_VERSION="Rolling release"
                         ;;
                         "opensuse-tumbleweed")
@@ -195,7 +203,8 @@
                             LINUX_VERSION="Ubuntu"
                             OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
-                            OS_NAME="Ubuntu Linux"
+                            OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_NAME="Ubuntu"
                         ;;
                         "rhel")
                             LINUX_VERSION="RHEL"

From b8c3c55d6868634f5a536c33a59c3c7bab0f34bb Mon Sep 17 00:00:00 2001
From: 2*yo <yohann@lepage.info>
Date: Tue, 3 Sep 2019 10:41:13 +0200
Subject: [PATCH 331/679] Add Debian EOL

---
 db/software-eol.db | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/db/software-eol.db b/db/software-eol.db
index 87f5a065..4d40d6d3 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -69,3 +69,12 @@ os:Slackware Linux 12.2:2013-12-09:1386540000:
 os:Slackware Linux 13.0:2018-07-05:1530738000:
 os:Slackware Linux 13.1:2018-07-05:1530738000:
 os:Slackware Linux 13.37:2018-07-05:1530738000:
+#
+# Debian - https://wiki.debian.org/DebianReleases#Production_Releases
+#
+os:Debian 5.0:2012-02-06:1328482800
+os:Debian 6.0:2016-02-29:1456700400
+os:Debian 7:2018-05-31:1527717600
+os:Debian 8:2020-06-30:1593468000
+os:Debian 9:2022-01-01:1640991600
+os:Debian 10:2022-01-01:1640991600

From b3cb6e91f057db77a875e70d2e523a07a01f2f33 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 3 Sep 2019 10:55:05 +0200
Subject: [PATCH 332/679] Ordering of entries

---
 db/software-eol.db | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/db/software-eol.db b/db/software-eol.db
index 4d40d6d3..0c185153 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -24,6 +24,15 @@ os:CentOS release 5:2017-03-31:1490911200:
 os:CentOS release 6:2020-11-30:1606690800:
 os:CentOS Linux release 7:2024-06-30:1719698400:
 #
+# Debian - https://wiki.debian.org/DebianReleases#Production_Releases
+#
+os:Debian 5.0:2012-02-06:1328482800:
+os:Debian 6.0:2016-02-29:1456700400:
+os:Debian 7:2018-05-31:1527717600:
+os:Debian 8:2020-06-30:1593468000:
+os:Debian 9:2022-01-01:1640991600:
+os:Debian 10:2022-01-01:1640991600:
+#
 # FreeBSD - https://www.freebsd.org/security/unsupported.html
 #
 os:FreeBSD 9.3:2014-12-31:0:
@@ -69,12 +78,3 @@ os:Slackware Linux 12.2:2013-12-09:1386540000:
 os:Slackware Linux 13.0:2018-07-05:1530738000:
 os:Slackware Linux 13.1:2018-07-05:1530738000:
 os:Slackware Linux 13.37:2018-07-05:1530738000:
-#
-# Debian - https://wiki.debian.org/DebianReleases#Production_Releases
-#
-os:Debian 5.0:2012-02-06:1328482800
-os:Debian 6.0:2016-02-29:1456700400
-os:Debian 7:2018-05-31:1527717600
-os:Debian 8:2020-06-30:1593468000
-os:Debian 9:2022-01-01:1640991600
-os:Debian 10:2022-01-01:1640991600

From 0088593506138b54f6edcabf995fdaac5cbeee9a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 3 Sep 2019 10:55:14 +0200
Subject: [PATCH 333/679] Updated log

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fa3d7cb4..bd99d253 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -56,7 +56,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - New command: lynis generate systemd-units
 - Measure timing of tests and report slow tests (10+ seconds)
 - Initial support for Clear Linux OS
-- Added end-of-life data of Arch Linux
+- Added end-of-life data for Arch Linux and Debian
 - Detection and end-of-life data added for Amazon Linux
 
 ### Changed

From b30df4261d0b21fc57f61f333ee362f9db1d3a13 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 10 Sep 2019 14:51:25 +0200
Subject: [PATCH 334/679] Also prevent showing tool tip when quiet mode is used

---
 lynis | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/lynis b/lynis
index c72fc521..32372a37 100755
--- a/lynis
+++ b/lynis
@@ -1108,7 +1108,12 @@ ${NORMAL}
     LogText "Program ended successfully"
     LogText "================================================================================"
 
-    if [ -z "${CUSTOM_PROFILE}" ]; then DisplayToolTip "Enhance ${PROGRAM_NAME} audits by adding your settings to custom.prf (see ${DEFAULT_PROFILE} for all settings)"; fi
+    # Tool tips
+
+    if [ ${QUIET} -eq 0 ]; then
+
+        if [ -z "${CUSTOM_PROFILE}" ]; then DisplayToolTip "Enhance ${PROGRAM_NAME} audits by adding your settings to custom.prf (see ${DEFAULT_PROFILE} for all settings)"; fi
+    fi
 
     # Clean exit (Delete PID file)
     if [ ${TOTAL_WARNINGS} -gt 0 ]; then

From fbcfab1adcf9be5e034790fe60eb9a7456518ce5 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 10 Sep 2019 14:52:20 +0200
Subject: [PATCH 335/679] [LOGG-2154] support new-style rsyslog configuration
 for remote targets

---
 include/tests_logging | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/include/tests_logging b/include/tests_logging
index 8e299ad0..7b370681 100644
--- a/include/tests_logging
+++ b/include/tests_logging
@@ -368,9 +368,7 @@
                     F=$(echo ${F} | ${SEDBINARY} 's/:space:/ /g')
                     LogText "Test: analyzing file ${F} for remote target"
                     DATA=$(${EGREPBINARY} "@@?([a-zA-Z0-9\-])+(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?" ${F} | ${GREPBINARY} -v "#" | ${TRBINARY} -cd "[:print:]\n" | ${SEDBINARY} 's/[[:blank:]]\{1,\}/:space:/g')
-                    if [ -z "${DATA}" ]; then
-                        LogText "Result: no remote target found"
-                    else
+                    if [ -n "${DATA}" ]; then
                         LogText "Result: found remote target"
                         REMOTE_LOGGING_ENABLED=1
                         for D in ${DATA}; do
@@ -379,6 +377,15 @@
                                 LogText "Data: ${D}"
                             fi
                         done
+                    else
+                        # Check new style configuration (omrelp/omfwd). This can be all on one line or even split over multiple lines.
+                        DATA=$(${EGREPBINARY} "target=\"([a-zA-Z0-9\-])" ${F})
+                        if [ -n "${DATA}" ]; then
+                            LogText "Result: most likely remote log host is used, as keyword 'target' is used"
+                            REMOTE_LOGGING_ENABLED=1
+                        else
+                            LogText "Result: no remote target found"
+                        fi
                     fi
                 done
             fi
@@ -412,11 +419,13 @@
 
         # Show result
         if [ ${REMOTE_LOGGING_ENABLED} -eq 0 ]; then
+            Report "remote_syslog_configured=0"
             LogText "Result: no remote logging found"
             ReportSuggestion ${TEST_NO} "Enable logging to an external logging host for archiving purposes and additional protection"
             AddHP 1 3
             Display --indent 2 --text "- Checking remote logging" --result "NOT ENABLED" --color YELLOW
         else
+            Report "remote_syslog_configured=1"
             AddHP 5 5
             Display --indent 2 --text "- Checking remote logging" --result "${STATUS_ENABLED}" --color GREEN
         fi

From 0fc887e830fa9b6779d1ee1129db0e8e64271e67 Mon Sep 17 00:00:00 2001
From: lowkey <dvehrs@gmail.com>
Date: Wed, 11 Sep 2019 10:47:28 -0600
Subject: [PATCH 336/679] Removed WARNINGs from unset certificate and private
 key

---
 include/tests_mail_messaging | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/include/tests_mail_messaging b/include/tests_mail_messaging
index 76c78dad..088ee371 100644
--- a/include/tests_mail_messaging
+++ b/include/tests_mail_messaging
@@ -137,28 +137,28 @@
                 LogText "Result: ${EXIM_CERTIFICATE}"
                 if [ -f "${EXIM_CERTIFICATE}" ]; then
                     Display --indent 4 --text "- Certificate" --result "${STATUS_FOUND}" --color GREEN
-                    LogText "Result: Certificate found."
+                    LogText "Result: Certificate found"
                 else
                     Display --indent 4 --text "- Certificate" --result "${STATUS_NOT_FOUND}" --color YELLOW
-                    LogText "Result: Certificate not found."
+                    LogText "Result: Certificate not found"
                 fi
             else
-                LogText "Result: Certificate not set."
-                Display --indent 4 --text "- Certificate not set" --result "${STATUS_WARNING}" --color WHITE
+                LogText "Result: Certificate not set"
+                Display --indent 4 --text "- Certificate" --result "Not Configured" --color WHITE
             fi
 
             if [ -n "${EXIM_PRIVATEKEY}" ]; then
                 LogText "Result: ${EXIM_PRIVATEKEY}"
                 if [ -f "${EXIM_PRIVATEKEY}" ]; then
-                    LogText "Result: Private Key found."
+                    LogText "Result: Private Key found"
                     Display --indent 4 --text "- Private Key" --result "${STATUS_FOUND}" --color GREEN
                 else
                     Display --indent 4 --text "- Private Key" --result "${STATUS_NOT_FOUND}" --color YELLOW
-                    LogText "Result: Private Key not found."
+                    LogText "Result: Private Key not found"
                 fi
             else
-                LogText "Result: Private Key not set."
-                Display --indent 4 --text "- Private Key not set" --result "${STATUS_WARNING}" --color WHITE
+                LogText "Result: Private Key not set"
+                Display --indent 4 --text "- Private Key" --result "Not Configured" --color WHITE
             fi
 
             LogText "Test: Exim Verify Certificates"
@@ -204,35 +204,33 @@
 
             LogText "Test: Exim Try Verify Hosts"
             if [ ! -z "${EXIM_TRY_VERIFY_HOSTS}" ]; then
+                LogText "Result: Try Verify Hosts enabled"
                 case "${EXIM_TYPE}" in
                     "INTERNET HOST" )
-                        LogText "Result: Try Verify Hosts enabled."
                         Display --indent 4 --text "- Try Verify Hosts" --result "ENABLED" --color GREEN
                         ;;
                     "SATELLITE" | "SMARTHOST" )
-                        LogText "Result: Try Verify Hosts."
                         Display --indent 4 --text "- Try Verify Hosts" --result "ENABLED" --color YELLOW
                         ;;
                 esac
             else
-                LogText "Result: Try Verify Hosts not enabled."
+                LogText "Result: Try Verify Hosts not enabled"
                 Display --indent 4 --text "- Try Verify Hosts" --result "NOT ENABLED" --color WHITE
             fi
 
             LogText "Test: Exim Verify Hosts"
             if [ ! -z "${EXIM_VERIFY_HOSTS}" ]; then
+                LogText "Result: Verify Hosts enabled"
                 case "${EXIM_TYPE}" in
                     "INTERNET HOST" )
-                        LogText "Result: Verify Hosts."
                         Display --indent 4 --text "- Verify Hosts" --result "ENABLED" --color YELLOW
                         ;;
                     "SATELLITE" | "SMARTHOST" )
-                        LogText "Result: Verify Hosts."
                         Display --indent 4 --text "- Verify Hosts" --result "ENABLED" --color GREEN
                         ;;
                 esac
             else
-                LogText "Result: Verify Hosts."
+                LogText "Result: Verify Hosts not enabled"
                 Display --indent 4 --text "- Verify Hosts" --result "NOT ENABLED" --color WHITE
             fi
         fi

From fa9fdd4322ec9677ef9705b48954ea76c7015b6e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 12 Sep 2019 11:13:39 +0200
Subject: [PATCH 337/679] [MAIL-8804] replaced static strings with
 translation-aware strings

---
 include/tests_mail_messaging | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/include/tests_mail_messaging b/include/tests_mail_messaging
index 088ee371..a8d33398 100644
--- a/include/tests_mail_messaging
+++ b/include/tests_mail_messaging
@@ -94,7 +94,7 @@
             Display --indent 4 --text "- Type" --result "${EXIM_TYPE}" --color GREEN
         else
             LogText "Result: Exim Type - Not Configured"
-            Display --indent 4 --text "- Type" --result "Not Configured" --color WHITE
+            Display --indent 4 --text "- Type" --result "${STATUS_NOT_CONFIGURED}" --color WHITE
         fi
 
         if [ "${EXIM_TYPE}" = "INTERNET HOST" -o "${EXIM_TYPE}" = "SMARTHOST" ]; then
@@ -112,10 +112,10 @@
             EXIM_TLS=$(${EXIMBINARY} -bP tls_advertise_hosts | ${CUTBINARY} -d '=' -f2 | ${SEDBINARY} -e 's/^\s*//' -e 's/\s*$//')
             if [ -n "${EXIM_TLS}" ]; then
                 LogText "Result: Enabled"
-                Display --indent 4 --text "- TLS" --result "ENABLED" --color GREEN
+                Display --indent 4 --text "- TLS" --result "${STATUS_ENABLED}" --color GREEN
             else
                 LogText "Result: Not enabled"
-                Display --indent 4 --text "- TLS" --result "NOT ENABLED" --color WHITE
+                Display --indent 4 --text "- TLS" --result "${STATUS_DISABLED}" --color WHITE
             fi
         fi
 
@@ -144,7 +144,7 @@
                 fi
             else
                 LogText "Result: Certificate not set"
-                Display --indent 4 --text "- Certificate" --result "Not Configured" --color WHITE
+                Display --indent 4 --text "- Certificate" --result "${STATUS_NOT_CONFIGURED}" --color WHITE
             fi
 
             if [ -n "${EXIM_PRIVATEKEY}" ]; then
@@ -158,7 +158,7 @@
                 fi
             else
                 LogText "Result: Private Key not set"
-                Display --indent 4 --text "- Private Key" --result "Not Configured" --color WHITE
+                Display --indent 4 --text "- Private Key" --result "${STATUS_NOT_CONFIGURED}" --color WHITE
             fi
 
             LogText "Test: Exim Verify Certificates"
@@ -207,15 +207,15 @@
                 LogText "Result: Try Verify Hosts enabled"
                 case "${EXIM_TYPE}" in
                     "INTERNET HOST" )
-                        Display --indent 4 --text "- Try Verify Hosts" --result "ENABLED" --color GREEN
+                        Display --indent 4 --text "- Try Verify Hosts" --result "${STATUS_ENABLED}" --color GREEN
                         ;;
                     "SATELLITE" | "SMARTHOST" )
-                        Display --indent 4 --text "- Try Verify Hosts" --result "ENABLED" --color YELLOW
+                        Display --indent 4 --text "- Try Verify Hosts" --result "${STATUS_ENABLED}" --color YELLOW
                         ;;
                 esac
             else
                 LogText "Result: Try Verify Hosts not enabled"
-                Display --indent 4 --text "- Try Verify Hosts" --result "NOT ENABLED" --color WHITE
+                Display --indent 4 --text "- Try Verify Hosts" --result "${STATUS_DISABLED}" --color WHITE
             fi
 
             LogText "Test: Exim Verify Hosts"
@@ -223,15 +223,15 @@
                 LogText "Result: Verify Hosts enabled"
                 case "${EXIM_TYPE}" in
                     "INTERNET HOST" )
-                        Display --indent 4 --text "- Verify Hosts" --result "ENABLED" --color YELLOW
+                        Display --indent 4 --text "- Verify Hosts" --result "${STATUS_ENABLED}" --color YELLOW
                         ;;
                     "SATELLITE" | "SMARTHOST" )
-                        Display --indent 4 --text "- Verify Hosts" --result "ENABLED" --color GREEN
+                        Display --indent 4 --text "- Verify Hosts" --result "${STATUS_ENABLED}" --color GREEN
                         ;;
                 esac
             else
                 LogText "Result: Verify Hosts not enabled"
-                Display --indent 4 --text "- Verify Hosts" --result "NOT ENABLED" --color WHITE
+                Display --indent 4 --text "- Verify Hosts" --result "${STATUS_DISABLED}" --color WHITE
             fi
         fi
     fi

From 157c23e892596e200dee974c8732f0abb73c27a9 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 12 Sep 2019 11:14:44 +0200
Subject: [PATCH 338/679] Added additional string

---
 db/languages/en | 1 +
 1 file changed, 1 insertion(+)

diff --git a/db/languages/en b/db/languages/en
index 34e7f63e..716a584c 100644
--- a/db/languages/en
+++ b/db/languages/en
@@ -31,6 +31,7 @@ STATUS_OK="OK"
 STATUS_ON="ON"
 STATUS_NO="NO"
 STATUS_NONE="NONE"
+STATUS_NOT_CONFIGURED="NOT CONFIGURED"
 STATUS_NOT_FOUND="NOT FOUND"
 STATUS_NOT_RUNNING="NOT RUNNING"
 STATUS_RUNNING="RUNNING"

From 79e5b52419543b0a7451e8decc8857319dcc4d40 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 12 Sep 2019 11:17:18 +0200
Subject: [PATCH 339/679] [SSH-7408] added forced-commands-only

---
 include/tests_ssh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_ssh b/include/tests_ssh
index 377d043f..7683b0a7 100644
--- a/include/tests_ssh
+++ b/include/tests_ssh
@@ -143,7 +143,7 @@
                 LogLevel:VERBOSE,INFO,:=\
                 MaxAuthTries:3,6,999:<\
                 MaxSessions:2,4,8:<\
-                PermitRootLogin:(NO|PROHIBIT-PASSWORD|WITHOUT-PASSWORD),,YES:=\
+                PermitRootLogin:(FORCED-COMMANDS-ONLY|NO|PROHIBIT-PASSWORD|WITHOUT-PASSWORD),,YES:=\
                 PermitUserEnvironment:NO,,YES:=\
                 PermitTunnel:NO,,YES:=\
                 Port:,,22:!\

From ca5216caf9abb4a757573c04da8a6dccff376359 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 12 Sep 2019 11:17:56 +0200
Subject: [PATCH 340/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bd99d253..f290bb33 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -93,6 +93,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - SSH-7402 - detect other SSH daemons like dropbear
 - SSH-7406 - strip OpenSSH patch version and remove characters (carriage return)
 - SSH-7408 - changed text in suggestion and report
+- SSH-7408 - added forced-commands-only option
 - STRG-1840 - renamed to USB-1000
 - STRG-1842 - added default authorized devices and renamed to USB-2000
 - TOOL-5002 - differentiate between a discovered binary and running process

From b7445e8d64bd8149f1899782033b73364725053a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 12 Sep 2019 11:18:37 +0200
Subject: [PATCH 341/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f290bb33..0435014b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -82,6 +82,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - INSE-8342 - renamed to INSE-8304
 - KRNL-5820 - extended check to include limits.d directory
 - LOGG-2154 - added support for rsyslog configurations
+- MAIL-8804 - replaced static strings with translation-aware strings
 - NAME-4402 - check if /etc/hosts exists before performing test
 - NAME-4404 - improved screen and log output
 - NAME-4408 - corrected Report function call

From ca0239b4d9d973cf51ab311a395a5637305c40b9 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 12 Sep 2019 16:34:45 +0200
Subject: [PATCH 342/679] [FILE-6374] corrected defaults flag, added root
 directory, and changed logging

---
 include/tests_filesystems | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/include/tests_filesystems b/include/tests_filesystems
index ac0c1d3c..8efa97c9 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -566,7 +566,7 @@
     FILESYSTEMS_TO_CHECK="/boot:nodev,noexec,nosuid /dev/shm:nosuid,nodev,noexec /home:nodev,nosuid /tmp:nodev,noexec,nosuid /var:nosuid /var/log:nodev,noexec,nosuid /var/log/audit:nodev,noexec,nosuid /var/tmp:nodev,noexec,nosuid"
     Register --test-no FILE-6374 --os Linux --weight L --network NO --category security --description "Checking partitions mount options"
     if [ ${SKIPTEST} -eq 0 ]; then
-        if [ -f /etc/fstab ]; then
+        if [ -f ${ROOTDIR}etc/fstab ]; then
             for I in ${FILESYSTEMS_TO_CHECK}; do
                 FILESYSTEM=$(echo ${I} | ${CUTBINARY} -d: -f1)
                 EXPECTED_FLAGS=$(echo ${I} | ${CUTBINARY} -d: -f2 | ${SEDBINARY} 's/,/ /g')
@@ -578,7 +578,8 @@
                     fi
                 fi
                 if [ -n "${FS_FSTAB}" ]; then
-                    FOUND_FLAGS=$(${AWKBINARY} -v fs=${FILESYSTEM} '{ if ($2==fs) { print $4 } }' ${ROOTDIR}etc/fstab | ${SEDBINARY} 's/,/ /g' | ${TRBINARY} '\n' ' ')
+                    # In awk using caret/circumflex as first character between brackets, means 'not' (instead of beginning of line)
+                    FOUND_FLAGS=$(${AWKBINARY} -v fs=${FILESYSTEM} '{ if ($1~"[^#]" && $2==fs) { print $4 } }' ${ROOTDIR}etc/fstab | ${SEDBINARY} 's/,/ /g' | ${TRBINARY} '\n' ' ')
                     LogText "File system:    ${FILESYSTEM}"
                     LogText "Expected flags: ${EXPECTED_FLAGS}"
                     LogText "Found flags:    ${FOUND_FLAGS}"
@@ -595,26 +596,27 @@
                         fi
                     done
                     if [ ${FULLY_HARDENED} -eq 1 ]; then
-                        LogText "Result: marked ${FILESYSTEM} as fully hardenened"
+                        LogText "Result: marked ${FILESYSTEM} as fully hardened"
                         Display --indent 2 --text "- Mount options of ${FILESYSTEM}" --result HARDENED --color GREEN
                         AddHP 5 5
                     elif [ ${PARTIALLY_HARDENED} -eq 1 ]; then
-                        LogText "Result: marked ${FILESYSTEM} as fully hardenened"
+                        LogText "Result: marked ${FILESYSTEM} as partially hardened"
                         Display --indent 2 --text "- Mount options of ${FILESYSTEM}" --result "PARTIALLY HARDENED" --color YELLOW
                         AddHP 4 5
                     else
-                        if [ "${FOUND_FLAGS}" = "defaults" ]; then
-                            LogText "Result: marked ${FILESYSTEM} options as default (non hardened)"
+                        # if 
+                        if ContainsString "defaults" "${FOUND_FLAGS}"; then
+                            LogText "Result: marked ${FILESYSTEM} options as default (not hardened)"
                             Display --indent 2 --text "- Mount options of ${FILESYSTEM}" --result DEFAULT --color YELLOW
                             AddHP 3 5
                         else
-                            LogText "Result: marked ${FILESYSTEM} options as non default (unclear about hardening)"
+                            LogText "Result: marked ${FILESYSTEM} options as non-default (unclear about hardening)"
                             Display --indent 2 --text "- Mount options of ${FILESYSTEM}" --result "NON DEFAULT" --color YELLOW
                             AddHP 4 5
                         fi
                     fi
                 else
-                    LogText "Result: file system ${FILESYSTEM} not found in /etc/fstab"
+                    LogText "Result: file system ${FILESYSTEM} not found in ${ROOTDIR}etc/fstab"
                 fi
             done
         fi

From 7d33353058258e0726075bfd952c77071f8e7fac Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 12 Sep 2019 16:37:15 +0200
Subject: [PATCH 343/679] Updated log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0435014b..c1385eb4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -70,6 +70,8 @@ Using the relevant options, the scan will change base on the intended goal.
 - AUTH-9408 - added support for pam_tally2 to log failed logins
 - CONT-8106 - support newer 'docker info' output
 - CRYP-8002 - gather kernel entropy on Linux systems
+- FILE-6374 - changed log and allow root location to be changed
+- FILE-6374 - corrected condition to find 'defaults' flag in /etc/fstab
 - FILE-7524 - optimized file permissions testing
 - FINT-4328 - corrected text in log
 - FINT-4334 - improved process detection for lfd

From 5c38a0bdb48b4d8f264931111eaefb4ad4b4500e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 13 Sep 2019 11:47:39 +0200
Subject: [PATCH 344/679] Tests using lsof may ignore threads (if supported)

---
 include/binaries         | 10 +++++++++-
 include/consts           |  2 ++
 include/functions        |  2 +-
 include/tests_logging    |  8 ++++----
 include/tests_networking |  2 +-
 5 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/include/binaries b/include/binaries
index 661e0d41..d8a28cfa 100644
--- a/include/binaries
+++ b/include/binaries
@@ -189,7 +189,15 @@
                             lsattr)                 LSATTRBINARY="${BINARY}";          LogText "  Found known binary: lsattr (file attributes) - ${BINARY}" ;;
 			    lsblk)		    LSBLKBINARY="${BINARY}";	       LogText "  Found known binary: lsblk (block devices) - ${BINARY}" ;;
                             lsmod)                  LSMODBINARY="${BINARY}";           LogText "  Found known binary: lsmod (kernel modules) - ${BINARY}" ;;
-                            lsof)                   LSOFBINARY="${BINARY}";            LogText "  Found known binary: lsof (open files) - ${BINARY}" ;;
+                            lsof)
+                                LSOFBINARY="${BINARY}"
+                                LogText "  Found known binary: lsof (open files) - ${BINARY}"
+                                DATA=$(${LSOFBINARY} -h 2>&1 | grep "\-K \[i\] list\|\(i\)gn tasKs")
+                                if [ $? -eq 0 ]; then
+                                    LogText "Note: added -K i to ignore tasks on Linux"
+                                    LSOF_EXTRA_OPTIONS=" -K i"
+                                fi
+                            ;;
                             lsvg)                   LSVGBINARY=${BINARY};              LogText "  Found known binary: lsvg (volume manager) - ${BINARY}" ;;
                             lvdisplay)              LVDISPLAYBINARY="${BINARY}";       LogText "  Found known binary: lvdisplay (LVM tool) - ${BINARY}" ;;
                             lynx)                   LYNXBINARY="${BINARY}";            LYNXVERSION=$(${BINARY} -version | grep "^Lynx Version" | cut -d ' ' -f3); LogText "Found known binary: lynx (browser) - ${BINARY} (version ${LYNXVERSION})" ;;
diff --git a/include/consts b/include/consts
index 47d1bc06..9d99f606 100644
--- a/include/consts
+++ b/include/consts
@@ -150,6 +150,8 @@ unset LANG
     LOGDIR=""
     LOGTEXT=1
     LSMODBINARY=""
+    LSOFBINARY=""
+    LSOF_EXTRA_OPTIONS=""
     LSVGBINARY=""
     LYNIS_CRONJOB=""
     MACHINEID=""
diff --git a/include/functions b/include/functions
index 9719b0ae..73549ad9 100644
--- a/include/functions
+++ b/include/functions
@@ -2336,7 +2336,7 @@
         else
             if [ $# -eq 2 ] && [ $1 = "TCP" -o $1 = "UDP" ]; then
                 LogText "Test: find service listening on $1:$2"
-                if [ $1 = "TCP" ]; then FIND=$(${LSOFBINARY} -i${1} -s${1}:LISTEN -P -n | grep ":${2} "); else FIND=$(${LSOFBINARY} -i${1} -P -n | grep ":${2} "); fi
+                if [ $1 = "TCP" ]; then FIND=$(${LSOFBINARY}${LSOF_EXTRA_OPTIONS} -i${1} -s${1}:LISTEN -P -n | grep ":${2} "); else FIND=$(${LSOFBINARY}${LSOF_EXTRA_OPTIONS} -i${1} -P -n | grep ":${2} "); fi
                 if [ ! "${FIND}" = "" ]; then
                     LogText "Result: found service listening on port $2 ($1)"
                     return 0
diff --git a/include/tests_logging b/include/tests_logging
index 7b370681..51e4d246 100644
--- a/include/tests_logging
+++ b/include/tests_logging
@@ -510,7 +510,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: checking open log files with lsof"
         if [ -n "${LSOFBINARY}" ]; then
-            FIND=$(${LSOFBINARY} -n 2>&1 | ${GREPBINARY} "log$" | ${EGREPBINARY} -v "WARNING|Output information" | ${AWKBINARY} '{ if ($5=="REG") { print $9 } }' | ${SORTBINARY} -u | ${GREPBINARY} -v "^$")
+            FIND=$(${LSOFBINARY}${LSOF_EXTRA_OPTIONS} -n 2>&1 | ${GREPBINARY} "log$" | ${EGREPBINARY} -v "WARNING|Output information" | ${AWKBINARY} '{ if ($5=="REG") { print $9 } }' | ${SORTBINARY} -u | ${GREPBINARY} -v "^$")
             for I in ${FIND}; do
                 LogText "Found logfile: ${I}"
             done
@@ -548,7 +548,7 @@
             LSOF_GREP="${LSOF_GREP}|anacron|awk|run-parts"
         fi
 
-        FIND=$(${LSOFBINARY} -n +L 1 2>&1 | ${EGREPBINARY} -vw "${LSOF_GREP}" | ${EGREPBINARY} -v '/dev/zero|/\[aio\]' | ${AWKBINARY} '{ if ($5=="REG") { printf "%s(%s)\n", $10, $1 } }' | ${GREPBINARY} -v "^$" | ${SORTBINARY} -u)
+        FIND=$(${LSOFBINARY}${LSOF_EXTRA_OPTIONS} -n +L 1 2>&1 | ${EGREPBINARY} -vw "${LSOF_GREP}" | ${EGREPBINARY} -v '/dev/zero|/\[aio\]' | ${AWKBINARY} '{ if ($5=="REG") { printf "%s(%s)\n", $10, $1 } }' | ${GREPBINARY} -v "^$" | ${SORTBINARY} -u)
         if [ -n "${FIND}" ]; then
             LogText "Result: found one or more files which are deleted, but still in use"
             for I in ${FIND}; do
@@ -567,10 +567,10 @@
 #
     # Test        : LOGG-2192
     # Description : Check for open log files which are empty. This may indicate a problem with log rotation, or unused services
-    if [ ! "${LSOFBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${LSOFBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no LOGG-2192 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking for open log files that are empty"
     if [ ${SKIPTEST} -eq 0 ]; then
-        FIND=$(${LSOFBINARY} -n -w | ${AWKBINARY} '{if ($5=="REG" && $7=="0" && $9 ~ /log$/) {print $1","$9}}' | ${SORTBINARY} | uniq)
+        FIND=$(${LSOFBINARY}${LSOF_EXTRA_OPTIONS} -n -w | ${AWKBINARY} '{if ($5=="REG" && $7=="0" && $9 ~ /log$/) {print $1","$9}}' | ${SORTBINARY} | uniq)
         if [ -n "${FIND}" ]; then
             for I in ${FIND}; do
                 LogText "Found an opened logfile that is empty: ${I}"
diff --git a/include/tests_networking b/include/tests_networking
index a04fe393..36b86671 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -402,7 +402,7 @@
                 if [ -n "${LSOFBINARY}" ]; then
                     LogText "Test: Retrieving lsof information to find listening ports"
                     # UDP and TCP combined
-                    FIND=$(${LSOFBINARY} -i -P | ${AWKBINARY} '{ print $9"|"$8"|"$1"|" }' | ${SEDBINARY} 's/\(.*\)\-\>.*\(\|.*\)/\1\2/' | ${SEDBINARY} 's/\*/'$IP'/' | ${SORTBINARY} -u | ${GREPBINARY} -v "NAME")
+                    FIND=$(${LSOFBINARY}${LSOF_EXTRA_OPTIONS} -i -P | ${AWKBINARY} '{ print $9"|"$8"|"$1"|" }' | ${SEDBINARY} 's/\(.*\)\-\>.*\(\|.*\)/\1\2/' | ${SEDBINARY} 's/\*/'$IP'/' | ${SORTBINARY} -u | ${GREPBINARY} -v "NAME")
                 else
                     FIND=""
                 fi

From 60a76d64a3daa4c2375bfd08f833dd5fcf18f78b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 13 Sep 2019 11:47:50 +0200
Subject: [PATCH 345/679] Updated log

---
 CHANGELOG.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c1385eb4..a36e9f45 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -106,6 +106,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - Show tip to use 'lynis generate hostids' when host IDs are missing
 - The 'show changelog' command works again for newer versions
 - Several code cleanups, simplification of commands, and code standardization
+- Tests using lsof may ignore individual threads (if supported)
 - Do not show tool tips when quiet option is used
 - Extended output of 'lynis update info'
 - Test if profiles are readable
@@ -113,7 +114,6 @@ Using the relevant options, the scan will change base on the intended goal.
 - bash completion script extended
 - Updated man page
 
-
 ---------------------------------------------------------------------------------
 
 ## Lynis 2.7.5 (2019-06-24)
@@ -136,7 +136,6 @@ Using the relevant options, the scan will change base on the intended goal.
 
 ---------------------------------------------------------------------------------
 
-
 ## Lynis 2.7.4 (2019-04-21)
 
 This is a bigger release than usual, including several new tests created by

From d6324ee29ad5500c25e57a7059af6ae0d7ebf8a8 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 14 Sep 2019 13:20:26 +0200
Subject: [PATCH 346/679] Disabled shadow files in default profile as each
 Linux distribution has its own default

---
 default.prf | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/default.prf b/default.prf
index 0c172b4a..f59e50c2 100644
--- a/default.prf
+++ b/default.prf
@@ -293,8 +293,6 @@ permfile=/etc/cron.deny:rw-------:root:-:WARN:
 permfile=/etc/crontab:rw-------:root:-:WARN:
 permfile=/etc/group:rw-r--r--:root:-:WARN:
 permfile=/etc/group-:rw-r--r--:root:-:WARN:
-permfile=/etc/gshadow:---------:root:-:WARN:
-permfile=/etc/gshadow-:---------:root:-:WARN:
 permfile=/etc/hosts.allow:rw-r--r--:root:root:WARN:
 permfile=/etc/hosts.deny:rw-r--r--:root:root:WARN:
 permfile=/etc/issue:rw-r--r--:root:root:WARN:
@@ -303,10 +301,15 @@ permfile=/etc/lilo.conf:rw-------:root:-:WARN:
 permfile=/etc/motd:rw-r--r--:root:root:WARN:
 permfile=/etc/passwd:rw-r--r--:root:-:WARN:
 permfile=/etc/passwd-:rw-r--r--:root:-:WARN:
-permfile=/etc/shadow:---------:root:-:WARN:
-permfile=/etc/shadow-:---------:root:-:WARN:
 permfile=/etc/ssh/sshd_config:rw-------:root:-:WARN:
 
+# These permissions differ by OS
+#permfile=/etc/gshadow:---------:root:-:WARN:
+#permfile=/etc/gshadow-:---------:root:-:WARN:
+#permfile=/etc/shadow:---------:root:-:WARN:
+#permfile=/etc/shadow-:---------:root:-:WARN:
+
+
 #################################################################################
 #
 # permdir

From 13a4dff7fe9c837ba16701a37069bf8a68afcc2c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 14 Sep 2019 13:22:50 +0200
Subject: [PATCH 347/679] Improved logging of HasCorrectFilePermissions
 function and use correct value when data has a value of zero

---
 include/functions | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/include/functions b/include/functions
index 73549ad9..ec5e44c9 100644
--- a/include/functions
+++ b/include/functions
@@ -239,7 +239,6 @@
                     # busybox does not support format
                     if [ ${SHELL_IS_BUSYBOX} -eq 0 ]; then
                         DATA=$(${STATBINARY} --format=%a ${CHECKFILE})
-                        LogText "Output: ${DATA}"
                     fi
                 fi
 
@@ -266,15 +265,20 @@
                     else
                         DATA=$(${LSBINARY} -l ${CHECKFILE} | cut -c 2-10)
                     fi
-                    # Convert permissions to octal
-                    LogText "Converting ${DATA} to octal"
-                    DATA=$(echo ${DATA} | ${AWKBINARY} '{k=0;for(i=0;i<=8;i++)k+=((substr($1,i+2,1)~/[rwx]/)*2^(8-i));if(k)printf("%0o",k)}')
-                    LogText "Output: ${DATA}"
                 fi
 
+                # Convert permissions to octal when needed
+                case ${DATA} in
+                    "r"|"w"|"x"|"-")
+                        LogText "Converting value ${DATA} to octal"
+                        DATA=$(echo ${DATA} | ${AWKBINARY} '{k=0;for(i=0;i<=8;i++)k+=((substr($1,i+2,1)~/[rwx]/)*2^(8-i));if(k)printf("%0o",k)}')
+                        if [ "${DATA}" = "0" ]; then DATA="000"; fi
+                    ;;
+                esac
+
                 if [ -n "${DATA}" ]; then
                     if [ "${DATA}" = "${CHECK_PERMISSION}" ]; then
-                        LogText "Outcome: correct permissions"
+                        LogText "Outcome: correct permissions (${DATA})"
                         return 0
                     fi
                 else
@@ -282,7 +286,7 @@
                 fi
             done
 
-            LogText "Did not find the permissions of file ${CHECKFILE} matching any of the ${CHECKPERMISSION_FULL} values"
+            LogText "Outcome: permissions of file ${CHECKFILE} are not matching expected value (${DATA} != ${CHECKPERMISSION_FULL})"
             # No match, return exit code 1
             return 1
         fi

From 95e9e808346a95e8810b94eaa589fa7cef814758 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 14 Sep 2019 13:23:28 +0200
Subject: [PATCH 348/679] Moved function

---
 include/functions | 167 +++++++++++++++++++++++-----------------------
 1 file changed, 83 insertions(+), 84 deletions(-)

diff --git a/include/functions b/include/functions
index ec5e44c9..108d1301 100644
--- a/include/functions
+++ b/include/functions
@@ -210,90 +210,6 @@
     }
 
 
-    ################################################################################
-    # Name        : HasCorrectFilePermissions()
-    # Description : Check file permissions
-    #
-    # Parameters  : $1 = Full path to file or directory
-    #               $2 = Permissions
-    # Returns     : exit code (0 = correct, 1 = not correct, 2 = file does not exist)
-    ################################################################################
-
-    HasCorrectFilePermissions() {
-        if [ $# -ne 2 ]; then Fatal "Incorrect usage of HasCorrectFilePermissions"; fi
-        CHECKFILE="$1"
-        CHECKPERMISSION_FULL="$2"
-        if [ ! -d ${CHECKFILE} -a ! -f ${CHECKFILE} ]; then
-            return 2
-        else
-            for CHECK_PERMISSION in ${CHECKPERMISSION_FULL}; do
-                DATA=$(echo ${CHECK_PERMISSION} | ${EGREPBINARY} "[rwx]")
-                if [ $? -eq 0 ]; then
-                    # add a dummy character as first character so it looks like output is a normal file
-                    CHECK_PERMISSION=$(echo "-${CHECK_PERMISSION}" | ${AWKBINARY} '{k=0;for(i=0;i<=8;i++)k+=((substr($1,i+2,1)~/[rwx]/)*2^(8-i));if(k)printf("%0o",k)}')
-                fi
-
-                # First try stat command
-                LogText "Test: checking if file ${CHECKFILE} is ${CHECK_PERMISSION}"
-                if [ -n "${STATBINARY}" ]; then
-                    # busybox does not support format
-                    if [ ${SHELL_IS_BUSYBOX} -eq 0 ]; then
-                        DATA=$(${STATBINARY} --format=%a ${CHECKFILE})
-                    fi
-                fi
-
-                # See if we can use the find binary
-                if [ -z "${DATA}" ]; then
-                    case ${OS} in
-                        "AIX")
-                            Debug "Skipping find command, as AIX does not support -printf"
-                        ;;
-                        *)
-                            # Only use find when OS is NOT AIX and binaries are NOT busybox
-                            if [ ${SHELL_IS_BUSYBOX} -eq 0 ]; then
-                                DATA=$(${FINDBINARY} ${CHECKFILE} -printf "%m")
-                            fi
-                        ;;
-                    esac
-                fi
-
-                # Finally use ls command
-                if [ -z "${DATA}" ]; then
-                    # If 'file' is an directory, use -d
-                    if [ -d ${CHECKFILE} ]; then
-                        DATA=$(${LSBINARY} -d -l ${CHECKFILE} | cut -c 2-10)
-                    else
-                        DATA=$(${LSBINARY} -l ${CHECKFILE} | cut -c 2-10)
-                    fi
-                fi
-
-                # Convert permissions to octal when needed
-                case ${DATA} in
-                    "r"|"w"|"x"|"-")
-                        LogText "Converting value ${DATA} to octal"
-                        DATA=$(echo ${DATA} | ${AWKBINARY} '{k=0;for(i=0;i<=8;i++)k+=((substr($1,i+2,1)~/[rwx]/)*2^(8-i));if(k)printf("%0o",k)}')
-                        if [ "${DATA}" = "0" ]; then DATA="000"; fi
-                    ;;
-                esac
-
-                if [ -n "${DATA}" ]; then
-                    if [ "${DATA}" = "${CHECK_PERMISSION}" ]; then
-                        LogText "Outcome: correct permissions (${DATA})"
-                        return 0
-                    fi
-                else
-                    ReportException "HasCorrectFilePermissions:02" "No data value found, which is unexpected"
-                fi
-            done
-
-            LogText "Outcome: permissions of file ${CHECKFILE} are not matching expected value (${DATA} != ${CHECKPERMISSION_FULL})"
-            # No match, return exit code 1
-            return 1
-        fi
-    }
-
-
-
     ################################################################################
     # Name        : CheckItem()
     # Description : Check if a specific item exists in the report
@@ -1342,6 +1258,89 @@
     }
 
 
+    ################################################################################
+    # Name        : HasCorrectFilePermissions()
+    # Description : Check file permissions
+    #
+    # Parameters  : $1 = Full path to file or directory
+    #               $2 = Permissions
+    # Returns     : exit code (0 = correct, 1 = not correct, 2 = file does not exist)
+    ################################################################################
+
+    HasCorrectFilePermissions() {
+        if [ $# -ne 2 ]; then Fatal "Incorrect usage of HasCorrectFilePermissions"; fi
+        CHECKFILE="$1"
+        CHECKPERMISSION_FULL="$2"
+        if [ ! -d ${CHECKFILE} -a ! -f ${CHECKFILE} ]; then
+            return 2
+        else
+            for CHECK_PERMISSION in ${CHECKPERMISSION_FULL}; do
+                DATA=$(echo ${CHECK_PERMISSION} | ${EGREPBINARY} "[rwx]")
+                if [ $? -eq 0 ]; then
+                    # add a dummy character as first character so it looks like output is a normal file
+                    CHECK_PERMISSION=$(echo "-${CHECK_PERMISSION}" | ${AWKBINARY} '{k=0;for(i=0;i<=8;i++)k+=((substr($1,i+2,1)~/[rwx]/)*2^(8-i));if(k)printf("%0o",k)}')
+                fi
+
+                # First try stat command
+                LogText "Test: checking if file ${CHECKFILE} is ${CHECK_PERMISSION}"
+                if [ -n "${STATBINARY}" ]; then
+                    # busybox does not support format
+                    if [ ${SHELL_IS_BUSYBOX} -eq 0 ]; then
+                        DATA=$(${STATBINARY} --format=%a ${CHECKFILE})
+                    fi
+                fi
+
+                # See if we can use the find binary
+                if [ -z "${DATA}" ]; then
+                    case ${OS} in
+                        "AIX")
+                            Debug "Skipping find command, as AIX does not support -printf"
+                        ;;
+                        *)
+                            # Only use find when OS is NOT AIX and binaries are NOT busybox
+                            if [ ${SHELL_IS_BUSYBOX} -eq 0 ]; then
+                                DATA=$(${FINDBINARY} ${CHECKFILE} -printf "%m")
+                            fi
+                        ;;
+                    esac
+                fi
+
+                # Finally use ls command
+                if [ -z "${DATA}" ]; then
+                    # If 'file' is an directory, use -d
+                    if [ -d ${CHECKFILE} ]; then
+                        DATA=$(${LSBINARY} -d -l ${CHECKFILE} | cut -c 2-10)
+                    else
+                        DATA=$(${LSBINARY} -l ${CHECKFILE} | cut -c 2-10)
+                    fi
+                fi
+
+                # Convert permissions to octal when needed
+                case ${DATA} in
+                    "r"|"w"|"x"|"-")
+                        LogText "Converting value ${DATA} to octal"
+                        DATA=$(echo ${DATA} | ${AWKBINARY} '{k=0;for(i=0;i<=8;i++)k+=((substr($1,i+2,1)~/[rwx]/)*2^(8-i));if(k)printf("%0o",k)}')
+                        if [ "${DATA}" = "0" ]; then DATA="000"; fi
+                    ;;
+                esac
+
+                if [ -n "${DATA}" ]; then
+                    if [ "${DATA}" = "${CHECK_PERMISSION}" ]; then
+                        LogText "Outcome: correct permissions (${DATA})"
+                        return 0
+                    fi
+                else
+                    ReportException "HasCorrectFilePermissions:02" "No data value found, which is unexpected"
+                fi
+            done
+
+            LogText "Outcome: permissions of file ${CHECKFILE} are not matching expected value (${DATA} != ${CHECKPERMISSION_FULL})"
+            # No match, return exit code 1
+            return 1
+        fi
+    }
+
+
     ################################################################################
     # Name        : HasData()
     # Description : Check for a filled variable

From 98017c78cac83d3370861797a3d2f716e8948481 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 17 Sep 2019 14:04:30 +0200
Subject: [PATCH 349/679] Implemented several code style improvements

---
 include/functions      | 34 +++++++++++++++++-----------------
 include/tests_homedirs |  4 ++--
 include/tests_logging  |  2 +-
 include/tests_ssh      |  2 +-
 include/tests_tooling  |  4 ++--
 include/tests_usb      |  4 ++--
 lynis                  | 10 +++++-----
 7 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/include/functions b/include/functions
index 108d1301..7d003976 100644
--- a/include/functions
+++ b/include/functions
@@ -345,7 +345,7 @@
     CreateTempFile() {
         TEMP_FILE=""
         if [ "${OS}" = "AIX" ]; then
-            RANDOMSTRING1=$(echo lynis-$(od -N4 -tu /dev/random | awk 'NR==1 {print $2} {}'))
+            RANDOMSTRING1="lynis-$(od -N4 -tu /dev/random | awk 'NR==1 {print $2} {}')"
             TEMP_FILE="/tmp/${RANDOMSTRING1}"
             touch ${TEMP_FILE}
         else
@@ -950,11 +950,11 @@
                     fi
                     if [ ! "${FIND}" = "" ]; then
                         # We have a MAC address, now hashing it
-                        if [ ! "${SHA1SUMBINARY}" = "" ]; then
+                        if [ -n "${SHA1SUMBINARY}" ]; then
                             HOSTID=$(echo ${FIND} | ${SHA1SUMBINARY} | awk '{ print $1 }')
-                        elif [ ! "${CSUMBINARY}" = "" ]; then
+                        elif [ -n "${CSUMBINARY}" ]; then
                             HOSTID=$(echo ${FIND} | ${CSUMBINARY} -h SHA1 - | awk '{ print $1 }')
-                        elif [ ! "${OPENSSLBINARY}" = "" ]; then
+                        elif [ -n "${OPENSSLBINARY}" ]; then
                             HOSTID=$(echo ${FIND} | ${OPENSSLBINARY} sha -sha1 | awk '{ print $2 }')
                         else
                             ReportException "GetHostID" "No sha1, sha1sum, csum or openssl binary available on AIX"
@@ -1138,17 +1138,17 @@
             fi
         fi
 
-        if [ "${HOSTID}" = "" ]; then
+        if [ -z "${HOSTID}" ]; then
             LogText "Result: no HOSTID available, trying to use SSH key as unique source"
             # Create host ID when a MAC address was not found
             SSH_KEY_FILES="ssh_host_ed25519_key.pub ssh_host_ecdsa_key.pub ssh_host_dsa_key.pub ssh_host_rsa_key.pub"
             if [ -d /etc/ssh ]; then
                 for I in ${SSH_KEY_FILES}; do
-                    if [ "${HOSTID}" = "" ]; then
+                    if [ -z "${HOSTID}" ]; then
                         if [ -f /etc/ssh/${I} ]; then
                             LogText "Result: found ${I} in /etc/ssh"
-                            if [ ! "${SHA1SUMBINARY}" = "" ]; then
-                                HOSTID=$(cat /etc/ssh/${I} | ${SHA1SUMBINARY} | awk '{ print $1 }')
+                            if [ -n "${SHA1SUMBINARY}" ]; then
+                                HOSTID=$(${SHA1SUMBINARY} /etc/ssh/${I} | awk '{ print $1 }')
                                 LogText "result: Created HostID with SSH key ($I): ${HOSTID}"
                             else
                                 ReportException "GetHostID" "Can't create HOSTID with SSH key, as sha1sum binary is missing"
@@ -1408,7 +1408,7 @@
         FOUND=0
         # Early on we can't use FileIsReadable yet
         if [ -e /proc/1/cgroup ]; then
-            FIND=$(cat ${ROOTDIR}proc/1/cgroup 2> /dev/null | grep -i docker)
+            FIND=$(grep -i docker ${ROOTDIR}proc/1/cgroup 2> /dev/null)
             if [ $? -eq 0 ]; then
                 LogText "Result: found Docker in control groups (/proc/1/cgroup), so we are running in Docker container"
                 CONTAINER_TYPE="Docker"; FOUND=1
@@ -1531,7 +1531,7 @@
             # When --user is used, perform a search using the -u option
                             # Initialize users for strict mode
             if [ -n "${users:-}" ]; then
-                for u in "${users}"; do
+                for u in ${users}; do
                     user_uid=$(getent passwd ${u} 2> /dev/null | ${AWKBINARY} -F: '{print $3}')
                     # Only perform search if user exists and we had no match yet
                     if [ -n "${user_uid}" ]; then
@@ -1553,7 +1553,7 @@
                 FIND=$(${PSBINARY} ${PSOPTIONS} | ${EGREPBINARY} "( |/)${search}" | ${GREPBINARY} -v "grep")
             else
                 if [ -n "${users}" ]; then
-                    for u in "${users}"; do
+                    for u in ${users}; do
                         user_uid=$(getent passwd ${u} 2> /dev/null | ${AWKBINARY} -F: '{print $3}')
                         # Only perform search if user exists and we had no match yet
                         if [ -n "${user_uid}" ]; then
@@ -2029,7 +2029,7 @@
             output=$(${SWUPDBINARY} bundle-list > /dev/null 2>&1 | ${GREPBINARY} "^${package}$")
             exit_code=$?
         elif [ -n "${ZYPPERBINARY}" ]; then
-            output=$(${ZYPPERBINARY} --quiet --non-interactive search --installed -i ${PACKAGE} 2> /dev/null | grep "^i")
+            output=$(${ZYPPERBINARY} --quiet --non-interactive search --installed -i ${package} 2> /dev/null | grep "^i")
             if [ -n "${output}" ]; then exit_code=0; else exit_code=1; fi
         else
             ReportException "PackageIsInstalled:01"
@@ -2131,11 +2131,11 @@
         # Strip out spaces, tabs and line breaks
         awk '{$1=$1;print $0}' ${CONFIG_FILE} > ${TMP_NGINX_FILE_RAW}
         # Now clean up the file further (combine lines, remove commented lines and empty lines)
-        cat ${TMP_NGINX_FILE_RAW} | sed 's#\\$##g' | grep -v "^#" | grep -v "^$" > ${TMP_NGINX_FILE}
+        sed 's#\\$##g' ${TMP_NGINX_FILE_RAW} | grep -v "^#" | grep -v "^$" > ${TMP_NGINX_FILE}
 
         LogText "Action: parsing configuration file ${CONFIG_FILE}"
         COUNT=$(( COUNT + 1))
-        FIND=$(cat ${TMP_NGINX_FILE} | sed 's/ /:space:/g')
+        FIND=$(sed 's/ /:space:/g' ${TMP_NGINX_FILE})
         DEPTH=0
         for I in ${FIND}; do
             I=$(echo ${I} | sed 's/:space:/ /g' | sed 's/;$//' | sed 's/ #.*$//')
@@ -2520,10 +2520,10 @@
             TIME_THRESHOLD=10  # seconds
 
             # Calculate timing and determine if we use seconds or nanoseconds (more precise)
-            TIME_DIFF=$((${CURRENT_TS} - ${PREVIOUS_TS}))
+            TIME_DIFF=$((CURRENT_TS - PREVIOUS_TS))
             if [ ${CURRENT_TS} -gt 1000000000000000000 ]; then
                 TIME_DIFF_FORMAT="nanoseconds"
-                TIME_THRESHOLD=$((${TIME_THRESHOLD} * 1000000000))
+                TIME_THRESHOLD=$((TIME_THRESHOLD * 1000000000))
                 if [ ${TIME_DIFF} -gt ${TIME_THRESHOLD} ]; then
                     SLOW_TEST=1
                     # Convert back to seconds for readability
@@ -3528,7 +3528,7 @@
     WaitForKeyPress() {
         if [ ${QUICKMODE} -eq 0 ]; then
             echo ""; echo "[ Press [ENTER] to continue, or [CTRL]+C to stop ]"
-            read void
+            read -r void
         fi
     }
 
diff --git a/include/tests_homedirs b/include/tests_homedirs
index e20b405f..389afd1a 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -57,7 +57,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users' home directories permissions are 750 or more restrictive
         FOUND=0
-        for LINE in "$(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }')"; do
+        for LINE in $(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }'); do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
             DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
             if [ -d "${DIR}" ]; then
@@ -89,7 +89,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users own their home directories
         FOUND=0
-        for LINE in "$(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }') { print }')"; do
+        for LINE in $(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }') { print }'); do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
             DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
             if [ -d ${DIR} ]; then
diff --git a/include/tests_logging b/include/tests_logging
index 51e4d246..7e595049 100644
--- a/include/tests_logging
+++ b/include/tests_logging
@@ -279,7 +279,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking which directories can be found in logrotate configuration"
         FIND=$(${LOGROTATEBINARY} -d -v ${ROOTDIR}etc/logrotate.conf 2>&1 | ${EGREPBINARY} "considering log|skipping" | ${GREPBINARY} -v '*' | ${SORTBINARY} -u | ${AWKBINARY} '{ if ($2=="log") { print $3 } }' | ${SEDBINARY} 's@/[^/]*$@@g' | ${SORTBINARY} -u)
-        if IsEmpty "${FIND}" ]; then
+        if IsEmpty "${FIND}"; then
             LogText "Result: nothing found"
         else
             LogText "Result: found one or more directories (via logrotate configuration)"
diff --git a/include/tests_ssh b/include/tests_ssh
index 7683b0a7..eb3b9134 100644
--- a/include/tests_ssh
+++ b/include/tests_ssh
@@ -104,7 +104,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         OPENSSHD_VERSION=$(${SSHDBINARY} -t -d 2>&1 | ${GREPBINARY} 'sshd version' | ${AWKBINARY} '{if($4~OpenSSH_){print $4}}' | ${AWKBINARY} -F_ '{print $2}' | ${TRBINARY} -d '[:cntrl:],')
         LogText "Result: discovered OpenSSH version is ${OPENSSHD_VERSION}"
-        if [ -n ${OPENSSHD_VERSION} ]; then
+        if [ -n "${OPENSSHD_VERSION}" ]; then
             OPENSSHD_VERSION_MAJOR=$(echo ${OPENSSHD_VERSION%%p*} | ${AWKBINARY} -F. '{print $1}')
             LogText "Result: OpenSSH major version: ${OPENSSHD_VERSION_MAJOR}"
             OPENSSHD_VERSION_MINOR=$(echo ${OPENSSHD_VERSION%%p*} | ${AWKBINARY} -F. '{print $2}')
diff --git a/include/tests_tooling b/include/tests_tooling
index 15fa3540..328a48fa 100644
--- a/include/tests_tooling
+++ b/include/tests_tooling
@@ -54,7 +54,7 @@
 
         # Ansible
         FOUND=0
-        LIST="~/.ansible ${ROOTDIR}etc/ansible ${ROOTDIR}root/.ansible ${ROOTDIR}tmp/.ansible"
+        LIST="${HOME}/.ansible ${ROOTDIR}etc/ansible ${ROOTDIR}root/.ansible ${ROOTDIR}tmp/.ansible"
         for ITEM in ${LIST}; do if DirectoryExists ${ITEM}; then FOUND=1; break; fi; done
         # Test for files (only if no match was found)
         if [ ${FOUND} -eq 0 ]; then
@@ -359,7 +359,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
 
         # Continue if tooling is available and snort is running
-        if [ -n ${SNORT_FOUND} ] || [ -n ${SNORT_RUNNING} ]; then
+        if [ -n "${SNORT_FOUND}" ] || [ -n "${SNORT_RUNNING}" ]; then
             if [ ${SNORT_FOUND} -eq 1 ] && [ ${SNORT_RUNNING} -eq 1 ]; then
                 SNORT_CONFIG=$(${PSBINARY} | ${AWKBINARY} -F-.. '/snort/ {print $3}' | ${HEADBINARY} -1)
                 if HasData "${SNORT_CONFIG}"; then
diff --git a/include/tests_usb b/include/tests_usb
index 3ba19cc9..36058490 100644
--- a/include/tests_usb
+++ b/include/tests_usb
@@ -96,11 +96,11 @@
         USBDEVICESPATH="${ROOTDIR}sys/bus/usb/devices/usb"
         for device in "${USBDEVICESPATH}"*; do
             if [ -e "${device}/authorized" -o -e "${device}/authorized_default" ]; then
-                if [ $(cat "${device}/authorized_default") -eq 1 ]; then
+                if [ "$(cat "${device}/authorized_default")" = "1" ]; then
                     FOUND=1
                     LogText "Test: ${device} is authorized by default"
                     Report "usb_authorized_default_device[]=${device}"
-                elif [ $(cat "${device}/authorized") -eq 1 ]; then
+                elif [ "$(cat "${device}/authorized")" = "1" ]; then
                     FOUND=1
                     LogText "Test: ${device} is authorized currently"
                     Report "usb_authorized_device[]=${device}"
diff --git a/lynis b/lynis
index 32372a37..dcc7de05 100755
--- a/lynis
+++ b/lynis
@@ -198,7 +198,7 @@
         fi
         printf "\n\n[ Press ENTER to continue, or CTRL+C to cancel ]"
         IGNORE_FILE_PERMISSION_ISSUES=1
-        read DUMMY
+        read -r void
     fi
 
     # Now include files if permissions are correct, or user decided to continue
@@ -727,7 +727,7 @@ ${NORMAL}
         LogText "Latest stable version      : ${PROGRAM_LV}"
         if [ ${PROGRAM_LV} -gt ${PROGRAM_AC} ]; then
             # Check if current version is REALLY outdated (10 versions ago)
-            PROGRAM_MINVERSION=$((${PROGRAM_LV} - 10))
+            PROGRAM_MINVERSION=$((PROGRAM_LV - 10))
             LogText "Minimum required version   : ${PROGRAM_MINVERSION}"
             if [ ${PROGRAM_MINVERSION} -gt ${PROGRAM_AC} ]; then
                 Display --indent 2 --text "- Program update status... " --result "WARNING" --color RED
@@ -764,7 +764,7 @@ ${NORMAL}
 
     OLD_RELEASE=0
     TIME_DIFFERENCE_CHECK=10368000 # 4 months
-    RELEASE_PLUS_TIMEDIFF=$((${PROGRAM_RELEASE_TIMESTAMP} + ${TIME_DIFFERENCE_CHECK}))
+    RELEASE_PLUS_TIMEDIFF=$((PROGRAM_RELEASE_TIMESTAMP + TIME_DIFFERENCE_CHECK))
     if [ ${NOW} -gt ${RELEASE_PLUS_TIMEDIFF} ]; then
         # Show if release is old, only if we didn't show it with normal update check
         if [ ${UPDATE_AVAILABLE} -eq 0 ]; then
@@ -882,7 +882,7 @@ ${NORMAL}
                 if [ -f ${PLUGIN_FILE} ]; then
                     FIND2=$(grep "^# PLUGIN_NAME=" ${PLUGIN_FILE} | awk -F= '{ print $2 }')
                     if [ ! "${FIND2}" = "" -a ! "${FIND2}" = "[plugin_name]" ]; then
-                        if [ ${PLUGIN_PHASE} -eq 1 ]; then N_PLUGIN=$((${N_PLUGIN} + 1)); fi
+                        if [ ${PLUGIN_PHASE} -eq 1 ]; then N_PLUGIN=$((N_PLUGIN + 1)); fi
                         # Check if the plugin is enabled in any of the profiles
                         PLUGIN_ENABLED_STATE=0
                         for PROFILE in ${PROFILES}; do
@@ -911,7 +911,7 @@ ${NORMAL}
                                 if SafePerms ${PLUGINFILE}; then
                                     LogText "Including plugin file: ${PLUGINFILE} (version: ${PLUGIN_VERSION})"
                                     Report "plugin_enabled_phase${PLUGIN_PHASE}[]=${FIND2}|${PLUGIN_VERSION}|"
-                                    if [ ${PLUGIN_PHASE} -eq 1 ]; then N_PLUGIN_ENABLED=$((${N_PLUGIN_ENABLED} + 1)); fi
+                                    if [ ${PLUGIN_PHASE} -eq 1 ]; then N_PLUGIN_ENABLED=$((N_PLUGIN_ENABLED + 1)); fi
                                     Display --indent 2 --text "- ${CYAN}Plugin${NORMAL}: ${WHITE}${FIND2}${NORMAL}"
                                     if [ ${PLUGIN_PHASE} -eq 1 ]; then Progress "    ["; fi
                                     . ${PLUGINFILE}

From 6cf0b28f2ccd7b4c04f41e985735bbe68ec2a023 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 17 Sep 2019 20:13:14 +0200
Subject: [PATCH 350/679] Bugfix: line had double print with incorrect quote

---
 include/tests_homedirs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_homedirs b/include/tests_homedirs
index 389afd1a..f4fcb61d 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -89,7 +89,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users own their home directories
         FOUND=0
-        for LINE in $(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }') { print }'); do
+        for LINE in $(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }'); do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
             DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
             if [ -d ${DIR} ]; then

From ccb8b2b6150bf4785ee5b4dce3856e2a961a5b2c Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Wed, 18 Sep 2019 20:47:09 +0200
Subject: [PATCH 351/679] enhance nginx config detection to correctly include
 confs via relative path and wildcards

---
 include/functions | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/include/functions b/include/functions
index 7d003976..c10971aa 100644
--- a/include/functions
+++ b/include/functions
@@ -2249,6 +2249,30 @@
                             if [ "${CONF}" = "${VALUE}" ]; then FOUND=1; LogText "Found this file already in our configuration files array (additions), not adding to queue"; fi
                         done
                         if [ ${FOUND} -eq 0 ]; then NGINX_CONF_FILES_ADDITIONS="${NGINX_CONF_FILES_ADDITIONS} ${VALUE}"; fi
+                    # Check if include value is a relative path only
+                    elif [ -f "${CONFIG_FILE%nginx.conf}${VALUE%;*}" ]; then
+                        VALUE="${CONFIG_FILE%nginx.conf}${VALUE}"
+                        FOUND=0
+                        for CONF in ${NGINX_CONF_FILES}; do
+                            if [ "${CONF}" = "${VALUE}" ]; then FOUND=1; LogText "Found this file already in our configuration files array, not adding to queue"; fi
+                        done
+                        for CONF in ${NGINX_CONF_FILES_ADDITIONS}; do
+                            if [ "${CONF}" = "${VALUE}" ]; then FOUND=1; LogText "Found this file already in our configuration files array (additions), not adding to queue"; fi
+                        done
+                        if [ ${FOUND} -eq 0 ]; then NGINX_CONF_FILES_ADDITIONS="${NGINX_CONF_FILES_ADDITIONS} ${VALUE}"; fi
+                    # Check for additional config files included as follows
+                    # "include sites-enabled/*.conf"
+                    elif [ $(echo ${VALUE} | grep -F -c "*.conf") -gt 0 ]; then
+                        for FOUND_CONF in $(ls ${CONFIG_FILE%nginx.conf}${VALUE%;*}); do
+                            FOUND=0
+                            for CONF in ${NGINX_CONF_FILES}; do
+                                if [ "${CONF}" = "${FOUND_CONF}" ]; then FOUND=1; LogText "Found this file already in our configuration files array, not adding to queue"; fi
+                            done
+                            for CONF in ${NGINX_CONF_FILES_ADDITIONS}; do
+                                if [ "${CONF}" = "${FOUND_CONF}" ]; then FOUND=1; LogText "Found this file already in our configuration files array (additions), not adding to queue"; fi
+                            done
+                            if [ ${FOUND} -eq 0 ]; then NGINX_CONF_FILES_ADDITIONS="${NGINX_CONF_FILES_ADDITIONS} ${FOUND_CONF}"; fi
+                        done
                     else
                         LogText "Result: this include does not point to a file"
                     fi

From a83505f47ba2e1b2cf4a257e4b394f18f59cd0f0 Mon Sep 17 00:00:00 2001
From: Marzal <2069735+Marzal@users.noreply.github.com>
Date: Wed, 18 Sep 2019 23:11:58 +0200
Subject: [PATCH 352/679] Thanks for the offer.

---
 CONTRIBUTORS.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md
index 6386c453..63136d63 100644
--- a/CONTRIBUTORS.md
+++ b/CONTRIBUTORS.md
@@ -39,6 +39,7 @@ These people made a significant impact to the development of Lynis:
 * C.J. Adams-Collier, US
 * Charlie Heselton, US
 * Dave Vehrs
+* David Marzal Cánovas, Spain
 * Eric Light, New Zealand
 * Kamil Boratyński, Poland
 * Mike Slifcak, US

From 36627a4eb7fb0d505c6df7897083d161e59cdf34 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 19 Sep 2019 14:05:15 +0200
Subject: [PATCH 353/679] Style improvements

---
 include/binaries                |  1 -
 include/functions               | 18 +++++++-------
 include/helper_audit_dockerfile | 32 ++++++++++---------------
 include/parameters              |  2 +-
 include/profiles                | 42 ++++++++++++++++-----------------
 include/tests_authentication    |  2 +-
 include/tests_boot_services     | 17 ++++++-------
 include/tests_firewalls         |  2 +-
 include/tests_mail_messaging    |  4 ++--
 include/tests_printers_spools   |  2 +-
 include/tests_webservers        |  4 ++--
 11 files changed, 59 insertions(+), 67 deletions(-)

diff --git a/include/binaries b/include/binaries
index d8a28cfa..7af676f8 100644
--- a/include/binaries
+++ b/include/binaries
@@ -124,7 +124,6 @@
                             arch-audit)             ARCH_AUDIT_BINARY="${BINARY}";     LogText "  Found known binary: arch-audit (auditing utility to test for vulnerable packages) - ${BINARY}" ;;
                             auditd)                 AUDITDBINARY=${BINARY};            LogText "  Found known binary: auditd (audit framework) - ${BINARY}" ;;
                             awk)                    AWKBINARY=${BINARY};               LogText "  Found known binary: awk (string tool) - ${BINARY}" ;;
-                            dig)                    DIGBINARY=${BINARY};               LogText "  Found known binary: dig (nameservice tool) - ${BINARY}" ;;
                             as)                     ASBINARY="${BINARY}";              COMPILER_INSTALLED=1;                  LogText "  Found known binary: as (compiler) - ${BINARY}" ;;
                             auditctl)               AUDITCTLBINARY="${BINARY}";        LogText "  Found known binary: auditctl (control utility for audit daemon) - ${BINARY}" ;;
                             autolog)                AUTOLOGBINARY="${BINARY}";         IDLE_SESSION_KILLER_INSTALLED=1;       LogText "  Found known binary: autolog (idle session killer) - ${BINARY}" ;;
diff --git a/include/functions b/include/functions
index 7d003976..0024484f 100644
--- a/include/functions
+++ b/include/functions
@@ -149,7 +149,7 @@
                 CreateTempFile
                 SETTINGS_FILE="${TEMP_FILE}"
             fi
-            FIND=$(egrep "^${SETTING};" ${SETTINGS_FILE})
+            FIND=$(grep -E "^${SETTING};" ${SETTINGS_FILE})
             if [ -z "${FIND}" ]; then
                 echo "${SETTING};${VALUE};${DESCRIPTION};" >> ${SETTINGS_FILE}
             else
@@ -227,7 +227,7 @@
             if [ ! "${REPORTFILE}" = "/dev/null" ]; then
                 # Check if we can find the main type (with or without brackets)
                 LogText "Test: search string $2 in earlier discovered results"
-                FIND=$(egrep "^$1(\[\])?=" ${REPORTFILE} | egrep "$2")
+                FIND=$(grep -E "^$1(\[\])?=" ${REPORTFILE} | grep -E "$2")
                 if HasData "${FIND}"; then
                     RETVAL=0
                     LogText "Result: found search string (result: $FIND)"
@@ -310,7 +310,7 @@
     ContainsString() {
         RETVAL=1
         if [ $# -ne 2 ]; then ReportException "ContainsString" "Incorrect number of arguments for ContainsStrings function"; fi
-        FIND=$(echo "$2" | egrep "$1")
+        FIND=$(echo "$2" | grep -E "$1")
         if [ ! "${FIND}" = "" ]; then RETVAL=0; fi
         return ${RETVAL}
     }
@@ -1024,10 +1024,10 @@
 
                     elif [ -n "${IPBINARY}" ]; then
                         # Determine if we have the common available eth0 interface
-                        FIND=$(${IPBINARY} addr show eth0 2> /dev/null | egrep "link/ether " | head -1 | awk '{ print $2 }' | tr '[:upper:]' '[:lower:]')
+                        FIND=$(${IPBINARY} addr show eth0 2> /dev/null | grep -E "link/ether " | head -1 | awk '{ print $2 }' | tr '[:upper:]' '[:lower:]')
                         if IsEmpty "${FIND}"; then
                             # Determine the MAC address of first interface with the ip command
-                            FIND=$(${IPBINARY} addr show 2> /dev/null | egrep "link/ether " | head -1 | awk '{ print $2 }' | tr '[:upper:]' '[:lower:]')
+                            FIND=$(${IPBINARY} addr show 2> /dev/null | grep -E "link/ether " | head -1 | awk '{ print $2 }' | tr '[:upper:]' '[:lower:]')
                             if IsEmpty "${FIND}"; then
                                 ReportException "GetHostID" "Can't create hostid (no MAC addresses found)"
                             fi
@@ -1816,7 +1816,7 @@
             # FreeBSD: hw.hv_vendor (remains empty for VirtualBox)
             # NetBSD: machdep.dmi.system-product
             # OpenBSD: hw.product
-            FIND=$(sysctl -a 2> /dev/null | egrep "(hw.product|machdep.dmi.system-product)" | head -1 | sed 's/ = /=/' | awk -F= '{ print $2 }')
+            FIND=$(sysctl -a 2> /dev/null | grep -E "(hw.product|machdep.dmi.system-product)" | head -1 | sed 's/ = /=/' | awk -F= '{ print $2 }')
             if [ ! "${FIND}" = "" ]; then
                 SHORT="${FIND}"
             fi
@@ -2694,7 +2694,7 @@
             # Clean up temp files
             for FILE in ${TEMP_FILES}; do
                 # Temporary files should be in /tmp
-                TMPFILE=$(echo ${FILE} | egrep "^/tmp/lynis" | grep -v "\.\.")
+                TMPFILE=$(echo ${FILE} | grep -E "^/tmp/lynis" | grep -v "\.\.")
                 if [ -n "${TMPFILE}" ]; then
                     if [ -f "${TMPFILE}" ]; then
                         LogText "Action: removing temporary file ${TMPFILE}"
@@ -3108,7 +3108,7 @@
             if [ -f ${FILE} ]; then
                 # Check if we can find the main type (with or without brackets)
                 LogText "Test: search string ${STRING} in file ${FILE}"
-                FIND=$(egrep "${STRING}" ${FILE})
+                FIND=$(grep -E "${STRING}" ${FILE})
                 if [ -n "${FIND}" ]; then
                     LogText "Result: found search string '${STRING}'"
                     if [ ${MASK_LOG} -eq 0 ]; then LogText "Full string returned: ${FIND}"; fi
@@ -3459,7 +3459,7 @@
         # Apply the related function
         case ${FUNCTION} in
               "contains")
-                  FIND=$(echo ${VALUE} | egrep "${SEARCH}")
+                  FIND=$(echo ${VALUE} | grep -E "${SEARCH}")
                   if [ "${FIND}" = "" ]; then RETVAL=1; else RETVAL=0; fi
               ;;
               #"gt" | "greater-than")   COLOR=$GREEN   ;;
diff --git a/include/helper_audit_dockerfile b/include/helper_audit_dockerfile
index b3eff024..a0efca38 100644
--- a/include/helper_audit_dockerfile
+++ b/include/helper_audit_dockerfile
@@ -23,7 +23,7 @@ if [ $# -eq 0 ]; then
     Display --text " "; Display --text " "
     ExitFatal
 else
-    FILE=$(echo $1 | egrep "^http|https")
+    FILE=$(echo $1 | grep -E "^http|https")
     if HasData "${FILE}"; then
         echo "Provide a file (not a URL)"
         ExitFatal
@@ -93,24 +93,19 @@ fi
 #
 ##################################################################################################
 #
+    InsertSection "Basics"
 
-InsertSection "Basics"
-
-    #FIND=$(egrep "^MAINTAINER" ${AUDIT_FILE} | sed 's/ /:space:/g')
-    FIND=$(egrep -i "*MAINTAINER" ${AUDIT_FILE}  |  sed 's/=/ /g' | cut -d'"' -f 2)
-    if [ -z "${FIND}" ]; then
+    MAINTAINER=$(grep -E -i "*MAINTAINER" ${AUDIT_FILE} | sed 's/=/ /g' | cut -d'"' -f 2)
+    if [ -z "${MAINTAINER}" ]; then
         ReportWarning "dockerfile" "No maintainer found. Unclear who created this file."
     else
-        #MAINTAINER=$(echo ${FIND} | sed 's/:space:/ /g' | awk '{ if($1=="MAINTAINER") { print }}')
-        MAINTAINER=$(echo ${FIND})
         Display --indent 2 --text "Maintainer" --result "${MAINTAINER}"
     fi
 
-    FIND=$(grep "^ENTRYPOINT" ${AUDIT_FILE} | cut -d' ' -f2 )
-    if [ "${FIND}" = "" ]; then
+    ENTRYPOINT=$(grep "^ENTRYPOINT" ${AUDIT_FILE} | cut -d' ' -f2 )
+    if [ -z "${ENTRYPOINT}" ]; then
         ReportWarning "dockerfile" "No ENTRYPOINT defined in Dockerfile."
     else
-        ENTRYPOINT=$(echo ${FIND})
         Display --indent 2 --text "ENTRYPOINT" --result "${ENTRYPOINT}"
     fi
 
@@ -129,17 +124,14 @@ InsertSection "Basics"
         USER=$(echo ${FIND})
         Display --indent 2 --text "User" --result "${USER}"
     fi
-
-
 #
 ##################################################################################################
 #
-
     InsertSection "Software"
 
     case $PKGMGR in
     "apt")
-        FIND=$(egrep "apt-get(.*) install" ${AUDIT_FILE})
+        FIND=$(grep -E "apt-get(.*) install" ${AUDIT_FILE})
         if [ ! "${FIND}" = "" ]; then
             LogText "Found installation via apt-get"
         else
@@ -147,7 +139,7 @@ InsertSection "Basics"
         fi
         ;;
      "apk")
-        FIND=$(egrep "apk(.*) add" ${AUDIT_FILE})
+        FIND=$(grep -E "apk(.*) add" ${AUDIT_FILE})
         if [ ! "${FIND}" = "" ]; then
             LogText "Found installation via apk"
         else
@@ -159,7 +151,7 @@ InsertSection "Basics"
     ;;
     esac
 
-    FIND=$(egrep " (gcc|libc6-dev|make)" ${AUDIT_FILE} | grep -v "^#")
+    FIND=$(grep -E " (gcc|libc6-dev|make)" ${AUDIT_FILE} | grep -v "^#")
     if [ ! "${FIND}" = "" ]; then
         ReportWarning "dockerfile" "Possible development utilities found, which is not advised for production environment"
         LogText "Details: ${FIND}"
@@ -202,7 +194,7 @@ InsertSection "Basics"
 
     if [ ${FILE_DOWNLOAD} -eq 1 ]; then
 
-        SSL_USED_FIND=$(egrep "(https)" ${AUDIT_FILE})
+        SSL_USED_FIND=$(grep -E "(https)" ${AUDIT_FILE})
 
         if HasData "${SSL_USED_FIND}"; then
             SSL_USED="YES"
@@ -213,9 +205,9 @@ InsertSection "Basics"
             ReportSuggestion "Use SSL downloads when possible to increase security (DNSSEC, HTTPS, validation of domain, avoid MitM)"
         fi
         Display --indent 2 --text "Integrity testing performed" --result "${SSL_USED}" --color ${COLOR}
-        HASHING_USED=$(egrep "(sha1sum|sha256sum|sha512sum)" ${AUDIT_FILE})
+        HASHING_USED=$(grep -E "(sha1sum|sha256sum|sha512sum)" ${AUDIT_FILE})
         Display --indent 2 --text "Hashing" --result "${HASHING_USED}"
-        KEYS_USED=$(egrep "(apt-key adv)" ${AUDIT_FILE}| sed 's/RUN apt-key adv//g'| sed 's/--keyserver/Key Server:/g' | sed 's/--recv/Key Value:/g')
+        KEYS_USED=$(grep -E "(apt-key adv)" ${AUDIT_FILE}| sed 's/RUN apt-key adv//g'| sed 's/--keyserver/Key Server:/g' | sed 's/--recv/Key Value:/g')
         Display --indent 2 --text "Signing keys used" --result "${KEYS_USED}"
         Display --indent 2 --text "All downloads properly checked" --result "?"
     else
diff --git a/include/parameters b/include/parameters
index 6309481d..048b992d 100644
--- a/include/parameters
+++ b/include/parameters
@@ -377,7 +377,7 @@
             ;;
 
             # Scan one or more tests from just on group
-            --tests-from-group | --tests-from-groups | --test-from-group | --test-from-group)
+            --tests-from-group | --tests-from-groups | --test-from-group | --test-from-groups)
                 shift
                 TEST_GROUP_TO_CHECK=$1
             ;;
diff --git a/include/profiles b/include/profiles
index 8121cd9a..f10d27a2 100644
--- a/include/profiles
+++ b/include/profiles
@@ -35,13 +35,13 @@
 
         # Show deprecation message for old config entries such as 'config:' and 'apache:'
         FOUND=0
-        DATA=$(egrep "^[a-z-]{1,}:" ${PROFILE} | od -An -ta | sed 's/ /!space!/g')  # od -An (no file offset), -ta (named character, to be on safe side)
+        DATA=$(grep -E "^[a-z-]{1,}:" ${PROFILE} | od -An -ta | sed 's/ /!space!/g')  # od -An (no file offset), -ta (named character, to be on safe side)
         if ! IsEmpty "${DATA}"; then FOUND=1; fi
 
         if [ ${FOUND} -eq 1 ]; then
             DisplayWarning "Your profile contains old-style configuration entries. See log file for more details and how to convert these entries"
             LogText "Your profile has one or more configuration items that are in an old format (lines starting with key:value). They need to be converted into the new format (key=value)."
-            LogText "Tip: Use egrep to see the relevant matches (egrep \"^[a-z-]{1,}:\" custom.prf)"
+            LogText "Tip: Use grep to see the relevant matches (grep -E \"^[a-z-]{1,}:\" custom.prf)"
             sleep 30
         fi
 
@@ -50,7 +50,7 @@
         if ! IsEmpty "${DATA}"; then
             DisplayWarning "Your profile '${PROFILE}' contains unexpected characters. See the log file for more information."
             LogText "Found unexpected or possibly harmful characters in profile '${PROFILE}'. See which characters matched in the output below and compare them with your profile."
-            for I in "${DATA}"; do
+            for I in ${DATA}; do
                 I=$(echo ${I} | sed 's/!space!/ /g')
                 LogText "Output: ${I}"
             done
@@ -59,7 +59,7 @@
         fi
 
         # Now parse the profile and filter out unwanted characters
-        DATA=$(egrep "^config:|^[a-z-].*=" ${PROFILE} | tr -dc '[:alnum:]/\[\]\(\)_\|,\.:;= \n\r-' | sed 's/ /!space!/g')
+        DATA=$(grep -E "^config:|^[a-z-].*=" ${PROFILE} | tr -dc '[:alnum:]/\[\]\(\)_\|,\.:;= \n\r-' | sed 's/ /!space!/g')
         for CONFIGOPTION in ${DATA}; do
             if ContainsString "^config:" "${CONFIGOPTION}"; then
                 # Old style configuration
@@ -76,7 +76,7 @@
 
                 # Is Lynis Enterprise allowed to purge this system when it is becomes outdated?
                 allow-auto-purge)
-                    FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$")
+                    FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)$")
                     if [ -n "${FIND}" ]; then
                         Report "allow-auto-purge=1"
                     else
@@ -109,7 +109,7 @@
                 colors)
                     # Quick mode (SKIP_PLUGINS) might already be set outside profile, so store in different variable
                     SETTING_COLORS=1 # default is yes
-                    FIND=$(echo "${VALUE}" | egrep "^(0|false|no)$") && COLORS=0
+                    FIND=$(echo "${VALUE}" | grep -E "^(0|false|no)$") && COLORS=0
                     if [ -n "${FIND}" ]; then SETTING_COLORS=0; RemoveColors; fi
                     Debug "Colors set to ${SETTING_COLORS}"
                     AddSetting "colors" "${SETTING_COLORS}" "Colored screen output"
@@ -165,27 +165,27 @@
 
                 # Do not check security repository in sources.list (Debian/Ubuntu)
                 debian-skip-security-repository | debian_skip_security_repository)
-                    FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)") && OPTION_DEBIAN_SKIP_SECURITY_REPOSITORY=1 
+                    FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)") && OPTION_DEBIAN_SKIP_SECURITY_REPOSITORY=1 
                     AddSetting "debian-skip-security-repository" "OPTION_DEBIAN_SKIP_SECURITY_REPOSITORY" "Skip checking for a security repository (Debian and others)"
                 ;;
 
                 # Debug status to show more details while running program
                 debug)
-                    FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)") && DEBUG=1
+                    FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)") && DEBUG=1
                     Debug "Debug mode set to '${DEBUG}'"
                     AddSetting "debug" "${DEBUG}" "Debugging mode"
                 ;;
 
                 # Development mode (--developer)
                 developer-mode)
-                    FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)") && DEVELOPER_MODE=1
+                    FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)") && DEVELOPER_MODE=1
                     Debug "Developer mode set to ${DEVELOPER_MODE}"
                     AddSetting "developer" "${DEVELOPER_MODE}" "Developer mode"
                 ;;
 
                 # Show non-zero exit code when errors are found
                 error-on-warnings)
-                    FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)") && ERROR_ON_WARNINGS=1
+                    FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)") && ERROR_ON_WARNINGS=1
                     Debug "Exit with different code on warnings is set to ${ERROR_ON_WARNINGS}"
                     AddSetting "error-on-warnings" "${ERROR_ON_WARNINGS}" "Use non-zero exit code if one or more warnings were found"
                 ;;
@@ -238,7 +238,7 @@
 
                 # Do (not) log tests if they have an different operating system
                 log-tests-incorrect-os | log_tests_incorrect_os)
-                    FIND=$(echo "${VALUE}" | egrep "^(0|false|no)") && SETTING_LOG_TESTS_INCORRECT_OS=0
+                    FIND=$(echo "${VALUE}" | grep -E "^(0|false|no)") && SETTING_LOG_TESTS_INCORRECT_OS=0
                     Debug "Logging of tests with incorrect operating system set to ${SETTING_LOG_TESTS_INCORRECT_OS}"
                     LOG_INCORRECT_OS=${SETTING_LOG_TESTS_INCORRECT_OS}
                 ;;
@@ -290,7 +290,7 @@
                 quick)
                     # Quick mode might already be set outside profile, so store in different variable
                     SETTING_QUICK_MODE=1 # default is yes
-                    FIND=$(echo "${VALUE}" | egrep "^(0|false|no)$") && QUICKMODE=0
+                    FIND=$(echo "${VALUE}" | grep -E "^(0|false|no)$") && QUICKMODE=0
                     if [ -n "${FIND}" ]; then SETTING_QUICK_MODE=1; fi
                     Debug "Quickmode set to ${SETTING_QUICK_MODE}"
                     AddSetting "quick" "${SETTING_QUICK_MODE}" "Quick mode (non-interactive)"
@@ -299,7 +299,7 @@
                 # Refresh software repositories
                 refresh-repositories)
                     SETTING_REFRESH_REPOSITORIES=1 # default is yes
-                    FIND=$(echo "${VALUE}" | egrep "^(0|false|no)$") && REFRESH_REPOSITORIES=0
+                    FIND=$(echo "${VALUE}" | grep -E "^(0|false|no)$") && REFRESH_REPOSITORIES=0
                     if [ -n "${FIND}" ]; then SETTING_REFRESH_REPOSITORIES=0; fi
                     Debug "Refreshing repositories set to ${SETTING_REFRESH_REPOSITORIES}"
                     AddSetting "refresh-repositories" "${SETTING_REFRESH_REPOSITORIES}" "Refresh repositories (for vulnerable package detection)"
@@ -308,7 +308,7 @@
                 # Show more details in report
                 show-report-solution)
                     SETTING_SHOW_REPORT_SOLUTION=${SHOW_REPORT_SOLUTION}
-                    FIND=$(echo "${VALUE}" | egrep "^(0|false|no)$") && SHOW_REPORT_SOLUTION=0
+                    FIND=$(echo "${VALUE}" | grep -E "^(0|false|no)$") && SHOW_REPORT_SOLUTION=0
                     if [ -n "${FIND}" ]; then SETTING_SHOW_REPORT_SOLUTION=0; fi
                     Debug "Show report details (solution) set to ${SETTING_SHOW_REPORT_SOLUTION}"
                 ;;
@@ -316,7 +316,7 @@
                 # Inline tips about tool (default enabled)
                 show_tool_tips | show-tool-tips)
                     SETTING_SHOW_TOOL_TIPS=1 # default is yes
-                    FIND=$(echo "${VALUE}" | egrep "^(0|false|no)$") && SHOW_TOOL_TIPS=0
+                    FIND=$(echo "${VALUE}" | grep -E "^(0|false|no)$") && SHOW_TOOL_TIPS=0
                     if [ -n "${FIND}" ]; then SETTING_SHOW_TOOL_TIPS=0; fi
                     Debug "Show tool tips set to ${SETTING_SHOW_TOOL_TIPS}"
                     AddSetting "show-tool-tips" "${SETTING_SHOW_TOOL_TIPS}" "Show tool tips"
@@ -326,7 +326,7 @@
                 show-warnings-only)
                     QUIET=1
                     QUICKMODE=1
-                    FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SHOW_WARNINGS_ONLY=1
+                    FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)$") && SHOW_WARNINGS_ONLY=1
                     Debug "Show warnings only set to ${SHOW_WARNINGS_ONLY}"
                     AddSetting "show-warnings-only" "${SHOW_WARNINGS_ONLY}" "Show only warnings"
                 ;;
@@ -335,7 +335,7 @@
                 skip-plugins)
                     # Skip plugins (SKIP_PLUGINS) might already be set, so store in different variable
                     SETTING_SKIP_PLUGINS=0 # default is no
-                    FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SKIP_PLUGINS=1
+                    FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)$") && SKIP_PLUGINS=1
                     if [ -n "${FIND}" ]; then SETTING_SKIP_PLUGINS=1; fi
                     Debug "Skip plugins is set to ${SETTING_SKIP_PLUGINS}"
                     AddSetting "skip-plugins" "${SETTING_SKIP_PLUGINS}" "Skip plugins"
@@ -349,7 +349,7 @@
 
                 # Do not check the latest version on the internet
                 skip_upgrade_test | skip-upgrade-test)
-                    FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)") && SKIP_UPGRADE_TEST=1
+                    FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)") && SKIP_UPGRADE_TEST=1
                     Debug "Skip upgrade test set to ${SKIP_UPGRADE_TEST}"
                 ;;
 
@@ -369,7 +369,7 @@
 
                 # Set strict mode for development and quality purposes
                 strict)
-                    FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)") && SET_STRICT=1
+                    FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)") && SET_STRICT=1
                 ;;
 
                 # The name of the customer/client that uses this system
@@ -398,7 +398,7 @@
                 # Perform upload
                 upload)
                     SETTING_UPLOAD=no # default
-                    FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && UPLOAD_DATA=1
+                    FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)$") && UPLOAD_DATA=1
                     if [ -n "${FIND}" ]; then SETTING_UPLOAD=1; fi
                     Debug "Upload set to ${SETTING_UPLOAD}"
                     AddSetting "upload" "${SETTING_UPLOAD}" "Data upload after scanning"
@@ -452,7 +452,7 @@
 
                 # Verbose output (--verbose)
                 verbose)
-                    FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)") && VERBOSE=1
+                    FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)") && VERBOSE=1
                     Debug "Verbose set to ${VERBOSE}"
                     AddSetting "verbose" "${VERBOSE}" "Verbose output"
                 ;;
diff --git a/include/tests_authentication b/include/tests_authentication
index 05f107ae..7f04a41f 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -863,7 +863,7 @@
                 NOW=$(date "+%s")
             fi
 
-            DAYS_SINCE_EPOCH=$((${NOW}/86400))
+            DAYS_SINCE_EPOCH=$((NOW / 86400))
             LogText "Data: Days since epoch is ${DAYS_SINCE_EPOCH}"
             LogText "Test: collecting accounts which have an expired password (last day changed + maximum change time)"
             # Skip fields with a !, *, or x, or !* (field $3 is last changed, $5 is maximum changed)
diff --git a/include/tests_boot_services b/include/tests_boot_services
index 2fee353f..fe6e316e 100644
--- a/include/tests_boot_services
+++ b/include/tests_boot_services
@@ -749,14 +749,14 @@
             Linux)
                 # Idle time, not real uptime
                 if [ -f /proc/uptime ]; then
-                    UPTIME_IN_SECS=$(cat /proc/uptime | ${CUTBINARY} -d ' ' -f1 | ${CUTBINARY} -d '.' -f1)
+                    UPTIME_IN_SECS=$(${CUTBINARY} -d ' ' -f1 /proc/uptime | ${CUTBINARY} -d '.' -f1)
                 else
                     Display --indent 2 --text "- Checking uptime" --result "${STATUS_SKIPPED}" --color YELLOW
                     ReportException "${TEST_NO}:1" "No uptime test available for this operating system (/proc/uptime missing)"
                 fi
-                ;;
+            ;;
 
-             DragonFly | FreeBSD | macOS)
+            DragonFly | FreeBSD | macOS)
                 if [ -n "${SYSCTLBINARY}" ]; then
                     TIME_BOOT=$(${SYSCTLBINARY} kern.boottime | ${AWKBINARY} '{ print $5 }' | ${SEDBINARY} -e 's/,//' | ${GREPBINARY} "[0-9]")
                     TIME_NOW=$(date "+%s")
@@ -771,9 +771,9 @@
                     Display --indent 2 --text "- Checking uptime" --result "${STATUS_SKIPPED}" --color YELLOW
                     ReportException "${TEST_NO}:4" "No uptime test available for this operating system (sysctl missing)"
                 fi
-                ;;
+            ;;
 
-             NetBSD | OpenBSD)
+            NetBSD | OpenBSD)
                 if [ -n "${SYSCTLBINARY}" ]; then
                     TIME_BOOT=$(${SYSCTLBINARY} -n kern.boottime)
                     TIME_NOW=$(date "+%s")
@@ -788,7 +788,7 @@
                     Display --indent 2 --text "- Checking uptime" --result "${STATUS_SKIPPED}" --color YELLOW
                     ReportException "${TEST_NO}:4" "No uptime test available for this operating system (sysctl missing)"
                 fi
-                ;;
+            ;;
 
             Solaris)
                 if [ -n "${KSTATBINARY}" ]; then
@@ -797,15 +797,16 @@
                     Display --indent 2 --text "- Checking uptime" --result "${STATUS_SKIPPED}" --color YELLOW
                     ReportException "${TEST_NO}:2" "No uptime test available for this operating system (kstat missing)"
                 fi
-                ;;
+            ;;
 
             *)
                 Display --indent 2 --text "- Checking uptime" --result "${STATUS_SKIPPED}" --color YELLOW
 
                 # Want to help improving Lynis? Share your operating system and a way to determine the uptime (in seconds)
                 ReportException "${TEST_NO}:3" "No uptime test available yet for this operating system"
-                ;;
+            ;;
         esac
+
         if [ -n "${UPTIME_IN_SECS}" ]; then
             UPTIME_IN_DAYS=$((UPTIME_IN_SECS / 60 / 60 / 24))
             LogText "Uptime (in seconds): ${UPTIME_IN_SECS}"
diff --git a/include/tests_firewalls b/include/tests_firewalls
index cb08696e..dabb7a97 100644
--- a/include/tests_firewalls
+++ b/include/tests_firewalls
@@ -115,7 +115,7 @@
             FIND="$FIND""\n"$(${IPTABLESBINARY} -t ${TABLE} --numeric --list | ${EGREPBINARY}  -z -o -w  '[A-Z]+' | tr -d '\0' | ${AWKBINARY} -v t=${TABLE} 'NR%2 {printf "%s %s ",t, $0 ; next;}1')
         done
 
-        echo "${FIND}" | while read line; do
+        echo "${FIND}" | while read -r line; do
             table=$(echo ${line} | ${AWKBINARY} '{ print $1 }')
             chainname=$(echo ${line} | ${AWKBINARY} '{ print $2 }')
             policy=$(echo ${line} | ${AWKBINARY} '{ print $3 }')
diff --git a/include/tests_mail_messaging b/include/tests_mail_messaging
index a8d33398..a5d116fc 100644
--- a/include/tests_mail_messaging
+++ b/include/tests_mail_messaging
@@ -203,7 +203,7 @@
             esac
 
             LogText "Test: Exim Try Verify Hosts"
-            if [ ! -z "${EXIM_TRY_VERIFY_HOSTS}" ]; then
+            if [ -n "${EXIM_TRY_VERIFY_HOSTS}" ]; then
                 LogText "Result: Try Verify Hosts enabled"
                 case "${EXIM_TYPE}" in
                     "INTERNET HOST" )
@@ -219,7 +219,7 @@
             fi
 
             LogText "Test: Exim Verify Hosts"
-            if [ ! -z "${EXIM_VERIFY_HOSTS}" ]; then
+            if [ -n "${EXIM_VERIFY_HOSTS}" ]; then
                 LogText "Result: Verify Hosts enabled"
                 case "${EXIM_TYPE}" in
                     "INTERNET HOST" )
diff --git a/include/tests_printers_spools b/include/tests_printers_spools
index a727f9a3..e2026bc5 100644
--- a/include/tests_printers_spools
+++ b/include/tests_printers_spools
@@ -276,7 +276,7 @@
 #################################################################################
 #
 
-if [ -n ${PRINTING_DAEMON} ]; then Report "printing_daemon=${PRINTING_DAEMON}"; fi
+if [ -n "${PRINTING_DAEMON}" ]; then Report "printing_daemon=${PRINTING_DAEMON}"; fi
 
 WaitForKeyPress
 
diff --git a/include/tests_webservers b/include/tests_webservers
index 1e893f26..01bb3f93 100644
--- a/include/tests_webservers
+++ b/include/tests_webservers
@@ -157,7 +157,7 @@
                 done
                 # Search Server aliases
                 for J in $(${GREPBINARY} "ServerAlias" ${I} | ${GREPBINARY} -v "^#" | ${SEDBINARY} "s/\s*ServerAlias //g" | ${SEDBINARY} "s/#.*//g"); do
-                    if [ -n ${J} ]; then
+                    if [ -n "${J}" ]; then
                         tVHOSTS="${tVHOSTS} ${J}"
                         cVHOSTS=$((cVHOSTS + 1))
                     fi
@@ -170,7 +170,7 @@
 
         # Log all virtual hosts we found
             for J in ${tVHOSTS}; do
-                if [ -n ${J} ]; then
+                if [ -n "${J}" ]; then
                     LogText "Virtual host: ${J}"
                     #Report "apache_vhost_name[]=${J}"
                 fi

From c0f9c0ab848f21cd66e7097acc3069afba4f17d1 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 19 Sep 2019 14:34:06 +0200
Subject: [PATCH 354/679] Style and log improvements

---
 include/helper_show             | 2 +-
 include/tests_insecure_services | 2 +-
 include/tests_nameservices      | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/helper_show b/include/helper_show
index ec5e7236..923f4496 100644
--- a/include/helper_show
+++ b/include/helper_show
@@ -423,7 +423,7 @@ if [ $# -gt 0 ]; then
                                     if [ -z "${SKIP_TESTS}" ]; then
                                         ${ECHOCMD} "  Profile:             ${GREEN}Yes${NORMAL} (not configured)"
                                     else
-                                        FIND=$(echo ${SKIP_TESTS} | egrep "${TEST}")
+                                        FIND=$(echo ${SKIP_TESTS} | grep -E "${TEST}")
                                         if [ -z "${FIND}" ]; then
                                             ${ECHOCMD} "  Profile:             ${GREEN}Yes${NORMAL} (test not marked to be skipped)"
                                         else
diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index f9ea8e07..3c2cd402 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -496,7 +496,7 @@
     Register --test-no INSE-8050 --os "macOS" --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight M --network NO --category security --description "Check for insecure services on macOS"
     if [ ${SKIPTEST} -eq 0 ]; then
         TEST_SERVICES="com.apple.fingerd com.apple.ftp-proxy"
-        for ITEM in "${TEST_SERVICES}"; do
+        for ITEM in ${TEST_SERVICES}; do
             if ${LAUNCHCTL_BINARY} list | ${GREPBINARY} -sq ${ITEM}; then
                 Display --indent 2 --text "- ${ITEM}" --result "${STATUS_NO}" --color RED
                 LogText "Result: found ${ITEM}, which is considered an insecure service"
diff --git a/include/tests_nameservices b/include/tests_nameservices
index bae149d4..56deb7ac 100644
--- a/include/tests_nameservices
+++ b/include/tests_nameservices
@@ -618,7 +618,7 @@
         DATA=$(${EGREPBINARY} -v '^(#|$)' ${ROOTDIR}etc/hosts | ${EGREPBINARY} '^(localhost|::1)\s' | ${GREPBINARY} -w ${HOSTNAME})
         if [ -n "${DATA}" ]; then
             LogText "Result: Found this server hostname mapped to a local address"
-            LogText "Output: ${sFIND}"
+            LogText "Output: ${DATA}"
             Display --indent 4 --text "- Hostname mapped to localhost" --result "${STATUS_FOUND}" --color YELLOW
             LogText "Information: Linking the hostname to the localhost entry may break some resolving. Split resolving so that localhost resolves back to 127.0.0.1 (and ::1) and the hostname of the machine to the real IP address on the network interface."
             ReportSuggestion ${TEST_NO} "Split resolving between localhost and the hostname of the system"

From 82d9940f13b1b2c59f3b61011e4971a31210afef Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 19 Sep 2019 15:17:23 +0200
Subject: [PATCH 355/679] Style changes

---
 extras/build-lynis.sh | 50 +++++++++++++++++++++----------------------
 1 file changed, 24 insertions(+), 26 deletions(-)

diff --git a/extras/build-lynis.sh b/extras/build-lynis.sh
index efe758cc..6726d998 100755
--- a/extras/build-lynis.sh
+++ b/extras/build-lynis.sh
@@ -55,23 +55,20 @@
 # Functions:
 
     # Clean temporary files up
-    CleanUp()
-      {
+    CleanUp() {
         if [ ! "${TMPDIR}" = "" -a -d "${TMPDIR}" ]; then
             rm -rf ${TMPDIR}
         fi
-      }
+    }
 
-    Exit()
-      {
+    Exit() {
         CleanUp
         exit 0
-      }
-    ExitFatal()
-      {
+    }
+    ExitFatal() {
         CleanUp
         exit 1
-      }
+    }
 #
 #########################################################################
 #
@@ -95,7 +92,7 @@
     if [ ! -d ${MYWORKDIR} ]; then
         echo "[X] Could not determine workdir (result: ${MYWORKDIR} seems invalid)"
         ExitFatal
-      else
+    else
         echo "[=] workdir: ${MYWORKDIR}"
     fi
 
@@ -105,7 +102,7 @@
         echo "[X] ${MYBUILDDIR} not found"
         echo "    Hint: create it with mkdir ${MYBUILDDIR}"
         ExitFatal
-      else
+    else
         echo "[=] builddir: ${MYBUILDDIR}"
     fi
 
@@ -129,7 +126,7 @@
     GITBUILDPACKAGEBINARY=$(which git-buildpackage)
     if [ ! "${GITBUILDPACKAGEBINARY}" = "" ]; then
         echo "[=] git-buildpackage = ${GITBUILDPACKAGEBINARY}"
-      else
+    else
         echo "[X] Can not find git-buildpackage binary"
         echo "    Hint: install git-buildpackage"
         ExitFatal
@@ -138,7 +135,7 @@
     RPMBUILDBINARY=$(which rpmbuild)
     if [ ! "${RPMBUILDBINARY}" = "" ]; then
         echo "[=] rpmbuild = ${RPMBUILDBINARY}"
-      else
+    else
         echo "[X] Can not find rpmbuild binary"
         echo "    Hint: install rpmbuild"
         ExitFatal
@@ -149,7 +146,7 @@
     umask ${OPTION_UMASK}
     if [ $? -eq 0 ]; then
         echo "[V] Setting umask to ${OPTION_UMASK}"
-      else
+    else
         echo "[X] Could not set umask"
         ExitFatal
     fi
@@ -157,7 +154,7 @@
     # Check if we are in dev directory
     if [ -f ../lynis -a -f ./build-lynis.sh ]; then
         echo "[V] Active in proper directory"
-      else
+    else
         echo "[X] This script should be executed from dev directory itself"
         ExitFatal
     fi
@@ -172,7 +169,7 @@
     if [ $? -eq 0 ]; then
         echo "[V] Creating temporary build directory"
         #echo "    BUILDROOT: ${TMPDIR}"
-      else
+    else
         echo "[X] Could not create temporary build directory"
         ExitFatal
     fi
@@ -192,11 +189,11 @@
 
     if [ -f ${TARBALL} ]; then
         echo "Tarball already exists for this version, not overwriting it"
-      else
+    else
         tar -C ${MYWORKDIR} --exclude=debian --exclude=README.md --exclude=.bzr* --exclude=.git* -c -z -f ${TARBALL} lynis 2> /dev/null
         if [ -f ${TARBALL} ]; then
             echo "[V] Tarball created"
-          else
+        else
             echo "[X] Tarball ${TARBALL} could not be created"
             ExitFatal
         fi
@@ -220,7 +217,7 @@
             fi
             echo "[*] Start RPM building"
             #${RPMBUILDBINARY} --quiet -ba -bl lynis.spec 2> /dev/null
-          else
+        else
             echo "[X] lynis.spec not found"
             ExitFatal
         fi
@@ -228,12 +225,12 @@
         RPMFILE="${RPMWORKDIR}/RPMS/noarch/lynis-${LYNIS_VERSION}-1.noarch.rpm"
         if [ -f ${RPMFILE} ]; then
             echo "[V] Building RPM successful!"
-          else
+        else
             echo "[X] Could not find RPM file, most likely failed"
             echo "    Expected: ${RPMFILE}"
             ExitFatal
         fi
-      else
+    else
         echo "[X] Could not find source file (${SOURCEFILE_RPM})"
         echo "    Hint: cp <lynis.tar.gz> ${SOURCEFILE_RPM}"
         #ExitFatal
@@ -246,7 +243,7 @@
         DEBCHANGELOGVERSIONREV=$(echo ${DEBCHANGELOGFULLVERSION} | awk -F- '{ print $2 }')
         if [ "${LYNIS_VERSION}" = "${DEBCHANGELOGVERSION}" ]; then
             echo "[V] Debian/changelog up-to-date"
-          else
+        else
             echo "[X] Debian/changelog outdated"
             ExitFatal
         fi
@@ -260,17 +257,17 @@
 #        echo "[=] Version in Debian changelog: ${DEBCHANGELOGVERSION} (revision: ${DEBCHANGELOGVERSIONREV})"
 #        if [ "${LYNIS_VERSION}" = "${DEBCHANGELOGVERSION}" ]; then
 #            echo "[V] Debian/changelog up-to-date"
-#          else
+#        else
 #            echo "[X] Debian/changelog outdated"
 ##            ExitFatal
 #        fi
 #        # execute command
 #        # bzr builddeb . --build-dir ${DEBWORKDIR}/build-area/ --result-dir ${DEBWORKDIR}
-#      elif [ "${BZRSTATUS}" = "3" ]; then
+#    elif [ "${BZRSTATUS}" = "3" ]; then
 #        echo "[X] Tree is not initialized for BZR"
 #        echo "    Hint: run bzr init while being in lynis directory (or bzr init ..)"
 #        ExitFatal
-#      else
+#    else
 #        echo "[X] Unknown error"
 #        echo "Output: ${BZRSTATUS}"
 #    fi
@@ -284,6 +281,7 @@
         rm -rf ${MYBUILDDIR}/git/Lynis
         #git checkout tags/${LYNIS_VERSION}
     fi
+
     git clone https://github.com/CISOfy/Lynis.git ${MYBUILDDIR}/git/Lynis
 
     if [ -d ${MYBUILDDIR}/git/Lynis/debian/ ]; then
@@ -292,7 +290,7 @@
         cd ${MYBUILDDIR}/git/Lynis/debian/
         git add .
         git commit -m "Building process for Lynis release version ${LYNIS_VERSION}"
-      else
+    else
         echo "[X] Could not copy debian directory and commit changes"
     fi
     #git tag -l ${MYBUILDDIR}/git/Lynis

From b39d0c3b69e64f98557c8203df0a1bc0f36db949 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 19 Sep 2019 15:21:51 +0200
Subject: [PATCH 356/679] Indented spacing

---
 extras/build-lynis.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extras/build-lynis.sh b/extras/build-lynis.sh
index 6726d998..974f2937 100755
--- a/extras/build-lynis.sh
+++ b/extras/build-lynis.sh
@@ -344,7 +344,7 @@ Exit
     FIND=$(sh -n ${OPTION_BINARY_FILE} ; echo $?)
     if [ $FIND -eq 0 ]; then
         echo "OK"
-      else
+    else
         echo "BAD"
     fi
 

From 187016a0511e59f95defc1b04dd39195fecdc50c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 19 Sep 2019 15:23:37 +0200
Subject: [PATCH 357/679] Changed spacing

---
 include/tests_nameservices | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/tests_nameservices b/include/tests_nameservices
index 56deb7ac..71f1427e 100644
--- a/include/tests_nameservices
+++ b/include/tests_nameservices
@@ -602,10 +602,10 @@
                 ReportSuggestion ${TEST_NO} "Add the IP name and FQDN to /etc/hosts for proper name resolving"
                 LogText "Risk: No entry for the server name [hostname] in /etc/hosts may cause unexpected performance problems for local connections"
             fi
-         else
+        else
             LogText "Result: Skipping test, no hostname configured"
-         fi
-     fi
+        fi
+    fi
 #
 #################################################################################
 #

From e48df09c4c3d62a02bae7898593b825d96510431 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 19 Sep 2019 19:10:13 +0200
Subject: [PATCH 358/679] Fixed typo found by SDK

---
 include/tests_dns | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_dns b/include/tests_dns
index b7cf2ba8..28bea959 100644
--- a/include/tests_dns
+++ b/include/tests_dns
@@ -24,8 +24,8 @@
 #
 #    # TODO create records on test domain
 #    # TODO after update even IP match can be checked to detect hijacking
-#    SIGOKDNS="sigok.example.org"      # adress with good DNSSEC signature
-#    SIGFAILDNS="sigfail.example.org"  # adress with bad  DNSSEC signature
+#    SIGOKDNS="sigok.example.org"      # address with good DNSSEC signature
+#    SIGFAILDNS="sigfail.example.org"  # address with bad  DNSSEC signature
 #    TIMEOUT=";; connection timed out; no servers could be reached"
 #
 #################################################################################

From 09a60783a69868506e8621079f8d7f42871f08ee Mon Sep 17 00:00:00 2001
From: Marzal <2069735+Marzal@users.noreply.github.com>
Date: Thu, 19 Sep 2019 20:00:12 +0200
Subject: [PATCH 359/679] Prefer [ p ] && [ q ] as [ p -a q ] is not well
 defined.SC2166

---
 include/functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/functions b/include/functions
index 7d003976..2484f76a 100644
--- a/include/functions
+++ b/include/functions
@@ -1527,7 +1527,7 @@
         if [ -z "${search}" ]; then ExitFatal "Missing process to search for when using IsRunning function"; fi
         RUNNING=0
         # AIX does not fully support pgrep options, so using ps instead
-        if [ -n "${PGREPBINARY}" -a ! "${OS}" = "AIX" ]; then
+        if [ -n "${PGREPBINARY}" ] && [ "${OS}" != "AIX" ]; then
             # When --user is used, perform a search using the -u option
                             # Initialize users for strict mode
             if [ -n "${users:-}" ]; then

From ddd87371b5b31821d0705003bfd13c1b89157af7 Mon Sep 17 00:00:00 2001
From: Marzal <2069735+Marzal@users.noreply.github.com>
Date: Thu, 19 Sep 2019 20:01:31 +0200
Subject: [PATCH 360/679] Double quote to prevent globbing and word
 splitting.SC2086 Info

---
 include/functions | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/functions b/include/functions
index 2484f76a..a10fb7c7 100644
--- a/include/functions
+++ b/include/functions
@@ -1532,12 +1532,12 @@
                             # Initialize users for strict mode
             if [ -n "${users:-}" ]; then
                 for u in ${users}; do
-                    user_uid=$(getent passwd ${u} 2> /dev/null | ${AWKBINARY} -F: '{print $3}')
+                    user_uid=$(getent passwd "${u}" 2> /dev/null | ${AWKBINARY} -F: '{print $3}')
                     # Only perform search if user exists and we had no match yet
                     if [ -n "${user_uid}" ]; then
                         if [ -z "${FIND}" ]; then
                             LogText "Performing pgrep scan using uid ${user_uid}"
-                            FIND=$(${PGREPBINARY} ${pgrep_options} -u ${user_uid} "${search}" | ${TRBINARY} '\n' ' ')
+                            FIND=$(${PGREPBINARY} ${pgrep_options} -u "${user_uid}" "${search}" | ${TRBINARY} '\n' ' ')
                         fi
                     fi
                 done
@@ -1546,7 +1546,7 @@
                 FIND=$(${PGREPBINARY} ${pgrep_options} "${search}" | ${TRBINARY} '\n' ' ')
             fi
         else
-            if [ ${SHELL_IS_BUSYBOX} -eq 1 ]; then
+            if [ "${SHELL_IS_BUSYBOX}" -eq 1 ]; then
                 # This search is not foolproof
                 LogText "Performing simple ps scan (busybox)"
                 PSOPTIONS=" -o args="
@@ -1554,16 +1554,16 @@
             else
                 if [ -n "${users}" ]; then
                     for u in ${users}; do
-                        user_uid=$(getent passwd ${u} 2> /dev/null | ${AWKBINARY} -F: '{print $3}')
+                        user_uid=$(getent passwd "${u}" 2> /dev/null | ${AWKBINARY} -F: '{print $3}')
                         # Only perform search if user exists and we had no match yet
                         if [ -n "${user_uid}" ]; then
                             if [ -z "${FIND}" ]; then
                                 if [ ${PARTIAL_SEARCH} -eq 1 ]; then
                                     LogText "Performing ps scan using partial match and for uid ${user_uid}"
-                                    FIND=$(${PSBINARY} -u ${user_uid} -o comm= "${search}" | ${AWKBINARY} -v pattern="${search}" '$0 ~ pattern {print}')
+                                    FIND=$(${PSBINARY} -u "${user_uid}" -o comm= "${search}" | ${AWKBINARY} -v pattern="${search}" '$0 ~ pattern {print}')
                                 else
                                     LogText "Performing ps scan using exact match and for uid ${user_uid}"
-                                    FIND=$(${PSBINARY} -u ${user_uid} -o comm= "${search}" | ${AWKBINARY} -v pattern="^${search}$" '$0 ~ pattern {print}')
+                                    FIND=$(${PSBINARY} -u "${user_uid}" -o comm= "${search}" | ${AWKBINARY} -v pattern="^${search}$" '$0 ~ pattern {print}')
                                 fi
                             fi
                         fi

From 42ac40aad6a15c2ae354e8a274723355cb7f26d3 Mon Sep 17 00:00:00 2001
From: Marzal <2069735+Marzal@users.noreply.github.com>
Date: Thu, 19 Sep 2019 23:33:19 +0200
Subject: [PATCH 361/679] Change variable name from FIND to FIND_P so is not
 reset by Register

---
 include/tests_authentication | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 05f107ae..9838b399 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -742,24 +742,24 @@
             case ${LINUX_VERSION} in
                 "SuSE")
                     PREQS_MET="YES"
-                    FIND=$(passwd -a -S 2> /dev/null | ${AWKBINARY} '{ if ($2=="P" && $5=="99999") print $1 }')
+                    FIND_P=$(passwd -a -S 2> /dev/null | ${AWKBINARY} '{ if ($2=="P" && $5=="99999") print $1 }')
                     FIND2=$(passwd -a -S 2> /dev/null | ${AWKBINARY} '{ if ($2=="NP") print $1 }')
                     ;;
                 *)
                     PREQS_MET="YES"
-                    FIND=$(passwd --all --status 2> /dev/null | ${AWKBINARY} '{ if ($2=="P" && $5=="99999") print $1 }')
+                    FIND_P=$(passwd --all --status 2> /dev/null | ${AWKBINARY} '{ if ($2=="P" && $5=="99999") print $1 }')
                     FIND2=$(passwd --all --status 2> /dev/null | ${AWKBINARY} '{ if ($2=="NP") print $1 }')
                     ;;
             esac
         elif [ ${OS_REDHAT_OR_CLONE} -eq 1 ]; then
             PREQS_MET="YES"
-            FIND=$(for I in $(${AWKBINARY} -F: '{print $1}' ${ROOTDIR}etc/passwd) ; do passwd -S $I | ${AWKBINARY} '{ if ($2=="PS" && $5=="99999") print $1 }' ; done)
+            FIND_P=$(for I in $(${AWKBINARY} -F: '{print $1}' ${ROOTDIR}etc/passwd) ; do passwd -S $I | ${AWKBINARY} '{ if ($2=="PS" && $5=="99999") print $1 }' ; done)
             FIND2=$(for I in $(${AWKBINARY} -F: '{print $1}' ${ROOTDIR}etc/passwd) ; do passwd -S $I | ${AWKBINARY} '{ if ($2=="NP") print $1 }' ; done)
         else
             LogText "Result: skipping test for this Linux version"
             ReportManual "AUTH-9282:01"
             PREQS_MET="NO"
-            FIND=""
+            FIND_P=""
             FIND2=""
         fi
      else
@@ -771,12 +771,12 @@
     Register --test-no AUTH-9282 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking password protected account without expire date"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking Linux version and password expire date status"
-        if [ -z "${FIND}" ]; then
+        if [ -z "${FIND_P}" ]; then
             LogText "Result: all accounts seem to have an expire date"
             Display --indent 2 --text "- Accounts without expire date" --result "${STATUS_OK}" --color GREEN
         else
-            LogText "Result: found one or more accounts with expire date set"
-            for I in ${FIND}; do
+            LogText "Result: found one or more accounts without expire date set"
+            for I in ${FIND_P}; do
                 LogText "Account without expire date: ${I}"
             done
             Display --indent 2 --text "- Accounts without expire date" --result "${STATUS_SUGGESTION}" --color YELLOW

From 0e1e80bacf81e28b9a70ab0a997480bc3d7141f6 Mon Sep 17 00:00:00 2001
From: Marzal <2069735+Marzal@users.noreply.github.com>
Date: Thu, 19 Sep 2019 23:36:36 +0200
Subject: [PATCH 362/679] Double quote to prevent globbing and word
 splitting.SC2086

---
 include/tests_authentication | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 9838b399..fc3d05df 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -738,7 +738,7 @@
     # Note        : Every Linux based operating system seem to have different passwd
     #               options, so we have to check the version first.
     if [ "${OS}" = "Linux" ]; then
-        if [ ${OS_REDHAT_OR_CLONE} -eq 0 ]; then
+        if [ "${OS_REDHAT_OR_CLONE}" -eq 0 ]; then
             case ${LINUX_VERSION} in
                 "SuSE")
                     PREQS_MET="YES"
@@ -751,10 +751,10 @@
                     FIND2=$(passwd --all --status 2> /dev/null | ${AWKBINARY} '{ if ($2=="NP") print $1 }')
                     ;;
             esac
-        elif [ ${OS_REDHAT_OR_CLONE} -eq 1 ]; then
+        elif [ "${OS_REDHAT_OR_CLONE}" -eq 1 ]; then
             PREQS_MET="YES"
-            FIND_P=$(for I in $(${AWKBINARY} -F: '{print $1}' ${ROOTDIR}etc/passwd) ; do passwd -S $I | ${AWKBINARY} '{ if ($2=="PS" && $5=="99999") print $1 }' ; done)
-            FIND2=$(for I in $(${AWKBINARY} -F: '{print $1}' ${ROOTDIR}etc/passwd) ; do passwd -S $I | ${AWKBINARY} '{ if ($2=="NP") print $1 }' ; done)
+            FIND_P=$(for I in $(${AWKBINARY} -F: '{print $1}' "${ROOTDIR}etc/passwd") ; do passwd -S "$I" | ${AWKBINARY} '{ if ($2=="PS" && $5=="99999") print $1 }' ; done)
+            FIND2=$(for I in $(${AWKBINARY} -F: '{print $1}' "${ROOTDIR}etc/passwd") ; do passwd -S "$I" | ${AWKBINARY} '{ if ($2=="NP") print $1 }' ; done)
         else
             LogText "Result: skipping test for this Linux version"
             ReportManual "AUTH-9282:01"
@@ -769,7 +769,7 @@
     # Test        : AUTH-9282
     # Description : Search password protected accounts without expire (Linux)
     Register --test-no AUTH-9282 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking password protected account without expire date"
-    if [ ${SKIPTEST} -eq 0 ]; then
+    if [ "${SKIPTEST}" -eq 0 ]; then
         LogText "Test: Checking Linux version and password expire date status"
         if [ -z "${FIND_P}" ]; then
             LogText "Result: all accounts seem to have an expire date"
@@ -780,7 +780,7 @@
                 LogText "Account without expire date: ${I}"
             done
             Display --indent 2 --text "- Accounts without expire date" --result "${STATUS_SUGGESTION}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "When possible set expire dates for all password protected accounts"
+            ReportSuggestion "${TEST_NO}" "When possible set expire dates for all password protected accounts"
         fi
     fi
 #
@@ -789,7 +789,7 @@
     # Test        : AUTH-9283
     # Description : Search passwordless accounts
     Register --test-no AUTH-9283 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking accounts without password"
-    if [ ${SKIPTEST} -eq 0 ]; then
+    if [ "${SKIPTEST}" -eq 0 ]; then
         LogText "Test: Checking passwordless accounts"
         if [ -z "${FIND2}" ]; then
             LogText "Result: all accounts seem to have a password"
@@ -801,7 +801,7 @@
                 Report "account_without_password=${I}"
             done
             Display --indent 2 --text "- Accounts without password" --result "${STATUS_WARNING}" --color RED
-            ReportWarning ${TEST_NO} "Found accounts without password"
+            ReportWarning "${TEST_NO}" "Found accounts without password"
         fi
     fi
 #

From 8088d0ab7746d0f1ef6ceb709406147393874584 Mon Sep 17 00:00:00 2001
From: Mike Robinson <multiwebinc@users.noreply.github.com>
Date: Thu, 19 Sep 2019 18:14:06 -0600
Subject: [PATCH 363/679] Update tests_ldap

Check was backwards
---
 include/tests_ldap | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/tests_ldap b/include/tests_ldap
index cd7be982..473d3c71 100644
--- a/include/tests_ldap
+++ b/include/tests_ldap
@@ -37,13 +37,13 @@
     Register --test-no LDAP-2219 --weight L --network NO --category security --description "Check running OpenLDAP instance"
     if [ ${SKIPTEST} -eq 0 ]; then
         if IsRunning "slapd"; then
-            Display --indent 2 --text "- Checking OpenLDAP instance" --result "${STATUS_NOT_FOUND}" --color WHITE
-            LogText "Result: No running slapd process found."
-        else
             Display --indent 2 --text "- Checking OpenLDAP instance" --result "${STATUS_FOUND}" --color GREEN
             LogText "Result: Found running slapd process"
             SLAPDFOUND=1
             SLAPD_RUNNING=1
+        else    
+            Display --indent 2 --text "- Checking OpenLDAP instance" --result "${STATUS_NOT_FOUND}" --color WHITE
+            LogText "Result: No running slapd process found."
         fi
     fi
 #

From 294bed32416904a6bbb80b5dd8e340c44512cf3b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 21 Sep 2019 11:12:25 +0200
Subject: [PATCH 364/679] Initial version of guestbook with happy users

---
 HAPPY_USERS.md | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 HAPPY_USERS.md

diff --git a/HAPPY_USERS.md b/HAPPY_USERS.md
new file mode 100644
index 00000000..ffad49c3
--- /dev/null
+++ b/HAPPY_USERS.md
@@ -0,0 +1,33 @@
+# Happy users of the Lynis project
+
+## Community
+
+Since 2007 the Lynis project helped many system administrators and security
+professionals to scan their systems and perform system hardening. Happy users
+and contributors are the foundation of a healthy project.
+
+
+## Your contribution
+
+Are you also using Lynis? Contribute to the project by let others know:
+1) What you like about the tool
+2) How you use it
+
+Your addition to the guestbook below will help existing and new users learn more
+about how Lynis can help them.
+
+### How to
+
+Create a pull request and add your name above the first entry. Thanks!
+
+
+## Our guestbook
+
+* <your name and story>
+
+* Michael Boelen - September 2019
+The development of Lynis learned me a lot about Linux and Unix security. It is
+installed on all my systems to uncover unexpected configuration issues. The
+valuable feedback and contributions give me the energy to continue to work on
+its development, even after 12+ years!
+

From a1b6d463b2f3ff5f9cdd2383bc3ee031f38bb4e5 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 21 Sep 2019 16:31:06 +0200
Subject: [PATCH 365/679] Fixed a typo

---
 CHANGELOG.md                  | 5 +++--
 include/binaries              | 4 ++--
 include/functions             | 2 +-
 include/profiles              | 2 +-
 include/tests_custom.template | 2 +-
 include/tests_databases       | 2 +-
 include/tests_dns             | 4 ++--
 include/tests_hardening       | 2 +-
 include/tests_homedirs        | 2 +-
 include/tests_ldap            | 2 +-
 include/tests_nameservices    | 2 +-
 include/tests_php             | 4 ++--
 include/tests_ports_packages  | 2 +-
 include/tests_shells          | 4 ++--
 include/tests_squid           | 2 +-
 include/tests_time            | 4 ++--
 include/tests_virtualization  | 1 -
 17 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a36e9f45..9679fa2f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -67,6 +67,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - Profiles: message is displayed when old format "key:value" is used
 - Security: the 'nounset' (set -u) parameter is now activated by default
 - AUTH-9266 - skip .pam-old files in /etc/pam.d
+- AUTH-9282 - fix: temporary variable was overwritten
 - AUTH-9408 - added support for pam_tally2 to log failed logins
 - CONT-8106 - support newer 'docker info' output
 - CRYP-8002 - gather kernel entropy on Linux systems
@@ -2916,10 +2917,10 @@ Lynis 1.1.7 (2008-06-28)
  - Added dig availability check to DNS test [NETW-2704]
  - Bugfix: Fixed iptables test if the binary is not located in /sbin [FIRE-4512]
  - Bugfix: Improved yum-utils check to display suggestions correctly [PKGS-7384]
- - Bugfix: Fixed prequisits for grpck test [AUTH-9216]
+ - Bugfix: Fixed prerequisites for grpck test [AUTH-9216]
  - Improved MySQL check [DBS-1804]
  - Changed color at chkconfig boot services test [BOOT-5177]
- - Added missing prequisits output to portaudit test [PKGS-7382]
+ - Added missing prerequisites output to portaudit test [PKGS-7382]
  - Test output for FreeBSD mounts (UFS) improved [FILE-6329]
  - Extended OpenLDAP test to avoid finding itself in ps output [LDAP-2219]
  - Several tests have their warning reporting improved
diff --git a/include/binaries b/include/binaries
index 7af676f8..648fb1d3 100644
--- a/include/binaries
+++ b/include/binaries
@@ -65,10 +65,10 @@
             if [ ${FOUND} -eq 1 ]; then
                 # Stop execution if privileged, otherwise continue but warn user
                 if [ ${PRIVILEGED} -eq 1 ]; then
-                    ExitFatal "Possible riskful location (${SCANDIR}) in PATH discovered. Quitting..."
+                    ExitFatal "Suspicious location (${SCANDIR}) in PATH discovered. Quitting..."
                 else
                     Display --indent 4 --text "Warning: suspicious location (${SCANDIR}) in PATH"
-                    ReportWarning "${TEST_NO}" "Possible riskful location in PATH discovered" "text:${MSG}"
+                    ReportWarning "${TEST_NO}" "Suspicious location in PATH discovered" "text:${MSG}"
                     sleep 1
                 fi
             fi
diff --git a/include/functions b/include/functions
index 3be7168a..d0992299 100644
--- a/include/functions
+++ b/include/functions
@@ -1418,7 +1418,7 @@
         if [ -e /proc/1/environ ]; then
             FIND=$(grep -qa 'container=lxc' ${ROOTDIR}proc/1/environ 2> /dev/null)
             if [ $? -eq 0 ]; then
-                LogText "Result: found LXC in environnement (/proc/1/environ), so we are running in LXC container"
+                LogText "Result: found LXC in environment (/proc/1/environ), so we are running in LXC container"
                 CONTAINER_TYPE="LXC"; FOUND=1
                 EXITCODE=0
             fi
diff --git a/include/profiles b/include/profiles
index f10d27a2..d05dcbb3 100644
--- a/include/profiles
+++ b/include/profiles
@@ -196,7 +196,7 @@
                     OPTION_FREEBSD_SKIP_PORTAUDIT="${VALUE}"
                 ;;
 
-                # Lynis Enterprise: group name - deprecrated option
+                # Lynis Enterprise: group name - deprecated option
                 group)
                     GROUP_NAME="${VALUE}"
                     AddSetting "group" "${GROUP_NAME}" "Group"
diff --git a/include/tests_custom.template b/include/tests_custom.template
index f2e6a2ef..e8de448f 100644
--- a/include/tests_custom.template
+++ b/include/tests_custom.template
@@ -109,7 +109,7 @@
 #################################################################################
 #
     # Test        : CUST-0040
-    # Description : Our second test, with a prequisite test
+    # Description : Our second test, with a prerequisite test
 
     # First check if OPENSSLBINARY is known as a prerequisite for this test
     # ! means "not". So if the binary is known, the prerequisite is matched. Otherwise we set it to NO and define a reason why we skipped this test
diff --git a/include/tests_databases b/include/tests_databases
index 01dcfe12..3ece8a99 100644
--- a/include/tests_databases
+++ b/include/tests_databases
@@ -219,7 +219,7 @@
 #################################################################################
 #
     # Test        : DBS-1860
-    # Description : Checks if a DB2 instance is currently runnigng
+    # Description : Checks if a DB2 instance is currently running
     Register --test-no DBS-1860 --weight L --network NO --category security --description "Checking active DB2 instances"
     if [ ${SKIPTEST} -eq 0 ]; then
         if IsRunning db2sysc; then
diff --git a/include/tests_dns b/include/tests_dns
index 28bea959..7e6109f5 100644
--- a/include/tests_dns
+++ b/include/tests_dns
@@ -35,7 +35,7 @@
 #################################################################################
 #
 #    # Test        : DNS-1600
-#    # Description : Validate DNSSEC signiture is checked
+#    # Description : Validate DNSSEC signature is checked
 #    Register --test-no DNS-1600 --weight L --network YES --category security --description "Validate DNSSEC igniture is checked"
 #    if [ "${SKIPTEST}" -eq 0 ]; then
 #        if [ -n "${DIGBINARY}" ]; then
@@ -54,7 +54,7 @@
 #            elif [ -n "${GOOD}" -a -n "${BAD}" ]; then
 #                Display --indent 4 --text "- Checking DNSSEC validation" --result "${STATUS_SUGGESTION}" --color YELLOW
 #                LogText "Note: Using DNSSEC validation can protect from DNS hijacking"
-#                #ReportSuggestion "${TEST_NO}" "Altered DNS queries are accepted, configure DNSSEC valdating name servers"
+#                #ReportSuggestion "${TEST_NO}" "Altered DNS queries are accepted, configure DNSSEC validating name servers"
 #                AddHP 2 2
 #            elif [ -n "${GOOD}" -a -z "${BAD}" ]; then
 #                Display --indent 4 --text "- Checking DNSSEC validation" --result "${STATUS_OK}" --color GREEN
diff --git a/include/tests_hardening b/include/tests_hardening
index 006df683..12af3c9b 100644
--- a/include/tests_hardening
+++ b/include/tests_hardening
@@ -20,7 +20,7 @@
 #
     InsertSection "Hardening"
 
-    # COMPILER_INSTALLED is initialised before
+    # COMPILER_INSTALLED is initialized before
     HARDEN_COMPILERS_NEEDED=0
 #
 #################################################################################
diff --git a/include/tests_homedirs b/include/tests_homedirs
index f4fcb61d..9b8c9c64 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -135,7 +135,7 @@
                 LogText "Info: above files could be redirected files to avoid logging and should be investigated"
                 ReportWarning ${TEST_NO} "Incorrect file type found for shell history file"
             fi
-            LogText "Remarks: History files are normally of the type 'file'. Symbolic links and other types can be riskful."
+            LogText "Remarks: History files are normally of the type 'file'. Symbolic links and other types are suspicious."
         else
             Display --indent 2 --text "- Checking shell history files" --result "${STATUS_SKIPPED}" --color WHITE
             LogText "Result: Homedirs is empty, test will be skipped"
diff --git a/include/tests_ldap b/include/tests_ldap
index 473d3c71..63e26e58 100644
--- a/include/tests_ldap
+++ b/include/tests_ldap
@@ -89,7 +89,7 @@
 #################################################################################
 #
     # Test        : LDAP-2240
-    # Description : Check OpenLDAP unencrypted RootDN password
+    # Description : Check OpenLDAP plaintext RootDN password
 #
 #################################################################################
 #
diff --git a/include/tests_nameservices b/include/tests_nameservices
index 71f1427e..aa60885b 100644
--- a/include/tests_nameservices
+++ b/include/tests_nameservices
@@ -124,7 +124,7 @@
                     Report "resolv_conf_option[]=${ITEM}"
                     # TODO add suggestions for the related options
                     # rotate --> add performance tune point
-                    # timeout --> add performe tune point when smaller than 3 seconds
+                    # timeout --> add performance tune point when smaller than 3 seconds
                 done
                 Display --indent 2 --text "- Checking /etc/resolv.conf options" --result "${STATUS_FOUND}" --color GREEN
             fi
diff --git a/include/tests_php b/include/tests_php
index 23ece909..d2303c2c 100644
--- a/include/tests_php
+++ b/include/tests_php
@@ -295,7 +295,7 @@
         FIND=$(${EGREPBINARY} -i 'allow_url_fopen.*(off|no|0)' ${PHPINIFILE} | ${GREPBINARY} -v '^;')
         if [ -z "${FIND}" ]; then
             Display --indent 4 --text "- Checking allow_url_fopen option" --result "${STATUS_ON}" --color YELLOW
-            LogText "Result: allow_url_fopen option is turned on, which can be used for riskful downloads via PHP"
+            LogText "Result: allow_url_fopen option is turned on, which can be used for downloads via PHP and is a security risk"
             ReportSuggestion ${TEST_NO} "Change the allow_url_fopen line to: allow_url_fopen = Off, to disable downloads via PHP"
             AddHP 0 1
         else
@@ -318,7 +318,7 @@
         FIND=$(${EGREPBINARY} -i 'allow_url_include.*(off|no|0)' ${PHPINIFILE} | ${GREPBINARY} -v '^;')
         if [ -z "${FIND}" ]; then
             Display --indent 4 --text "- Checking allow_url_include option" --result "${STATUS_ON}" --color YELLOW
-            Report "Result: allow_url_include option is turned on, which can be used for riskful downloads via PHP"
+            Report "Result: allow_url_include option is turned on, which can be used for downloads via PHP and is a risk"
             ReportSuggestion ${TEST_NO} "Change the allow_url_include line to: allow_url_include = Off, to disable downloads via PHP"
             AddHP 0 1
         else
diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index e82c8eaf..55276ca5 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -650,7 +650,7 @@
                 LogText "Result: Cron job is not configured for debsums utility."
                 Display --indent 6 --text "- Cron job for debsums" --result "${STATUS_NOT_FOUND}" --color YELLOW
                 AddHP 1 3
-                ReportSuggestion "${TEST_NO}" "Check debsums configuration and enable checking regurlarly via a cron job."
+                ReportSuggestion "${TEST_NO}" "Check debsums configuration and enable checking regularly via a cron job."
             fi
         else
             LogText "Result: debsums utility is not installed."
diff --git a/include/tests_shells b/include/tests_shells
index 37d152b4..480166be 100644
--- a/include/tests_shells
+++ b/include/tests_shells
@@ -109,12 +109,12 @@
         LogText "Test: Search for session timeout tools or settings in shell"
         if IsRunning "timeoutd"; then
             IDLE_TIMEOUT=1
-            LogText "Result: found timeoutd process to kill idle sesions"
+            LogText "Result: found timeoutd process to kill idle sessions"
             IDLE_TIMEOUT_METHOD="timeout-daemon"
         fi
         if IsRunning "autolog"; then
             IDLE_TIMEOUT=1
-            LogText "Result: found autolog process to kill idle sesions"
+            LogText "Result: found autolog process to kill idle sessions"
             Report="session_timeout_method[]=autolog"
             IDLE_TIMEOUT_METHOD="autolog"
         fi
diff --git a/include/tests_squid b/include/tests_squid
index bfb699f0..f6070507 100644
--- a/include/tests_squid
+++ b/include/tests_squid
@@ -222,7 +222,7 @@
 #################################################################################
 #
     # Test        : SQD-3624
-    # Description : Check unsecure ports in Safe_ports list
+    # Description : Check insecure ports in Safe_ports list
     if [ ${SQUID_DAEMON_RUNNING} -eq 1 -a ! "${SQUID_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SQD-3624 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check Squid safe ports"
     if [ ${SKIPTEST} -eq 0 ]; then
diff --git a/include/tests_time b/include/tests_time
index 00245ff2..4f24da5c 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -108,7 +108,7 @@
                     LogText "Result: ${ROOTDIR}etc/systemd/timesyncd.conf does not exist"
                 fi
             else
-                LogText "Result: time sychronization not performed according timedatectl command"
+                LogText "Result: time synchronization not performed according timedatectl command"
             fi
         else
             LogText "Result: timedatectl command not available on this system"
@@ -223,7 +223,7 @@
         FIND=$(${TIMEDATECTL} status | ${EGREPBINARY} "(NTP|System clock) synchronized: yes")
         if [ -z "${FIND}" ]; then
             LogText "Result: time not synchronized via NTP"
-            ReportSuggestion "${TEST_NO}" "Check timedatectl output. Sychronization via NTP is enabled, but status reflects it is not synchronized"
+            ReportSuggestion "${TEST_NO}" "Check timedatectl output. Synchronization via NTP is enabled, but status reflects it is not synchronized"
         fi
     fi
 #
diff --git a/include/tests_virtualization b/include/tests_virtualization
index 0f22f149..825eefeb 100644
--- a/include/tests_virtualization
+++ b/include/tests_virtualization
@@ -30,7 +30,6 @@
 #    # Description : Checking VMware
 #    Register --test-no VIRT-1920 --weight L --network NO --category security --description "Checking VMware guest status"
 #    if [ ${SKIPTEST} -eq 0 ]; then
-#        # Initialise
 #        VMWARE_GUEST=0
 #        Display --indent 2 --text "- Checking VMware guest status"
 #        # check memory driver file

From fe5f42fc73eaa73bcfdd77e7ed94aaf070f54ab1 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 21 Sep 2019 16:35:36 +0200
Subject: [PATCH 366/679] Removed brackets

---
 HAPPY_USERS.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/HAPPY_USERS.md b/HAPPY_USERS.md
index ffad49c3..049a9689 100644
--- a/HAPPY_USERS.md
+++ b/HAPPY_USERS.md
@@ -23,7 +23,9 @@ Create a pull request and add your name above the first entry. Thanks!
 
 ## Our guestbook
 
-* <your name and story>
+
+* YOUR NAME AND STORY
+
 
 * Michael Boelen - September 2019
 The development of Lynis learned me a lot about Linux and Unix security. It is

From d17d30d6a7c7b208f731309d05cdcd9bf9eaacb0 Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Thu, 26 Sep 2019 21:24:15 +0200
Subject: [PATCH 367/679] nginx-test: add log file detection for relative paths

---
 include/functions | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/include/functions b/include/functions
index 89626958..b96bb070 100644
--- a/include/functions
+++ b/include/functions
@@ -2181,8 +2181,9 @@
                         if [ ! "${VALUE}" = "" ]; then
                             # If multiple values follow, select first one
                             VALUE=$(echo ${VALUE} | awk '{ print $1 }')
-                            if [ ! -f ${VALUE} ]; then
-                                LogText "Result: could not find referenced log file ${VALUE} in nginx configuration"
+                            # Find both, log files provided with full or relative path
+                            if [ ! -f ${VALUE} -a ! -f "${CONFIG_FILE%nginx.conf}${VALUE}" ]; then
+                                LogText "Result: could not find log file ${VALUE} referenced in nginx configuration"
                                 NGINX_ACCESS_LOG_MISSING=1
                             fi
                         fi
@@ -2218,7 +2219,8 @@
                     # Check if log file exists
                     FILE=$(echo ${VALUE} | awk '{ print $1 }')
                     if [ ! "${FILE}" = "" ]; then
-                        if [ ! -f ${FILE} ]; then
+                        # Find both, log files provided with full or relative path
+                        if [ ! -f ${FILE} -a ! -f "${CONFIG_FILE%nginx.conf}${FILE}" ]; then
                             NGINX_ERROR_LOG_MISSING=1
                         fi
                     else

From 07084501b6e4eb2c796431a95f2f708ed634c954 Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Thu, 26 Sep 2019 23:26:08 +0200
Subject: [PATCH 368/679] kernel-test: add linux-lts detection for arch

---
 include/tests_kernel | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index 2ffd8df9..f13012a6 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -541,10 +541,16 @@
                     else
                         ReportException "${TEST_NO}:1" "Can't determine kernel version on disk, need debug data"
                     fi
-                elif [ -f ${ROOTDIR}boot/vmlinuz-linux ]; then
-                    LogText "Result: /found /boot/vmlinuz-linux (usually Arch Linux or similar)"
-                    LogText "Test: checking kernel version on disk"
-                    VERSION_ON_DISK=$(${FILEBINARY} -b ${ROOTDIR}boot/vmlinuz-linux | ${AWKBINARY} '{ if ($1=="Linux" && $7=="version") { print $8 }}')
+                elif [ -f ${ROOTDIR}boot/vmlinuz-linux -o -f ${ROOTDIR}boot/vmlinuz-linux-lts ]; then
+                    if [ -f ${ROOTDIR}boot/vmlinuz-linux ]; then
+                        LogText "Result: /found /boot/vmlinuz-linux (usually Arch Linux or similar)"
+                        LogText "Test: checking kernel version on disk"
+                        VERSION_ON_DISK=$(${FILEBINARY} -b ${ROOTDIR}boot/vmlinuz-linux | ${AWKBINARY} '{ if ($1=="Linux" && $7=="version") { print $8 }}')
+                    else
+                        LogText "Result: /found /boot/vmlinuz-linux-lts (usually Arch Linux or similar)"
+                        LogText "Test: checking kernel version on disk"
+                        VERSION_ON_DISK=$(${FILEBINARY} -b ${ROOTDIR}boot/vmlinuz-linux-lts | ${AWKBINARY} '{ if ($1=="Linux" && $7=="version") { print $8 }}')
+                    fi
                     if [ -n "${VERSION_ON_DISK}" ]; then
                         LogText "Result: found version ${VERSION_ON_DISK}"
                         ACTIVE_KERNEL=$(uname -r)

From b38031803d1350aa6af89663631fa7abe833219a Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Fri, 27 Sep 2019 00:07:45 +0200
Subject: [PATCH 369/679] kernel-test: avoid grep errors if
 etc/security/limits.d does not exist

---
 include/tests_kernel | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index f13012a6..56df2a99 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -442,8 +442,8 @@
         if [ -f ${ROOTDIR}etc/security/limits.conf ]; then
             LogText "Result: file ${ROOTDIR}etc/security/limits.conf exists"
             LogText "Test: Checking if core dumps are disabled in ${ROOTDIR}etc/security/limits.conf and ${ROOTDIR}etc/security/limits.d/*"
-            FIND1=$(${GREPBINARY} -r -v "^#" ${ROOTDIR}etc/security/limits.conf ${LIMITS_DIRECTORY} | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="soft" && $3=="core" && $4=="0") { print "soft core disabled" } else if ($1=="*" && $2=="soft" && $3=="core" && $4!="0") { print "soft core enabled" } }')
-            FIND2=$(${GREPBINARY} -r -v "^#" ${ROOTDIR}etc/security/limits.conf ${LIMITS_DIRECTORY} | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="hard" && $3=="core" && $4=="0") { print "hard core disabled" } else if ($1=="*" && $2=="hard" && $3=="core" && $4!="0") { print "hard core enabled" } }')
+            FIND1=$(${GREPBINARY} -r -v "^#" ${ROOTDIR}etc/security/limits.conf $( if [ -d ${LIMITS_DIRECTORY} ]; then echo "${LIMITS_DIRECTORY}"; fi ) | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="soft" && $3=="core" && $4=="0") { print "soft core disabled" } else if ($1=="*" && $2=="soft" && $3=="core" && $4!="0") { print "soft core enabled" } }')
+            FIND2=$(${GREPBINARY} -r -v "^#" ${ROOTDIR}etc/security/limits.conf $( if [ -d ${LIMITS_DIRECTORY} ]; then echo "${LIMITS_DIRECTORY}"; fi ) | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="hard" && $3=="core" && $4=="0") { print "hard core disabled" } else if ($1=="*" && $2=="hard" && $3=="core" && $4!="0") { print "hard core enabled" } }')
             if [ "${FIND2}" = "hard core disabled" ]; then
                 LogText "Result: core dumps (soft and hard) are both disabled"
                 Display --indent 2 --text "- Checking core dumps configuration" --result "${STATUS_DISABLED}" --color GREEN

From 364b770c648c7a4ee4ab8f3a5dd3e07dbe1f1461 Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Sat, 28 Sep 2019 00:39:12 +0200
Subject: [PATCH 370/679] kernel-test: determine reboot requirement for more
 distros. Plus a few fixes

---
 include/tests_authentication |  2 +-
 include/tests_kernel         | 27 ++++++++++++++++++++-------
 2 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 0f4b95e0..7458c487 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -1048,7 +1048,7 @@
             if [ -n "${FIND}" ]; then
                 LogText "Result: found /etc/profile.d, with one or more files in it"
                 for FILE in ${FIND}; do
-                    HAS_MASK=$(${GREPBINARY} umask ${FILE} | ${SEDBINARY} 's/^[ \t]*//' | ${GREPBINARY} -v "^#" | ${AWKBINARY} '{ print $2 }')
+                    HAS_MASK=$(${GREPBINARY} umask ${FILE} 2> /dev/null | ${SEDBINARY} 's/^[ \t]*//' | ${GREPBINARY} -v "^#" | ${AWKBINARY} '{ print $2 }')
                     for MASK in ${HAS_MASK}; do
                         if [ "${MASK}" = "077" -o "${MASK}" = "027" -o "${MASK}" = "0077" -o "${MASK}" = "0027" ]; then
                             LogText "Result: found a strong umask '${MASK}' set in ${FILE}"
diff --git a/include/tests_kernel b/include/tests_kernel
index 56df2a99..95634786 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -527,6 +527,7 @@
                     for I in $(file ${ROOTDIR}boot/vmlinuz-linux); do
                         if [ ${NEXTLINE} -eq 1 ]; then
                             FINDVERSION="${I}"
+                            break
                         else
                             # Searching for the Linux kernel after the keyword 'version'
                             if [ "${I}" = "version" ]; then NEXTLINE=1; fi
@@ -541,16 +542,28 @@
                     else
                         ReportException "${TEST_NO}:1" "Can't determine kernel version on disk, need debug data"
                     fi
-                elif [ -f ${ROOTDIR}boot/vmlinuz-linux -o -f ${ROOTDIR}boot/vmlinuz-linux-lts ]; then
+                elif [ -f ${ROOTDIR}boot/vmlinuz-linux -o -f ${ROOTDIR}boot/vmlinuz-linux-lts -o -f $(ls -t ${ROOTDIR}boot/vmlinuz-* | head -1) ]; then
                     if [ -f ${ROOTDIR}boot/vmlinuz-linux ]; then
-                        LogText "Result: /found /boot/vmlinuz-linux (usually Arch Linux or similar)"
-                        LogText "Test: checking kernel version on disk"
-                        VERSION_ON_DISK=$(${FILEBINARY} -b ${ROOTDIR}boot/vmlinuz-linux | ${AWKBINARY} '{ if ($1=="Linux" && $7=="version") { print $8 }}')
+                        FOUND_VMLINUZ=${ROOTDIR}boot/vmlinuz-linux
+                    elif [ -f ${ROOTDIR}boot/vmlinuz-linux-lts ]; then
+                        FOUND_VMLINUZ=${ROOTDIR}boot/vmlinuz-linux-lts
                     else
-                        LogText "Result: /found /boot/vmlinuz-linux-lts (usually Arch Linux or similar)"
-                        LogText "Test: checking kernel version on disk"
-                        VERSION_ON_DISK=$(${FILEBINARY} -b ${ROOTDIR}boot/vmlinuz-linux-lts | ${AWKBINARY} '{ if ($1=="Linux" && $7=="version") { print $8 }}')
+                        FOUND_VMLINUZ=$(ls -t ${ROOTDIR}boot/vmlinuz-* | head -1)
                     fi
+                    LogText "Result: /found /boot/vmlinuz-linux-lts (usually Arch Linux or similar)"
+                    LogText "Test: checking kernel version on disk"
+                    #VERSION_ON_DISK=$(${FILEBINARY} -b ${FOUND_VMLINUZ} | ${AWKBINARY} '{ if ($1=="Linux" && $7=="version") { print $8 }}')
+                    NEXTLINE=0
+                    VERSION_ON_DISK=""
+                    for I in $(file ${FOUND_VMLINUZ}); do
+                        if [ ${NEXTLINE} -eq 1 ]; then
+                            VERSION_ON_DISK="${I}"
+                            break
+                        else
+                            # Searching for the Linux kernel after the keyword 'version'
+                            if [ "${I}" = "version" ]; then NEXTLINE=1; fi
+                        fi
+                    done
                     if [ -n "${VERSION_ON_DISK}" ]; then
                         LogText "Result: found version ${VERSION_ON_DISK}"
                         ACTIVE_KERNEL=$(uname -r)

From 001cd85183d19e20ce012cd5c527d8d7d296b6be Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Sun, 29 Sep 2019 17:42:07 +0200
Subject: [PATCH 371/679] kernel-test: additional improvements for required
 reboot detection

---
 include/tests_kernel | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index 95634786..f0846e14 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -542,17 +542,16 @@
                     else
                         ReportException "${TEST_NO}:1" "Can't determine kernel version on disk, need debug data"
                     fi
-                elif [ -f ${ROOTDIR}boot/vmlinuz-linux -o -f ${ROOTDIR}boot/vmlinuz-linux-lts -o -f $(ls -t ${ROOTDIR}boot/vmlinuz-* | head -1) ]; then
+                elif [ -f ${ROOTDIR}boot/vmlinuz-linux -o -f ${ROOTDIR}boot/vmlinuz-linux-lts -o -f $(ls -t ${ROOTDIR}boot/vmlinuz-* 2> /dev/null | head -1) ]; then
                     if [ -f ${ROOTDIR}boot/vmlinuz-linux ]; then
                         FOUND_VMLINUZ=${ROOTDIR}boot/vmlinuz-linux
                     elif [ -f ${ROOTDIR}boot/vmlinuz-linux-lts ]; then
                         FOUND_VMLINUZ=${ROOTDIR}boot/vmlinuz-linux-lts
                     else
-                        FOUND_VMLINUZ=$(ls -t ${ROOTDIR}boot/vmlinuz-* | head -1)
+                        FOUND_VMLINUZ=$(ls -t ${ROOTDIR}boot/vmlinuz-* 2> /dev/null | head -1)
                     fi
-                    LogText "Result: /found /boot/vmlinuz-linux-lts (usually Arch Linux or similar)"
+                    LogText "Result: /found ${FOUND_VMLINUZ} (usually Arch Linux or similar)"
                     LogText "Test: checking kernel version on disk"
-                    #VERSION_ON_DISK=$(${FILEBINARY} -b ${FOUND_VMLINUZ} | ${AWKBINARY} '{ if ($1=="Linux" && $7=="version") { print $8 }}')
                     NEXTLINE=0
                     VERSION_ON_DISK=""
                     for I in $(file ${FOUND_VMLINUZ}); do

From 51d3c568423e82d59ee5a3da755cb8ccdda2a095 Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Sun, 29 Sep 2019 17:44:15 +0200
Subject: [PATCH 372/679] crypto-test: suppress errors when devs are not
 accessible for cryptsetup

---
 include/tests_crypto | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_crypto b/include/tests_crypto
index b5f3c7be..77be22f2 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -140,7 +140,7 @@
         # cryptsetup only works as root
         if [ -n "${LSBLKBINARY}" -a -n "${CRYPTSETUPBINARY}" -a ${FORENSICS_MODE} -eq 0 ]; then
             for BLOCK_DEV in $(${LSBLKBINARY} --noheadings --list --paths -o NAME); do
-                if ${CRYPTSETUPBINARY} isLuks ${BLOCK_DEV}; then
+                if ${CRYPTSETUPBINARY} isLuks ${BLOCK_DEV} 2> /dev/null; then
                     LogText "Result: Found LUKS encrypted block device: ${BLOCK_DEV}"
                     Report "encryption[]=luks,block_device,${BLOCK_DEV}"
                     FOUND=$((FOUND +1))

From 7d430d5abc2a8d3b0754df8b2b19f63294c84813 Mon Sep 17 00:00:00 2001
From: Marzal <2069735+Marzal@users.noreply.github.com>
Date: Sun, 29 Sep 2019 21:13:47 +0200
Subject: [PATCH 373/679] rephrasing comment to avioid false positive in
 lynis-sdk

---
 include/tests_storage | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_storage b/include/tests_storage
index a9029852..1e3d93c3 100644
--- a/include/tests_storage
+++ b/include/tests_storage
@@ -30,7 +30,7 @@
 #
     # Test        : STRG-1846
     # Description : Check for disabled firewire storage
-    # Explanation : Best option is to use the install function, or else drivers can still be loaded manually
+    # Explanation : Best option is to use the install function, otherwise drivers can still be loaded manually
     Register --test-no STRG-1846 --os Linux --weight L --network NO --category security --description "Check if firewire storage is disabled"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0

From a052a107d3f6da9836cb2c9a22d9dc1068e80bc7 Mon Sep 17 00:00:00 2001
From: Marzal <2069735+Marzal@users.noreply.github.com>
Date: Sun, 29 Sep 2019 21:15:29 +0200
Subject: [PATCH 374/679] SC2086

---
 include/tests_storage | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/tests_storage b/include/tests_storage
index 1e3d93c3..c355a72b 100644
--- a/include/tests_storage
+++ b/include/tests_storage
@@ -32,10 +32,10 @@
     # Description : Check for disabled firewire storage
     # Explanation : Best option is to use the install function, otherwise drivers can still be loaded manually
     Register --test-no STRG-1846 --os Linux --weight L --network NO --category security --description "Check if firewire storage is disabled"
-    if [ ${SKIPTEST} -eq 0 ]; then
+    if [ "${SKIPTEST}" -eq 0 ]; then
         FOUND=0
         LogText "Test: Checking firewire storage driver in directory /etc/modprobe.d and configuration file /etc/modprobe.conf"
-        if [ -d ${ROOTDIR}etc/modprobe.d ]; then
+        if [ -d "${ROOTDIR}etc/modprobe.d" ]; then
             FIND=$(${LSBINARY} ${ROOTDIR}etc/modprobe.d/* 2> /dev/null)
             if [ -n "${FIND}" ]; then
                 FIND1=$(${EGREPBINARY} "blacklist (ohci1394|firewire[-_]ohci|firewire-core)" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#")
@@ -48,9 +48,9 @@
                 LogText "Result: skipping ${ROOTDIR}etc/modprobe.d, directory found but no files in it"
             fi
         fi
-        if [ -f ${ROOTDIR}etc/modprobe.conf ]; then
-            FIND1=$(${EGREPBINARY} -r "blacklist (ohci1394|firewire[-_]ohci|firewire-core)" ${ROOTDIR}etc/modprobe.conf | ${GREPBINARY} -v "#")
-            FIND2=$(${EGREPBINARY} -r "install (ohci1394|firewire[-_]ohci|firewire-core) /bin/(false|true)" ${ROOTDIR}etc/modprobe.conf | ${GREPBINARY} -v "#")
+        if [ -f "${ROOTDIR}etc/modprobe.conf" ]; then
+            FIND1=$(${EGREPBINARY} -r "blacklist (ohci1394|firewire[-_]ohci|firewire-core)" "${ROOTDIR}etc/modprobe.conf" | ${GREPBINARY} -v "#")
+            FIND2=$(${EGREPBINARY} -r "install (ohci1394|firewire[-_]ohci|firewire-core) /bin/(false|true)" "${ROOTDIR}etc/modprobe.conf" | ${GREPBINARY} -v "#")
             if [ -n "${FIND1}" -o -n "${FIND2}" ]; then
                 FOUND=1
                 LogText "Result: found firewire ohci driver in disabled state"
@@ -60,7 +60,7 @@
         if [ ${FOUND} -eq 0 ]; then
             LogText "Result: firewire ohci driver is not explicitly disabled"
             Display --indent 2 --text "- Checking firewire ohci driver (modprobe config)" --result "NOT DISABLED" --color WHITE
-            ReportSuggestion ${TEST_NO} "Disable drivers like firewire storage when not used, to prevent unauthorized storage or data theft"
+            ReportSuggestion "${TEST_NO}" "Disable drivers like firewire storage when not used, to prevent unauthorized storage or data theft"
             # after blacklisting modules, make sure to remove them from the initram filesystem: update-initramfs -u
             AddHP 2 3
         else

From f77e56ed4b1f8aea5113f4928422bd994ad9fa90 Mon Sep 17 00:00:00 2001
From: Marzal <2069735+Marzal@users.noreply.github.com>
Date: Sun, 29 Sep 2019 21:17:52 +0200
Subject: [PATCH 375/679] Prefer [ p ] && [ q ] as [ p -a q ] is not well
 defined. SC2166

---
 include/tests_storage | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_storage b/include/tests_storage
index c355a72b..8cf13b78 100644
--- a/include/tests_storage
+++ b/include/tests_storage
@@ -40,7 +40,7 @@
             if [ -n "${FIND}" ]; then
                 FIND1=$(${EGREPBINARY} "blacklist (ohci1394|firewire[-_]ohci|firewire-core)" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#")
                 FIND2=$(${EGREPBINARY} "install (ohci1394|firewire[-_]ohci|firewire-core) /bin/(false|true)" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#")
-                if [ -n "${FIND1}" -o -n "${FIND2}" ]; then
+                if [ -n "${FIND1}" ] || [ -n "${FIND2}" ]; then
                     FOUND=1
                     LogText "Result: found firewire ohci driver in disabled state"
                 fi
@@ -51,7 +51,7 @@
         if [ -f "${ROOTDIR}etc/modprobe.conf" ]; then
             FIND1=$(${EGREPBINARY} -r "blacklist (ohci1394|firewire[-_]ohci|firewire-core)" "${ROOTDIR}etc/modprobe.conf" | ${GREPBINARY} -v "#")
             FIND2=$(${EGREPBINARY} -r "install (ohci1394|firewire[-_]ohci|firewire-core) /bin/(false|true)" "${ROOTDIR}etc/modprobe.conf" | ${GREPBINARY} -v "#")
-            if [ -n "${FIND1}" -o -n "${FIND2}" ]; then
+            if [ -n "${FIND1}" ] || [ -n "${FIND2}" ]; then
                 FOUND=1
                 LogText "Result: found firewire ohci driver in disabled state"
             fi

From f188bac7e8b92a4d1d933e5ed961c0417d4e1aeb Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 8 Oct 2019 15:10:02 +0200
Subject: [PATCH 376/679] Update description for FILE-6374

---
 db/tests.db               | 2 +-
 include/tests_filesystems | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/db/tests.db b/db/tests.db
index 77ec7fbb..000883e2 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -113,7 +113,7 @@ FILE-6362:test:security:filesystems::Checking /tmp sticky bit:
 FILE-6363:test:security:filesystems::Checking /var/tmp sticky bit:
 FILE-6368:test:security:filesystems:Linux:Checking ACL support on root file system:
 FILE-6372:test:security:filesystems:Linux:Checking / mount options:
-FILE-6374:test:security:filesystems:Linux:Checking /boot mount options:
+FILE-6374:test:security:filesystems:Linux:Linux mount options:
 FILE-6376:test:security:filesystems:Linux:Determine if /var/tmp is bound to /tmp:
 FILE-6410:test:security:filesystems::Checking Locate database:
 FILE-6430:test:security:filesystems::Disable mounting of some filesystems:
diff --git a/include/tests_filesystems b/include/tests_filesystems
index 8efa97c9..398b2530 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -564,7 +564,7 @@
     #            ---------------------------------------------------------
 
     FILESYSTEMS_TO_CHECK="/boot:nodev,noexec,nosuid /dev/shm:nosuid,nodev,noexec /home:nodev,nosuid /tmp:nodev,noexec,nosuid /var:nosuid /var/log:nodev,noexec,nosuid /var/log/audit:nodev,noexec,nosuid /var/tmp:nodev,noexec,nosuid"
-    Register --test-no FILE-6374 --os Linux --weight L --network NO --category security --description "Checking partitions mount options"
+    Register --test-no FILE-6374 --os Linux --weight L --network NO --category security --description "Linux mount options"
     if [ ${SKIPTEST} -eq 0 ]; then
         if [ -f ${ROOTDIR}etc/fstab ]; then
             for I in ${FILESYSTEMS_TO_CHECK}; do

From 87f559695267d114bde01b5dc8f2be4425aade41 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 8 Oct 2019 15:15:18 +0200
Subject: [PATCH 377/679] Added new test DBS-1828

---
 CHANGELOG.md            |  1 +
 db/tests.db             |  1 +
 include/tests_databases | 25 +++++++++++++++++++++++++
 3 files changed, 27 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9679fa2f..49e08904 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -47,6 +47,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - New profile option: disable-plugin - disables a single plugin
 - New profile option: ssl-certificate-paths-to-ignore - ignore a path
 - New test: CRYP-7930 - test for LUKS encryption
+- New test: DBS-1828  - PostgreSQL configuration files
 - New test: FINT-4316 - presence of AIDE database and size test
 - New test: INSE-8314 - test for NIS client
 - New test: INSE-8316 - test for NIS server
diff --git a/db/tests.db b/db/tests.db
index 000883e2..b43cef54 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -92,6 +92,7 @@ DBS-1816:test:security:databases::Checking MySQL root password:
 DBS-1818:test:security:databases::MongoDB status:
 DBS-1820:test:security:databases::Check MongoDB authentication:
 DBS-1826:test:security:databases::Checking active PostgreSQL processes:
+DBS-1828:test:security:databases::PostgreSQL configuration files:
 DBS-1840:test:security:databases::Checking active Oracle processes:
 DBS-1860:test:security:databases::Checking active DB2 instances:
 DBS-1880:test:security:databases::Checking active Redis processes:
diff --git a/include/tests_databases b/include/tests_databases
index 3ece8a99..16ea6786 100644
--- a/include/tests_databases
+++ b/include/tests_databases
@@ -179,6 +179,31 @@
     fi
 #
 #################################################################################
+#
+    # Test        : DBS-1828
+    # Description : Test PostgreSQL configuration file(s)
+    #
+    # Authentication:
+    # /var/lib/pgsql/data/pg_hba.conf
+    #
+    # Configuration
+    # Arch            /var/lib/postgres/data/postgresql.conf
+    # CentOS/Fedora   /var/lib/pgsql/data/postgresql.conf
+    # Ubuntu          /etc/postgresql/x.y/main/postgresql.conf
+
+    if [ "${POSTGRESQL_RUNNING}" -eq 1 ]; then PREQS_MET="YES"; SKIPREASON=""; else PREQS_MET="NO"; SKIPREASON="PostgreSQL not installed or not running"; fi
+
+    Register --test-no DBS-1828 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Test PostgreSQL configuration"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        FIND_PATHS="${ROOTDIR}etc/postgres ${ROOTDIR}var/lib/postgres/data"
+        CONFIG_FILES=$(${FINDBINARY} ${FIND_PATHS} -type f -name "postgresql.conf" -print0 2> /dev/null | ${TRBINARY} -cd '[:print:]\0' | ${TRBINARY} -d '\n' | ${TRBINARY} '\0' '\n' | xargs -i sh -c 'test -r "{}" && echo "{}" | ${SEDBINARY} "s/ /:space:/g"')
+        for CF in ${CONFIG_FILES}; do
+            Report "postgresql_config_file[]=${CF}"
+            LogText "Found configuration file (${CF})"
+        done
+    fi
+#
+#################################################################################
 #
     # Test        : DBS-1840
     # Description : Check if Oracle is being used

From 52e1231433eca258d868c6989cf02f26f3870146 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 8 Oct 2019 16:43:09 +0200
Subject: [PATCH 378/679] Additional check to ensure pacman package manager is
 used instead of pacman game

---
 CHANGELOG.md                 | 1 +
 include/tests_ports_packages | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 49e08904..b80c0816 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -103,6 +103,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - STRG-1842 - added default authorized devices and renamed to USB-2000
 - TOOL-5002 - differentiate between a discovered binary and running process
 - TOOL-5160 - added support for OSSEC agent daemon
+- Perform additional check to ensure pacman package manager is used
 - Use 'pre-release/release' (was: 'dev/final') with 'lynis show release'
 - Use only locations from PATH environment variable, unless it is not defined
 - Show tip to use 'lynis generate hostids' when host IDs are missing
diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 55276ca5..eef56596 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -26,6 +26,7 @@
     PACKAGE_MGR_PKG=0
     PACKAGE_AUDIT_TOOL=""
     PACKAGE_AUDIT_TOOL_FOUND=0
+    PACMANCONF="${ROOTDIR}etc/pacman.conf"
     INSTALLED_PACKAGES=""
 #
 #################################################################################
@@ -191,7 +192,7 @@
 #
     # Test        : PKGS-7310
     # Description : pacman package based systems
-    if [ -n "${PACMANBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${PACMANBINARY}" -a -f "${PACMANCONF}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7310 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking package list with pacman"
     if [ ${SKIPTEST} -eq 0 ]; then
         COUNT=0
@@ -222,7 +223,7 @@
 #
     # Test        : PKGS-7312
     # Description : Check for available package updates when pacman package is used
-    if [ -n "${PACMANBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${PACMANBINARY}" -a -f "${PACMANCONF}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7312 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking available updates for pacman based system"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
@@ -251,8 +252,7 @@
 #
     # Test        : PKGS-7314
     # Description : Check pacman.conf options
-    PACMANCONF="/etc/pacman.conf"
-    if [ -n "${PACMANBINARY}" -a -f ${PACMANCONF} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${PACMANBINARY}" -a -f "${PACMANCONF}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PKGS-7314 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking pacman configuration options"
     if [ ${SKIPTEST} -eq 0 ]; then
         COUNT=0

From 52cef0ed87aca64e22bc692da35addb82ef81532 Mon Sep 17 00:00:00 2001
From: pyllyukko <pyllyukko@maimed.org>
Date: Tue, 8 Oct 2019 20:19:30 +0300
Subject: [PATCH 379/679] Slackware Linux OS detection

---
 include/osdetection | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/include/osdetection b/include/osdetection
index 3e4b8610..db7b9e92 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -214,6 +214,13 @@
                             OS_FULLNAME="${OS_NAME} ${OS_VERSION_FULL}"
                             OS_REDHAT_OR_CLONE=1
                         ;;
+                        "slackware")
+                            LINUX_VERSION="Slackware"
+                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_NAME="Slackware Linux"
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                        ;;
                         *)
                             ReportException "OS Detection" "Unknown OS found in /etc/os-release"
                         ;;

From c88953a81531dc05d049077763d1c7151ce55651 Mon Sep 17 00:00:00 2001
From: pyllyukko <pyllyukko@maimed.org>
Date: Tue, 8 Oct 2019 20:31:35 +0300
Subject: [PATCH 380/679] Test SINT-7010 in macOS only

---
 db/tests.db                    | 2 +-
 include/tests_system_integrity | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/db/tests.db b/db/tests.db
index b43cef54..cbe892b9 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -363,7 +363,7 @@ SHLL-6202:test:security:shells:FreeBSD:Check console TTYs:
 SHLL-6211:test:security:shells::Checking available and valid shells:
 SHLL-6220:test:security:shells::Checking available and valid shells:
 SHLL-6230:test:security:shells::Perform umask check for shell configurations:
-SINT-7010:test:security:system_integrity::System Integrity Status:
+SINT-7010:test:security:system_integrity:MacOS:System Integrity Status:
 SNMP-3302:test:security:snmp::Check for running SNMP daemon:
 SNMP-3304:test:security:snmp::Check SNMP daemon file location:
 SNMP-3306:test:security:snmp::Check SNMP communities:
diff --git a/include/tests_system_integrity b/include/tests_system_integrity
index a02f84fb..8b6910c1 100644
--- a/include/tests_system_integrity
+++ b/include/tests_system_integrity
@@ -31,7 +31,7 @@
 #################################################################################
 #
     if [ -x ${ROOTDIR}/usr/bin/csrutil ]; then PREQS_MET="YES"; else PREQS_MET="NO"; SKIPREASON="No CSrutil binary found"; fi
-    Register --test-no SINT-7010 --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight H --network NO --category security --description "System Integrity Status"
+    Register --test-no SINT-7010 --os MacOS --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight H --network NO --category security --description "System Integrity Status"
     if [ ${SKIPTEST} -eq 0 ]; then
         if ${ROOTDIR}usr/bin/csrutil status | ${GREPBINARY} -sq enabled ; then
             Display --indent 2 --text "- System Integrity Protection (status)" --result "${STATUS_OK}" --color GREEN

From b771437cd0666730649619dae29ddefe9497b928 Mon Sep 17 00:00:00 2001
From: pyllyukko <pyllyukko@maimed.org>
Date: Tue, 8 Oct 2019 20:52:55 +0300
Subject: [PATCH 381/679] Redirect gradm stderr to /dev/null

If the tool exists but the kernel doesn't have grsec, you'll get the
following error into stderr:

Could not open /dev/grsec.
open: No such file or directory
---
 include/tests_mac_frameworks | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_mac_frameworks b/include/tests_mac_frameworks
index 14b34e4a..15d675a3 100644
--- a/include/tests_mac_frameworks
+++ b/include/tests_mac_frameworks
@@ -222,7 +222,7 @@
             Display --indent 2 --text "- Checking presence grsecurity" --result "${STATUS_NOT_FOUND}" --color WHITE
         fi
         if HasData "${GRADMBINARY}"; then
-            FIND=$(${GRADMBINARY} --status)
+            FIND=$(${GRADMBINARY} --status 2>/dev/null)
             if [ "${FIND}" = "The RBAC system is currently enabled." ]; then
                 MAC_FRAMEWORK_ACTIVE=1
             fi

From 7b52ff52c7b4959c1a30adb4c88aaf28720eaae7 Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Sun, 13 Oct 2019 22:06:50 +0200
Subject: [PATCH 382/679] add check for disabled coredumps in etc/profile and
 systemd

---
 include/binaries     |   2 +
 include/tests_kernel | 140 ++++++++++++++++++++++++++++++++++++-------
 2 files changed, 120 insertions(+), 22 deletions(-)

diff --git a/include/binaries b/include/binaries
index 648fb1d3..1c4646da 100644
--- a/include/binaries
+++ b/include/binaries
@@ -263,6 +263,7 @@
                             sysctl)                 SYSCTLBINARY="${BINARY}";          LogText "  Found known binary: sysctl (kernel parameters) - ${BINARY}" ;;
                             syslog-ng)              SYSLOGNGBINARY="${BINARY}";        SYSLOGNGVERSION=$(${BINARY} -V 2>&1 | grep "^syslog-ng" | awk '{ print $2 }'); LogText "Found ${BINARY} (version ${SYSLOGNGVERSION})" ;;
                             systemctl)              SYSTEMCTLBINARY="${BINARY}";       LogText "  Found known binary: systemctl (client to systemd) - ${BINARY}" ;;
+                            tail)                   TAILBINARY="${BINARY}";            LogText "  Found known binary: tail (text filter) - ${BINARY}" ;;
                             timedatectl)            TIMEDATECTL="${BINARY}";           LogText "  Found known binary: timedatectl (timedate client) - ${BINARY}" ;;
                             tomoyo-init)            TOMOYOINITBINARY=${BINARY};        LogText "  Found known binary: tomoyo-init (tomoyo component) - ${BINARY}" ;;
                             tr)                     TRBINARY="${BINARY}";              LogText "  Found known binary: tr (text transformation) - ${BINARY}" ;;
@@ -305,6 +306,7 @@
         [ "${FINDBINARY:-}" ] || ExitFatal "find binary not found"
         [ "${GREPBINARY:-}" ] || ExitFatal "grep binary not found"
         [ "${HEADBINARY:-}" ] || ExitFatal "head binary not found"
+        [ "${TAILBINARY:-}" ] || ExitFatal "tail binary not found"
         [ "${LSBINARY:-}" ] || ExitFatal "ls binary not found"
         [ "${PSBINARY:-}" ] || ExitFatal "ps binary not found"
         [ "${SEDBINARY:-}" ] || ExitFatal "sed binary not found"
diff --git a/include/tests_kernel b/include/tests_kernel
index f0846e14..f79c77d1 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -26,7 +26,6 @@
 #
 #################################################################################
 #
-    CORE_DUMPS_DISABLED=0
     CPU_PAE=0
     CPU_NX=0
     LINUXCONFIGFILE=""
@@ -49,7 +48,7 @@
                     LogText "Exception: can't find the target of the symlink of /etc/systemd/system/default.target"
                     ReportException "${TEST_NO}:01"
                 else
-                    FIND2=$(echo ${FIND} | ${EGREPBINARY} "runlevel5|graphical")
+                    FIND2=$(${ECHOCMD} ${FIND} | ${EGREPBINARY} "runlevel5|graphical")
                     if HasData "${FIND2}"; then
                         LogText "Result: Found match on runlevel5/graphical"
                         Display --indent 2 --text "- Checking default runlevel" --result "runlevel 5" --color GREEN
@@ -437,33 +436,128 @@
     # Description : Checking core dumps configuration (Linux)
     Register --test-no KRNL-5820 --os Linux --weight L --network NO --category security --description "Checking core dumps configuration"
     if [ ${SKIPTEST} -eq 0 ]; then
+        Display --indent 2 --text "- Checking core dumps configuration"
+        LogText "Test: Checking presence of systemd"
+        # systemd option
+        if [ $HAS_SYSTEMD -eq 1 ]; then
+            LogText "Result: systemd is present on this system"
+            LogText "Test: Checking if core dumps are disabled in ${ROOTDIR}etc/systemd/coredump.conf and ${ROOTDIR}etc/systemd/coredump.conf.d/*.conf"
+            # check likely main config file for systemd: ${ROOTDIR}etc/systemd/coredump.conf for ProcessSizeMax=0 and Storage=none
+            SYSD_CORED_BASE_PROCSIZEMAX_NR_DISABLED=$(${GREPBINARY} -v "^\s*#" ${ROOTDIR}etc/systemd/coredump.conf 2> /dev/null | ${GREPBINARY} -i "ProcessSizeMax=0" | ${WCBINARY} -l)
+            SYSD_CORED_BASE_STORAGE_NR_DISABLED=$(${GREPBINARY} -v "^\s*#" ${ROOTDIR}etc/systemd/coredump.conf 2> /dev/null | ${GREPBINARY} -i "Storage=none" | ${WCBINARY} -l)
+            # check conf files in possibly existing coredump.conf.d folders 
+            # using find instead of grep -r to stay POSIX compliant. On AIX and HPUX grep -r is not available.
+            # while there could be multiple files overwriting each other, we are checking the number of occurrences
+            SYSD_CORED_SUB_PROCSIZEMAX_NR_DISABLED=$(${FINDBINARY} /etc/systemd/coredump.conf.d/ /run/systemd/coredump.conf.d/ /usr/lib/systemd/coredump.conf.d/ -type f -iname "*.conf" -exec ${SEDBINARY} 's/^\s*//g' {} \; 2> /dev/null | ${GREPBINARY} -i "^ProcessSizeMax=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g' | ${GREPBINARY} "^0\s*$" | ${WCBINARY} -l)
+            SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED=$(${FINDBINARY} /etc/systemd/coredump.conf.d/ /run/systemd/coredump.conf.d/ /usr/lib/systemd/coredump.conf.d/ -type f -iname "*.conf" -exec ${SEDBINARY} 's/^\s*//g' {} \; 2> /dev/null | ${GREPBINARY} -i "^ProcessSizeMax=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g' | ${GREPBINARY} -v "^0\s*$" | ${WCBINARY} -l)
+            
+            SYSD_CORED_SUB_STORAGE_FOUND=$(${FINDBINARY} /etc/systemd/coredump.conf.d/ /run/systemd/coredump.conf.d/ /usr/lib/systemd/coredump.conf.d/ -type f -iname "*.conf" -exec ${SEDBINARY} 's/^\s*//g' {} \; 2> /dev/null | ${GREPBINARY} -i "^Storage=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g')
+            SYSD_CORED_SUB_STORAGE_NR_ENABLED=$(${ECHOCMD} "${SYSD_CORED_SUB_STORAGE_FOUND}" | ${SEDBINARY} 's/none//g' | ${WCBINARY} | ${AWKBINARY} '{print $2}')
+            SYSD_CORED_SUB_STORAGE_NR_DISABLED=$(${ECHOCMD} "${SYSD_CORED_SUB_STORAGE_FOUND}" | ${GREPBINARY} -o "none" | ${WCBINARY} | ${AWKBINARY} '{print $2}')
+            
+            if ( [ ${SYSD_CORED_BASE_PROCSIZEMAX_NR_DISABLED} -ge 1 ] && [ ${SYSD_CORED_BASE_STORAGE_NR_DISABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -eq 0 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_ENABLED} -eq 0 ] ) || \
+               ( [ ${SYSD_CORED_BASE_PROCSIZEMAX_NR_DISABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_DISABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -eq 0 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_ENABLED} -eq 0 ] ) || \
+               ( [ ${SYSD_CORED_BASE_STORAGE_NR_DISABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_DISABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -eq 0 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_ENABLED} -eq 0 ] ) || \
+               ( [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_DISABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_DISABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -eq 0 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_ENABLED} -eq 0 ] ); then
+                LogText "Result: core dumps are disabled by 'ProcessSizeMax=0' and 'Storage=none' in systemd configuration files"
+                AddHP 1 1
+                TMP_COLOR="GREEN"
+                if [ ${SYSD_CORED_BASE_PROCSIZEMAX_NR_DISABLED} -gt 1 ] || [ ${SYSD_CORED_BASE_STORAGE_NR_DISABLED} -gt 1 ] || [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_DISABLED} -gt 1 ] || [ ${SYSD_CORED_SUB_STORAGE_NR_DISABLED} -gt 1 ]; then
+                    LogText "Result: 'ProcessSizeMax=0' and 'Storage=none' are set multiple times in systemd configuration files. Check config!"
+                    ReportSuggestion ${TEST_NO} "Check systemd configuration for duplicate entries of core dump settings"
+                    TMP_COLOR="YELLOW"
+                fi
+                Display --indent 4 --text "- configuration in systemd conf files" --result "${STATUS_DISABLED}" --color "${TMP_COLOR}"
+            elif [ ${SYSD_CORED_BASE_PROCSIZEMAX_NR_DISABLED} -ge 1 ] && [ ${SYSD_CORED_BASE_STORAGE_NR_DISABLED} -ge 1 ] && ( [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -ge 1 ] || [ ${SYSD_CORED_SUB_STORAGE_NR_ENABLED} -ge 1 ] ); then
+                LogText "Result: 'ProcessSizeMax=0' and 'Storage=none' are set in ${ROOTDIR}etc/systemd/coredump.conf but overwritten in subdir config files"
+                ReportSuggestion ${TEST_NO} "Check systemd configuration for overwriting core dump settings"
+                Display --indent 4 --text "- configuration in systemd conf files" --result "${STATUS_ENABLED}" --color YELLOW
+                AddHP 0 1
+            elif ( [ ${SYSD_CORED_BASE_PROCSIZEMAX_NR_ENABLED} -ge 1 ] && [ ${SYSD_CORED_BASE_STORAGE_NR_ENABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_ENABLED} -ge 1 ] ) || \
+                 ( [ ${SYSD_CORED_BASE_PROCSIZEMAX_NR_ENABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_ENABLED} -ge 1 ] ) || \
+                 ( [ ${SYSD_CORED_BASE_STORAGE_NR_ENABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -ge 1 ] ) || \
+                 ( [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_ENABLED} -ge 1 ] ); then
+                LogText "Result: core dumps are explicitely enabled in systemd configuration files"
+                ReportSuggestion ${TEST_NO} "If not required, consider explicit disabling of core dump in ${ROOTDIR}etc/systemd/coredump.conf ('ProcessSizeMax=0', 'Storage=none')"
+                Display --indent 4 --text "- configuration in systemd conf files" --result "${STATUS_ENABLED}" --color RED
+                AddHP 0 1
+            else
+                LogText "Result: core dumps are not disabled in systemd configuration. Didn't find settings 'ProcessSizeMax=0' and 'Storage=none'"
+                Display --indent 4 --text "- configuration in systemd conf files" --result "DEFAULT" --color WHITE
+                AddHP 0 1
+            fi
+        fi
+        # Profile option
+        LogText "Test: Checking presence ${ROOTDIR}etc/profile"
+        if [ -f "${ROOTDIR}etc/profile" ]; then
+            LogText "Test: Checking if 'ulimit -c 0' exists in ${ROOTDIR}etc/profile or ${ROOTDIR}etc/profile.d/*.sh"
+            # use tail -1 in the following commands to get the last entry, which is the one that counts (in case of profile.d/ probably counts)
+            ULIMIT_C_VALUE="$(${GREPBINARY} "ulimit -c " ${ROOTDIR}etc/profile 2> /dev/null | ${SEDBINARY} 's/^\s*//g' | ${GREPBINARY} -v "^#" | ${TAILBINARY} -1 | ${CUTBINARY} -d' ' -f3 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g')"
+            ULIMIT_C_VALUE_SUB="$(${FINDBINARY} ${ROOTDIR}etc/profile.d -name "*.sh" -type f -exec ${CAT_BINARY} {} \; 2> /dev/null | ${GREPBINARY} "ulimit -c " | ${SEDBINARY} 's/^\s*//g' | ${GREPBINARY} -v "^#" | ${TAILBINARY} -1 | ${CUTBINARY} -d' ' -f3 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g')"
+            
+            if ( [ -n "${ULIMIT_C_VALUE_SUB}" ] && [ "${ULIMIT_C_VALUE_SUB}" = "0" ] ) || ( [ -n "${ULIMIT_C_VALUE}" ] && [ -z "${ULIMIT_C_VALUE_SUB}" ] && [ "${ULIMIT_C_VALUE}" = "0" ] ); then
+                LogText "Result: core dumps are disabled by 'ulimit -c 0' in ${ROOTDIR}etc/profile or ${ROOTDIR}etc/profile.d/*.sh"
+                Display --indent 4 --text "- configuration in etc/profile" --result "${STATUS_DISABLED}" --color GREEN
+                AddHP 1 1
+            elif [ -z "${ULIMIT_C_VALUE_SUB}" ] && [ -z "${ULIMIT_C_VALUE}" ]; then
+                LogText "Result: core dumps are not disabled in ${ROOTDIR}etc/profile or ${ROOTDIR}etc/profile.d/*.sh config files. Didn't find setting 'ulimit -c 0'"
+                Display --indent 4 --text "- configuration in etc/profile" --result "DEFAULT" --color WHITE
+                AddHP 0 1
+            elif ( [ -n "${ULIMIT_C_VALUE_SUB}" ] && ( [ "${ULIMIT_C_VALUE_SUB}" = "unlimited" ] || [ "${ULIMIT_C_VALUE_SUB}" != "0" ] ) ) || ( [ -n "${ULIMIT_C_VALUE}" ] && [ -z "${ULIMIT_C_VALUE_SUB}" ] && ( [ "${ULIMIT_C_VALUE}" = "unlimited" ] || [ "${ULIMIT_C_VALUE}" != "0" ] ) ); then
+                LogText "Result: core dumps are enabled in ${ROOTDIR}etc/profile or ${ROOTDIR}etc/profile.d/*.sh config files. A value higher than 0 is configured for 'ulimit -c'"
+                Display --indent 4 --text "- configuration in etc/profile" --result "${STATUS_ENABLED}" --color RED
+                AddHP 0 1
+            else
+                LogText "Result: ERROR - something went wrong. Unexpected result during check of ${ROOTDIR}etc/profile and ${ROOTDIR}etc/profile.d/*.sh config files. Please report on Github!"
+                Display --indent 4 --text "- configuration in etc/profile" --result "ERROR" --color YELLOW
+            fi
+        fi
         # Limits option
         LogText "Test: Checking presence ${ROOTDIR}etc/security/limits.conf"
-        if [ -f ${ROOTDIR}etc/security/limits.conf ]; then
+        if [ -f "${ROOTDIR}etc/security/limits.conf" ]; then
             LogText "Result: file ${ROOTDIR}etc/security/limits.conf exists"
-            LogText "Test: Checking if core dumps are disabled in ${ROOTDIR}etc/security/limits.conf and ${ROOTDIR}etc/security/limits.d/*"
-            FIND1=$(${GREPBINARY} -r -v "^#" ${ROOTDIR}etc/security/limits.conf $( if [ -d ${LIMITS_DIRECTORY} ]; then echo "${LIMITS_DIRECTORY}"; fi ) | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="soft" && $3=="core" && $4=="0") { print "soft core disabled" } else if ($1=="*" && $2=="soft" && $3=="core" && $4!="0") { print "soft core enabled" } }')
-            FIND2=$(${GREPBINARY} -r -v "^#" ${ROOTDIR}etc/security/limits.conf $( if [ -d ${LIMITS_DIRECTORY} ]; then echo "${LIMITS_DIRECTORY}"; fi ) | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="hard" && $3=="core" && $4=="0") { print "hard core disabled" } else if ($1=="*" && $2=="hard" && $3=="core" && $4!="0") { print "hard core enabled" } }')
+            LogText "Test: Checking if core dumps are disabled in ${ROOTDIR}etc/security/limits.conf and ${LIMITS_DIRECTORY}/*"
+            FIND1=$(${GREPBINARY} -r -v "^#" "${ROOTDIR}etc/security/limits.conf" $( if [ -d "${LIMITS_DIRECTORY}" ]; then ${ECHOCMD} "${LIMITS_DIRECTORY}"; fi ) | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="soft" && $3=="core" && $4=="0") { print "soft core disabled" } else if ($1=="*" && $2=="soft" && $3=="core" && $4!="0") { print "soft core enabled" } }' | ${TAILBINARY} -1)
+            FIND2=$(${GREPBINARY} -r -v "^#" "${ROOTDIR}etc/security/limits.conf" $( if [ -d "${LIMITS_DIRECTORY}" ]; then ${ECHOCMD} "${LIMITS_DIRECTORY}"; fi ) | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="hard" && $3=="core" && $4=="0") { print "hard core disabled" } else if ($1=="*" && $2=="hard" && $3=="core" && $4!="0") { print "hard core enabled" } }' | ${TAILBINARY} -1)
+            
+            IS_SOFTCORE_DISABLED="$(if [ "${FIND1}" = "soft core disabled" ]; then ${ECHOCMD} DISABLED; elif [ "${FIND1}" = "soft core enabled" ]; then ${ECHOCMD} ENABLED; else ${ECHOCMD} DEFAULT; fi)"
+            IS_HARDCORE_DISABLED="$(if [ "${FIND2}" = "hard core disabled" ]; then ${ECHOCMD} DISABLED; elif [ "${FIND2}" = "hard core enabled" ]; then ${ECHOCMD} ENABLED; else ${ECHOCMD} DEFAULT; fi)"
+
             if [ "${FIND2}" = "hard core disabled" ]; then
-                LogText "Result: core dumps (soft and hard) are both disabled"
-                Display --indent 2 --text "- Checking core dumps configuration" --result "${STATUS_DISABLED}" --color GREEN
-                CORE_DUMPS_DISABLED=1
+                LogText "Result: core dumps are hard disabled"
+                Display --indent 4 --text "- 'hard' configuration in security/limits.conf" --result "${IS_HARDCORE_DISABLED}" --color "GREEN"
+                if [ "${FIND1}" = "soft core disabled" ]; then
+                    Display --indent 4 --text "- 'soft' configuration in security/limits.conf" --result "${IS_SOFTCORE_DISABLED}" --color "GREEN"
+                else
+                    Display --indent 4 --text "- 'soft' config in security/limits.conf (implicit)" --result "${STATUS_DISABLED}" --color "GREEN"
+                fi
                 AddHP 3 3
-            elif [ "${FIND1}" = "soft core enabled" -o "${FIND2}" = "hard core enabled" ]; then
-                LogText "Result: core dumps (soft or hard) are enabled"
-                Display --indent 2 --text "- Checking core dumps configuration" --result "${STATUS_ENABLED}" --color YELLOW
-                ReportSuggestion "${TEST_NO}" "Check if core dumps need to be enabled on this system"
-                AddHP 1 3
+            elif [ "${FIND1}" = "soft core enabled" ] && [ "${FIND2}" = "hard core enabled" ]; then
+                LogText "Result: core dumps (soft and hard) are enabled"
+                Display --indent 4 --text "- 'hard' configuration in security/limits.conf" --result "${STATUS_ENABLED}" --color "RED"
+                Display --indent 4 --text "- 'soft' configuration in security/limits.conf" --result "${STATUS_ENABLED}" --color "RED"
+                ReportSuggestion "${TEST_NO}" "If not required, consider explicit disabling of core dump in /etc/security/limits.conf file"
+                AddHP 0 3
+            elif [ "${FIND1}" = "soft core disabled" ]; then
+                LogText "Result: core dumps are disabled for 'soft' ('hard'=${IS_HARDCORE_DISABLED})"
+                Display --indent 4 --text "- 'hard' configuration in security/limits.conf" --result "${IS_HARDCORE_DISABLED}" --color "$(if [ "${IS_HARDCORE_DISABLED}" = "ENABLED" ]; then ${ECHOCMD} RED; elif [ "${IS_HARDCORE_DISABLED}" = "DISABLED" ]; then ${ECHOCMD} GREEN; else ${ECHOCMD} WHITE; fi)"
+                Display --indent 4 --text "- 'soft' configuration in security/limits.conf" --result "${IS_SOFTCORE_DISABLED}" --color "GREEN"
+                AddHP 2 3
+            elif [ "${FIND1}" = "soft core enabled" ] || [ "${FIND2}" = "hard core enabled" ]; then
+                LogText "Result: core dumps are partially enabled ('hard'=${IS_HARDCORE_DISABLED}, 'soft'=${IS_SOFTCORE_DISABLED})"
+                Display --indent 4 --text "- 'hard' configuration in security/limits.conf" --result "${IS_HARDCORE_DISABLED}" --color "$(if [ "${IS_HARDCORE_DISABLED}" = "ENABLED" ]; then ${ECHOCMD} RED; elif [ "${IS_HARDCORE_DISABLED}" = "DISABLED" ]; then ${ECHOCMD} GREEN; else ${ECHOCMD} WHITE; fi)"
+                Display --indent 4 --text "- 'soft' configuration in security/limits.conf" --result "${IS_SOFTCORE_DISABLED}" --color "$(if [ "${IS_SOFTCORE_DISABLED}" = "ENABLED" ]; then ${ECHOCMD} RED; elif [ "${IS_SOFTCORE_DISABLED}" = "DISABLED" ]; then ${ECHOCMD} GREEN; else ${ECHOCMD} WHITE; fi)"
+                AddHP 0 3
             else
                 LogText "Result: core dumps are not explicitly disabled"
-                Display --indent 2 --text "- Checking core dumps configuration" --result "${STATUS_NOT_FOUND}" --color WHITE
-                ReportSuggestion "${TEST_NO}" "If not required, consider explicit disabling of core dump in /etc/security/limits.conf file"
-                AddHP 2 3
+                Display --indent 4 --text "- 'hard' configuration in security/limits.conf" --result "${IS_HARDCORE_DISABLED}" --color "WHITE"
+                Display --indent 4 --text "- 'soft' configuration in security/limits.conf" --result "${IS_HARDCORE_DISABLED}" --color "WHITE"
+                ReportSuggestion "${TEST_NO}" "If not required, consider explicit disabling of core dump in ${ROOTDIR}etc/security/limits.conf file"
+                AddHP 1 3
             fi
         else
             LogText "Result: file ${ROOTDIR}etc/security/limits.conf does not exist, skipping test"
         fi
-        # TODO: Check ulimit settings in /etc/profile and /etc/profile.d
 
         # Sysctl option
         LogText "Test: Checking sysctl value of fs.suid_dumpable"
@@ -475,7 +569,7 @@
         fi
         if [ "${FIND}" = "2" ]; then
             LogText "Result: programs can dump core dump, but only readable by root (value 2, for debugging with file protection)"
-            Display --indent 4 --text "- Checking setuid core dumps configuration" --result PROTECTED --color GREEN
+            Display --indent 4 --text "- Checking setuid core dumps configuration" --result PROTECTED --color WHITE
             AddHP 1 1
         elif [ "${FIND}" = "1" ]; then
             LogText "Result: all programs can perform core dumps (value 1, for debugging)"
@@ -483,8 +577,10 @@
             ReportSuggestion "${TEST_NO}" "Determine if all binaries need to be able to core dump"
             AddHP 0 1
         else
-            LogText "Result: found default option, some programs can dump (not processes which need to change credentials)"
-            Display --indent 4 --text "- Checking setuid core dumps configuration" --result DEFAULT --color WHITE
+            # 0 - (default) - traditional behaviour. Any process which has changed privilege levels or is execute only will not be dumped
+            # https://www.kernel.org/doc/Documentation/sysctl/fs.txt
+            LogText "Result: found default option (0), no execute only program or program with changed privilege levels can dump"
+            Display --indent 4 --text "- Checking setuid core dumps configuration" --result DISABLED --color GREEN
             AddHP 1 1
         fi
     fi
@@ -596,7 +692,7 @@
                         # Ignore rescue images. Remove generic. and huge. for Slackware machines
                         LogText "Action: checking relevant kernels"
                         KERNELS=$(${LSBINARY} /boot/vmlinuz* | ${GREPBINARY} -v rescue | ${SEDBINARY} 's/vmlinuz-//' | ${SEDBINARY} 's/generic.//' | ${SEDBINARY} 's/huge.//' | ${SEDBINARY} 's/\.[a-z].*.//g' | ${SEDBINARY} 's/-[a-z].*.//g' | ${SEDBINARY} 's./boot/..' | ${SEDBINARY} 's/-/./g' | ${SORTBINARY} -n -k1,1 -k2,2 -k3,3 -k4,4 -k5,5 -k6,6 -t \.)
-                        KERNELS_ONE_LINE=$(echo ${KERNELS} | ${TRBINARY} '\n' ' ')
+                        KERNELS_ONE_LINE=$(${ECHOCMD} ${KERNELS} | ${TRBINARY} '\n' ' ')
                         LogText "Output: ${KERNELS_ONE_LINE}"
                     elif [ ! "$(ls ${ROOTDIR}boot/kernel* 2> /dev/null)" = "" ]; then
                         LogText "Output: Found a kernel file in ${ROOTDIR}boot"

From 3bc70b425e98fc7ccc896e0f92b36a4d8be1f7dd Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Sun, 13 Oct 2019 23:08:19 +0200
Subject: [PATCH 383/679] fix old limits check not working in a few cases

---
 include/tests_kernel | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index f79c77d1..97ebe9fa 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -517,9 +517,10 @@
         if [ -f "${ROOTDIR}etc/security/limits.conf" ]; then
             LogText "Result: file ${ROOTDIR}etc/security/limits.conf exists"
             LogText "Test: Checking if core dumps are disabled in ${ROOTDIR}etc/security/limits.conf and ${LIMITS_DIRECTORY}/*"
-            FIND1=$(${GREPBINARY} -r -v "^#" "${ROOTDIR}etc/security/limits.conf" $( if [ -d "${LIMITS_DIRECTORY}" ]; then ${ECHOCMD} "${LIMITS_DIRECTORY}"; fi ) | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="soft" && $3=="core" && $4=="0") { print "soft core disabled" } else if ($1=="*" && $2=="soft" && $3=="core" && $4!="0") { print "soft core enabled" } }' | ${TAILBINARY} -1)
-            FIND2=$(${GREPBINARY} -r -v "^#" "${ROOTDIR}etc/security/limits.conf" $( if [ -d "${LIMITS_DIRECTORY}" ]; then ${ECHOCMD} "${LIMITS_DIRECTORY}"; fi ) | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="hard" && $3=="core" && $4=="0") { print "hard core disabled" } else if ($1=="*" && $2=="hard" && $3=="core" && $4!="0") { print "hard core enabled" } }' | ${TAILBINARY} -1)
-            
+            # using find instead of grep -r to stay POSIX compliant. On AIX and HPUX grep -r is not available.
+            FIND1=$(${FINDBINARY} "${ROOTDIR}etc/security/limits.conf" "${ROOTDIR}etc/security/limits.conf.d" -type f -exec ${CAT_BINARY} {} \; 2> /dev/null | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="soft" && $3=="core" && $4=="0") { print "soft core disabled" } else if ($1=="*" && $2=="soft" && $3=="core" && $4!="0") { print "soft core enabled" } }' | ${TAILBINARY} -1)
+            FIND2=$(${FINDBINARY} "${ROOTDIR}etc/security/limits.conf" "${ROOTDIR}etc/security/limits.conf.d" -type f -exec ${CAT_BINARY} {} \; 2> /dev/null | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="hard" && $3=="core" && $4=="0") { print "hard core disabled" } else if ($1=="*" && $2=="hard" && $3=="core" && $4!="0") { print "hard core enabled" } }' | ${TAILBINARY} -1)
+
             IS_SOFTCORE_DISABLED="$(if [ "${FIND1}" = "soft core disabled" ]; then ${ECHOCMD} DISABLED; elif [ "${FIND1}" = "soft core enabled" ]; then ${ECHOCMD} ENABLED; else ${ECHOCMD} DEFAULT; fi)"
             IS_HARDCORE_DISABLED="$(if [ "${FIND2}" = "hard core disabled" ]; then ${ECHOCMD} DISABLED; elif [ "${FIND2}" = "hard core enabled" ]; then ${ECHOCMD} ENABLED; else ${ECHOCMD} DEFAULT; fi)"
 

From 4bb78d721e740b165c4cca2c659456b2df528258 Mon Sep 17 00:00:00 2001
From: Katarina Durechova <durechova@ynet.sk>
Date: Mon, 14 Oct 2019 21:50:22 +0200
Subject: [PATCH 384/679] Databases - variables initialization

---
 include/tests_databases | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/include/tests_databases b/include/tests_databases
index 16ea6786..5778dd1c 100644
--- a/include/tests_databases
+++ b/include/tests_databases
@@ -28,6 +28,14 @@
     sMYCNFLOCS="${ROOTDIR}etc/mysql/my.cnf ${ROOTDIR}usr/etc/my.cnf"
     REDIS_CONFIGURATION_FILES=""
     REDIS_CONFIGURATION_FOUND=0
+
+    MYSQL_RUNNING=0
+    DATABASE_ENGINE_RUNNING=0
+    MONGODB_RUNNING=0
+    POSTGRESQL_RUNNING=0
+    ORACLE_RUNNING=0
+    DB2_RUNNING=0
+    REDIS_RUNNING=0
 #
 #################################################################################
 #

From 4eeb2899cc777e3829e86ad1b472b2e233073163 Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Tue, 15 Oct 2019 21:52:53 +0200
Subject: [PATCH 385/679] add missing variables and replace '\s' to be posix
 conform

---
 include/tests_kernel | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index 97ebe9fa..f5a896ba 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -443,15 +443,19 @@
             LogText "Result: systemd is present on this system"
             LogText "Test: Checking if core dumps are disabled in ${ROOTDIR}etc/systemd/coredump.conf and ${ROOTDIR}etc/systemd/coredump.conf.d/*.conf"
             # check likely main config file for systemd: ${ROOTDIR}etc/systemd/coredump.conf for ProcessSizeMax=0 and Storage=none
-            SYSD_CORED_BASE_PROCSIZEMAX_NR_DISABLED=$(${GREPBINARY} -v "^\s*#" ${ROOTDIR}etc/systemd/coredump.conf 2> /dev/null | ${GREPBINARY} -i "ProcessSizeMax=0" | ${WCBINARY} -l)
-            SYSD_CORED_BASE_STORAGE_NR_DISABLED=$(${GREPBINARY} -v "^\s*#" ${ROOTDIR}etc/systemd/coredump.conf 2> /dev/null | ${GREPBINARY} -i "Storage=none" | ${WCBINARY} -l)
+            SYSD_CORED_BASE_PROCSIZEMAX_NR_DISABLED=$(${GREPBINARY} -v "^ *#" ${ROOTDIR}etc/systemd/coredump.conf 2> /dev/null | ${SEDBINARY} 's/^ *//g' | ${GREPBINARY} -i "^ProcessSizeMax=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g' | ${GREPBINARY} "^0 *$" | ${WCBINARY} -l)
+            SYSD_CORED_BASE_PROCSIZEMAX_NR_ENABLED=$(${GREPBINARY} -v "^ *#" ${ROOTDIR}etc/systemd/coredump.conf 2> /dev/null | ${SEDBINARY} 's/^ *//g' | ${GREPBINARY} -i "^ProcessSizeMax=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g' | ${GREPBINARY} -v "^0 *$" | ${WCBINARY} -l)
+            
+            SYSD_CORED_BASE_STORAGE_FOUND=$(${GREPBINARY} -v "^ *#" ${ROOTDIR}etc/systemd/coredump.conf 2> /dev/null | ${SEDBINARY} 's/^ *//g' | ${GREPBINARY} -i "^Storage=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g')
+            SYSD_CORED_BASE_STORAGE_NR_ENABLED=$(${ECHOCMD} "${SYSD_CORED_BASE_STORAGE_FOUND}" | ${SEDBINARY} 's/none//g' | ${WCBINARY} | ${AWKBINARY} '{print $2}')
+            SYSD_CORED_BASE_STORAGE_NR_DISABLED=$(${ECHOCMD} "${SYSD_CORED_BASE_STORAGE_FOUND}" | ${GREPBINARY} -o "none" | ${WCBINARY} | ${AWKBINARY} '{print $2}')
             # check conf files in possibly existing coredump.conf.d folders 
             # using find instead of grep -r to stay POSIX compliant. On AIX and HPUX grep -r is not available.
             # while there could be multiple files overwriting each other, we are checking the number of occurrences
-            SYSD_CORED_SUB_PROCSIZEMAX_NR_DISABLED=$(${FINDBINARY} /etc/systemd/coredump.conf.d/ /run/systemd/coredump.conf.d/ /usr/lib/systemd/coredump.conf.d/ -type f -iname "*.conf" -exec ${SEDBINARY} 's/^\s*//g' {} \; 2> /dev/null | ${GREPBINARY} -i "^ProcessSizeMax=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g' | ${GREPBINARY} "^0\s*$" | ${WCBINARY} -l)
-            SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED=$(${FINDBINARY} /etc/systemd/coredump.conf.d/ /run/systemd/coredump.conf.d/ /usr/lib/systemd/coredump.conf.d/ -type f -iname "*.conf" -exec ${SEDBINARY} 's/^\s*//g' {} \; 2> /dev/null | ${GREPBINARY} -i "^ProcessSizeMax=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g' | ${GREPBINARY} -v "^0\s*$" | ${WCBINARY} -l)
+            SYSD_CORED_SUB_PROCSIZEMAX_NR_DISABLED=$(${FINDBINARY} /etc/systemd/coredump.conf.d/ /run/systemd/coredump.conf.d/ /usr/lib/systemd/coredump.conf.d/ -type f -iname "*.conf" -exec ${SEDBINARY} 's/^ *//g' {} \; 2> /dev/null | ${GREPBINARY} -i "^ProcessSizeMax=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g' | ${GREPBINARY} "^0 *$" | ${WCBINARY} -l)
+            SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED=$(${FINDBINARY} /etc/systemd/coredump.conf.d/ /run/systemd/coredump.conf.d/ /usr/lib/systemd/coredump.conf.d/ -type f -iname "*.conf" -exec ${SEDBINARY} 's/^ *//g' {} \; 2> /dev/null | ${GREPBINARY} -i "^ProcessSizeMax=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g' | ${GREPBINARY} -v "^0 *$" | ${WCBINARY} -l)
             
-            SYSD_CORED_SUB_STORAGE_FOUND=$(${FINDBINARY} /etc/systemd/coredump.conf.d/ /run/systemd/coredump.conf.d/ /usr/lib/systemd/coredump.conf.d/ -type f -iname "*.conf" -exec ${SEDBINARY} 's/^\s*//g' {} \; 2> /dev/null | ${GREPBINARY} -i "^Storage=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g')
+            SYSD_CORED_SUB_STORAGE_FOUND=$(${FINDBINARY} /etc/systemd/coredump.conf.d/ /run/systemd/coredump.conf.d/ /usr/lib/systemd/coredump.conf.d/ -type f -iname "*.conf" -exec ${SEDBINARY} 's/^ *//g' {} \; 2> /dev/null | ${GREPBINARY} -i "^Storage=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g')
             SYSD_CORED_SUB_STORAGE_NR_ENABLED=$(${ECHOCMD} "${SYSD_CORED_SUB_STORAGE_FOUND}" | ${SEDBINARY} 's/none//g' | ${WCBINARY} | ${AWKBINARY} '{print $2}')
             SYSD_CORED_SUB_STORAGE_NR_DISABLED=$(${ECHOCMD} "${SYSD_CORED_SUB_STORAGE_FOUND}" | ${GREPBINARY} -o "none" | ${WCBINARY} | ${AWKBINARY} '{print $2}')
             
@@ -473,7 +477,7 @@
                 ReportSuggestion ${TEST_NO} "Check systemd configuration for overwriting core dump settings"
                 Display --indent 4 --text "- configuration in systemd conf files" --result "${STATUS_ENABLED}" --color YELLOW
                 AddHP 0 1
-            elif ( [ ${SYSD_CORED_BASE_PROCSIZEMAX_NR_ENABLED} -ge 1 ] && [ ${SYSD_CORED_BASE_STORAGE_NR_ENABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_ENABLED} -ge 1 ] ) || \
+            elif ( [ ${SYSD_CORED_BASE_PROCSIZEMAX_NR_ENABLED} -ge 1 ] && [ ${SYSD_CORED_BASE_STORAGE_NR_ENABLED} -ge 1 ] ) || \
                  ( [ ${SYSD_CORED_BASE_PROCSIZEMAX_NR_ENABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_ENABLED} -ge 1 ] ) || \
                  ( [ ${SYSD_CORED_BASE_STORAGE_NR_ENABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -ge 1 ] ) || \
                  ( [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_ENABLED} -ge 1 ] ); then
@@ -492,8 +496,8 @@
         if [ -f "${ROOTDIR}etc/profile" ]; then
             LogText "Test: Checking if 'ulimit -c 0' exists in ${ROOTDIR}etc/profile or ${ROOTDIR}etc/profile.d/*.sh"
             # use tail -1 in the following commands to get the last entry, which is the one that counts (in case of profile.d/ probably counts)
-            ULIMIT_C_VALUE="$(${GREPBINARY} "ulimit -c " ${ROOTDIR}etc/profile 2> /dev/null | ${SEDBINARY} 's/^\s*//g' | ${GREPBINARY} -v "^#" | ${TAILBINARY} -1 | ${CUTBINARY} -d' ' -f3 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g')"
-            ULIMIT_C_VALUE_SUB="$(${FINDBINARY} ${ROOTDIR}etc/profile.d -name "*.sh" -type f -exec ${CAT_BINARY} {} \; 2> /dev/null | ${GREPBINARY} "ulimit -c " | ${SEDBINARY} 's/^\s*//g' | ${GREPBINARY} -v "^#" | ${TAILBINARY} -1 | ${CUTBINARY} -d' ' -f3 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g')"
+            ULIMIT_C_VALUE="$(${GREPBINARY} "ulimit -c " ${ROOTDIR}etc/profile 2> /dev/null | ${SEDBINARY} 's/^ *//g' | ${GREPBINARY} -v "^#" | ${TAILBINARY} -1 | ${CUTBINARY} -d' ' -f3 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g')"
+            ULIMIT_C_VALUE_SUB="$(${FINDBINARY} ${ROOTDIR}etc/profile.d -name "*.sh" -type f -exec ${CAT_BINARY} {} \; 2> /dev/null | ${GREPBINARY} "ulimit -c " | ${SEDBINARY} 's/^ *//g' | ${GREPBINARY} -v "^#" | ${TAILBINARY} -1 | ${CUTBINARY} -d' ' -f3 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g')"
             
             if ( [ -n "${ULIMIT_C_VALUE_SUB}" ] && [ "${ULIMIT_C_VALUE_SUB}" = "0" ] ) || ( [ -n "${ULIMIT_C_VALUE}" ] && [ -z "${ULIMIT_C_VALUE_SUB}" ] && [ "${ULIMIT_C_VALUE}" = "0" ] ); then
                 LogText "Result: core dumps are disabled by 'ulimit -c 0' in ${ROOTDIR}etc/profile or ${ROOTDIR}etc/profile.d/*.sh"

From 62419033f5049a39e177953a54e180bfe0123211 Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Sat, 19 Oct 2019 00:34:25 +0200
Subject: [PATCH 386/679] fix for #781 - run lsblk without --paths

---
 include/tests_crypto | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/tests_crypto b/include/tests_crypto
index 77be22f2..96dc067a 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -138,9 +138,9 @@
         FOUND=0
 
         # cryptsetup only works as root
-        if [ -n "${LSBLKBINARY}" -a -n "${CRYPTSETUPBINARY}" -a ${FORENSICS_MODE} -eq 0 ]; then
-            for BLOCK_DEV in $(${LSBLKBINARY} --noheadings --list --paths -o NAME); do
-                if ${CRYPTSETUPBINARY} isLuks ${BLOCK_DEV} 2> /dev/null; then
+        if [ -n "${LSBLKBINARY}" ] && [ -n "${CRYPTSETUPBINARY}" ] && [ ${FORENSICS_MODE} -eq 0 ]; then
+            for BLOCK_DEV in $(${LSBLKBINARY} --noheadings --list -o NAME 2> /dev/null | cut -d' ' -f1); do
+                if ${CRYPTSETUPBINARY} isLuks $(${FINDBINARY} /dev/ -name "${BLOCK_DEV}" 2> /dev/null) 2> /dev/null; then
                     LogText "Result: Found LUKS encrypted block device: ${BLOCK_DEV}"
                     Report "encryption[]=luks,block_device,${BLOCK_DEV}"
                     FOUND=$((FOUND +1))

From ace2e27237b1866b456b9e6aea859778d2bbb601 Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Sun, 20 Oct 2019 19:55:34 +0200
Subject: [PATCH 387/679] KRNL-5840: add detection for proxmox and raspi kernel

---
 include/tests_ports_packages | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index eef56596..94116e6e 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -1248,7 +1248,8 @@
         LogText "Test: Checking how many kernel packages are installed"
 
         if [ -n "${DPKGBINARY}" ]; then
-            KERNELS=$(${DPKGBINARY} -l 2> /dev/null | ${GREPBINARY} "linux-image-[0-9]" | ${WCBINARY} -l)
+            KERNEL_PKG_NAMES="linux-image-[0-9]|raspberrypi-kernel|pve-kernel-[0-9]"
+            KERNELS=$(${DPKGBINARY} -l 2> /dev/null | ${EGREPBINARY} "${KERNEL_PKG_NAMES}" | ${WCBINARY} -l)
             if [ ${KERNELS} -eq 0 ]; then
                 LogText "Result: found no kernels from dpkg -l output, which is unexpected"
                 ReportException "KRNL-5840:2" "Could not find any kernel packages from DPKG output"

From 66a754fa1849b1f1b9d1bb1c341e6cdb09451a86 Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Sun, 20 Oct 2019 20:21:54 +0200
Subject: [PATCH 388/679] OS-Detection: add raspian detection

---
 include/osdetection | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/include/osdetection b/include/osdetection
index db7b9e92..cf9d1eac 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -206,6 +206,13 @@
                             OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="Ubuntu"
                         ;;
+                        "raspbian")
+                            LINUX_VERSION="Raspbian"
+                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_NAME="Raspbian"
+                        ;;
                         "rhel")
                             LINUX_VERSION="RHEL"
                             OS_NAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')

From 62feaf3fffc591ef18b7adbc063d696b01ac66ce Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Tue, 22 Oct 2019 20:07:56 +0200
Subject: [PATCH 389/679] do set variable NTP_CONFIG_FOUND if ntp config is
 found

---
 include/tests_time | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/tests_time b/include/tests_time
index 4f24da5c..4513cb9a 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -487,6 +487,7 @@
                     ReportWarning "${TEST_NO}" "Found world writable configuration file" "${FILE}" ""
                 fi
                 Report "ntp_config_file[]=${FILE}"
+                NTP_CONFIG_FOUND=1
             fi
         done
     fi

From 4898e48e160d07b0a7be57f6e5d85562ff1aa6db Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Tue, 22 Oct 2019 21:43:37 +0200
Subject: [PATCH 390/679] don't fail relative paths check with spaces in PATH

---
 include/binaries | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/include/binaries b/include/binaries
index 1c4646da..8f30a010 100644
--- a/include/binaries
+++ b/include/binaries
@@ -50,7 +50,7 @@
         # Test if our PATH variable provides a set of paths. If so, reverse the order. If we discover the same binary
         # multiple times, the one first in PATH should be used.
         if [ -n "${PATH}" ]; then
-            PATH_REVERSED=$(echo ${PATH} | awk -F: '{ for (i=NF; i>1; i--) printf("%s ",$i); print $1; }')
+            PATH_REVERSED=$(echo "${PATH}" | sed 's/ /!!space!!/g' | awk -F: '{ for (i=NF; i>1; i--) printf("%s ",$i); print $1; }')
             BIN_PATHS=$(echo "${PATH_REVERSED}" | tr ':' ' ')
         fi
 
@@ -59,8 +59,8 @@
             FOUND=0
             if [ "${SCANDIR}" = "." ]; then FOUND=1; MSG="Found single dot (.) in PATH"
             elif [ "${SCANDIR}" = ".." ]; then FOUND=1; MSG="Found double dot (..) in PATH"
-            elif echo ${SCANDIR} | grep '^\.\.' > /dev/null; then FOUND=1; MSG="Found path starting with double dot (..) in PATH"
-            elif echo ${SCANDIR} | grep '^[a-zA-Z]' > /dev/null; then FOUND=1; MSG="Found relative path in PATH"
+            elif echo "${SCANDIR}" | grep '^\.\.' > /dev/null; then FOUND=1; MSG="Found path starting with double dot (..) in PATH"
+            elif echo "${SCANDIR}" | grep '^[a-zA-Z]' > /dev/null; then FOUND=1; MSG="Found relative path in PATH"
             fi
             if [ ${FOUND} -eq 1 ]; then
                 # Stop execution if privileged, otherwise continue but warn user
@@ -76,11 +76,12 @@
 
         # Now perform binary detection
         for SCANDIR in ${BIN_PATHS}; do
+            SCANDIR=$(echo "$SCANDIR" | sed 's/!!space!!/ /g')
             LogText "Test: Checking binaries in directory ${SCANDIR}"
             ORGPATH=""
-            if [ -d ${SCANDIR} ]; then
+            if [ -d "${SCANDIR}" ]; then
                 SKIPDIR=0
-                if [ -L ${SCANDIR} ]; then
+                if [ -L "${SCANDIR}" ]; then
                     LogText "Result: directory exists, but is actually a symlink"
                     ShowSymlinkPath ${SCANDIR}
                     if [ ${FOUNDPATH} -eq 1 ]; then
@@ -109,7 +110,7 @@
                     LogText "Directory ${SCANDIR} exists. Starting directory scanning..."
 
                     # Show the contents of the directory with binaries, ignore directories
-                    FIND=$(ls -p ${SCANDIR} | grep -v '/$')
+                    FIND=$(ls -p "${SCANDIR}" | grep -v '/$')
                     for FILENAME in ${FIND}; do
                         COUNT=$((COUNT + 1))
                         BINARY="${SCANDIR}/${FILENAME}"
@@ -186,7 +187,7 @@
                             logrotate)              LOGROTATEBINARY="${BINARY}";       LogText "  Found known binary: logrotate (log rotation tool) - ${BINARY}" ;;
                             ls)                     LSBINARY="${BINARY}";              LogText "  Found known binary: ls (file listing) - ${BINARY}" ;;
                             lsattr)                 LSATTRBINARY="${BINARY}";          LogText "  Found known binary: lsattr (file attributes) - ${BINARY}" ;;
-			    lsblk)		    LSBLKBINARY="${BINARY}";	       LogText "  Found known binary: lsblk (block devices) - ${BINARY}" ;;
+                            lsblk)		            LSBLKBINARY="${BINARY}";	       LogText "  Found known binary: lsblk (block devices) - ${BINARY}" ;;
                             lsmod)                  LSMODBINARY="${BINARY}";           LogText "  Found known binary: lsmod (kernel modules) - ${BINARY}" ;;
                             lsof)
                                 LSOFBINARY="${BINARY}"
@@ -293,7 +294,7 @@
 
         # unset SORTED_BIN_PATHS
         BINARY_SCAN_FINISHED=1
-        BINARY_PATHS_FOUND=$(echo ${BINARY_PATHS_FOUND} | sed 's/^, //g' | sed 's/ //g')
+        BINARY_PATHS_FOUND=$(echo ${BINARY_PATHS_FOUND} | sed 's/^, //g' | sed 's/, /,/g')
         LogText "Discovered directories: ${BINARY_PATHS_FOUND}"
         LogText "Result: found ${COUNT} binaries"
         Report "binaries_count=${COUNT}"

From 6dad2f476e3ab5386cf573b962f9af58a20fb60f Mon Sep 17 00:00:00 2001
From: Dave Vehrs <dvehrs@gmail.com>
Date: Wed, 23 Oct 2019 12:31:20 -0600
Subject: [PATCH 391/679] Updated permissions checks

---
 include/functions | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/include/functions b/include/functions
index b96bb070..ea5a2bd3 100644
--- a/include/functions
+++ b/include/functions
@@ -1281,6 +1281,9 @@
                     CHECK_PERMISSION=$(echo "-${CHECK_PERMISSION}" | ${AWKBINARY} '{k=0;for(i=0;i<=8;i++)k+=((substr($1,i+2,1)~/[rwx]/)*2^(8-i));if(k)printf("%0o",k)}')
                 fi
 
+                # Add leading zeros if necessary
+                CHECK_PERMISSION=$(echo "${CHECK_PERMISSION}" | ${AWKBINARY} '{printf "%03d",$1}')
+
                 # First try stat command
                 LogText "Test: checking if file ${CHECKFILE} is ${CHECK_PERMISSION}"
                 if [ -n "${STATBINARY}" ]; then
@@ -1299,7 +1302,11 @@
                         *)
                             # Only use find when OS is NOT AIX and binaries are NOT busybox
                             if [ ${SHELL_IS_BUSYBOX} -eq 0 ]; then
-                                DATA=$(${FINDBINARY} ${CHECKFILE} -printf "%m")
+                                if [ -d ${CHECKFILE} ]; then
+                                    DATA=$(${FINDBINARY} ${CHECKFILE} -maxdepth 0 -printf "%m")
+                                else
+                                    DATA=$(${FINDBINARY} ${CHECKFILE} -printf "%m")
+                                fi
                             fi
                         ;;
                     esac
@@ -1317,13 +1324,16 @@
 
                 # Convert permissions to octal when needed
                 case ${DATA} in
-                    "r"|"w"|"x"|"-")
+                    [-r][-w][-x][-r][-w][-x][-r][-w][-x] )
                         LogText "Converting value ${DATA} to octal"
-                        DATA=$(echo ${DATA} | ${AWKBINARY} '{k=0;for(i=0;i<=8;i++)k+=((substr($1,i+2,1)~/[rwx]/)*2^(8-i));if(k)printf("%0o",k)}')
-                        if [ "${DATA}" = "0" ]; then DATA="000"; fi
+                        # add a dummy character as first character so it looks like output is a normal file
+                        DATA=$(echo "-${DATA}" | ${AWKBINARY} '{k=0;for(i=0;i<=8;i++)k+=((substr($1,i+2,1)~/[rwx]/)*2^(8-i));if(k)printf("%0o",k)}')
                     ;;
                 esac
 
+                # Add leading zeros if necessary
+                DATA=$(echo "${DATA}" | ${AWKBINARY} '{printf "%03d",$1}')
+
                 if [ -n "${DATA}" ]; then
                     if [ "${DATA}" = "${CHECK_PERMISSION}" ]; then
                         LogText "Outcome: correct permissions (${DATA})"

From e6bf111f41e2a235c23593e649a08565daacb1e5 Mon Sep 17 00:00:00 2001
From: Dave Vehrs <dvehrs@gmail.com>
Date: Wed, 23 Oct 2019 14:47:03 -0600
Subject: [PATCH 392/679] Updated tests for file permissions to case statements

---
 include/tests_authentication  | 77 ++++++++++++++++++++++++-----------
 include/tests_printers_spools | 19 +++++----
 2 files changed, 65 insertions(+), 31 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 7458c487..b29ff65d 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -478,10 +478,10 @@
         done
         if [ ${FOUND} -eq 1 ]; then
             LogText "Result: sudoers file found (${SUDOERS_FILE})"
-            Display --indent 2 --text "- sudoers file" --result "${STATUS_FOUND}" --color GREEN
+            Display --indent 2 --text "- Sudoers file(s)" --result "${STATUS_FOUND}" --color GREEN
         else
             LogText "Result: sudoers file NOT found"
-            Display --indent 2 --text "- sudoers file" --result "${STATUS_NOT_FOUND}" --color YELLOW
+            Display --indent 2 --text "- Sudoers file" --result "${STATUS_NOT_FOUND}" --color YELLOW
         fi
     fi
 #
@@ -499,13 +499,27 @@
             FIND=$(${LSBINARY} -ld ${SUDOERS_D} | ${CUTBINARY} -c 2-10)
             FIND2=$(${LSBINARY} -nd ${SUDOERS_D} | ${AWKBINARY} '{print $3$4}')
             LogText "Result: Found directory permissions: ${FIND} and owner UID GID: ${FIND2}"
-            if [ "${FIND}" = "rwxrwx---" -o "${FIND}" = "rwxr-x---" -o "${FIND}" = "rwx------" ] && [ "${FIND2}" = "00" ]; then
-                LogText "Result: directory ${SUDOERS_D} permissions/ownership OK"
-                Display --indent 4 --text "- Permissions for directory: ${SUDOERS_D}" --result "${STATUS_OK}" --color GREEN
-            else
-                LogText "Result: directory has possibly unsafe permissions/ownership"
-                Display --indent 4 --text "- Permissions for directory: ${SUDOERS_D}" --result "${STATUS_WARNING}" --color RED
-            fi
+            case "${FIND}" in
+                rwx[r-][w-][x-]--- )
+                    LogText "Result: directory ${SUDOERS_D} permissions OK"
+                    if [ "${FIND2}" = "00" ]; then
+                        LogText "Result: directory ${SUDOERS_D} ownership OK"
+                        Display --indent 4 --text "- Permissions for directory: ${SUDOERS_D}" --result "${STATUS_OK}" --color GREEN
+                    else
+                        LogText "Result: directory ${SUDOERS_D} has possibly unsafe ownership"
+                        Display --indent 4 --text "- Permissions for directory: ${SUDOERS_D}" --result "${STATUS_WARNING}" --color RED
+                    fi
+                    ;;
+                * )
+                    LogText "Result: directory ${SUDOERS_D} has possibly unsafe permissions"
+                    if [ "${FIND2}" = "00" ]; then
+                        LogText "Result: directory ${SUDOERS_D} ownership OK"
+                    else
+                        LogText "Result: directory ${SUDOERS_D} has possibly unsafe ownership"
+                    fi
+                    Display --indent 4 --text "- Permissions for directory: ${SUDOERS_D}" --result "${STATUS_WARNING}" --color RED
+                    ;;
+            esac
             SUDO_CONFIG_FILES="${SUDO_CONFIG_FILES} $(${FINDBINARY} ${SUDOERS_D} -type f -print)"
         fi
         for f in ${SUDO_CONFIG_FILES}; do
@@ -513,13 +527,27 @@
             FIND=$(${LSBINARY} -l ${f} | ${CUTBINARY} -c 2-10)
             FIND2=$(${LSBINARY} -n ${f} | ${AWKBINARY} '{print $3$4}')
             LogText "Result: Found file permissions: ${FIND} and owner UID GID: ${FIND2}"
-            if [ "${FIND}" = "rw-------" -o "${FIND}" = "rw-rw----" -o "${FIND}" = "r--r-----" ] && [ "${FIND2}" = "00" ]; then
-                LogText "Result: file ${f} permissions/ownership OK"
-                Display --indent 4 --text "- Permissions for: ${f}" --result "${STATUS_OK}" --color GREEN
-            else
-                LogText "Result: file has possibly unsafe permissions/ownership"
-                Display --indent 4 --text "- Permissions for: ${f}" --result "${STATUS_WARNING}" --color RED
-            fi
+            case "${FIND}" in
+                r[w-]-[r-][w-]---- )
+                    LogText "Result: file ${f} permissions OK"
+                    if [ "${FIND2}" = "00" ]; then
+                        LogText "Result: file ${f} ownership OK"
+                        Display --indent 4 --text "- Permissions for: ${f}" --result "${STATUS_OK}" --color GREEN
+                    else
+                        LogText "Result: file ${f} has possibly unsafe ownership"
+                        Display --indent 4 --text "- Permissions for: ${f}" --result "${STATUS_WARNING}" --color RED
+                    fi
+                    ;;
+                * )
+                    LogText "Result: file ${f} has possibly unsafe permissions"
+                    if [ "${FIND2}" = "00" ]; then
+                        LogText "Result: file ${f} ownership OK"
+                    else
+                        LogText "Result: file ${f} has possibly unsafe ownership"
+                    fi
+                    Display --indent 4 --text "- Permissions for: ${f}" --result "${STATUS_WARNING}" --color RED
+                    ;;
+            esac
         done
     fi
 #
@@ -1469,13 +1497,16 @@
         LogText "Test: checking /etc/doas.conf permissions"
         FIND=$(ls -l ${DOAS_FILE} | ${CUTBINARY} -c 2-10)
         LogText "Result: Found /etc/doas.conf file permissions: ${FIND}"
-        if [ "${FIND}" = "rw-------" -o "${FIND}" = "rw-rw----" -o "${FIND}" = "r--r-----" ]; then
-            LogText "Result: file /etc/doas.conf has correct permissions"
-            Display --indent 4 --text "- Check doas file permissions" --result "${STATUS_OK}" --color GREEN
-        else
-            LogText "Result: file has possibly unsafe file permissions"
-            Display --indent 4 --text "- Check doas file permissions" --result "${STATUS_WARNING}" --color RED
-        fi
+        case "${FIND}" in
+            r[w-]-[r-][w-]---- )
+                LogText "Result: file /etc/doas.conf has correct permissions"
+                Display --indent 4 --text "- Check doas file permissions" --result "${STATUS_OK}" --color GREEN
+                ;;
+            * )
+                LogText "Result: file has possibly unsafe file permissions"
+                Display --indent 4 --text "- Check doas file permissions" --result "${STATUS_WARNING}" --color RED
+                ;;
+        esac
     fi
 #
 #################################################################################
diff --git a/include/tests_printers_spools b/include/tests_printers_spools
index e2026bc5..d7483d63 100644
--- a/include/tests_printers_spools
+++ b/include/tests_printers_spools
@@ -117,14 +117,17 @@
         LogText "Test: Checking CUPS configuration file permissions"
         FIND=$(${LSBINARY} -l ${CUPSD_CONFIG_FILE} | ${CUTBINARY} -c 2-10)
         LogText "Result: found ${FIND}"
-        if [ "${FIND}" = "r--------" -o "${FIND}" = "rw-------" -o "${FIND}" = "rw-r-----" -o "${FIND}" = "rw-rw----" ]; then
-            Display --indent 4 --text "- File permissions" --result "${STATUS_OK}" --color GREEN
-            AddHP 1 1
-        else
-            Display --indent 4 --text "- File permissions" --result "${STATUS_WARNING}" --color RED
-            ReportSuggestion ${TEST_NO} "Access to CUPS configuration could be more strict."
-            AddHP 1 2
-        fi
+        case "${FIND}" in
+            r[w-]-[r-][w-]---- )
+                Display --indent 4 --text "- File permissions" --result "${STATUS_OK}" --color GREEN
+                AddHP 1 1
+                ;;
+            * )
+                Display --indent 4 --text "- File permissions" --result "${STATUS_WARNING}" --color RED
+                ReportSuggestion ${TEST_NO} "Access to CUPS configuration could be more strict."
+                AddHP 1 2
+                ;;
+        esac
     fi
 #
 #################################################################################

From 32ee01681080b25e2f8888b11458209af7c1fade Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Wed, 23 Oct 2019 23:06:03 +0200
Subject: [PATCH 393/679] fix: forgot to replace test folder with correct
 folder from variable

---
 include/tests_kernel | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index f5a896ba..b9cec302 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -522,8 +522,8 @@
             LogText "Result: file ${ROOTDIR}etc/security/limits.conf exists"
             LogText "Test: Checking if core dumps are disabled in ${ROOTDIR}etc/security/limits.conf and ${LIMITS_DIRECTORY}/*"
             # using find instead of grep -r to stay POSIX compliant. On AIX and HPUX grep -r is not available.
-            FIND1=$(${FINDBINARY} "${ROOTDIR}etc/security/limits.conf" "${ROOTDIR}etc/security/limits.conf.d" -type f -exec ${CAT_BINARY} {} \; 2> /dev/null | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="soft" && $3=="core" && $4=="0") { print "soft core disabled" } else if ($1=="*" && $2=="soft" && $3=="core" && $4!="0") { print "soft core enabled" } }' | ${TAILBINARY} -1)
-            FIND2=$(${FINDBINARY} "${ROOTDIR}etc/security/limits.conf" "${ROOTDIR}etc/security/limits.conf.d" -type f -exec ${CAT_BINARY} {} \; 2> /dev/null | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="hard" && $3=="core" && $4=="0") { print "hard core disabled" } else if ($1=="*" && $2=="hard" && $3=="core" && $4!="0") { print "hard core enabled" } }' | ${TAILBINARY} -1)
+            FIND1=$(${FINDBINARY} "${ROOTDIR}etc/security/limits.conf" "${LIMITS_DIRECTORY}" -type f -exec ${CAT_BINARY} {} \; 2> /dev/null | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="soft" && $3=="core" && $4=="0") { print "soft core disabled" } else if ($1=="*" && $2=="soft" && $3=="core" && $4!="0") { print "soft core enabled" } }' | ${TAILBINARY} -1)
+            FIND2=$(${FINDBINARY} "${ROOTDIR}etc/security/limits.conf" "${LIMITS_DIRECTORY}" -type f -exec ${CAT_BINARY} {} \; 2> /dev/null | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="hard" && $3=="core" && $4=="0") { print "hard core disabled" } else if ($1=="*" && $2=="hard" && $3=="core" && $4!="0") { print "hard core enabled" } }' | ${TAILBINARY} -1)
 
             IS_SOFTCORE_DISABLED="$(if [ "${FIND1}" = "soft core disabled" ]; then ${ECHOCMD} DISABLED; elif [ "${FIND1}" = "soft core enabled" ]; then ${ECHOCMD} ENABLED; else ${ECHOCMD} DEFAULT; fi)"
             IS_HARDCORE_DISABLED="$(if [ "${FIND2}" = "hard core disabled" ]; then ${ECHOCMD} DISABLED; elif [ "${FIND2}" = "hard core enabled" ]; then ${ECHOCMD} ENABLED; else ${ECHOCMD} DEFAULT; fi)"

From d97221b851e0cb33903f09e8e2859f740049cd34 Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Thu, 24 Oct 2019 00:14:42 +0200
Subject: [PATCH 394/679] added additional php folders to check, plus added
 PHP72 and PHP73

---
 include/tests_php | 83 ++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 67 insertions(+), 16 deletions(-)

diff --git a/include/tests_php b/include/tests_php
index d2303c2c..b58d1758 100644
--- a/include/tests_php
+++ b/include/tests_php
@@ -29,25 +29,60 @@
 
     # Possible locations of php.ini
     PHPINILOCS="${ROOTDIR}etc/php.ini ${ROOTDIR}etc/php.ini.default \
-                ${ROOTDIR}etc/php/php.ini ${ROOTDIR}etc/php5.5/php.ini ${ROOTDIR}etc/php5.6/php.ini ${ROOTDIR}etc/php7.0/php.ini ${ROOTDIR}etc/php7.1/php.ini ${ROOTDIR}etc/php7.2/php.ini \
-                ${ROOTDIR}etc/php/cgi-php5/php.ini ${ROOTDIR}etc/php/cli-php5/php.ini ${ROOTDIR}etc/php/apache2-php5/php.ini \
-                ${ROOTDIR}etc/php/apache2-php5.5/php.ini ${ROOTDIR}etc/php/apache2-php5.6/php.ini ${ROOTDIR}etc/php/apache2-php7.0/php.ini ${ROOTDIR}etc/php/apache2-php7.1/php.ini \
-                ${ROOTDIR}etc/php/cgi-php7.1/php.ini ${ROOTDIR}etc/php/apache2-php7.1/php.ini ${ROOTDIR}etc/php/cgi-php5.5/php.ini ${ROOTDIR}etc/php/cgi-php5.6/php.ini ${ROOTDIR}etc/php/cgi-php7.0/php.ini \
-                ${ROOTDIR}etc/php/cli-php7.1/php.ini ${ROOTDIR}etc/php/cli-php5.5/php.ini ${ROOTDIR}etc/php/cli-php5.6/php.ini ${ROOTDIR}etc/php/cli-php7.0/php.ini \
-                ${ROOTDIR}etc/php/embed-php7.1/php.ini ${ROOTDIR}etc/php/embed-php5.5/php.ini ${ROOTDIR}etc/php/embed-php5.6/php.ini ${ROOTDIR}etc/php/embed-php7.0/php.ini \
-                ${ROOTDIR}etc/php/fpm-php7.1/php.ini ${ROOTDIR}etc/php/fpm-php5.5/php.ini ${ROOTDIR}etc/php/fpm-php5.6/php.ini ${ROOTDIR}etc/php/fpm-php7.0/php.ini \
+                ${ROOTDIR}etc/php/php.ini \
+                ${ROOTDIR}etc/php5.5/php.ini \
+                ${ROOTDIR}etc/php5.6/php.ini \
+                ${ROOTDIR}etc/php7.0/php.ini \
+                ${ROOTDIR}etc/php7.1/php.ini \
+                ${ROOTDIR}etc/php7.2/php.ini \
+                ${ROOTDIR}etc/php7.3/php.ini \
+                ${ROOTDIR}etc/php/cgi-php5/php.ini \
+                ${ROOTDIR}etc/php/cli-php5/php.ini \
+                ${ROOTDIR}etc/php/apache2-php5/php.ini \
+                ${ROOTDIR}etc/php/apache2-php5.5/php.ini \
+                ${ROOTDIR}etc/php/apache2-php5.6/php.ini \
+                ${ROOTDIR}etc/php/apache2-php7.0/php.ini \
+                ${ROOTDIR}etc/php/apache2-php7.1/php.ini \
+                ${ROOTDIR}etc/php/apache2-php7.2/php.ini \
+                ${ROOTDIR}etc/php/apache2-php7.3/php.ini \
+                ${ROOTDIR}etc/php/cgi-php5.5/php.ini \
+                ${ROOTDIR}etc/php/cgi-php5.6/php.ini \
+                ${ROOTDIR}etc/php/cgi-php7.0/php.ini \
+                ${ROOTDIR}etc/php/cgi-php7.1/php.ini \
+                ${ROOTDIR}etc/php/cgi-php7.2/php.ini \
+                ${ROOTDIR}etc/php/cgi-php7.3/php.ini \
+                ${ROOTDIR}etc/php/cli-php5.5/php.ini \
+                ${ROOTDIR}etc/php/cli-php5.6/php.ini \
+                ${ROOTDIR}etc/php/cli-php7.0/php.ini \
+                ${ROOTDIR}etc/php/cli-php7.1/php.ini \
+                ${ROOTDIR}etc/php/cli-php7.2/php.ini \
+                ${ROOTDIR}etc/php/cli-php7.3/php.ini \
+                ${ROOTDIR}etc/php/embed-php5.5/php.ini \
+                ${ROOTDIR}etc/php/embed-php5.6/php.ini \
+                ${ROOTDIR}etc/php/embed-php7.0/php.ini \
+                ${ROOTDIR}etc/php/embed-php7.1/php.ini \
+                ${ROOTDIR}etc/php/embed-php7.2/php.ini \
+                ${ROOTDIR}etc/php/embed-php7.3/php.ini \
+                ${ROOTDIR}etc/php/fpm-php7.3/php.ini \
+                ${ROOTDIR}etc/php/fpm-php7.2/php.ini \
+                ${ROOTDIR}etc/php/fpm-php7.1/php.ini \
+                ${ROOTDIR}etc/php/fpm-php7.0/php.ini \
+                ${ROOTDIR}etc/php/fpm-php5.5/php.ini \
+                ${ROOTDIR}etc/php/fpm-php5.6/php.ini \
                 ${ROOTDIR}etc/php5/cgi/php.ini \
                 ${ROOTDIR}etc/php5/cli/php.ini \
                 ${ROOTDIR}etc/php5/cli-php5.4/php.ini ${ROOTDIR}etc/php5/cli-php5.5/php.ini ${ROOTDIR}etc/php5/cli-php5.6/php.ini \
                 ${ROOTDIR}etc/php5/apache2/php.ini \
                 ${ROOTDIR}etc/php5/fpm/php.ini \
                 ${ROOTDIR}private/etc/php.ini \
-                ${ROOTDIR}etc/php/7.2/apache2/php.ini \
-                ${ROOTDIR}etc/php/7.1/apache2/php.ini \
                 ${ROOTDIR}etc/php/7.0/apache2/php.ini \
-                ${ROOTDIR}etc/php/7.2/cli/php.ini ${ROOTDIR}etc/php/7.2/fpm/php.ini \
-                ${ROOTDIR}etc/php/7.1/cli/php.ini ${ROOTDIR}etc/php/7.1/fpm/php.ini \
+                ${ROOTDIR}etc/php/7.1/apache2/php.ini \
+                ${ROOTDIR}etc/php/7.2/apache2/php.ini \
+                ${ROOTDIR}etc/php/7.3/apache2/php.ini \
                 ${ROOTDIR}etc/php/7.0/cli/php.ini ${ROOTDIR}etc/php/7.0/fpm/php.ini \
+                ${ROOTDIR}etc/php/7.1/cli/php.ini ${ROOTDIR}etc/php/7.1/fpm/php.ini \
+                ${ROOTDIR}etc/php/7.2/cli/php.ini ${ROOTDIR}etc/php/7.2/fpm/php.ini \
+                ${ROOTDIR}etc/php/7.3/cli/php.ini ${ROOTDIR}etc/php/7.3/fpm/php.ini \
                 ${ROOTDIR}var/www/conf/php.ini \
                 ${ROOTDIR}usr/local/etc/php.ini ${ROOTDIR}usr/local/lib/php.ini \
                 ${ROOTDIR}usr/local/etc/php5/cgi/php.ini \
@@ -55,6 +90,8 @@
                 ${ROOTDIR}usr/local/php56/lib/php.ini \
                 ${ROOTDIR}usr/local/php70/lib/php.ini \
                 ${ROOTDIR}usr/local/php71/lib/php.ini \
+                ${ROOTDIR}usr/local/php72/lib/php.ini \
+                ${ROOTDIR}usr/local/php73/lib/php.ini \
                 ${ROOTDIR}usr/local/zend/etc/php.ini \
                 ${ROOTDIR}usr/pkg/etc/php.ini \
                 ${ROOTDIR}opt/cpanel/ea-php54/root/etc/php.ini \
@@ -62,6 +99,8 @@
                 ${ROOTDIR}opt/cpanel/ea-php56/root/etc/php.ini \
                 ${ROOTDIR}opt/cpanel/ea-php70/root/etc/php.ini \
                 ${ROOTDIR}opt/cpanel/ea-php71/root/etc/php.ini \
+                ${ROOTDIR}opt/cpanel/ea-php72/root/etc/php.ini \
+                ${ROOTDIR}opt/cpanel/ea-php73/root/etc/php.ini \
                 ${ROOTDIR}opt/alt/php44/etc/php.ini \
                 ${ROOTDIR}opt/alt/php51/etc/php.ini \
                 ${ROOTDIR}opt/alt/php52/etc/php.ini \
@@ -71,24 +110,29 @@
                 ${ROOTDIR}opt/alt/php56/etc/php.ini \
                 ${ROOTDIR}opt/alt/php70/etc/php.ini \
                 ${ROOTDIR}opt/alt/php71/etc/php.ini \
+                ${ROOTDIR}opt/alt/php72/etc/php.ini \
+                ${ROOTDIR}opt/alt/php73/etc/php.ini \
                 ${ROOTDIR}etc/opt/remi/php56/php.ini \
                 ${ROOTDIR}etc/opt/remi/php70/php.ini \
                 ${ROOTDIR}etc/opt/remi/php71/php.ini \
-                ${ROOTDIR}etc/opt/remi/php72/php.ini"
+                ${ROOTDIR}etc/opt/remi/php72/php.ini \
+                ${ROOTDIR}etc/opt/remi/php73/php.ini"
     # HEADS-UP: OpenBSD, last two releases are supported, and snapshots of -current
     PHPINILOCS="${PHPINILOCS} \
-                ${ROOTDIR}etc/php-5.6.ini ${ROOTDIR}etc/php-7.0.ini ${ROOTDIR}etc/php-7.1.ini ${ROOTDIR}etc/php-7.2.ini"
+                ${ROOTDIR}etc/php-5.6.ini ${ROOTDIR}etc/php-7.0.ini ${ROOTDIR}etc/php-7.1.ini ${ROOTDIR}etc/php-7.2.ini ${ROOTDIR}etc/php-7.3.ini"
 
     PHPINIDIRS="${ROOTDIR}etc/php5/conf.d \
                 ${ROOTDIR}etc/php/7.0/cli/conf.d \
                 ${ROOTDIR}etc/php/7.1/cli/conf.d \
                 ${ROOTDIR}etc/php/7.2/cli/conf.d \
+                ${ROOTDIR}etc/php/7.3/cli/conf.d \
                 ${ROOTDIR}etc/php/7.0/fpm/conf.d \
                 ${ROOTDIR}etc/php/7.1/fpm/conf.d \
                 ${ROOTDIR}etc/php/7.2/fpm/conf.d \
+                ${ROOTDIR}etc/php/7.3/fpm/conf.d \
                 ${ROOTDIR}etc/php.d \
                 ${ROOTDIR}opt/cpanel/ea-php54/root/etc/php.d ${ROOTDIR}opt/cpanel/ea-php55/root/etc/php.d ${ROOTDIR}opt/cpanel/ea-php56/root/etc/php.d ${ROOTDIR}opt/cpanel/ea-php70/root/etc/php.d \
-                ${ROOTDIR}opt/cpanel/ea-php71/root/etc/php.d \
+                ${ROOTDIR}opt/cpanel/ea-php71/root/etc/php.d ${ROOTDIR}opt/cpanel/ea-php72/root/etc/php.d ${ROOTDIR}opt/cpanel/ea-php73/root/etc/php.d \
                 ${ROOTDIR}opt/alt/php44/etc/php.d.all \
                 ${ROOTDIR}opt/alt/php51/etc/php.d.all \
                 ${ROOTDIR}opt/alt/php52/etc/php.d.all \
@@ -97,10 +141,17 @@
                 ${ROOTDIR}opt/alt/php55/etc/php.d.all \
                 ${ROOTDIR}opt/alt/php56/etc/php.d.all \
                 ${ROOTDIR}opt/alt/php70/etc/php.d.all \
-                ${ROOTDIR}opt/alt/php71/etc/php.d.all"
+                ${ROOTDIR}opt/alt/php71/etc/php.d.all \
+                ${ROOTDIR}opt/alt/php72/etc/php.d.all \
+                ${ROOTDIR}opt/alt/php73/etc/php.d.all \
+                ${ROOTDIR}usr/local/lib/php.conf.d \
+                ${ROOTDIR}usr/local/php70/lib/php.conf.d \
+                ${ROOTDIR}usr/local/php71/lib/php.conf.d \
+                ${ROOTDIR}usr/local/php72/lib/php.conf.d \
+                ${ROOTDIR}usr/local/php73/lib/php.conf.d"
     # HEADS-UP: OpenBSD, last two releases are supported, and snapshots of -current
     PHPINIDIRS="${PHPINIDIRS} \
-                ${ROOTDIR}etc/php-5.6 ${ROOTDIR}etc/php-7.0 ${ROOTDIR}etc/php-7.1 ${ROOTDIR}etc/php-7.2"
+                ${ROOTDIR}etc/php-5.6 ${ROOTDIR}etc/php-7.0 ${ROOTDIR}etc/php-7.1 ${ROOTDIR}etc/php-7.2 ${ROOTDIR}etc/php-7.3"
 #
 #################################################################################
 #

From 8353483d1dcc89be5eecf032b474a6045b7f3782 Mon Sep 17 00:00:00 2001
From: Marzal <2069735+Marzal@users.noreply.github.com>
Date: Tue, 29 Oct 2019 18:47:07 +0100
Subject: [PATCH 395/679] grep doesn't work with '\|' in AIX. grep -E is more
 POSIX compliant.

---
 include/profiles | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/profiles b/include/profiles
index d05dcbb3..f1bfb326 100644
--- a/include/profiles
+++ b/include/profiles
@@ -46,7 +46,7 @@
         fi
 
         # Security check for unexpected and possibly harmful escape characters (hyphen should be listed as first or last character)
-        DATA=$(grep -v '^$\|^ \|^#\|^config:' ${PROFILE} | tr -d '[:alnum:]/\[\]\(\)_\|,\.:;= \n\r-' | od -An -ta | sed 's/ /!space!/g')
+        DATA=$(grep -Ev '^$|^ |^#|^config:' "${PROFILE}" | tr -d '[:alnum:]/\[\]\(\)_\|,\.:;= \n\r-' | od -An -ta | sed 's/ /!space!/g')
         if ! IsEmpty "${DATA}"; then
             DisplayWarning "Your profile '${PROFILE}' contains unexpected characters. See the log file for more information."
             LogText "Found unexpected or possibly harmful characters in profile '${PROFILE}'. See which characters matched in the output below and compare them with your profile."

From 9de822767454e68b4a79574bcb058eee78f32287 Mon Sep 17 00:00:00 2001
From: Neil Mayhew <neil@fpcomplete.com>
Date: Tue, 15 Oct 2019 12:06:29 -0600
Subject: [PATCH 396/679] Fix for false positive for some users on HOME-9306

Closes #773

Patch from @church1e
---
 include/tests_homedirs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/tests_homedirs b/include/tests_homedirs
index 9b8c9c64..4830b9a3 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -57,9 +57,9 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users' home directories permissions are 750 or more restrictive
         FOUND=0
-        for LINE in $(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }'); do
+        for LINE in $(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print $1 ":" $6}'); do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
-            DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
+            DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f2)
             if [ -d "${DIR}" ]; then
                 WRITE_GROUP_PERM=$(${LSBINARY} -ld ${DIR} | ${CUTBINARY} -f1 -d" " | ${CUTBINARY} -c6)
                 OTHER_PERMS=$(${LSBINARY} -ld ${DIR} | ${CUTBINARY} -f1 -d" " | ${CUTBINARY} -c8-10)
@@ -89,9 +89,9 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users own their home directories
         FOUND=0
-        for LINE in $(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }'); do
+        for LINE in $(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print $1 ":" $6}'); do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
-            DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
+            DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f2)
             if [ -d ${DIR} ]; then
                 OWNER=$(ls -ld ${DIR} | awk -F" " '{ print $3 }')
                 if [ ! "${OWNER}" = "${USER}" ]; then

From d9013b13acf25199690a4c65f9fa337e6b9c8f67 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A1nos=20M=C3=A1rkus?= <janos.markus@sophos.com>
Date: Wed, 16 Oct 2019 16:14:44 +0200
Subject: [PATCH 397/679] Fixes CISOfy/lynis#773

---
 include/tests_homedirs | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/include/tests_homedirs b/include/tests_homedirs
index 9b8c9c64..e1cdc9b0 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -57,7 +57,8 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users' home directories permissions are 750 or more restrictive
         FOUND=0
-        for LINE in $(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }'); do
+        USERDATA=$(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }')
+	while read -r LINE; do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
             DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
             if [ -d "${DIR}" ]; then
@@ -70,7 +71,9 @@
                     LogText "Result: permissions of home directory ${DIR} of user ${USER} are fine"
                 fi
             fi
-        done
+        done << EOF
+$USERDATA
+EOF
 
         if [ ${FOUND} -eq 1 ]; then
             Display --indent 2 --text "- Permissions of home directories" --result "${STATUS_WARNING}" --color RED
@@ -89,7 +92,8 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if users own their home directories
         FOUND=0
-        for LINE in $(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }'); do
+	USERDATA=$(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }')
+	while read -r LINE; do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
             DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
             if [ -d ${DIR} ]; then
@@ -101,7 +105,9 @@
                     LogText "Result: ownership of home directory ${DIR} for user ${USER} looks to be correct"
                 fi
             fi
-        done
+        done << EOF
+$USERDATA
+EOF
 
         if [ ${FOUND} -eq 1 ]; then
             Display --indent 2 --text "- Ownership of home directories" --result "${STATUS_WARNING}" --color RED

From 2b8f761efa685b5e36e1eb20efef6766dbfb84b9 Mon Sep 17 00:00:00 2001
From: fbomj <frank.bourdeau@ocsinventory-ng.org>
Date: Wed, 6 Nov 2019 21:49:54 +0100
Subject: [PATCH 398/679] MALW-3280: Kaspersky detection

---
 include/tests_malware | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/include/tests_malware b/include/tests_malware
index b260c488..e8d680c1 100644
--- a/include/tests_malware
+++ b/include/tests_malware
@@ -33,6 +33,7 @@
     CLAMSCAN_INSTALLED=0
     ESET_DAEMON_RUNNING=0
     FRESHCLAM_DAEMON_RUNNING=0
+    KASPERSKY_SCANNER_RUNNING=0
     MCAFEE_SCANNER_RUNNING=0
     MALWARE_SCANNER_INSTALLED=0
     SOPHOS_SCANNER_RUNNING=0
@@ -155,6 +156,22 @@
             Report "malware_scanner[]=cylance-protect"
         fi
 
+        # Kaspersky products
+        LogText "Test: checking process wdserver or klnagent (Kaspersky)"
+        # wdserver is too generic to match on, so we want to ensure that it is related to Kaspersky first
+        if [ -x /opt/kaspersky/kesl/libexec/kesl_launcher.sh ]; then
+            if IsRunning "wdserver"; then KASPERSKY_SCANNER_RUNNING=1; fi
+        else
+            if IsRunning "klnagent"; then KASPERSKY_SCANNER_RUNNING=1; fi
+        fi
+        if [ ${KASPERSKY_SCANNER_RUNNING} -eq 1 ]; then
+            FOUND=1
+            if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} Kaspersky" --result "${STATUS_FOUND}" --color GREEN; fi
+            LogText "Result: Found Kaspersky"
+            MALWARE_SCANNER_INSTALLED=1
+            Report "malware_scanner[]=kaspersky"
+        fi
+
         # McAfee products
         LogText "Test: checking process cma or cmdagent (McAfee)"
         # cma is too generic to match on, so we want to ensure that it is related to McAfee first

From cb52e9bfbe2bbfcacb7db9c26c4373d02366be9b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 18 Nov 2019 08:00:03 +0100
Subject: [PATCH 399/679] Also cleanup when Lynis process is terminated

---
 lynis | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lynis b/lynis
index dcc7de05..85cf5807 100755
--- a/lynis
+++ b/lynis
@@ -248,7 +248,7 @@
 #
 #################################################################################
 #
-    trap CleanUp INT
+    trap CleanUp INT TERM
 
     # Use safe umask for the files we create
     umask 027

From a07fcb3348b499eea4684a37d0aab0dbb0095e5f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 18 Nov 2019 10:19:43 +0100
Subject: [PATCH 400/679] Add USR1 trap to show status such as active test

---
 include/functions | 17 +++++++++++++++++
 lynis             |  1 +
 2 files changed, 18 insertions(+)

diff --git a/include/functions b/include/functions
index b96bb070..0c258907 100644
--- a/include/functions
+++ b/include/functions
@@ -98,6 +98,7 @@
 #    ShowComplianceFinding      Display a particular finding regarding compliance or a security standard
 #    ShowSymlinkPath            Show a path behind a symlink
 #    SkipAtomicTest             Test if a subtest needs to be skipped
+#    Status                     Show execution status, such as active test being performed
 #    StoreNginxSettings         Save parsed nginx settings to file
 #    TestValue                  Evaluate a value in a string or key
 #    ViewCategories             Show available category of tests
@@ -3383,6 +3384,22 @@
     }
 
 
+    ################################################################################
+    # Name        : Status()
+    # Description : Reports back the status of tool
+    #
+    # Returns     : text to screen
+    # Notes       : kill --signal USR1 <PID> or pkill --signal USR1 lynis
+    ################################################################################
+
+    Status() {
+        echo ""
+        echo "Date / time : $(date "+%Y-%m-%d %H:%M:%S")"
+        echo "Active test : ${TEST_NO:-NONE}"
+        echo ""
+    }
+
+
     ################################################################################
     # Name        : StoreNginxSettings()
     # Description : Store parsed settings from nginx (by ParseNginx)
diff --git a/lynis b/lynis
index 85cf5807..db50a3f3 100755
--- a/lynis
+++ b/lynis
@@ -249,6 +249,7 @@
 #################################################################################
 #
     trap CleanUp INT TERM
+    trap Status USR1
 
     # Use safe umask for the files we create
     umask 027

From f81ff3d7d6634ffa2f19dfde2250b88b252c5b9a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 18 Nov 2019 10:20:31 +0100
Subject: [PATCH 401/679] Removed empty lines

---
 include/tests_kernel | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index f5a896ba..8a1914cd 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -445,7 +445,6 @@
             # check likely main config file for systemd: ${ROOTDIR}etc/systemd/coredump.conf for ProcessSizeMax=0 and Storage=none
             SYSD_CORED_BASE_PROCSIZEMAX_NR_DISABLED=$(${GREPBINARY} -v "^ *#" ${ROOTDIR}etc/systemd/coredump.conf 2> /dev/null | ${SEDBINARY} 's/^ *//g' | ${GREPBINARY} -i "^ProcessSizeMax=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g' | ${GREPBINARY} "^0 *$" | ${WCBINARY} -l)
             SYSD_CORED_BASE_PROCSIZEMAX_NR_ENABLED=$(${GREPBINARY} -v "^ *#" ${ROOTDIR}etc/systemd/coredump.conf 2> /dev/null | ${SEDBINARY} 's/^ *//g' | ${GREPBINARY} -i "^ProcessSizeMax=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g' | ${GREPBINARY} -v "^0 *$" | ${WCBINARY} -l)
-            
             SYSD_CORED_BASE_STORAGE_FOUND=$(${GREPBINARY} -v "^ *#" ${ROOTDIR}etc/systemd/coredump.conf 2> /dev/null | ${SEDBINARY} 's/^ *//g' | ${GREPBINARY} -i "^Storage=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g')
             SYSD_CORED_BASE_STORAGE_NR_ENABLED=$(${ECHOCMD} "${SYSD_CORED_BASE_STORAGE_FOUND}" | ${SEDBINARY} 's/none//g' | ${WCBINARY} | ${AWKBINARY} '{print $2}')
             SYSD_CORED_BASE_STORAGE_NR_DISABLED=$(${ECHOCMD} "${SYSD_CORED_BASE_STORAGE_FOUND}" | ${GREPBINARY} -o "none" | ${WCBINARY} | ${AWKBINARY} '{print $2}')
@@ -454,11 +453,9 @@
             # while there could be multiple files overwriting each other, we are checking the number of occurrences
             SYSD_CORED_SUB_PROCSIZEMAX_NR_DISABLED=$(${FINDBINARY} /etc/systemd/coredump.conf.d/ /run/systemd/coredump.conf.d/ /usr/lib/systemd/coredump.conf.d/ -type f -iname "*.conf" -exec ${SEDBINARY} 's/^ *//g' {} \; 2> /dev/null | ${GREPBINARY} -i "^ProcessSizeMax=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g' | ${GREPBINARY} "^0 *$" | ${WCBINARY} -l)
             SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED=$(${FINDBINARY} /etc/systemd/coredump.conf.d/ /run/systemd/coredump.conf.d/ /usr/lib/systemd/coredump.conf.d/ -type f -iname "*.conf" -exec ${SEDBINARY} 's/^ *//g' {} \; 2> /dev/null | ${GREPBINARY} -i "^ProcessSizeMax=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g' | ${GREPBINARY} -v "^0 *$" | ${WCBINARY} -l)
-            
             SYSD_CORED_SUB_STORAGE_FOUND=$(${FINDBINARY} /etc/systemd/coredump.conf.d/ /run/systemd/coredump.conf.d/ /usr/lib/systemd/coredump.conf.d/ -type f -iname "*.conf" -exec ${SEDBINARY} 's/^ *//g' {} \; 2> /dev/null | ${GREPBINARY} -i "^Storage=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g')
             SYSD_CORED_SUB_STORAGE_NR_ENABLED=$(${ECHOCMD} "${SYSD_CORED_SUB_STORAGE_FOUND}" | ${SEDBINARY} 's/none//g' | ${WCBINARY} | ${AWKBINARY} '{print $2}')
             SYSD_CORED_SUB_STORAGE_NR_DISABLED=$(${ECHOCMD} "${SYSD_CORED_SUB_STORAGE_FOUND}" | ${GREPBINARY} -o "none" | ${WCBINARY} | ${AWKBINARY} '{print $2}')
-            
             if ( [ ${SYSD_CORED_BASE_PROCSIZEMAX_NR_DISABLED} -ge 1 ] && [ ${SYSD_CORED_BASE_STORAGE_NR_DISABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -eq 0 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_ENABLED} -eq 0 ] ) || \
                ( [ ${SYSD_CORED_BASE_PROCSIZEMAX_NR_DISABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_DISABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -eq 0 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_ENABLED} -eq 0 ] ) || \
                ( [ ${SYSD_CORED_BASE_STORAGE_NR_DISABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_DISABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -eq 0 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_ENABLED} -eq 0 ] ) || \
@@ -498,7 +495,6 @@
             # use tail -1 in the following commands to get the last entry, which is the one that counts (in case of profile.d/ probably counts)
             ULIMIT_C_VALUE="$(${GREPBINARY} "ulimit -c " ${ROOTDIR}etc/profile 2> /dev/null | ${SEDBINARY} 's/^ *//g' | ${GREPBINARY} -v "^#" | ${TAILBINARY} -1 | ${CUTBINARY} -d' ' -f3 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g')"
             ULIMIT_C_VALUE_SUB="$(${FINDBINARY} ${ROOTDIR}etc/profile.d -name "*.sh" -type f -exec ${CAT_BINARY} {} \; 2> /dev/null | ${GREPBINARY} "ulimit -c " | ${SEDBINARY} 's/^ *//g' | ${GREPBINARY} -v "^#" | ${TAILBINARY} -1 | ${CUTBINARY} -d' ' -f3 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g')"
-            
             if ( [ -n "${ULIMIT_C_VALUE_SUB}" ] && [ "${ULIMIT_C_VALUE_SUB}" = "0" ] ) || ( [ -n "${ULIMIT_C_VALUE}" ] && [ -z "${ULIMIT_C_VALUE_SUB}" ] && [ "${ULIMIT_C_VALUE}" = "0" ] ); then
                 LogText "Result: core dumps are disabled by 'ulimit -c 0' in ${ROOTDIR}etc/profile or ${ROOTDIR}etc/profile.d/*.sh"
                 Display --indent 4 --text "- configuration in etc/profile" --result "${STATUS_DISABLED}" --color GREEN

From 189b7a04baa7eaed38388d1f00c981c6815882a6 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 18 Nov 2019 10:21:21 +0100
Subject: [PATCH 402/679] Updated log

---
 CHANGELOG.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b80c0816..a6041cf0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -55,10 +55,12 @@ Using the relevant options, the scan will change base on the intended goal.
 - New test: PROC-3802 - check presence of prelink tooling
 - New report key: openssh_daemon_running
 - New command: lynis generate systemd-units
+- Sending USR1 signal to Lynis process will show active status
 - Measure timing of tests and report slow tests (10+ seconds)
 - Initial support for Clear Linux OS
 - Added end-of-life data for Arch Linux and Debian
 - Detection and end-of-life data added for Amazon Linux
+- Detection of linux-lts on Arch Linux
 
 ### Changed
 - Function: CheckItem() now returns only exit code (ITEM_FOUND is dropped)
@@ -87,6 +89,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - KRNL-5820 - extended check to include limits.d directory
 - LOGG-2154 - added support for rsyslog configurations
 - MAIL-8804 - replaced static strings with translation-aware strings
+- MALW-3280 - Kaspersky detection added
 - NAME-4402 - check if /etc/hosts exists before performing test
 - NAME-4404 - improved screen and log output
 - NAME-4408 - corrected Report function call
@@ -95,6 +98,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - PROC-3612 - show 'Not found' instead of 'OK'
 - PROC-3614 - show 'Not found' instead of 'OK'
 - SCHD-7702 - removed hardening points
+- SINT-7010 - limit test to only macOS systems
 - SSH-7402 - detect other SSH daemons like dropbear
 - SSH-7406 - strip OpenSSH patch version and remove characters (carriage return)
 - SSH-7408 - changed text in suggestion and report
@@ -108,6 +112,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - Use only locations from PATH environment variable, unless it is not defined
 - Show tip to use 'lynis generate hostids' when host IDs are missing
 - The 'show changelog' command works again for newer versions
+- Improved screen output in several tests
 - Several code cleanups, simplification of commands, and code standardization
 - Tests using lsof may ignore individual threads (if supported)
 - Do not show tool tips when quiet option is used

From 61b78c1cf3d9d5fa4f5bf968063e3931be336572 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 18 Nov 2019 11:03:38 +0100
Subject: [PATCH 403/679] Only show message about 4+ months old if there is
 actually an update available.

---
 lynis | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/lynis b/lynis
index db50a3f3..081833bb 100755
--- a/lynis
+++ b/lynis
@@ -43,8 +43,8 @@
     PROGRAM_WEBSITE="https://cisofy.com/lynis/"
 
     # Version details
-    PROGRAM_RELEASE_DATE="2019-07-14"
-    PROGRAM_RELEASE_TIMESTAMP=1563094548
+    PROGRAM_RELEASE_DATE="2019-11-18"
+    PROGRAM_RELEASE_TIMESTAMP=1574071362
     PROGRAM_RELEASE_TYPE="pre-release" # pre-release or release
     PROGRAM_VERSION="3.0.0"
 
@@ -771,7 +771,6 @@ ${NORMAL}
         if [ ${UPDATE_AVAILABLE} -eq 0 ]; then
             ReportSuggestion "LYNIS" "This release is more than 4 months old. Consider upgrading"
         fi
-        UPDATE_AVAILABLE=1
         OLD_RELEASE=1
     fi
 

From 51b7a207c5a1213bf019811e23847c1e40c8198b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 4 Dec 2019 08:01:22 +0100
Subject: [PATCH 404/679] Corrected text for groups and prefer --use-cwd
 instead of --usecwd

---
 lynis.8 | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lynis.8 b/lynis.8
index 2f424209..719e82c7 100644
--- a/lynis.8
+++ b/lynis.8
@@ -1,4 +1,4 @@
-.TH Lynis 8 "21 Aug 2019" "1.30" "Unix System Administrator's Manual"
+.TH Lynis 8 "4 Dec 2019" "1.31" "Unix System Administrator's Manual"
 
 
 .SH "NAME"
@@ -126,9 +126,9 @@ Tests are only performed if they belong to the defined category. Use the command
 .TP
 .B \-\-tests\-from\-group "<group>"
 Similar to \-\-tests\-from\-category. Only perform tests from a particular group.
-Use 'show categories' to determine valid options.
+Use 'show groups' to determine valid options.
 .TP
-.B \-\-usecwd
+.B \-\-use-cwd
 Run from the current working directory.
 .TP
 .B \-\-upload

From 15ae5ea0c1c48fdd2d1c7601c3471ce0910861c8 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 4 Dec 2019 08:01:56 +0100
Subject: [PATCH 405/679] Added alias --use-cwd as that is more in line with
 other options (instead of --usecwd)

---
 include/parameters | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/parameters b/include/parameters
index 048b992d..b8676b4c 100644
--- a/include/parameters
+++ b/include/parameters
@@ -387,7 +387,7 @@
                 UPLOAD_DATA=1
             ;;
 
-            --usecwd)
+            --usecwd | --use-cwd)
                 USE_CWD=1
             ;;
 

From 6421c2e419c6ab164c657529419561289758ed70 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 6 Dec 2019 09:49:06 +0100
Subject: [PATCH 406/679] [BANN-7126] additional words for login banner are
 accepted

---
 include/tests_banners | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_banners b/include/tests_banners
index dde7a67e..f9f26104 100644
--- a/include/tests_banners
+++ b/include/tests_banners
@@ -27,7 +27,7 @@
 #################################################################################
 #
     BANNER_FILES="${ROOTDIR}etc/issue ${ROOTDIR}etc/issue.net ${ROOTDIR}etc/motd"
-    LEGAL_BANNER_STRINGS="audit access authori connect enforce evidence forbidden intrusion law legal monitor owner policy policies privacy private prohibited record restricted secure subject system terms unauthorized"
+    LEGAL_BANNER_STRINGS="audit access authori condition connect consent continu criminal enforce evidence forbidden intrusion law legal legislat log monitor owner penal policy policies privacy private prohibited record restricted secure subject system terms warning"
 #
 #################################################################################
 #

From f93be8a44d8b46e19bb96d7001d30ef1aa4ca7d1 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 6 Dec 2019 09:49:14 +0100
Subject: [PATCH 407/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a6041cf0..52b4788d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -72,6 +72,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - AUTH-9266 - skip .pam-old files in /etc/pam.d
 - AUTH-9282 - fix: temporary variable was overwritten
 - AUTH-9408 - added support for pam_tally2 to log failed logins
+- BANN-7126 - additional words for login banner are accepted
 - CONT-8106 - support newer 'docker info' output
 - CRYP-8002 - gather kernel entropy on Linux systems
 - FILE-6374 - changed log and allow root location to be changed

From b2c73547dddebf2620a9fffd972fff6bd072977d Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 6 Dec 2019 15:55:29 +0100
Subject: [PATCH 408/679] Initialize variables and filter out pam-old files

---
 plugins/plugin_pam_phase1 | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/plugins/plugin_pam_phase1 b/plugins/plugin_pam_phase1
index f4866db7..361918de 100644
--- a/plugins/plugin_pam_phase1
+++ b/plugins/plugin_pam_phase1
@@ -6,19 +6,26 @@
 #-----------------------------------------------------
 # PLUGIN_AUTHOR=Michael Boelen <michael.boelen@cisofy.com>
 # PLUGIN_CATEGORY=authentication
-# PLUGIN_DATE=2017-04-30
+# PLUGIN_DATE=2019-07-26
 # PLUGIN_DESC=PAM
 # PLUGIN_NAME=pam
 # PLUGIN_PACKAGE=all
 # PLUGIN_REQUIRED_TESTS=
-# PLUGIN_VERSION=1.0.2
+# PLUGIN_VERSION=1.0.4
 #-----------------------------------------------------
 #########################################################################
 #
     # Variables
+    CREDITS_D_PASSWORD=""
+    CREDITS_L_PASSWORD=""
+    CREDITS_O_PASSWORD=""
+    CREDITS_U_PASSWORD=""
     MAX_PASSWORD_RETRY=""
+    MIN_PASSWORD_CLASS=""
     PAM_DIRECTORY="${ROOTDIR}etc/pam.d"
-
+#
+#########################################################################
+#
     # Test        : PLGN-0008
     # Description : Check PAM configuration
     FILE="${ROOTDIR}etc/security/pwquality.conf"
@@ -57,8 +64,9 @@
             done
         done
     fi
-
-
+#
+#########################################################################
+#
     # Test        : PLGN-0010
     # Description : Check PAM configuration
     if [ -f ${ROOTDIR}etc/pam.conf -o -d ${PAM_DIRECTORY} ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
@@ -69,12 +77,12 @@
         if [ -d ${PAM_DIRECTORY} ]; then
             LogText "Result: ${PAM_DIRECTORY} exists"
             if [ ! "${OS}" = "FreeBSD" -a ! "${OS}" = "NetBSD" ]; then
-                FIND_FILES=$(find ${PAM_DIRECTORY} -type f -print)
+                FIND_FILES=$(find ${PAM_DIRECTORY} -not -name "*.pam-old" -type f -print)
             else
                 if [ -f ${PAM_DIRECTORY}/README ]; then
                     LogText "Skipped checking ${OS} ${PAM_DIRECTORY}/README as a PAM file"
                 fi
-                FIND_FILES=$(find ${PAM_DIRECTORY} -type f -print | grep -v "README")
+                FIND_FILES=$(find ${PAM_DIRECTORY} -not -name "README" -not -name "*.pam-old" -type f -print)
             fi
 
             for PAM_FILE in ${FIND_FILES}; do

From f00447fd1b5f340e78f5fd27d861089f6c48c8a7 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 6 Dec 2019 15:55:59 +0100
Subject: [PATCH 409/679] Style change, add curly brackets

---
 include/binaries | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/binaries b/include/binaries
index 8f30a010..f567ed1f 100644
--- a/include/binaries
+++ b/include/binaries
@@ -76,7 +76,7 @@
 
         # Now perform binary detection
         for SCANDIR in ${BIN_PATHS}; do
-            SCANDIR=$(echo "$SCANDIR" | sed 's/!!space!!/ /g')
+            SCANDIR=$(echo "${SCANDIR}" | sed 's/!!space!!/ /g')
             LogText "Test: Checking binaries in directory ${SCANDIR}"
             ORGPATH=""
             if [ -d "${SCANDIR}" ]; then

From fd84be485b39f49b411c4e9744864119be954d82 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 13 Dec 2019 12:34:56 +0100
Subject: [PATCH 410/679] Improved permission check for BSD systems

---
 include/functions | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/include/functions b/include/functions
index 25a74552..9ed5fee7 100644
--- a/include/functions
+++ b/include/functions
@@ -1288,17 +1288,25 @@
                 # First try stat command
                 LogText "Test: checking if file ${CHECKFILE} is ${CHECK_PERMISSION}"
                 if [ -n "${STATBINARY}" ]; then
-                    # busybox does not support format
-                    if [ ${SHELL_IS_BUSYBOX} -eq 0 ]; then
-                        DATA=$(${STATBINARY} --format=%a ${CHECKFILE})
-                    fi
+
+                    case ${OS} in
+                        "*BSD")
+                            DATA=$(${STATBINARY} -f "%OLp" ${CHECKFILE})
+                        ;;
+                        *)
+                            # busybox does not support format
+                            if [ ${SHELL_IS_BUSYBOX} -eq 0 ]; then
+                                DATA=$(${STATBINARY} --format=%a ${CHECKFILE})
+                            fi
+                        ;;
+                    esac
                 fi
 
                 # See if we can use the find binary
                 if [ -z "${DATA}" ]; then
                     case ${OS} in
-                        "AIX")
-                            Debug "Skipping find command, as AIX does not support -printf"
+                        "AIX" | "*BSD")
+                            Debug "Skipping find command, as this operating system does not support -printf parameter"
                         ;;
                         *)
                             # Only use find when OS is NOT AIX and binaries are NOT busybox

From bf4374bb1956c0aa93c9e7b92a786e188dd31968 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 13 Dec 2019 12:35:38 +0100
Subject: [PATCH 411/679] [KRNL-5830] skip test partially if non-privileged

---
 include/tests_kernel | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index c3caf24b..9357e298 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -612,8 +612,9 @@
         else
             LogText "Result: file ${FILE} not found"
         fi
+
         # Check if /boot exists
-        if [ -d ${ROOTDIR}boot ]; then
+        if [ ${PRIVILEGED} -eq 1 -a -d "${ROOTDIR}boot" ]; then
             LogText "Result: /boot exists, performing more tests from here"
             FIND=$(${LSBINARY} ${ROOTDIR}boot/* 2> /dev/null)
             if [ -n "${FIND}" ]; then
@@ -647,7 +648,7 @@
                     else
                         FOUND_VMLINUZ=$(ls -t ${ROOTDIR}boot/vmlinuz-* 2> /dev/null | head -1)
                     fi
-                    LogText "Result: /found ${FOUND_VMLINUZ} (usually Arch Linux or similar)"
+                    LogText "Result: found ${FOUND_VMLINUZ}"
                     LogText "Test: checking kernel version on disk"
                     NEXTLINE=0
                     VERSION_ON_DISK=""
@@ -737,7 +738,7 @@
                 LogText "Result: Skipping this test, as there are no files in /boot"
             fi
         else
-            LogText "Result: /boot does not exist"
+            LogText "Result: /boot does not exist or not privileged to read files"
         fi
 
         # Display discovered status

From 1b4b02d8132cdda28d9d93c4509b69a996f65431 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 13 Dec 2019 12:36:19 +0100
Subject: [PATCH 412/679] Decrease length of line breaks between tests

---
 include/functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/functions b/include/functions
index 9ed5fee7..2094e989 100644
--- a/include/functions
+++ b/include/functions
@@ -2004,7 +2004,7 @@
     LogTextBreak() {
         if [ ! "${LOGFILE}" = "" -a ${LOGTEXT} -eq 1 ]; then
             CDATE=$(date "+%Y-%m-%d %H:%M:%S")
-            echo "${CDATE} ===---------------------------------------------------------------===" >> ${LOGFILE}
+            echo "${CDATE} ====" >> ${LOGFILE}
         fi
     }
 

From 700e0823de3b470230393a09be11443a224ceba5 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 13 Dec 2019 12:36:50 +0100
Subject: [PATCH 413/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 52b4788d..342d6d76 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -88,6 +88,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - INSE-8320 - test for TFTP server tools
 - INSE-8342 - renamed to INSE-8304
 - KRNL-5820 - extended check to include limits.d directory
+- KRNL-5830 - skip test partially when running non-privileged
 - LOGG-2154 - added support for rsyslog configurations
 - MAIL-8804 - replaced static strings with translation-aware strings
 - MALW-3280 - Kaspersky detection added

From f35a08ad28568f7e80d3a7f9ceeaa8203fec82fb Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 13 Dec 2019 12:40:29 +0100
Subject: [PATCH 414/679] Quoting should not be used when globbing

---
 include/functions | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/functions b/include/functions
index 2094e989..de40a427 100644
--- a/include/functions
+++ b/include/functions
@@ -1290,7 +1290,7 @@
                 if [ -n "${STATBINARY}" ]; then
 
                     case ${OS} in
-                        "*BSD")
+                        *BSD)
                             DATA=$(${STATBINARY} -f "%OLp" ${CHECKFILE})
                         ;;
                         *)
@@ -1305,7 +1305,7 @@
                 # See if we can use the find binary
                 if [ -z "${DATA}" ]; then
                     case ${OS} in
-                        "AIX" | "*BSD")
+                        "AIX" | *BSD)
                             Debug "Skipping find command, as this operating system does not support -printf parameter"
                         ;;
                         *)

From d680fe549fe6e643f666f28f4d86e424ae08ab9e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 13 Dec 2019 12:59:43 +0100
Subject: [PATCH 415/679] Switched from warnings to suggestions, corrected path
 selection for DIR variable

---
 include/tests_homedirs | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/include/tests_homedirs b/include/tests_homedirs
index 12251ae4..e8226bed 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -60,7 +60,8 @@
         USERDATA=$(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }')
         while read -r LINE; do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
-            DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f2)
+            DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
+            LogText "Test: checking directory '${DIR}' for user '${USER}'"
             if [ -d "${DIR}" ]; then
                 WRITE_GROUP_PERM=$(${LSBINARY} -ld ${DIR} | ${CUTBINARY} -f1 -d" " | ${CUTBINARY} -c6)
                 OTHER_PERMS=$(${LSBINARY} -ld ${DIR} | ${CUTBINARY} -f1 -d" " | ${CUTBINARY} -c8-10)
@@ -77,10 +78,10 @@ EOF
 
         if [ ${FOUND} -eq 1 ]; then
             Display --indent 2 --text "- Permissions of home directories" --result "${STATUS_WARNING}" --color RED
-            ReportWarning ${TEST_NO} "Permissions of some users' home directories are not strict enough. Should be 750 or more restrictive."
+            ReportSuggestion "${TEST_NO}" "Double check the permissions of home directories as some might be not strict enough."
         else
             Display --indent 2 --text "- Permissions of home directories" --result "${STATUS_OK}" --color GREEN
-            LogText "Result: Ok, All users' home directories permissions are 750 or more restrictive"
+            LogText "Result: OK, all permissions of the home directories are 750 or more restrictive"
         fi
     fi
 #
@@ -95,11 +96,12 @@ EOF
         USERDATA=$(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }')
         while read -r LINE; do
             USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1)
-            DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f2)
-            if [ -d ${DIR} ]; then
+            DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6)
+            LogText "Test: checking directory '${DIR}' for user '${USER}'"
+            if [ -d "${DIR}" ]; then
                 OWNER=$(ls -ld ${DIR} | awk -F" " '{ print $3 }')
                 if [ ! "${OWNER}" = "${USER}" ]; then
-                    LogText "Result: The home directory ${DIR} of user ${USER} is owned by ${OWNER}. Change with: chown ${USER} ${DIR}" 
+                    LogText "Result: the home directory ${DIR} of user ${USER} is owned by ${OWNER}. Correct: chown ${USER} ${DIR}" 
                     FOUND=1
                 else
                     LogText "Result: ownership of home directory ${DIR} for user ${USER} looks to be correct"
@@ -111,10 +113,10 @@ EOF
 
         if [ ${FOUND} -eq 1 ]; then
             Display --indent 2 --text "- Ownership of home directories" --result "${STATUS_WARNING}" --color RED
-            ReportWarning ${TEST_NO} "Owner of some users' home directories are not correctly set"
+            ReportSuggestion "${TEST_NO}" "Double check the ownership of home directories as some might be incorrect."
         else
             Display --indent 2 --text "- Ownership of home directories" --result "${STATUS_OK}" --color GREEN
-            LogText "Result: Ok, All users own their home directories"
+            LogText "Result: OK, all users own their home directories"
         fi
     fi
 #
@@ -141,10 +143,10 @@ EOF
                 LogText "Info: above files could be redirected files to avoid logging and should be investigated"
                 ReportWarning ${TEST_NO} "Incorrect file type found for shell history file"
             fi
-            LogText "Remarks: History files are normally of the type 'file'. Symbolic links and other types are suspicious."
+            LogText "Remark: History files are normally of the type 'file'. Symbolic links and other types are suspicious."
         else
             Display --indent 2 --text "- Checking shell history files" --result "${STATUS_SKIPPED}" --color WHITE
-            LogText "Result: Homedirs is empty, test will be skipped"
+            LogText "Result: Homedirs is empty, therefore test will be skipped"
         fi
     fi
 #

From 4e255617d37c54ef1d55fcdbde5baa85f380bcb0 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 16 Dec 2019 09:47:40 +0100
Subject: [PATCH 416/679] [KRNL-5830] Fetch target for symlinked kernel

---
 include/tests_kernel | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index 9357e298..b3417676 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -640,13 +640,14 @@
                     else
                         ReportException "${TEST_NO}:1" "Can't determine kernel version on disk, need debug data"
                     fi
-                elif [ -f ${ROOTDIR}boot/vmlinuz-linux -o -f ${ROOTDIR}boot/vmlinuz-linux-lts -o -f $(ls -t ${ROOTDIR}boot/vmlinuz-* 2> /dev/null | head -1) ]; then
-                    if [ -f ${ROOTDIR}boot/vmlinuz-linux ]; then
-                        FOUND_VMLINUZ=${ROOTDIR}boot/vmlinuz-linux
+                elif [ -f ${ROOTDIR}boot/vmlinuz-linux -o -f ${ROOTDIR}boot/vmlinuz-linux-lts -o -f $(ls -t ${ROOTDIR}boot/vm[l-]* 2> /dev/null | head -1) ]; then
+                    if [ -L ${ROOTDIR}boot/vmlinuz-linux ]; then
+                        FOUND_VMLINUZ=$(readlink ${ROOTDIR}boot/vmlinuz-linux)
                     elif [ -f ${ROOTDIR}boot/vmlinuz-linux-lts ]; then
                         FOUND_VMLINUZ=${ROOTDIR}boot/vmlinuz-linux-lts
                     else
-                        FOUND_VMLINUZ=$(ls -t ${ROOTDIR}boot/vmlinuz-* 2> /dev/null | head -1)
+                        # Match on /boot/vm5.3.7 or /boot/vmlinuz-5.3.7-1-default
+                        FOUND_VMLINUZ=$(ls -t ${ROOTDIR}boot/vm[l-]* 2> /dev/null | head -1)
                     fi
                     LogText "Result: found ${FOUND_VMLINUZ}"
                     LogText "Test: checking kernel version on disk"

From 11f8ce236165bd650515f3141f3dea1ed1fb8baa Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 17 Dec 2019 08:03:51 +0100
Subject: [PATCH 417/679] [KRNL-5830] Use symlink, only test for 'version'
 keyword if needed, adjusted exception message

---
 include/tests_kernel | 39 +++++++++++++++++++++++----------------
 1 file changed, 23 insertions(+), 16 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index b3417676..1a78bfcc 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -642,27 +642,33 @@
                     fi
                 elif [ -f ${ROOTDIR}boot/vmlinuz-linux -o -f ${ROOTDIR}boot/vmlinuz-linux-lts -o -f $(ls -t ${ROOTDIR}boot/vm[l-]* 2> /dev/null | head -1) ]; then
                     if [ -L ${ROOTDIR}boot/vmlinuz-linux ]; then
+                        LogText "Result: found symlink ${ROOTDIR}boot/vmlinuz-linux"
                         FOUND_VMLINUZ=$(readlink ${ROOTDIR}boot/vmlinuz-linux)
+                        LogText "Result: symlinked target is ${FOUND_VMLINUZ}"
+                        VERSION_ON_DISK=$(echo ${FOUND_VMLINUZ} | sed 's/^vmlinuz-//')
                     elif [ -f ${ROOTDIR}boot/vmlinuz-linux-lts ]; then
+                        LogText "Result: found boot/vmlinuz-linux-lts"
                         FOUND_VMLINUZ=${ROOTDIR}boot/vmlinuz-linux-lts
                     else
                         # Match on /boot/vm5.3.7 or /boot/vmlinuz-5.3.7-1-default
                         FOUND_VMLINUZ=$(ls -t ${ROOTDIR}boot/vm[l-]* 2> /dev/null | head -1)
                     fi
-                    LogText "Result: found ${FOUND_VMLINUZ}"
-                    LogText "Test: checking kernel version on disk"
-                    NEXTLINE=0
-                    VERSION_ON_DISK=""
-                    for I in $(file ${FOUND_VMLINUZ}); do
-                        if [ ${NEXTLINE} -eq 1 ]; then
-                            VERSION_ON_DISK="${I}"
-                            break
-                        else
-                            # Searching for the Linux kernel after the keyword 'version'
-                            if [ "${I}" = "version" ]; then NEXTLINE=1; fi
-                        fi
-                    done
-                    if [ -n "${VERSION_ON_DISK}" ]; then
+
+                    if [ -z "${VERSION_ON_DISK}" ]; then
+                        LogText "Result: found ${FOUND_VMLINUZ}"
+                        LogText "Test: checking kernel version on disk"
+                        NEXTLINE=0
+                        VERSION_ON_DISK=""
+                        for I in $(file ${FOUND_VMLINUZ}); do
+                            if [ ${NEXTLINE} -eq 1 ]; then
+                                VERSION_ON_DISK="${I}"
+                                break
+                            else
+                                # Searching for the Linux kernel after the keyword 'version'
+                                if [ "${I}" = "version" -o  ]; then NEXTLINE=1; fi
+                            fi
+                        done
+                    else
                         LogText "Result: found version ${VERSION_ON_DISK}"
                         ACTIVE_KERNEL=$(uname -r)
                         LogText "Result: active kernel version ${ACTIVE_KERNEL}"
@@ -673,9 +679,10 @@
                             REBOOT_NEEDED=1
                             LogText "Result: reboot needed, as there is a difference between active kernel and the one on disk"
                         fi
-                    else
+                    fi
+                    if [ -z "${VERSION_ON_DISK}" ]; then
                         LogText "Result: could not find the version on disk"
-                        ReportException "${TEST_NO}:4" "Could not find the kernel version from /boot/vmlinux-linux"
+                        ReportException "${TEST_NO}:4" "Could not find the kernel version"
                     fi
                 else
                     if [ -L ${ROOTDIR}boot/vmlinuz ]; then

From 2dfb901bcb24261a201423f0cfc47a86bd54781c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 17 Dec 2019 08:23:12 +0100
Subject: [PATCH 418/679] [PKGS-7410] Use multiple package managers when they
 are available on system. Also added support for Zypper for this test

---
 include/tests_ports_packages | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 94116e6e..12329cc8 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -1245,25 +1245,27 @@
     Register --test-no PKGS-7410 --weight L --network NO --category security --description "Count installed kernel packages"
     if [ ${SKIPTEST} -eq 0 ]; then
         KERNELS=0
+        TESTED=0
         LogText "Test: Checking how many kernel packages are installed"
 
-        if [ -n "${DPKGBINARY}" ]; then
+        if [ "${DPKGBINARY}" ]; then
+            TESTED=1
             KERNEL_PKG_NAMES="linux-image-[0-9]|raspberrypi-kernel|pve-kernel-[0-9]"
             KERNELS=$(${DPKGBINARY} -l 2> /dev/null | ${EGREPBINARY} "${KERNEL_PKG_NAMES}" | ${WCBINARY} -l)
             if [ ${KERNELS} -eq 0 ]; then
                 LogText "Result: found no kernels from dpkg -l output, which is unexpected"
-                ReportException "KRNL-5840:2" "Could not find any kernel packages from DPKG output"
             elif [ ${KERNELS} -gt 5 ]; then
                 LogText "Result: found more than 5 kernel packages on the system, which might indicate lack of regular cleanups"
                 ReportSuggestion "${TEST_NO}" "Remove any unneeded kernel packages" "${KERNELS} kernels" "text:validate dpkg -l output and perform cleanup with apt autoremove"
             else
                 LogText "Result: found ${KERNELS} kernel packages on the system, which is fine"
             fi
-        elif [ -n "${RPMBINARY}" ]; then
+        fi
+        if [ "${RPMBINARY}" ]; then
+            TESTED=1
             KERNELS=$(${RPMBINARY} -q kernel 2> /dev/null | ${WCBINARY} -l)
             if [ ${KERNELS} -eq 0 ]; then
                 LogText "Result: found no kernels from rpm -q kernel output, which is unexpected"
-                ReportException "KRNL-5840:1" "Could not find any kernel packages from RPM output"
             elif [ ${KERNELS} -gt 5 ]; then
                 LogText "Result: found more than 5 kernel packages on the system, which might indicate lack of regular cleanups"
                 ReportSuggestion "${TEST_NO}" "Remove any unneeded kernel packages with package-cleanup utility (--old-kernels)"
@@ -1272,6 +1274,24 @@
             fi
         fi
 
+        if [ "${ZYPPERBINARY}" ]; then
+            TESTED=1
+            KERNELS=$(${ZYPPERBINARY} --non-interactive -n se --type package --match-exact --installed-only "kernel-default" 2> /dev/null | ${GREPBINARY} "kernel-default" | ${WCBINARY} -l)
+            if [ ${KERNELS} -eq 0 ]; then
+                LogText "Result: found no kernels from zypper output, which is unexpected."
+                ReportException "KRNL-5840:3" "Could not find any kernel packages via package manager. Maybe using a different kernel package?"
+            elif [ ${KERNELS} -gt 3 ]; then
+                LogText "Result: found more than 5 kernel packages on the system, which might indicate lack of regular cleanups"
+                ReportSuggestion "${TEST_NO}" "Remove any unneeded kernel packages"
+            else
+                LogText "Result: found ${KERNELS} kernel packages on the system, which is fine"
+            fi
+        fi
+
+        if [ ${KERNELS} -eq 0 -a ${TESTED} -eq 1 ]; then
+            ReportException "KRNL-5840:1" "Could not find any kernel packages via package manager"
+        fi
+
         Report "installed_kernel_packages=${KERNELS}"
     fi
 #

From 7f4274bee5a0894071fba028d57cae963781c28d Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 17 Dec 2019 08:24:04 +0100
Subject: [PATCH 419/679] Added log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 342d6d76..6da88646 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -96,6 +96,8 @@ Using the relevant options, the scan will change base on the intended goal.
 - NAME-4404 - improved screen and log output
 - NAME-4408 - corrected Report function call
 - NETW-3032 - small rewrite of test and extended with addrwatch
+- PKGS-7410 - use multiple package managers when available
+- PKGS-7410 - added support for Zypper to test number of kernels
 - PROC-3602 - allow different root directory
 - PROC-3612 - show 'Not found' instead of 'OK'
 - PROC-3614 - show 'Not found' instead of 'OK'

From c4b24c48a97acd98bb94fccbd4691a777553c350 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 18 Dec 2019 12:01:32 +0100
Subject: [PATCH 420/679] [INSE-8314] changed text of suggestion

---
 include/tests_insecure_services | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index 3c2cd402..5b7d96a5 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -411,7 +411,7 @@
         if [ -n "${FOUND}" ]; then
             LogText "Result: NIS client is installed"
             Display --indent 2 --text "- Checking NIS client installation" --result "${STATUS_SUGGESTION}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "NIS client should be removed as it contains numerous security exposures and have been replaced with the more secure SSH package"
+            ReportSuggestion ${TEST_NO} "NIS client should be removed if not required. Use a more secure alternative or a protocol that can use encrypted communications."
         else
             LogText "Result: NIS client is NOT installed"
             Display --indent 2 --text "- Checking NIS client installation" --result "${STATUS_OK}" --color GREEN

From 94ba30e765d02ce638e01d731882f8b7086506e2 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 18 Dec 2019 12:04:32 +0100
Subject: [PATCH 421/679] [INSE-8050] corrected function call for showing
 suggestion

---
 include/tests_insecure_services | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index 5b7d96a5..40cd9cf0 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -500,7 +500,7 @@
             if ${LAUNCHCTL_BINARY} list | ${GREPBINARY} -sq ${ITEM}; then
                 Display --indent 2 --text "- ${ITEM}" --result "${STATUS_NO}" --color RED
                 LogText "Result: found ${ITEM}, which is considered an insecure service"
-                AddSuggestion "${TEST_NO}" "Consider disabling service ${ITEM}" "launchctl" "-"
+                ReportSuggestion "${TEST_NO}" "Consider disabling service ${ITEM}" "launchctl" "-"
                 AddHP 0 1
             else
                 Display --indent 2 --text "- ${ITEM}" --result "${STATUS_OK}" --color GREEN

From 09f29a5e64d4eb0fbbec2a0a503fa173a973b898 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 18 Dec 2019 12:17:46 +0100
Subject: [PATCH 422/679] Code style improvement: quote argument

---
 include/tests_accounting        | 24 +++++++-------
 include/tests_authentication    | 58 ++++++++++++++++-----------------
 include/tests_banners           |  4 +--
 include/tests_boot_services     | 24 +++++++-------
 include/tests_crypto            |  2 +-
 include/tests_custom.template   |  2 +-
 include/tests_databases         |  4 +--
 include/tests_file_integrity    |  4 +--
 include/tests_filesystems       | 18 +++++-----
 include/tests_firewalls         | 12 +++----
 include/tests_hardening         |  4 +--
 include/tests_homedirs          |  2 +-
 include/tests_insecure_services | 28 ++++++++--------
 include/tests_kernel            | 16 ++++-----
 include/tests_kernel_hardening  |  2 +-
 include/tests_logging           | 18 +++++-----
 include/tests_mac_frameworks    |  4 +--
 include/tests_mail_messaging    |  6 ++--
 include/tests_malware           |  2 +-
 include/tests_memory_processes  |  4 +--
 include/tests_nameservices      | 18 +++++-----
 include/tests_networking        | 12 +++----
 include/tests_php               | 20 ++++++------
 include/tests_ports_packages    | 58 ++++++++++++++++-----------------
 include/tests_printers_spools   | 12 +++----
 include/tests_shells            |  2 +-
 include/tests_snmp              |  2 +-
 include/tests_squid             | 14 ++++----
 include/tests_ssh               |  4 +--
 include/tests_storage_nfs       |  4 +--
 include/tests_time              | 22 ++++++-------
 include/tests_tooling           |  4 +--
 include/tests_usb               | 30 ++++++++---------
 include/tests_webservers        | 14 ++++----
 plugins/custom_plugin.template  |  2 +-
 35 files changed, 228 insertions(+), 228 deletions(-)

diff --git a/include/tests_accounting b/include/tests_accounting
index 93cd2162..4d05f4d6 100644
--- a/include/tests_accounting
+++ b/include/tests_accounting
@@ -42,7 +42,7 @@
             Display --indent 2 --text "- Checking accounting information" --result "${STATUS_NOT_FOUND}" --color YELLOW
             LogText "Result: No accounting information available"
             LogText "Remark: Possibly there is another location where the accounting data is stored"
-            ReportSuggestion ${TEST_NO} "Enable process accounting"
+            ReportSuggestion "${TEST_NO}" "Enable process accounting"
             AddHP 2 3
         fi
     fi
@@ -61,7 +61,7 @@
             Display --indent 2 --text "- Checking accounting information" --result "${STATUS_NOT_FOUND}" --color YELLOW
             LogText "Result: No accounting information available"
             LogText "Remark: Possibly there is another location where the accounting data is stored"
-            ReportSuggestion ${TEST_NO} "Enable process accounting"
+            ReportSuggestion "${TEST_NO}" "Enable process accounting"
             AddHP 2 3
         fi
     fi
@@ -90,7 +90,7 @@
             Display --indent 2 --text "- Checking accounting information" --result "${STATUS_NOT_FOUND}" --color YELLOW
             LogText "Result: No accounting information available (${ROOTDIR}var/account/pacct, ${ROOTDIR}var/log/account/pact nor ${ROOTDIR}var/log/pact exist)"
             LogText "Remark: Possibly there is another location where the accounting data is stored"
-            ReportSuggestion ${TEST_NO} "Enable process accounting"
+            ReportSuggestion "${TEST_NO}" "Enable process accounting"
             AddHP 2 3
         fi
     fi
@@ -111,7 +111,7 @@
             else
                 LogText "Result: sysstat disabled via ${ROOTDIR}etc/default/sysstat"
                 Display --indent 2 --text "- Checking sysstat accounting data" --result "${STATUS_DISABLED}" --color WHITE
-                ReportSuggestion ${TEST_NO} "Enable sysstat to collect accounting (disabled)"
+                ReportSuggestion "${TEST_NO}" "Enable sysstat to collect accounting (disabled)"
             fi
         elif [ -f ${ROOTDIR}etc/cron.d/sysstat ]; then
             FIND=$(${GREPBINARY} -v '^[[:space:]]*\(#\|$\)' ${ROOTDIR}etc/cron.d/sysstat)
@@ -121,12 +121,12 @@
             else
                 LogText "Result: sysstat disabled via ${ROOTDIR}etc/cron.d/sysstat"
                 Display --indent 2 --text "- Checking sysstat accounting data" --result "${STATUS_DISABLED}" --color WHITE
-                ReportSuggestion ${TEST_NO} "Enable sysstat to collect accounting (cron disabled)"
+                ReportSuggestion "${TEST_NO}" "Enable sysstat to collect accounting (cron disabled)"
             fi
         else
             LogText "Result: sysstat not found via ${ROOTDIR}etc/default/sysstat or ${ROOTDIR}etc/cron.d/sysstat"
             Display --indent 2 --text "- Checking sysstat accounting data" --result "${STATUS_NOT_FOUND}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Enable sysstat to collect accounting (no results)"
+            ReportSuggestion "${TEST_NO}" "Enable sysstat to collect accounting (no results)"
         fi
     fi
 #
@@ -151,7 +151,7 @@
             LogText "Result: auditd not active"
             Display --indent 2 --text "- Checking auditd" --result "${STATUS_NOT_FOUND}" --color WHITE
             if [ ! "${VMTYPE}" = "openvz" ]; then
-                ReportSuggestion ${TEST_NO} "Enable auditd to collect audit information"
+                ReportSuggestion "${TEST_NO}" "Enable auditd to collect audit information"
             fi
             AddHP 0 1
             Report "linux_auditd_running=0"
@@ -171,7 +171,7 @@
             LogText "Result: auditd rules empty"
             Display --indent 4 --text "- Checking audit rules" --result "${STATUS_SUGGESTION}" --color YELLOW
             AddHP 0 2
-            ReportSuggestion ${TEST_NO} "Audit daemon is enabled with an empty ruleset. Disable the daemon or define rules"
+            ReportSuggestion "${TEST_NO}" "Audit daemon is enabled with an empty ruleset. Disable the daemon or define rules"
         else
             LogText "Result: found auditd rules"
             Display --indent 4 --text "- Checking audit rules" --result "${STATUS_OK}" --color GREEN
@@ -206,7 +206,7 @@
         else
             LogText "Result: could not find auditd configuration file"
             Display --indent 4 --text "- Checking audit configuration file" --result "${STATUS_FOUND}" --color RED
-            ReportSuggestion ${TEST_NO} "Determine the location of auditd configuration file"
+            ReportSuggestion "${TEST_NO}" "Determine the location of auditd configuration file"
         fi
     fi
 #
@@ -229,12 +229,12 @@
             else
                 LogText "Result: can't find log file ${FIND} on disk"
                 Display --indent 4 --text "- Checking auditd log file" --result "${STATUS_SUGGESTION}" --color YELLOW
-                ReportSuggestion ${TEST_NO} "Check auditd log file location"
+                ReportSuggestion "${TEST_NO}" "Check auditd log file location"
             fi
         else
             LogText "Result: no log file found"
             Display --indent 4 --text "- Checking auditd log file" --result "${STATUS_WARNING}" --color RED
-            ReportWarning ${TEST_NO} "Auditd log file is defined but can not be found on disk"
+            ReportWarning "${TEST_NO}" "Auditd log file is defined but can not be found on disk"
         fi
     fi
 #
@@ -258,7 +258,7 @@
                     Report "audit_trail_tool[]=snoopy"
                 else
                     Display --indent 6 --text "- Library in ld.so.preload" --result "${STATUS_NOT_FOUND}" --color YELLOW
-                    ReportSuggestion ${TEST_NO} "Snoopy is installed but not loaded via ${ROOTDIR}etc/ld.so.preload"
+                    ReportSuggestion "${TEST_NO}" "Snoopy is installed but not loaded via ${ROOTDIR}etc/ld.so.preload"
                     AddHP 3 3
                 fi
             else
diff --git a/include/tests_authentication b/include/tests_authentication
index b29ff65d..786bec64 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -56,7 +56,7 @@
                 if [ "${USER}" = "toor" ]; then
                     LogText "BSD note: default there is a user 'toor' installed. This account is considered useless unless it"
                     LogText "is assigned a password and used for daily operations or emergencies. ie: bad shell for root user."
-                    ReportSuggestion ${TEST_NO} "Use vipw to delete the 'toor' user if not used."
+                    ReportSuggestion "${TEST_NO}" "Use vipw to delete the 'toor' user if not used."
                 fi
             done
         else
@@ -87,7 +87,7 @@
                 Display --indent 2 --text "- Unique UIDs" --result "${STATUS_WARNING}" --color RED
                 LogText "Result: found multiple accounts with same UID"
                 LogText "Output (non-unique UIDs): ${FIND}"
-                ReportWarning ${TEST_NO} "Multiple accounts found with same UID"
+                ReportWarning "${TEST_NO}" "Multiple accounts found with same UID"
             fi
           else
             Display --indent 2 --text "- Unique UIDs" --result "${STATUS_SKIPPED}" --color WHITE
@@ -115,7 +115,7 @@
             Display --indent 4 --text "- Checking consistency of /etc/group file" --result "${STATUS_WARNING}" --color RED
             LogText "Result: chkgrp found some errors. Run the tool manually to see details."
             LogText "chkgrp output: ${FIND}"
-            ReportWarning ${TEST_NO} "chkgrp reported inconsistencies in /etc/group file"
+            ReportWarning "${TEST_NO}" "chkgrp reported inconsistencies in /etc/group file"
         fi
     fi
 #
@@ -147,7 +147,7 @@
             LogText "Result: grpck binary didn't find any errors in the group files"
         else
             Display --indent 2 --text "- Consistency of group files (grpck)" --result "${STATUS_WARNING}" --color RED
-            ReportWarning ${TEST_NO} "grpck binary found errors in one or more group files"
+            ReportWarning "${TEST_NO}" "grpck binary found errors in one or more group files"
         fi
         unset FIND
     fi
@@ -181,12 +181,12 @@
                             FOUND=1
                         else
                             LogText "Result: shell ${SHELL} does not exist"
-                            ReportSuggestion ${TEST_NO} "Determine if account is needed, as shell ${SHELL} does not exist"
+                            ReportSuggestion "${TEST_NO}" "Determine if account is needed, as shell ${SHELL} does not exist"
                         fi
                     fi
                 done
                 if [ ${FOUND} -eq 1 ]; then
-                    ReportWarning ${TEST_NO} "Possible harmful shell found (for passwordless account!)"
+                    ReportWarning "${TEST_NO}" "Possible harmful shell found (for passwordless account!)"
                 fi
             fi
           else
@@ -225,12 +225,12 @@
                             FOUND=1
                         else
                             LogText "Result: shell ${SHELL} does not exist"
-                            ReportSuggestion ${TEST_NO} "Determine if account is needed, as shell ${SHELL} does not exist"
+                            ReportSuggestion "${TEST_NO}" "Determine if account is needed, as shell ${SHELL} does not exist"
                         fi
                     fi
                 done
                 if [ ${FOUND} -eq 1 ]; then
-                    ReportWarning ${TEST_NO} "Possible harmful shell found (for passwordless account!)"
+                    ReportWarning "${TEST_NO}" "Possible harmful shell found (for passwordless account!)"
                 fi
             fi
           else
@@ -259,7 +259,7 @@
                 Report "auth_groups_nonunique[]=${I}"
                 LogText "Non-unique group: ${I}"
             done
-            ReportSuggestion ${TEST_NO} "Check your /etc/group file and correct any inconsistencies"
+            ReportSuggestion "${TEST_NO}" "Check your /etc/group file and correct any inconsistencies"
         fi
     fi
 #
@@ -283,7 +283,7 @@
                 Report "auth_groups_nonunique[]=${I}"
                 LogText "Non-unique group: ${I}"
             done
-            ReportSuggestion ${TEST_NO} "Check your ${ROOTDIR}etc/group file and correct any inconsistencies"
+            ReportSuggestion "${TEST_NO}" "Check your ${ROOTDIR}etc/group file and correct any inconsistencies"
         fi
     fi
 #
@@ -319,7 +319,7 @@
         else
             Display --indent 2 --text "- Password file consistency" --result "${STATUS_SUGGESTION}" --color YELLOW
             LogText "Result: pwck found one or more errors/warnings in the password file."
-            ReportSuggestion ${TEST_NO} "Run pwck manually and correct any errors in the password file"
+            ReportSuggestion "${TEST_NO}" "Run pwck manually and correct any errors in the password file"
             AddHP 0 2
         fi
     fi
@@ -563,7 +563,7 @@
             Display --indent 2 --text "- Passwordless accounts on Solaris" --result "${STATUS_OK}" --color GREEN
         else
             for I in ${FIND}; do
-                ReportWarning ${TEST_NO} "Found passwordless account (${I})"
+                ReportWarning "${TEST_NO}" "Found passwordless account (${I})"
             done
             Display --indent 2 --text "- Passwordless accounts on Solaris" --result "${STATUS_WARNING}" --color RED
         fi
@@ -630,7 +630,7 @@
         if [ ${FOUND} -eq 0 ]; then
             Display --indent 2 --text "- PAM password strength tools" --result "${STATUS_SUGGESTION}" --color YELLOW
             LogText "Result: no PAM modules for password strength testing found"
-            ReportSuggestion ${TEST_NO} "Install a PAM module for password strength testing like pam_cracklib or pam_passwdqc"
+            ReportSuggestion "${TEST_NO}" "Install a PAM module for password strength testing like pam_cracklib or pam_passwdqc"
             AddHP 0 3
         else
             Display --indent 2 --text "- PAM password strength tools" --result "${STATUS_OK}" --color GREEN
@@ -851,7 +851,7 @@
         if [ -z "${FIND}" -o "${FIND}" = "0" ]; then
             LogText "Result: password minimum age is not configured"
             Display --indent 2 --text "- Checking user password aging (minimum)" --result "${STATUS_DISABLED}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Configure minimum password age in /etc/login.defs"
+            ReportSuggestion "${TEST_NO}" "Configure minimum password age in /etc/login.defs"
             AddHP 0 1
         else
             LogText "Result: password needs to be at least ${FIND} days old"
@@ -865,7 +865,7 @@
         if [ -z "${FIND}" -o "${FIND}" = "99999" ]; then
             LogText "Result: password aging limits are not configured"
             Display --indent 2 --text "- User password aging (maximum)" --result "${STATUS_DISABLED}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Configure maximum password age in /etc/login.defs"
+            ReportSuggestion "${TEST_NO}" "Configure maximum password age in /etc/login.defs"
             AddHP 0 1
         else
             LogText "Result: max password age is ${FIND} days"
@@ -933,7 +933,7 @@
             else
                 LogText "Result: option present, no password needed at single user mode login"
                 Display --indent 2 --text "- Checking Solaris /etc/default/sulogin file" --result "${STATUS_WARNING}" --color RED
-                ReportWarning ${TEST_NO} "No password needed for single user mode login"
+                ReportWarning "${TEST_NO}" "No password needed for single user mode login"
                 AddHP 0 1
             fi
         else
@@ -963,7 +963,7 @@
             else
                 LogText "Result: option present, no password needed at single user mode login"
                 Display --indent 2 --text "- Checking HP-UX boot authentication" --result "${STATUS_SUGGESTION}" --color YELLOW
-                ReportSuggestion ${TEST_NO} "Set password for system boot"
+                ReportSuggestion "${TEST_NO}" "Set password for system boot"
                 AddHP 0 1
             fi
         else
@@ -1042,8 +1042,8 @@
             if [ ${FOUND} -eq 0 ]; then
                 LogText "Result: option not set, no password needed at single user mode boot"
                 Display --indent 2 --text "- Checking Linux single user mode authentication" --result "${STATUS_WARNING}" --color RED
-                ReportWarning ${TEST_NO} "No password set for single mode"
-                ReportSuggestion ${TEST_NO} "Set password for single user mode to minimize physical access attack surface"
+                ReportWarning "${TEST_NO}" "No password set for single mode"
+                ReportSuggestion "${TEST_NO}" "Set password for single user mode to minimize physical access attack surface"
                 AddHP 0 2
             else
                 LogText "Result: option set, password is needed at single user mode boot"
@@ -1136,11 +1136,11 @@
                     AddHP 2 2
                 elif [ ${GOOD_UMASK} -eq 1 -a ${WEAK_UMASK} -eq 1 ]; then
                     Display --indent 4 --text "- umask (/etc/profile and /etc/profile.d)" --result "${STATUS_SUGGESTION}" --color YELLOW
-                    ReportSuggestion ${TEST_NO} "Some umasks found could be more strict (e.g. 027)"
+                    ReportSuggestion "${TEST_NO}" "Some umasks found could be more strict (e.g. 027)"
                     AddHP 1 2
                 else
                     Display --indent 4 --text "- umask (/etc/profile and /etc/profile.d)" --result "${STATUS_SUGGESTION}" --color YELLOW
-                    ReportSuggestion ${TEST_NO} "Default umask in /etc/profile or /etc/profile.d/custom.sh could be more strict (e.g. 027)"
+                    ReportSuggestion "${TEST_NO}" "Default umask in /etc/profile or /etc/profile.d/custom.sh could be more strict (e.g. 027)"
                     AddHP 0 2
                 fi
               else
@@ -1174,7 +1174,7 @@
             if [ "${FIND}" = "" ]; then
                 LogText "Result: umask value is not configured (most likely it will have the default 022 value)"
                 Display --indent 4 --text "- umask (/etc/login.defs)" --result "${STATUS_SUGGESTION}" --color YELLOW
-                ReportSuggestion ${TEST_NO} "Default umask in /etc/login.defs could not be found and defaults usually to 022, which could be more strict like 027"
+                ReportSuggestion "${TEST_NO}" "Default umask in /etc/login.defs could not be found and defaults usually to 022, which could be more strict like 027"
                 AddHP 1 2
             elif [ "${FIND}" = "077" -o "${FIND}" = "027" -o "${FIND}" = "0077" -o "${FIND}" = "0027" ]; then
                 LogText "Result: umask is ${FIND}, which is fine"
@@ -1183,7 +1183,7 @@
             else
                 LogText "Result: found umask ${FIND}, which could be improved"
                 Display --indent 4 --text "- umask (/etc/login.defs)" --result "${STATUS_SUGGESTION}" --color YELLOW
-                ReportSuggestion ${TEST_NO} "Default umask in /etc/login.defs could be more strict like 027"
+                ReportSuggestion "${TEST_NO}" "Default umask in /etc/login.defs could be more strict like 027"
                 AddHP 0 2
             fi
         else
@@ -1221,7 +1221,7 @@
             if [ "${FIND}" = "" ]; then
                 LogText "Result: UMASK value is not configured (most likely it will have the default 022 value)"
                 Display --indent 4 --text "- Checking umask (/etc/init.d/rc)" --result "${STATUS_SUGGESTION}" --color YELLOW
-                ReportSuggestion ${TEST_NO} "Default umask in /etc/init.d/rc could not be found and defaults usually to 022, which could be more strict like 027"
+                ReportSuggestion "${TEST_NO}" "Default umask in /etc/init.d/rc could not be found and defaults usually to 022, which could be more strict like 027"
                 AddHP 1 2
             elif [ "${FIND}" = "077" -o "${FIND}" = "027" -o "${FIND}" = "0077" -o "${FIND}" = "0027" ]; then
                 LogText "Result: umask is ${FIND}, which is fine"
@@ -1230,7 +1230,7 @@
             else
                 LogText "Result: found umask ${FIND}, which could be improved"
                 Display --indent 4 --text "- umask (/etc/init.d/rc)" --result "${STATUS_SUGGESTION}" --color YELLOW
-                ReportSuggestion ${TEST_NO} "Default umask in /etc/init.d/rc could be more strict like 027"
+                ReportSuggestion "${TEST_NO}" "Default umask in /etc/init.d/rc could be more strict like 027"
                 AddHP 0 2
             fi
           else
@@ -1265,7 +1265,7 @@
                     Display --indent 4 --text "- umask (/etc/login.conf)" --result "${STATUS_OK}" --color GREEN
                 else
                     Display --indent 4 --text "- umask (/etc/login.conf)" --result "${STATUS_WEAK}" --color YELLOW
-                    ReportSuggestion ${TEST_NO} "Umask in /etc/login.conf could be more strict like 027"
+                    ReportSuggestion "${TEST_NO}" "Umask in /etc/login.conf could be more strict like 027"
                 fi
             else
                 LogText "Result: no umask setting found in /etc/login.conf, which is unexpected"
@@ -1284,7 +1284,7 @@
                 if [ "${FIND2}" = "" ]; then
                     LogText "Result: UMASK value is not configured (most likely it will have the default 022 value)"
                     Display --indent 4 --text "- Checking umask (/etc/init.d/rcS)" --result "${STATUS_SUGGESTION}" --color YELLOW
-                    ReportSuggestion ${TEST_NO} "Default umask in /etc/init.d/rcS could not be found and defaults usually to 022, which could be more strict like 027"
+                    ReportSuggestion "${TEST_NO}" "Default umask in /etc/init.d/rcS could not be found and defaults usually to 022, which could be more strict like 027"
                     AddHP 1 2
                 elif [ "${FIND2}" = "077" -o "${FIND2}" = "027" ]; then
                     LogText "Result: umask is ${FIND2}, which is fine"
@@ -1293,7 +1293,7 @@
                 else
                     LogText "Result: found umask ${FIND2}, which could be improved"
                     Display --indent 4 --text "- umask (/etc/init.d/rcS)" --result "${STATUS_SUGGESTION}" --color YELLOW
-                    ReportSuggestion ${TEST_NO} "Default umask in /etc/init.d/rcS could be more strict like 027"
+                    ReportSuggestion "${TEST_NO}" "Default umask in /etc/init.d/rcS could be more strict like 027"
                     AddHP 0 2
                 fi
             else
@@ -1458,7 +1458,7 @@
             AddHP 3 3
         else
             AddHP 0 1
-            #ReportSuggestion ${TEST_NO} "Configure failed login attempts to be logged using pam_tally2 or /etc/login.defs"
+            #ReportSuggestion "${TEST_NO}" "Configure failed login attempts to be logged using pam_tally2 or /etc/login.defs"
         fi
     fi
 #
diff --git a/include/tests_banners b/include/tests_banners
index f9f26104..7fa94da6 100644
--- a/include/tests_banners
+++ b/include/tests_banners
@@ -108,7 +108,7 @@
         else
             LogText "Result: Found only ${COUNT} key words (5 or more suggested), to warn unauthorized users and could be increased"
             Display --indent 4 --text "- ${FILE} contents" --result "${STATUS_WEAK}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Add a legal banner to ${FILE}, to warn unauthorized users"
+            ReportSuggestion "${TEST_NO}" "Add a legal banner to ${FILE}, to warn unauthorized users"
             AddHP 0 1
             Report "weak_banner_file[]=${FILE}"
         fi
@@ -161,7 +161,7 @@
         else
             LogText "Result: Found only ${COUNT} key words, to warn unauthorized users and could be increased"
             Display --indent 4 --text "- ${ROOTDIR}etc/issue.net contents" --result "${STATUS_WEAK}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Add legal banner to /etc/issue.net, to warn unauthorized users"
+            ReportSuggestion "${TEST_NO}" "Add legal banner to /etc/issue.net, to warn unauthorized users"
             AddHP 0 1
         fi
     fi
diff --git a/include/tests_boot_services b/include/tests_boot_services
index fe6e316e..2c239b64 100644
--- a/include/tests_boot_services
+++ b/include/tests_boot_services
@@ -338,7 +338,7 @@
             else
                 Display --indent 4 --text "- Checking for password protection" --result "${STATUS_NONE}" --color RED
                 LogText "Result: Didn't find hashed password line in GRUB boot file!"
-                ReportSuggestion ${TEST_NO} "Set a password on GRUB bootloader to prevent altering boot configuration (e.g. boot in single user mode without password)"
+                ReportSuggestion "${TEST_NO}" "Set a password on GRUB bootloader to prevent altering boot configuration (e.g. boot in single user mode without password)"
                 AddHP 0 2
             fi
         else
@@ -420,13 +420,13 @@
                     if [ "${MACHINE_ROLE}" = "server" -o "${MACHINE_ROLE}" = "workstation" ]; then
                         Display --indent 4 --text "- Password option presence " --result "${STATUS_WARNING}" --color RED
                         LogText "Result: no password set for LILO. Bootloader is unprotected to dropping to single user mode or unauthorized access to devices/data."
-                        ReportSuggestion ${TEST_NO} "Add a password to LILO, by adding a line to the lilo.conf file, above the first line saying 'image=<name>': password=<password>"
-                        ReportWarning ${TEST_NO} "No password set on LILO bootloader"
+                        ReportSuggestion "${TEST_NO}" "Add a password to LILO, by adding a line to the lilo.conf file, above the first line saying 'image=<name>': password=<password>"
+                        ReportWarning "${TEST_NO}" "No password set on LILO bootloader"
                         AddHP 0 2
                     elif [ "${MACHINE_ROLE}" = "personal" ]; then
                         Display --indent 4 --text "- Password option presence " --result "${STATUS_WARNING}" --color yellow
                         LogText "Result: no password set for LILO. Bootloader is unprotected to dropping to single user mode or unauthorized access to devices/data."
-                        ReportSuggestion ${TEST_NO} "No password set on LILO bootloader. Add a password to LILO, by adding a line to the lilo.conf file, above the first line saying 'image=<name>': password=<password>"
+                        ReportSuggestion "${TEST_NO}" "No password set on LILO bootloader. Add a password to LILO, by adding a line to the lilo.conf file, above the first line saying 'image=<name>': password=<password>"
                         AddHP 1 2
                     else
                         LogText "Result: no password set for LILO, with unknown machine role"
@@ -501,8 +501,8 @@
             FIND=$(${GREPBINARY} '^boot' ${ROOTDIR}etc/boot.conf)
             if [ -z "${FIND}" ]; then
                 Display --indent 4 --text "- Checking boot option" --result "${STATUS_WARNING}" --color RED
-                #ReportSuggestion ${TEST_NO} "Add 'boot' to the ${ROOTDIR}etc/boot.conf file to disable the default 5 seconds waiting time, to disallow booting into single user mode."
-                ReportWarning ${TEST_NO} "System can be booted into single user mode without password"
+                #ReportSuggestion "${TEST_NO}" "Add 'boot' to the ${ROOTDIR}etc/boot.conf file to disable the default 5 seconds waiting time, to disallow booting into single user mode."
+                ReportWarning "${TEST_NO}" "System can be booted into single user mode without password"
             else
                 Display --indent 4 --text "- Checking boot option" --result "${STATUS_OK}" --color GREEN
                 LogText "Ok, boot option is enabled."
@@ -511,7 +511,7 @@
             Display --indent 2 --text "- Checking ${ROOTDIR}etc/boot.conf" --result "${STATUS_NOT_FOUND}" --color YELLOW
             LogText "Result: no ${ROOTDIR}etc/boot.conf found. When using the default boot loader, physical"
             LogText "access to the server can be used to possibly enter single user mode."
-            ReportSuggestion ${TEST_NO} "Add 'boot' to the ${ROOTDIR}etc/boot.conf file to disable the default 5 seconds waiting time."
+            ReportSuggestion "${TEST_NO}" "Add 'boot' to the ${ROOTDIR}etc/boot.conf file to disable the default 5 seconds waiting time."
         fi
         if [ ${FOUND} -eq 1 ]; then
             LogText "Result: found OpenBSD boot loader"
@@ -645,7 +645,7 @@
                 LogText "Result: found ${COUNT} services"
             fi
         elif [ -z "${sRUNLEVEL}" ]; then
-            ReportSuggestion ${TEST_NO} "Determine runlevel and services at startup"
+            ReportSuggestion "${TEST_NO}" "Determine runlevel and services at startup"
         else
             LogText "Result: skipping further actions"
         fi
@@ -716,7 +716,7 @@
                 LogText "Test: Checking ${CHECKFILE} file for writable bit"
                 if IsWorldWritable ${CHECKFILE}; then
                     FOUND=1
-                    ReportWarning ${TEST_NO} "Found writable startup script ${CHECKFILE}"
+                    ReportWarning "${TEST_NO}" "Found writable startup script ${CHECKFILE}"
                     LogText "Result: warning, file ${CHECKFILE} is world writable"
                 else
                     LogText "Result: good, file ${CHECKFILE} not world writable"
@@ -727,7 +727,7 @@
         # Check results
         if [ ${FOUND} -eq 1 ]; then
             Display --indent 2 --text "- Check startup files (permissions)" --result "${STATUS_WARNING}" --color RED
-            ReportWarning ${TEST_NO} "Found world writable startup scripts" "-" "-"
+            ReportWarning "${TEST_NO}" "Found world writable startup scripts" "-" "-"
             LogText "Result: found one or more scripts which are possibly writable by other users"
             AddHP 0 3
         else
@@ -938,7 +938,7 @@
                 LogText "Test: Checking ${CHECKFILE} file for writable bit"
                 if IsWorldWritable ${CHECKFILE}; then
                     FOUND=1
-                    ReportWarning ${TEST_NO} "Found writable startup script ${CHECKFILE}"
+                    ReportWarning "${TEST_NO}" "Found writable startup script ${CHECKFILE}"
                     LogText "Result: warning, file ${CHECKFILE} is world writable"
                 else
                     LogText "Result: good, file ${CHECKFILE} not world writable"
@@ -949,7 +949,7 @@
         # Check results
         if [ ${FOUND} -eq 1 ]; then
             Display --indent 2 --text "- Check startup files (permissions)" --result "${STATUS_WARNING}" --color RED
-            ReportWarning ${TEST_NO} "Found world writable startup scripts" "-" "-"
+            ReportWarning "${TEST_NO}" "Found world writable startup scripts" "-" "-"
             LogText "Result: found one or more scripts which are possibly writable by other users"
             AddHP 0 3
         else
diff --git a/include/tests_crypto b/include/tests_crypto
index 96dc067a..44f19cdc 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -123,7 +123,7 @@
             Display --indent 2 --text "- Checking for expired SSL certificates [${COUNT_EXPIRED}/${COUNT_TOTAL}]" --result "${STATUS_NONE}" --color GREEN
         else
             Display --indent 2 --text "- Checking for expired SSL certificates [${COUNT_EXPIRED}/${COUNT_TOTAL}]" --result "${STATUS_FOUND}" --color RED
-            ReportSuggestion ${TEST_NO} "Check available certificates for expiration"
+            ReportSuggestion "${TEST_NO}" "Check available certificates for expiration"
         fi
     fi
 
diff --git a/include/tests_custom.template b/include/tests_custom.template
index e8de448f..38dfaf0a 100644
--- a/include/tests_custom.template
+++ b/include/tests_custom.template
@@ -134,7 +134,7 @@
             Display --indent 2 --text "- Checking if everything is OK..." --result "${STATUS_OK}" --color GREEN
         else
             Display --indent 2 --text "- Checking if everything is OK..." --result "${STATUS_WARNING}" --color RED
-            ReportSuggestion ${TEST_NO} "This is a suggestion"
+            ReportSuggestion "${TEST_NO}" "This is a suggestion"
         fi
     fi
 #
diff --git a/include/tests_databases b/include/tests_databases
index 5778dd1c..f950fa9c 100644
--- a/include/tests_databases
+++ b/include/tests_databases
@@ -89,7 +89,7 @@
         FIND=$(${MYSQLCLIENTBINARY} --no-defaults -u root --password= --silent --batch --execute="SELECT count(*) FROM mysql.user WHERE user = 'root' AND plugin = 'mysql_native_password' AND authentication_string = ''" mysql 2>/dev/null; echo $?)
         if [ "${FIND}" = "0" ]; then
            LogText "Result: Login succeeded, no MySQL root password set!"
-           ReportWarning ${TEST_NO} "No MySQL root password set"
+           ReportWarning "${TEST_NO}" "No MySQL root password set"
            Display --indent 4 --text "- Checking empty MySQL root password" --result "${STATUS_WARNING}" --color RED
            AddHP 0 5
         else
@@ -160,7 +160,7 @@
             if [ ${MONGODB_AUTHORIZATION_ENABLED} -eq 0 ]; then
                 LogText "Result: no authorization enabled via parameter or configuration file"
                 Report "mongodb_authorization_disabled=1"
-                ReportWarning ${TEST_NO} "MongoDB instance allows any user to access databases"
+                ReportWarning "${TEST_NO}" "MongoDB instance allows any user to access databases"
                 Display --indent 4 --text "- Checking MongoDB authorization" --result "${STATUS_DISABLED}" --color RED
             else
                 if IsVerbose; then Display --indent 4 --text "- Checking MongoDB authorization" --result "${STATUS_ENABLED}" --color GREEN; fi
diff --git a/include/tests_file_integrity b/include/tests_file_integrity
index 8f97d8c2..36201fcf 100644
--- a/include/tests_file_integrity
+++ b/include/tests_file_integrity
@@ -307,7 +307,7 @@
         if [ -z "${FIND}" ]; then
             LogText "Result: No SHA256 or SHA512 found for creating checksums"
             Display --indent 6 --text "- AIDE config (Checksum)" --result Suggestion --color YELLOW
-            ReportSuggestion ${TEST_NO} "Use SHA256 or SHA512 to create checksums in AIDE"
+            ReportSuggestion "${TEST_NO}" "Use SHA256 or SHA512 to create checksums in AIDE"
             AddHP 1 3
         else
             LogText "Result: Found SHA256 or SHA512 found for creating checksums"
@@ -330,7 +330,7 @@
         else
             LogText "Result: No file integrity tools found"
             Display --indent 2 --text "- Checking presence integrity tool" --result "${STATUS_NOT_FOUND}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Install a file integrity tool to monitor changes to critical and sensitive files"
+            ReportSuggestion "${TEST_NO}" "Install a file integrity tool to monitor changes to critical and sensitive files"
             AddHP 0 5
         fi
     fi
diff --git a/include/tests_filesystems b/include/tests_filesystems
index 398b2530..96087094 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -44,7 +44,7 @@
             if [ -L ${I} ]; then
                 ShowSymlinkPath ${I}
                 LogText "Result: ${I} is a symlink. Manual check required to determine exact file system options"
-                ReportSuggestion ${TEST_NO} "Symlinked mount point needs to be checked manually" "${I}" ""
+                ReportSuggestion "${TEST_NO}" "Symlinked mount point needs to be checked manually" "${I}" ""
                 Display --indent 4 --text "- Checking ${I} mount point" --result SYMLINK --color WHITE
             elif [ -d ${I} ]; then
                 LogText "Result: directory ${I} exists"
@@ -56,7 +56,7 @@
                 if IsEmpty "${FIND}"; then
                     LogText "Result: ${I} not found in mount list. Directory most likely stored on / file system"
                     Display --indent 4 --text "- Checking ${I} mount point" --result "${STATUS_SUGGESTION}" --color YELLOW
-                    ReportSuggestion ${TEST_NO} "To decrease the impact of a full ${I} file system, place ${I} on a separate partition"
+                    ReportSuggestion "${TEST_NO}" "To decrease the impact of a full ${I} file system, place ${I} on a separate partition"
                     AddHP 9 10
                 else
                     LogText "Result: found ${I} as a separated mount point"
@@ -327,8 +327,8 @@
         else
             Display --indent 2 --text "- Testing swap partitions" --result "CHECK NEEDED" --color YELLOW
             LogText "Result: possible incorrect mount options used for mounting swap partition (${FIND})"
-            #ReportWarning ${TEST_NO} "Possible incorrect mount options used for swap partition (${FIND})"
-            ReportSuggestion ${TEST_NO} "Check your /etc/fstab file for swap partition mount options"
+            #ReportWarning "${TEST_NO}" "Possible incorrect mount options used for swap partition (${FIND})"
+            ReportSuggestion "${TEST_NO}" "Check your /etc/fstab file for swap partition mount options"
             LogText "Notes: usually swap partition have 'sw' or 'swap' in the options field (4th)"
         fi
     fi
@@ -396,7 +396,7 @@
             LogText "private information and should be deleted it not being used actively. Use a tool like lsof to"
             LogText "see which programs possibly are using a particular file. Some systems can cleanup temporary"
             LogText "directories by setting a boot option."
-            ReportSuggestion ${TEST_NO} "Check ${COUNT} files in ${ROOTDIR}tmp which are older than ${TMP_OLD_DAYS} days"
+            ReportSuggestion "${TEST_NO}" "Check ${COUNT} files in ${ROOTDIR}tmp which are older than ${TMP_OLD_DAYS} days"
         fi
     fi
 #
@@ -415,7 +415,7 @@
             AddHP 3 3
         else
             Display --indent 2 --text "- Checking ${ROOTDIR}tmp sticky bit" --result "${STATUS_WARNING}" --color RED
-            ReportSuggestion ${TEST_NO} "Set the sticky bit on ${ROOTDIR}tmp, to prevent users deleting (by other owned) files in the /tmp directory." "/tmp" "text:Set sticky bit"
+            ReportSuggestion "${TEST_NO}" "Set the sticky bit on ${ROOTDIR}tmp, to prevent users deleting (by other owned) files in the /tmp directory." "/tmp" "text:Set sticky bit"
             AddHP 0 3
         fi
         unset FIND
@@ -438,7 +438,7 @@
             AddHP 3 3
         else
             Display --indent 2 --text "- Checking ${ROOTDIR}var/tmp sticky bit" --result "${STATUS_WARNING}" --color RED
-            ReportSuggestion ${TEST_NO} "Set the sticky bit on ${ROOTDIR}var/tmp, to prevent users deleting (by other owned) files in the /var/tmp directory." "/var/tmp" "text:Set sticky bit"
+            ReportSuggestion "${TEST_NO}" "Set the sticky bit on ${ROOTDIR}var/tmp, to prevent users deleting (by other owned) files in the /var/tmp directory." "/var/tmp" "text:Set sticky bit"
             AddHP 0 3
         fi
         unset FIND
@@ -716,7 +716,7 @@
         else
             LogText "Result: database not found"
             Display --indent 2 --text "- Checking Locate database" --result "${STATUS_NOT_FOUND}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "The database required for 'locate' could not be found. Run 'updatedb' or 'locate.updatedb' to create this file."
+            ReportSuggestion "${TEST_NO}" "The database required for 'locate' could not be found. Run 'updatedb' or 'locate.updatedb' to create this file."
         fi
     fi
 #
@@ -782,7 +782,7 @@
                         AddHP 2 3
                         if IsDebug; then Display --indent 6 --text "- Module ${FS} not loaded (lsmod)" --result OK --color GREEN; fi
                         # Tip to disable a particular module if it is not loaded TODO
-                        #ReportSuggestion ${TEST_NO} "The modprobe.d directory should contain a file with the entry 'install ${FS} /bin/true'"
+                        #ReportSuggestion "${TEST_NO}" "The modprobe.d directory should contain a file with the entry 'install ${FS} /bin/true'"
                         FOUND=1
                         AVAILABLE_MODPROBE_FS="${AVAILABLE_MODPROBE_FS}${FS} "
                     else
diff --git a/include/tests_firewalls b/include/tests_firewalls
index dabb7a97..67f21020 100644
--- a/include/tests_firewalls
+++ b/include/tests_firewalls
@@ -128,7 +128,7 @@
                         "ACCEPT")
                              LogText "Result: Found ACCEPT for ${chainname} (table: ${table})"
                              Display --indent 6 --text "- Checking chain ${chainname} (table: ${table}, policy ${policy})" --result "ACCEPT" --color YELLOW
-                             #ReportSuggestion ${TEST_NO} "Consider settings default chain policy to DROP (iptables chain ${chainname}, table: ${table})"
+                             #ReportSuggestion "${TEST_NO}" "Consider settings default chain policy to DROP (iptables chain ${chainname}, table: ${table})"
                              AddHP 1 3
                              ;;
                          "DROP")
@@ -139,7 +139,7 @@
                          *)
                              Display --indent 6 --text "- Checking chain ${chainname} (table: ${table}, policy ${policy})" --result "other" --color YELLOW
                              LogText "Result: Unknown policy: ${policy}"
-                             #ReportSuggestion ${TEST_NO} "Check iptables ${chainname} (table: ${table}) chain policy"
+                             #ReportSuggestion "${TEST_NO}" "Check iptables ${chainname} (table: ${table}) chain policy"
                              ;;
                     esac
                 fi
@@ -162,7 +162,7 @@
                 FIREWALL_EMPTY_RULESET=1
                 LogText "Result: iptables ruleset seems to be empty (found ${FIND} rules)"
                 Display --indent 4 --text "- Checking for empty ruleset" --result "${STATUS_WARNING}" --color RED
-                ReportWarning ${TEST_NO} "iptables module(s) loaded, but no rules active"
+                ReportWarning "${TEST_NO}" "iptables module(s) loaded, but no rules active"
             else
                 LogText "Result: one or more rules are available (${FIND} rules)"
                 Display --indent 4 --text "- Checking for empty ruleset" --result "${STATUS_OK}" --color GREEN
@@ -187,7 +187,7 @@
             LogText "Description: Unused rules can be a sign that the firewall rules aren't optimized or up-to-date"
             LogText "Note: Sometimes rules aren't triggered but still in use. Keep this in mind before cleaning up rules."
             LogText "Output: iptables rule numbers: ${FIND}"
-            ReportSuggestion ${TEST_NO} "Check iptables rules to see which rules are currently not used"
+            ReportSuggestion "${TEST_NO}" "Check iptables rules to see which rules are currently not used"
             LogText "Tip: iptables --list --numeric --line-numbers --verbose"
         fi
     fi
@@ -282,7 +282,7 @@
             else
                 Display --indent 4 --text "- Checking pf configuration consistency" --result "${STATUS_WARNING}" --color RED
                 LogText "Result: found one or more warnings in the pf filter rules"
-                ReportWarning ${TEST_NO} "Found one or more warnings in pf configuration file" "/etc/pf.conf" "text:Run 'pfctl -n -f /etc/pf.conf -vvv' to see available pf warnings"
+                ReportWarning "${TEST_NO}" "Found one or more warnings in pf configuration file" "/etc/pf.conf" "text:Run 'pfctl -n -f /etc/pf.conf -vvv' to see available pf warnings"
             fi
         else
             LogText "Result: /etc/pf.conf does NOT exist"
@@ -548,7 +548,7 @@
         else
             Display --indent 2 --text "- Checking host based firewall" --result "NOT ACTIVE" --color YELLOW
             LogText "Result: no host based firewall/packet filter found or configured"
-            ReportSuggestion ${TEST_NO} "Configure a firewall/packet filter to filter incoming and outgoing traffic"
+            ReportSuggestion "${TEST_NO}" "Configure a firewall/packet filter to filter incoming and outgoing traffic"
             AddHP 0 5
         fi
     fi
diff --git a/include/tests_hardening b/include/tests_hardening
index 12af3c9b..8b8ae452 100644
--- a/include/tests_hardening
+++ b/include/tests_hardening
@@ -76,7 +76,7 @@
             # Report suggestion is one or more compilers can be better hardened
             if [ ${HARDEN_COMPILERS_NEEDED} -eq 1 ]; then
                 LogText "Result: at least one compiler could be better hardened by restricting executable access to root or group only"
-                ReportSuggestion ${TEST_NO} "Harden compilers like restricting access to root user only"
+                ReportSuggestion "${TEST_NO}" "Harden compilers like restricting access to root user only"
             fi
         fi
     fi
@@ -99,7 +99,7 @@
             else
                 Display --indent 4 --text "- Installed malware scanner" --result "${STATUS_NOT_FOUND}" --color RED
             fi
-            ReportSuggestion ${TEST_NO} "Harden the system by installing at least one malware scanner, to perform periodic file system scans" "-" "Install a tool like rkhunter, chkrootkit, OSSEC"
+            ReportSuggestion "${TEST_NO}" "Harden the system by installing at least one malware scanner, to perform periodic file system scans" "-" "Install a tool like rkhunter, chkrootkit, OSSEC"
             AddHP 1 3
             LogText "Result: no malware scanner found"
         fi
diff --git a/include/tests_homedirs b/include/tests_homedirs
index e8226bed..13a91d86 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -141,7 +141,7 @@ EOF
                 LogText "Result: the following files seem to be of the wrong file type:"
                 LogText "Output: ${FIND}"
                 LogText "Info: above files could be redirected files to avoid logging and should be investigated"
-                ReportWarning ${TEST_NO} "Incorrect file type found for shell history file"
+                ReportWarning "${TEST_NO}" "Incorrect file type found for shell history file"
             fi
             LogText "Remark: History files are normally of the type 'file'. Symbolic links and other types are suspicious."
         else
diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index 40cd9cf0..61a66066 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -45,7 +45,7 @@
             INETD_PACKAGE_INSTALLED=1
             LogText "Result: inetd is installed"
             Display --indent 2 --text "- Installed inetd package" --result "${STATUS_FOUND}" --color YELLOW
-            #ReportSuggestion ${TEST_NO} "If there are no inetd services required, it is recommended that the daemon be removed"
+            #ReportSuggestion "${TEST_NO}" "If there are no inetd services required, it is recommended that the daemon be removed"
         else
             LogText "Result: inetd is NOT installed"
             Display --indent 2 --text "- Installed inetd package" --result "${STATUS_NOT_FOUND}" --color GREEN
@@ -105,7 +105,7 @@
         else
             LogText "Result: found services in inetd, even though inetd is not running"
             Display --indent 4 --text "- Checking enabled inetd services" --result "${STATUS_SUGGESTION}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Although inetd is not running, make sure no services are enabled in ${INETD_CONFIG_FILE}, or remove inetd service"
+            ReportSuggestion "${TEST_NO}" "Although inetd is not running, make sure no services are enabled in ${INETD_CONFIG_FILE}, or remove inetd service"
         fi
     fi
 #
@@ -141,7 +141,7 @@
         if PackageIsInstalled "xinetd"; then
             LogText "Result: xinetd is installed"
             Display --indent 2 --text "- Installed xinetd package" --result "${STATUS_FOUND}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "If there are no xinetd services required, it is recommended that the daemon be removed"
+            ReportSuggestion "${TEST_NO}" "If there are no xinetd services required, it is recommended that the daemon be removed"
         else
             LogText "Result: xinetd is NOT installed"
             Display --indent 2 --text "- Installed xinetd package" --result "${STATUS_OK}" --color GREEN
@@ -200,7 +200,7 @@
         else
             LogText "Result: found services in ${XINETD_CONFIG_DIR}, even though xinetd is not running"
             Display --indent 6 --text "- Enabled xinetd.d services" --result "${STATUS_FOUND}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Although xinetd is not running, make sure no services are enabled in ${XINETD_CONFIG_DIR}, or remove xinetd service"
+            ReportSuggestion "${TEST_NO}" "Although xinetd is not running, make sure no services are enabled in ${XINETD_CONFIG_DIR}, or remove xinetd service"
         fi
     fi
 #
@@ -264,7 +264,7 @@
         else
             LogText "Result: tcp_wrappers is NOT installed"
             Display --indent 2 --text "- Checking tcp_wrappers installation" --result "${STATUS_SUGGESTION}" --color YELLOW
-            #ReportSuggestion ${TEST_NO} "When network services are using the inetd/xinetd service, the tcp_wrappers package should be installed"
+            #ReportSuggestion "${TEST_NO}" "When network services are using the inetd/xinetd service, the tcp_wrappers package should be installed"
         fi
     fi
 #
@@ -283,7 +283,7 @@
         if [ ${FOUND} -eq 1 ]; then
             LogText "Result: rsh client is installed"
             Display --indent 2 --text "- Installed rsh client package" --result "${STATUS_SUGGESTION}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Remove rsh client when it is not in use or replace with the more secure SSH package"
+            ReportSuggestion "${TEST_NO}" "Remove rsh client when it is not in use or replace with the more secure SSH package"
         else
             LogText "Result: rsh client is NOT installed"
             Display --indent 2 --text "- Installed rsh client package" --result "${STATUS_OK}" --color GREEN
@@ -317,7 +317,7 @@
     #    if [ ${FOUND} -eq 1 ]; then
     #        LogText "Result: found one or more Rsh Trust Files"
     #        Display --indent 4 --text "- Checking presence of Rsh Trust Files" --result "${STATUS_SUGGESTION}" --color YELLOW
-    #        ReportSuggestion ${TEST_NO} "Remove every Rsh Trust Files as they can allow unauthenticated access to a system"
+    #        ReportSuggestion "${TEST_NO}" "Remove every Rsh Trust Files as they can allow unauthenticated access to a system"
     #    else
     #        LogText "Result: no Rsh Trust Files found"
     #        Display --indent 4 --text "- Checking presence of Rsh Trust Files" --result "${STATUS_OK}" --color GREEN
@@ -340,7 +340,7 @@
         if [ ${FOUND} -eq 1 ]; then
             LogText "Result: rsh server is installed"
             Display --indent 2 --text "- Installed rsh server package" --result "${STATUS_SUGGESTION}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Remove the rsh-server package and replace with a more secure alternative like SSH"
+            ReportSuggestion "${TEST_NO}" "Remove the rsh-server package and replace with a more secure alternative like SSH"
             Report "insecure_service[]=rsh-server"
         else
             LogText "Result: rsh server is NOT installed"
@@ -362,7 +362,7 @@
             LogText "Result: telnet client is installed"
             Display --indent 2 --text "- Installed telnet client package" --result "${STATUS_FOUND}" --color YELLOW
             # Telnet client usage might be used for troubleshooting instead of system administration
-            #ReportSuggestion ${TEST_NO} "telnet client contain numerous security exposures and have been replaced with the more secure SSH package"
+            #ReportSuggestion "${TEST_NO}" "telnet client contain numerous security exposures and have been replaced with the more secure SSH package"
         else
             LogText "Result: telnet client is NOT installed"
             Display --indent 2 --text "- Installed telnet client package" --result "${STATUS_OK}" --color GREEN
@@ -385,7 +385,7 @@
         if [ ${FOUND} -eq 1 ]; then
             LogText "Result: telnet server is installed"
             Display --indent 2 --text "- Installed telnet server package" --result "${STATUS_FOUND}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Removing the ${FOUND} package and replace with SSH when possible"
+            ReportSuggestion "${TEST_NO}" "Removing the ${FOUND} package and replace with SSH when possible"
             Report "insecure_service[]=telnet-server"
         else
             LogText "Result: telnet server is NOT installed"
@@ -411,7 +411,7 @@
         if [ -n "${FOUND}" ]; then
             LogText "Result: NIS client is installed"
             Display --indent 2 --text "- Checking NIS client installation" --result "${STATUS_SUGGESTION}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "NIS client should be removed if not required. Use a more secure alternative or a protocol that can use encrypted communications."
+            ReportSuggestion "${TEST_NO}" "NIS client should be removed if not required. Use a more secure alternative or a protocol that can use encrypted communications."
         else
             LogText "Result: NIS client is NOT installed"
             Display --indent 2 --text "- Checking NIS client installation" --result "${STATUS_OK}" --color GREEN
@@ -435,7 +435,7 @@
         if [ -n "${FOUND}" ]; then
             LogText "Result: NIS server is installed"
             Display --indent 2 --text "- Checking NIS server installation" --result "${STATUS_SUGGESTION}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Removing the ${FOUND} package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services"
+            ReportSuggestion "${TEST_NO}" "Removing the ${FOUND} package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services"
         else
             LogText "Result: NIS server is NOT installed"
             Display --indent 2 --text "- Checking NIS server installation" --result "${STATUS_OK}" --color GREEN
@@ -459,7 +459,7 @@
         if [ -n "${FOUND}" ]; then
             LogText "Result: TFTP client is installed"
             Display --indent 2 --text "- Checking TFTP client installation" --result "${STATUS_SUGGESTION}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "It is recommended that TFTP be removed, unless there is a specific need for TFTP (such as a boot server)"
+            ReportSuggestion "${TEST_NO}" "It is recommended that TFTP be removed, unless there is a specific need for TFTP (such as a boot server)"
         else
             LogText "Result: TFTP client is NOT installed"
             Display --indent 2 --text "- Checking TFTP client installation" --result "${STATUS_OK}" --color GREEN
@@ -483,7 +483,7 @@
         if [ -n "${FOUND}" ]; then
             LogText "Result: TFTP server is installed"
             Display --indent 2 --text "- Checking TFTP server installation" --result "${STATUS_SUGGESTION}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Removing the ${FOUND} package decreases the risk of the accidental (or intentional) activation of tftp services"
+            ReportSuggestion "${TEST_NO}" "Removing the ${FOUND} package decreases the risk of the accidental (or intentional) activation of tftp services"
         else
             LogText "Result: TFTP server is NOT installed"
             Display --indent 2 --text "- Checking TFTP server installation" --result "${STATUS_OK}" --color GREEN
diff --git a/include/tests_kernel b/include/tests_kernel
index 1a78bfcc..a77ac69a 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -144,7 +144,7 @@
                 Display --indent 4 --text "CPU support: PAE and/or NoeXecute supported" --result "${STATUS_FOUND}" --color GREEN
             else
                 Display --indent 4 --text "CPU support: No PAE or NoeXecute supported" --result "${STATUS_NONE}" --color YELLOW
-                ReportSuggestion ${TEST_NO} "Use a PAE enabled kernel when possible to gain native No eXecute/eXecute Disable support"
+                ReportSuggestion "${TEST_NO}" "Use a PAE enabled kernel when possible to gain native No eXecute/eXecute Disable support"
             fi
         else
             Display --indent 4 --text "CPU support: no /proc/cpuinfo" --result "${STATUS_SKIPPED}" --color YELLOW
@@ -394,7 +394,7 @@
                 LogText "Result: ${ROOTDIR}vmlinuz missing due to grsecurity; assuming ${FINDKERNEL}"
             else
                 LogText "This system is missing ${ROOTDIR}vmlinuz or ${ROOTDIR}boot/vmlinuz.  Unable to check whether kernel is up-to-date."
-                ReportSuggestion ${TEST_NO} "Determine why ${ROOTDIR}vmlinuz or ${ROOTDIR}boot/vmlinuz is missing on this Debian/Ubuntu system." "/vmlinuz or /boot/vmlinuz"
+                ReportSuggestion "${TEST_NO}" "Determine why ${ROOTDIR}vmlinuz or ${ROOTDIR}boot/vmlinuz is missing on this Debian/Ubuntu system." "/vmlinuz or /boot/vmlinuz"
             fi
             LogText "Test: Using apt-cache policy to determine if there is an update available"
             FINDINST=$(apt-cache policy ${FINDKERNEL} | ${EGREPBINARY} 'Installed' | ${CUTBINARY} -d ':' -f2 | ${TRBINARY} -d ' ')
@@ -406,7 +406,7 @@
                 LogText "Result: Exception occurred, no output from apt-cache policy"
                 if [ ${HAS_VMLINUZ} -eq 1 ]; then
                     ReportException "${TEST_NO}:01"
-                    ReportSuggestion ${TEST_NO} "Check the output of apt-cache policy to determine why its output is empty"
+                    ReportSuggestion "${TEST_NO}" "Check the output of apt-cache policy to determine why its output is empty"
                 fi
                 LogText "Result: apt-cache policy did not return an installed kernel version"
             else
@@ -422,7 +422,7 @@
                 else
                     Display --indent 2 --text "- Checking for available kernel update" --result "UPDATE AVAILABLE" --color YELLOW
                     LogText "Result: kernel update available according 'apt-cache policy'."
-                    ReportSuggestion ${TEST_NO} "Determine priority for available kernel update"
+                    ReportSuggestion "${TEST_NO}" "Determine priority for available kernel update"
                 fi
             fi
         else
@@ -465,13 +465,13 @@
                 TMP_COLOR="GREEN"
                 if [ ${SYSD_CORED_BASE_PROCSIZEMAX_NR_DISABLED} -gt 1 ] || [ ${SYSD_CORED_BASE_STORAGE_NR_DISABLED} -gt 1 ] || [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_DISABLED} -gt 1 ] || [ ${SYSD_CORED_SUB_STORAGE_NR_DISABLED} -gt 1 ]; then
                     LogText "Result: 'ProcessSizeMax=0' and 'Storage=none' are set multiple times in systemd configuration files. Check config!"
-                    ReportSuggestion ${TEST_NO} "Check systemd configuration for duplicate entries of core dump settings"
+                    ReportSuggestion "${TEST_NO}" "Check systemd configuration for duplicate entries of core dump settings"
                     TMP_COLOR="YELLOW"
                 fi
                 Display --indent 4 --text "- configuration in systemd conf files" --result "${STATUS_DISABLED}" --color "${TMP_COLOR}"
             elif [ ${SYSD_CORED_BASE_PROCSIZEMAX_NR_DISABLED} -ge 1 ] && [ ${SYSD_CORED_BASE_STORAGE_NR_DISABLED} -ge 1 ] && ( [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -ge 1 ] || [ ${SYSD_CORED_SUB_STORAGE_NR_ENABLED} -ge 1 ] ); then
                 LogText "Result: 'ProcessSizeMax=0' and 'Storage=none' are set in ${ROOTDIR}etc/systemd/coredump.conf but overwritten in subdir config files"
-                ReportSuggestion ${TEST_NO} "Check systemd configuration for overwriting core dump settings"
+                ReportSuggestion "${TEST_NO}" "Check systemd configuration for overwriting core dump settings"
                 Display --indent 4 --text "- configuration in systemd conf files" --result "${STATUS_ENABLED}" --color YELLOW
                 AddHP 0 1
             elif ( [ ${SYSD_CORED_BASE_PROCSIZEMAX_NR_ENABLED} -ge 1 ] && [ ${SYSD_CORED_BASE_STORAGE_NR_ENABLED} -ge 1 ] ) || \
@@ -479,7 +479,7 @@
                  ( [ ${SYSD_CORED_BASE_STORAGE_NR_ENABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -ge 1 ] ) || \
                  ( [ ${SYSD_CORED_SUB_PROCSIZEMAX_NR_ENABLED} -ge 1 ] && [ ${SYSD_CORED_SUB_STORAGE_NR_ENABLED} -ge 1 ] ); then
                 LogText "Result: core dumps are explicitely enabled in systemd configuration files"
-                ReportSuggestion ${TEST_NO} "If not required, consider explicit disabling of core dump in ${ROOTDIR}etc/systemd/coredump.conf ('ProcessSizeMax=0', 'Storage=none')"
+                ReportSuggestion "${TEST_NO}" "If not required, consider explicit disabling of core dump in ${ROOTDIR}etc/systemd/coredump.conf ('ProcessSizeMax=0', 'Storage=none')"
                 Display --indent 4 --text "- configuration in systemd conf files" --result "${STATUS_ENABLED}" --color RED
                 AddHP 0 1
             else
@@ -755,7 +755,7 @@
             AddHP 5 5
         elif [ ${REBOOT_NEEDED} -eq 1 ]; then
             Display --indent 2 --text "- Check if reboot is needed" --result "${STATUS_YES}" --color RED
-            ReportWarning ${TEST_NO} "Reboot of system is most likely needed" "" "text:reboot"
+            ReportWarning "${TEST_NO}" "Reboot of system is most likely needed" "" "text:reboot"
             AddHP 0 5
         else
             Display --indent 2 --text "- Check if reboot is needed" --result "${STATUS_UNKNOWN}" --color YELLOW
diff --git a/include/tests_kernel_hardening b/include/tests_kernel_hardening
index eba7504d..9599a708 100644
--- a/include/tests_kernel_hardening
+++ b/include/tests_kernel_hardening
@@ -106,7 +106,7 @@
         # Add suggestion if one or more sysctls have a different value than scan profile
         if [ ${FOUND} -eq 1 ]; then
             LogText "Result: found ${N} keys that can use tuning, according scan profile"
-            ReportSuggestion ${TEST_NO} "One or more sysctl values differ from the scan profile and could be tweaked" "" "Change sysctl value or disable test (skip-test=${TEST_NO}:<sysctl-key>)"
+            ReportSuggestion "${TEST_NO}" "One or more sysctl values differ from the scan profile and could be tweaked" "" "Change sysctl value or disable test (skip-test=${TEST_NO}:<sysctl-key>)"
         fi
     fi
 #
diff --git a/include/tests_logging b/include/tests_logging
index 7e595049..9c2ae9a6 100644
--- a/include/tests_logging
+++ b/include/tests_logging
@@ -47,7 +47,7 @@
         if [ -z "${FIND}" ]; then
             Display --indent 2 --text "- Checking for a running log daemon" --result "${STATUS_WARNING}" --color RED
             LogText "Result: Could not find a syslog daemon like syslog, syslog-ng, rsyslog, metalog, systemd-journal"
-            ReportSuggestion ${TEST_NO} "Check if any syslog daemon is running and correctly configured."
+            ReportSuggestion "${TEST_NO}" "Check if any syslog daemon is running and correctly configured."
             AddHP 0 3
         else
             Display --indent 2 --text "- Checking for a running log daemon" --result "${STATUS_OK}" --color GREEN
@@ -92,7 +92,7 @@
         else
             LogText "Result: Syslog-NG configuration file seems NOT to be consistent"
             Display --indent 6 --text "- Checking Syslog-NG consistency" --result "${STATUS_WARNING}" --color RED
-            ReportSuggestion ${TEST_NO} "Check the Syslog-NG configuration file and/or run a manual consistency check with: syslog-ng -s"
+            ReportSuggestion "${TEST_NO}" "Check the Syslog-NG configuration file and/or run a manual consistency check with: syslog-ng -s"
         fi
     fi
 #
@@ -191,7 +191,7 @@
             else
                 LogText "Result: No klogd found"
                 Display --indent 4 --text "- Checking klogd" --result "${STATUS_NOT_FOUND}" --color RED
-                ReportWarning ${TEST_NO} "klogd is not running, which could lead to missing kernel messages in log files"
+                ReportWarning "${TEST_NO}" "klogd is not running, which could lead to missing kernel messages in log files"
             fi
         else
             LogText "Result: test skipped, because other facility is being used to log kernel messages"
@@ -210,7 +210,7 @@
             Display --indent 4 --text "- Checking minilogd instances" --result "${STATUS_WARNING}" --color RED
             LogText "Result: minilogd found in process list"
             # minilogd daemon seems to be running
-            ReportWarning ${TEST_NO} "minilogd is running, which should normally not be running"
+            ReportWarning "${TEST_NO}" "minilogd is running, which should normally not be running"
         else
             Display --indent 4 --text "- Checking minilogd instances" --result "${STATUS_NOT_FOUND}" --color WHITE
             LogText "Result: No minilogd is running"
@@ -247,7 +247,7 @@
         else
             Display --indent 2 --text "- Checking logrotate presence" --result "${STATUS_WARNING}" --color RED
             LogText "Result: No logrotate configuration found"
-            ReportSuggestion ${TEST_NO} "Check if log files are properly rotated"
+            ReportSuggestion "${TEST_NO}" "Check if log files are properly rotated"
         fi
     fi
 #
@@ -328,8 +328,8 @@
         else
             Display --indent 2 --text "- Checking loghost entry" --result "${STATUS_WARNING}" --color RED
             LogText "Result: No loghost entry found"
-            ReportWarning ${TEST_NO} "No loghost entry found"
-            ReportSuggestion ${TEST_NO} "Add a loghost entry to /etc/inet/hosts or other name services"
+            ReportWarning "${TEST_NO}" "No loghost entry found"
+            ReportSuggestion "${TEST_NO}" "Add a loghost entry to /etc/inet/hosts or other name services"
         fi
     fi
 #
@@ -421,7 +421,7 @@
         if [ ${REMOTE_LOGGING_ENABLED} -eq 0 ]; then
             Report "remote_syslog_configured=0"
             LogText "Result: no remote logging found"
-            ReportSuggestion ${TEST_NO} "Enable logging to an external logging host for archiving purposes and additional protection"
+            ReportSuggestion "${TEST_NO}" "Enable logging to an external logging host for archiving purposes and additional protection"
             AddHP 1 3
             Display --indent 2 --text "- Checking remote logging" --result "NOT ENABLED" --color YELLOW
         else
@@ -556,7 +556,7 @@
                 Report "deleted_file[]=${I}"
             done
             Display --indent 2 --text "- Checking deleted files in use" --result "FILES FOUND" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Check what deleted files are still in use and why."
+            ReportSuggestion "${TEST_NO}" "Check what deleted files are still in use and why."
         else
             LogText "Result: no deleted files found"
             Display --indent 2 --text "- Checking deleted files in use" --result "${STATUS_DONE}" --color GREEN
diff --git a/include/tests_mac_frameworks b/include/tests_mac_frameworks
index 15d675a3..972bbb8a 100644
--- a/include/tests_mac_frameworks
+++ b/include/tests_mac_frameworks
@@ -83,7 +83,7 @@
                     Display --indent 4 --text "- Checking AppArmor status" --result "${STATUS_UNKNOWN}" --color RED
                 elif [ $? -eq 2 ]; then
                     LogText "Result: AppArmor is enabled, but no policy is loaded"
-                    ReportSuggestion ${TEST_NO} "Load AppArmor policies"
+                    ReportSuggestion "${TEST_NO}" "Load AppArmor policies"
                     Display --indent 4 --text "- Checking AppArmor status" --result "NON-ACTIVE" --color GREEN
                     Report "apparmor_enabled=1"
                     Report "apparmor_policy_loaded=0"
@@ -148,7 +148,7 @@
                 Display --indent 6 --text "- Checking current mode and config file" --result "${STATUS_OK}" --color GREEN
             else
                 LogText "Result: Current SELinux mode (${FIND}) is NOT the same as in config file (${FIND2})."
-                ReportWarning ${TEST_NO} "Current SELinux mode is different from config file (current: ${FIND}, config file: ${FIND2})"
+                ReportWarning "${TEST_NO}" "Current SELinux mode is different from config file (current: ${FIND}, config file: ${FIND2})"
                 Display --indent 6 --text "- Checking current mode and config file" --result "${STATUS_WARNING}" --color RED
             fi
             Display --indent 8 --text "Current SELinux mode: ${FIND}"
diff --git a/include/tests_mail_messaging b/include/tests_mail_messaging
index a5d116fc..63b43804 100644
--- a/include/tests_mail_messaging
+++ b/include/tests_mail_messaging
@@ -286,7 +286,7 @@
             Report "postfix_config_error=1"
             Display --indent 6 --text "- Postfix configuration errors" --result "${STATUS_WARNING}" --color RED
             LogText "Result: found an error or warning in the Postfix configuration. Manual check suggested."
-            ReportSuggestion ${TEST_NO} "Found a configuration error in Postfix" "${POSTFIX_CONFIGFILE}" "text:run postconf > /dev/null"
+            ReportSuggestion "${TEST_NO}" "Found a configuration error in Postfix" "${POSTFIX_CONFIGFILE}" "text:run postconf > /dev/null"
         else
             LogText "Result: all looks to be fine with Postfix configuration"
             if IsVerbose; then Display --indent 6 --text "- Postfix configuration errors" --result "${STATUS_OK}" --color GREEN; fi
@@ -327,8 +327,8 @@
         if [ ${SHOWWARNING} -eq 1 ]; then
             Display --indent 6 --text "- Postfix banner" --result "${STATUS_WARNING}" --color RED
             LogText "Result: found OS, or mail_name in SMTP banner, and/or mail_name contains 'Postfix'."
-            ReportWarning ${TEST_NO} "Found some information disclosure in SMTP banner (OS or software name)"
-            ReportSuggestion ${TEST_NO} "You are advised to hide the mail_name (option: smtpd_banner) from your postfix configuration. Use postconf -e or change your main.cf file (${POSTFIX_CONFIGFILE})"
+            ReportWarning "${TEST_NO}" "Found some information disclosure in SMTP banner (OS or software name)"
+            ReportSuggestion "${TEST_NO}" "You are advised to hide the mail_name (option: smtpd_banner) from your postfix configuration. Use postconf -e or change your main.cf file (${POSTFIX_CONFIGFILE})"
         else
             if IsVerbose; then Display --indent 6 --text "- Postfix banner" --result "${STATUS_OK}" --color GREEN; fi
         fi
diff --git a/include/tests_malware b/include/tests_malware
index e8d680c1..6718a10b 100644
--- a/include/tests_malware
+++ b/include/tests_malware
@@ -297,7 +297,7 @@
         else
             Display --indent 4 --text "- ${GEN_CHECKING} freshclam" --result "${STATUS_SUGGESTION}" --color YELLOW
             LogText "Result: freshclam is not running"
-            ReportSuggestion ${TEST_NO} "Confirm that freshclam is properly configured and keeps updating the ClamAV database"
+            ReportSuggestion "${TEST_NO}" "Confirm that freshclam is properly configured and keeps updating the ClamAV database"
         fi
     fi
 #
diff --git a/include/tests_memory_processes b/include/tests_memory_processes
index fc1789dc..6c1bf558 100644
--- a/include/tests_memory_processes
+++ b/include/tests_memory_processes
@@ -85,7 +85,7 @@
             LogText "Result: found one or more dead or zombie processes"
             LogText "Output: PIDs ${FIND}"
             Display --indent 2 --text "- Searching for dead/zombie processes" --result "${STATUS_FOUND}" --color RED
-            ReportSuggestion ${TEST_NO} "Check the output of ps for dead or zombie processes"
+            ReportSuggestion "${TEST_NO}" "Check the output of ps for dead or zombie processes"
         fi
     fi
 #
@@ -110,7 +110,7 @@
             LogText "More info: processes which show up with the status flag 'D' are often stuck, until a disk IO event finished. This can happen for example with network storage, where the connection or protocol settings are not logtext well configured."
             LogText "Output: PIDs ${FIND}"
             Display --indent 2 --text "- Searching for IO waiting processes" --result "${STATUS_FOUND}" --color RED
-            ReportSuggestion ${TEST_NO} "Check process listing for processes waiting for IO requests"
+            ReportSuggestion "${TEST_NO}" "Check process listing for processes waiting for IO requests"
         fi
     fi
 #
diff --git a/include/tests_nameservices b/include/tests_nameservices
index aa60885b..59983cac 100644
--- a/include/tests_nameservices
+++ b/include/tests_nameservices
@@ -84,7 +84,7 @@
                 if [ ${COUNT} -gt 6 ]; then
                     LogText "Result: Found ${COUNT} search domains"
                     Display --indent 2 --text "- Checking search domains" --result "${STATUS_WARNING}" --color YELLOW
-                    ReportWarning ${TEST_NO} "Found more than 6 search domains, which is usually more than the maximum allowed number in most resolvers"
+                    ReportWarning "${TEST_NO}" "Found more than 6 search domains, which is usually more than the maximum allowed number in most resolvers"
                 else
                     LogText "Result: Found ${COUNT} search domains"
                     Display --indent 2 --text "- Checking search domains" --result "${STATUS_FOUND}" --color GREEN
@@ -95,7 +95,7 @@
             if [ ! "${FIND}" = "0" -a ! "${FIND}" = "1" ]; then
                 LogText "Result: found ${FIND} line(s) with a search statement (expecting less than 2 lines)"
                 Display --indent 4 --text "- Checking search domains lines" --result "CONFIG ERROR" --color YELLOW
-                ReportWarning ${TEST_NO} "Found more than 1 search lines in /etc/resolv.conf, which is probably a misconfiguration"
+                ReportWarning "${TEST_NO}" "Found more than 1 search lines in /etc/resolv.conf, which is probably a misconfiguration"
             else
                 LogText "Result: found ${FIND} line(s) with a search statement (expecting less than 2 lines)"
             fi
@@ -204,7 +204,7 @@
             Display --indent 6 --text "Domain name: ${DOMAINNAME}"
         else
             Display --indent 2 --text "- Searching DNS domain name" --result "${STATUS_UNKNOWN}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Check DNS configuration for the dns domain name"
+            ReportSuggestion "${TEST_NO}" "Check DNS configuration for the dns domain name"
         fi
     fi
 #
@@ -324,7 +324,7 @@
             else
                 LogText "Result: possible errors found in ${BIND_CONFIG_LOCATION}"
                 Display --indent 4 --text "- Checking BIND configuration consistency" --result "${STATUS_WARNING}" --color RED
-                ReportWarning ${TEST_NO} "Errors discovered in BIND configuration file"
+                ReportWarning "${TEST_NO}" "Errors discovered in BIND configuration file"
             fi
         else
             LogText "Result: named-checkconf not found, skipping test"
@@ -347,8 +347,8 @@
         else
             LogText "Result: possible BIND version available in version banner"
             Display --indent 4 --text "- Checking BIND version in banner" --result "${STATUS_WARNING}" --color RED
-            ReportWarning ${TEST_NO} "Found BIND version in banner"
-            ReportSuggestion ${TEST_NO} "The version in BIND can be masked by defining 'version none' in the configuration file"
+            ReportWarning "${TEST_NO}" "Found BIND version in banner"
+            ReportSuggestion "${TEST_NO}" "The version in BIND can be masked by defining 'version none' in the configuration file"
             AddHP 0 2
         fi
     fi
@@ -599,7 +599,7 @@
             else
                 LogText "Result: No entry found for ${HOSTNAME} in ${ROOTDIR}etc/hosts"
                 Display --indent 4 --text "- Presence of configured hostname in /etc/hosts" --result "${STATUS_NOT_FOUND}" --color YELLOW
-                ReportSuggestion ${TEST_NO} "Add the IP name and FQDN to /etc/hosts for proper name resolving"
+                ReportSuggestion "${TEST_NO}" "Add the IP name and FQDN to /etc/hosts for proper name resolving"
                 LogText "Risk: No entry for the server name [hostname] in /etc/hosts may cause unexpected performance problems for local connections"
             fi
         else
@@ -621,7 +621,7 @@
             LogText "Output: ${DATA}"
             Display --indent 4 --text "- Hostname mapped to localhost" --result "${STATUS_FOUND}" --color YELLOW
             LogText "Information: Linking the hostname to the localhost entry may break some resolving. Split resolving so that localhost resolves back to 127.0.0.1 (and ::1) and the hostname of the machine to the real IP address on the network interface."
-            ReportSuggestion ${TEST_NO} "Split resolving between localhost and the hostname of the system"
+            ReportSuggestion "${TEST_NO}" "Split resolving between localhost and the hostname of the system"
         else
             LogText "Result: this server hostname is not mapped to a local address"
             Display --indent 4 --text "- Hostname mapped to localhost" --result "${STATUS_NOT_FOUND}" --color GREEN
@@ -654,7 +654,7 @@
             LogText "Result: this server hostname is not mapped to a local address"
             Display --indent 4 --text "- Localhost mapping to IP address" --result "${STATUS_SUGGESTION}" --color YELLOW
             LogText "Information: Ensure that localhost resolves back to 127.0.0.1 (and/or ::1)."
-            ReportSuggestion ${TEST_NO} "Split resolving between localhost and the hostname of the system" "/etc/hosts" "text:Check your localhost line"
+            ReportSuggestion "${TEST_NO}" "Split resolving between localhost and the hostname of the system" "/etc/hosts" "text:Check your localhost line"
         fi
     fi
 #
diff --git a/include/tests_networking b/include/tests_networking
index 36b86671..22dbcb53 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -147,8 +147,8 @@
                             Display --indent 8 --text "Nameserver: ${I}" --result "NO RESPONSE" --color RED
                             LogText "Result: nameserver ${I} does NOT respond"
                             LogText "Exit-code from dig: ${DNSRESPONSE}"
-                            ReportSuggestion ${TEST_NO} "Check connection to this nameserver and make sure no outbound DNS queries are blocked (port 53 UDP and TCP)."
-                            ReportWarning ${TEST_NO} "Nameserver ${I} does not respond"
+                            ReportSuggestion "${TEST_NO}" "Check connection to this nameserver and make sure no outbound DNS queries are blocked (port 53 UDP and TCP)."
+                            ReportWarning "${TEST_NO}" "Nameserver ${I} does not respond"
                         fi
                     else
                         LogText "Result: Nameserver test for ${I} skipped, 'dig' not installed"
@@ -171,9 +171,9 @@
             if [ ${NUMBERACTIVENS} -lt 2 ]; then
                 Display --indent 4 --text "- Minimal of 2 responsive nameservers" --result "${STATUS_WARNING}" --color RED
                 LogText "Result: less than 2 responsive nameservers found"
-                ReportWarning ${TEST_NO} "Couldn't find 2 responsive nameservers"
+                ReportWarning "${TEST_NO}" "Couldn't find 2 responsive nameservers"
                 LogText "Note: Non responsive nameservers can give problems for your system(s). Like the lack of recursive lookups, bad connectivity to update servers etc."
-                ReportSuggestion ${TEST_NO} "Check your resolv.conf file and fill in a backup nameserver if possible"
+                ReportSuggestion "${TEST_NO}" "Check your resolv.conf file and fill in a backup nameserver if possible"
                 AddHP 1 2
             else
                 Display --indent 4 --text "- Minimal of 2 responsive nameservers" --result "${STATUS_OK}" --color GREEN
@@ -489,7 +489,7 @@
                 # Check if this interface was whitelisted
                 if [ ${WHITELISTED} -eq 0 ]; then
                     FOUNDPROMISC=1
-                    ReportWarning ${TEST_NO} "Found promiscuous interface (${I})"
+                    ReportWarning "${TEST_NO}" "Found promiscuous interface (${I})"
                     LogText "Note: some tools put an interface into promiscuous mode, to capture/log network traffic"
                 else
                     LogText "Result: Found promiscuous interface ${I} (*whitelisted via profile*)"
@@ -539,7 +539,7 @@
                     ISWHITELISTED=$(${GREPBINARY} "^if_promisc:${I}:" ${PROFILE})
                     if [ -z "${ISWHITELISTED}" ]; then
                         FOUNDPROMISC=1
-                        ReportWarning ${TEST_NO} "Found promiscuous interface" "${I}" "text:Determine if this mode is required or whitelist interface in profile"
+                        ReportWarning "${TEST_NO}" "Found promiscuous interface" "${I}" "text:Determine if this mode is required or whitelist interface in profile"
                         LogText "Note: some tools put an interface into promiscuous mode, to capture/log network traffic"
                     else
                         LogText "Result: Found promiscuous interface ${I} (*whitelisted via profile*)"
diff --git a/include/tests_php b/include/tests_php
index b58d1758..d84b181a 100644
--- a/include/tests_php
+++ b/include/tests_php
@@ -230,7 +230,7 @@
         if [ ${FOUND} -eq 0 ]; then
             LogText "Result: all PHP functions can be executed"
             Display --indent 4 --text "- Checking PHP disabled functions" --result "${STATUS_NONE}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Harden PHP by disabling risky functions"
+            ReportSuggestion "${TEST_NO}" "Harden PHP by disabling risky functions"
             LogText "Functions of interest to research/disable: chown, diskfreespace, disk_free_space, disk_total_space, dl, exec, escapeshellarg, escapeshellcmd, fileinode, highlight_file, max_execution_time, passthru, pclose, phpinfo, popen, proc_close, proc_open, proc_get_status, proc_nice, proc_open, proc_terminate, set_time_limit, shell_exec, show_source, system)"
             AddHP 0 1
         else
@@ -268,8 +268,8 @@
         FIND=$(${EGREPBINARY} -i 'register_globals.*(on|yes|1)' ${PHPINIFILE} | ${GREPBINARY} -v '^;')
         if [ -n "${FIND}" ]; then
             Display --indent 4 --text "- Checking register_globals option" --result "${STATUS_WARNING}" --color RED
-            ReportWarning ${TEST_NO} "PHP option register_globals option is turned on, which can be a risk for variable value overwriting"
-            ReportSuggestion ${TEST_NO} "Change the register_globals line to: register_globals = Off"
+            ReportWarning "${TEST_NO}" "PHP option register_globals option is turned on, which can be a risk for variable value overwriting"
+            ReportSuggestion "${TEST_NO}" "Change the register_globals line to: register_globals = Off"
             LogText "Result: register_globals option is turned on, which can be a risk for variable value overwriting."
             AddHP 1 2
         else
@@ -302,7 +302,7 @@
 
         if [ ${FOUND} -eq 1 ]; then
             Display --indent 4 --text "- Checking expose_php option" --result "${STATUS_ON}" --color RED
-            ReportSuggestion ${TEST_NO} "Turn off PHP information exposure" "expose_php = Off" "-"
+            ReportSuggestion "${TEST_NO}" "Turn off PHP information exposure" "expose_php = Off" "-"
             Report "Result: expose_php option is turned on, which can expose useful information for an attacker"
             AddHP 1 3
         else
@@ -325,7 +325,7 @@
         if [ -n "${FIND}" ]; then
             Display --indent 4 --text "- Checking enable_dl option" --result "${STATUS_ON}" --color YELLOW
             Report "Result: enable_dl option is turned on, which can be used to enable more modules dynamically and circumventing security controls"
-            ReportSuggestion ${TEST_NO} "Change the enable_dl line to: enable_dl = Off, to disable dynamically loading new modules"
+            ReportSuggestion "${TEST_NO}" "Change the enable_dl line to: enable_dl = Off, to disable dynamically loading new modules"
             AddHP 0 1
         else
             Display --indent 4 --text "- Checking enable_dl option" --result "${STATUS_OFF}" --color GREEN
@@ -347,7 +347,7 @@
         if [ -z "${FIND}" ]; then
             Display --indent 4 --text "- Checking allow_url_fopen option" --result "${STATUS_ON}" --color YELLOW
             LogText "Result: allow_url_fopen option is turned on, which can be used for downloads via PHP and is a security risk"
-            ReportSuggestion ${TEST_NO} "Change the allow_url_fopen line to: allow_url_fopen = Off, to disable downloads via PHP"
+            ReportSuggestion "${TEST_NO}" "Change the allow_url_fopen line to: allow_url_fopen = Off, to disable downloads via PHP"
             AddHP 0 1
         else
             Display --indent 4 --text "- Checking allow_url_fopen option" --result "${STATUS_OFF}" --color GREEN
@@ -370,7 +370,7 @@
         if [ -z "${FIND}" ]; then
             Display --indent 4 --text "- Checking allow_url_include option" --result "${STATUS_ON}" --color YELLOW
             Report "Result: allow_url_include option is turned on, which can be used for downloads via PHP and is a risk"
-            ReportSuggestion ${TEST_NO} "Change the allow_url_include line to: allow_url_include = Off, to disable downloads via PHP"
+            ReportSuggestion "${TEST_NO}" "Change the allow_url_include line to: allow_url_include = Off, to disable downloads via PHP"
             AddHP 0 1
         else
             Display --indent 4 --text "- Checking allow_url_include option" --result "${STATUS_OFF}" --color GREEN
@@ -419,7 +419,7 @@
     #    if [ -n "${MAJOR_VERSION}" -a ${FOUND} -eq 1 ]; then
     #        LogText "Test: Check Suhosin for PHP 7 is not enabled"
     #        LogText "Result: Suhosin for PHP 7 is in alpha stage and should not be used in production"
-    #        ReportSuggestion ${TEST_NO} "Disable Suhosin for PHP 7"
+    #        ReportSuggestion "${TEST_NO}" "Disable Suhosin for PHP 7"
     #        Display --indent 4 --text "- Checking PHP suhosin extension status" --result "${STATUS_WARNING}" --color RED
     #        Display --indent 6 --text "- Suhosin is enabled for PHP 7" --result "${STATUS_WARNING}" --color RED
     #        AddHP 0 1
@@ -433,7 +433,7 @@
     #        if [ ${FOUND} -eq 0 ]; then
     #            LogText "Result: Suhosin extension is not enabled"
     #            Display --indent 4 --text "- Checking PHP suhosin extension status" --result "${STATUS_WARNING}" --color RED
-    #            ReportSuggestion ${TEST_NO} "Harden PHP by enabling suhosin extension"
+    #            ReportSuggestion "${TEST_NO}" "Harden PHP by enabling suhosin extension"
     #            LogText "suhosin extension is not enabled"
     #            AddHP 0 1
     #        else
@@ -449,7 +449,7 @@
     #        else
     #            LogText "Result: Suhosin simulation mode is active"
     #            Display --indent 6 --text "- Suhosin simulation mode status" --result "${STATUS_WARNING}" --color RED
-    #            ReportSuggestion ${TEST_NO} "Harden PHP by deactivating suhosin simulation mode"
+    #            ReportSuggestion "${TEST_NO}" "Harden PHP by deactivating suhosin simulation mode"
     #            LogText "suhosin simulation mode is active"
     #            AddHP 0 1
     #        fi
diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 12329cc8..4d037bf7 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -372,7 +372,7 @@
         else
             Display --indent 2 --text "- Using Zypper to find vulnerable packages" --result "${STATUS_WARNING}" --color RED
             LogText "Result: Zypper found one or more installed packages which are vulnerable."
-            ReportWarning ${TEST_NO} "Found one or more vulnerable packages installed"
+            ReportWarning "${TEST_NO}" "Found one or more vulnerable packages installed"
             # Unfortunately zypper does not properly give back which package it is. Usually best guess is last word on the line
             FIND=$(${ZYPPERBINARY} --non-interactive lp | ${AWKBINARY} '{ if ($5=="security" || $7=="security") { print $NF }}' | ${SEDBINARY} 's/:$//' | ${GREPBINARY} -v "^$" | ${SORTBINARY} -u)
             LogText "List of vulnerable packages/version:"
@@ -487,7 +487,7 @@
                 COUNT=$((COUNT + 1))
                 LogText "Found unpurged package: ${J}"
             done
-            ReportSuggestion ${TEST_NO} "Purge old/removed packages (${COUNT} found) with aptitude purge or dpkg --purge command. This will cleanup old configuration files, cron jobs and startup scripts."
+            ReportSuggestion "${TEST_NO}" "Purge old/removed packages (${COUNT} found) with aptitude purge or dpkg --purge command. This will cleanup old configuration files, cron jobs and startup scripts."
         fi
     else
         LogText "Result: dpkg can NOT be found on this system, test skipped"
@@ -510,7 +510,7 @@
             else
                 Display --indent 2 --text "- Checking presence old distfiles" --result "${STATUS_WARNING}" --color YELLOW
                 LogText "Result: found ${FIND} unused distfiles"
-                ReportSuggestion ${TEST_NO} "Unused distfiles found. Use portsclean to delete these files. For example: portsclean -DD."
+                ReportSuggestion "${TEST_NO}" "Unused distfiles found. Use portsclean to delete these files. For example: portsclean -DD."
             fi
         fi
     fi
@@ -561,7 +561,7 @@
                 # Decrease hardening points for every found vulnerable package
                 AddHP 1 2
             done
-            ReportWarning ${TEST_NO} "Found one or more vulnerable packages. Run: dnf upgrade"
+            ReportWarning "${TEST_NO}" "Found one or more vulnerable packages. Run: dnf upgrade"
             Display --indent 2 --text "- Using DNF to find vulnerable packages" --result "${STATUS_WARNING}" --color RED
         else
             LogText "Result: no security updates found"
@@ -618,13 +618,13 @@
                 LogText "Result: no cron job is configured for debsecan"
                 Display --indent 4 --text "- debsecan cron job" --result "${STATUS_NOT_FOUND}" --color YELLOW
                 AddHP 1 3
-                ReportSuggestion ${TEST_NO} "Check debsecan cron job and ensure it is enabled"
+                ReportSuggestion "${TEST_NO}" "Check debsecan cron job and ensure it is enabled"
             fi
         else
             LogText "Result: debsecan is not installed."
             Display --indent 4 --text "- debsecan utility" --result "${STATUS_NOT_FOUND}" --color YELLOW
             AddHP 0 2
-            ReportSuggestion ${TEST_NO} "Install debsecan to check for vulnerabilities on installed packages."
+            ReportSuggestion "${TEST_NO}" "Install debsecan to check for vulnerabilities on installed packages."
         fi
     fi
 #
@@ -655,7 +655,7 @@
         else
             LogText "Result: debsums utility is not installed."
             AddHP 0 2
-            ReportSuggestion ${TEST_NO} "Install debsums utility for the verification of packages with known good database."
+            ReportSuggestion "${TEST_NO}" "Install debsums utility for the verification of packages with known good database."
         fi
     fi
 #
@@ -702,7 +702,7 @@
                 else
                     Display --indent 2 --text "- Checking pkg_admin audit to obtain vulnerable packages" --result "${STATUS_WARNING}" --color RED
                     LogText "Result: pkg_admin audit found one or more installed packages which are vulnerable."
-                    ReportWarning ${TEST_NO} "Found one or more vulnerable packages."
+                    ReportWarning "${TEST_NO}" "Found one or more vulnerable packages."
                     LogText "List of vulnerable packages/version:"
                     for I in $(${ROOTDIR}usr/sbin/pkg_admin audit | ${AWKBINARY} '{ print $2 }' | ${SORTBINARY} -u); do
                         VULNERABLE_PACKAGES_FOUND=1
@@ -755,7 +755,7 @@
                         LogText "Vulnerable package: ${ITEM}"
                         AddHP 1 2
                     done
-                    ReportWarning ${TEST_NO} "Found vulnerable packages" "${COUNT} vulnerable packages" "text:Run pkg audit"
+                    ReportWarning "${TEST_NO}" "Found vulnerable packages" "${COUNT} vulnerable packages" "text:Run pkg audit"
                 else
                     LogText "Result: found an exit code greater than zero, yet no output"
                 fi
@@ -786,8 +786,8 @@
         else
             Display --indent 2 --text "- Checking portaudit to obtain vulnerabilities" --result "${STATUS_WARNING}" --color RED
             LogText "Result: Portaudit found one or more installed packages which are vulnerable."
-            ReportWarning ${TEST_NO} "Found one or more vulnerable packages."
-            ReportSuggestion ${TEST_NO} "Update your system with portupgrade or other tools"
+            ReportWarning "${TEST_NO}" "Found one or more vulnerable packages."
+            ReportSuggestion "${TEST_NO}" "Update your system with portupgrade or other tools"
             LogText "List of vulnerable packages/version:"
             for PKG in $(${ROOTDIR}usr/local/sbin/portaudit | ${GREPBINARY} "Affected package" | ${CUTBINARY} -d ' ' -f3 | ${SORTBINARY} -u); do
                 VULNERABLE_PACKAGES_FOUND=1
@@ -812,7 +812,7 @@
         if [ -z "${FIND}" -o "${FIND}" = "0" ]; then
             LogText "Result: YUM package update management failed"
             Display --indent 2 --text "- YUM package management consistency" --result "${STATUS_WARNING}" --color RED
-            ReportWarning ${TEST_NO} "YUM is not properly configured or registered for this platform (no repolist found)"
+            ReportWarning "${TEST_NO}" "YUM is not properly configured or registered for this platform (no repolist found)"
         else
             LogText "Result: YUM repository available (${FIND})"
             Display --indent 2 --text "- YUM package management consistency" --result "${STATUS_OK}" --color GREEN
@@ -838,8 +838,8 @@
             else
                 LogText "Result: One or more duplicate packages found"
                 Display --indent 2 --text "- Checking package database duplicates" --result "${STATUS_WARNING}" --color RED
-                ReportWarning ${TEST_NO} "Found one or more duplicate packages installed"
-                ReportSuggestion ${TEST_NO} "Run package-cleanup to solve duplicate package problems"
+                ReportWarning "${TEST_NO}" "Found one or more duplicate packages installed"
+                ReportSuggestion "${TEST_NO}" "Run package-cleanup to solve duplicate package problems"
             fi
 
             # Check for package database problems
@@ -851,13 +851,13 @@
             else
                 LogText "Result: One or more problems found in package database"
                 Display --indent 2 --text "- Checking package database for problems" --result "${STATUS_WARNING}" --color RED
-                ReportWarning ${TEST_NO} "Found one or more problems in the package database"
-                ReportSuggestion ${TEST_NO} "Run package-cleanup to solve package problems"
+                ReportWarning "${TEST_NO}" "Found one or more problems in the package database"
+                ReportSuggestion "${TEST_NO}" "Run package-cleanup to solve package problems"
             fi
         else
             Display --indent 2 --text "- yum-utils package not installed" --result "${STATUS_SUGGESTION}" --color YELLOW
             LogText "Result: YUM utils package not found"
-            ReportSuggestion ${TEST_NO} "Install package 'yum-utils' for better consistency checking of the package database"
+            ReportSuggestion "${TEST_NO}" "Install package 'yum-utils' for better consistency checking of the package database"
         fi
     fi
 #
@@ -927,12 +927,12 @@
                     LogText "Vulnerable package: ${I}"
                     AddHP 1 2
                 done
-                ReportWarning ${TEST_NO} "Found one or more vulnerable packages."
+                ReportWarning "${TEST_NO}" "Found one or more vulnerable packages."
             fi
         else
             LogText "Result: yum-security package not found"
             Display --indent 2 --text "- Checking missing security packages" --result "${STATUS_SKIPPED}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Install package yum-plugin-security if possible, to maintain security updates easier (yum install yum-plugin-security)"
+            ReportSuggestion "${TEST_NO}" "Install package yum-plugin-security if possible, to maintain security updates easier (yum install yum-plugin-security)"
         fi
     fi
 #
@@ -973,7 +973,7 @@
                 AddHP 3 3
             else
                 Display --indent 2 --text "- Checking GPG checks (yum.conf)" --result "${STATUS_DISABLED}" --color RED
-                ReportWarning ${TEST_NO} "No GPG signing option found in yum.conf"
+                ReportWarning "${TEST_NO}" "No GPG signing option found in yum.conf"
                 AddHP 2 3
             fi
         fi
@@ -1019,7 +1019,7 @@
                 AddHP 3 3
             else
                 Display --indent 2 --text "- Checking security repository in sources.list file or directory" --result "${STATUS_WARNING}" --color RED
-                ReportWarning ${TEST_NO} "Can't find any security repository in /etc/apt/sources.list or sources.list.d directory"
+                ReportWarning "${TEST_NO}" "Can't find any security repository in /etc/apt/sources.list or sources.list.d directory"
                 AddHP 0 3
             fi
         else
@@ -1043,8 +1043,8 @@
         else
             LogText "Result: package database is most likely NOT consistent"
             Display --indent 2 --text "- Checking APT package database" --result "${STATUS_WARNING}" --color RED
-            ReportWarning ${TEST_NO} "apt-get check returned a non successful exit code."
-            ReportSuggestion ${TEST_NO} "Run apt-get to perform a manual package database consistency check."
+            ReportWarning "${TEST_NO}" "apt-get check returned a non successful exit code."
+            ReportSuggestion "${TEST_NO}" "Run apt-get to perform a manual package database consistency check."
         fi
     fi
 #
@@ -1080,7 +1080,7 @@
             # Check if we get the proper line back and amount of security patches available
             if [ -z "${FIND}" ]; then
                 LogText "Result: did not find security updates line"
-                ReportSuggestion ${TEST_NO} "Check if system is up-to-date, security updates test (apt-check) gives an unexpected result"
+                ReportSuggestion "${TEST_NO}" "Check if system is up-to-date, security updates test (apt-check) gives an unexpected result"
                 ReportException "${TEST_NO}:1" "Apt-check did not provide any result"
             else
                 if [ "${FIND}" = "0" ]; then
@@ -1113,8 +1113,8 @@
         fi
         if [ ${SCAN_PERFORMED} -eq 1 ]; then
             if [ ${VULNERABLE_PACKAGES_FOUND} -eq 1 ]; then
-                ReportWarning ${TEST_NO} "Found one or more vulnerable packages."
-                ReportSuggestion ${TEST_NO} "Update your system with apt-get update, apt-get upgrade, apt-get dist-upgrade and/or unattended-upgrades"
+                ReportWarning "${TEST_NO}" "Found one or more vulnerable packages."
+                ReportSuggestion "${TEST_NO}" "Update your system with apt-get update, apt-get upgrade, apt-get dist-upgrade and/or unattended-upgrades"
                 Display --indent 2 --text "- Checking vulnerable packages" --result "${STATUS_WARNING}" --color RED
             else
                 Display --indent 2 --text "- Checking vulnerable packages" --result "${STATUS_OK}" --color GREEN
@@ -1173,7 +1173,7 @@
             fi
         else
             LogText "Result: glsa-check tool not found"
-            ReportSuggestion ${TEST_NO} "Use Emerge to install the gentoolkit package, which includes glsa-check tool for additional security checks."
+            ReportSuggestion "${TEST_NO}" "Use Emerge to install the gentoolkit package, which includes glsa-check tool for additional security checks."
         fi
     fi
 #
@@ -1205,7 +1205,7 @@
         else
             LogText "Result: ${ROOTDIR}usr/bin/apt-show-versions not found"
             Display --indent 2 --text "- Checking upgradeable packages" --result "${STATUS_SKIPPED}" --color WHITE
-            ReportSuggestion ${TEST_NO} "Install package apt-show-versions for patch management purposes"
+            ReportSuggestion "${TEST_NO}" "Install package apt-show-versions for patch management purposes"
         fi
     fi
 
@@ -1219,7 +1219,7 @@
         LogText "Test: checking for package audit tool"
         if [ ${PACKAGE_AUDIT_TOOL_FOUND} -eq 0 ]; then
             Display --indent 2 --text "- Checking package audit tool" --result "${STATUS_NONE}" --color RED
-            ReportSuggestion ${TEST_NO} "Install a package audit tool to determine vulnerable packages"
+            ReportSuggestion "${TEST_NO}" "Install a package audit tool to determine vulnerable packages"
             LogText "Result: no package audit tool found"
         else
             Display --indent 2 --text "- Checking package audit tool" --result INSTALLED --color GREEN
diff --git a/include/tests_printers_spools b/include/tests_printers_spools
index d7483d63..148bc007 100644
--- a/include/tests_printers_spools
+++ b/include/tests_printers_spools
@@ -55,7 +55,7 @@
                 LogText "Result: chkprintcap did NOT gave any warnings"
             else
                 Display --indent 2 --text "- Integrity check of printcap file" --result "${STATUS_WARNING}" --color RED
-                ReportSuggestion ${TEST_NO} "Run chkprintcap manually to test printcap file"
+                ReportSuggestion "${TEST_NO}" "Run chkprintcap manually to test printcap file"
                 LogText "Output from chkprintcap: ${FIND}"
                 LogText "Run chkprintcap and check the ${ROOTDIR}etc/printcap file"
             fi
@@ -124,7 +124,7 @@
                 ;;
             * )
                 Display --indent 4 --text "- File permissions" --result "${STATUS_WARNING}" --color RED
-                ReportSuggestion ${TEST_NO} "Access to CUPS configuration could be more strict."
+                ReportSuggestion "${TEST_NO}" "Access to CUPS configuration could be more strict."
                 AddHP 1 2
                 ;;
         esac
@@ -157,12 +157,12 @@
                 AddHP 2 2
             else
                 LogText "Result: CUPS daemon running on one or more interfaces (not limited to localhost)"
-                ReportSuggestion ${TEST_NO} "Check CUPS configuration if it really needs to listen on the network"
+                ReportSuggestion "${TEST_NO}" "Check CUPS configuration if it really needs to listen on the network"
                 AddHP 1 2
             fi
         else
             LogText "Result: CUPS daemon is running on several network addresses"
-            ReportSuggestion ${TEST_NO} "Check CUPS configuration if it really needs to run on several network addresses"
+            ReportSuggestion "${TEST_NO}" "Check CUPS configuration if it really needs to run on several network addresses"
             AddHP 1 2
         fi
 
@@ -240,7 +240,7 @@
             if [ ${QDAEMON_CONFIG_ENABLED} -eq 1 ]; then
                 LogText "Result: qdaemon daemon not running"
                 Display --indent 2 --text "- Checking qdaemon daemon" --result "${STATUS_NOT_RUNNING}" --color RED
-                ReportSuggestion ${TEST_NO} "Activate print spooler daemon (qdaemon) in order to process print jobs"
+                ReportSuggestion "${TEST_NO}" "Activate print spooler daemon (qdaemon) in order to process print jobs"
             else
                 LogText "Result: qdaemon daemon not running"
                 Display --indent 2 --text "- Checking qdaemon daemon" --result "${STATUS_NOT_RUNNING}" --color WHITE
@@ -267,7 +267,7 @@
                 done
                 LogText "Result: Found ${COUNT} old print jobs in /var/spool/lpd/qdir"
                 Display --indent 4 --text "- Checking old print jobs" --result "${STATUS_FOUND}" --color YELLOW
-                ReportSuggestion ${TEST_NO} "Check old print jobs in /var/spool/lpd/qdir to prevent new jobs from being processed"
+                ReportSuggestion "${TEST_NO}" "Check old print jobs in /var/spool/lpd/qdir to prevent new jobs from being processed"
                 LogText "Risk: Failed or defunct print jobs can occupy a lot of space and in some cases, prevent new jobs from being processed"
             else
                 LogText "Result: Old print jobs not found in /var/spool/lpd/qdir"
diff --git a/include/tests_shells b/include/tests_shells
index 480166be..f440da5a 100644
--- a/include/tests_shells
+++ b/include/tests_shells
@@ -61,7 +61,7 @@
             LogText "Result: Found insecure console in ${ROOTDIR}etc/ttys. Single user mode login without password allowed!"
             LogText "Output ${ROOTDIR}etc/ttys:"
             LogText "${FIND}"
-            ReportWarning ${TEST_NO} "Found unprotected console in ${ROOTDIR}etc/ttys"
+            ReportWarning "${TEST_NO}" "Found unprotected console in ${ROOTDIR}etc/ttys"
             LogText "Possible solution: Change the console line from 'secure' to 'insecure'."
         fi
     fi
diff --git a/include/tests_snmp b/include/tests_snmp
index 20c61f3b..6253f542 100644
--- a/include/tests_snmp
+++ b/include/tests_snmp
@@ -93,7 +93,7 @@
             AddHP 2 2
         else
             Display --indent 2 --text "- Checking SNMP community strings" --result "${STATUS_WARNING}" --color RED
-            ReportWarning ${TEST_NO} "Found easy guessable SNMP community string"
+            ReportWarning "${TEST_NO}" "Found easy guessable SNMP community string"
         fi
     fi
 #
diff --git a/include/tests_squid b/include/tests_squid
index f6070507..075ecbb4 100644
--- a/include/tests_squid
+++ b/include/tests_squid
@@ -135,8 +135,8 @@
         if [ -n "${FIND}" ]; then
             LogText "Result: file ${SQUID_DAEMON_CONFIG} is world readable, writable or executable and could leak information or passwords"
             Display --indent 4 --text "- Checking Squid configuration file permissions" --result "${STATUS_WARNING}" --color RED
-            ReportSuggestion ${TEST_NO} "Check file permissions of ${SQUID_DAEMON_CONFIG} to limit access"
-            ReportWarning ${TEST_NO} "File permissions of ${SQUID_DAEMON_CONFIG} are not restrictive"
+            ReportSuggestion "${TEST_NO}" "Check file permissions of ${SQUID_DAEMON_CONFIG} to limit access"
+            ReportWarning "${TEST_NO}" "File permissions of ${SQUID_DAEMON_CONFIG} are not restrictive"
             AddHP 0 2
         else
             LogText "Result: file ${SQUID_DAEMON_CONFIG} has proper file permissions"
@@ -231,13 +231,13 @@
         if IsEmpty "${FIND}"; then
             LogText "Result: no Safe_ports found"
             Display --indent 6 --text "- Checking ACL 'Safe_ports' http_access option" --result "${STATUS_NOT_FOUND}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Check if Squid has been configured to restrict access to all safe ports"
+            ReportSuggestion "${TEST_NO}" "Check if Squid has been configured to restrict access to all safe ports"
         else
             LogText "Result: checking ACL safe ports"
             FIND2=$(${GREPBINARY} "^acl Safe_ports port" ${SQUID_DAEMON_CONFIG} | ${AWKBINARY} '{ print $4 }')
             if IsEmpty "${FIND2}"; then
                 Display --indent 6 --text "- Checking ACL 'Safe_ports' ports" --result "NONE FOUND" --color YELLOW
-                ReportSuggestion ${TEST_NO} "Check if Squid has been configured for which ports it can allow outgoing traffic (Safe_ports)"
+                ReportSuggestion "${TEST_NO}" "Check if Squid has been configured for which ports it can allow outgoing traffic (Safe_ports)"
                 AddHP 0 1
             else
                 LogText "Result: Safe_ports found"
@@ -256,7 +256,7 @@
                     AddHP 1 1
                 else
                     Display --indent 6 --text "- Checking ACL 'Safe_ports' (port ${ITEM})" --result "${STATUS_FOUND}" --color RED
-                    ReportWarning ${TEST_NO} "Squid configuration possibly allows relaying traffic via configured Safe_port ${ITEM}"
+                    ReportWarning "${TEST_NO}" "Squid configuration possibly allows relaying traffic via configured Safe_port ${ITEM}"
                     AddHP 0 1
                 fi
             done
@@ -282,7 +282,7 @@
             LogText "Result: option reply_body_max_size not configured"
             Display --indent 6 --text "- Checking option: reply_body_max_size" --result "${STATUS_NONE}" --color RED
             AddHP 1 2
-            ReportSuggestion ${TEST_NO} "Configure Squid option reply_body_max_size to limit the upper size of requests."
+            ReportSuggestion "${TEST_NO}" "Configure Squid option reply_body_max_size to limit the upper size of requests."
         else
             LogText "Result: option reply_body_max_size configured"
             LogText "Output: ${FIND}"
@@ -309,7 +309,7 @@
             LogText "Result: option httpd_suppress_version_string not configured"
             Display --indent 6 --text "- Checking option: httpd_suppress_version_string" --result "${STATUS_NOT_FOUND}" --color YELLOW
             AddHP 1 2
-            ReportSuggestion ${TEST_NO} "Configure Squid option httpd_suppress_version_string (on) to suppress the version."
+            ReportSuggestion "${TEST_NO}" "Configure Squid option httpd_suppress_version_string (on) to suppress the version."
         else
             LogText "Result: option httpd_suppress_version_string configured"
             LogText "Output: ${FIND}"
diff --git a/include/tests_ssh b/include/tests_ssh
index eb3b9134..5c8b3775 100644
--- a/include/tests_ssh
+++ b/include/tests_ssh
@@ -267,13 +267,13 @@
                     AddHP 3 3
                 elif [ "${RESULT}" = "MIDSCORED" ]; then
                     LogText "Result: OpenSSH option ${OPTIONNAME} is configured reasonably"
-                    ReportSuggestion ${TEST_NO} "Consider hardening SSH configuration" "${OPTIONNAME} (set ${FOUNDVALUE} to ${EXPECTEDVALUE})" "-"
+                    ReportSuggestion "${TEST_NO}" "Consider hardening SSH configuration" "${OPTIONNAME} (set ${FOUNDVALUE} to ${EXPECTEDVALUE})" "-"
                     ReportDetails --test "${TEST_NO}" --service "sshd" --field "${OPTIONNAME}" --value "${FOUNDVALUE}" --preferredvalue "${EXPECTEDVALUE}" --description "sshd option ${OPTIONNAME}"
                     Display --indent 4 --text "- OpenSSH option: ${OPTIONNAME}" --result "${STATUS_SUGGESTION}" --color YELLOW
                     AddHP 1 3
                 elif [ "${RESULT}" = "WEAK" ]; then
                     LogText "Result: OpenSSH option ${OPTIONNAME} is in a weak configuration state and should be fixed"
-                    ReportSuggestion ${TEST_NO} "Consider hardening SSH configuration" "${OPTIONNAME} (set ${FOUNDVALUE} to ${EXPECTEDVALUE})" "-"
+                    ReportSuggestion "${TEST_NO}" "Consider hardening SSH configuration" "${OPTIONNAME} (set ${FOUNDVALUE} to ${EXPECTEDVALUE})" "-"
                     ReportDetails --test "${TEST_NO}" --service "sshd" --field "${OPTIONNAME}" --value "${FOUNDVALUE}" --preferredvalue "${EXPECTEDVALUE}" --description "sshd option ${OPTIONNAME}"
                     Display --indent 4 --text "- OpenSSH option: ${OPTIONNAME}" --result "${STATUS_SUGGESTION}" --color YELLOW
                     AddHP 0 3
diff --git a/include/tests_storage_nfs b/include/tests_storage_nfs
index bfc5192d..3d3ceab5 100644
--- a/include/tests_storage_nfs
+++ b/include/tests_storage_nfs
@@ -149,7 +149,7 @@
         if [ ${NFS_EXPORTS_EMPTY} -eq 1 ]; then
             Display --indent 6 --text "- Checking empty /etc/exports" --result "${STATUS_SUGGESTION}" --color YELLOW
             LogText "Result: ${ROOTDIR}etc/exports seems to have no exported file systems"
-            ReportSuggestion ${TEST_NO} "/etc/exports has no exported file systems, while NFS daemon is running. Check if NFS needs to run on this system"
+            ReportSuggestion "${TEST_NO}" "/etc/exports has no exported file systems, while NFS daemon is running. Check if NFS needs to run on this system"
         fi
     fi
 #
@@ -164,7 +164,7 @@
         if [ -n "${sFIND}" ]; then
             LogText "Result: all client are allowed to access a NFS share in /etc/exports"
             Display --indent 4 --text "- Checking NFS client access" --result "ALL CLIENTS" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Specify clients that are allowed to access a NFS share /etc/exports"
+            ReportSuggestion "${TEST_NO}" "Specify clients that are allowed to access a NFS share /etc/exports"
             AddHP 2 3
         else
             LogText "Result: only some clients are allowed to access a NFS share"
diff --git a/include/tests_time b/include/tests_time
index 4513cb9a..d3bda505 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -189,7 +189,7 @@
                 NTP_CONFIG_TYPE_STARTUP=1
                 # Only show suggestion when ntpdate is enabled, however ntpd is not running
                 if [ ${NTP_DAEMON_RUNNING} -eq 0 ]; then
-                    ReportSuggestion ${TEST_NO} "Although ntpdate is enabled in rc.conf, it is advised to run it at least daily or use a NTP daemon"
+                    ReportSuggestion "${TEST_NO}" "Although ntpdate is enabled in rc.conf, it is advised to run it at least daily or use a NTP daemon"
                 fi
             else
                 LogText "Result: ntpdate is not enabled in rc.conf"
@@ -202,7 +202,7 @@
             else
                 Display --indent 2 --text "- Checking for a running NTP daemon or client" --result "${STATUS_WARNING}" --color RED
                 LogText "Result: Could not find a NTP daemon or client"
-                ReportSuggestion ${TEST_NO} "Use NTP daemon or NTP client to prevent time issues."
+                ReportSuggestion "${TEST_NO}" "Use NTP daemon or NTP client to prevent time issues."
                 AddHP 0 2
             fi
         else
@@ -241,7 +241,7 @@
             LogText "Result: Found one or more association ID's"
         else
             Display --indent 2 --text "- Checking valid association ID's" --result "${STATUS_WARNING}" --color RED
-            ReportSuggestion ${TEST_NO} "Check ntp.conf for properly configured NTP servers and a correctly functioning name service."
+            ReportSuggestion "${TEST_NO}" "Check ntp.conf for properly configured NTP servers and a correctly functioning name service."
         fi
     fi
 #
@@ -276,7 +276,7 @@
             else
                 Display --indent 2 --text "- Checking high stratum ntp peers" --result "${STATUS_WARNING}" --color RED
                 LogText "Result: Found ${COUNT} high stratum (16) peers)"
-                ReportSuggestion ${TEST_NO} "Check ntpq peers output for stratum 16 peers"
+                ReportSuggestion "${TEST_NO}" "Check ntpq peers output for stratum 16 peers"
             fi
         fi
     fi
@@ -302,7 +302,7 @@
                 LogText "Unreliable peer: ${I}"
                 Report "ntp_unreliable_peer[]=${I}"
             done
-            ReportSuggestion ${TEST_NO} "Check ntpq peers output for unreliable ntp peers and correct/replace them"
+            ReportSuggestion "${TEST_NO}" "Check ntpq peers output for unreliable ntp peers and correct/replace them"
         fi
     fi
 #
@@ -324,7 +324,7 @@
             Display --indent 2 --text "- Checking selected time source" --result "${STATUS_WARNING}" --color RED
             LogText "Result: Found local source as selected time source. This could indicate that no external sources are available to sync with."
             LogText "Local source: ${FIND}"
-            ReportSuggestion ${TEST_NO} "Check ntpq peers output for selected time source"
+            ReportSuggestion "${TEST_NO}" "Check ntpq peers output for selected time source"
         fi
     fi
 #
@@ -340,7 +340,7 @@
         if [ -z "${FIND}" ]; then
             Display --indent 2 --text "- Checking time source candidates" --result "${STATUS_NONE}" --color YELLOW
             LogText "Result: No other time source candidates found"
-            ReportSuggestion ${TEST_NO} "Check ntpq peers output for time source candidates"
+            ReportSuggestion "${TEST_NO}" "Check ntpq peers output for time source candidates"
         else
             Display --indent 2 --text "- Checking time source candidates" --result "${STATUS_OK}" --color GREEN
             LogText "Result: Found one or more candidates to synchronize time with."
@@ -371,7 +371,7 @@
                 LogText "Falseticker found: ${I}"
                 Report "ntp_falseticker[]=${I}"
             done
-            ReportSuggestion ${TEST_NO} "Check ntpq peers output for falsetickers"
+            ReportSuggestion "${TEST_NO}" "Check ntpq peers output for falsetickers"
         fi
     fi
 #
@@ -387,7 +387,7 @@
         if [ -z "${FIND}" ]; then
             Display --indent 2 --text "- Checking NTP version" --result "${STATUS_UNKNOWN}" --color YELLOW
             LogText "Result: No NTP version found"
-            ReportSuggestion ${TEST_NO} "Check ntpq output for NTP protocol version"
+            ReportSuggestion "${TEST_NO}" "Check ntpq output for NTP protocol version"
         else
             Display --indent 2 --text "- Checking NTP version" --result "${STATUS_FOUND}" --color GREEN
             LogText "Result: Found NTP version ${FIND}"
@@ -438,7 +438,7 @@
             else
                 LogText "Result: ${FILE} is empty. The step-tickers contain no configured NTP servers"
                 Display --indent 2 --text "- Checking NTP step-tickers file" --result "EMPTY FILE" --color YELLOW
-                ReportSuggestion ${TEST_NO} "Use step-tickers file for quicker time synchronization"
+                ReportSuggestion "${TEST_NO}" "Use step-tickers file for quicker time synchronization"
             fi
         else
             LogText "Result: ${FILE} is not empty, which is fine"
@@ -455,7 +455,7 @@
             done
             if [ ${FOUND} -eq 1 ]; then
                 Display --indent 4 --text "- Checking step-tickers ntp servers entries" --result "SOME MISSING" --color YELLOW
-                ReportSuggestion ${TEST_NO} "Some time servers missing in step-tickers file"
+                ReportSuggestion "${TEST_NO}" "Some time servers missing in step-tickers file"
                 AddHP 3 4
             else
                 Display --indent 4 --text "- Checking step-tickers ntp servers entries" --result "${STATUS_OK}" --color GREEN
diff --git a/include/tests_tooling b/include/tests_tooling
index 328a48fa..00c37369 100644
--- a/include/tests_tooling
+++ b/include/tests_tooling
@@ -182,7 +182,7 @@
             Display --indent 2 --text "- Automation tooling" --result "${STATUS_FOUND}" --color GREEN
         else
             Display --indent 2 --text "- Automation tooling" --result "${STATUS_NOT_FOUND}" --color YELLOW
-            ReportSuggestion ${TEST_NO} "Determine if automation tools are present for system management"
+            ReportSuggestion "${TEST_NO}" "Determine if automation tools are present for system management"
         fi
     fi
 #
@@ -412,7 +412,7 @@
             AddHP 2 2
         else
             Display --indent 2 --text "- Checking for IDS/IPS tooling" --result "${STATUS_NONE}" --color YELLOW
-            #ReportSuggestion ${TEST_NO} "Install and configure automated intrusion detection/prevention tools"
+            #ReportSuggestion "${TEST_NO}" "Install and configure automated intrusion detection/prevention tools"
             AddHP 0 2
         fi
     fi
diff --git a/include/tests_usb b/include/tests_usb
index 36058490..24c74982 100644
--- a/include/tests_usb
+++ b/include/tests_usb
@@ -75,7 +75,7 @@
             LogText "Result: usb-storage driver is not explicitly disabled"
             Display --indent 2 --text "- Checking usb-storage driver (modprobe config)" --result "NOT DISABLED" --color WHITE
             if [ "${USBGUARD_FOUND}" -eq "0" ]; then
-                ReportSuggestion ${TEST_NO} "Disable drivers like USB storage when not used, to prevent unauthorized storage or data theft"
+                ReportSuggestion "${TEST_NO}" "Disable drivers like USB storage when not used, to prevent unauthorized storage or data theft"
             fi
             AddHP 2 3
         else
@@ -117,7 +117,7 @@
             Display --indent 2 --text "- Checking USB devices authorization" --result "${STATUS_ENABLED}" --color YELLOW
             # To-Be-Added: create documentation and enable the suggestion
             #if [ ${USBGUARD_FOUND} -eq 0 ]; then
-            #   ReportSuggestion ${TEST_NO} "Disable USB devices authorization, to prevent unauthorized storage or data theft"
+            #   ReportSuggestion "${TEST_NO}" "Disable USB devices authorization, to prevent unauthorized storage or data theft"
             #fi
             AddHP 0 3
         else
@@ -160,7 +160,7 @@
                             Display --indent 6 --text "- Restore controller device state" --result "${USBGUARD_RESTORE_POLICY}" --color YELLOW
                             LogText "  Consider changing RestoreControllerDeviceState to \"false\""
                             # TODO: assign TEST_NO, create documentation, and enable the suggestion
-                            # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "RestoreControllerDeviceState (${USBGUARD_RESTORE_POLICY} --> false)"
+                            # ReportSuggestion "${TEST_NO}" "Consider hardening USBGuard configuration" "RestoreControllerDeviceState (${USBGUARD_RESTORE_POLICY} --> false)"
                             AddHP 0 1
                             ;;
                         "false")
@@ -171,7 +171,7 @@
                             LogText "Result: Invalid configuration for RestoreControllerDeviceState"
                             Display --indent 6 --text "- Restore controller device state" --result "Invalid" --color RED
                             # TODO: assign TEST_NO, create documentation, and enable the suggestion
-                            # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "RestoreControllerDeviceState invalid \"${USBGUARD_RESTORE_POLICY}\""
+                            # ReportSuggestion "${TEST_NO}" "Fix USBGuard configuration" "RestoreControllerDeviceState invalid \"${USBGUARD_RESTORE_POLICY}\""
                             AddHP 0 1
                             ;;
                     esac
@@ -191,7 +191,7 @@
                             Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "${USBGUARD_CONTROLLER_POLICY}" --color YELLOW
                             LogText "  Consider changing PresentControllerPolicy to \"apply-policy\", \"block\" or \"reject\""
                             # TODO: assign TEST_NO, create documentation, and enable the suggestion
-                            # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "PresentControllerPolicy (${USBGUARD_CONTROLLER_POLICY} --> (apply-policy|block|reject)"
+                            # ReportSuggestion "${TEST_NO}" "Consider hardening USBGuard configuration" "PresentControllerPolicy (${USBGUARD_CONTROLLER_POLICY} --> (apply-policy|block|reject)"
                             AddHP 0 1
                             ;;
                         "apply-policy" | "block" | "reject")
@@ -202,7 +202,7 @@
                             LogText "Result: Invalid configuration for PresentControllerPolicy"
                             Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "Invalid" --color RED
                             # TODO: assign TEST_NO, create documentation, and enable the suggestion
-                            # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "PresentControllerPolicy invalid \"${USBGUARD_CONTROLLER_POLICY}\""
+                            # ReportSuggestion "${TEST_NO}" "Fix USBGuard configuration" "PresentControllerPolicy invalid \"${USBGUARD_CONTROLLER_POLICY}\""
                             AddHP 0 1
                             ;;
                     esac
@@ -221,7 +221,7 @@
                             Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "${USBGUARD_DEVICE_POLICY}" --color YELLOW
                             LogText "  Consider changing PresentDevicePolicy to \"apply-policy\", \"block\" or \"reject\""
                             # TODO: assign TEST_NO, create documentation, and enable the suggestion
-                            # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "PresentDevicePolicy (${USBGUARD_DEVICE_POLICY} --> (apply-policy|block|reject)"
+                            # ReportSuggestion "${TEST_NO}" "Consider hardening USBGuard configuration" "PresentDevicePolicy (${USBGUARD_DEVICE_POLICY} --> (apply-policy|block|reject)"
                             AddHP 0 1
                             ;;
                         "apply-policy" | "block" | "reject")
@@ -232,7 +232,7 @@
                             LogText "Result: Invalid configuration for PresentDevicePolicy"
                             Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "Invalid" --color RED
                             # TODO: assign TEST_NO, create documentation, and enable the suggestion
-                            # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "PresentDevicePolicy invalid \"${USBGUARD_DEVICE_POLICY}\""
+                            # ReportSuggestion "${TEST_NO}" "Fix USBGuard configuration" "PresentDevicePolicy invalid \"${USBGUARD_DEVICE_POLICY}\""
                             AddHP 0 1
                             ;;
                     esac
@@ -251,7 +251,7 @@
                             Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "${USBGUARD_INSERTED_POLICY}" --color YELLOW
                             LogText "  Consider changing InsertedDevicePolicy to \"apply-policy\", \"block\" or \"reject\""
                             # TODO: assign TEST_NO, create documentation, and enable the suggestion
-                            # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "InsertedDevicePolicy (${USBGUARD_INSERTED_POLICY} --> (apply-policy|block|reject)"
+                            # ReportSuggestion "${TEST_NO}" "Consider hardening USBGuard configuration" "InsertedDevicePolicy (${USBGUARD_INSERTED_POLICY} --> (apply-policy|block|reject)"
                             AddHP 0 1
                             ;;
                         "apply-policy" | "block" | "reject")
@@ -262,7 +262,7 @@
                             LogText "Result: Invalid configuration for InsertedDevicePolicy"
                             Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "Invalid" --color RED
                             # TODO: assign TEST_NO, create documentation, and enable the suggestion
-                            # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "InsertedDevicePolicy invalid \"${USBGUARD_INSERTED_POLICY}\""
+                            # ReportSuggestion "${TEST_NO}" "Fix USBGuard configuration" "InsertedDevicePolicy invalid \"${USBGUARD_INSERTED_POLICY}\""
                             AddHP 0 1
                             ;;
                     esac
@@ -281,7 +281,7 @@
                             Display --indent 6 --text "- Rule for devices not in RuleFile" --result "${USBGUARD_DEFAULT_POLICY}" --color YELLOW
                             LogText "  Consider changing ImplicitPolicyTarget to \"block\" or \"reject\""
                             # TODO: assign TEST_NO, create documentation, and enable the suggestion
-                            # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "ImplicitPolicyTarget (${USBGUARD_DEFAULT_POLICY} --> (block|reject)"
+                            # ReportSuggestion "${TEST_NO}" "Consider hardening USBGuard configuration" "ImplicitPolicyTarget (${USBGUARD_DEFAULT_POLICY} --> (block|reject)"
                             AddHP 0 1
                             ;;
                         "block"|"reject")
@@ -292,7 +292,7 @@
                             LogText "Result: Invalid configuration for ImplicitPolicyTarget"
                             Display --indent 6 --text "- Rule for devices not in RuleFile" --result "Invalid" --color RED
                             # TODO: assign TEST_NO, create documentation, and enable the suggestion
-                            # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "ImplicitPolicyTarget invalid \"${USBGUARD_DEFAULT_POLICY}\""
+                            # ReportSuggestion "${TEST_NO}" "Fix USBGuard configuration" "ImplicitPolicyTarget invalid \"${USBGUARD_DEFAULT_POLICY}\""
                             AddHP 0 1
                             ;;
                     esac
@@ -319,7 +319,7 @@
                     LogText "Result: RuleFile not found (\"man usbguard\" for instructions to install initial policies)"
                     Display --indent 4 --text "- RuleFile" --result "${STATUS_NOT_FOUND}" --color RED
                     # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
-                    #ReportSuggestion ${TEST_NO} "Install USBGuard RuleFile" "\"man usbguard\" for instructions to install initial policies"
+                    #ReportSuggestion "${TEST_NO}" "Install USBGuard RuleFile" "\"man usbguard\" for instructions to install initial policies"
                     AddHP 0 1
                 fi
 
@@ -327,14 +327,14 @@
                 Display --indent 4 --text "- Configuration" --result "${STATUS_NOT_FOUND}" --color WHITE
                 LogText "Result: Configuration not found"
                 # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
-                #ReportSuggestion ${TEST_NO} "USBGuard configuration file not found, consider reinstalling"
+                #ReportSuggestion "${TEST_NO}" "USBGuard configuration file not found, consider reinstalling"
                 AddHP 0 7
             fi
         else
             LogText "Result: USBGuard not found"
             Display --indent 2 --text "- Checking USBGuard" --result "${STATUS_NOT_FOUND}" --color WHITE
             # To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion
-            #ReportSuggestion ${TEST_NO} "Install USBGuard to allow for fine-grained control of USB authorization"
+            #ReportSuggestion "${TEST_NO}" "Install USBGuard to allow for fine-grained control of USB authorization"
             AddHP 0 8
         fi
 
diff --git a/include/tests_webservers b/include/tests_webservers
index 01bb3f93..54db20d7 100644
--- a/include/tests_webservers
+++ b/include/tests_webservers
@@ -257,7 +257,7 @@
         else
             Display --indent 10 --text "mod_evasive: anti-DoS/brute force" --result "${STATUS_NOT_FOUND}" --color WHITE
             AddHP 2 3
-            ReportSuggestion ${TEST_NO} "Install Apache mod_evasive to guard webserver against DoS/brute force attempts"
+            ReportSuggestion "${TEST_NO}" "Install Apache mod_evasive to guard webserver against DoS/brute force attempts"
         fi
     fi
 #
@@ -276,7 +276,7 @@
         else
             Display --indent 10 --text "mod_reqtimeout/mod_qos" --result "${STATUS_NOT_FOUND}" --color WHITE
             AddHP 2 3
-            ReportSuggestion ${TEST_NO} "Install Apache mod_reqtimeout or mod_qos to guard webserver against Slowloris attacks"
+            ReportSuggestion "${TEST_NO}" "Install Apache mod_reqtimeout or mod_qos to guard webserver against Slowloris attacks"
         fi
     fi
 #
@@ -294,7 +294,7 @@
         else
             Display --indent 10 --text "ModSecurity: web application firewall" --result "${STATUS_NOT_FOUND}" --color WHITE
             AddHP 2 3
-            ReportSuggestion ${TEST_NO} "Install Apache modsecurity to guard webserver against web application attacks"
+            ReportSuggestion "${TEST_NO}" "Install Apache modsecurity to guard webserver against web application attacks"
         fi
     fi
 #
@@ -480,7 +480,7 @@
         else
             LogText "Result: No SSL configuration found"
             Display --indent 6 --text "- SSL configured" --result "${STATUS_NO}" --color RED
-            ReportSuggestion ${TEST_NO} "Add HTTPS to nginx virtual hosts for enhanced protection of sensitive data and privacy"
+            ReportSuggestion "${TEST_NO}" "Add HTTPS to nginx virtual hosts for enhanced protection of sensitive data and privacy"
             AddHP 1 5
         fi
         if [ ${NGINX_SSL_SUGGESTION} -eq 1 ]; then
@@ -520,7 +520,7 @@
         fi
         # Report suggestion
         if [ ${NGINX_LOG_SUGGESTION} -eq 1 ]; then
-            ReportSuggestion ${TEST_NO} "Check your nginx access log for proper functioning"
+            ReportSuggestion "${TEST_NO}" "Check your nginx access log for proper functioning"
         fi
     fi
 #
@@ -541,7 +541,7 @@
         fi
         # Report suggestion
         if [ ${NGINX_LOG_SUGGESTION} -eq 1 ]; then
-            ReportSuggestion ${TEST_NO} "Check your nginx error_log statements"
+            ReportSuggestion "${TEST_NO}" "Check your nginx error_log statements"
         fi
     fi
 #
@@ -566,7 +566,7 @@
         fi
         # Report suggestion
         if [ ${NGINX_LOG_SUGGESTION} -eq 1 ]; then
-            ReportSuggestion ${TEST_NO} "Check your nginx error_log statements and disable debug mode"
+            ReportSuggestion "${TEST_NO}" "Check your nginx error_log statements and disable debug mode"
         fi
     fi
 #
diff --git a/plugins/custom_plugin.template b/plugins/custom_plugin.template
index 17dada3a..3841ce00 100644
--- a/plugins/custom_plugin.template
+++ b/plugins/custom_plugin.template
@@ -72,7 +72,7 @@
             Display --indent 2 --text "- Checking if everything is OK..." --result OK --color GREEN
         else
             Display --indent 2 --text "- Checking if everything is OK..." --result WARNING --color RED
-            ReportSuggestion ${TEST_NO} "This is a suggestion"
+            ReportSuggestion "${TEST_NO}" "This is a suggestion"
         fi
     fi
 #

From d5bc4f7854e47f1ad328db40584aa0f346181523 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 18 Dec 2019 12:17:55 +0100
Subject: [PATCH 423/679] Updated log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6da88646..f0c9896f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -83,7 +83,9 @@ Using the relevant options, the scan will change base on the intended goal.
 - HOME-9304 - improved selection for normal users
 - HOME-9306 - improved selection for normal users
 - INSE-8050 - added com.apple.ftp-proxy and improved text output
+- INSE-8050 - corrected function call for showing suggestion
 - INSE-8116 - added rsync service
+- INSE-8314 - changed text of suggestion
 - INSE-8318 - test for TFTP client tools
 - INSE-8320 - test for TFTP server tools
 - INSE-8342 - renamed to INSE-8304

From cb59e924417fb1b18a8c2af5200c7359550ae92c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 18 Dec 2019 12:22:51 +0100
Subject: [PATCH 424/679] [MALW-3280] Added support for falcon-sensor by
 CrowdStrike

---
 include/tests_malware | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/include/tests_malware b/include/tests_malware
index 6718a10b..d983b17f 100644
--- a/include/tests_malware
+++ b/include/tests_malware
@@ -31,6 +31,7 @@
     BITDEFENDER_DAEMON_RUNNING=0
     CLAMD_RUNNING=0
     CLAMSCAN_INSTALLED=0
+    CROWDSTRIKE_FALCON_SENSOR_RUNNING=0
     ESET_DAEMON_RUNNING=0
     FRESHCLAM_DAEMON_RUNNING=0
     KASPERSKY_SCANNER_RUNNING=0
@@ -145,6 +146,17 @@
             Report "malware_scanner[]=avira"
         fi
 
+        # CrowdStrike falcon-sensor
+        LogText "Test: checking process falcon-sensor (CrowdStrike)"
+        if IsRunning "falcon-sensor"; then
+            FOUND=1
+            if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} falcon-sensor" --result "${STATUS_FOUND}" --color GREEN; fi
+            LogText "Result: found falcon-sensor service"
+            CROWDSTRIKE_FALCON_SENSOR_RUNNING=1
+            MALWARE_SCANNER_INSTALLED=1
+            Report "malware_scanner[]=falcon-sensor"
+        fi
+
         # Cylance (macOS)
         LogText "Test: checking process CylanceSvc"
         if IsRunning "CylanceSvc"; then

From 4381382d7ed1c7246e213238b9b1b406f6f70cd1 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 18 Dec 2019 12:23:59 +0100
Subject: [PATCH 425/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f0c9896f..e14b8941 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -94,6 +94,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - LOGG-2154 - added support for rsyslog configurations
 - MAIL-8804 - replaced static strings with translation-aware strings
 - MALW-3280 - Kaspersky detection added
+- MALW-3280 - CrowdStrike falcon-sensor detection added
 - NAME-4402 - check if /etc/hosts exists before performing test
 - NAME-4404 - improved screen and log output
 - NAME-4408 - corrected Report function call

From 35d248b74ce84c434b4cb2fff7562f627919872c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 18 Dec 2019 19:20:48 +0100
Subject: [PATCH 426/679] [FILE-6430] minor code improvements and show
 suggestion with more details

---
 include/tests_filesystems | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/include/tests_filesystems b/include/tests_filesystems
index 96087094..798978e7 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -759,7 +759,7 @@
     # Test        : FILE-6430
     # Description : Disable mounting of some filesystems
     # Rationale   : Unless there is a specific reason to use a particular file system, disable it.
-    # Data        : cramfs freevxfs hfs hfsplus jffs2 squashfs udf 
+    # Data        : cramfs freevxfs hfs hfsplus jffs2 squashfs udf
     Register --test-no FILE-6430 --weight L --network NO --category security --description "Disable mounting of some filesystems"
     if [ ${SKIPTEST} -eq 0 ]; then
         if [ -n "${LSMODBINARY}" -a -f /proc/modules ]; then
@@ -770,19 +770,17 @@
             AVAILABLE_MODPROBE_FS=""
             for FS in ${LIST_FS_NOT_SUPPORTED}; do
                 # Check if filesystem is present in modprobe output
-                FIND=$(${MODPROBEBINARY} -v -n $FS 2>/dev/null | ${EGREPBINARY} "/${FS}.ko" | tail -1)
+                FIND=$(${MODPROBEBINARY} -v -n ${FS} 2>/dev/null | ${EGREPBINARY} "/${FS}.ko" | ${TAILBINARY} -1)
                 if [ -n "${FIND}" ]; then
-                    LogText "Result: found module support in kernel: ${FIND}"
+                    LogText "Result: found ${FS} support in the kernel (output = ${FIND})"
                     Debug "Module ${FS} present in the kernel"
                     LogText "Test: Checking if ${FS} is active"
                     # Check if FS is present in lsmod output
                     FIND=$(${LSMODBINARY} | ${EGREPBINARY} "^${FS}")
                     if IsEmpty "${FIND}"; then
-                        LogText "Result: module ${FS} is not loaded in the kernel"
+                        LogText "Result: module ${FS} is currently not loaded in the kernel."
                         AddHP 2 3
                         if IsDebug; then Display --indent 6 --text "- Module ${FS} not loaded (lsmod)" --result OK --color GREEN; fi
-                        # Tip to disable a particular module if it is not loaded TODO
-                        #ReportSuggestion "${TEST_NO}" "The modprobe.d directory should contain a file with the entry 'install ${FS} /bin/true'"
                         FOUND=1
                         AVAILABLE_MODPROBE_FS="${AVAILABLE_MODPROBE_FS}${FS} "
                     else
@@ -796,6 +794,7 @@
             done
             if [ ${FOUND} -eq 1 ]; then
                 Display --indent 4 --text "- Discovered kernel modules: ${AVAILABLE_MODPROBE_FS}"
+                ReportSuggestion "${TEST_NO}" "Consider disabling unused kernel modules" "/etc/modprobe.d/blacklist.conf" "Add 'install MODULENAME /bin/true' (without quotes)"
             fi
         else
             LogText "Test skipped lsmod binary not found or /proc/modules can not be opened"

From 66b8eb3000b9c7722c95755cb7c510de00575876 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 18 Dec 2019 19:20:57 +0100
Subject: [PATCH 427/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e14b8941..34fa7423 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -77,6 +77,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - CRYP-8002 - gather kernel entropy on Linux systems
 - FILE-6374 - changed log and allow root location to be changed
 - FILE-6374 - corrected condition to find 'defaults' flag in /etc/fstab
+- FILE-6430 - minor code improvements and show suggestion with more details
 - FILE-7524 - optimized file permissions testing
 - FINT-4328 - corrected text in log
 - FINT-4334 - improved process detection for lfd

From 09740e0debb410e2b8de55fcc30add6cdbc32ad8 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 18 Dec 2019 19:28:29 +0100
Subject: [PATCH 428/679] Create stale.yml

---
 .github/workflows/stale.yml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 .github/workflows/stale.yml

diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
new file mode 100644
index 00000000..7bbc0505
--- /dev/null
+++ b/.github/workflows/stale.yml
@@ -0,0 +1,19 @@
+name: Mark stale issues and pull requests
+
+on:
+  schedule:
+  - cron: "0 0 * * *"
+
+jobs:
+  stale:
+
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/stale@v1
+      with:
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        stale-issue-message: 'Stale issue message'
+        stale-pr-message: 'Stale pull request message'
+        stale-issue-label: 'no-issue-activity'
+        stale-pr-label: 'no-pr-activity'

From e5091772c531d1339f6526fb0307ff5189724523 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 23 Dec 2019 13:59:06 +0100
Subject: [PATCH 429/679] Removed -o which had no purpose

---
 include/tests_kernel | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index a77ac69a..23f7823f 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -665,7 +665,7 @@
                                 break
                             else
                                 # Searching for the Linux kernel after the keyword 'version'
-                                if [ "${I}" = "version" -o  ]; then NEXTLINE=1; fi
+                                if [ "${I}" = "version" ]; then NEXTLINE=1; fi
                             fi
                         done
                     else

From ab4291242da0304552d585844506ecbaa310e765 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 23 Dec 2019 15:36:26 +0100
Subject: [PATCH 430/679] [KRNL-5830] check for symlink

---
 include/tests_kernel | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/include/tests_kernel b/include/tests_kernel
index 23f7823f..2c2c860f 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -654,7 +654,14 @@
                         FOUND_VMLINUZ=$(ls -t ${ROOTDIR}boot/vm[l-]* 2> /dev/null | head -1)
                     fi
 
+                    if [ -L "${FOUND_VMLINUZ}" ]; then
+                        LogText "Result: found a symlink, retrieving destination"
+                        FOUND_VMLINUZ=$(readlink "${FOUND_VMLINUZ}")
+                        LogText "Result: destination file is ${FOUND_VMLINUZ}"
+                    fi
+
                     if [ -z "${VERSION_ON_DISK}" ]; then
+
                         LogText "Result: found ${FOUND_VMLINUZ}"
                         LogText "Test: checking kernel version on disk"
                         NEXTLINE=0

From b7da40c6aeee6429e1716e2c28f855d13c62dc23 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 23 Dec 2019 15:41:26 +0100
Subject: [PATCH 431/679] [KRNL-5830] derive kernel version from filename after
 obtaining symlink target

---
 include/tests_kernel | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index 2c2c860f..fbd1ff85 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -645,7 +645,7 @@
                         LogText "Result: found symlink ${ROOTDIR}boot/vmlinuz-linux"
                         FOUND_VMLINUZ=$(readlink ${ROOTDIR}boot/vmlinuz-linux)
                         LogText "Result: symlinked target is ${FOUND_VMLINUZ}"
-                        VERSION_ON_DISK=$(echo ${FOUND_VMLINUZ} | sed 's/^vmlinuz-//')
+                        VERSION_ON_DISK=$(echo ${FOUND_VMLINUZ} | ${SEDBINARY} 's/^vmlinuz-//')
                     elif [ -f ${ROOTDIR}boot/vmlinuz-linux-lts ]; then
                         LogText "Result: found boot/vmlinuz-linux-lts"
                         FOUND_VMLINUZ=${ROOTDIR}boot/vmlinuz-linux-lts
@@ -658,10 +658,11 @@
                         LogText "Result: found a symlink, retrieving destination"
                         FOUND_VMLINUZ=$(readlink "${FOUND_VMLINUZ}")
                         LogText "Result: destination file is ${FOUND_VMLINUZ}"
+                        VERSION_ON_DISK=$(echo ${FOUND_VMLINUZ} | ${SEDBINARY} 's/^vmlinuz-//')
+                        LogText "Result: version derived from file name is '${VERSION_ON_DISK}'"
                     fi
 
                     if [ -z "${VERSION_ON_DISK}" ]; then
-
                         LogText "Result: found ${FOUND_VMLINUZ}"
                         LogText "Test: checking kernel version on disk"
                         NEXTLINE=0

From b48bee581add42afbff3b336392dd0be74f1a7a9 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 26 Dec 2019 14:48:48 +0100
Subject: [PATCH 432/679] Set more conservative values

---
 .github/workflows/stale.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 7bbc0505..08dce83e 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -17,3 +17,5 @@ jobs:
         stale-pr-message: 'Stale pull request message'
         stale-issue-label: 'no-issue-activity'
         stale-pr-label: 'no-pr-activity'
+        days-before-stale: 14
+        days-before-close: 90

From 40acdc111d34b7ed040f4cb652f65ca7ed22afd6 Mon Sep 17 00:00:00 2001
From: pyllyukko <pyllyukko@maimed.org>
Date: Mon, 6 Jan 2020 21:22:00 +0200
Subject: [PATCH 433/679] Added CRYP-8004

---
 include/tests_crypto | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/include/tests_crypto b/include/tests_crypto
index 44f19cdc..9c40ff47 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -194,6 +194,33 @@
     fi
 #
 #################################################################################
+#
+    # Test        : CRYP-8004
+    # Description : Test for HWRNG & rngd
+    Register --test-no CRYP-8004 --os Linux --weight L --network NO --root-only NO --category security --description "Test for HWRNG & rngd"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        if [ -f ${ROOTDIR}sys/class/misc/hw_random/rng_current ]; then
+            DATA=$(${CAT_BINARY} ${ROOTDIR}sys/class/misc/hw_random/rng_current)
+            if [ "${DATA}" != "none" ]; then
+                LogText "Result: found HW RNG: ${DATA}"
+                if IsRunning "rngd"; then
+                    Display --indent 2 --text "- HW RNG & rngd" --result "${STATUS_YES}" --color GREEN
+                    LogText "Result: rngd is running"
+                else
+                    Display --indent 2 --text "- HW RNG & rngd" --result "${STATUS_NO}" --color YELLOW
+                    ReportSuggestion "${TEST_NO}" "Utilize HW RNG by running rngd"
+                fi
+            else
+                Display --indent 2 --text "- HW RNG & rngd" --result "${STATUS_NO}" --color RED
+                LogText "Result: no HW RNG available"
+            fi
+        else
+            Display --indent 2 --text "- HW RNG & rngd" --result "${STATUS_NO}" --color RED
+            LogText "Result: could not find ${ROOTDIR}sys/class/misc/hw_random/rng_current"
+        fi
+    fi
+#
+#################################################################################
 #
 
 WaitForKeyPress

From 618a8430174ba1b912fc0df5d8bfe1b9cbcdb9c0 Mon Sep 17 00:00:00 2001
From: pyllyukko <pyllyukko@maimed.org>
Date: Tue, 7 Jan 2020 22:27:27 +0200
Subject: [PATCH 434/679] KRNL-5788 in Raspi: don't complain about missing
 /vmlinuz

The Raspberry Pi kernels reside within raspberrypi-kernel package[1].

[1] https://www.raspberrypi.org/documentation/linux/kernel/updating.md
---
 include/tests_kernel | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/include/tests_kernel b/include/tests_kernel
index fbd1ff85..5f5ce856 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -392,6 +392,9 @@
             elif [ -e ${ROOTDIR}dev/grsec ]; then
                 FINDKERNEL=linux-image-$(uname -r)
                 LogText "Result: ${ROOTDIR}vmlinuz missing due to grsecurity; assuming ${FINDKERNEL}"
+            elif [ -e ${ROOTDIR}etc/rpi-issue ]; then
+                FINDKERNEL=raspberrypi-kernel
+                LogText "Result: ${ROOTDIR}vmlinuz missing due to Raspbian"
             else
                 LogText "This system is missing ${ROOTDIR}vmlinuz or ${ROOTDIR}boot/vmlinuz.  Unable to check whether kernel is up-to-date."
                 ReportSuggestion "${TEST_NO}" "Determine why ${ROOTDIR}vmlinuz or ${ROOTDIR}boot/vmlinuz is missing on this Debian/Ubuntu system." "/vmlinuz or /boot/vmlinuz"

From c58e296bd36b8705714ab8a3c1bbafa25cf07816 Mon Sep 17 00:00:00 2001
From: Simon Biewald <simon@fam-biewald.de>
Date: Wed, 8 Jan 2020 18:53:15 +0100
Subject: [PATCH 435/679] add openntpd detection and a few tests for it

---
 include/binaries   |  1 +
 include/tests_time | 96 ++++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 93 insertions(+), 4 deletions(-)

diff --git a/include/binaries b/include/binaries
index f567ed1f..ec633f02 100644
--- a/include/binaries
+++ b/include/binaries
@@ -212,6 +212,7 @@
                             netstat)                NETSTATBINARY="${BINARY}";         LogText "  Found known binary: netstat (network statistics) - ${BINARY}" ;;
                             nft)                    NFTBINARY="${BINARY}";             LogText "  Found known binary: nft (nftables client) - ${BINARY}" ;;
                             nmap)                   NMAPBINARY="${BINARY}";            NMAPVERSION=$(${BINARY} -V | grep "^Nmap version" | awk '{ print $3 }'); LogText "Found ${BINARY} (version ${NMAPVERSION})" ;;
+                            ntpctl)                 NTPCTLBINARY="${BINARY}";                LogText "  Found known binary: ntpctl (openntpd client) - ${BINARY}" ;;
                             ntpq)                   NTPQBINARY="${BINARY}";            LogText "  Found known binary ntpq (time daemon client) - ${BINARY}" ;;
                             osiris)                 OSIRISBINARY="${BINARY}";          LogText "  Found known binary: osiris - ${BINARY}" ;;
                             openssl)                OPENSSLBINARY="${BINARY}";         OPENSSLVERSION=$(${BINARY} version 2> /dev/null | head -n 1 | awk '{ print $2 }' | xargs); LogText "Found ${BINARY} (version ${OPENSSLVERSION})" ;;
diff --git a/include/tests_time b/include/tests_time
index d3bda505..d5169d9e 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -36,6 +36,7 @@
     NTP_CONFIG_TYPE_EVENTBASED=0
     NTP_CONFIG_TYPE_STARTUP=0
     NTPD_RUNNING=0 # Specific for ntpd
+    OPENNTPD_COMMUNICATION=0 # if ntpctl can communicate
     SYSTEMD_NTP_ENABLED=0
 #
 #################################################################################
@@ -79,9 +80,37 @@
             Display --indent 2 --text "- NTP daemon found: dntpd" --result "${STATUS_FOUND}" --color GREEN
         fi
 
-        # Check running processes
-        FIND=$(${PSBINARY} ax | ${GREPBINARY} "ntpd" | ${GREPBINARY} -v "dntpd" | ${GREPBINARY} -v "grep")
-        if [ -n "${FIND}" ]; then
+        # Check for OpenNTPD, ntpctl comes with a "regular" install
+        if [ -n ${NTPCTLBINARY} ]; then
+            # In contrast to timectl, "synchronised: yes" is not grepped.
+            # Reason: openntpd syncs only if large time corrections are not required or -s is passed.
+            #         This might be not intended by the administrator (-s is NOT the default!)
+            FIND=$(${PSBINARY} ax | ${GREPBINARY} "ntpd: ntp engine" | ${GREPBINARY} -v "grep")
+            ${NTPCTLBINARY} -s status > /dev/null 2> /dev/null
+            # Status code 0 is when communication over the socket is successfull
+            if [ "$?" -eq 0 ]; then
+                FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="openntpd"
+                LogText "result: found openntpd (method: ntpctl)"
+                OPENNTPD_COMMUNICATION=1
+            elif [ -n "${FIND}" ] ; then
+                # Reasons for ntpctl to fail might be someone spawned a new process thus overwriting the socket,
+                # then ended it, but another openntpd process is still running
+                FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="openntpd"
+                LogText "result: found openntpd (method: ps)"
+            else
+                LogText "result: running openntpd not found, but ntpctl is instaalled"
+            fi
+
+            if [ "${NTP_DAEMON}" == "openntpd" ]; then
+                Display --indent 2 --text "- NTP daemon found: OpenNTPD" --result "${STATUS_FOUND}" --color GREEN
+            fi
+        fi
+
+        # Check running processes (ntpd from ntp.org)
+        # As checking by process name is ambigiouse (openntpd has the same process name),
+        # this check will be skipped if openntpd has been found.
+        FIND=$(${PSBINARY} ax | ${GREPBINARY} "ntpd" | ${GREPBINARY} -v "dntpd" | ${GREPBINARY} -v "ntpd: " | ${GREPBINARY} -v "grep")
+        if [ "${NTP_DAEMON}" != "openntpd" ] && [  -n "${FIND}" ]; then
             FOUND=1; NTPD_RUNNING=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1
             NTP_DAEMON="ntpd"
             LogText "Result: found running NTP daemon in process list"
@@ -476,7 +505,8 @@
     #               Other should preferably have no access, or read-only at max
 
     FILE_ARRAY="${ROOTDIR}etc/chrony.conf ${ROOTDIR}usr/pkg/etc/chrony.conf \
-        ${ROOTDIR}etc/inet/ntp.conf ${ROOTDIR}etc/ntp.conf ${ROOTDIR}usr/local/etc/ntp.conf"
+        ${ROOTDIR}etc/inet/ntp.conf ${ROOTDIR}etc/ntp.conf ${ROOTDIR}usr/local/etc/ntp.conf\
+        ${ROOTDIR}etc/ntpd.conf ${ROOTDIR}etc/openntpd/ntpd.conf ${ROOTDIR}usr/local/etc/ntpd.conf"
 
     Register --test-no TIME-3170 --weight L --network NO --category security --description "Check configuration files"
     if [ ${SKIPTEST} -eq 0 ]; then
@@ -494,6 +524,64 @@
 #
 #################################################################################
 #
+    # Test        : TIME-3180
+    # Description : Report if ntpctl cannot communicate with OpenNTPD
+
+    if [ "${NTPD_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" == "openntpd" ]; then
+        PREQS_MET="YES"
+    else
+        PREQS_MET="NO"
+    fi
+
+    Register --test-no TIME-3180 --weight L --network NO --category security --description "Report if ntpctl cannot communicate with OpenNTPD"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        if [ "${OPENNTPD_COMMUNICATION}" -eq 0 ]; then
+            ReportWarning "${TEST_NO}" "OpenNTPD found, but ntpctl cannot communicate with" "${NTPCTLBINARY} -s status" "Restart OpenNTPD"
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : TIME-3181
+    # Description : Check status of OpenNTPD time synchronisation
+
+    if [ "${NTPD_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" == "openntpd" ] && [ "${OPENNTPD_COMMUNICATION}" -eq 1 ]; then
+        PREQS_MET="YES"
+    else
+        PREQS_MET="NO"
+    fi
+
+    Register --test-no TIME-3181 --weight L --network NO --category security --description "Check status of OpenNTPD time synchronisation"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        FIND=$(${NTPCTLBINARY} -s status | ${GREPBINARY} "clock synced" )
+        if [ -z "${FIND}" ]; then
+            ReportWarning "${TEST_NO}" "OpenNTPD is not synchronising system time" "${NTPCTLBINARY} -s status" "text:Set time manually once or check network connectivity."
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : TIME-3182
+    # Description : Check OpenNTPD has working peers
+
+    if [ "${NTPD_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" == "openntpd" ] && [ "${OPENNTPD_COMMUNICATION}" -eq 1 ]; then
+        PREQS_MET="YES"
+    else
+        PREQS_MET="NO"
+    fi
+
+    Register --test-no TIME-3182 --weight L --network NO --category security --description "Check OpenNTPD has working peers"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        # Format is "xx/yy peers valid, ..."
+        FIND=$(${NTPCTLBINARY} -s status | ${EGREPBINARY} -o "[0-9]{1,4}/" | ${EGREPBINARY} -o "[0-9]{1,4}" )
+        if [ -n "${FIND}" ] || [ "${FIND}" -eq 0 ]; then
+            ReportWarning "${TEST_NO}" "OpenNTPD has no peers" "${NTPCTLBINARY} -s status"
+        fi
+    fi
+#
+#################################################################################
+#
+
     Report "ntp_config_found=${NTP_CONFIG_FOUND}"
     Report "ntp_config_type_daemon=${NTP_CONFIG_TYPE_DAEMON}"
     Report "ntp_config_type_eventbased=${NTP_CONFIG_TYPE_EVENTBASED}"

From 232b1cdc3f1df99fc120fb9a3516a4f633a816a3 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 11 Jan 2020 11:27:37 +0100
Subject: [PATCH 436/679] [KRNL-5820] allow dash to define hard/soft value

---
 include/tests_kernel | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/include/tests_kernel b/include/tests_kernel
index fbd1ff85..0f72525e 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -520,6 +520,16 @@
             # using find instead of grep -r to stay POSIX compliant. On AIX and HPUX grep -r is not available.
             FIND1=$(${FINDBINARY} "${ROOTDIR}etc/security/limits.conf" "${LIMITS_DIRECTORY}" -type f -exec ${CAT_BINARY} {} \; 2> /dev/null | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="soft" && $3=="core" && $4=="0") { print "soft core disabled" } else if ($1=="*" && $2=="soft" && $3=="core" && $4!="0") { print "soft core enabled" } }' | ${TAILBINARY} -1)
             FIND2=$(${FINDBINARY} "${ROOTDIR}etc/security/limits.conf" "${LIMITS_DIRECTORY}" -type f -exec ${CAT_BINARY} {} \; 2> /dev/null | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="hard" && $3=="core" && $4=="0") { print "hard core disabled" } else if ($1=="*" && $2=="hard" && $3=="core" && $4!="0") { print "hard core enabled" } }' | ${TAILBINARY} -1)
+            FIND3=$(${FINDBINARY} "${ROOTDIR}etc/security/limits.conf" "${LIMITS_DIRECTORY}" -type f -exec ${CAT_BINARY} {} \; 2> /dev/null | ${GREPBINARY} -v "^$" | ${AWKBINARY} '{ if ($1=="*" && $2=="-" && $3=="core" && $4=="0") { print "core dumps disabled" } else if ($1=="*" && $2=="-" && $3=="core" && $4!="0") { print "core dumps enabled" } }' | ${TAILBINARY} -1)
+
+            # When "* - core [value]" is used, then this sets both soft and core. In that case we set the values, as they the type 'hard' and 'soft' will not be present in the configuration file.
+            if [ "${FIND3}" = "core dumps disabled" ]; then
+                FIND1="soft core disabled"
+                FIND2="hard core disabled"
+            elif [ "${FIND3}" = "core dumps enabled" ]; then
+                FIND1="soft core enabled"
+                FIND2="hard core enabled"
+            fi
 
             IS_SOFTCORE_DISABLED="$(if [ "${FIND1}" = "soft core disabled" ]; then ${ECHOCMD} DISABLED; elif [ "${FIND1}" = "soft core enabled" ]; then ${ECHOCMD} ENABLED; else ${ECHOCMD} DEFAULT; fi)"
             IS_HARDCORE_DISABLED="$(if [ "${FIND2}" = "hard core disabled" ]; then ${ECHOCMD} DISABLED; elif [ "${FIND2}" = "hard core enabled" ]; then ${ECHOCMD} ENABLED; else ${ECHOCMD} DEFAULT; fi)"

From a7b48e40b0ef500b4e0213d2fd23194b1efd3f83 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 11 Jan 2020 11:31:40 +0100
Subject: [PATCH 437/679] [NETW-3015] check for promiscuity value that is
 higher than 0 instead of just 1

---
 include/tests_networking | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_networking b/include/tests_networking
index 22dbcb53..f52be0ac 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -530,7 +530,7 @@
             FOUNDPROMISC=0
             for I in ${NETWORK}; do
                 if [ ${USE_IP_INSTEAD_IFCONFIG} -eq 1 ]; then
-                    FIND=$(${IPBINARY} -o -d link show ${I} 2> /dev/null | ${GREPBINARY} 'promiscuity 1')
+                    FIND=$(${IPBINARY} -o -d link show ${I} 2> /dev/null | ${GREPBINARY} "promiscuity [1-9]")
                 else
                     FIND=$(${IFCONFIGBINARY} ${I} 2> /dev/null | ${GREPBINARY} PROMISC)
                 fi

From d3287bd7effe3f7d7648c848eac1ca17a46d63ce Mon Sep 17 00:00:00 2001
From: gfelkel <60182072+gfelkel@users.noreply.github.com>
Date: Wed, 22 Jan 2020 16:31:49 +0100
Subject: [PATCH 438/679] FILE-6310 for HP-UX
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

HP-UX: /usr/sbin/mount reports "/home on /dev/…", so $1 has to be used
---
 include/tests_filesystems | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/tests_filesystems b/include/tests_filesystems
index 798978e7..c709a79a 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -50,6 +50,7 @@
                 LogText "Result: directory ${I} exists"
                 case "${OS}" in
                     "AIX") FIND=$(${MOUNTBINARY} | ${AWKBINARY} -v MP=${I} '{ if ($2==MP) { print $2 }}') ;;
+                    "HP-UX") FIND=$(${MOUNTBINARY} | ${AWKBINARY} -v MP=${I} '{ if ($1==MP) { print $1 }}') ;;
                     *) FIND=$(${MOUNTBINARY} | ${AWKBINARY} -v MP=${I} '{ if ($3==MP) { print $3 }}') ;;
                 esac
 

From 5bce9d598cc546933739ec21c471a40e6e237cde Mon Sep 17 00:00:00 2001
From: gfelkel <60182072+gfelkel@users.noreply.github.com>
Date: Thu, 23 Jan 2020 13:30:46 +0100
Subject: [PATCH 439/679] AUTH-9228 for HP-UX

HP-UX also has /usr/sbin/pwck. For trusted systems, two additional options -s (check inconsistencies with the protected password database) and -l (check encrypted password lengths that are greater than 8 characters) are available.
---
 include/tests_authentication | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 786bec64..21bcf719 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -302,7 +302,7 @@
                 FIND=$(${ROOTDIR}usr/sbin/pwck -q -r 2> /dev/null; echo $?)
                 TESTED=1
             ;;
-            "Solaris")
+            "Solaris"|"HP-UX")
                 FIND=$(${ROOTDIR}usr/sbin/pwck 2> /dev/null; echo $?)
                 TESTED=1
             ;;

From 79a29381a4e708c4cbd38d831d4b2d5ad546d97e Mon Sep 17 00:00:00 2001
From: Kristian Schuster <kristian.s@outlook.de>
Date: Sun, 26 Jan 2020 19:13:26 +0100
Subject: [PATCH 440/679] restructered test and fixed vmlinuz detection

---
 include/tests_kernel | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index 0f72525e..e7b6b742 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -624,7 +624,7 @@
         fi
 
         # Check if /boot exists
-        if [ ${PRIVILEGED} -eq 1 -a -d "${ROOTDIR}boot" ]; then
+        if [ -d "${ROOTDIR}boot" ]; then
             LogText "Result: /boot exists, performing more tests from here"
             FIND=$(${LSBINARY} ${ROOTDIR}boot/* 2> /dev/null)
             if [ -n "${FIND}" ]; then
@@ -650,18 +650,17 @@
                     else
                         ReportException "${TEST_NO}:1" "Can't determine kernel version on disk, need debug data"
                     fi
-                elif [ -f ${ROOTDIR}boot/vmlinuz-linux -o -f ${ROOTDIR}boot/vmlinuz-linux-lts -o -f $(ls -t ${ROOTDIR}boot/vm[l-]* 2> /dev/null | head -1) ]; then
-                    if [ -L ${ROOTDIR}boot/vmlinuz-linux ]; then
-                        LogText "Result: found symlink ${ROOTDIR}boot/vmlinuz-linux"
-                        FOUND_VMLINUZ=$(readlink ${ROOTDIR}boot/vmlinuz-linux)
-                        LogText "Result: symlinked target is ${FOUND_VMLINUZ}"
-                        VERSION_ON_DISK=$(echo ${FOUND_VMLINUZ} | ${SEDBINARY} 's/^vmlinuz-//')
+                elif [ -f ${ROOTDIR}boot/vmlinuz-linux ] || [ -f ${ROOTDIR}boot/vmlinuz-linux-lts ] || [ -f "$(${LSBINARY} -t ${ROOTDIR}boot/vm[l0-9]* 2> /dev/null | ${HEADBINARY} -1)" ]; then
+                    if [ -f ${ROOTDIR}boot/vmlinuz-linux ]; then
+                        LogText "Result: found ${ROOTDIR}boot/vmlinuz-linux"
+                        FOUND_VMLINUZ=${ROOTDIR}boot/vmlinuz-linux
                     elif [ -f ${ROOTDIR}boot/vmlinuz-linux-lts ]; then
-                        LogText "Result: found boot/vmlinuz-linux-lts"
+                        LogText "Result: found ${ROOTDIR}boot/vmlinuz-linux-lts"
                         FOUND_VMLINUZ=${ROOTDIR}boot/vmlinuz-linux-lts
                     else
                         # Match on /boot/vm5.3.7 or /boot/vmlinuz-5.3.7-1-default
-                        FOUND_VMLINUZ=$(ls -t ${ROOTDIR}boot/vm[l-]* 2> /dev/null | head -1)
+                        FOUND_VMLINUZ=$(${LSBINARY} -t ${ROOTDIR}boot/vm[l0-9]* 2> /dev/null | ${HEADBINARY} -1)
+                        LogText "Result: found ${FOUND_VMLINUZ}"
                     fi
 
                     if [ -L "${FOUND_VMLINUZ}" ]; then
@@ -673,7 +672,6 @@
                     fi
 
                     if [ -z "${VERSION_ON_DISK}" ]; then
-                        LogText "Result: found ${FOUND_VMLINUZ}"
                         LogText "Test: checking kernel version on disk"
                         NEXTLINE=0
                         VERSION_ON_DISK=""
@@ -686,6 +684,11 @@
                                 if [ "${I}" = "version" ]; then NEXTLINE=1; fi
                             fi
                         done
+                    fi
+
+                    if [ -z "${VERSION_ON_DISK}" ]; then
+                        LogText "Result: could not find the version on disk"
+                        ReportException "${TEST_NO}:4" "Could not find the kernel version"
                     else
                         LogText "Result: found version ${VERSION_ON_DISK}"
                         ACTIVE_KERNEL=$(uname -r)
@@ -698,10 +701,6 @@
                             LogText "Result: reboot needed, as there is a difference between active kernel and the one on disk"
                         fi
                     fi
-                    if [ -z "${VERSION_ON_DISK}" ]; then
-                        LogText "Result: could not find the version on disk"
-                        ReportException "${TEST_NO}:4" "Could not find the kernel version"
-                    fi
                 else
                     if [ -L ${ROOTDIR}boot/vmlinuz ]; then
                         LogText "Result: found symlink of ${ROOTDIR}boot/vmlinuz, skipping file"

From 530ad1ef7585f62c8945db0dabf2c767901d13e8 Mon Sep 17 00:00:00 2001
From: Sascha Holzleiter <sascha@root-login.org>
Date: Tue, 28 Jan 2020 21:29:34 +0100
Subject: [PATCH 441/679] NETW-3014: Report correct promisc interface

---
 include/tests_networking | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_networking b/include/tests_networking
index f52be0ac..51bed912 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -489,10 +489,10 @@
                 # Check if this interface was whitelisted
                 if [ ${WHITELISTED} -eq 0 ]; then
                     FOUNDPROMISC=1
-                    ReportWarning "${TEST_NO}" "Found promiscuous interface (${I})"
+                    ReportWarning "${TEST_NO}" "Found promiscuous interface (${ITEM})"
                     LogText "Note: some tools put an interface into promiscuous mode, to capture/log network traffic"
                 else
-                    LogText "Result: Found promiscuous interface ${I} (*whitelisted via profile*)"
+                    LogText "Result: Found promiscuous interface ${ITEM} (*whitelisted via profile*)"
                 fi
             done
         fi

From af70303aeb9566ca1bed564f8e655720e60b4a5e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 14 Feb 2020 11:49:32 +0100
Subject: [PATCH 442/679] Set preferred option to skip plugin executiont o
 --no-plugins, as that is more in line with the other 'no' options

---
 include/helper_show |  2 +-
 include/parameters  | 10 +++++-----
 lynis.8             |  8 ++++----
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/include/helper_show b/include/helper_show
index 923f4496..fc21ead9 100644
--- a/include/helper_show
+++ b/include/helper_show
@@ -30,7 +30,7 @@
 
 COMMANDS="audit configure generate show update upload-only"
 HELPERS="audit configure show update"
-OPTIONS="--auditor\n--cronjob (--cron)\n--debug\n--developer\n--devops\n--forensics\n--help (-h)\n--log-file\n--manpage (--man)\n--no-colors\n--no-log\n--pentest\n--profile\n--plugin-dir\n--quick (-Q)\n--quiet (-q)\n--report-file\n--reverse-colors\n--skip-plugins\n--tests\n--tests-from-category\n--tests-from-group\n--usecwd\n--upload\n--verbose\n--version (-V)\n--wait\n--warnings-only"
+OPTIONS="--auditor\n--cronjob (--cron)\n--debug\n--developer\n--devops\n--forensics\n--help (-h)\n--log-file\n--manpage (--man)\n--no-colors\n--no-log\n--no-plugins\n--pentest\n--profile\n--plugin-dir\n--quick (-Q)\n--quiet (-q)\n--report-file\n--reverse-colors\n--tests\n--tests-from-category\n--tests-from-group\n--usecwd\n--upload\n--verbose\n--version (-V)\n--wait\n--warnings-only"
 
 SHOW_ARGS="categories changelog commands dbdir details environment eol groups help hostids includedir language license logfile man options os pidfile plugindir profiles release releasedate report settings tests version workdir"
 SHOW_HELP="lynis show ${BROWN}categories${NORMAL}              (display test categories)
diff --git a/include/parameters b/include/parameters
index b8676b4c..77a6084f 100644
--- a/include/parameters
+++ b/include/parameters
@@ -280,6 +280,11 @@
                 LOGFILE="/dev/null"
             ;;
 
+            # Skip execution of plugins
+            --no-plugins | --noplugins | --skip-plugins)
+                SKIP_PLUGINS=1
+            ;;
+
             --pen-test | --pentest)
                 PENTESTINGMODE=1
             ;;
@@ -359,11 +364,6 @@
                 fi
             ;;
 
-            # Skip execution of plugins
-            --skip-plugins | --no-plugins | --noplugins)
-                SKIP_PLUGINS=1
-            ;;
-
             # Only scan these tests
             --tests)
                 shift
diff --git a/lynis.8 b/lynis.8
index 719e82c7..717a6c4a 100644
--- a/lynis.8
+++ b/lynis.8
@@ -1,4 +1,4 @@
-.TH Lynis 8 "4 Dec 2019" "1.31" "Unix System Administrator's Manual"
+.TH Lynis 8 "14 Feb 2020" "1.32" "Unix System Administrator's Manual"
 
 
 .SH "NAME"
@@ -91,6 +91,9 @@ Disable colored output.
 Redirect all logging information to /dev/null, prevents sensitive information to
 be written to disk.
 .TP
+.B \-\-no\-plugins
+Do not run any of the enabled plugins.
+.TP
 .B \-\-pentest
 Run a non-privileged scan, usually used for penetration testing. Some of the
 tests will be skipped if they require root permissions.
@@ -113,9 +116,6 @@ Provide an alternative name for report file.
 .B \-\-reverse\-colors
 Optimize screen output for light backgrounds.
 .TP
-.B \-\-skip\-plugins
-Do not run plugins.
-.TP
 .B \-\-tests TEST-IDs
 Only run the specific test(s). When using multiple tests, add quotes around the
 line.

From 5ca8baf7a8b3a31a4893d8130fa85f085d3b1ef2 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 15 Feb 2020 14:09:23 +0100
Subject: [PATCH 443/679] [USB-2000] improved testing for USB devices and
 filtering out possible incorrect state

---
 include/tests_usb | 67 ++++++++++++++++++++++++++---------------------
 1 file changed, 37 insertions(+), 30 deletions(-)

diff --git a/include/tests_usb b/include/tests_usb
index 24c74982..1c6cae6d 100644
--- a/include/tests_usb
+++ b/include/tests_usb
@@ -91,39 +91,46 @@
     # Description : Check USB authorizations
     Register --test-no USB-2000 --os Linux --weight L --network NO --category security --description "Check USB authorizations"
     if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: Checking USB devices authorization to connect to the system"
         FOUND=0
-        USBDEVICESPATH="${ROOTDIR}sys/bus/usb/devices/usb"
-        for device in "${USBDEVICESPATH}"*; do
-            if [ -e "${device}/authorized" -o -e "${device}/authorized_default" ]; then
-                if [ "$(cat "${device}/authorized_default")" = "1" ]; then
-                    FOUND=1
-                    LogText "Test: ${device} is authorized by default"
-                    Report "usb_authorized_default_device[]=${device}"
-                elif [ "$(cat "${device}/authorized")" = "1" ]; then
-                    FOUND=1
-                    LogText "Test: ${device} is authorized currently"
-                    Report "usb_authorized_device[]=${device}"
-                fi
-            else
-                LogText "Test: ${device} is authorized by default"
-                Report "usb_authorized_default_device[]=${device}"
-                FOUND=1
-            fi
-        done
+        USBDEVICESPATH="${ROOTDIR}sys/bus/usb/devices"
+        LogText "Test: checking presence of USB devices path (${USBDEVICESPATH})"
+        if [ -d "${USBDEVICESPATH}" ]; then
 
-        if [ ${FOUND} -eq 1 ]; then
-            LogText "Result: Some USB devices are authorized by default (or temporary) to connect to the system"
-            Display --indent 2 --text "- Checking USB devices authorization" --result "${STATUS_ENABLED}" --color YELLOW
-            # To-Be-Added: create documentation and enable the suggestion
-            #if [ ${USBGUARD_FOUND} -eq 0 ]; then
-            #   ReportSuggestion "${TEST_NO}" "Disable USB devices authorization, to prevent unauthorized storage or data theft"
-            #fi
-            AddHP 0 3
+            LogText "Test: Checking USB devices authorization to connect to the system"
+            for device in $(find ${USBDEVICESPATH} -name "usb*" -type l -print); do
+                if [ -e "${device}/authorized" -o -e "${device}/authorized_default" ]; then
+                    if [ "$(cat "${device}/authorized_default")" = "1" ]; then
+                        FOUND=1
+                        LogText "Test: ${device} is authorized by default (authorized_default=1)"
+                        Report "usb_authorized_default_device[]=${device}"
+                    fi
+                    if [ "$(cat "${device}/authorized")" = "1" ]; then
+                        FOUND=1
+                        LogText "Test: ${device} is authorized currently (authorized=1)"
+                        Report "usb_authorized_device[]=${device}"
+                    fi
+                else
+                    LogText "Test: no authorized or authorized_default file, assuming ${device} is authorized by default"
+                    Report "usb_authorized_default_device[]=${device}"
+                    FOUND=1
+                fi
+            done
+
+            if [ ${FOUND} -eq 1 ]; then
+                LogText "Result: Some USB devices are authorized by default (or temporary) to connect to the system"
+                Display --indent 2 --text "- Checking USB devices authorization" --result "${STATUS_ENABLED}" --color YELLOW
+                # TODO: create documentation and enable the suggestion
+                #if [ ${USBGUARD_FOUND} -eq 0 ]; then
+                #   ReportSuggestion "${TEST_NO}" "Disable USB devices authorization, to prevent unauthorized storage or data theft"
+                #fi
+                AddHP 0 3
+            else
+                LogText "Result: None USB devices are authorized by default (or temporary) to connect to the system"
+                Display --indent 2 --text "- Checking USB devices authorization" --result "${STATUS_DISABLED}" --color GREEN
+                AddHP 3 3
+            fi
         else
-            LogText "Result: None USB devices are authorized by default (or temporary) to connect to the system"
-            Display --indent 2 --text "- Checking USB devices authorization" --result "${STATUS_DISABLED}" --color GREEN
-            AddHP 3 3
+            LogText "Result: devices path does not exist"
         fi
     fi
 

From 3bbe34ea736968e572dbc65aaec2d91e217c6eff Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 15 Feb 2020 14:09:56 +0100
Subject: [PATCH 444/679] [CRYP-8004] enhanced after pulling in initital test

---
 db/tests.db          |  1 +
 include/tests_crypto | 16 +++++++++-------
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/db/tests.db b/db/tests.db
index cbe892b9..e057c06e 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -86,6 +86,7 @@ CORE-1000:test:performance:system_integrity::Check all system binaries:
 CRYP-7902:test:security:crypto::Check expire date of SSL certificates:
 CRYP-7930:test:security:crypto:Linux:Determine if system uses LUKS encryption:
 CRYP-8002:test:security:crypto:Linux:Gather kernel entropy:
+CRYP-8004:test:security:crypto:Linux:Presence of hardware number generator:
 DNS-1600:test:security:dns::Validating that the DNSSEC signatures are checked:
 DBS-1804:test:security:databases::Checking active MySQL process:
 DBS-1816:test:security:databases::Checking MySQL root password:
diff --git a/include/tests_crypto b/include/tests_crypto
index 9c40ff47..548ba0a0 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -196,22 +196,24 @@
 #################################################################################
 #
     # Test        : CRYP-8004
-    # Description : Test for HWRNG & rngd
-    Register --test-no CRYP-8004 --os Linux --weight L --network NO --root-only NO --category security --description "Test for HWRNG & rngd"
+    # Description : Test for presence of random number generators
+    Register --test-no CRYP-8004 --os Linux --weight L --network NO --root-only NO --category security --description "Presence of random number generators"
     if [ ${SKIPTEST} -eq 0 ]; then
-        if [ -f ${ROOTDIR}sys/class/misc/hw_random/rng_current ]; then
-            DATA=$(${CAT_BINARY} ${ROOTDIR}sys/class/misc/hw_random/rng_current)
+        LogText "Test: looking for ${ROOTDIR}sys/class/misc/hw_random/rng_current"
+        if [ -f "${ROOTDIR}sys/class/misc/hw_random/rng_current" ]; then
+            DATA=$(${HEADBINARY} --lines=1 ${ROOTDIR}sys/class/misc/hw_random/rng_current | ${TRBINARY} -d '[[:cntrl:]]')
             if [ "${DATA}" != "none" ]; then
-                LogText "Result: found HW RNG: ${DATA}"
+                LogText "Result: positive match, found RNG: ${DATA}"
                 if IsRunning "rngd"; then
                     Display --indent 2 --text "- HW RNG & rngd" --result "${STATUS_YES}" --color GREEN
                     LogText "Result: rngd is running"
                 else
                     Display --indent 2 --text "- HW RNG & rngd" --result "${STATUS_NO}" --color YELLOW
-                    ReportSuggestion "${TEST_NO}" "Utilize HW RNG by running rngd"
+                    # TODO - enable suggestion when website has listing for this control
+                    # ReportSuggestion "${TEST_NO}" "Utilize hardware random number generation by running rngd"
                 fi
             else
-                Display --indent 2 --text "- HW RNG & rngd" --result "${STATUS_NO}" --color RED
+                Display --indent 2 --text "- HW RNG & rngd" --result "${STATUS_NO}" --color YELLOW
                 LogText "Result: no HW RNG available"
             fi
         else

From d81cc71790144ed9ff354748254d300d297f3da6 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 15 Feb 2020 14:10:48 +0100
Subject: [PATCH 445/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 34fa7423..6538e1cd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -47,6 +47,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - New profile option: disable-plugin - disables a single plugin
 - New profile option: ssl-certificate-paths-to-ignore - ignore a path
 - New test: CRYP-7930 - test for LUKS encryption
+- New test: CRYP-8004 - presence of hardware random number generator
 - New test: DBS-1828  - PostgreSQL configuration files
 - New test: FINT-4316 - presence of AIDE database and size test
 - New test: INSE-8314 - test for NIS client

From 91ad10d464dab3450e3107f95e7de649b15d2d1b Mon Sep 17 00:00:00 2001
From: Nicolas CARPi <nicolas.carpi@curie.fr>
Date: Tue, 18 Feb 2020 22:19:45 +0100
Subject: [PATCH 446/679] Remove the test for ssh config VerifyReverseMapping

This option is deprecated since 2003. Having it in a config file raises
a warning and UseDNS (that is on by default) includes the
VerifyReverseMapping check.

See
https://github.com/openssh/openssh-portable/commit/3a961dc0d36c1f87788b707130f6d07709822d38

See #528
---
 include/tests_ssh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/include/tests_ssh b/include/tests_ssh
index 5c8b3775..44424b3a 100644
--- a/include/tests_ssh
+++ b/include/tests_ssh
@@ -151,7 +151,6 @@
                 StrictModes:YES,,NO:=\
                 TCPKeepAlive:NO,,YES:=\
                 UseDNS:NO,,YES:=\
-                VerifyReverseMapping:YES,,NO:=\
                 X11Forwarding:NO,,YES:=\
                 AllowAgentForwarding:NO,,YES:="
 

From 42b2831f758cd5a229a4615f1ffc8a500394ebd4 Mon Sep 17 00:00:00 2001
From: Kevin <kevin.klopfenstein@bedag.ch>
Date: Fri, 21 Feb 2020 08:04:08 +0100
Subject: [PATCH 447/679] add basic xbps/void support

---
 include/binaries  | 1 +
 include/functions | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/include/binaries b/include/binaries
index f567ed1f..0eaf6acb 100644
--- a/include/binaries
+++ b/include/binaries
@@ -154,6 +154,7 @@
                             docker)                 DOCKERBINARY="${BINARY}";          LogText "  Found known binary: docker (container technology) - ${BINARY}" ;;
                             domainname)             DOMAINNAMEBINARY="${BINARY}";      LogText "  Found known binary: domainname (NIS domain) - ${BINARY}" ;;
                             dpkg)                   DPKGBINARY="${BINARY}";            LogText "  Found known binary: dpkg (package management) - ${BINARY}" ;;
+                            xbps-query)             XBPSBINARY="${BINARY}";            LogText "  Found known binary: xbps (package management) - ${BINARY}" ;;
                             egrep)                  EGREPBINARY=${BINARY};             LogText "  Found known binary: egrep (text search) - ${BINARY}" ;;
                             equery)                 EQUERYBINARY="${BINARY}";          LogText "  Found known binary: query (package manager) - ${BINARY}" ;;
                             exim)                   EXIMBINARY="${BINARY}";            EXIMVERSION=$(${BINARY} -bV | grep 'Exim version' | awk '{ print $3 }' | xargs); LogText "  Found known binary ${BINARY} (version ${EXIMVERSION})" ;;
diff --git a/include/functions b/include/functions
index de40a427..7b31cdc3 100644
--- a/include/functions
+++ b/include/functions
@@ -2050,6 +2050,9 @@
         elif [ -n "${ZYPPERBINARY}" ]; then
             output=$(${ZYPPERBINARY} --quiet --non-interactive search --installed -i ${package} 2> /dev/null | grep "^i")
             if [ -n "${output}" ]; then exit_code=0; else exit_code=1; fi
+        elif [ -n "${XBPSBINARY}" ]; then
+            output=$(${XBPSBINARY} ${package} 2> /dev/null | ${GREPBINARY} "^ii")
+            exit_code=$?
         else
             ReportException "PackageIsInstalled:01"
         fi

From 35e568e695da2a0d37854f2b769cb438747e3e58 Mon Sep 17 00:00:00 2001
From: Skactor <sk4ct0r@gmail.com>
Date: Mon, 24 Feb 2020 20:44:05 +0800
Subject: [PATCH 448/679] Update tests_ports_packages

Incorrect constant name spelling
---
 include/tests_ports_packages | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 4d037bf7..326bd94f 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -1347,7 +1347,7 @@
                 Display --indent 2 --text "- Toolkit for automatic upgrades (${UNATTENDED_UPGRADES_TOOL})" --result "${STATUS_FOUND}" --color GREEN
             else
                 AddHP 1 5
-                Display --indent 2 --text "- Toolkit for automatic upgrades" --result "${STATUS_NOTFOUND}" --color YELLOW
+                Display --indent 2 --text "- Toolkit for automatic upgrades" --result "${STATUS_NOT_FOUND}" --color YELLOW
                 LogText "Result: no toolkit for automatic updates discovered"
                 ReportSuggestion "${TEST_NO}" "Consider using a tool to automatically apply upgrades"
             fi

From d8a3bc8afae3430abc1b1c366d77496c0e06d17a Mon Sep 17 00:00:00 2001
From: maczniak <maczniak@gmail.com>
Date: Mon, 24 Feb 2020 23:17:09 +0900
Subject: [PATCH 449/679] fix CISOfy/lynis#844

---
 include/tests_ssh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_ssh b/include/tests_ssh
index 5c8b3775..36de9c4b 100644
--- a/include/tests_ssh
+++ b/include/tests_ssh
@@ -117,7 +117,7 @@
     # Test        : SSH-7408
     # Description : Check SSH specific defined options
     # Notes       : Instead of parsing the configuration file, we query the SSH daemon itself
-    if [ ${OPENSSHD_RUNNING} -eq 1 -a -n "${SSH_DAEMON_OPTIONS_FILE}" -a ${OPENSSHD_VERSION_MAJOR} -ge 5 -a ${OPENSSHD_VERSION_MINOR} -ge 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ ${OPENSSHD_RUNNING} -eq 1 -a -n "${SSH_DAEMON_OPTIONS_FILE}" -a \( ${OPENSSHD_VERSION_MAJOR} -gt 5 -o ${OPENSSHD_VERSION_MAJOR} -eq 5 -a ${OPENSSHD_VERSION_MINOR} -ge 1 \) ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no SSH-7408 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check SSH specific defined options"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking specific defined options in ${SSH_DAEMON_OPTIONS_FILE}"

From fc7c5fb7234ffa4e7ac26b1094e44b6b2fb6a2eb Mon Sep 17 00:00:00 2001
From: Skactor <sk4ct0r@gmail.com>
Date: Tue, 25 Feb 2020 15:48:55 +0800
Subject: [PATCH 450/679] Update tests_shells

Write function as variable due to careless error
---
 include/tests_shells | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_shells b/include/tests_shells
index f440da5a..d4b3d9a3 100644
--- a/include/tests_shells
+++ b/include/tests_shells
@@ -115,7 +115,7 @@
         if IsRunning "autolog"; then
             IDLE_TIMEOUT=1
             LogText "Result: found autolog process to kill idle sessions"
-            Report="session_timeout_method[]=autolog"
+            Report "session_timeout_method[]=autolog"
             IDLE_TIMEOUT_METHOD="autolog"
         fi
 

From 30b1e4170bfffad8894b68d8b82f2e2cfa3e89b0 Mon Sep 17 00:00:00 2001
From: Mark Garrett <mark.garrett@optus.com.au>
Date: Sun, 1 Mar 2020 10:18:33 +1100
Subject: [PATCH 451/679] macosx add Catalina 10.15

---
 include/osdetection | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/osdetection b/include/osdetection
index cf9d1eac..c048c0ac 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -61,6 +61,7 @@
                     10.12 | 10.12.[0-9]*) OS_FULLNAME="macOS Sierra (${OS_VERSION})" ;;
                     10.13 | 10.13.[0-9]*) OS_FULLNAME="macOS High Sierra (${OS_VERSION})" ;;
                     10.14 | 10.14.[0-9]*) OS_FULLNAME="macOS Mojave (${OS_VERSION})" ;;
+		    10.15 | 10.15.[0-9]*) OS_FULLNAME="macOS Catalina (${OS_VERSION})" ;;
                     *) echo "Unknown macOS version. Do you know what version it is? Create an issue at ${PROGRAM_SOURCE}" ;;
                 esac
             else

From b2f676da7bf99090f384888b56bc20216bb5bc94 Mon Sep 17 00:00:00 2001
From: Mark Garrett <mark.garrett@optus.com.au>
Date: Sun, 1 Mar 2020 10:19:33 +1100
Subject: [PATCH 452/679] allow for correct spelling for colour should drop the
 s from colours but didnt

---
 include/parameters | 4 ++--
 lynis              | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/include/parameters b/include/parameters
index b8676b4c..e682824f 100644
--- a/include/parameters
+++ b/include/parameters
@@ -270,7 +270,7 @@
             ;;
 
             # Don't use colors
-            --no-colors | --nocolors)
+            --no-colors | --nocolors | --no-colours | --nocolours)
                 COLORS=0
                 RemoveColors
             ;;
@@ -332,7 +332,7 @@
             ;;
 
             # Strip the colors which aren't clearly visible on light backgrounds
-            --reverse-colors)
+            --reverse-colors| --reverse-colours)
                 BLUE="${NORMAL}";
                 SECTION="${NORMAL}";
                 NOTICE="${NORMAL}";
diff --git a/lynis b/lynis
index 081833bb..66a56acc 100755
--- a/lynis
+++ b/lynis
@@ -436,8 +436,10 @@ ${YELLOW}Note: ${WHITE}Cancelling the program can leave temporary files behind${
 
     ${WHITE}Layout options${NORMAL}
     ${GRAY}--no-colors${NORMAL}                       : Don't use colors in output
+    ${GRAY}--no-colours${NORMAL}                      : Don't use colours in output
     ${GRAY}--quiet (-q)${NORMAL}                      : No output
     ${GRAY}--reverse-colors${NORMAL}                  : Optimize color display for light backgrounds
+    ${GRAY}--reverse-colours${NORMAL}                 : Optimize colour display for light backgrounds
 
     ${WHITE}Misc options${NORMAL}
     ${GRAY}--debug${NORMAL}                           : Debug logging to screen

From 0cd256372cda0d41d95a176e37e0404f426ccb1e Mon Sep 17 00:00:00 2001
From: Mark Garrett <mark.garrett@optus.com.au>
Date: Sun, 1 Mar 2020 10:31:52 +1100
Subject: [PATCH 453/679] fix whitespace

---
 include/osdetection | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/osdetection b/include/osdetection
index c048c0ac..f06b23b6 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -61,7 +61,7 @@
                     10.12 | 10.12.[0-9]*) OS_FULLNAME="macOS Sierra (${OS_VERSION})" ;;
                     10.13 | 10.13.[0-9]*) OS_FULLNAME="macOS High Sierra (${OS_VERSION})" ;;
                     10.14 | 10.14.[0-9]*) OS_FULLNAME="macOS Mojave (${OS_VERSION})" ;;
-		    10.15 | 10.15.[0-9]*) OS_FULLNAME="macOS Catalina (${OS_VERSION})" ;;
+                    10.15 | 10.15.[0-9]*) OS_FULLNAME="macOS Catalina (${OS_VERSION})" ;;
                     *) echo "Unknown macOS version. Do you know what version it is? Create an issue at ${PROGRAM_SOURCE}" ;;
                 esac
             else

From 22ceeaa9262000234b8209d29e14e3ce73d67e5b Mon Sep 17 00:00:00 2001
From: Craig Comstock <craig@unreasonablefarm.org>
Date: Tue, 3 Mar 2020 13:56:33 -0600
Subject: [PATCH 454/679] Added detection of PureOS in /etc/os-release

---
 include/osdetection | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/include/osdetection b/include/osdetection
index cf9d1eac..5a136732 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -180,6 +180,13 @@
                             OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="Debian"
                         ;;
+                        "pureos")
+                            LINUX_VERSION="PureOS"
+                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_NAME="PureOS"
+                        ;;
                         "manjaro")
                             LINUX_VERSION="Manjaro"
                             OS_FULLNAME="Manjaro Linux"

From e008907ff1242f6055a4591f75eae73ea53e1d3a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 4 Mar 2020 14:51:13 +0100
Subject: [PATCH 455/679] Remove 's' from word 'colours'

---
 include/parameters | 4 ++--
 lynis              | 1 -
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/include/parameters b/include/parameters
index bdbbfae5..0edae1cd 100644
--- a/include/parameters
+++ b/include/parameters
@@ -270,7 +270,7 @@
             ;;
 
             # Don't use colors
-            --no-colors | --nocolors | --no-colours | --nocolours)
+            --no-colors | --nocolors | --no-colour | --nocolour)
                 COLORS=0
                 RemoveColors
             ;;
@@ -337,7 +337,7 @@
             ;;
 
             # Strip the colors which aren't clearly visible on light backgrounds
-            --reverse-colors| --reverse-colours)
+            --reverse-colors| --reverse-colour)
                 BLUE="${NORMAL}";
                 SECTION="${NORMAL}";
                 NOTICE="${NORMAL}";
diff --git a/lynis b/lynis
index 66a56acc..f39dd7af 100755
--- a/lynis
+++ b/lynis
@@ -436,7 +436,6 @@ ${YELLOW}Note: ${WHITE}Cancelling the program can leave temporary files behind${
 
     ${WHITE}Layout options${NORMAL}
     ${GRAY}--no-colors${NORMAL}                       : Don't use colors in output
-    ${GRAY}--no-colours${NORMAL}                      : Don't use colours in output
     ${GRAY}--quiet (-q)${NORMAL}                      : No output
     ${GRAY}--reverse-colors${NORMAL}                  : Optimize color display for light backgrounds
     ${GRAY}--reverse-colours${NORMAL}                 : Optimize colour display for light backgrounds

From 5faf69af1611ce046de3a9e4dd088bb4806f3bdc Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 4 Mar 2020 15:02:39 +0100
Subject: [PATCH 456/679] Code enhancement to avoid repetition

---
 include/osdetection | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/include/osdetection b/include/osdetection
index 35d0b576..dc6eacae 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -139,12 +139,12 @@
 
             # Generic
             if [ -e /etc/os-release ]; then
+                OS_FULLNAME=$(awk -F= '/^PRETTY_NAME=/ {print substr($2,2,length($2)-2)}' /etc/os-release)
                 OS_ID=$(grep "^ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                 if [ -n "${OS_ID}" ]; then
                     case ${OS_ID} in
                         "amzn")
                             LINUX_VERSION="Amazon Linux"
-                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="Amazon Linux"
                             OS_REDHAT_OR_CLONE=1
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
@@ -156,34 +156,29 @@
                         ;;
                         "centos")
                             LINUX_VERSION="CentOS"
-                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="CentOS Linux"
                             OS_REDHAT_OR_CLONE=1
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                         ;;
                         "clear-linux-os")
                             LINUX_VERSION="Clear Linux OS"
-                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="Clear Linux OS"
                             OS_REDHAT_OR_CLONE=1
                             OS_VERSION="Rolling release"
                         ;;
                         "coreos")
                             LINUX_VERSION="CoreOS"
-                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="CoreOS Linux"
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                         ;;
                         "debian")
                             LINUX_VERSION="Debian"
-                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="Debian"
                         ;;
                         "pureos")
                             LINUX_VERSION="PureOS"
-                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="PureOS"
@@ -196,27 +191,23 @@
                         ;;
                         "opensuse-tumbleweed")
                             LINUX_VERSION="openSUSE Tumbleweed"
-                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             # It's rolling release but has a snapshot version (the date of the snapshot)
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="openSUSE"
                         ;;
                         "opensuse-leap")
                             LINUX_VERSION="openSUSE Leap"
-                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="openSUSE"
                         ;;
                         "ubuntu")
                             LINUX_VERSION="Ubuntu"
-                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="Ubuntu"
                         ;;
                         "raspbian")
                             LINUX_VERSION="Raspbian"
-                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="Raspbian"
@@ -231,7 +222,6 @@
                         ;;
                         "slackware")
                             LINUX_VERSION="Slackware"
-                            OS_FULLNAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="Slackware Linux"
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')

From 4d1a170e84225174b8fde01a23f88dfaa16c89c0 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 4 Mar 2020 15:03:23 +0100
Subject: [PATCH 457/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6538e1cd..d9163527 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -59,6 +59,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - Sending USR1 signal to Lynis process will show active status
 - Measure timing of tests and report slow tests (10+ seconds)
 - Initial support for Clear Linux OS
+- Initial support for PureOS
 - Added end-of-life data for Arch Linux and Debian
 - Detection and end-of-life data added for Amazon Linux
 - Detection of linux-lts on Arch Linux

From c0158da38ea4b95c4789b072447a820f288ee2f3 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 4 Mar 2020 15:04:54 +0100
Subject: [PATCH 458/679] Corrected test ID

---
 include/tests_mail_messaging | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_mail_messaging b/include/tests_mail_messaging
index 63b43804..dbe449af 100644
--- a/include/tests_mail_messaging
+++ b/include/tests_mail_messaging
@@ -61,7 +61,7 @@
     # Test        : MAIL-8804
     # Description : Exim configuration options
     if [ ${EXIM_RUNNING} -eq 1 -a ! "${EXIMBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no MAIL-8803 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Exim configuration options"
+    Register --test-no MAIL-8804 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Exim configuration options"
     if [ ${SKIPTEST} -eq 0 -a ${EXIM_RUNNING} -eq 1 ]; then
         LogText "Test: Exim configuration options"
 

From 28bd36d9c6d0d695f0b92459407cf11a91411694 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 4 Mar 2020 15:09:10 +0100
Subject: [PATCH 459/679] Added Fedora

---
 include/osdetection | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/include/osdetection b/include/osdetection
index dc6eacae..5d65aa51 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -173,9 +173,15 @@
                         ;;
                         "debian")
                             LINUX_VERSION="Debian"
+                            OS_NAME="Debian"
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
-                            OS_NAME="Debian"
+                        ;;
+                        "fedora")
+                            LINUX_VERSION="Fedora"
+                            OS_NAME="Fedora Linux"
+                            OS_REDHAT_OR_CLONE=1
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                         ;;
                         "pureos")
                             LINUX_VERSION="PureOS"

From 24ca3c20459c93385994d9b8e2d2b6b24a32ec1b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 4 Mar 2020 19:38:22 +0100
Subject: [PATCH 460/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d9163527..4b00ec84 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -113,6 +113,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - SSH-7406 - strip OpenSSH patch version and remove characters (carriage return)
 - SSH-7408 - changed text in suggestion and report
 - SSH-7408 - added forced-commands-only option
+- SSH-7408 - VerifyReverseMapping removed (deprecated)
 - STRG-1840 - renamed to USB-1000
 - STRG-1842 - added default authorized devices and renamed to USB-2000
 - TOOL-5002 - differentiate between a discovered binary and running process

From 0593c69f2f434e79c5e3af1cdd1e5e0ffd714543 Mon Sep 17 00:00:00 2001
From: Nicolas CARPi <nicolas.carpi@curie.fr>
Date: Thu, 5 Mar 2020 00:53:27 +0100
Subject: [PATCH 461/679] Skip the PHP cli configuration file when looking for
 expose_php

The expose_php configuration option is only relevant for non-cli PHP and
thus lynis should not look for it in config files that are for cli

Fix #849
---
 CHANGELOG.md      | 1 +
 include/tests_php | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4b00ec84..34dc6829 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -102,6 +102,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - NAME-4404 - improved screen and log output
 - NAME-4408 - corrected Report function call
 - NETW-3032 - small rewrite of test and extended with addrwatch
+- PHP-2372 - don't look in the cli configuration files
 - PKGS-7410 - use multiple package managers when available
 - PKGS-7410 - added support for Zypper to test number of kernels
 - PROC-3602 - allow different root directory
diff --git a/include/tests_php b/include/tests_php
index d84b181a..6e4d44f9 100644
--- a/include/tests_php
+++ b/include/tests_php
@@ -291,6 +291,8 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
         for FILE in ${PHPINI_ALLFILES}; do
+            # Don't look at this setting in cli configuration
+            if [[ ${FILE} == *"/cli/"* ]]; then continue; fi
             LogText "Test: Checking file ${FILE}"
             FIND=$(${EGREPBINARY} -i 'expose_php.*(on|yes|1)' ${FILE} | ${GREPBINARY} -v '^;')
             if HasData "${FIND}"; then

From 600cb84310b0b97aad7184b5224fdc3ba18a04be Mon Sep 17 00:00:00 2001
From: Nicolas CARPi <nicolas.carpi@curie.fr>
Date: Thu, 5 Mar 2020 21:42:54 +0100
Subject: [PATCH 462/679] Use a POSIX implementation to check for substring

This works with all shells, even busybox.
---
 include/tests_php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/include/tests_php b/include/tests_php
index 6e4d44f9..120b7dcb 100644
--- a/include/tests_php
+++ b/include/tests_php
@@ -292,7 +292,11 @@
         FOUND=0
         for FILE in ${PHPINI_ALLFILES}; do
             # Don't look at this setting in cli configuration
-            if [[ ${FILE} == *"/cli/"* ]]; then continue; fi
+            case "${FILE}" in
+                */cli/*)
+                    continue
+                    ;;
+            esac
             LogText "Test: Checking file ${FILE}"
             FIND=$(${EGREPBINARY} -i 'expose_php.*(on|yes|1)' ${FILE} | ${GREPBINARY} -v '^;')
             if HasData "${FIND}"; then

From 30a456c5f44fe57f705e2958d01c8c4b08691880 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 11 Mar 2020 15:56:32 +0100
Subject: [PATCH 463/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4b00ec84..d22601fe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -60,6 +60,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - Measure timing of tests and report slow tests (10+ seconds)
 - Initial support for Clear Linux OS
 - Initial support for PureOS
+- Support for X Binary Package (xbps)
 - Added end-of-life data for Arch Linux and Debian
 - Detection and end-of-life data added for Amazon Linux
 - Detection of linux-lts on Arch Linux

From 0b0b0ea90515c42062d43d244016dceee6889147 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 12 Mar 2020 16:01:11 +0100
Subject: [PATCH 464/679] Style improvement

---
 include/parameters           | 2 +-
 include/tests_authentication | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/parameters b/include/parameters
index 0edae1cd..2d9ef14d 100644
--- a/include/parameters
+++ b/include/parameters
@@ -337,7 +337,7 @@
             ;;
 
             # Strip the colors which aren't clearly visible on light backgrounds
-            --reverse-colors| --reverse-colour)
+            --reverse-colors | --reverse-colour)
                 BLUE="${NORMAL}";
                 SECTION="${NORMAL}";
                 NOTICE="${NORMAL}";
diff --git a/include/tests_authentication b/include/tests_authentication
index 21bcf719..a20f8976 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -302,7 +302,7 @@
                 FIND=$(${ROOTDIR}usr/sbin/pwck -q -r 2> /dev/null; echo $?)
                 TESTED=1
             ;;
-            "Solaris"|"HP-UX")
+            "Solaris" | "HP-UX")
                 FIND=$(${ROOTDIR}usr/sbin/pwck 2> /dev/null; echo $?)
                 TESTED=1
             ;;

From 7a1719ef75d8ef714ab77ed283e35c3d3d89dd8b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 12 Mar 2020 16:01:19 +0100
Subject: [PATCH 465/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d22601fe..518b9d60 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -72,6 +72,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - Profiles: unused options removed
 - Profiles: message is displayed when old format "key:value" is used
 - Security: the 'nounset' (set -u) parameter is now activated by default
+- AUTH-9228 - HP-UX support
 - AUTH-9266 - skip .pam-old files in /etc/pam.d
 - AUTH-9282 - fix: temporary variable was overwritten
 - AUTH-9408 - added support for pam_tally2 to log failed logins

From 7c01b9784b8a9ac286525dbaad437d65378101ab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Dequ=C3=A8nes=20=28Duck=29?= <duck@redhat.com>
Date: Tue, 17 Mar 2020 12:01:21 +0900
Subject: [PATCH 466/679] Fix quote syntax error in manpage

Quotes have a special meaning when used at the start of line.
---
 lynis.8 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lynis.8 b/lynis.8
index 717a6c4a..3d674e74 100644
--- a/lynis.8
+++ b/lynis.8
@@ -122,7 +122,7 @@ line.
 .TP
 .B \-\-tests\-from\-category "<category>"
 Tests are only performed if they belong to the defined category. Use the command
-'show categories' to determine all valid options.
+\ 'show categories' to determine all valid options.
 .TP
 .B \-\-tests\-from\-group "<group>"
 Similar to \-\-tests\-from\-category. Only perform tests from a particular group.

From d1db448c515b9aa5de34bf37c90395b9c9daee4b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 17 Mar 2020 13:02:59 +0100
Subject: [PATCH 467/679] Skip pacman when it is the game instead of package
 manager

---
 CHANGELOG.md     | 1 +
 include/binaries | 7 ++++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 518b9d60..501729b4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -71,6 +71,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - Function: PackageIsInstalled extended with pacman support
 - Profiles: unused options removed
 - Profiles: message is displayed when old format "key:value" is used
+- Binaries: skip pacman when it is the game instead of package manager
 - Security: the 'nounset' (set -u) parameter is now activated by default
 - AUTH-9228 - HP-UX support
 - AUTH-9266 - skip .pam-old files in /etc/pam.d
diff --git a/include/binaries b/include/binaries
index 0eaf6acb..3f5d72ea 100644
--- a/include/binaries
+++ b/include/binaries
@@ -216,7 +216,12 @@
                             ntpq)                   NTPQBINARY="${BINARY}";            LogText "  Found known binary ntpq (time daemon client) - ${BINARY}" ;;
                             osiris)                 OSIRISBINARY="${BINARY}";          LogText "  Found known binary: osiris - ${BINARY}" ;;
                             openssl)                OPENSSLBINARY="${BINARY}";         OPENSSLVERSION=$(${BINARY} version 2> /dev/null | head -n 1 | awk '{ print $2 }' | xargs); LogText "Found ${BINARY} (version ${OPENSSLVERSION})" ;;
-                            pacman)                 PACMANBINARY="${BINARY}";          LogText "  Found known binary: pacman (package manager) - ${BINARY}" ;;
+                            pacman)
+                                if [ -z "$(echo "${BINARY}" | grep -E "/usr(/local)?/games")" ]; then
+                                    PACMANBINARY="${BINARY}"
+                                    LogText "  Found known binary: pacman (package manager) - ${BINARY}"
+                                fi
+                            ;;
                             perl)                   PERLBINARY="${BINARY}";            PERLVERSION=$(${BINARY} -V:version | sed 's/^version=//' | sed 's/;//' | xargs); LogText "Found ${BINARY} (version ${PERLVERSION})" ;;
                             pgrep)                  PGREPBINARY="${BINARY}";           LogText "  Found known binary: pgrep (search in process list) - ${BINARY}" ;;
                             php)                    PHPBINARY="${BINARY}";             PHPVERSION=$(${BINARY} -v | awk '{ if ($1=="PHP") { print $2 }}' | head -1); LogText "Found known binary: php (programming language interpreter) - ${BINARY} (version ${PHPVERSION})" ;;

From 6e3e93d5854960dee1e7516922647c303e4094b8 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 17 Mar 2020 16:05:14 +0100
Subject: [PATCH 468/679] [PKGS-7388] only perform check for Debian, Mint,
 Ubuntu

---
 CHANGELOG.md                 |  1 +
 include/tests_ports_packages | 10 +++++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 258b806e..9535b64a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -106,6 +106,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - NAME-4408 - corrected Report function call
 - NETW-3032 - small rewrite of test and extended with addrwatch
 - PHP-2372 - don't look in the cli configuration files
+- PKGS-7388 - only perform check for Debian/Ubuntu/Mint
 - PKGS-7410 - use multiple package managers when available
 - PKGS-7410 - added support for Zypper to test number of kernels
 - PROC-3602 - allow different root directory
diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 326bd94f..f2291a03 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -983,7 +983,15 @@
 #
     # Test        : PKGS-7388
     # Description : Check security repository in Debian/ubuntu apt sources.list file
-    if [ -f ${ROOTDIR}etc/apt/sources.list -a -d ${ROOTDIR}etc/apt/sources.list.d ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -f ${ROOTDIR}etc/apt/sources.list -a -d ${ROOTDIR}etc/apt/sources.list.d ]; then
+        case "${LINUX_VERSION}" in
+            "Debian" | "Linux Mint" | "Ubuntu")  PREQS_MET="YES" ;;
+            *)
+                PREQS_MET="NO"
+                LogText "Skipping test, although sources.list or sources.list.d exists. This specific OS version most likely has no security repository"
+            ;;
+        esac
+    fi
     Register --test-no PKGS-7388 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check security repository in Debian/ubuntu apt sources.list file"
     if [ $SKIPTEST -eq 0 ]; then
         FOUND=0

From eaafbb642e232ba70fa5209df64deae1bf709a7f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 18 Mar 2020 11:37:06 +0100
Subject: [PATCH 469/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9535b64a..ae4fbfc6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -80,6 +80,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - BANN-7126 - additional words for login banner are accepted
 - CONT-8106 - support newer 'docker info' output
 - CRYP-8002 - gather kernel entropy on Linux systems
+- FILE-6310 - support for HP-UX
 - FILE-6374 - changed log and allow root location to be changed
 - FILE-6374 - corrected condition to find 'defaults' flag in /etc/fstab
 - FILE-6430 - minor code improvements and show suggestion with more details

From cc78713c6a989d974d4403653d0d3f46f51c7882 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 18 Mar 2020 11:43:29 +0100
Subject: [PATCH 470/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ae4fbfc6..65bfdad5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -96,6 +96,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - INSE-8318 - test for TFTP client tools
 - INSE-8320 - test for TFTP server tools
 - INSE-8342 - renamed to INSE-8304
+- KRNL-5788 - don't complain about missing /vmlinuz for Raspi
 - KRNL-5820 - extended check to include limits.d directory
 - KRNL-5830 - skip test partially when running non-privileged
 - LOGG-2154 - added support for rsyslog configurations

From bc4146555ceaaf03c924ef9263050d8caee2f580 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 19 Mar 2020 10:51:02 +0100
Subject: [PATCH 471/679] [PKGS-7388] Only perform test when all conditions are
 correct

---
 include/tests_ports_packages | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index f2291a03..484607e4 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -982,17 +982,19 @@
 #################################################################################
 #
     # Test        : PKGS-7388
-    # Description : Check security repository in Debian/ubuntu apt sources.list file
+    # Description : Check security repository in Debian/Ubuntu apt sources.list file
+    PREQS_MET="NO"
     if [ -f ${ROOTDIR}etc/apt/sources.list -a -d ${ROOTDIR}etc/apt/sources.list.d ]; then
         case "${LINUX_VERSION}" in
-            "Debian" | "Linux Mint" | "Ubuntu")  PREQS_MET="YES" ;;
+            "Debian" | "Linux Mint" | "Ubuntu")
+                PREQS_MET="YES"
+            ;;
             *)
-                PREQS_MET="NO"
                 LogText "Skipping test, although sources.list or sources.list.d exists. This specific OS version most likely has no security repository"
             ;;
         esac
     fi
-    Register --test-no PKGS-7388 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check security repository in Debian/ubuntu apt sources.list file"
+    Register --test-no PKGS-7388 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check security repository in apt sources.list file"
     if [ $SKIPTEST -eq 0 ]; then
         FOUND=0
         if [ ${OPTION_DEBIAN_SKIP_SECURITY_REPOSITORY} -eq 0 ]; then

From e5c1f2f303b1dbf56486369d09f24707ced25acb Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 19 Mar 2020 11:01:22 +0100
Subject: [PATCH 472/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 65bfdad5..72354de0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -121,6 +121,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - SSH-7408 - changed text in suggestion and report
 - SSH-7408 - added forced-commands-only option
 - SSH-7408 - VerifyReverseMapping removed (deprecated)
+- SSH-7408 - corrected OpenSSH server version check
 - STRG-1840 - renamed to USB-1000
 - STRG-1842 - added default authorized devices and renamed to USB-2000
 - TOOL-5002 - differentiate between a discovered binary and running process

From f15fbfa6edf650ad359781008a799a7c5924f0f9 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Thu, 19 Mar 2020 15:12:04 +0200
Subject: [PATCH 473/679] Check if /vmlinuz is missing due to
 /etc/kernel-img.conf

If /etc/kernel-img.conf has the line do_symlinks=No, Debian (probably
also Ubuntu) kernel packages will not update /vmlinuz
etc. symlinks. In that case, guess the kernel from uname -r.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 include/tests_kernel | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/include/tests_kernel b/include/tests_kernel
index 369d3727..225ab5e4 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -395,6 +395,9 @@
             elif [ -e ${ROOTDIR}etc/rpi-issue ]; then
                 FINDKERNEL=raspberrypi-kernel
                 LogText "Result: ${ROOTDIR}vmlinuz missing due to Raspbian"
+            elif `${EGREPBINARY} -q 'do_symlinks.*=.*No' ${ROOTDIR}etc/kernel-img.conf`; then
+                FINDKERNEL=linux-image-$(uname -r)
+                LogText "Result: ${ROOTDIR}vmlinuz missing due to /etc/kernel-img.conf item do_symlinks = No"
             else
                 LogText "This system is missing ${ROOTDIR}vmlinuz or ${ROOTDIR}boot/vmlinuz.  Unable to check whether kernel is up-to-date."
                 ReportSuggestion "${TEST_NO}" "Determine why ${ROOTDIR}vmlinuz or ${ROOTDIR}boot/vmlinuz is missing on this Debian/Ubuntu system." "/vmlinuz or /boot/vmlinuz"

From 80a67914c3945a36204e998576fbdf81227f502f Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Thu, 19 Mar 2020 15:25:59 +0200
Subject: [PATCH 474/679] Fix logging of running and enabled services

Log lines for running and enabled services were mixed up, fix.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 include/tests_boot_services | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_boot_services b/include/tests_boot_services
index 2c239b64..f96afbfb 100644
--- a/include/tests_boot_services
+++ b/include/tests_boot_services
@@ -579,7 +579,7 @@
             LogText "Hint: Run systemctl --full --type=service to see all services"
             Display --indent 2 --text "- Check running services (systemctl)" --result "${STATUS_DONE}" --color GREEN
             Display --indent 8 --text "Result: found ${COUNT} running services"
-            LogText "Result: Found ${COUNT} enabled services"
+            LogText "Result: Found ${COUNT} running services"
 
             # Services at boot
             LogText "Searching for enabled services (systemctl services only)"
@@ -594,7 +594,7 @@
             LogText "Hint: Run systemctl list-unit-files --type=service to see all services"
             Display --indent 2 --text "- Check enabled services at boot (systemctl)" --result "${STATUS_DONE}" --color GREEN
             Display --indent 8 --text "Result: found ${COUNT} enabled services"
-            LogText "Result: Found ${COUNT} running services"
+            LogText "Result: Found ${COUNT} enabled services"
 
         else
 

From 3aaeeea856f6e939c5b8d50d995e9e3eaa80fb35 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Thu, 19 Mar 2020 15:42:16 +0200
Subject: [PATCH 475/679] Check for rEFInd boot loader

Detect rEFInd boot loader (https://www.rodsbooks.com/refind/).

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 db/tests.db                 |  1 +
 include/tests_boot_services | 15 +++++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/db/tests.db b/db/tests.db
index e057c06e..359760b9 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -57,6 +57,7 @@ BOOT-5102:test:security:boot_services:AIX:Check for AIX boot device:
 BOOT-5104:test:security:boot_services::Determine service manager:
 BOOT-5106:test:security:boot_services:MacOS:Check EFI boot file on macOS:
 BOOT-5108:test:security:boot_services:Linux:Test Syslinux boot loader:
+BOOT-5109:test:security:boot_services:Linux:Test rEFInd boot loader:
 BOOT-5116:test:security:boot_services::Check if system is booted in UEFI mode:
 BOOT-5117:test:security:boot_services:Linux:Check for systemd-boot boot loader:
 BOOT-5121:test:security:boot_services::Check for GRUB boot loader presence:
diff --git a/include/tests_boot_services b/include/tests_boot_services
index 2c239b64..bc8ae321 100644
--- a/include/tests_boot_services
+++ b/include/tests_boot_services
@@ -182,6 +182,21 @@
     fi
 #
 #################################################################################
+#
+    # Test        : BOOT-5109
+    # Description : Check for rEFInd
+    Register --test-no BOOT-5109 --os "Linux" --weight L --network NO --root-only YES --category security --description "Check rEFInd as bootloader"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        BOOT_LOADER_SEARCHED=1
+        FileExists ${ROOTDIR}boot/refind_linux.conf
+        if [ ${FILE_FOUND} -eq 1 ]; then
+            LogText "Result: found rEFInd"
+            BOOT_LOADER="rEFInd"
+            BOOT_LOADER_FOUND=1
+        fi
+    fi
+#
+#################################################################################
 #
     # Test        : BOOT-5116
     # Description : Check if system is booted in UEFI mode

From 00a31c6dbd1b142f5807c5e71997df0a8482acbe Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 19 Mar 2020 15:29:01 +0100
Subject: [PATCH 476/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 72354de0..7d1a5d85 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -46,6 +46,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - New option: --usecwd - run from the current working directory
 - New profile option: disable-plugin - disables a single plugin
 - New profile option: ssl-certificate-paths-to-ignore - ignore a path
+- New test: BOOT-5109 - Test presence rEFInd boot loader
 - New test: CRYP-7930 - test for LUKS encryption
 - New test: CRYP-8004 - presence of hardware random number generator
 - New test: DBS-1828  - PostgreSQL configuration files

From 72e8f572bf51ef9b9e09506624cc0a9f9143a9a9 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Thu, 19 Mar 2020 16:31:20 +0200
Subject: [PATCH 477/679] Harden mount options for /var, check also /dev and
 /run

There should not be any need for char/block devices in /var, so
propose nodev. Sockets are not affected.

Check also /dev for noexec,nosuid and /run for
nodev,nosuid. Historically there was /dev/MAKEDEV script but that's
long gone.

In case a file system is not found in /etc/fstab, check if they are
mounted otherwise (e.g. via systemd mount units).

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 include/tests_filesystems | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/include/tests_filesystems b/include/tests_filesystems
index c709a79a..89166aa0 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -555,16 +555,18 @@
     #            ---------------------------------------------------------
     #               Mount point              nodev  noexec  nosuid
     #               /boot                      v      v       v
+    #               /dev                              v       v
     #               /dev/shm                   v      v       v
     #               /home                      v              v
+    #               /run                       v              v
     #               /tmp                       v      v       v
-    #               /var                                      v
+    #               /var                       v              v
     #               /var/log                   v      v       v
     #               /var/log/audit             v      v       v
     #               /var/tmp                   v      v       v
     #            ---------------------------------------------------------
 
-    FILESYSTEMS_TO_CHECK="/boot:nodev,noexec,nosuid /dev/shm:nosuid,nodev,noexec /home:nodev,nosuid /tmp:nodev,noexec,nosuid /var:nosuid /var/log:nodev,noexec,nosuid /var/log/audit:nodev,noexec,nosuid /var/tmp:nodev,noexec,nosuid"
+    FILESYSTEMS_TO_CHECK="/boot:nodev,noexec,nosuid /dev:noexec,nosuid /dev/shm:nosuid,nodev,noexec /home:nodev,nosuid /run:nodev,nosuid /tmp:nodev,noexec,nosuid /var:nodev,nosuid /var/log:nodev,noexec,nosuid /var/log/audit:nodev,noexec,nosuid /var/tmp:nodev,noexec,nosuid"
     Register --test-no FILE-6374 --os Linux --weight L --network NO --category security --description "Linux mount options"
     if [ ${SKIPTEST} -eq 0 ]; then
         if [ -f ${ROOTDIR}etc/fstab ]; then
@@ -578,9 +580,14 @@
                         FS_FSTAB=""
                     fi
                 fi
+		if [ -z "${FS_FSTAB}" ]; then # not found in fstab, check if mounted otherwise
+                    FS_FSTAB=$(mount | ${AWKBINARY} -v fs=${FILESYSTEM} '{ if ($3==fs) { print $6 } }')
+                    FOUND_FLAGS=$(mount | ${AWKBINARY} -v fs=${FILESYSTEM} '{ if ($1~"[^#]" && $3==fs) { print $6 } }' | ${SEDBINARY} 's/,/ /g' | ${TRBINARY} '\n' ' ')
+                else
+                    FOUND_FLAGS=$(${AWKBINARY} -v fs=${FILESYSTEM} '{ if ($1~"[^#]" && $2==fs) { print $4 } }' ${ROOTDIR}etc/fstab | ${SEDBINARY} 's/,/ /g' | ${TRBINARY} '\n' ' ')
+                fi
                 if [ -n "${FS_FSTAB}" ]; then
                     # In awk using caret/circumflex as first character between brackets, means 'not' (instead of beginning of line)
-                    FOUND_FLAGS=$(${AWKBINARY} -v fs=${FILESYSTEM} '{ if ($1~"[^#]" && $2==fs) { print $4 } }' ${ROOTDIR}etc/fstab | ${SEDBINARY} 's/,/ /g' | ${TRBINARY} '\n' ' ')
                     LogText "File system:    ${FILESYSTEM}"
                     LogText "Expected flags: ${EXPECTED_FLAGS}"
                     LogText "Found flags:    ${FOUND_FLAGS}"

From ddcf9bc713cc38be6dd683888626c0941f14c156 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 19 Mar 2020 15:52:03 +0100
Subject: [PATCH 478/679] [BOOT-5122] check for defined password in all GRUB
 configuration files

---
 CHANGELOG.md                |  1 +
 include/tests_boot_services | 56 ++++++++++++++++++++++---------------
 2 files changed, 35 insertions(+), 22 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7d1a5d85..a61a85b7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -79,6 +79,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - AUTH-9282 - fix: temporary variable was overwritten
 - AUTH-9408 - added support for pam_tally2 to log failed logins
 - BANN-7126 - additional words for login banner are accepted
+- BOOT-5122 - check for defined password in all GRUB configuration files
 - CONT-8106 - support newer 'docker info' output
 - CRYP-8002 - gather kernel entropy on Linux systems
 - FILE-6310 - support for HP-UX
diff --git a/include/tests_boot_services b/include/tests_boot_services
index 5430a76b..f28cc69b 100644
--- a/include/tests_boot_services
+++ b/include/tests_boot_services
@@ -331,34 +331,46 @@
     Register --test-no BOOT-5122 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for GRUB boot password"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
-        LogText "Found file ${GRUBCONFFILE}, proceeding with tests."
-        FileIsReadable ${GRUBCONFFILE}
-        if [ ${CANREAD} -eq 1 ]; then
-            FIND=$(${GREPBINARY} 'password --md5' ${GRUBCONFFILE} | ${GREPBINARY} -v '^#')
-            FIND2=$(${GREPBINARY} 'password --encrypted' ${GRUBCONFFILE} | ${GREPBINARY} -v '^#')
-            FIND3=$(${GREPBINARY} 'set superusers' ${GRUBCONFFILE} | ${GREPBINARY} -v '^#')
-            FIND4=$(${GREPBINARY} 'password_pbkdf2' ${GRUBCONFFILE} | ${GREPBINARY} -v '^#')
-            FIND5=$(${GREPBINARY} 'grub.pbkdf2' ${GRUBCONFFILE} | ${GREPBINARY} -v '^#')
-            # GRUB1: Password should be set (MD5 or SHA1)
-            if [ -n "${FIND}" -o -n "${FIND2}" ]; then
-                FOUND=1
-            # GRUB2: Superusers AND password should be defined
-            elif [ -n "${FIND3}" ]; then
-                if [ -n "${FIND4}" -o -n "${FIND5}" ]; then FOUND=1; fi
+
+        CONF_FILES=$(${FINDBINARY} /etc/grub.d -type f -name "[0-9][0-9]*" -print0 | ${TRBINARY} '\0' ' ' | ${TRBINARY} -d '[:cntrl:]')
+        CONF_FILES="${GRUBCONFFILE} ${ROOTDIR}boot/grub/custom.cfg ${CONF_FILES}"
+
+        for FILE in ${CONF_FILES}; do
+            if [ -f "${FILE}" ]; then
+                LogText "Found file ${FILE}, proceeding with tests."
+                if FileIsReadable "${FILE}"; then
+                    FIND=$(${GREPBINARY} 'password --md5' ${FILE} | ${GREPBINARY} -v '^#')
+                    FIND2=$(${GREPBINARY} 'password --encrypted' ${FILE} | ${GREPBINARY} -v '^#')
+                    FIND3=$(${GREPBINARY} 'set superusers' ${FILE} | ${GREPBINARY} -v '^#')
+                    FIND4=$(${GREPBINARY} 'password_pbkdf2' ${FILE} | ${GREPBINARY} -v '^#')
+                    FIND5=$(${GREPBINARY} 'grub.pbkdf2' ${FILE} | ${GREPBINARY} -v '^#')
+                    # GRUB1: Password should be set (MD5 or SHA1)
+                    if [ -n "${FIND}" -o -n "${FIND2}" ]; then
+                        FOUND=1
+                    # GRUB2: Superusers AND password should be defined
+                    elif [ -n "${FIND3}" ]; then
+                        if [ -n "${FIND4}" -o -n "${FIND5}" ]; then FOUND=1; fi
+                    else
+                        LogText "Result: did not find hashed password line in this file"
+                    fi
+                else
+                    LogText "Result: Can not read '${FILE}' (no permission?)"
+                fi
+            else
+                LogText "Result: File '${FILE}' does not exist"
             fi
-            if [ ${FOUND} -eq 1 ]; then
+        done
+        if [ ${FOUND} -eq 1 ]; then
                 Display --indent 4 --text "- Checking for password protection" --result "${STATUS_OK}" --color GREEN
                 LogText "Result: GRUB has password protection."
                 AddHP 4 4
-            else
-                Display --indent 4 --text "- Checking for password protection" --result "${STATUS_NONE}" --color RED
-                LogText "Result: Didn't find hashed password line in GRUB boot file!"
-                ReportSuggestion "${TEST_NO}" "Set a password on GRUB bootloader to prevent altering boot configuration (e.g. boot in single user mode without password)"
-                AddHP 0 2
-            fi
         else
-            LogText "Result: Can not read ${GRUBCONFFILE} (no permission)"
+                Display --indent 4 --text "- Checking for password protection" --result "${STATUS_NONE}" --color RED
+                LogText "Result: Didn't find hashed password line in GRUB configuration"
+                ReportSuggestion "${TEST_NO}" "Set a password on GRUB boot loader to prevent altering boot configuration (e.g. boot in single user mode without password)"
+                AddHP 0 2
         fi
+        unset CONF_FILES FILE FIND FIND2 FIND3 FIND4 FIND5 FOUND
     fi
 #
 #################################################################################

From fb9cdb5c435963b24ea98a729b133fb7714c1592 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Thu, 19 Mar 2020 19:45:37 +0200
Subject: [PATCH 479/679] Enhance SELinux checks

Display and log: permissive types (rules are not enforced), unconfined
processes (not confined by rules) and processes with initrc_t
type (generic type with weak rules).

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 include/binaries             |  3 ++-
 include/tests_mac_frameworks | 11 +++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/include/binaries b/include/binaries
index 3f5d72ea..a14434a1 100644
--- a/include/binaries
+++ b/include/binaries
@@ -249,7 +249,8 @@
                             samhain)                SAMHAINBINARY="${BINARY}";         LogText "  Found known binary: samhain (integrity tool) - ${BINARY}" ;;
                             service)                SERVICEBINARY="${BINARY}";         LogText "  Found known binary: service (system services) - ${BINARY}" ;;
                             sed)                    SEDBINARY="${BINARY}";             LogText "  Found known binary: sed (text stream editor) - ${BINARY}" ;;
-                            sestatus)               SESTATUSBINARY="${BINARY}";        LogText "  Found known binary: sestatus (SELinux client) - ${BINARY}" ;;
+                            semanage)               SEMANAGEBINARY="${BINARY}";        LogText "  Found known binary: semanage (SELinux policy management tool) - ${BINARY}" ;;
+                            sestatus)               SESTATUSBINARY="${BINARY}";        LogText "  Found known binary: sestatus (SELinux status tool) - ${BINARY}" ;;
                             slocate)                LOCATEBINARY="${BINARY}";          LogText "  Found known binary: slocate (file database) - ${BINARY}" ;;
                             smbd)                   SMBDBINARY="${BINARY}";            if [ "${OS}" = "macOS" ]; then SMBDVERSION="unknown"; else SMBDVERSION=$(${BINARY} -V | grep "^Version" | awk '{ print $2 }'); fi; LogText "Found ${BINARY} (version ${SMBDVERSION})" ;;
                             smtpctl)                SMTPCTLBINARY="${BINARY}";         LogText "  Found known binary: smtpctl (OpenSMTPD client) - ${BINARY}" ;;
diff --git a/include/tests_mac_frameworks b/include/tests_mac_frameworks
index 972bbb8a..aded40d3 100644
--- a/include/tests_mac_frameworks
+++ b/include/tests_mac_frameworks
@@ -152,6 +152,17 @@
                 Display --indent 6 --text "- Checking current mode and config file" --result "${STATUS_WARNING}" --color RED
             fi
             Display --indent 8 --text "Current SELinux mode: ${FIND}"
+            PERMISSIVE=$(${SEMANAGEBINARY} permissive --list --noheading | ${TRBINARY} '\n' ' ')
+            NPERMISSIVE=$(${SEMANAGEBINARY} permissive --list --noheading | ${WCBINARY} --lines)
+            Display --indent 8 --text "Found ${NPERMISSIVE} permissive SELinux object types"
+            LogText "Permissive SELinux object types: ${PERMISSIVE}"
+            UNCONFINED=$(${PSBINARY} -eo label,pid,command | ${GREPBINARY} '[u]nconfined_t' | ${TRBINARY} '\n' ' ')
+            INITRC=$(${PSBINARY} -eo label,pid,command | ${GREPBINARY} '[i]nitrc_t' | ${TRBINARY} '\n' ' ')
+            NUNCONFINED=$(${PSBINARY} -eo label | ${GREPBINARY} '[u]nconfined_t' | ${WCBINARY} --lines)
+            NINITRC=$(${PSBINARY} -eo label | ${GREPBINARY} '[i]nitrc_t' | ${WCBINARY} --lines)
+            Display --indent 8 --text "Found ${NUNCONFINED} unconfined and ${NINITRC} initrc_t processes"
+            LogText "Unconfined processes: ${UNCONFINED}"
+            LogText "Processes with initrc_t type: ${INITRC}"
         else
             LogText "Result: SELinux framework is disabled"
             Display --indent 4 --text "- Checking SELinux status" --result "${STATUS_DISABLED}" --color YELLOW

From 9087de0dacbe3184f8dbe86e1a7525a44dda8473 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Thu, 19 Mar 2020 20:55:23 +0200
Subject: [PATCH 480/679] pam: ignore leading dash

PAM rules may have a leading '-' character to indicate that if the
module is missing, the error will be ignored, so let's ignore it in
the check.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 plugins/plugin_pam_phase1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/plugin_pam_phase1 b/plugins/plugin_pam_phase1
index 361918de..50a86a6f 100644
--- a/plugins/plugin_pam_phase1
+++ b/plugins/plugin_pam_phase1
@@ -96,7 +96,7 @@
                         PAM_CONTROL_OPTIONS="-"
                         PAM_MODULE="-"
                         PAM_MODULE_OPTIONS="-"
-                        PAM_TYPE=$(echo ${LINE} | awk '{ print $1 }')
+                        PAM_TYPE=$(echo ${LINE} | awk '{ print $1 }' | sed 's/^ *-//g')
                         PARSELINE=0
                         case ${PAM_TYPE} in
                             "@include")

From 34ec6a1edf4d52e148916655b5e203c5bebac836 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Thu, 19 Mar 2020 21:17:04 +0200
Subject: [PATCH 481/679] pam: pam_selinux is known good module

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 plugins/plugin_pam_phase1 | 1 +
 1 file changed, 1 insertion(+)

diff --git a/plugins/plugin_pam_phase1 b/plugins/plugin_pam_phase1
index 361918de..61b8c09b 100644
--- a/plugins/plugin_pam_phase1
+++ b/plugins/plugin_pam_phase1
@@ -271,6 +271,7 @@
                                 pam_securetty) ;;
                                 pam_securityserver) ;;
                                 pam_self) ;;
+                                pam_selinux) ;;
                                 pam_shells) ;;
                                 pam_skey) ;;
                                 pam_ssh)

From 6de9c31cf54c9be5fd7524fc5fcdfa42994a45f6 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Thu, 19 Mar 2020 21:25:50 +0200
Subject: [PATCH 482/679] Fix journalctl output parsing for recent journalctls

Process output from journalctl (v245) like: "Archived and active
journals take up xxx.xM in the file system."

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 plugins/plugin_systemd_phase1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/plugin_systemd_phase1 b/plugins/plugin_systemd_phase1
index 9d424915..0c73f45d 100644
--- a/plugins/plugin_systemd_phase1
+++ b/plugins/plugin_systemd_phase1
@@ -176,7 +176,7 @@
     if [ ! "${JOURNALCTLBINARY}" = "" -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PLGN-3816 --preqs-met ${PREQS_MET} --weight L --network NO --description "Query journal for boot related information" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
-        FIND=`${JOURNALCTLBINARY} --disk-usage | awk '{ if ($1=="Journals") { print $4 }}'`
+        FIND=`${JOURNALCTLBINARY} --disk-usage | awk '{ if ($1=="Journals") { print $4 } else if ($1=="Archived") { print $7 }}'`
         Report "journal_disk_size=${FIND}"
         LogText "Result: journals are ${FIND} in size"
     fi

From 820d2ec60774e558f24f09357827d98d0c766efe Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Thu, 19 Mar 2020 23:53:57 +0200
Subject: [PATCH 483/679] Check DNSSEC status with resolvectl when available

'resolvectl statistics' shows if DNSSEC is supported by
systemd-resolved and upstream DNS servers.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 db/tests.db              |  1 +
 include/binaries         |  1 +
 include/tests_networking | 25 +++++++++++++++++++++++++
 3 files changed, 27 insertions(+)

diff --git a/db/tests.db b/db/tests.db
index 359760b9..e45d2d9a 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -283,6 +283,7 @@ NAME-4408:test:security:nameservices::Check localhost to IP mapping:
 NETW-2600:test:security:networking:Linux:Checking IPv6 configuration:
 NETW-2704:test:security:networking::Basic nameserver configuration tests:
 NETW-2705:test:security:networking::Check availability two nameservers:
+NETW-2705:test:security:networking::Check DNSSEC status:
 NETW-3001:test:security:networking::Find default gateway (route):
 NETW-3004:test:security:networking::Search available network interfaces:
 NETW-3006:test:security:networking::Get network MAC addresses:
diff --git a/include/binaries b/include/binaries
index 3f5d72ea..cd91cab1 100644
--- a/include/binaries
+++ b/include/binaries
@@ -239,6 +239,7 @@
                             python3)                PYTHON3BINARY="${BINARY}";         PYTHON3VERSION=$(${BINARY}  --version 2>&1 | sed 's/^Python //'); LogText "Found known binary: ${FILENAME} (programming language interpreter) - ${BINARY} (version ${PYTHON3VERSION})" ;;
                             rcctl)                  RCCTLBINARY="${BINARY}";           LogText "  Found known binary: rcctl (services and daemons configuration and control) - ${BINARY}" ;;
                             readlink)               READLINKBINARY="${BINARY}";        LogText "  Found known binary: readlink (follows symlinks) - ${BINARY}" ;;
+                            resolvectl)             RESOLVECTLBINARY="${BINARY}";      LogText "  Found known binary: resolvectl (systemd-resolved DNS resolver manager) - ${BINARY}" ;;
                             rkhunter)               RKHUNTERBINARY="${BINARY}";        MALWARE_SCANNER_INSTALLED=1;           LogText "  Found known binary: rkhunter (malware scanner) - ${BINARY}" ;;
                             rootsh)                 ROOTSHBINARY="${BINARY}";          LogText "  Found known binary: rootsh (wrapper for shells) - ${BINARY}" ;;
                             rpcinfo)                RPCINFOBINARY="${BINARY}";         LogText "  Found known binary: rpcinfo (RPC information) - ${BINARY}" ;;
diff --git a/include/tests_networking b/include/tests_networking
index 51bed912..9f78bca4 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -189,6 +189,31 @@
     fi
 #
 #################################################################################
+#
+    # Test        : NETW-2706
+    # Description : Check systemd-resolved and upstream DNSSEC status
+    if [ -n "${RESOLVECTLBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no NETW-2706 --preqs-met ${PREQS_MET} --weight L --network YES --category security --description "Check systemd-resolved and upstream DNSSEC status"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        SKIP=0
+        if [ -n "${RESOLVECTLBINARY}" ]; then
+	    DNSSEC_STATUS=$(${RESOLVECTLBINARY} statistics | ${AWKBINARY} -F ":" '/DNSSEC supported/ { print $2 }' | ${TRBINARY} -d ' ')
+            if [ "${DNSSEC_STATUS}" = "yes" ]; then
+                Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_OK}" --color GREEN
+                LogText "Result: DNSSEC supported by systemd-resolved and upstream DNS servers"
+            else
+                Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_WARNING}" --color RED
+                LogText "Result: DNSSEC not supported by systemd-resolved or upstream DNS servers"
+            fi
+        else
+            Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_SKIPPED}" --color YELLOW
+            LogText "Result: resolvectl not installed, test can't be fully performed"
+        fi
+    else
+        LogText "Result: Test most likely skipped due to not having resolvectl"
+    fi
+#
+#################################################################################
 #
     # Test        : NETW-3001
     # Description : Find default gateway (route)

From 8f37edb62699316e2992a9c768b83cfde17d01ed Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 20 Mar 2020 09:46:08 +0100
Subject: [PATCH 484/679] Update tests.db

Corrected test ID
---
 db/tests.db | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/db/tests.db b/db/tests.db
index e45d2d9a..d051c77d 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -283,7 +283,7 @@ NAME-4408:test:security:nameservices::Check localhost to IP mapping:
 NETW-2600:test:security:networking:Linux:Checking IPv6 configuration:
 NETW-2704:test:security:networking::Basic nameserver configuration tests:
 NETW-2705:test:security:networking::Check availability two nameservers:
-NETW-2705:test:security:networking::Check DNSSEC status:
+NETW-2706:test:security:networking::Check DNSSEC status:
 NETW-3001:test:security:networking::Find default gateway (route):
 NETW-3004:test:security:networking::Search available network interfaces:
 NETW-3006:test:security:networking::Get network MAC addresses:

From 1f3467f69a8af76bb774011eb9c37aa90ca3cc64 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 20 Mar 2020 09:47:57 +0100
Subject: [PATCH 485/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a61a85b7..981fecb0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -53,6 +53,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - New test: FINT-4316 - presence of AIDE database and size test
 - New test: INSE-8314 - test for NIS client
 - New test: INSE-8316 - test for NIS server
+- New test: NETW-2706 - check DNSSEC (systemd)
 - New test: NETW-3200 - determine avilable network protocols
 - New test: PROC-3802 - check presence of prelink tooling
 - New report key: openssh_daemon_running

From 626e2a9ab9a1bd2ac65b092e34477cb3c36baf42 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 20 Mar 2020 14:13:21 +0100
Subject: [PATCH 486/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 981fecb0..135200bb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -103,6 +103,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - KRNL-5820 - extended check to include limits.d directory
 - KRNL-5830 - skip test partially when running non-privileged
 - LOGG-2154 - added support for rsyslog configurations
+- MACF-6234 - SELinux tests extended
 - MAIL-8804 - replaced static strings with translation-aware strings
 - MALW-3280 - Kaspersky detection added
 - MALW-3280 - CrowdStrike falcon-sensor detection added

From 38310223a6177a15f556957ab4bf5279bca3d454 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 20 Mar 2020 14:50:25 +0100
Subject: [PATCH 487/679] Updated date/year

---
 FAQ                               | 2 +-
 INSTALL                           | 4 ++--
 include/binaries                  | 2 +-
 include/consts                    | 2 +-
 include/data_upload               | 2 +-
 include/functions                 | 4 ++--
 include/helper_audit_dockerfile   | 2 +-
 include/helper_configure          | 2 +-
 include/helper_generate           | 2 +-
 include/helper_show               | 2 +-
 include/helper_system_remote_scan | 2 +-
 include/helper_update             | 2 +-
 include/osdetection               | 2 +-
 include/parameters                | 2 +-
 include/profiles                  | 2 +-
 include/report                    | 2 +-
 include/tests_accounting          | 4 ++--
 include/tests_authentication      | 2 +-
 include/tests_banners             | 2 +-
 include/tests_boot_services       | 2 +-
 include/tests_containers          | 4 ++--
 include/tests_crypto              | 2 +-
 include/tests_databases           | 2 +-
 include/tests_dns                 | 2 +-
 include/tests_file_integrity      | 4 ++--
 include/tests_file_permissions    | 4 ++--
 include/tests_filesystems         | 2 +-
 include/tests_firewalls           | 2 +-
 include/tests_hardening           | 2 +-
 include/tests_homedirs            | 2 +-
 include/tests_insecure_services   | 2 +-
 include/tests_kernel              | 4 ++--
 include/tests_kernel_hardening    | 2 +-
 include/tests_ldap                | 2 +-
 include/tests_logging             | 2 +-
 include/tests_mac_frameworks      | 2 +-
 include/tests_mail_messaging      | 2 +-
 include/tests_malware             | 2 +-
 include/tests_memory_processes    | 2 +-
 include/tests_nameservices        | 2 +-
 include/tests_networking          | 2 +-
 include/tests_php                 | 2 +-
 include/tests_ports_packages      | 2 +-
 include/tests_printers_spools     | 2 +-
 include/tests_scheduling          | 2 +-
 include/tests_shells              | 4 ++--
 include/tests_snmp                | 4 ++--
 include/tests_squid               | 4 ++--
 include/tests_ssh                 | 2 +-
 include/tests_storage             | 4 ++--
 include/tests_storage_nfs         | 2 +-
 include/tests_system_integrity    | 4 ++--
 include/tests_time                | 2 +-
 include/tests_tooling             | 2 +-
 include/tests_virtualization      | 2 +-
 include/tests_webservers          | 2 +-
 include/tool_tips                 | 2 +-
 lynis                             | 8 ++++----
 58 files changed, 73 insertions(+), 73 deletions(-)

diff --git a/FAQ b/FAQ
index 80f8b934..f2891428 100644
--- a/FAQ
+++ b/FAQ
@@ -98,4 +98,4 @@
 
 
 ================================================================================
- Lynis - Copyright 2007-2019, Michael Boelen, CISOfy - https://cisofy.com
+ Lynis - Copyright 2007-2020, Michael Boelen, CISOfy - https://cisofy.com
diff --git a/INSTALL b/INSTALL
index 1f7784fa..b79a8b35 100644
--- a/INSTALL
+++ b/INSTALL
@@ -6,7 +6,7 @@
 ================================================================================
 
   Author:                   2007-2013, Michael Boelen (michael.boelen@cisofy.com)
-                            2013-2016, CISOfy development team
+                            2013-now, CISOfy development team
   Description:              Security and system auditing tool
   Web site:                 https://cisofy.com
   Support:                  See 'Support' and https://cisofy.com/support/
@@ -48,4 +48,4 @@
 
 
 ================================================================================
- Lynis - Copyright 2007-2019, Michael Boelen, CISOfy - https://cisofy.com
+ Lynis - Copyright 2007-2020, Michael Boelen, CISOfy - https://cisofy.com
diff --git a/include/binaries b/include/binaries
index 7c8477e7..89e2fddd 100644
--- a/include/binaries
+++ b/include/binaries
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/consts b/include/consts
index 9d99f606..ac76f36f 100644
--- a/include/consts
+++ b/include/consts
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/data_upload b/include/data_upload
index cdc84ff0..6718d6d3 100644
--- a/include/data_upload
+++ b/include/data_upload
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/functions b/include/functions
index 7b31cdc3..ed1a58eb 100644
--- a/include/functions
+++ b/include/functions
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
@@ -3644,4 +3644,4 @@
 
 #================================================================================
 # Lynis is part of Lynis Enterprise and released under GPLv3 license
-# Copyright 2007-2019 - Michael Boelen, CISOfy - https://cisofy.com
+# Copyright 2007-2020 - Michael Boelen, CISOfy - https://cisofy.com
diff --git a/include/helper_audit_dockerfile b/include/helper_audit_dockerfile
index a0efca38..05d24c24 100644
--- a/include/helper_audit_dockerfile
+++ b/include/helper_audit_dockerfile
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/helper_configure b/include/helper_configure
index 4e0dd654..ebd7f706 100644
--- a/include/helper_configure
+++ b/include/helper_configure
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/helper_generate b/include/helper_generate
index 30044705..67b58b66 100644
--- a/include/helper_generate
+++ b/include/helper_generate
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/helper_show b/include/helper_show
index fc21ead9..3e1b130c 100644
--- a/include/helper_show
+++ b/include/helper_show
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/helper_system_remote_scan b/include/helper_system_remote_scan
index 15aaf249..8f9df294 100644
--- a/include/helper_system_remote_scan
+++ b/include/helper_system_remote_scan
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/helper_update b/include/helper_update
index dedbed4d..cc5f672c 100644
--- a/include/helper_update
+++ b/include/helper_update
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/osdetection b/include/osdetection
index 5d65aa51..12502e20 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/parameters b/include/parameters
index 2d9ef14d..8668b683 100644
--- a/include/parameters
+++ b/include/parameters
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/profiles b/include/profiles
index f1bfb326..767f3b79 100644
--- a/include/profiles
+++ b/include/profiles
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/report b/include/report
index 815dfd03..29f45643 100644
--- a/include/report
+++ b/include/report
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_accounting b/include/tests_accounting
index 4d05f4d6..91fca1a0 100644
--- a/include/tests_accounting
+++ b/include/tests_accounting
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
@@ -413,4 +413,4 @@ WaitForKeyPress
 
 #
 #================================================================================
-# Lynis - Copyright 2007-2019, Michael Boelen / CISOfy - https://cisofy.com
+# Lynis - Copyright 2007-2020, Michael Boelen / CISOfy - https://cisofy.com
diff --git a/include/tests_authentication b/include/tests_authentication
index a20f8976..02a3bb74 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_banners b/include/tests_banners
index 7fa94da6..60fa3c2e 100644
--- a/include/tests_banners
+++ b/include/tests_banners
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_boot_services b/include/tests_boot_services
index f28cc69b..0b72ab0a 100644
--- a/include/tests_boot_services
+++ b/include/tests_boot_services
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_containers b/include/tests_containers
index cda52da7..a9a18836 100644
--- a/include/tests_containers
+++ b/include/tests_containers
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
@@ -226,4 +226,4 @@ WaitForKeyPress
 
 #
 #================================================================================
-# Lynis - Copyright 2007-2019, CISOfy - https://cisofy.com
+# Lynis - Copyright 2007-2020, CISOfy - https://cisofy.com
diff --git a/include/tests_crypto b/include/tests_crypto
index 548ba0a0..6a9cb5f2 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_databases b/include/tests_databases
index f950fa9c..ace3fd67 100644
--- a/include/tests_databases
+++ b/include/tests_databases
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_dns b/include/tests_dns
index 7e6109f5..e21a2aef 100644
--- a/include/tests_dns
+++ b/include/tests_dns
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_file_integrity b/include/tests_file_integrity
index 36201fcf..7a5658ac 100644
--- a/include/tests_file_integrity
+++ b/include/tests_file_integrity
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
@@ -340,4 +340,4 @@
     WaitForKeyPress
 #
 #================================================================================
-# Lynis - Copyright 2007-2019 Michael Boelen, CISOfy - https://cisofy.com
+# Lynis - Copyright 2007-2020 Michael Boelen, CISOfy - https://cisofy.com
diff --git a/include/tests_file_permissions b/include/tests_file_permissions
index 35e28753..e9e859fd 100644
--- a/include/tests_file_permissions
+++ b/include/tests_file_permissions
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
@@ -72,4 +72,4 @@ WaitForKeyPress
 
 #
 #================================================================================
-# Lynis - Copyright 2007-2019, CISOfy - https://cisofy.com
+# Lynis - Copyright 2007-2020, CISOfy - https://cisofy.com
diff --git a/include/tests_filesystems b/include/tests_filesystems
index c709a79a..502e4227 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_firewalls b/include/tests_firewalls
index 67f21020..20f87e1e 100644
--- a/include/tests_firewalls
+++ b/include/tests_firewalls
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_hardening b/include/tests_hardening
index 8b8ae452..2f88b179 100644
--- a/include/tests_hardening
+++ b/include/tests_hardening
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_homedirs b/include/tests_homedirs
index 13a91d86..09f4601c 100644
--- a/include/tests_homedirs
+++ b/include/tests_homedirs
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index 61a66066..3bc8dfdf 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_kernel b/include/tests_kernel
index 225ab5e4..a308e645 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
@@ -792,4 +792,4 @@ WaitForKeyPress
 
 #
 #================================================================================
-# Lynis - Copyright 2007-2019, CISOfy - https://cisofy.com
+# Lynis - Copyright 2007-2020, CISOfy - https://cisofy.com
diff --git a/include/tests_kernel_hardening b/include/tests_kernel_hardening
index 9599a708..59a5f846 100644
--- a/include/tests_kernel_hardening
+++ b/include/tests_kernel_hardening
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_ldap b/include/tests_ldap
index 63e26e58..26d11965 100644
--- a/include/tests_ldap
+++ b/include/tests_ldap
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_logging b/include/tests_logging
index 9c2ae9a6..7f254147 100644
--- a/include/tests_logging
+++ b/include/tests_logging
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_mac_frameworks b/include/tests_mac_frameworks
index aded40d3..d6d40a6b 100644
--- a/include/tests_mac_frameworks
+++ b/include/tests_mac_frameworks
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_mail_messaging b/include/tests_mail_messaging
index dbe449af..3a65765c 100644
--- a/include/tests_mail_messaging
+++ b/include/tests_mail_messaging
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_malware b/include/tests_malware
index d983b17f..a5ed3e06 100644
--- a/include/tests_malware
+++ b/include/tests_malware
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_memory_processes b/include/tests_memory_processes
index 6c1bf558..0b0fff6f 100644
--- a/include/tests_memory_processes
+++ b/include/tests_memory_processes
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_nameservices b/include/tests_nameservices
index 59983cac..df41fbc9 100644
--- a/include/tests_nameservices
+++ b/include/tests_nameservices
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_networking b/include/tests_networking
index 9f78bca4..7c288000 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_php b/include/tests_php
index 120b7dcb..a452781a 100644
--- a/include/tests_php
+++ b/include/tests_php
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 484607e4..f63f2793 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_printers_spools b/include/tests_printers_spools
index 148bc007..161c9fb3 100644
--- a/include/tests_printers_spools
+++ b/include/tests_printers_spools
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_scheduling b/include/tests_scheduling
index 98b29932..a7b3f5c2 100644
--- a/include/tests_scheduling
+++ b/include/tests_scheduling
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_shells b/include/tests_shells
index d4b3d9a3..6f39e1fd 100644
--- a/include/tests_shells
+++ b/include/tests_shells
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
@@ -282,4 +282,4 @@ WaitForKeyPress
 
 #
 #================================================================================
-# Lynis - Copyright 2007-2019, CISOfy - http://cisofy.com
+# Lynis - Copyright 2007-2020, CISOfy - http://cisofy.com
diff --git a/include/tests_snmp b/include/tests_snmp
index 6253f542..d8ce450d 100644
--- a/include/tests_snmp
+++ b/include/tests_snmp
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
@@ -104,4 +104,4 @@ WaitForKeyPress
 
 #
 #================================================================================
-# Lynis - Copyright 2007-2019 Michael Boelen, CISOfy - https://cisofy.com
+# Lynis - Copyright 2007-2020 Michael Boelen, CISOfy - https://cisofy.com
diff --git a/include/tests_squid b/include/tests_squid
index 075ecbb4..f94befa0 100644
--- a/include/tests_squid
+++ b/include/tests_squid
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
@@ -325,4 +325,4 @@ WaitForKeyPress
 
 #
 #================================================================================
-# Lynis - Copyright 2007-2019 Michael Boelen, CISOfy - https://cisofy.com
+# Lynis - Copyright 2007-2020 Michael Boelen, CISOfy - https://cisofy.com
diff --git a/include/tests_ssh b/include/tests_ssh
index 3c1d379a..bd02440c 100644
--- a/include/tests_ssh
+++ b/include/tests_ssh
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_storage b/include/tests_storage
index 8cf13b78..6de4f15d 100644
--- a/include/tests_storage
+++ b/include/tests_storage
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
@@ -77,4 +77,4 @@ WaitForKeyPress
 
 #
 #================================================================================
-# Lynis - Copyright 2007-2019, CISOfy, Michael Boelen - https://cisofy.com
+# Lynis - Copyright 2007-2020, CISOfy, Michael Boelen - https://cisofy.com
diff --git a/include/tests_storage_nfs b/include/tests_storage_nfs
index 3d3ceab5..6aaafc79 100644
--- a/include/tests_storage_nfs
+++ b/include/tests_storage_nfs
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_system_integrity b/include/tests_system_integrity
index 8b6910c1..7a21925b 100644
--- a/include/tests_system_integrity
+++ b/include/tests_system_integrity
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
@@ -51,4 +51,4 @@
     WaitForKeyPress
 #
 #================================================================================
-# Lynis - Copyright 2007-2019 Michael Boelen, CISOfy - https://cisofy.com
+# Lynis - Copyright 2007-2020 Michael Boelen, CISOfy - https://cisofy.com
diff --git a/include/tests_time b/include/tests_time
index d3bda505..fcbe145b 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_tooling b/include/tests_tooling
index 00c37369..7fed8460 100644
--- a/include/tests_tooling
+++ b/include/tests_tooling
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_virtualization b/include/tests_virtualization
index 825eefeb..3902defc 100644
--- a/include/tests_virtualization
+++ b/include/tests_virtualization
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tests_webservers b/include/tests_webservers
index 54db20d7..188a6031 100644
--- a/include/tests_webservers
+++ b/include/tests_webservers
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/include/tool_tips b/include/tool_tips
index 4f2f3b6e..6ff7534e 100644
--- a/include/tool_tips
+++ b/include/tool_tips
@@ -6,7 +6,7 @@
 # ------------------
 #
 # Copyright 2007-2013, Michael Boelen
-# Copyright 2007-2019, CISOfy
+# Copyright 2007-2020, CISOfy
 #
 # Website  : https://cisofy.com
 # Blog     : http://linux-audit.com
diff --git a/lynis b/lynis
index f39dd7af..12eea7fb 100755
--- a/lynis
+++ b/lynis
@@ -43,8 +43,8 @@
     PROGRAM_WEBSITE="https://cisofy.com/lynis/"
 
     # Version details
-    PROGRAM_RELEASE_DATE="2019-11-18"
-    PROGRAM_RELEASE_TIMESTAMP=1574071362
+    PROGRAM_RELEASE_DATE="2020-03-20"
+    PROGRAM_RELEASE_TIMESTAMP=1584711965
     PROGRAM_RELEASE_TYPE="pre-release" # pre-release or release
     PROGRAM_VERSION="3.0.0"
 
@@ -52,7 +52,7 @@
     PROGRAM_SOURCE="https://github.com/CISOfy/lynis"
     PROGRAM_PACKAGE="https://packages.cisofy.com/"
     PROGRAM_DOCUMENTATION="https://cisofy.com/docs/"
-    PROGRAM_COPYRIGHT="2007-2019, ${PROGRAM_AUTHOR} - ${PROGRAM_WEBSITE}"
+    PROGRAM_COPYRIGHT="2007-2020, ${PROGRAM_AUTHOR} - ${PROGRAM_WEBSITE}"
     PROGRAM_LICENSE="${PROGRAM_NAME} comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
   welcome to redistribute it under the terms of the GNU General Public License.
   See the LICENSE file for details about using this software."
@@ -1132,4 +1132,4 @@ ${NORMAL}
 
 #
 #================================================================================
-# Lynis - Copyright 2007-2019, Michael Boelen, CISOfy - https://cisofy.com
+# Lynis - Copyright 2007-2020, Michael Boelen, CISOfy - https://cisofy.com

From 27cdcec7416a4869e166a00432fe880165a831a6 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 20 Mar 2020 14:57:28 +0100
Subject: [PATCH 488/679] Add CentOS 7 (Core)

---
 db/software-eol.db | 1 +
 1 file changed, 1 insertion(+)

diff --git a/db/software-eol.db b/db/software-eol.db
index 0c185153..d0452616 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -23,6 +23,7 @@ os:Arch Linux:2286-11-20:9999999999:
 os:CentOS release 5:2017-03-31:1490911200:
 os:CentOS release 6:2020-11-30:1606690800:
 os:CentOS Linux release 7:2024-06-30:1719698400:
+os:CentOS Linux 7 (Core):2024-06-30:1719698400:
 #
 # Debian - https://wiki.debian.org/DebianReleases#Production_Releases
 #

From 1f8b5fafde1fb5dd4f8c5231240e3a8cf1afa39f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 20 Mar 2020 14:57:56 +0100
Subject: [PATCH 489/679] Add OS to 'show eol' and make output easier to parse

---
 include/helper_show | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/include/helper_show b/include/helper_show
index 3e1b130c..b78da175 100644
--- a/include/helper_show
+++ b/include/helper_show
@@ -265,14 +265,15 @@ if [ $# -gt 0 ]; then
             fi
             ;;
         "eol")
+            ${ECHOCMD} "Operating-system=${OS_FULLNAME}"
             if [ ${EOL} -eq 0 ]; then
-                ${ECHOCMD} "OS end-of-life: No"
+                ${ECHOCMD} "End-of-life=No"
             elif [ ${EOL} -eq 1 ]; then
-                ${ECHOCMD} "OS end-of-life: Yes"
+                ${ECHOCMD} "End-of-life=Yes"
             elif [ ${EOL} -eq 255 ]; then
-                ${ECHOCMD} "OS end-of-life: Not tested"
+                ${ECHOCMD} "End-of-life=Not tested"
             else
-                ${ECHOCMD} "OS end-of-life: Unknown"
+                ${ECHOCMD} "End-of-life=Unknown"
             fi
             ;;
         "groups")

From c2cdf54d0c907268328c692d930c862706fa34e8 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Fri, 20 Mar 2020 19:03:21 +0200
Subject: [PATCH 490/679] Add myself as contributor

As requested by Michael Boelen, add my humble name to the list of
contributors. Thank you Michael for this great software!

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 CONTRIBUTORS.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md
index 63136d63..419c3e72 100644
--- a/CONTRIBUTORS.md
+++ b/CONTRIBUTORS.md
@@ -46,6 +46,7 @@ These people made a significant impact to the development of Lynis:
 * Mikko Lehtisalo, Finland
 * Steve Bosek, France
 * Thomas Siebel, Germany
+* Topi Miettinen, Finland
 * Zach Crownover
 
 

From 724acf1be5c2cad92c9ca9ea6e7be0cbdc3a32e5 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 20 Mar 2020 19:33:10 +0100
Subject: [PATCH 491/679] Added CentOS 8 end-of-life

---
 db/software-eol.db | 1 +
 1 file changed, 1 insertion(+)

diff --git a/db/software-eol.db b/db/software-eol.db
index d0452616..a3aaa93c 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -24,6 +24,7 @@ os:CentOS release 5:2017-03-31:1490911200:
 os:CentOS release 6:2020-11-30:1606690800:
 os:CentOS Linux release 7:2024-06-30:1719698400:
 os:CentOS Linux 7 (Core):2024-06-30:1719698400:
+os:CentOS Linux 8 (Core):2029-05-31:1874872800:
 #
 # Debian - https://wiki.debian.org/DebianReleases#Production_Releases
 #

From af03c07d9fd81225d8c975c62e352d01e4c88e9a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 20 Mar 2020 19:39:49 +0100
Subject: [PATCH 492/679] Shortened CentOS 7/8 strings to allow match and added
 note

---
 db/software-eol.db | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/db/software-eol.db b/db/software-eol.db
index a3aaa93c..eb5353ff 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -9,6 +9,9 @@
 #
 # Date can be converted on Linux using: date "+%s" --date=2020-01-01
 #
+# Note: Full string for CentOS can be something like 'CentOS Linux 8 (Core)'.
+# As this does not properly match, shorter string is used for matching.
+#
 # Amazon Linux
 #
 os:Amazon Linux:2020-06-30:1593468000:
@@ -22,9 +25,8 @@ os:Arch Linux:2286-11-20:9999999999:
 #
 os:CentOS release 5:2017-03-31:1490911200:
 os:CentOS release 6:2020-11-30:1606690800:
-os:CentOS Linux release 7:2024-06-30:1719698400:
-os:CentOS Linux 7 (Core):2024-06-30:1719698400:
-os:CentOS Linux 8 (Core):2029-05-31:1874872800:
+os:CentOS Linux 7:2024-06-30:1719698400:
+os:CentOS Linux 8:2029-05-31:1874872800:
 #
 # Debian - https://wiki.debian.org/DebianReleases#Production_Releases
 #

From 52344913d3ac3fe1c7120a9c4395d5a3f961e314 Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Thu, 19 Mar 2020 15:41:35 -0500
Subject: [PATCH 493/679] Add a way to signify undetermined EOL

Replace setting an artificaly high date and converted date for
operating systems with no EOL (rolling) or the EOL is still to
be determined. This makes it easier for humans and saves making
a comparison (when using an artifically high converted time)
will always be false (EOL=0).

An example entry

        os:AGreatOS 2.0::-1:

The converted time (seconds since the epoch) could be specified as
zero but this typically means the OS is out of date (now), A value
of -1 is a convention indicating no EOL.
---
 db/software-eol.db  |  5 ++++-
 include/osdetection | 16 ++++++++++------
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/db/software-eol.db b/db/software-eol.db
index d0452616..124334e9 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -9,6 +9,9 @@
 #
 # Date can be converted on Linux using: date "+%s" --date=2020-01-01
 #
+# Note: For rolling releases or releases that do not (currently have an
+#       EOL date, leave field three empty and set field four to -1.
+#
 # Amazon Linux
 #
 os:Amazon Linux:2020-06-30:1593468000:
@@ -16,7 +19,7 @@ os:Amazon Linux 2:2023-06-26:1687730400:
 #
 # Arch Linux
 #
-os:Arch Linux:2286-11-20:9999999999:
+os:Arch Linux::-1:
 #
 # CentOS
 #
diff --git a/include/osdetection b/include/osdetection
index 12502e20..08fd931e 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -575,13 +575,17 @@
             EOL_TIMESTAMP=$(awk -v value="${FIND}" -F: '{if ($1=="os" && value ~ $2){print $4}}' ${DBDIR}/software-eol.db | head -n 1)
             if [ -n "${EOL_TIMESTAMP}" ]; then
                 EOL_DATE=$(awk -v value="${FIND}" -F: '{if ($1=="os" && value ~ $2){print $3}}' ${DBDIR}/software-eol.db | head -n 1)
-                NOW=$(date "+%s")
-                if [ -n "${NOW}" ]; then
-                    if [ ${NOW} -gt ${EOL_TIMESTAMP} ]; then
-                        EOL=1
-                    else
-                        EOL=0
+                if [ -n "${EOL_DATE}" ]; then
+                    NOW=$(date "+%s")
+                    if [ -n "${NOW}" ]; then
+                        if [ ${NOW} -gt ${EOL_TIMESTAMP} ]; then
+                            EOL=1
+                        else
+                            EOL=0
+                        fi
                     fi
+                else
+                    EOL=0
                 fi
             fi
         fi

From 50fc3f816a87824f0891b25d099b7270743e99fa Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Thu, 19 Mar 2020 15:58:50 -0500
Subject: [PATCH 494/679] Add NetBSD EOL data

---
 db/software-eol.db | 49 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git a/db/software-eol.db b/db/software-eol.db
index 124334e9..a1eb43c7 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -48,6 +48,55 @@ os:FreeBSD 10.4:2018-10-31:0:
 os:FreeBSD 11.0:2017-11-30:0:
 os:FreeBSD 11.1:2018-09-30:0:
 #
+# NetBSD - https://www.netbsd.org/support/security/release.html and
+#          https://www.netbsd.org/releases/formal.html
+#
+os:NetBSD 2.0:2008-01-19:0:
+os:NetBSD 2.0.1:2008-01-19:0:
+os:NetBSD 2.0.2:2008-01-19:0:
+os:NetBSD 2.0.3:2008-01-19:0:
+os:NetBSD 2.1:2008-01-19:0:
+os:NetBSD 3.0:2009-09-29:0:
+os:NetBSD 3.0.1:2009-09-29:0:
+os:NetBSD 3.0.2:2009-09-29:0:
+os:NetBSD 3.1:2009-09-29:0:
+os:NetBSD 4.0:2012-11-17:0:
+os:NetBSD 4.0.1:2012-11-17:0:
+os:NetBSD 5.0:2015-11-17:0:
+os:NetBSD 5.0.1:2015-10-17:0:
+os:NetBSD 5.0.2:2015-10-17:0:
+os:NetBSD 5.1:2015-10-17:0:
+os:NetBSD 5.1.1:2015-10-17:0:
+os:NetBSD 5.1.2:2015-10-17:0:
+os:NetBSD 5.1.3:2015-10-17:0:
+os:NetBSD 5.1.4:2015-10-17:0:
+os:NetBSD 5.1.5:2015-10-17:0:
+os:NetBSD 5.2.1:2015-10-17:0:
+os:NetBSD 5.2.2:2015-10-17:0:
+os:NetBSD 5.2.3:2015-10-17:0:
+os:NetBSD 6.0:2017-09-17:0:
+os:NetBSD 6.0.1:2017-09-17:0:
+os:NetBSD 6.0.2:2017-09-17:0:
+os:NetBSD 6.0.3:2017-09-17:0:
+os:NetBSD 6.0.4:2017-09-17:0:
+os:NetBSD 6.0.5:2017-09-17:0:
+os:NetBSD 6.1:2017-09-17:0:
+os:NetBSD 6.1.1:2017-09-17:0:
+os:NetBSD 6.1.2:2017-09-17:0:
+os:NetBSD 6.1.3:2017-09-17:0:
+os:NetBSD 6.1.4:2017-09-17:0:
+os:NetBSD 6.1.5:2017-09-17:0:
+os:NetBSD 7.0:2020-03-14:1584162000:
+os:NetBSD 7.0.1:2020-03-14:1584162000:
+os:NetBSD 7.0.2:2020-03-14:1584162000:
+os:NetBSD 7.1:2020-03-14:1584162000:
+os:NetBSD 7.1.1:2020-03-14:1584162000:
+os:NetBSD 7.1.1:2020-03-14:1584162000:
+os:NetBSD 7.2:2020-03-14:1584162000:
+os:NetBSD 8.0::-1:
+os:NetBSD 8.1::-1:
+os:NetBSD 9.0::-1:
+#
 # OpenBSD - https://en.wikipedia.org/wiki/OpenBSD_version_history
 #
 os:OpenBSD 5.8:2016-09-01:0:

From 6356b3adb180d05f71514ea91455d513586ae71e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 20 Mar 2020 19:43:18 +0100
Subject: [PATCH 495/679] Updated log

---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 135200bb..cb92e253 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -135,10 +135,11 @@ Using the relevant options, the scan will change base on the intended goal.
 - Use only locations from PATH environment variable, unless it is not defined
 - Show tip to use 'lynis generate hostids' when host IDs are missing
 - The 'show changelog' command works again for newer versions
-- Improved screen output in several tests
 - Several code cleanups, simplification of commands, and code standardization
 - Tests using lsof may ignore individual threads (if supported)
+- Corrected end-of-life detection for CentOS 7 and CentOS 8
 - Do not show tool tips when quiet option is used
+- Improved screen output in several tests
 - Extended output of 'lynis update info'
 - Test if profiles are readable
 - systemd service file adjusted

From 32d1155953a04afafdbc31590ff1ae9f840bd37c Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Thu, 19 Mar 2020 17:10:37 -0500
Subject: [PATCH 496/679] Fix uses of non-standard find not operator

Use ! rather than the non-standard -not find(1) operator.
---
 include/tests_authentication | 2 +-
 plugins/plugin_pam_phase1    | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 02a3bb74..b4520035 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -677,7 +677,7 @@
             LogText "Result: directory /etc/pam.d exists"
             Display --indent 2 --text "- PAM configuration files (pam.d)" --result "${STATUS_FOUND}" --color GREEN
             LogText "Test: searching PAM configuration files"
-            FIND=$(${FINDBINARY} ${ROOTDIR}etc/pam.d -not -name "*.pam-old" -type f -print | sort)
+            FIND=$(${FINDBINARY} ${ROOTDIR}etc/pam.d \! -name "*.pam-old" -type f -print | sort)
             for FILE in ${FIND}; do
                 LogText "Found file: ${FILE}"
             done
diff --git a/plugins/plugin_pam_phase1 b/plugins/plugin_pam_phase1
index 361918de..46f2e67a 100644
--- a/plugins/plugin_pam_phase1
+++ b/plugins/plugin_pam_phase1
@@ -77,12 +77,12 @@
         if [ -d ${PAM_DIRECTORY} ]; then
             LogText "Result: ${PAM_DIRECTORY} exists"
             if [ ! "${OS}" = "FreeBSD" -a ! "${OS}" = "NetBSD" ]; then
-                FIND_FILES=$(find ${PAM_DIRECTORY} -not -name "*.pam-old" -type f -print)
+                FIND_FILES=$(find ${PAM_DIRECTORY} \! -name "*.pam-old" -type f -print)
             else
                 if [ -f ${PAM_DIRECTORY}/README ]; then
                     LogText "Skipped checking ${OS} ${PAM_DIRECTORY}/README as a PAM file"
                 fi
-                FIND_FILES=$(find ${PAM_DIRECTORY} -not -name "README" -not -name "*.pam-old" -type f -print)
+                FIND_FILES=$(find ${PAM_DIRECTORY} \! -name "README" \! -name "*.pam-old" -type f -print)
             fi
 
             for PAM_FILE in ${FIND_FILES}; do

From 9c5451d29db6d3bba7abe580896f249a8464f6b6 Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Thu, 19 Mar 2020 21:30:10 -0500
Subject: [PATCH 497/679] Make BOOT-5260 Linux only

Linux is the only OS with systemd so no need to check for systemd
single user mode on other operatings systems.
---
 include/tests_boot_services | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_boot_services b/include/tests_boot_services
index 0b72ab0a..f280cb86 100644
--- a/include/tests_boot_services
+++ b/include/tests_boot_services
@@ -849,7 +849,7 @@
 #
     # Test        : BOOT-5260
     # Description : Check single user mode for systemd
-    Register --test-no BOOT-5260 --weight L --network NO --category security --description "Check single user mode for systemd"
+    Register --test-no BOOT-5260 --os Linux --weight L --network NO --category security --description "Check single user mode for systemd"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Searching /usr/lib/systemd/system/rescue.service"
         if [ -f ${ROOTDIR}usr/lib/systemd/system/rescue.service ]; then

From e98fcb9b73f7f1054e07d920de9b5ac19e30a8a3 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Fri, 20 Mar 2020 22:26:51 +0200
Subject: [PATCH 498/679] Fix developer profile

Initialialize a few variables to let --profile developer.prf pass.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 include/consts       | 2 ++
 include/tests_kernel | 1 +
 2 files changed, 3 insertions(+)

diff --git a/include/consts b/include/consts
index ac76f36f..3969aad5 100644
--- a/include/consts
+++ b/include/consts
@@ -98,6 +98,7 @@ unset LANG
     DEBSUMSBINARY=""
     DEVELOPER_MODE=0
     DEVOPS_MODE=0
+    DIGBINARY=""
     DISABLED_PLUGINS=""
     DISCOVERED_BINARIES=""
     DMIDECODEBINARY=""
@@ -148,6 +149,7 @@ unset LANG
     LOCATEBINARY=""
     LOGFILE=""
     LOGDIR=""
+    LOGROTATEBINARY=""
     LOGTEXT=1
     LSMODBINARY=""
     LSOFBINARY=""
diff --git a/include/tests_kernel b/include/tests_kernel
index a308e645..4948e0dd 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -669,6 +669,7 @@
                         LogText "Result: found ${FOUND_VMLINUZ}"
                     fi
 
+                    VERSION_ON_DISK=""
                     if [ -L "${FOUND_VMLINUZ}" ]; then
                         LogText "Result: found a symlink, retrieving destination"
                         FOUND_VMLINUZ=$(readlink "${FOUND_VMLINUZ}")

From 4a51ad031b371dd60ed79f125fa68b787d31a840 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Sat, 21 Mar 2020 12:50:38 +0200
Subject: [PATCH 499/679] Check password hashing methods

Manual page crypt(5) gives recommendations for choosing password
hashing methods, so let's check if there are weakly encrypted
passwords in the system.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 db/tests.db                  |  1 +
 include/binaries             |  1 +
 include/tests_authentication | 61 ++++++++++++++++++++++++++++++++++++
 3 files changed, 63 insertions(+)

diff --git a/db/tests.db b/db/tests.db
index d051c77d..fce9a691 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -22,6 +22,7 @@ AUTH-9218:test:security:authentication:FreeBSD:Check harmful login shells:
 AUTH-9222:test:security:authentication::Check for non unique groups:
 AUTH-9226:test:security:authentication::Check non unique group names:
 AUTH-9228:test:security:authentication::Check password file consistency with pwck:
+AUTH-9229:test:security:authentication::Check password hashing methods:
 AUTH-9234:test:security:authentication::Query user accounts:
 AUTH-9240:test:security:authentication::Query NIS+ authentication support:
 AUTH-9242:test:security:authentication::Query NIS authentication support:
diff --git a/include/binaries b/include/binaries
index 89e2fddd..af5882a5 100644
--- a/include/binaries
+++ b/include/binaries
@@ -310,6 +310,7 @@
 
         # Test if the basic system tools are defined. These will be used during the audit.
         [ "${AWKBINARY:-}" ] || ExitFatal "awk binary not found"
+        [ "${CAT_BINARY:-}" ] || ExitFatal "cat binary not found"
         [ "${CUTBINARY:-}" ] || ExitFatal "cut binary not found"
         [ "${EGREPBINARY:-}" ] || ExitFatal "grep binary not found"
         [ "${FINDBINARY:-}" ] || ExitFatal "find binary not found"
diff --git a/include/tests_authentication b/include/tests_authentication
index 02a3bb74..9d992d49 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -325,6 +325,67 @@
     fi
 #
 #################################################################################
+#
+    # Test        : AUTH-9229
+    # Description : Check password hashing methods vs. recommendations in crypt(5)
+    # Notes       : Applicable to all Unix-like OS
+    Register --test-no AUTH-9229 --weight L --network NO --category security --description "Check password hashing methods"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: Checking password hashing methods"
+	if [ -e ${ROOTDIR}etc/shadow ]; then SHADOW=${ROOTDIR}etc/shadow; else SHADOW=""; fi
+	FIND=$(${CAT_BINARY} ${ROOTDIR}etc/passwd ${SHADOW} | ${AWKBINARY} -F : '{print length($2) ":" $2 }' | while read METHOD; do
+	    case ${METHOD} in
+		1:\* | 1:x | 0: | *:!*)
+		    # disabled | shadowed | no password | locked account
+		    ;;
+		*:\$5\$*| *:\$6\$*)
+		    # sha256crypt | sha512crypt: check number of rounds, should be >5000
+		    ROUNDS=$(echo "${METHOD}" | sed -n 's/.*rounds=\([0-9]*\)\$.*/\1/gp')
+		    if [ -z "${ROUNDS}" ]; then
+		        echo 'sha256crypt/sha512crypt(default<=5000rounds)'
+		    elif [ "${ROUNDS}" -le 5000 ]; then
+		        echo 'sha256crypt/sha512crypt(<=5000rounds)'
+		    fi
+		    ;;
+		*:\$y\$* | *:\$gy\$* | *:\$2b\$* | *:\$7\$*)
+		    # yescrypt | gost-yescrypt | bcrypt | scrypt
+		    ;;
+		*:_*)
+		    echo bsdicrypt
+		    ;;
+		*:\$1\$*)
+		    echo md5crypt
+		    ;;
+		*:\$3\$*)
+		    echo NT
+		    ;;
+		*:\$md5*)
+		    echo SunMD5
+		    ;;
+		*:\$sha1*)
+		    echo sha1crypt
+		    ;;
+		13:* | 178:*)
+		    echo bigcrypt/descrypt
+		    ;;
+                *)
+                    echo "Unknown password hashing method ${METHOD}. Please report to lynis-dev@cisofy.com"
+                    ;;
+	    esac
+	done | ${SORTBINARY} --unique | ${TRBINARY} '\n' ' ')
+        if [ -z "${FIND}" ]; then
+            Display --indent 2 --text "- Password hashing methods" --result "${STATUS_OK}" --color GREEN
+            LogText "Result: no poor password hashing methods found"
+            AddHP 2 2
+        else
+            Display --indent 2 --text "- Password hashing methods" --result "${STATUS_SUGGESTION}" --color YELLOW
+            LogText "Result: poor password hashing methods found: ${FIND}"
+            ReportSuggestion "${TEST_NO}" "Change ${ROOTDIR}etc/login.defs password ENCRYPT_METHOD and SHA_CRYPT_MIN_ROUNDS to more secure values, check also PAM configuration, expire passwords to encrypt with new values"
+            AddHP 0 2
+        fi
+    fi
+#
+#################################################################################
 #
     # Test        : AUTH-9234
     # Description : Query user accounts

From 695eef64ade2ce3413c16ce91105787460d0708b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 21 Mar 2020 14:09:11 +0100
Subject: [PATCH 500/679] Updated version

---
 plugins/plugin_pam_phase1 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/plugins/plugin_pam_phase1 b/plugins/plugin_pam_phase1
index 81c758c1..9aada629 100644
--- a/plugins/plugin_pam_phase1
+++ b/plugins/plugin_pam_phase1
@@ -6,12 +6,12 @@
 #-----------------------------------------------------
 # PLUGIN_AUTHOR=Michael Boelen <michael.boelen@cisofy.com>
 # PLUGIN_CATEGORY=authentication
-# PLUGIN_DATE=2019-07-26
+# PLUGIN_DATE=2020-03-21
 # PLUGIN_DESC=PAM
 # PLUGIN_NAME=pam
 # PLUGIN_PACKAGE=all
 # PLUGIN_REQUIRED_TESTS=
-# PLUGIN_VERSION=1.0.4
+# PLUGIN_VERSION=1.0.5
 #-----------------------------------------------------
 #########################################################################
 #

From 26a54991ba6a09f1fcc5f8f68cb9ae64539c8230 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Sat, 21 Mar 2020 14:12:06 +0200
Subject: [PATCH 501/679] Check for software pseudo random number generators

Check for running audio-entropyd, havegd or jitterentropy-rngd.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 db/tests.db          |  3 ++-
 include/tests_crypto | 26 ++++++++++++++++++++++++--
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/db/tests.db b/db/tests.db
index d051c77d..76884a45 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -87,7 +87,8 @@ CORE-1000:test:performance:system_integrity::Check all system binaries:
 CRYP-7902:test:security:crypto::Check expire date of SSL certificates:
 CRYP-7930:test:security:crypto:Linux:Determine if system uses LUKS encryption:
 CRYP-8002:test:security:crypto:Linux:Gather kernel entropy:
-CRYP-8004:test:security:crypto:Linux:Presence of hardware number generator:
+CRYP-8004:test:security:crypto:Linux:Presence of hardware random number generators:
+CRYP-8005:test:security:crypto:Linux:Presence of software pseudo random number generators:
 DNS-1600:test:security:dns::Validating that the DNSSEC signatures are checked:
 DBS-1804:test:security:databases::Checking active MySQL process:
 DBS-1816:test:security:databases::Checking MySQL root password:
diff --git a/include/tests_crypto b/include/tests_crypto
index 6a9cb5f2..5c2a0804 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -196,8 +196,8 @@
 #################################################################################
 #
     # Test        : CRYP-8004
-    # Description : Test for presence of random number generators
-    Register --test-no CRYP-8004 --os Linux --weight L --network NO --root-only NO --category security --description "Presence of random number generators"
+    # Description : Test for presence of hardware random number generators
+    Register --test-no CRYP-8004 --os Linux --weight L --network NO --root-only NO --category security --description "Presence of hardware random number generators"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: looking for ${ROOTDIR}sys/class/misc/hw_random/rng_current"
         if [ -f "${ROOTDIR}sys/class/misc/hw_random/rng_current" ]; then
@@ -223,6 +223,28 @@
     fi
 #
 #################################################################################
+#
+    # Test        : CRYP-8005
+    # Description : Test for presence of software pseudo random number generators
+    Register --test-no CRYP-8005 --os Linux --weight L --network NO --root-only NO --category security --description "Presence of software pseudo random number generators"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: looking for software pseudo random number generators"
+	FOUND=""
+	for SERVICE in audio-entropyd havegd jitterentropy-rngd; do
+            if IsRunning "${SERVICE}" --full; then
+		FOUND="${FOUND} ${SERVICE}"
+	    fi
+	done
+	if [ -z "${FOUND}" ]; then
+            Display --indent 2 --text "- SW prng" --result "${STATUS_NO}" --color YELLOW
+            ReportSuggestion "${TEST_NO}" "Utilize software pseudo random number generators"
+        else
+            Display --indent 2 --text "- SW prng" --result "${STATUS_YES}" --color GREEN
+            LogText "Result: found ${FOUND} running"
+        fi
+    fi
+#
+#################################################################################
 #
 
 WaitForKeyPress

From e0e2096a25a45a3ea03133cb2247a638f564ec49 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Sat, 21 Mar 2020 17:14:55 +0200
Subject: [PATCH 502/679] Enhance AppArmor check

Count and log unconfined processes which have no AppArmor profile
applied.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 include/tests_mac_frameworks | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/tests_mac_frameworks b/include/tests_mac_frameworks
index d6d40a6b..94f2065d 100644
--- a/include/tests_mac_frameworks
+++ b/include/tests_mac_frameworks
@@ -75,6 +75,12 @@
                     Report "apparmor_enabled=1"
                     Report "apparmor_policy_loaded=1"
                     AddHP 3 3
+                    # ignore kernel threads (Parent PID = 2 [kthreadd])
+                    NUNCONFINED=$(${PSBINARY} -N --ppid 2 -o label | ${GREPBINARY} '^unconfined' | ${WCBINARY} --lines)
+                    Display --indent 8 --text "Found ${NUNCONFINED} unconfined processes"
+                    for PROCESS in $(${PSBINARY} -N --ppid 2 -o label:1,pid,comm | ${GREPBINARY} '^unconfined' | ${TRBINARY} ' ' ':'); do
+                        LogText "Result: Unconfined process: ${PROCESS}"
+                    done
                 elif [ $? -eq 4 ]; then
                     LogText "Result: Can not determine status, most likely due to lacking permissions"
                     Display --indent 4 --text "- Checking AppArmor status" --result "${STATUS_UNKNOWN}" --color RED

From f3426697777d87de31d6229ebecd875a2fc2f0c4 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 21 Mar 2020 18:53:05 +0100
Subject: [PATCH 503/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cb92e253..3023dc5b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -49,6 +49,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - New test: BOOT-5109 - Test presence rEFInd boot loader
 - New test: CRYP-7930 - test for LUKS encryption
 - New test: CRYP-8004 - presence of hardware random number generator
+- New test: CRYP-8005 - presence of software random number generator
 - New test: DBS-1828  - PostgreSQL configuration files
 - New test: FINT-4316 - presence of AIDE database and size test
 - New test: INSE-8314 - test for NIS client

From 044c78452b84758a741855a319c0dade2c64a9b2 Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Thu, 19 Mar 2020 16:38:37 -0500
Subject: [PATCH 504/679] Add AUTH-9234 for NetBSD

---
 include/tests_authentication | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index b4520035..2b3fcae3 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -331,7 +331,7 @@
     # Notes       : AIX: 100+
     #               HPUX: 100+
     #               macOS doesn't have any user info in /etc/passwd, users are managed with opendirectoryd)
-    #               OpenBSD/NetBSD: unknown
+    #               OpenBSD/NetBSD: 1000-60000, excluding 32767 (default)
     #               Arch Linux / CentOS / Ubuntu: 1000+
     Register --test-no AUTH-9234 --weight L --network NO --category security --description "Query user accounts"
     if [ ${SKIPTEST} -eq 0 ]; then
@@ -373,6 +373,23 @@
                 fi
             ;;
 
+            "NetBSD")
+                if [ -f ${ROOTDIR}etc/usermgmt.conf ]; then
+			UID_RANGE=$(${GREPBINARY} "^range" ${ROOTDIR}etc/usermgmt.conf | ${AWKBINARY} '{ sub(/\.\./, "-", $2); print $2 }')
+                fi
+		if [ -n "${UID_RANGE}" ]; then
+                    LogText "Result: found configured user id range specified: ${UID_RANGE}"
+                    UID_MIN=$(echo $UID_RANGE | ${AWKBINARY} -F- '{ print $1 }')
+                    UID_MAX=$(echo $UID_RANGE | ${AWKBINARY} -F- '{ print $2 }')
+                else
+                    UID_MIN=1000
+		    UID_MAX=60000
+                    LogText "Result: no configured user id range specified; using default ${UID_MIN}-${UID_MAX}"
+                fi
+                LogText "NetBSD real users output (ID = 0, or ${UID_MIN}-${UID_MAX}, but not 32767):"
+                FIND=$(${AWKBINARY} -v UID_MIN="${UID_MIN}" -v UID_MAX="${UID_MAX}" -F: '($3 >= UID_MIN && $3 <= UID_MAX && $3 != 32767) || ($3 == 0) { print $1","$3 }' /etc/passwd)
+            ;;
+
             "OpenBSD")
                 LogText "OpenBSD real users output (ID = 0, or 1000-60000, but not 32767):"
                 FIND=$(${AWKBINARY} -F: '($3 >= 1000 && $3 <= 60000 && $3 != 32767) || ($3 == 0) { print $1","$3 }' /etc/passwd)

From f56c3b5f94c57732ceffe306eb12db4b50df095c Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Sat, 21 Mar 2020 16:16:34 -0500
Subject: [PATCH 505/679] Combine NetBSD and OpenBSD AUTH-9234 check

Both NetBSD and OpenBSD have `useradd(8)`, so they can share logic
checking `/etc/usermgmt.conf` for the default user UID range.
---
 include/tests_authentication | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 2b3fcae3..9496380b 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -373,7 +373,7 @@
                 fi
             ;;
 
-            "NetBSD")
+            "NetBSD"|"OpenBSD")
                 if [ -f ${ROOTDIR}etc/usermgmt.conf ]; then
 			UID_RANGE=$(${GREPBINARY} "^range" ${ROOTDIR}etc/usermgmt.conf | ${AWKBINARY} '{ sub(/\.\./, "-", $2); print $2 }')
                 fi
@@ -386,15 +386,10 @@
 		    UID_MAX=60000
                     LogText "Result: no configured user id range specified; using default ${UID_MIN}-${UID_MAX}"
                 fi
-                LogText "NetBSD real users output (ID = 0, or ${UID_MIN}-${UID_MAX}, but not 32767):"
+                LogText "${OS} real users output (ID = 0, or ${UID_MIN}-${UID_MAX}, but not 32767):"
                 FIND=$(${AWKBINARY} -v UID_MIN="${UID_MIN}" -v UID_MAX="${UID_MAX}" -F: '($3 >= UID_MIN && $3 <= UID_MAX && $3 != 32767) || ($3 == 0) { print $1","$3 }' /etc/passwd)
             ;;
 
-            "OpenBSD")
-                LogText "OpenBSD real users output (ID = 0, or 1000-60000, but not 32767):"
-                FIND=$(${AWKBINARY} -F: '($3 >= 1000 && $3 <= 60000 && $3 != 32767) || ($3 == 0) { print $1","$3 }' /etc/passwd)
-            ;;
-
             "Solaris")
                 LogText "Solaris real users output (ID =0, or 100+, but not 60001/65534):"
                 FIND=$(${AWKBINARY} -F: '($3 >= 100 && $3 != 60001 && $3 != 65534) || ($3 == 0) { print $1","$3 }' /etc/passwd)

From 33ba896b41b194ceced8a29910f172f18f4f0644 Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Sat, 21 Mar 2020 19:30:07 -0500
Subject: [PATCH 506/679] Add FreeBSD and NetBSD to AUTH-9268

Add FreeBSD and NetBSD as both support PAM. Simplify the PREQS_MET
test by using a case rather than a long if or.
---
 include/tests_authentication | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index b4520035..d2a23f9e 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -691,8 +691,13 @@
 #
     # Test        : AUTH-9268
     # Description : Searching available PAM files
-    # Notes       : PAM is used on AIX, FreeBSD, Linux, HPUX, Solaris
-    if [ ${OS} = "AIX" -o ${OS} = "Linux" -o ${OS} = "HPUX" -o ${OS} = "Solaris" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    # Notes       : PAM is used on AIX, FreeBSD, Linux, HPUX, NetBSD, Solaris
+    case "${OS}" in
+        "AIX"|"FreeBSD"|"Linux"|"HPUX"|"NetBSD"|"Solaris")
+            PREQS_MET="YES" ;;
+        *)
+            PREQS_MET="NO" ;;
+    esac
     Register --test-no AUTH-9268 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking presence pam.d files"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0

From 203a4d34801ec37200d2ec190328f6c27ad71b78 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Sun, 22 Mar 2020 11:18:00 +0200
Subject: [PATCH 507/679] Check IMA/EVM status

Check for evmctl (Extended Verification Module) tool and system IMA (Integrity Measurement
Architecture) status.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 db/tests.db                  |  1 +
 include/binaries             |  1 +
 include/tests_file_integrity | 22 ++++++++++++++++++++++
 3 files changed, 24 insertions(+)

diff --git a/db/tests.db b/db/tests.db
index 76884a45..44a9a410 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -135,6 +135,7 @@ FINT-4330:test:security:file_integrity::mtree availability:
 FINT-4334:test:security:file_integrity::Check lfd daemon status:
 FINT-4336:test:security:file_integrity::Check lfd configuration status:
 FINT-4338:test:security:file_integrity::osqueryd syscheck daemon running:
+FINT-4339:test:security:file_integrity:Linux:Check IMA/EVM Status
 FINT-4350:test:security:file_integrity::File integrity software installed:
 FINT-4402:test:security:file_integrity::Checksums (SHA256 or SHA512):
 FIRE-4502:test:security:firewalls:Linux:Check iptables kernel module:
diff --git a/include/binaries b/include/binaries
index 89e2fddd..b538eb56 100644
--- a/include/binaries
+++ b/include/binaries
@@ -157,6 +157,7 @@
                             xbps-query)             XBPSBINARY="${BINARY}";            LogText "  Found known binary: xbps (package management) - ${BINARY}" ;;
                             egrep)                  EGREPBINARY=${BINARY};             LogText "  Found known binary: egrep (text search) - ${BINARY}" ;;
                             equery)                 EQUERYBINARY="${BINARY}";          LogText "  Found known binary: query (package manager) - ${BINARY}" ;;
+                            evmctl)                 EVMCTLBINARY=${BINARY};            LogText "  Found known binary: evmctl (IMA/EVM tool) - ${BINARY}" ;;
                             exim)                   EXIMBINARY="${BINARY}";            EXIMVERSION=$(${BINARY} -bV | grep 'Exim version' | awk '{ print $3 }' | xargs); LogText "  Found known binary ${BINARY} (version ${EXIMVERSION})" ;;
                             fail2ban-server)        FAIL2BANBINARY="${BINARY}";        LogText "  Found known binary: fail2ban (IPS tool) - ${BINARY}" ;;
                             file)                   FILEBINARY="${BINARY}";            LogText "  Found known binary: file (file type detection) - ${BINARY}" ;;
diff --git a/include/tests_file_integrity b/include/tests_file_integrity
index 7a5658ac..a387c248 100644
--- a/include/tests_file_integrity
+++ b/include/tests_file_integrity
@@ -297,6 +297,28 @@
     fi
 #
 #################################################################################
+#
+    # Test        : FINT-4339
+    # Description : Check IMA/EVM status
+    if [ ! -z "${EVMCTLBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; SKIPREASON="No evmctl binary found"; fi
+    Register --test-no FINT-4339 --os Linux --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight L --network NO --category security --description "Check IMA/EVM status"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        FOUND=0
+        if [ -e /sys/kernel/security/ima ]; then
+            FOUND=$(${CAT_BINARY} /sys/kernel/security/ima)
+        fi
+        if [ "${FOUND}" -ne 1 ]; then
+            LogText "Result: EVM tools found but IMA/EVM disabled"
+            Display --indent 2 --text "- IMA/EVM (status)" --result "${STATUS_DISABLED}" --color YELLOW
+        else
+            LogText "Result: EVM tools found, IMA/EVM enabled"
+            FILE_INT_TOOL="evmctl"
+            FILE_INT_TOOL_FOUND=1
+            Display --indent 2 --text "- IMA/EVM (status)" --result "${STATUS_ENABLED}" --color GREEN
+        fi
+    fi
+#
+#################################################################################
 #
     # Test        : FINT-4402 (was FINT-4316)
     # Description : Check if AIDE is configured to use SHA256 or SHA512 checksums

From a067c4211afbf8ced99e20de9b13e8c8526ea9fa Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 22 Mar 2020 15:16:31 +0100
Subject: [PATCH 508/679] Updated log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3023dc5b..2237cc5e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -77,7 +77,9 @@ Using the relevant options, the scan will change base on the intended goal.
 - Binaries: skip pacman when it is the game instead of package manager
 - Security: the 'nounset' (set -u) parameter is now activated by default
 - AUTH-9228 - HP-UX support
+- AUTH-9234 - NetBSD support
 - AUTH-9266 - skip .pam-old files in /etc/pam.d
+- AUTH-9268 - Perform test also on FreeBSD and NetBSD
 - AUTH-9282 - fix: temporary variable was overwritten
 - AUTH-9408 - added support for pam_tally2 to log failed logins
 - BANN-7126 - additional words for login banner are accepted

From 8ea39314f2a028bca4ff53842258459c8ca018d3 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Mon, 23 Mar 2020 10:35:38 +0200
Subject: [PATCH 509/679] Check for dm-integrity and dm-verity

Detect tools for dm-integrity and dm-verity, check if some devices
in /dev/mapper/* use them and especially the system root device.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 db/tests.db                  |  2 +
 include/binaries             |  2 +
 include/tests_file_integrity | 79 ++++++++++++++++++++++++++++++++++++
 3 files changed, 83 insertions(+)

diff --git a/db/tests.db b/db/tests.db
index 44a9a410..3fc66b9a 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -136,6 +136,8 @@ FINT-4334:test:security:file_integrity::Check lfd daemon status:
 FINT-4336:test:security:file_integrity::Check lfd configuration status:
 FINT-4338:test:security:file_integrity::osqueryd syscheck daemon running:
 FINT-4339:test:security:file_integrity:Linux:Check IMA/EVM Status
+FINT-4340:test:security:file_integrity:Linux:Check dm-integrity status
+FINT-4341:test:security:file_integrity:Linux:Check dm-verity status
 FINT-4350:test:security:file_integrity::File integrity software installed:
 FINT-4402:test:security:file_integrity::Checksums (SHA256 or SHA512):
 FIRE-4502:test:security:firewalls:Linux:Check iptables kernel module:
diff --git a/include/binaries b/include/binaries
index b538eb56..bae053d2 100644
--- a/include/binaries
+++ b/include/binaries
@@ -176,6 +176,7 @@
                             httpd2-prefork)         HTTPDBINARY=${BINARY};             LogText "  Found known binary: apache2 (web server) - ${BINARY}" ;;
                             initctl)                INITCTLBINARY=${BINARY};           SERVICE_MANAGER="upstart";  LogText "  Found known binary: initctl (client to upstart init) - ${BINARY}" ;;
                             ifconfig)               IFCONFIGBINARY="${BINARY}";        LogText "  Found known binary: ipconfig (IP configuration) - ${BINARY}" ;;
+                            integritysetup)         INTEGRITYSETUPBINARY="${BINARY}";  LogText "  Found known binary: integritysetup (dm-integrity setup tool) - ${BINARY}" ;;
                             ip)                     IPBINARY="${BINARY}";              LogText "  Found known binary: ip (IP configuration) - ${BINARY}" ;;
                             ipf)                    IPFBINARY="${BINARY}";             LogText "  Found known binary: ipf (firewall) - ${BINARY}" ;;
                             iptables)               IPTABLESBINARY="${BINARY}";        LogText "  Found known binary: iptables (firewall) - ${BINARY}" ;;
@@ -282,6 +283,7 @@
                             uname)                  UNAMEBINARY="${BINARY}";           LogText "  Found known binary: uname (operating system details) - ${BINARY}" ;;
                             uniq)                   UNIQBINARY="${BINARY}";            LogText "  Found known binary: uniq (text manipulation utility) - ${BINARY}";;
                             usbguard)               USBGUARDBINARY="${BINARY}";        LogText "  Found known binary: usbguard (USB security tool) - ${BINARY}" ;;
+                            veritysetup)            VERITYSETUPBINARY="${BINARY}";     LogText "  Found known binary: veritysetup (dm-verity setup tool) - ${BINARY}" ;;
                             vgdisplay)              VGDISPLAYBINARY="${BINARY}";       LogText "  Found known binary: vgdisplay (LVM tool) - ${BINARY}" ;;
                             vmtoolsd)               VMWARETOOLSDBINARY="${BINARY}";    LogText "  Found known binary: vmtoolsd (VMWare tools) - ${BINARY}" ;;
                             wc)                     WCBINARY="${BINARY}";              LogText "  Found known binary: wc (word count) - ${BINARY}" ;;
diff --git a/include/tests_file_integrity b/include/tests_file_integrity
index a387c248..dc32411d 100644
--- a/include/tests_file_integrity
+++ b/include/tests_file_integrity
@@ -319,6 +319,85 @@
     fi
 #
 #################################################################################
+#
+    # Test        : FINT-4340
+    # Description : Check dm-integrity status
+    if [ ! -z "${INTEGRITYSETUPBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; SKIPREASON="No integritysetup binary found"; fi
+    Register --test-no FINT-4340 --os Linux --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight L --network NO --category security --description "Check dm-integrity status"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        FOUND=0
+        ROOTPROTECTED=0
+	ROOTDEVICE=$(${MOUNTBINARY} | ${AWKBINARY} '/ on \/ type / { print $1 }')
+	for DEVICE in /dev/mapper/*; do
+	    if [ -e "${DEVICE}" ]; then
+		FIND=$(${INTEGRITYSETUPBINARY} status "${DEVICE}" | ${EGREPBINARY} 'type:.*INTEGRITY')
+		if [ ! -z "${FIND}" ]; then
+		    FOUND=1
+		    LogText "Result: found dm-integrity device ${DEVICE}"
+		    if [ "${DEVICE}" = "${ROOTDEVICE}" ]; then
+			ROOTPROTECTED=1
+		    fi
+		fi
+	    fi
+	done
+        if [ "${FOUND}" -ne 1 ]; then
+            LogText "Result: dm-integrity tools found but no active devices"
+            Display --indent 2 --text "- dm-integrity (status)" --result "${STATUS_DISABLED}" --color WHITE
+        else
+            LogText "Result: dm-integrity tools found, active devices"
+	    if [ ${ROOTPROTECTED} -eq 1 ]; then
+		LogText "Result: root filesystem is protected by dm-integrity"
+		Display --indent 2 --text "- dm-integrity (status)" --result "${STATUS_ENABLED}" --color GREEN
+	    else
+		LogText "Result: root filesystem is not protected by dm-integrity but active devices found"
+		Display --indent 2 --text "- dm-integrity (status)" --result "${STATUS_FOUND}" --color YELLOW
+	    fi
+            FILE_INT_TOOL="dm-integrity"
+            FILE_INT_TOOL_FOUND=1
+            Display --indent 2 --text "- dm-integrity (status)" --result "${STATUS_ENABLED}" --color GREEN
+        fi
+    fi
+#
+#################################################################################
+#
+    # Test        : FINT-4341
+    # Description : Check dm-verity status
+    if [ ! -z "${VERITYSETUPBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; SKIPREASON="No veritysetup binary found"; fi
+    Register --test-no FINT-4341 --os Linux --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight L --network NO --category security --description "Check dm-verity status"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        FOUND=0
+        ROOTPROTECTED=0
+	ROOTDEVICE=$(${MOUNTBINARY} | ${AWKBINARY} '/ on \/ type / { print $1 }')
+	for DEVICE in /dev/mapper/*; do
+	    if [ -e "${DEVICE}" ]; then
+		FIND=$(${VERITYSETUPBINARY} status "${DEVICE}" | ${EGREPBINARY} 'type:.*VERITY')
+		if [ ! -z "${FIND}" ]; then
+		    FOUND=1
+		    LogText "Result: found dm-verity device ${DEVICE}"
+		    if [ "${DEVICE}" = "${ROOTDEVICE}" ]; then
+			ROOTPROTECTED=1
+		    fi
+		fi
+	    fi
+	done
+        if [ "${FOUND}" -ne 1 ]; then
+            LogText "Result: dm-verity tools found but no active devices"
+            Display --indent 2 --text "- dm-verity (status)" --result "${STATUS_DISABLED}" --color WHITE
+        else
+            LogText "Result: dm-verity tools found, active devices"
+	    if [ ${ROOTPROTECTED} -eq 1 ]; then
+		LogText "Result: root filesystem is protected by dm-verity"
+		Display --indent 2 --text "- dm-verity (status)" --result "${STATUS_ENABLED}" --color GREEN
+	    else
+		LogText "Result: root filesystem is not protected by dm-verity but active devices found"
+		Display --indent 2 --text "- dm-verity (status)" --result "${STATUS_FOUND}" --color YELLOW
+	    fi
+            FILE_INT_TOOL="dm-verity"
+            FILE_INT_TOOL_FOUND=1
+        fi
+    fi
+#
+#################################################################################
 #
     # Test        : FINT-4402 (was FINT-4316)
     # Description : Check if AIDE is configured to use SHA256 or SHA512 checksums

From 17ac4d2c1cfc1aa8432401cae834779874d3e734 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 23 Mar 2020 10:44:45 +0100
Subject: [PATCH 510/679] [AUTH-9252] corrected permission check

---
 CHANGELOG.md                 | 1 +
 include/tests_authentication | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2237cc5e..84f15898 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -78,6 +78,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - Security: the 'nounset' (set -u) parameter is now activated by default
 - AUTH-9228 - HP-UX support
 - AUTH-9234 - NetBSD support
+- AUTH-9252 - corrected permission check
 - AUTH-9266 - skip .pam-old files in /etc/pam.d
 - AUTH-9268 - Perform test also on FreeBSD and NetBSD
 - AUTH-9282 - fix: temporary variable was overwritten
diff --git a/include/tests_authentication b/include/tests_authentication
index f0b61ba2..d3f9d3aa 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -509,7 +509,7 @@
         if [ -d "${SUDOERS_D}" ]; then
             LogText "Test: checking drop-in directory (${SUDOERS_D})"
             FIND=$(${LSBINARY} -ld ${SUDOERS_D} | ${CUTBINARY} -c 2-10)
-            FIND2=$(${LSBINARY} -nd ${SUDOERS_D} | ${AWKBINARY} '{print $3$4}')
+            FIND2=$(${LSBINARY} -lnd ${SUDOERS_D} | ${AWKBINARY} '{print $3$4}')
             LogText "Result: Found directory permissions: ${FIND} and owner UID GID: ${FIND2}"
             case "${FIND}" in
                 rwx[r-][w-][x-]--- )
@@ -537,7 +537,7 @@
         for f in ${SUDO_CONFIG_FILES}; do
             LogText "Test: checking file (${f})"
             FIND=$(${LSBINARY} -l ${f} | ${CUTBINARY} -c 2-10)
-            FIND2=$(${LSBINARY} -n ${f} | ${AWKBINARY} '{print $3$4}')
+            FIND2=$(${LSBINARY} -ln ${f} | ${AWKBINARY} '{print $3$4}')
             LogText "Result: Found file permissions: ${FIND} and owner UID GID: ${FIND2}"
             case "${FIND}" in
                 r[w-]-[r-][w-]---- )

From 410206619aecc57bfd73904252f5f03356533e18 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 23 Mar 2020 11:30:10 +0100
Subject: [PATCH 511/679] Removed restriction for using the plugin and code
 style improvements

---
 plugins/plugin_systemd_phase1 | 90 ++++++++++++++++-------------------
 1 file changed, 40 insertions(+), 50 deletions(-)

diff --git a/plugins/plugin_systemd_phase1 b/plugins/plugin_systemd_phase1
index 0c73f45d..4e183f88 100644
--- a/plugins/plugin_systemd_phase1
+++ b/plugins/plugin_systemd_phase1
@@ -1,27 +1,17 @@
 #!/bin/sh
 
-#########################################################################
-#
-# This component is part of Lynis Enterprise. No parts may be copied,
-# distributed or used without written permission of CISOfy. Users who
-# have an active license are permitted to use this component as part
-# of the service. This software component may only be used in combination
-# with Lynis and Lynis Enterprise.
-#
-# Copyright 2016, CISOfy - https://cisofy.com
-#
 #########################################################################
 #
 #    * DO NOT REMOVE *
 #-----------------------------------------------------
 # PLUGIN_AUTHOR=Michael Boelen <michael.boelen@cisofy.com>
 # PLUGIN_CATEGORY=essentials
-# PLUGIN_DATE=2017-04-30
+# PLUGIN_DATE=2020-03-23
 # PLUGIN_DESC=Tests related to systemd tooling
 # PLUGIN_NAME=systemd
 # PLUGIN_PACKAGE=community
 # PLUGIN_REQUIRED_TESTS=
-# PLUGIN_VERSION=1.0.2
+# PLUGIN_VERSION=1.0.4
 #-----------------------------------------------------
 #
 #########################################################################
@@ -36,7 +26,7 @@
 #
     # Test        : PLGN-3800
     # Description : Gather systemctl exit code
-    if [ ! "${SYSTEMCTLBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${SYSTEMCTLBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PLGN-3800 --preqs-met ${PREQS_MET} --weight L --network NO --description "Gather systemctl exit code" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${SYSTEMCTLBINARY} > /dev/null)
@@ -54,17 +44,17 @@
     # Description : Query systemd version and options
     # Notes       : version can also be gathered with systemctl show | grep ^Version=
     #               features with systemctl show | grep ^Features=
-    if [ ! "${SYSTEMCTLBINARY}" = "" -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${SYSTEMCTLBINARY}" -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PLGN-3802 --preqs-met ${PREQS_MET} --weight L --network NO --description "Query systemd version and options" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${SYSTEMCTLBINARY} --version 2> /dev/null | ${AWKBINARY} '{ if ($1=="systemd") { print $2 } }' | grep "^[1-9][0-9][0-9]$" | head -1)
-        if [ ! "${FIND}" = "" ]; then
+        if [ -n "${FIND}" ]; then
             SYSTEMD_VERSION=${FIND}
             Report "systemd_version=${FIND}"
             LogText "Result: found systemd version ${FIND}"
         fi
-        FIND=`${SYSTEMCTLBINARY} --version 2> /dev/null | grep "^[-+]" | sed 's/[[:space:]]/,/g' | head -1`
-        if [ ! "${FIND}" = "" ]; then
+        FIND=$(${SYSTEMCTLBINARY} --version 2> /dev/null | grep "^[-+]" | sed 's/[[:space:]]/,/g' | head -1)
+        if [ -n "${FIND}" ]; then
             Report "systemd_builtin_components=${FIND}"
             LogText "Result: found builtin components list"
         fi
@@ -74,11 +64,11 @@
 #
     # Test        : PLGN-3804
     # Description : Gather all systemd unit files
-    if [ ! "${SYSTEMCTLBINARY}" = "" -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${SYSTEMCTLBINARY}" -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PLGN-3804 --preqs-met ${PREQS_MET} --weight L --network NO --description "Gather systemd unit files and their status" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
-        FIND=`${SYSTEMCTLBINARY} --no-legend list-unit-files 2> /dev/null | ${AWKBINARY} '{ print $1"|"$2"|" }'`
-        if [ ! "${FIND}" = "" ]; then
+        FIND=$(${SYSTEMCTLBINARY} --no-legend list-unit-files 2> /dev/null | ${AWKBINARY} '{ print $1"|"$2"|" }')
+        if [ -n "${FIND}" ]; then
             LogText "Result: found systemd unit files via systemctl list-unit-files"
             for I in ${FIND}; do
                 LogText "Output: ${I}"
@@ -91,11 +81,11 @@
 #
     # Test        : PLGN-3806
     # Description : Gather all failed systemd units
-    if [ ! "${SYSTEMCTLBINARY}" = "" -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${SYSTEMCTLBINARY}" -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PLGN-3806 --preqs-met ${PREQS_MET} --weight L --network NO --description "Gather failed systemd units" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
-        FIND=`${SYSTEMCTLBINARY} --no-legend --state=failed 2> /dev/null | ${AWKBINARY} '{ if ($4=="failed" && $5=="failed") { print $2 } }'`
-        if [ ! "${FIND}" = "" ]; then
+        FIND=$(${SYSTEMCTLBINARY} --no-legend --state=failed 2> /dev/null | ${AWKBINARY} '{ if ($4=="failed" && $5=="failed") { print $2 } }')
+        if [ -n "${FIND}" ]; then
             LogText "Result: found systemd unit files via systemctl list-unit-files"
             for I in ${FIND}; do
                 LogText "Output: ${I}"
@@ -108,11 +98,11 @@
 #
     # Test        : PLGN-3808
     # Description : Gather machine ID
-    if [ -f /etc/machine-id -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -f ${ROOTDIR}etc/machine-id -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PLGN-3808 --preqs-met ${PREQS_MET} --weight L --network NO --description "Gather systemd machine ID" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
-        FIND=$(cat /etc/machine-id | head -1)
-        if [ ! "${FIND}" = "" ]; then
+        FIND=$(cat ${ROOTDIR}etc/machine-id | head -1)
+        if [ -n "${FIND}" ]; then
             SYSTEMD_MACHINEID="${FIND}"
             LogText "Result: found machine ID: ${SYSTEMD_MACHINEID}"
         fi
@@ -122,11 +112,11 @@
 #
     # Test        : PLGN-3810
     # Description : Query main systemd binaries
-    if [ ! "${FINDBINARY}" = "" -a -d /usr/lib/systemd -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${FINDBINARY}" -a -d /usr/lib/systemd -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PLGN-3810 --preqs-met ${PREQS_MET} --weight L --network NO --description "Query main systemd binaries" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${FINDBINARY} ${ROOTDIR}usr/lib/systemd -maxdepth 1 -type f -name "systemd-*" -printf "%f|")
-        if [ ! "${FIND}" = "" ]; then
+        if [ -n "${FIND}" ]; then
             Report "systemd_binaries=${FIND}"
             LogText "Result: found systemd binaries in /usr/lib/systemd"
         else
@@ -138,29 +128,29 @@
 #
     # Test        : PLGN-3812
     # Description : Query journal for boot related information
-    if [ ! "${JOURNALCTLBINARY}" = "" -a ${SYSTEMD_RUNNING} -eq 1 -a ${SYSTEMD_VERSION} -ge 209 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${JOURNALCTLBINARY}" -a ${SYSTEMD_RUNNING} -eq 1 -a ${SYSTEMD_VERSION} -ge 209 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PLGN-3812 --preqs-met ${PREQS_MET} --weight L --network NO --description "Query journal for boot related information" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${JOURNALCTLBINARY} --list-boots | wc -l)
         LogText "Output: number of boots listed in journal is ${FIND}"
-        if [ ! "${FIND}" = "" ]; then Report "journal_bootlogs=${FIND}"; fi
+        if [ -n "${FIND}" ]; then Report "journal_bootlogs=${FIND}"; fi
         FIND=$(${JOURNALCTLBINARY} --list-boots | head -1 | awk '{ print $4 }')
         LogText "Output: oldest boot date in journal is ${FIND}"
-        if [ ! "${FIND}" = "" ]; then Report "journal_oldest_bootdate=${FIND}"; fi
+        if [ -n "${FIND}" ]; then Report "journal_oldest_bootdate=${FIND}"; fi
     fi
 #
 #################################################################################
 #
     # Test        : PLGN-3814
     # Description : Journal integrity
-    if [ ! "${JOURNALCTLBINARY}" = "" -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${JOURNALCTLBINARY}" -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PLGN-3814 --preqs-met ${PREQS_MET} --weight L --network NO --description "Verify journal integrity" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${JOURNALCTLBINARY} --verify 2>&1 | grep FAIL | sed 's/[[:space:]]/:space:/g')
-        if [ ! "${FIND}" = "" ]; then
+        if [ -n "${FIND}" ]; then
             Report "journal_contains_errors=1"
             for I in ${FIND}; do
-                LINE=`echo ${I} | sed 's/:space:/ /g'`
+                LINE=$(echo ${I} | sed 's/:space:/ /g')
                 LogText "Output (fails): ${LINE}"
             done
           else
@@ -173,10 +163,10 @@
 #
     # Test        : PLGN-3816
     # Description : Journal sizing
-    if [ ! "${JOURNALCTLBINARY}" = "" -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${JOURNALCTLBINARY}" -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PLGN-3816 --preqs-met ${PREQS_MET} --weight L --network NO --description "Query journal for boot related information" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
-        FIND=`${JOURNALCTLBINARY} --disk-usage | awk '{ if ($1=="Journals") { print $4 } else if ($1=="Archived") { print $7 }}'`
+        FIND=$(${JOURNALCTLBINARY} --disk-usage | awk '{ if ($1=="Journals") { print $4 } else if ($1=="Archived") { print $7 }}')
         Report "journal_disk_size=${FIND}"
         LogText "Result: journals are ${FIND} in size"
     fi
@@ -185,10 +175,10 @@
 #
     # Test        : PLGN-3818
     # Description : Journal meta data
-    if [ ! "${JOURNALCTLBINARY}" = "" -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${JOURNALCTLBINARY}" -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PLGN-3818 --preqs-met ${PREQS_MET} --weight L --network NO --description "Query journal meta data" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
-        FIND=`${JOURNALCTLBINARY} --header | sed 's/^$/|/g' | tr '\n' ',' | sed 's/[[:space:]]//g'`
+        FIND=$(${JOURNALCTLBINARY} --header | sed 's/^$/|/g' | tr '\n' ',' | sed 's/[[:space:]]//g')
         Report "journal_meta_data=${FIND}"
     fi
 #
@@ -196,7 +186,7 @@
 #
     # Test        : PLGN-3820
     # Description : Journal FSS (Forward Secure Sealing) configuration
-    if [ ! "${JOURNALCTLBINARY}" = "" -a ! "${SYSTEMD_MACHINEID}" = "" -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${JOURNALCTLBINARY}" -a -n "${SYSTEMD_MACHINEID}" -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PLGN-3820 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check for journal FSS configuration" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
         FILE="/var/log/journal/${SYSTEMD_MACHINEID}/fss"
@@ -211,11 +201,11 @@
 #
     # Test        : PLGN-3830
     # Description : Query systemd status
-    if [ ! "${SYSTEMCTLBINARY}" = "" -a ${SYSTEMD_RUNNING} -eq 1 -a ${SYSTEMD_VERSION} -ge 215 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${SYSTEMCTLBINARY}" -a ${SYSTEMD_RUNNING} -eq 1 -a ${SYSTEMD_VERSION} -ge 215 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PLGN-3830 --preqs-met ${PREQS_MET} --weight L --network NO --description "Query systemd status" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${SYSTEMCTLBINARY} is-system-running 2> /dev/null | head -1)
-        if [ ! "${FIND}" = "" ]; then
+        if [ -n "${FIND}" ]; then
             Report "systemd_status=${FIND}"
             LogText "Result: found systemd status = ${FIND}"
         fi
@@ -228,8 +218,8 @@
     if [ ! "${SYSTEMCTLBINARY}" = "" -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PLGN-3832 --preqs-met ${PREQS_MET} --weight L --network NO --description "Query systemd status for processes which can not be found" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
-        FIND=`${SYSTEMCTLBINARY} --no-legend --all --state=not-found 2> /dev/null | awk '{ print $1 }'`
-        if [ ! "${FIND}" = "" ]; then
+        FIND=$(${SYSTEMCTLBINARY} --no-legend --all --state=not-found 2> /dev/null | awk '{ print $1 }')
+        if [ -n "${FIND}" ]; then
             for I in ${FIND}; do
                 Report "systemd_unit_not_found[]=${I}"
             done
@@ -240,11 +230,11 @@
 #
     # Test        : PLGN-3834
     # Description : Gather units from systemd which can not be found
-    if [ ! "${SYSTEMCTLBINARY}" = "" -a ! "${AWKBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${SYSTEMCTLBINARY}" -a -n "${AWKBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PLGN-3834 --preqs-met ${PREQS_MET} --weight L --network NO --description "Collect service units which can not be found in systemd" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
-        FIND=`${SYSTEMCTLBINARY} list-units -t service --all | ${AWKBINARY} '{ if ($3=="not-found") { print $2 }}'`
-        if [ ! "${FIND}" = "" ]; then
+        FIND=$(${SYSTEMCTLBINARY} list-units -t service --all | ${AWKBINARY} '{ if ($3=="not-found") { print $2 }}')
+        if [ -n "${FIND}" ]; then
             LogText "Result: found one or more services with faulty state"
             for I in ${FIND}; do
                 LogText "Result: service seems to be faulty (not-found) ${I}"
@@ -261,8 +251,8 @@
     Register --test-no PLGN-3856 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check if systemd-coredump is used" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
         SYSTEMD_COREDUMP_USED=1
-        FIND=`cat /proc/sys/kernel/core_pattern | grep systemd-coredump`
-        if [ ! "${FIND}" = "" ]; then
+        FIND=$(cat /proc/sys/kernel/core_pattern | grep systemd-coredump)
+        if [ -n "${FIND}" ]; then
             LogText "Result: systemd uses systemd-coredump to handle coredumps"
             Report "systemd_coredump_used=1"
         fi
@@ -278,11 +268,11 @@
 #
     # Test        : PLGN-3860
     # Description : Query coredumps from journalctl since Yesterday
-    if [ ! "${JOURNALCTLBINARY}" = "" -a ${SYSTEMD_COREDUMP_USED} -eq 1 -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    if [ -n "${JOURNALCTLBINARY}" -a ${SYSTEMD_COREDUMP_USED} -eq 1 -a ${SYSTEMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PLGN-3860 --preqs-met ${PREQS_MET} --weight L --network NO --description "Query coredumps from journals since Yesterday" --progress
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${JOURNALCTLBINARY} SYSLOG_IDENTIFIER=systemd-coredump --since=yesterday -o cat 2> /dev/null)
-        if [ ! "${FIND}" = "" ]; then
+        if [ -n "${FIND}" ]; then
             Report "journal_coredumps_lastday=1"
             LogText "Result: found recent coredumps"
         else

From 4e35b91ab2de333a8b9027a564a8f3a2f59cf743 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 23 Mar 2020 12:50:31 +0100
Subject: [PATCH 512/679] Updated log

---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 84f15898..639e23e1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -46,7 +46,8 @@ Using the relevant options, the scan will change base on the intended goal.
 - New option: --usecwd - run from the current working directory
 - New profile option: disable-plugin - disables a single plugin
 - New profile option: ssl-certificate-paths-to-ignore - ignore a path
-- New test: BOOT-5109 - Test presence rEFInd boot loader
+- New test: AUTH-9229 - check used password hashing methods
+- New test: BOOT-5109 - test presence rEFInd boot loader
 - New test: CRYP-7930 - test for LUKS encryption
 - New test: CRYP-8004 - presence of hardware random number generator
 - New test: CRYP-8005 - presence of software random number generator

From 17bbaa8f7a54b30fdda8cf367593964a31ddcda6 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 23 Mar 2020 13:19:10 +0100
Subject: [PATCH 513/679] [AUTH-9229] make test only available for root

---
 include/tests_authentication | 80 ++++++++++++++++++------------------
 1 file changed, 41 insertions(+), 39 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 0cc831ad..d8efe6e2 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -329,50 +329,52 @@
     # Test        : AUTH-9229
     # Description : Check password hashing methods vs. recommendations in crypt(5)
     # Notes       : Applicable to all Unix-like OS
-    Register --test-no AUTH-9229 --weight L --network NO --category security --description "Check password hashing methods"
+    #               Requires read access to /etc/shadow (if it exists)
+    Register --test-no AUTH-9229 --root-only YES --weight L --network NO --category security --description "Check password hashing methods"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking password hashing methods"
-	if [ -e ${ROOTDIR}etc/shadow ]; then SHADOW=${ROOTDIR}etc/shadow; else SHADOW=""; fi
-	FIND=$(${CAT_BINARY} ${ROOTDIR}etc/passwd ${SHADOW} | ${AWKBINARY} -F : '{print length($2) ":" $2 }' | while read METHOD; do
-	    case ${METHOD} in
-		1:\* | 1:x | 0: | *:!*)
-		    # disabled | shadowed | no password | locked account
-		    ;;
-		*:\$5\$*| *:\$6\$*)
-		    # sha256crypt | sha512crypt: check number of rounds, should be >5000
-		    ROUNDS=$(echo "${METHOD}" | sed -n 's/.*rounds=\([0-9]*\)\$.*/\1/gp')
-		    if [ -z "${ROUNDS}" ]; then
-		        echo 'sha256crypt/sha512crypt(default<=5000rounds)'
-		    elif [ "${ROUNDS}" -le 5000 ]; then
-		        echo 'sha256crypt/sha512crypt(<=5000rounds)'
-		    fi
-		    ;;
-		*:\$y\$* | *:\$gy\$* | *:\$2b\$* | *:\$7\$*)
-		    # yescrypt | gost-yescrypt | bcrypt | scrypt
-		    ;;
-		*:_*)
-		    echo bsdicrypt
-		    ;;
-		*:\$1\$*)
-		    echo md5crypt
-		    ;;
-		*:\$3\$*)
-		    echo NT
-		    ;;
-		*:\$md5*)
-		    echo SunMD5
-		    ;;
-		*:\$sha1*)
-		    echo sha1crypt
-		    ;;
-		13:* | 178:*)
-		    echo bigcrypt/descrypt
-		    ;;
+        SHADOW="";
+        if [ -e ${ROOTDIR}etc/shadow ]; then SHADOW="${ROOTDIR}etc/shadow"; fi
+        FIND=$(${CAT_BINARY} ${ROOTDIR}etc/passwd ${SHADOW} | ${AWKBINARY} -F : '{print length($2) ":" $2 }' | while read METHOD; do
+            case ${METHOD} in
+                1:\* | 1:x | 0: | *:!*)
+                    # disabled | shadowed | no password | locked account
+                    ;;
+                *:\$5\$*| *:\$6\$*)
+                    # sha256crypt | sha512crypt: check number of rounds, should be >5000
+                    ROUNDS=$(echo "${METHOD}" | sed -n 's/.*rounds=\([0-9]*\)\$.*/\1/gp')
+                    if [ -z "${ROUNDS}" ]; then
+                        echo 'sha256crypt/sha512crypt(default<=5000rounds)'
+                    elif [ "${ROUNDS}" -le 5000 ]; then
+                        echo 'sha256crypt/sha512crypt(<=5000rounds)'
+                    fi
+                    ;;
+                *:\$y\$* | *:\$gy\$* | *:\$2b\$* | *:\$7\$*)
+                    # yescrypt | gost-yescrypt | bcrypt | scrypt
+                    ;;
+                *:_*)
+                    echo bsdicrypt
+                    ;;
+                *:\$1\$*)
+                    echo md5crypt
+                    ;;
+                *:\$3\$*)
+                    echo NT
+                    ;;
+                *:\$md5*)
+                    echo SunMD5
+                    ;;
+                *:\$sha1*)
+                    echo sha1crypt
+                    ;;
+                13:* | 178:*)
+                    echo bigcrypt/descrypt
+                    ;;
                 *)
                     echo "Unknown password hashing method ${METHOD}. Please report to lynis-dev@cisofy.com"
                     ;;
-	    esac
-	done | ${SORTBINARY} --unique | ${TRBINARY} '\n' ' ')
+            esac
+        done | ${SORTBINARY} --unique | ${TRBINARY} '\n' ' ')
         if [ -z "${FIND}" ]; then
             Display --indent 2 --text "- Password hashing methods" --result "${STATUS_OK}" --color GREEN
             LogText "Result: no poor password hashing methods found"

From 08f57c557d78f580e19971c6a7f99a5a99b00bf9 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 23 Mar 2020 13:20:41 +0100
Subject: [PATCH 514/679] Updated log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 639e23e1..86959483 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -53,6 +53,8 @@ Using the relevant options, the scan will change base on the intended goal.
 - New test: CRYP-8005 - presence of software random number generator
 - New test: DBS-1828  - PostgreSQL configuration files
 - New test: FINT-4316 - presence of AIDE database and size test
+- New test: FINT-4340 - check dm-integrity status (Linux)
+- New test: FINT-4341 - verify status of dm-verity (Linux)
 - New test: INSE-8314 - test for NIS client
 - New test: INSE-8316 - test for NIS server
 - New test: NETW-2706 - check DNSSEC (systemd)

From 7d1fe1231a564a30f5a926b5eadb38dc3e22de86 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 23 Mar 2020 14:29:47 +0100
Subject: [PATCH 515/679] [CRYP-8005] added haveged, match against process name
 instead of full command line, code cleanup

---
 include/tests_crypto | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/include/tests_crypto b/include/tests_crypto
index 5c2a0804..09507aac 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -229,13 +229,13 @@
     Register --test-no CRYP-8005 --os Linux --weight L --network NO --root-only NO --category security --description "Presence of software pseudo random number generators"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: looking for software pseudo random number generators"
-	FOUND=""
-	for SERVICE in audio-entropyd havegd jitterentropy-rngd; do
-            if IsRunning "${SERVICE}" --full; then
-		FOUND="${FOUND} ${SERVICE}"
-	    fi
-	done
-	if [ -z "${FOUND}" ]; then
+        FOUND=""
+        for SERVICE in audio-entropyd havegd haveged jitterentropy-rngd; do
+            if IsRunning "${SERVICE}"; then
+                FOUND="${FOUND} ${SERVICE}"
+            fi
+        done
+        if [ -z "${FOUND}" ]; then
             Display --indent 2 --text "- SW prng" --result "${STATUS_NO}" --color YELLOW
             ReportSuggestion "${TEST_NO}" "Utilize software pseudo random number generators"
         else

From 1e74f9be9a0c010ea63b7b0dd7d59d9933eb06c1 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 23 Mar 2020 15:55:40 +0100
Subject: [PATCH 516/679] Fixed 'lynis show details' output

---
 include/helper_show | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/helper_show b/include/helper_show
index b78da175..e251aad0 100644
--- a/include/helper_show
+++ b/include/helper_show
@@ -245,7 +245,7 @@ if [ $# -gt 0 ]; then
                 shift
                 if [ $# -eq 1 ]; then
                     TESTID="$1"
-                    awk -v search="Performing test ID $TESTID" '$0 ~ search {++f;p=1}p&&f==1;/===---/{p=0}' ${LOGFILE}
+                    awk -v search="Performing test ID $TESTID" '$0 ~ search {++f;p=1}p&&f==1;/====/{p=0}' ${LOGFILE}
                 fi
             fi
             ;;

From 7bba7bd4af22a959a1a058e76bb4689f748491a6 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 23 Mar 2020 16:13:39 +0100
Subject: [PATCH 517/679] Removed incorrect process name from list, enable
 --full as it is required for matching jitterentropy-rngd

---
 include/tests_crypto | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/tests_crypto b/include/tests_crypto
index 09507aac..466f6b52 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -230,8 +230,9 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: looking for software pseudo random number generators"
         FOUND=""
-        for SERVICE in audio-entropyd havegd haveged jitterentropy-rngd; do
-            if IsRunning "${SERVICE}"; then
+        for SERVICE in audio-entropyd haveged jitterentropy-rngd; do
+            # Using --full as jitterentropy-rngd would otherwise not match
+            if IsRunning --full "${SERVICE}"; then
                 FOUND="${FOUND} ${SERVICE}"
             fi
         done

From 8913374092acf285b492abcffde3d97406ec88f1 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Thu, 19 Mar 2020 22:40:54 +0200
Subject: [PATCH 518/679] Run 'systemd-analyze security'

'systemd-analyze security' (available since systemd v240) makes a nice
overall evaluation of hardening levels of services in a system. More
details can be found with 'systemd-analyze security SERVICE' for each
service.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 CHANGELOG.md                |  1 +
 db/tests.db                 |  1 +
 include/binaries            |  1 +
 include/tests_boot_services | 38 +++++++++++++++++++++++++++++++++++++
 4 files changed, 41 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 86959483..3ca72710 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -48,6 +48,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - New profile option: ssl-certificate-paths-to-ignore - ignore a path
 - New test: AUTH-9229 - check used password hashing methods
 - New test: BOOT-5109 - test presence rEFInd boot loader
+- New test: BOOT-5264 - run systemd-analyze security
 - New test: CRYP-7930 - test for LUKS encryption
 - New test: CRYP-8004 - presence of hardware random number generator
 - New test: CRYP-8005 - presence of software random number generator
diff --git a/db/tests.db b/db/tests.db
index 79cfe6ce..34af6fdd 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -78,6 +78,7 @@ BOOT-5260:test:security:boot_services::Check single user mode for systemd:
 BOOT-5261:test:security:boot_services:DragonFly:Check for DragonFly boot loader presence:
 BOOT-5262:test:security:boot_services:OpenBSD:Check for OpenBSD boot daemons:
 BOOT-5263:test:security:boot_services:OpenBSD:Check permissions for boot files/scripts:
+BOOT-5264:test:security:boot_services:Linux:Run systemd-analyze security:
 CONT-8004:test:security:containers:Solaris:Query running Solaris zones:
 CONT-8102:test:security:containers::Checking Docker status and information:
 CONT-8104:test:security:containers::Checking Docker info for any warnings:
diff --git a/include/binaries b/include/binaries
index 2327368e..8b754146 100644
--- a/include/binaries
+++ b/include/binaries
@@ -274,6 +274,7 @@
                             sysctl)                 SYSCTLBINARY="${BINARY}";          LogText "  Found known binary: sysctl (kernel parameters) - ${BINARY}" ;;
                             syslog-ng)              SYSLOGNGBINARY="${BINARY}";        SYSLOGNGVERSION=$(${BINARY} -V 2>&1 | grep "^syslog-ng" | awk '{ print $2 }'); LogText "Found ${BINARY} (version ${SYSLOGNGVERSION})" ;;
                             systemctl)              SYSTEMCTLBINARY="${BINARY}";       LogText "  Found known binary: systemctl (client to systemd) - ${BINARY}" ;;
+                            systemd-analyze)        SYSTEMDANALYZEBINARY="${BINARY}";  LogText "  Found known binary: systemd-analyze (systemd service analysis tool) - ${BINARY}" ;;
                             tail)                   TAILBINARY="${BINARY}";            LogText "  Found known binary: tail (text filter) - ${BINARY}" ;;
                             timedatectl)            TIMEDATECTL="${BINARY}";           LogText "  Found known binary: timedatectl (timedate client) - ${BINARY}" ;;
                             tomoyo-init)            TOMOYOINITBINARY=${BINARY};        LogText "  Found known binary: tomoyo-init (tomoyo component) - ${BINARY}" ;;
diff --git a/include/tests_boot_services b/include/tests_boot_services
index f280cb86..8ad83d7c 100644
--- a/include/tests_boot_services
+++ b/include/tests_boot_services
@@ -986,6 +986,44 @@
     fi
 #
 #################################################################################
+#
+    # Test        : BOOT-5264
+    # Description : Run systemd-analyze security
+    if [ -z "${SYSTEMDANALYZEBINARY}" ]; then SKIPREASON="systemd-analyze not available"; PREQS_MET="NO";
+    else
+        SYSTEMD_VERSION=$("${SYSTEMDANALYZEBINARY}" --version | ${AWKBINARY} '/^systemd / {print $2}')
+        if [ "${SYSTEMD_VERSION}" -ge 240 ]; then PREQS_MET="YES"; else SKIPREASON="systemd-analyze too old (v${SYSTEMD_VERSION}), need at least v240"; PREQS_MET="NO"; fi
+    fi
+    Register --test-no BOOT-5264 --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --os Linux --weight L --network NO --category security --description "Run systemd-analyze security"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: Run systemd-analyze security"
+        Display --indent 2 --text "- Running 'systemd-analyze security'"
+        ${SYSTEMDANALYZEBINARY} security | while read UNIT EXPOSURE PREDICATE HAPPY; do
+            if [ "${UNIT}" = "UNIT" ]; then
+                continue
+            fi
+            COLOR="BLACK"
+            case ${PREDICATE} in
+                PERFECT | SAFE | OK)
+                    COLOR=GREEN
+                ;;
+                MEDIUM)
+                    COLOR=WHITE
+                ;;
+                EXPOSED)
+                    COLOR=YELLOW
+                ;;
+                UNSAFE | DANGEROUS)
+                    COLOR=RED
+                ;;
+            esac
+            Display --indent 8 --text "- ${UNIT}:" --result "${PREDICATE}" --color "${COLOR}"
+            LogText "Result: ${UNIT}: ${EXPOSURE} ${PREDICATE}"
+        done
+        ReportSuggestion "${TEST_NO}" "Consider hardening system services" "Run '${SYSTEMDANALYZEBINARY} security SERVICE' for each service"
+    fi
+#
+#################################################################################
 #
 
 Report "boot_loader=${BOOT_LOADER}"

From 0da82a18cbf05bd990016e7f0ab94694a54e5a69 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Thu, 19 Mar 2020 20:31:47 +0200
Subject: [PATCH 519/679] FS module tests: check if modules are blacklisted

Check if FS modules are blacklisted.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 include/tests_filesystems | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/tests_filesystems b/include/tests_filesystems
index 502e4227..0d528a0d 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -792,6 +792,12 @@
                     AddHP 3 3
                     if IsDebug; then Display --indent 6 --text "- Module ${FS} not present in the kernel" --result OK --color GREEN; fi
                 fi
+                FIND1=$(${EGREPBINARY} "blacklist ${FS}" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#")
+                FIND2=$(${EGREPBINARY} "install ${FS} /bin/true" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#")
+                if [ -n "${FIND1}" ] || [ -n "${FIND2}" ]; then
+                    Display --indent 4 --text "- Module $FS is blacklisted" --result "OK" --color GREEN
+                    LogText "Result: module ${FS} is blacklisted"
+                fi
             done
             if [ ${FOUND} -eq 1 ]; then
                 Display --indent 4 --text "- Discovered kernel modules: ${AVAILABLE_MODPROBE_FS}"

From e09fe98b893dc69ac5fad65829c8b0c52f232f98 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Mon, 23 Mar 2020 18:41:58 +0200
Subject: [PATCH 520/679] Enhance TOMOYO Linux check

Count and log unconfined processes, which are not using policy
profile 3.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 include/binaries             | 1 +
 include/tests_mac_frameworks | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/include/binaries b/include/binaries
index 2327368e..4e0cda05 100644
--- a/include/binaries
+++ b/include/binaries
@@ -277,6 +277,7 @@
                             tail)                   TAILBINARY="${BINARY}";            LogText "  Found known binary: tail (text filter) - ${BINARY}" ;;
                             timedatectl)            TIMEDATECTL="${BINARY}";           LogText "  Found known binary: timedatectl (timedate client) - ${BINARY}" ;;
                             tomoyo-init)            TOMOYOINITBINARY=${BINARY};        LogText "  Found known binary: tomoyo-init (tomoyo component) - ${BINARY}" ;;
+                            tomoyo-pstree)          TOMOYOPSTREEBINARY=${BINARY};      LogText "  Found known binary: tomoyo-pstree (tomoyo process tree) - ${BINARY}" ;;
                             tr)                     TRBINARY="${BINARY}";              LogText "  Found known binary: tr (text transformation) - ${BINARY}" ;;
                             tripwire)               TRIPWIREBINARY="${BINARY}";        LogText "  Found known binary: tripwire (file integrity) - ${BINARY}" ;;
                             tune2fs)                TUNE2FSBINARY="${BINARY}";         LogText "  Found known binary: tune2fs (file system tool) - ${BINARY}" ;;
diff --git a/include/tests_mac_frameworks b/include/tests_mac_frameworks
index 94f2065d..3f23c77e 100644
--- a/include/tests_mac_frameworks
+++ b/include/tests_mac_frameworks
@@ -206,6 +206,13 @@
             LogText "Result: TOMOYO Linux is enabled"
             Display --indent 4 --text "- Checking TOMOYO Linux status" --result "${STATUS_ENABLED}" --color GREEN
             Report "tomoyo_enabled=1"
+            if [ ! -z ${TOMOYOPSTREEBINARY} ]; then
+                NUNCONFINED=$(${TOMOYOPSTREEBINARY} | ${GREPBINARY} -v '^  3 ' | ${WCBINARY} --lines)
+                Display --indent 8 --text "Found ${NUNCONFINED} unconfined (not profile 3) processes"
+                for PROCESS in $(${TOMOYOPSTREEBINARY} | ${GREPBINARY} -v '^  3 ' | ${SEDBINARY} -e 's/+-//g' -e 's/^ *//g' -e 's/ \+/:/g' | ${SORTBINARY}); do
+                    LogText "Result: Unconfined process: ${PROCESS}"
+                done
+            fi
             AddHP 3 3
         else
             LogText "Result: TOMOYO Linux is disabled"

From 6818db5e127e732db432a119c9894c663995ed5e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
 <konstruktoid@users.noreply.github.com>
Date: Tue, 24 Mar 2020 11:43:34 +0100
Subject: [PATCH 521/679] add AUTH-9230
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
 db/tests.db | 1 +
 1 file changed, 1 insertion(+)

diff --git a/db/tests.db b/db/tests.db
index 79cfe6ce..220d76e1 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -23,6 +23,7 @@ AUTH-9222:test:security:authentication::Check for non unique groups:
 AUTH-9226:test:security:authentication::Check non unique group names:
 AUTH-9228:test:security:authentication::Check password file consistency with pwck:
 AUTH-9229:test:security:authentication::Check password hashing methods:
+AUTH-9230:test:security:authentication::Check group password hashing rounds:
 AUTH-9234:test:security:authentication::Query user accounts:
 AUTH-9240:test:security:authentication::Query NIS+ authentication support:
 AUTH-9242:test:security:authentication::Query NIS authentication support:

From 5341fa7b29dbd32db32a11934d1b2eef3c022d72 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
 <konstruktoid@users.noreply.github.com>
Date: Tue, 24 Mar 2020 11:44:14 +0100
Subject: [PATCH 522/679] AUTH-9229 isnt related to login.defs, add AUTH-9230
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
 include/tests_authentication | 52 +++++++++++++++++++++++++++++++++++-
 1 file changed, 51 insertions(+), 1 deletion(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index d8efe6e2..c5c71eee 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -382,12 +382,62 @@
         else
             Display --indent 2 --text "- Password hashing methods" --result "${STATUS_SUGGESTION}" --color YELLOW
             LogText "Result: poor password hashing methods found: ${FIND}"
-            ReportSuggestion "${TEST_NO}" "Change ${ROOTDIR}etc/login.defs password ENCRYPT_METHOD and SHA_CRYPT_MIN_ROUNDS to more secure values, check also PAM configuration, expire passwords to encrypt with new values"
+            ReportSuggestion "${TEST_NO}" "Check PAM configuration, add rounds if applicable and expire passwords to encrypt with new values"
             AddHP 0 2
         fi
     fi
 #
 #################################################################################
+#
+    # Test        : AUTH-9230
+    # Description : Check group password hashing rounds in login.defs
+    # Notes       : Applicable to all Unix-like OS
+    PREQS_MET="NO"
+    if [ -f ${ROOTDIR}etc/login.defs ]; then
+        PREQS_MET="YES"
+    fi
+    Register --test-no AUTH-9230 --root-only NO --weight L --network NO --category security --description "Check group password hashing rounds"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        LogText "Test: Checking SHA_CRYPT_MIN_ROUNDS option in ${ROOTDIR}etc/login.defs"
+        FIND=$(${GREPBINARY} "^SHA_CRYPT_MIN_ROUNDS" ${ROOTDIR}etc/login.defs | ${AWKBINARY} '{ if ($1=="SHA_CRYPT_MIN_ROUNDS") { print $2 } }')
+        if [ -z "${FIND}" -o "${FIND}" = "0" ]; then
+            LogText "Result: number of minimum rounds used by the encryption algorithm is not configured"
+            Display --indent 2 --text "- Checking minimum group password hashing rounds" --result "${STATUS_DISABLED}" --color YELLOW
+            ReportSuggestion "${TEST_NO}" "Configure minimum encryption algorithm rounds in /etc/login.defs"
+            AddHP 0 2
+        elif [ "${FIND}" -lt 5000 ]; then
+            LogText "Result: low number of minimum encryption algorithm rounds found: ${FIND}"
+            PASSWORD_MINIMUM_ROUNDS=${FIND}
+            Display --indent 2 --text "- Group password hashing rounds (minimum)"  --result "${STATUS_SUGGESTION}" --color YELLOW
+            AddHP 1 2
+  else
+            LogText "Result: number of encryption algorithm rounds is ${FIND}"
+            PASSWORD_MINIMUM_ROUNDS=${FIND}
+            Display --indent 2 --text "- Group password hashing rounds (minimum)" --result CONFIGURED --color GREEN
+            AddHP 2 2
+        fi
+
+        LogText "Test: Checking SHA_CRYPT_MAX_ROUNDS option in ${ROOTDIR}etc/login.defs"
+        FIND=$(${GREPBINARY} "^SHA_CRYPT_MAX_ROUNDS" ${ROOTDIR}etc/login.defs | ${AWKBINARY} '{ if ($1=="SHA_CRYPT_MAX_ROUNDS") { print $2 } }')
+        if [ -z "${FIND}" -o "${FIND}" = "0" ]; then
+            LogText "Result: number of maximum rounds used by the encryption algorithm is not configured"
+            Display --indent 2 --text "- Checking maximum group password hashing rounds" --result "${STATUS_DISABLED}" --color YELLOW
+            ReportSuggestion "${TEST_NO}" "Configure maximum encryption algorithm rounds in /etc/login.defs"
+            AddHP 0 2
+        elif [ "${FIND}" -lt 10000 ]; then
+            LogText "Result: low number of maximum encryption algorithm rounds found: ${FIND}"
+            PASSWORD_MINIMUM_ROUNDS=${FIND}
+            Display --indent 2 --text "- Group password hashing rounds (maximum)"  --result "${STATUS_SUGGESTION}" --color YELLOW
+            AddHP 1 2
+        else
+            LogText "Result: number of encryption algorithm rounds is ${FIND}"
+            PASSWORD_MINIMUM_ROUNDS=${FIND}
+            Display --indent 2 --text "- Group password hashing rounds (maximum)" --result CONFIGURED --color GREEN
+            AddHP 2 2
+        fi
+    fi
+#
+#################################################################################
 #
     # Test        : AUTH-9234
     # Description : Query user accounts

From 0b9e2d85d6a593bc4f71565d9756d129a1859e27 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
 <konstruktoid@users.noreply.github.com>
Date: Tue, 24 Mar 2020 11:44:54 +0100
Subject: [PATCH 523/679] fix tabs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
 include/tests_authentication | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index c5c71eee..c3c072f5 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -488,15 +488,15 @@
 
             "NetBSD"|"OpenBSD")
                 if [ -f ${ROOTDIR}etc/usermgmt.conf ]; then
-			UID_RANGE=$(${GREPBINARY} "^range" ${ROOTDIR}etc/usermgmt.conf | ${AWKBINARY} '{ sub(/\.\./, "-", $2); print $2 }')
+                    UID_RANGE=$(${GREPBINARY} "^range" ${ROOTDIR}etc/usermgmt.conf | ${AWKBINARY} '{ sub(/\.\./, "-", $2); print $2 }')
                 fi
-		if [ -n "${UID_RANGE}" ]; then
+                if [ -n "${UID_RANGE}" ]; then
                     LogText "Result: found configured user id range specified: ${UID_RANGE}"
                     UID_MIN=$(echo $UID_RANGE | ${AWKBINARY} -F- '{ print $1 }')
                     UID_MAX=$(echo $UID_RANGE | ${AWKBINARY} -F- '{ print $2 }')
                 else
                     UID_MIN=1000
-		    UID_MAX=60000
+                    UID_MAX=60000
                     LogText "Result: no configured user id range specified; using default ${UID_MIN}-${UID_MAX}"
                 fi
                 LogText "${OS} real users output (ID = 0, or ${UID_MIN}-${UID_MAX}, but not 32767):"

From bc09f921f0a8d28f2ff19df8c359f5be71c064f5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
 <konstruktoid@users.noreply.github.com>
Date: Tue, 24 Mar 2020 11:53:50 +0100
Subject: [PATCH 524/679] fix indentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
 include/tests_authentication | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index c3c072f5..ce821fba 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -410,7 +410,7 @@
             PASSWORD_MINIMUM_ROUNDS=${FIND}
             Display --indent 2 --text "- Group password hashing rounds (minimum)"  --result "${STATUS_SUGGESTION}" --color YELLOW
             AddHP 1 2
-  else
+        else
             LogText "Result: number of encryption algorithm rounds is ${FIND}"
             PASSWORD_MINIMUM_ROUNDS=${FIND}
             Display --indent 2 --text "- Group password hashing rounds (minimum)" --result CONFIGURED --color GREEN

From 1d9a8874061f03a8838b05d630c4a2ee48aeb86a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 24 Mar 2020 13:25:22 +0100
Subject: [PATCH 525/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3ca72710..ffd31b5e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -47,6 +47,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - New profile option: disable-plugin - disables a single plugin
 - New profile option: ssl-certificate-paths-to-ignore - ignore a path
 - New test: AUTH-9229 - check used password hashing methods
+- New test: AUTH-9230 - check group password hashing rounds
 - New test: BOOT-5109 - test presence rEFInd boot loader
 - New test: BOOT-5264 - run systemd-analyze security
 - New test: CRYP-7930 - test for LUKS encryption

From 5e821687af6025980d9a94f5520b8bf849bcd0dc Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 24 Mar 2020 13:33:24 +0100
Subject: [PATCH 526/679] Added new tests

---
 CHANGELOG.md | 3 +++
 db/tests.db  | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ffd31b5e..9342a4f5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -62,6 +62,9 @@ Using the relevant options, the scan will change base on the intended goal.
 - New test: NETW-2706 - check DNSSEC (systemd)
 - New test: NETW-3200 - determine avilable network protocols
 - New test: PROC-3802 - check presence of prelink tooling
+- New test: TIME-3180 - report if ntpctl cannot communicate with OpenNTPD
+- New test: TIME-3181 - check status of OpenNTPD time synchronisation
+- New test: TIME-3182 - check OpenNTPD has working peers
 - New report key: openssh_daemon_running
 - New command: lynis generate systemd-units
 - Sending USR1 signal to Lynis process will show active status
diff --git a/db/tests.db b/db/tests.db
index 43a48c12..d401424c 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -413,6 +413,9 @@ TIME-3136:test:security:time:Linux:Check NTP protocol version:
 TIME-3148:test:performance:time:Linux:Check TZ variable:
 TIME-3160:test:security:time:Linux:Check empty NTP step-tickers:
 TIME-3170:test:security:time::Check configuration files:
+TIME-3180:test:security:time::Report if ntpctl cannot communicate with OpenNTPD:
+TIME-3181:test:security:time::Check status of OpenNTPD time synchronisation
+TIME-3182:test:security:time::Check OpenNTPD has working peers
 TOOL-5002:test:security:tooling::Checking for automation tools:
 TOOL-5102:test:security:tooling::Check for presence of Fail2ban:
 TOOL-5104:test:security:tooling::Enabled tests for Fail2ban:

From 339e0c3207f5c4064bc9efa8172c6606779b6ec9 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Wed, 25 Mar 2020 09:18:16 +0200
Subject: [PATCH 527/679] [FILE-6374]: Summarize unhardened file system

Report total numbers of unhardened filesystems.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 include/tests_filesystems | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/include/tests_filesystems b/include/tests_filesystems
index 70efd2cc..38b4c0d0 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -628,6 +628,13 @@
                 fi
             done
         fi
+        NMOUNTS=$(mount | ${WCBINARY} --lines)
+        NDEVMOUNTS=$(mount | ${AWKBINARY} '{print $6}' | ${GREPBINARY} -v nodev | ${WCBINARY} --lines)
+        NEXECMOUNTS=$(mount | ${AWKBINARY} '{print $6}' | ${GREPBINARY} -v noexec | ${WCBINARY} --lines)
+        NSUIDMOUNTS=$(mount | ${AWKBINARY} '{print $6}' | ${GREPBINARY} -v nosuid | ${WCBINARY} --lines)
+        NWRITEANDEXECMOUNTS=$(mount | ${AWKBINARY} '{print $6}' | ${GREPBINARY} -v noexec | ${EGREPBINARY} -v '^\(ro[,)]' | ${WCBINARY} --lines)
+        LogText "Result: Total without nodev:${NDEVMOUNTS} noexec:${NEXECMOUNTS} nosuid:${NSUIDMOUNTS} ro or noexec (W^X): ${NWRITEANDEXECMOUNTS}, of total ${NMOUNTS}"
+        Display --indent 2 --text "- Total without nodev:${NDEVMOUNTS} noexec:${NEXECMOUNTS} nosuid:${NSUIDMOUNTS} ro or noexec (W^X): ${NWRITEANDEXECMOUNTS} of total ${NMOUNTS}"
     fi
 #
 #################################################################################

From f644927a4209cf2caf27c6a8152c9bf6c610676c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 25 Mar 2020 10:11:25 +0100
Subject: [PATCH 528/679] Improved warning message with 'how to resolve'

---
 include/profiles | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/include/profiles b/include/profiles
index 767f3b79..5b940150 100644
--- a/include/profiles
+++ b/include/profiles
@@ -39,10 +39,19 @@
         if ! IsEmpty "${DATA}"; then FOUND=1; fi
 
         if [ ${FOUND} -eq 1 ]; then
+            Display --text " "
+            Display --text "=================================================================================================="
             DisplayWarning "Your profile contains old-style configuration entries. See log file for more details and how to convert these entries"
-            LogText "Your profile has one or more configuration items that are in an old format (lines starting with key:value). They need to be converted into the new format (key=value)."
-            LogText "Tip: Use grep to see the relevant matches (grep -E \"^[a-z-]{1,}:\" custom.prf)"
-            sleep 30
+            Display --indent 2 --text "* ${RED}ISSUE${NORMAL}"
+            Display --indent 2 --text "Your profile has one or more lines that are in an old format (key:value). They need to be converted into the new format (key=value) or disabled."
+            Display --text " "
+            Display --indent 2 --text "* ${GREEN}HOW TO RESOLVE${NORMAL}"
+            Display --indent 2 --text "Use grep to see the relevant matches (grep -E \"^[a-z-]{1,}:\" custom.prf)"
+            Display --text " "
+            Display --text "=================================================================================================="
+            Display --text " "
+            ReportWarning "GEN-0020" "Your profile contains one or more old-style configuration entries"
+            sleep 10
         fi
 
         # Security check for unexpected and possibly harmful escape characters (hyphen should be listed as first or last character)

From 9b978a3581a0fed053c33b8ef1b4877d261cb1ce Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 25 Mar 2020 15:03:21 +0100
Subject: [PATCH 529/679] Add specific control ID for warnings regarding usage
 of deprecated options

---
 include/profiles | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/profiles b/include/profiles
index 5b940150..328d4d49 100644
--- a/include/profiles
+++ b/include/profiles
@@ -541,7 +541,7 @@
 #################################################################################
 #
     if [ -n "${DEPRECATED_OPTION}" ]; then
-        ReportWarning "LYNIS" "One or more deprecated options used" "${DEPRECATED_OPTION}" "Update your profile"
+        ReportWarning "GEN-0030" "One or more deprecated options used in profile" "${DEPRECATED_OPTION}" "Update your profile"
     fi
 #
 #################################################################################

From 04c969752a9a309f681e5da6ac2757488f3c39ff Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 25 Mar 2020 15:15:42 +0100
Subject: [PATCH 530/679] [NETW-3200] corrected test

---
 include/tests_networking | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/include/tests_networking b/include/tests_networking
index 7c288000..c19505c1 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -669,37 +669,39 @@
     Register --test-no NETW-3200 --weight L --network YES --category security --description "Determine available network protocols"
     if [ ${SKIPTEST} -eq 0 ]; then
         TESTED=0
+        FOUND_UNCOMMON_PROTOCOL_ENABLED=0
         case ${OS} in
             Linux)
                 TESTED=1
                 LogText "Test: checking the status of some network protocols that typically are not used"
                 UNCOMMON_PROTOCOLS="dccp sctp rds tipc"
                 for P in ${UNCOMMON_PROTOCOLS}; do
+                    LogText "Test: now checking module '${P}'"
                     if ! SkipAtomicTest "${TEST_NO}:${P}"; then
-                        FOUND_UNCOMMON_PROTOCOL=0
+                        UNCOMMON_PROTOCOL_DISABLED=0
+                        # First check modprobe.conf
                         if [ -f ${ROOTDIR}etc/modprobe.conf ]; then
                             DATA=$(${GREPBINARY} "^install ${P} /bin/true" ${ROOTDIR}etc/modprobe.conf)
                             if [ -n "${DATA}" ]; then
-                                LogText "Result: found ${P} module loaded via modprobe.conf"
-                                FOUND_UNCOMMON_PROTOCOL=1
+                                LogText "Result: found ${P} module disabled via modprobe.conf"
+                                UNCOMMON_PROTOCOL_DISABLED=1
                             fi
                         fi
+                        # Then additional modprobe configuration files
                         if [ -d ${ROOTDIR}etc/modprobe.d ]; then
                             DATA=$(${GREPBINARY} --files-with-matches --no-messages "^install ${P} /bin/true" ${ROOTDIR}etc/modprobe.d/*)
                             if [ -n "${DATA}" ]; then
-                                FOUND_UNCOMMON_PROTOCOL=1
+                                UNCOMMON_PROTOCOL_DISABLED=1
                                 for F in ${DATA}; do
-                                    LogText "Result: found ${P} module loaded via ${F}"
+                                    LogText "Result: found ${P} module disabled via ${F}"
                                 done
                             fi
                         fi
 
-                        # Although a protocol may not been enabled using install, it can be loaded. This may be revealed using /proc
-                        #/proc/sys/net/
-
-                        if [ ${FOUND_UNCOMMON_PROTOCOL} -eq 1 ]; then
-                            ReportSuggestion "${TEST_NO}" "Determine if network protocol ${P} needs to be used on this system"
+                        if [ ${UNCOMMON_PROTOCOL_DISABLED} -eq 0 ]; then
+                            ReportSuggestion "${TEST_NO}" "Determine if protocol '${P}' is really needed on this system"
                             Report "uncommon_network_protocol_enabled=${P}"
+                            FOUND_UNCOMMON_PROTOCOL_ENABLED=1
                         fi
                     fi
                 done
@@ -711,7 +713,7 @@
             ;;
         esac
         if [ ${TESTED} -eq 1 ]; then
-            if [ ${FOUND_UNCOMMON_PROTOCOL} -eq 1 ]; then
+            if [ ${FOUND_UNCOMMON_PROTOCOL_ENABLED} -eq 1 ]; then
                 Display --indent 2 --text "- Uncommon network protocols" --result "${FOUND}" --color YELLOW
             else
                 Display --indent 2 --text "- Uncommon network protocols" --result "${STATUS_NOT_FOUND}" --color GREEN

From 1e52ed0c0d948c9cfe231959648090b5c49e9fa4 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 25 Mar 2020 15:19:21 +0100
Subject: [PATCH 531/679] Added notes to NETW-3200 for future extending this
 test

---
 include/tests_networking | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/tests_networking b/include/tests_networking
index c19505c1..b182f605 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -666,6 +666,8 @@
 #
     # Test        : NETW-3200
     # Description : Determine available network protocols
+    # Notes       : See all available supported modules: ls -d /lib/modules/$(uname -r )/kernel/net
+    #               To see active/enabled protocols: ls -d /proc/sys/net
     Register --test-no NETW-3200 --weight L --network YES --category security --description "Determine available network protocols"
     if [ ${SKIPTEST} -eq 0 ]; then
         TESTED=0

From daa9c42ec083c7d05a8ecb569c2cb06c1dbd70a4 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 25 Mar 2020 15:19:30 +0100
Subject: [PATCH 532/679] Updated log

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9342a4f5..340f597f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -60,7 +60,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - New test: INSE-8314 - test for NIS client
 - New test: INSE-8316 - test for NIS server
 - New test: NETW-2706 - check DNSSEC (systemd)
-- New test: NETW-3200 - determine avilable network protocols
+- New test: NETW-3200 - determine enabled network protocols
 - New test: PROC-3802 - check presence of prelink tooling
 - New test: TIME-3180 - report if ntpctl cannot communicate with OpenNTPD
 - New test: TIME-3181 - check status of OpenNTPD time synchronisation

From b8cdb04772aac01bbdaec89d49cd22bc6325e4b8 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 25 Mar 2020 19:33:55 +0100
Subject: [PATCH 533/679] Corrected requirements to run tests

---
 include/tests_time | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/include/tests_time b/include/tests_time
index ba2e40c1..23fd0965 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -81,7 +81,7 @@
         fi
 
         # Check for OpenNTPD, ntpctl comes with a "regular" install
-        if [ -n ${NTPCTLBINARY} ]; then
+        if [ -n "${NTPCTLBINARY}" ]; then
             # In contrast to timectl, "synchronised: yes" is not grepped.
             # Reason: openntpd syncs only if large time corrections are not required or -s is passed.
             #         This might be not intended by the administrator (-s is NOT the default!)
@@ -526,14 +526,12 @@
 #
     # Test        : TIME-3180
     # Description : Report if ntpctl cannot communicate with OpenNTPD
-
     if [ "${NTPD_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" == "openntpd" ]; then
         PREQS_MET="YES"
     else
         PREQS_MET="NO"
     fi
-
-    Register --test-no TIME-3180 --weight L --network NO --category security --description "Report if ntpctl cannot communicate with OpenNTPD"
+    Register --test-no TIME-3180 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Report if ntpctl cannot communicate with OpenNTPD"
     if [ ${SKIPTEST} -eq 0 ]; then
         if [ "${OPENNTPD_COMMUNICATION}" -eq 0 ]; then
             ReportWarning "${TEST_NO}" "OpenNTPD found, but ntpctl cannot communicate with" "${NTPCTLBINARY} -s status" "Restart OpenNTPD"
@@ -544,14 +542,13 @@
 #
     # Test        : TIME-3181
     # Description : Check status of OpenNTPD time synchronisation
-
     if [ "${NTPD_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" == "openntpd" ] && [ "${OPENNTPD_COMMUNICATION}" -eq 1 ]; then
         PREQS_MET="YES"
     else
         PREQS_MET="NO"
     fi
 
-    Register --test-no TIME-3181 --weight L --network NO --category security --description "Check status of OpenNTPD time synchronisation"
+    Register --test-no TIME-3181 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Check status of OpenNTPD time synchronisation"
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(${NTPCTLBINARY} -s status | ${GREPBINARY} "clock synced" )
         if [ -z "${FIND}" ]; then
@@ -570,7 +567,7 @@
         PREQS_MET="NO"
     fi
 
-    Register --test-no TIME-3182 --weight L --network NO --category security --description "Check OpenNTPD has working peers"
+    Register --test-no TIME-3182 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Check OpenNTPD has working peers"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Format is "xx/yy peers valid, ..."
         FIND=$(${NTPCTLBINARY} -s status | ${EGREPBINARY} -o "[0-9]{1,4}/" | ${EGREPBINARY} -o "[0-9]{1,4}" )

From 603d5b16a282b6c2f646bae450002e385bd91b3f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 25 Mar 2020 19:40:05 +0100
Subject: [PATCH 534/679] [FINT-4339] define what file to check for

---
 include/tests_file_integrity | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_file_integrity b/include/tests_file_integrity
index dc32411d..728c2616 100644
--- a/include/tests_file_integrity
+++ b/include/tests_file_integrity
@@ -305,7 +305,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
         if [ -e /sys/kernel/security/ima ]; then
-            FOUND=$(${CAT_BINARY} /sys/kernel/security/ima)
+            FOUND=$(${CAT_BINARY} /sys/kernel/security/ima/runtime_measurements_count)
         fi
         if [ "${FOUND}" -ne 1 ]; then
             LogText "Result: EVM tools found but IMA/EVM disabled"

From 5c5cc43c6f7effe83adc8eeb65e7202e5ce10a73 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Fri, 27 Mar 2020 13:00:09 +0200
Subject: [PATCH 535/679] Check if system uses encrypted swap devices

Add test CRYP-7931 to check if the system uses any encrypted swap
devices.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 CHANGELOG.md         |  1 +
 db/tests.db          |  1 +
 include/binaries     |  1 +
 include/tests_crypto | 25 +++++++++++++++++++++++++
 4 files changed, 28 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 340f597f..1686e0db 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -51,6 +51,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - New test: BOOT-5109 - test presence rEFInd boot loader
 - New test: BOOT-5264 - run systemd-analyze security
 - New test: CRYP-7930 - test for LUKS encryption
+- New test: CRYP-7931 - determine if system uses encrypted swap
 - New test: CRYP-8004 - presence of hardware random number generator
 - New test: CRYP-8005 - presence of software random number generator
 - New test: DBS-1828  - PostgreSQL configuration files
diff --git a/db/tests.db b/db/tests.db
index d401424c..9b978fa5 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -89,6 +89,7 @@ CONT-8108:test:security:containers::Check file permissions for Docker files:
 CORE-1000:test:performance:system_integrity::Check all system binaries:
 CRYP-7902:test:security:crypto::Check expire date of SSL certificates:
 CRYP-7930:test:security:crypto:Linux:Determine if system uses LUKS encryption:
+CRYP-7931:test:security:crypto:Linux:Determine if system uses encrypted swap:
 CRYP-8002:test:security:crypto:Linux:Gather kernel entropy:
 CRYP-8004:test:security:crypto:Linux:Presence of hardware random number generators:
 CRYP-8005:test:security:crypto:Linux:Presence of software pseudo random number generators:
diff --git a/include/binaries b/include/binaries
index 16096fe4..08b9b4d4 100644
--- a/include/binaries
+++ b/include/binaries
@@ -271,6 +271,7 @@
                             sha256|sha256sum)       SHA256SUMBINARY="${BINARY}";       LogText "  Found known binary: sha256/sha256sum (crypto hashing) - ${BINARY}" ;;
                             ssh-keyscan)            SSHKEYSCANBINARY="${BINARY}";      LogText "  Found known binary: ssh-keyscan (scanner for SSH keys) - ${BINARY}" ;;
                             suricata)               SURICATABINARY="${BINARY}";        LogText "  Found known binary: suricata (IDS) - ${BINARY}" ;;
+                            swapon)                 SWAPONBINARY="${BINARY}";          LogText "  Found known binary: swapon (swap device tool) - ${BINARY}" ;;
                             swupd)                  SWUPDBINARY="${BINARY}";           LogText "  Found known binary: swupd (package manager) - ${BINARY}" ;;
                             sysctl)                 SYSCTLBINARY="${BINARY}";          LogText "  Found known binary: sysctl (kernel parameters) - ${BINARY}" ;;
                             syslog-ng)              SYSLOGNGBINARY="${BINARY}";        SYSLOGNGVERSION=$(${BINARY} -V 2>&1 | grep "^syslog-ng" | awk '{ print $2 }'); LogText "Found ${BINARY} (version ${SYSLOGNGVERSION})" ;;
diff --git a/include/tests_crypto b/include/tests_crypto
index 466f6b52..47c03451 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -173,6 +173,31 @@
     fi
 #
 #################################################################################
+#
+    # Test        : CRYP-7931
+    # Description : Determine if system uses encrypted swap
+    if [ -e "${SWAPONBINARY}" -a -e "${CRYPTSETUPBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no CRYP-7931 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --root-only YES --category security --description "Determine if system uses encrypted swap"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        ENCRYPTED_SWAPS=0
+        UNENCRYPTED_SWAPS=0
+        SWAPS=$(${SWAPONBINARY} --show=NAME --noheadings)
+        for BLOCK_DEV in ${SWAPS}; do
+            if ${CRYPTSETUPBINARY} isLuks "${BLOCK_DEV}" 2> /dev/null; then
+                LogText "Result: Found LUKS encrypted swap device: ${BLOCK_DEV}"
+                ENCRYPTED_SWAPS=$((ENCRYPTED_SWAPS +1))
+            elif ${CRYPTSETUPBINARY} status "${BLOCK_DEV}" | ${GREPBINARY} --quiet "cipher:"; then
+                LogText "Result: Found non-LUKS encrypted swap device: ${BLOCK_DEV}"
+                ENCRYPTED_SWAPS=$((ENCRYPTED_SWAPS +1))
+            else
+                LogText "Result: Found unencrypted swap device: ${BLOCK_DEV}"
+                UNENCRYPTED_SWAPS=$((UNENCRYPTED_SWAPS +1))
+            fi
+        done
+        Display --indent 2 --text "- Found ${ENCRYPTED_SWAPS} encrypted and ${UNENCRYPTED_SWAPS} unencrypted swap devices in use." --result OK --color WHITE
+    fi
+#
+#################################################################################
 #
     # Test        : CRYP-8002
     # Description : Gather available kernel entropy

From e7da240022de8fe7857a3fde9d24339b331c5bdb Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Sat, 28 Mar 2020 13:40:36 +0200
Subject: [PATCH 536/679] README.md: add repology badge

Show downstream usage for various versions of Lynis.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index c4e10b88..dc4f0e45 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,7 @@
 [![Linux Security Expert badge](https://badges.linuxsecurity.expert/tools/ranking/lynis.svg)](https://linuxsecurity.expert/tools/lynis/)
 [![Build Status](https://travis-ci.org/CISOfy/lynis.svg?branch=master)](https://travis-ci.org/CISOfy/lynis)
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/96/badge)](https://bestpractices.coreinfrastructure.org/projects/96)
+[![Packaging status](https://repology.org/badge/tiny-repos/lynis.svg)](https://repology.org/project/lynis/versions)
 [Documentation]
 
 [Documentation]: https://cisofy.com/documentation/lynis/

From 4732b640aeb5b1009401fecc477860995db4bd4d Mon Sep 17 00:00:00 2001
From: Sander <sander.contrib@gmail.com>
Date: Sat, 28 Mar 2020 19:23:00 +0000
Subject: [PATCH 537/679] Adding test FILE-6394

---
 include/tests_filesystems | 32 ++++++++++++++++++++++++++++----
 1 file changed, 28 insertions(+), 4 deletions(-)

diff --git a/include/tests_filesystems b/include/tests_filesystems
index 38b4c0d0..51d22760 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -689,11 +689,35 @@
 #
 #################################################################################
 #
-    # Test        : FILE-6394 TODO
+    # Test        : FILE-6394
     # Description : Check vm.swappiness (Linux)
-
-    # Want to contribute to Lynis? Create this test
-
+    Register --test-no FILE-6394 --os Linux --weight L --network NO --category security --description "Determine level of swappiness."
+    if [ ${SKIPTEST} -eq 0 ]; then
+        SWAPLEVEL=$(${CAT_BINARY} /proc/sys/vm/swappiness)
+        LogText "Test: checking level of vm.swappiness: ${SWAPLEVEL}"
+		PHYSDISK=$(${LSBLKBINARY} | ${GREPBINARY} -E 'disk|SWAP' | ${GREPBINARY} -B1 SWAP | ${HEADBINARY} -n1 | ${AWKBINARY} '{print $1}')
+        if [ ${SWAPLEVEL} -gt 60 ]; then
+            LogText "Result: vm.swappiness=${SWAPLEVEL} meaning that swapping is more frequent than default."
+			# Check if swap is on a HDD or SDD for frequent swapping
+            if [ -d /sys/block/${PHYSDISK} ]; then
+                HDDORSDD=$(${CAT_BINARY} /sys/block/${PHYSDISK}/queue/rotational)
+                if [ ${HDDORSDD} -eq 1 ]; then
+                    ReportSuggestion "${TEST_NO}" "vm.swappiness set to: ${SWAPLEVEL} > 60 (default) - consider installing an SSD for swap partition for better performance."
+                fi
+            fi
+        elif [ ${SWAPLEVEL} -eq 0 ]; then
+            LogText "Result: vm.swappiness=${SWAPLEVEL} meaning swapping is disabled."
+            ReportSuggestion "${TEST_NO}" "vm.swappiness set to: ${SWAPLEVEL}. Consider setting value to minimum of 1 for minimizing swappiness, but not quite disabling it. Will prevent OOM killer from killing processes when running out of physical memory."
+        elif [ ${SWAPLEVEL} -eq 1]; then
+            LogText "Result: vm.swappiness=${SWAPLEVEL} meaning that swapping can still occur but at very minimum."
+        elif [ ${SWAPLEVEL} -eq 10 ]; then
+            LogText "Result: vm.swappiness=${SWAPLEVEL} which is the preferred setting for database servers."
+        elif [ ${SWAPLEVEL} -lt 60 ]; then
+            LogText "Result: vm.swappiness=${SWAPLEVEL} meaning that swapping is less frequent than default. This is only recommended for servers."
+        else
+            LogText "Result: vm.swappiness=${SWAPLEVEL} which is the standard level of swappiness and works well for desktop systems."
+        fi
+    fi
 #
 #################################################################################
 #

From 18daa9f4955e0f5e1009321bd24a8002aab392e6 Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Sun, 29 Mar 2020 15:06:36 -0500
Subject: [PATCH 538/679] AUTH-9229 Do not use long options for sort

Use the standard `sort(1)` short option `-u` rather than `--unique`,
since not all versions support long options.
---
 include/tests_authentication | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index ce821fba..2e14c7f0 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -374,7 +374,7 @@
                     echo "Unknown password hashing method ${METHOD}. Please report to lynis-dev@cisofy.com"
                     ;;
             esac
-        done | ${SORTBINARY} --unique | ${TRBINARY} '\n' ' ')
+        done | ${SORTBINARY} -u | ${TRBINARY} '\n' ' ')
         if [ -z "${FIND}" ]; then
             Display --indent 2 --text "- Password hashing methods" --result "${STATUS_OK}" --color GREEN
             LogText "Result: no poor password hashing methods found"

From 90b17121baf55a233a5819a0c5f8ba7fe5a387ba Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Sun, 29 Mar 2020 15:31:41 -0500
Subject: [PATCH 539/679] Fix AUTH-9230 for systems without /etc/login.defs

This fixes a bug where it was determined that /etc/login.defs didn't
exist as a prerequisite but then wasn't used to skip the test. Prevents
warnings from `grep(1)` for "no such file or directory".
---
 include/tests_authentication | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index ce821fba..81842b63 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -396,7 +396,7 @@
     if [ -f ${ROOTDIR}etc/login.defs ]; then
         PREQS_MET="YES"
     fi
-    Register --test-no AUTH-9230 --root-only NO --weight L --network NO --category security --description "Check group password hashing rounds"
+    Register --test-no AUTH-9230 --preqs-met ${PREQS_MET} --root-only NO --weight L --network NO --category security --description "Check group password hashing rounds"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking SHA_CRYPT_MIN_ROUNDS option in ${ROOTDIR}etc/login.defs"
         FIND=$(${GREPBINARY} "^SHA_CRYPT_MIN_ROUNDS" ${ROOTDIR}etc/login.defs | ${AWKBINARY} '{ if ($1=="SHA_CRYPT_MIN_ROUNDS") { print $2 } }')

From f13d919dfa9379969e14dbd11e296c37c7792945 Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Sun, 29 Mar 2020 16:19:25 -0500
Subject: [PATCH 540/679] PROC-3802 Only check for prelink package on Linux

The prelink package is Linux specific no need to check for it on
non-Linux systems.
---
 include/tests_memory_processes | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_memory_processes b/include/tests_memory_processes
index 0b0fff6f..65473cf4 100644
--- a/include/tests_memory_processes
+++ b/include/tests_memory_processes
@@ -118,7 +118,7 @@
 #
     # Test        : PROC-3802
     # Description : Check presence of prelink tooling
-    Register --test-no PROC-3802 --weight L --network NO --category security --description "Check presence of prelink tooling"
+    Register --test-no PROC-3802 --os Linux --weight L --network NO --category security --description "Check presence of prelink tooling"
     if [ ${SKIPTEST} -eq 0 ]; then
         if PackageIsInstalled "prelink"; then
             LogText "Result: prelink packages is installed"

From 677f0c32fa844bc309db4a1bae5c71d97e2a2cdf Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 30 Mar 2020 12:11:58 +0200
Subject: [PATCH 541/679] Move Repology link and text change for packages

---
 README.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index dc4f0e45..096890d4 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,6 @@
 [![Linux Security Expert badge](https://badges.linuxsecurity.expert/tools/ranking/lynis.svg)](https://linuxsecurity.expert/tools/lynis/)
 [![Build Status](https://travis-ci.org/CISOfy/lynis.svg?branch=master)](https://travis-ci.org/CISOfy/lynis)
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/96/badge)](https://bestpractices.coreinfrastructure.org/projects/96)
-[![Packaging status](https://repology.org/badge/tiny-repos/lynis.svg)](https://repology.org/project/lynis/versions)
 [Documentation]
 
 [Documentation]: https://cisofy.com/documentation/lynis/
@@ -58,9 +57,11 @@ If you want to run the software as `root`, we suggest changing the ownership of
 
 ### Package
 
-Stable releases of Lynis are packaged and made available as RPM or DEB package. The [CISOfy software repository](https://packages.cisofy.com) can be used to install Lynis on systems running:
+For Linux, BSD, macOS, there is typically a package available. The Lynis project also provides packages in RPM or DEB format. The [CISOfy software repository](https://packages.cisofy.com) can be used to install Lynis on systems running:
 `CentOS`, `Debian`, `Fedora`, `OEL`, `openSUSE`, `RHEL`, `Ubuntu`, and others.
 
+Some distributions may have Lynis is their repository available. Use the overview by [![Repology](https://repology.org/badge/tiny-repos/lynis.svg)](https://repology.org/project/lynis/versions) to see if they are up-to-date. Otherwise consider the CISOfy repository, tarball (website), or GitHub releases.
+
 ### Enterprise Version
 
 This software component is also part of an enterprise solution. Same quality, yet with more functionality.

From 49b8779cb55ba9985cdad75d70af071a60bbb438 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 30 Mar 2020 12:14:40 +0200
Subject: [PATCH 542/679] Improved text about software packages

---
 README.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 096890d4..ccc5a4d3 100644
--- a/README.md
+++ b/README.md
@@ -55,12 +55,13 @@ Typical users of the software:
 
 If you want to run the software as `root`, we suggest changing the ownership of the files. Use `chown -R 0:0` to recursively alter the owner and group and set it to user ID `0` (`root`).
 
-### Package
+### Software Package
 
 For Linux, BSD, macOS, there is typically a package available. The Lynis project also provides packages in RPM or DEB format. The [CISOfy software repository](https://packages.cisofy.com) can be used to install Lynis on systems running:
 `CentOS`, `Debian`, `Fedora`, `OEL`, `openSUSE`, `RHEL`, `Ubuntu`, and others.
 
-Some distributions may have Lynis is their repository available. Use the overview by [![Repology](https://repology.org/badge/tiny-repos/lynis.svg)](https://repology.org/project/lynis/versions) to see if they are up-to-date. Otherwise consider the CISOfy repository, tarball (website), or GitHub releases.
+Some distributions may also have Lynis in their software repository: [![Repology](https://repology.org/badge/tiny-repos/lynis.svg)](https://repology.org/project/lynis/versions)
+If they don't provide an up-to-date version, consider the CISOfy repository, tarball (website), or GitHub release.
 
 ### Enterprise Version
 

From 9a1bbbc69ae817d4d59b0d58a40b9bc434b32a63 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 30 Mar 2020 16:08:31 +0200
Subject: [PATCH 543/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 340f597f..1cae9172 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -130,6 +130,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - PROC-3602 - allow different root directory
 - PROC-3612 - show 'Not found' instead of 'OK'
 - PROC-3614 - show 'Not found' instead of 'OK'
+- PROC-3802 - limit to Linux only (prelink package check)
 - SCHD-7702 - removed hardening points
 - SINT-7010 - limit test to only macOS systems
 - SSH-7402 - detect other SSH daemons like dropbear

From 2b1d5fa46ffe7c9794fe8fc972040d722a35b17c Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Mon, 30 Mar 2020 14:09:28 -0500
Subject: [PATCH 544/679] Add NetBSD pkgsrc pkg_info to known binaries

The NetBSD pkgsrc package management system uses pkg_info for
determining information about packages. This is also the command
used in PKGS-7302.
---
 include/binaries | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/binaries b/include/binaries
index 16096fe4..5884fc0c 100644
--- a/include/binaries
+++ b/include/binaries
@@ -230,6 +230,7 @@
                             php)                    PHPBINARY="${BINARY}";             PHPVERSION=$(${BINARY} -v | awk '{ if ($1=="PHP") { print $2 }}' | head -1); LogText "Found known binary: php (programming language interpreter) - ${BINARY} (version ${PHPVERSION})" ;;
                             pkg)                    PKG_BINARY="${BINARY}";            LogText "  Found known binary: pkg (software package administration) - ${BINARY}" ;;
                             pkg_admin)              PKGADMINBINARY="${BINARY}";        LogText "  Found known binary: pkg_admin (software package administration) - ${BINARY}" ;;
+                            pkg_info)               PKGINFOBINARY="${BINARY}";         LogText "  Found known binary: pkg_info (software package information) - ${BINARY}" ;;
                             postconf)               POSTCONFBINARY="${BINARY}";        LogText "  Found known binary: postconf (postfix configuration) - ${BINARY}" ;;
                             postfix)                POSTFIXBINARY="${BINARY}";         LogText "  Found known binary: postfix (postfix binary) - ${BINARY}" ;;
                             prelink)                PRELINKBINARY="${BINARY}";         LogText "  Found known binary: prelink (system optimizer) - ${BINARY}" ;;

From eb7dbab1ee55f24a300b58ef845edc18d443f68a Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Mon, 30 Mar 2020 14:12:36 -0500
Subject: [PATCH 545/679] Add pkg_info to PackageIsInstalled

The `pkg_info` command is used on a system using NetBSD pkgsrc to
determine which packages are installed.
---
 include/functions | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/include/functions b/include/functions
index ed1a58eb..5b60419f 100644
--- a/include/functions
+++ b/include/functions
@@ -2041,6 +2041,9 @@
         elif [ -n "${PKG_BINARY}" ]; then
             output=$(${PKG_BINARY} -N info ${package} >/dev/null 2>&1)
             exit_code=$?  # 0=package installed, 70=invalid package
+        elif [ -n "${PKGINFOBINARY}" ]; then
+            output=$(${PKGINFOBINARY} -q -e ${package} >/dev/null 2>&1)
+            exit_code=$?  # 0=package installed, 1=package not installed
         elif [ -n "${RPMBINARY}" ]; then
             output=$(${RPMBINARY} --quiet -q ${package} > /dev/null 2>&1)
             exit_code=$?

From 94915ac2fe9d27c8c2ae7d54dee72f40139187a8 Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Mon, 30 Mar 2020 14:23:58 -0500
Subject: [PATCH 546/679] Fix PKGS-7301 message nit

The comment is correct. It is FreeBSD pkg not NetBSD pkg.
---
 include/tests_ports_packages | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index f63f2793..286da608 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -38,7 +38,7 @@
     # Test        : PKGS-7301
     # Description : Query FreeBSD pkg
     if [ -x ${ROOTDIR}usr/sbin/pkg ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no PKGS-7301 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Query NetBSD pkg"
+    Register --test-no PKGS-7301 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Query FreeBSD pkg"
     if [ ${SKIPTEST} -eq 0 ]; then
         FIND=$(pkg -N 2>&1; echo $?)
         if [ "${FIND}" = "0" ]; then

From 53ad72e791ea378e4974e2db1eb416d4ee537455 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 31 Mar 2020 16:25:27 +0200
Subject: [PATCH 547/679] Removed unneeded complexity regarding dmidecode, as
 binary checks are already done at this point

---
 include/functions | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/include/functions b/include/functions
index 5b60419f..fd47cd3d 100644
--- a/include/functions
+++ b/include/functions
@@ -1774,14 +1774,9 @@
         # dmidecode
         # Values: VMware Virtual Platform / VirtualBox
         if [ -z "${SHORT}" ]; then
-            if [ -x /usr/bin/dmidecode ]; then DMIDECODE_BINARY="/usr/bin/dmidecode"
-            elif [ -x /usr/sbin/dmidecode ]; then DMIDECODE_BINARY="/usr/sbin/dmidecode"
-            else
-                DMIDECODE_BINARY=""
-            fi
-            if [ ! "${DMIDECODE_BINARY}" = "" -a ${PRIVILEGED} -eq 1 ]; then
+            if [ -n "${DMIDECODEBINARY}" -a -x "${DMIDECODEBINARY}" -a ${PRIVILEGED} -eq 1 ]; then
                 LogText "Test: trying to guess virtualization with dmidecode"
-                FIND=$(/usr/sbin/dmidecode -s system-product-name | awk '{ print $1 }')
+                FIND=$(${DMIDECODEBINARY} -s system-product-name | awk '{ print $1 }')
                 if [ -n "${FIND}" ]; then
                     LogText "Result: found ${FIND}"
                     SHORT="${FIND}"
@@ -1794,6 +1789,7 @@
         else
             LogText "Result: skipped dmidecode test, as we already found machine type"
         fi
+
         # Other options
         # SaltStack: salt-call grains.get virtual
         # < needs snippet >

From 5f13de96a415fdcea8fd79a7538083a419033139 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 31 Mar 2020 16:25:33 +0200
Subject: [PATCH 548/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1cae9172..39e93961 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -154,6 +154,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - Do not show tool tips when quiet option is used
 - Improved screen output in several tests
 - Extended output of 'lynis update info'
+- Improved support for NetBSD
 - Test if profiles are readable
 - systemd service file adjusted
 - bash completion script extended

From a38e2b535e09ec12e58a9243ef942c9f778acb7a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 31 Mar 2020 16:31:41 +0200
Subject: [PATCH 549/679] Corrected case where binaries were not checked while
 we do want to use dmidecode if it available

---
 include/functions | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/functions b/include/functions
index fd47cd3d..63cc4864 100644
--- a/include/functions
+++ b/include/functions
@@ -1774,6 +1774,8 @@
         # dmidecode
         # Values: VMware Virtual Platform / VirtualBox
         if [ -z "${SHORT}" ]; then
+            # Try to find dmidecode in case we did not check binaries (e.g. lynis show environment)
+            if [ ${CHECK_BINARIES} -eq 0 ]; then DMIDECODEBINARY=$(command -v dmidecode 2> /dev/null); fi
             if [ -n "${DMIDECODEBINARY}" -a -x "${DMIDECODEBINARY}" -a ${PRIVILEGED} -eq 1 ]; then
                 LogText "Test: trying to guess virtualization with dmidecode"
                 FIND=$(${DMIDECODEBINARY} -s system-product-name | awk '{ print $1 }')

From 179f7d3442d4821972e77fe3355e3bb479981f4a Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Tue, 31 Mar 2020 17:55:49 +0300
Subject: [PATCH 550/679] Enhance binaries report

Report also number of set-uid and set-gid binaries found.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 include/binaries | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/include/binaries b/include/binaries
index 5884fc0c..5f23f13a 100644
--- a/include/binaries
+++ b/include/binaries
@@ -74,6 +74,10 @@
             fi
         done
 
+        NSUID_BINARIES=0
+        NSGID_BINARIES=0
+        SUID_BINARIES=
+        SGID_BINARIES=
         # Now perform binary detection
         for SCANDIR in ${BIN_PATHS}; do
             SCANDIR=$(echo "${SCANDIR}" | sed 's/!!space!!/ /g')
@@ -115,6 +119,14 @@
                         COUNT=$((COUNT + 1))
                         BINARY="${SCANDIR}/${FILENAME}"
                         DISCOVERED_BINARIES="${DISCOVERED_BINARIES}${BINARY} "
+                        if [ -u ${BINARY} ]; then
+                            NSUID_BINARIES=$((NSUID_BINARIES + 1))
+                            SUID_BINARIES="${SUID_BINARIES}${BINARY} "
+                        fi
+                        if [ -g ${BINARY} ]; then
+                            NSGID_BINARIES=$((NSGID_BINARIES + 1))
+                            SGID_BINARIES="${SGID_BINARIES}${BINARY} "
+                        fi
                         # Optimized, much quicker (limited file access needed)
                         case ${FILENAME} in
                             aa-status)              AASTATUSBINARY=${BINARY};          LogText "  Found known binary: aa-status (apparmor component) - ${BINARY}" ;;
@@ -311,8 +323,10 @@
         BINARY_SCAN_FINISHED=1
         BINARY_PATHS_FOUND=$(echo ${BINARY_PATHS_FOUND} | sed 's/^, //g' | sed 's/, /,/g')
         LogText "Discovered directories: ${BINARY_PATHS_FOUND}"
-        LogText "Result: found ${COUNT} binaries"
-        Report "binaries_count=${COUNT}"
+        LogText "Result: found ${COUNT} binaries including ${NSUID_BINARIES} set-uid and ${NSGID_BINARIES} set-gid"
+        LogText "Result: set-uid binaries: ${SUID_BINARIES}"
+        LogText "Result: set-gid binaries: ${SGID_BINARIES}"
+        Report "binaries_count=${COUNT} suid_count=${SUID_BINARIES} sgid_count=${SGID_BINARIES}"
         Report "binary_paths=${BINARY_PATHS_FOUND}"
 
         # Test if the basic system tools are defined. These will be used during the audit.

From c5914c4e0f5a6d48034107c0627a3e2e8f640210 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 1 Apr 2020 11:48:39 +0200
Subject: [PATCH 551/679] Split count values so they are reported as individual
 items

---
 include/binaries | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/binaries b/include/binaries
index 5f23f13a..4555378d 100644
--- a/include/binaries
+++ b/include/binaries
@@ -326,7 +326,9 @@
         LogText "Result: found ${COUNT} binaries including ${NSUID_BINARIES} set-uid and ${NSGID_BINARIES} set-gid"
         LogText "Result: set-uid binaries: ${SUID_BINARIES}"
         LogText "Result: set-gid binaries: ${SGID_BINARIES}"
-        Report "binaries_count=${COUNT} suid_count=${SUID_BINARIES} sgid_count=${SGID_BINARIES}"
+        Report "binaries_count=${COUNT}"
+        Report "binaries_suid_count=${SUID_BINARIES}"
+        Report "binaries_sgid_count=${SGID_BINARIES}"
         Report "binary_paths=${BINARY_PATHS_FOUND}"
 
         # Test if the basic system tools are defined. These will be used during the audit.

From 7e3c9448df1bea8344597bcc4a1732c51430bf1a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 1 Apr 2020 16:16:31 +0200
Subject: [PATCH 552/679] [TIME-3104] search for files using find and strip
 potential characters that may be unexpected

---
 include/tests_time | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/include/tests_time b/include/tests_time
index 23fd0965..7c15d0a3 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -163,22 +163,28 @@
             fi
         done
 
-        # Don't run check in cron job directory on Solaris
-        # /etc/cron.d/FIFO is a special file and test get stuck at this file
+        # Notes: only test for normal files. File /etc/cron.d/FIFO on solaris is a special file and test may hang
+        # Linux systems may have a .placeholder file
         FOUND_IN_CRON=0
 
         # Check cron jobs
         for I in ${CRON_DIRS}; do
             if [ -d ${I} ]; then
                 if FileIsReadable ${I}; then
-                    FIND=$(${LSBINARY} ${I} | ${GREPBINARY} -v FIFO)
+                    FIND=$(${FINDBINARY} ${I} -type f -a ! -name ".placeholder" -print 2> /dev/null | ${SEDBINARY} 's/ /__space__/g' | ${TRBINARY} '\n' '\0' | ${TRBINARY} -cd '[:print:]\0' | ${TRBINARY} '\0' ' ')
                     if [ -n "${FIND}" ]; then
                         for J in ${FIND}; do
-                            LogText "Test: checking for ntpdate or rdate in ${I}/${J}"
-                            FIND2=$(${EGREPBINARY} "rdate|ntpdate" ${I}/${J} | ${GREPBINARY} -v "^#")
-                            if [ -n "${FIND2}" ]; then
-                                LogText "Positive match found: ${FIND2}"
-                                FOUND=1; FOUND_IN_CRON=1; NTP_CONFIG_TYPE_SCHEDULED=1
+                            # Place back spaces if needed
+                            J=$(echo ${J} | ${SEDBINARY} 's/__space__/ /g')
+                            LogText "Test: checking for ntpdate or rdate in ${J}"
+                            if FileIsReadable ${J}; then
+                                FIND2=$(${EGREPBINARY} "rdate|ntpdate" "${J}" | ${GREPBINARY} -v "^#")
+                                if [ -n "${FIND2}" ]; then
+                                    LogText "Positive match found: ${FIND2}"
+                                    FOUND=1; FOUND_IN_CRON=1; NTP_CONFIG_TYPE_SCHEDULED=1
+                                fi
+                            else
+                                LogText "Result: could not test in file '${J}' as it is not readable"
                             fi
                         done
                     else

From f232b4f9bbb1592b37d2af4938f940b03a61d54d Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 1 Apr 2020 16:18:03 +0200
Subject: [PATCH 553/679] Added quotes

---
 include/tests_filesystems | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/include/tests_filesystems b/include/tests_filesystems
index 51d22760..aabdc2be 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -580,7 +580,7 @@
                         FS_FSTAB=""
                     fi
                 fi
-		if [ -z "${FS_FSTAB}" ]; then # not found in fstab, check if mounted otherwise
+                if [ -z "${FS_FSTAB}" ]; then # not found in fstab, check if mounted otherwise
                     FS_FSTAB=$(mount | ${AWKBINARY} -v fs=${FILESYSTEM} '{ if ($3==fs) { print $6 } }')
                     FOUND_FLAGS=$(mount | ${AWKBINARY} -v fs=${FILESYSTEM} '{ if ($1~"[^#]" && $3==fs) { print $6 } }' | ${SEDBINARY} 's/,/ /g' | ${TRBINARY} '\n' ' ')
                 else
@@ -668,7 +668,6 @@
     # Description : Check for nodirtime option
 
     # Want to contribute to Lynis? Create this test
-
 #
 #################################################################################
 #
@@ -676,7 +675,6 @@
     # Description : Check for relatime
 
     # Want to contribute to Lynis? Create this test
-
 #
 #################################################################################
 #
@@ -695,12 +693,12 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         SWAPLEVEL=$(${CAT_BINARY} /proc/sys/vm/swappiness)
         LogText "Test: checking level of vm.swappiness: ${SWAPLEVEL}"
-		PHYSDISK=$(${LSBLKBINARY} | ${GREPBINARY} -E 'disk|SWAP' | ${GREPBINARY} -B1 SWAP | ${HEADBINARY} -n1 | ${AWKBINARY} '{print $1}')
+        PHYSDISK=$(${LSBLKBINARY} | ${GREPBINARY} -E 'disk|SWAP' | ${GREPBINARY} -B1 SWAP | ${HEADBINARY} -n1 | ${AWKBINARY} '{print $1}')
         if [ ${SWAPLEVEL} -gt 60 ]; then
             LogText "Result: vm.swappiness=${SWAPLEVEL} meaning that swapping is more frequent than default."
-			# Check if swap is on a HDD or SDD for frequent swapping
-            if [ -d /sys/block/${PHYSDISK} ]; then
-                HDDORSDD=$(${CAT_BINARY} /sys/block/${PHYSDISK}/queue/rotational)
+            # Check if swap is on a HDD or SDD for frequent swapping
+            if [ -d "/sys/block/${PHYSDISK}" ]; then
+                HDDORSDD=$(${CAT_BINARY} "/sys/block/${PHYSDISK}/queue/rotational")
                 if [ ${HDDORSDD} -eq 1 ]; then
                     ReportSuggestion "${TEST_NO}" "vm.swappiness set to: ${SWAPLEVEL} > 60 (default) - consider installing an SSD for swap partition for better performance."
                 fi
@@ -708,7 +706,7 @@
         elif [ ${SWAPLEVEL} -eq 0 ]; then
             LogText "Result: vm.swappiness=${SWAPLEVEL} meaning swapping is disabled."
             ReportSuggestion "${TEST_NO}" "vm.swappiness set to: ${SWAPLEVEL}. Consider setting value to minimum of 1 for minimizing swappiness, but not quite disabling it. Will prevent OOM killer from killing processes when running out of physical memory."
-        elif [ ${SWAPLEVEL} -eq 1]; then
+        elif [ ${SWAPLEVEL} -eq 1 ]; then
             LogText "Result: vm.swappiness=${SWAPLEVEL} meaning that swapping can still occur but at very minimum."
         elif [ ${SWAPLEVEL} -eq 10 ]; then
             LogText "Result: vm.swappiness=${SWAPLEVEL} which is the preferred setting for database servers."
@@ -717,6 +715,7 @@
         else
             LogText "Result: vm.swappiness=${SWAPLEVEL} which is the standard level of swappiness and works well for desktop systems."
         fi
+        if IsVerbose; then Display --indent 2 --text "- Swappiness: ${SWAPLEVEL}" --result "INFO" --color WHITE; fi
     fi
 #
 #################################################################################

From 4cf21ebdcc3310265fd923907b08080f6af0f346 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 1 Apr 2020 16:19:09 +0200
Subject: [PATCH 554/679] Added FILE-6394

---
 db/tests.db | 1 +
 1 file changed, 1 insertion(+)

diff --git a/db/tests.db b/db/tests.db
index d401424c..48430806 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -122,6 +122,7 @@ FILE-6368:test:security:filesystems:Linux:Checking ACL support on root file syst
 FILE-6372:test:security:filesystems:Linux:Checking / mount options:
 FILE-6374:test:security:filesystems:Linux:Linux mount options:
 FILE-6376:test:security:filesystems:Linux:Determine if /var/tmp is bound to /tmp:
+FILE-6394:test:performance:filesystems:Linux:Test swappiness of virtual memory:
 FILE-6410:test:security:filesystems::Checking Locate database:
 FILE-6430:test:security:filesystems::Disable mounting of some filesystems:
 FILE-6439:test:security:filesystems:DragonFly:Checking HAMMER PFS mounts:

From c309ad7bdc1f365eca3e28b33a3a647fc2c91355 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 1 Apr 2020 16:19:54 +0200
Subject: [PATCH 555/679] Updated log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 39e93961..e3afdbfb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -54,6 +54,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - New test: CRYP-8004 - presence of hardware random number generator
 - New test: CRYP-8005 - presence of software random number generator
 - New test: DBS-1828  - PostgreSQL configuration files
+- New test: FILE-6394 - test virtual memory swappiness (Linux)
 - New test: FINT-4316 - presence of AIDE database and size test
 - New test: FINT-4340 - check dm-integrity status (Linux)
 - New test: FINT-4341 - verify status of dm-verity (Linux)
@@ -141,6 +142,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - SSH-7408 - corrected OpenSSH server version check
 - STRG-1840 - renamed to USB-1000
 - STRG-1842 - added default authorized devices and renamed to USB-2000
+- TIME-3104 - use find to discover files in cron directories
 - TOOL-5002 - differentiate between a discovered binary and running process
 - TOOL-5160 - added support for OSSEC agent daemon
 - Perform additional check to ensure pacman package manager is used

From 4432f9304485c0c1615b8772d19065c5fc7e7e4c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 1 Apr 2020 16:32:52 +0200
Subject: [PATCH 556/679] [LOGG-2190] skip mysqld related entries

---
 include/tests_logging | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/include/tests_logging b/include/tests_logging
index 7f254147..292940e3 100644
--- a/include/tests_logging
+++ b/include/tests_logging
@@ -534,12 +534,7 @@
         LSOF_GREP="WARNING|Output information"
 
         # MySQL versions prior to 5.6 leave lots of deleted in-use files in /tmp, ignoring those
-        if [ -n "${DPKGBINARY}" ]; then
-            EARLY_MYSQL=$(${DPKGBINARY} -l | ${EGREPBINARY} mysql-server-5.[0-5])
-        elif [ -n "${RPMBINARY}" ]; then
-            EARLY_MYSQL=$(${RPMBINARY} -qa mariadb | ${EGREPBINARY} mariadb-5.[0-5])
-        fi
-        if [ -n "${EARLY_MYSQL}" ]; then LSOF_GREP="${LSOF_GREP}|mysqld"; fi
+        LSOF_GREP="${LSOF_GREP}|mysqld"
 
         # grsecurity causes Fail2Ban to hold onto deleted in-use files in /var/tmp
         if [ ${GRSEC_FOUND} -eq 1 ]; then LSOF_GREP="${LSOF_GREP}|fail2ban"; fi

From 2c4ed62ef6cf82ae2af5c0ea2b4f39001f1ec32a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 1 Apr 2020 16:32:59 +0200
Subject: [PATCH 557/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e3afdbfb..40844409 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -116,6 +116,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - KRNL-5820 - extended check to include limits.d directory
 - KRNL-5830 - skip test partially when running non-privileged
 - LOGG-2154 - added support for rsyslog configurations
+- LOGG-2190 - skip mysqld related entries
 - MACF-6234 - SELinux tests extended
 - MAIL-8804 - replaced static strings with translation-aware strings
 - MALW-3280 - Kaspersky detection added

From 156f740ff2fae6a39bc763e66df2ea17cd87d5b7 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 1 Apr 2020 19:02:11 +0200
Subject: [PATCH 558/679] The IsRunning function may have not everything
 defined early on, so added a fallback

---
 include/functions | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/include/functions b/include/functions
index 63cc4864..b99fdc53 100644
--- a/include/functions
+++ b/include/functions
@@ -1546,7 +1546,7 @@
         if [ -z "${search}" ]; then ExitFatal "Missing process to search for when using IsRunning function"; fi
         RUNNING=0
         # AIX does not fully support pgrep options, so using ps instead
-        if [ -n "${PGREPBINARY}" ] && [ "${OS}" != "AIX" ]; then
+        if [ "${OS}" != "AIX" ]; then
             # When --user is used, perform a search using the -u option
                             # Initialize users for strict mode
             if [ -n "${users:-}" ]; then
@@ -1556,33 +1556,33 @@
                     if [ -n "${user_uid}" ]; then
                         if [ -z "${FIND}" ]; then
                             LogText "Performing pgrep scan using uid ${user_uid}"
-                            FIND=$(${PGREPBINARY} ${pgrep_options} -u "${user_uid}" "${search}" | ${TRBINARY} '\n' ' ')
+                            FIND=$(${PGREPBINARY:-pgrep} ${pgrep_options} -u "${user_uid}" "${search}" | ${TRBINARY:-tr} '\n' ' ')
                         fi
                     fi
                 done
             else
                 LogText "Performing pgrep scan without uid"
-                FIND=$(${PGREPBINARY} ${pgrep_options} "${search}" | ${TRBINARY} '\n' ' ')
+                FIND=$(${PGREPBINARY:-pgrep} ${pgrep_options} "${search}" | ${TRBINARY} '\n' ' ')
             fi
         else
             if [ "${SHELL_IS_BUSYBOX}" -eq 1 ]; then
                 # This search is not foolproof
                 LogText "Performing simple ps scan (busybox)"
                 PSOPTIONS=" -o args="
-                FIND=$(${PSBINARY} ${PSOPTIONS} | ${EGREPBINARY} "( |/)${search}" | ${GREPBINARY} -v "grep")
+                FIND=$(${PSBINARY:-ps} ${PSOPTIONS} | ${EGREPBINARY:-egrep} "( |/)${search}" | ${GREPBINARY:-grep} -v "grep")
             else
                 if [ -n "${users}" ]; then
                     for u in ${users}; do
-                        user_uid=$(getent passwd "${u}" 2> /dev/null | ${AWKBINARY} -F: '{print $3}')
+                        user_uid=$(getent passwd "${u}" 2> /dev/null | ${AWKBINARY:-awk} -F: '{print $3}')
                         # Only perform search if user exists and we had no match yet
                         if [ -n "${user_uid}" ]; then
                             if [ -z "${FIND}" ]; then
                                 if [ ${PARTIAL_SEARCH} -eq 1 ]; then
                                     LogText "Performing ps scan using partial match and for uid ${user_uid}"
-                                    FIND=$(${PSBINARY} -u "${user_uid}" -o comm= "${search}" | ${AWKBINARY} -v pattern="${search}" '$0 ~ pattern {print}')
+                                    FIND=$(${PSBINARY:-ps} -u "${user_uid}" -o comm= "${search}" | ${AWKBINARY:-awk} -v pattern="${search}" '$0 ~ pattern {print}')
                                 else
                                     LogText "Performing ps scan using exact match and for uid ${user_uid}"
-                                    FIND=$(${PSBINARY} -u "${user_uid}" -o comm= "${search}" | ${AWKBINARY} -v pattern="^${search}$" '$0 ~ pattern {print}')
+                                    FIND=$(${PSBINARY:-ps} -u "${user_uid}" -o comm= "${search}" | ${AWKBINARY:-awk} -v pattern="^${search}$" '$0 ~ pattern {print}')
                                 fi
                             fi
                         fi
@@ -1595,10 +1595,10 @@
                     esac
                     if [ ${PARTIAL_SEARCH} -eq 1 ]; then
                         LogText "Performing ps scan using partial match and without uid"
-                        FIND=$(${PSBINARY} ${PSOPTIONS} | ${AWKBINARY} -v pattern="${search}" '$0 ~ pattern {print}')
+                        FIND=$(${PSBINARY:-ps} ${PSOPTIONS} | ${AWKBINARY:-awk} -v pattern="${search}" '$0 ~ pattern {print}')
                     else
                         LogText "Performing ps scan using exact match and without uid"
-                        FIND=$(${PSBINARY} ${PSOPTIONS} | ${AWKBINARY} -v pattern="^${search}$" '$0 ~ pattern {print}')
+                        FIND=$(${PSBINARY:-ps} ${PSOPTIONS} | ${AWKBINARY:-awk} -v pattern="^${search}$" '$0 ~ pattern {print}')
                     fi
                 fi
             fi

From b5a2d11738cf72691f3b09c48a4c647a4c499277 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 2 Apr 2020 09:28:41 +0200
Subject: [PATCH 559/679] Added fallback for awk/tr, small code enhancement,
 added note

---
 include/functions | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/include/functions b/include/functions
index b99fdc53..492ade27 100644
--- a/include/functions
+++ b/include/functions
@@ -1516,6 +1516,7 @@
     # Returns     : 0 (process is running), 1 (process not running)
     #               RUNNING (1 = running, 0 = not running) - will be deprecated
     # Notes       : PSOPTIONS are declared globally, to prevent testing each call
+    #               Fallback is used on binaries as IsRunning is used for 'show' command
     ################################################################################
 
     IsRunning() {
@@ -1548,10 +1549,10 @@
         # AIX does not fully support pgrep options, so using ps instead
         if [ "${OS}" != "AIX" ]; then
             # When --user is used, perform a search using the -u option
-                            # Initialize users for strict mode
+            # Initialize users for strict mode
             if [ -n "${users:-}" ]; then
                 for u in ${users}; do
-                    user_uid=$(getent passwd "${u}" 2> /dev/null | ${AWKBINARY} -F: '{print $3}')
+                    user_uid=$(getent passwd "${u}" 2> /dev/null | ${AWKBINARY:-awk} -F: '{print $3}')
                     # Only perform search if user exists and we had no match yet
                     if [ -n "${user_uid}" ]; then
                         if [ -z "${FIND}" ]; then
@@ -1562,7 +1563,7 @@
                 done
             else
                 LogText "Performing pgrep scan without uid"
-                FIND=$(${PGREPBINARY:-pgrep} ${pgrep_options} "${search}" | ${TRBINARY} '\n' ' ')
+                FIND=$(${PGREPBINARY:-pgrep} ${pgrep_options} "${search}" | ${TRBINARY:-tr} '\n' ' ')
             fi
         else
             if [ "${SHELL_IS_BUSYBOX}" -eq 1 ]; then
@@ -1862,7 +1863,7 @@
         fi
 
         # Check if we caught some string along all tests
-        if [ ! "${SHORT}" = "" ]; then
+        if [ -n "${SHORT}" ]; then
             # Lowercase and see if we found a match
             SHORT=$(echo ${SHORT} | awk '{ print $1 }' | tr '[:upper:]' '[:lower:]')
 

From 9642bcffc839f4713558f927f4202ce3dd3588fd Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Fri, 27 Mar 2020 11:25:31 +0200
Subject: [PATCH 560/679] [CRYP-7902] Optionally check also certificates
 provided by packages

The package maintainers are not immune to mistakes or they might not
always provide timely updates, so let's check (optionally) more
certificates even if they are delivered by packages.

I found three expired certificates in my Debian/unstable system,
thanks to changed Lynis.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 CHANGELOG.md         | 1 +
 default.prf          | 3 ++-
 include/consts       | 1 +
 include/profiles     | 7 +++++++
 include/tests_crypto | 4 ++--
 5 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 40844409..14d77906 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -95,6 +95,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - BANN-7126 - additional words for login banner are accepted
 - BOOT-5122 - check for defined password in all GRUB configuration files
 - CONT-8106 - support newer 'docker info' output
+- CRYP-7902 - optionally check also certificates provided by packages
 - CRYP-8002 - gather kernel entropy on Linux systems
 - FILE-6310 - support for HP-UX
 - FILE-6374 - changed log and allow root location to be changed
diff --git a/default.prf b/default.prf
index f59e50c2..6ff3eac2 100644
--- a/default.prf
+++ b/default.prf
@@ -93,8 +93,9 @@ skip-plugins=no
 #skip-upgrade-test=yes
 
 # Locations where to search for SSL certificates (separate paths with a colon)
-ssl-certificate-paths=/etc/apache2:/etc/dovecot:/etc/httpd:/etc/letsencrypt:/etc/pki:/etc/postfix:/etc/ssl:/opt/psa/var/certificates:/usr/local/psa/var/certificates:/usr/local/share/ca-certificates:/var/www:/srv/www
+ssl-certificate-paths=/etc/apache2:/etc/dovecot:/etc/httpd:/etc/letsencrypt:/etc/pki:/etc/postfix:/etc/ssl:/opt/psa/var/certificates:/usr/local/psa/var/certificates:/usr/local/share/ca-certificates:/usr/share/ca-certificates:/usr/share/gnupg:/var/www:/srv/www
 ssl-certificate-paths-to-ignore=/etc/letsencrypt/archive:
+ssl-certificate-include-packages=no
 
 # Scan type - how deep the audit should be (light, normal or full)
 test-scan-mode=full
diff --git a/include/consts b/include/consts
index 3969aad5..80548c6b 100644
--- a/include/consts
+++ b/include/consts
@@ -279,6 +279,7 @@ unset LANG
     SNORTBINARY=""
     SSHKEYSCANBINARY=""
     SSHKEYSCANFOUND=0
+    SSL_CERTIFICATE_INCLUDE_PACKAGES=0
     SSL_CERTIFICATE_PATHS=""
     SSL_CERTIFICATE_PATHS_TO_IGNORE=""
     STUNNELBINARY=""
diff --git a/include/profiles b/include/profiles
index 328d4d49..da2124f7 100644
--- a/include/profiles
+++ b/include/profiles
@@ -376,6 +376,13 @@
                     AddSetting "ssl-certificate-paths-to-ignore" "${SSL_CERTIFICATE_PATHS_TO_IGNORE}" "Paths that should be ignored for SSL certificates"
                 ;;
 
+                # Check also certificates provided by packages?
+                ssl-certificate-include-packages)
+                    FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)") && SSL_CERTIFICATE_INCLUDE_PACKAGES=1
+                    Debug "Check also certificates provided by packages set to ${SSL_CERTIFICATE_INCLUDE_PACKAGES}"
+                ;;
+
+
                 # Set strict mode for development and quality purposes
                 strict)
                     FIND=$(echo "${VALUE}" | grep -E "^(1|true|yes)") && SET_STRICT=1
diff --git a/include/tests_crypto b/include/tests_crypto
index 466f6b52..e001bb26 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -74,8 +74,8 @@
                             COUNT_DIR=$((COUNT_DIR + 1))
                             FileIsReadable "${FILE}"
                             if [ ${CANREAD} -eq 1 ]; then
-                                # Only check the files that are not installed by a package
-                                if ! FileInstalledByPackage "${FILE}"; then
+                                # Only check the files that are not installed by a package, unless enabled by profile
+                                if [ ${SSL_CERTIFICATE_INCLUDE_PACKAGES} -eq 1 ] || ! FileInstalledByPackage "${FILE}"; then
                                     OUTPUT=$(${GREPBINARY} -q 'BEGIN CERT' "${FILE}")
                                     if [ $? -eq 0 ]; then
                                         LogText "Result: file is a certificate file"

From 1996b7e0c664bfc331c5de880c843da775525396 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 2 Apr 2020 13:14:51 +0200
Subject: [PATCH 561/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 40844409..cf15b1d8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -129,6 +129,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - PKGS-7388 - only perform check for Debian/Ubuntu/Mint
 - PKGS-7410 - use multiple package managers when available
 - PKGS-7410 - added support for Zypper to test number of kernels
+- PRNT-2308 - check also SSLListen statements
 - PROC-3602 - allow different root directory
 - PROC-3612 - show 'Not found' instead of 'OK'
 - PROC-3614 - show 'Not found' instead of 'OK'

From 4fe1cb92a56f6e008d9bd040f4a0f2c1116fb333 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 2 Apr 2020 13:15:03 +0200
Subject: [PATCH 562/679] [PRNT-2308] check also SSLListen statements

---
 include/tests_printers_spools | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/tests_printers_spools b/include/tests_printers_spools
index 161c9fb3..18c48beb 100644
--- a/include/tests_printers_spools
+++ b/include/tests_printers_spools
@@ -134,13 +134,14 @@
 #
     # Test        : PRNT-2308
     # Description : Check CUPS daemon network configuration
+    # Notes       : Listen and SSLListen can be used
     if [ ${CUPSD_FOUND} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
     Register --test-no PRNT-2308 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check CUPSd network configuration"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
         # Checking network addresses
         LogText "Test: Checking CUPS daemon listening network addresses"
-        FIND=$(${GREPBINARY} "^Listen" ${CUPSD_CONFIG_FILE} | ${GREPBINARY} -v "/" | ${AWKBINARY} '{ print $2 }')
+        FIND=$(${EGREPBINARY} "^(SSL)?Listen" ${CUPSD_CONFIG_FILE} | ${GREPBINARY} -v "/" | ${AWKBINARY} '{ print $2 }')
         COUNT=0
         for ITEM in ${FIND}; do
             LogText "Found network address: ${ITEM}"

From ca6fc134ddee6b408bf1381a4346b15b0791c8ab Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 2 Apr 2020 13:20:06 +0200
Subject: [PATCH 563/679] Renamed spools to spoolers

---
 include/{tests_printers_spools => tests_printers_spoolers} | 0
 lynis                                                      | 2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename include/{tests_printers_spools => tests_printers_spoolers} (100%)

diff --git a/include/tests_printers_spools b/include/tests_printers_spoolers
similarity index 100%
rename from include/tests_printers_spools
rename to include/tests_printers_spoolers
diff --git a/lynis b/lynis
index 12eea7fb..881b8ade 100755
--- a/lynis
+++ b/lynis
@@ -980,7 +980,7 @@ ${NORMAL}
             LogText "Info: perform tests from all categories"
 
             INCLUDE_TESTS="boot_services kernel memory_processes authentication shells \
-                           filesystems usb storage storage_nfs nameservices dns ports_packages networking printers_spools \
+                           filesystems usb storage storage_nfs nameservices dns ports_packages networking printers_spoolers \
                            mail_messaging firewalls webservers ssh snmp databases ldap php squid logging \
                            insecure_services banners scheduling accounting time crypto virtualization containers \
                            mac_frameworks file_integrity tooling malware file_permissions homedirs \

From 6eb204a85d9e48adef4e8c62bbb794830060ac40 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 2 Apr 2020 14:45:44 +0200
Subject: [PATCH 564/679] [PRNT-2308] check for Port statement and minor
 adjustments to test

---
 include/tests_printers_spoolers | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/include/tests_printers_spoolers b/include/tests_printers_spoolers
index 18c48beb..b8435493 100644
--- a/include/tests_printers_spoolers
+++ b/include/tests_printers_spoolers
@@ -144,14 +144,21 @@
         FIND=$(${EGREPBINARY} "^(SSL)?Listen" ${CUPSD_CONFIG_FILE} | ${GREPBINARY} -v "/" | ${AWKBINARY} '{ print $2 }')
         COUNT=0
         for ITEM in ${FIND}; do
-            LogText "Found network address: ${ITEM}"
+            LogText "Result: found network address: ${ITEM}"
             COUNT=$((COUNT + 1))
             FOUND=1
         done
 
-        # Check if daemon is only running on localhost
+        # Search for Port statement
+        FIND=$(${EGREPBINARY} "^Port 631" ${CUPSD_CONFIG_FILE})
+        if [ -n "${FIND}" ]; then
+            LogText "Result: found CUPS listening on port 631 (most likely all interfaces)"
+            FOUND=1
+        fi
+
+        # Check if daemon might be running on localhost
         if [ ${FOUND} -eq 0 ]; then
-            LogText "Result: no listen statement found in CUPS configuration file"
+            LogText "Result: CUPS does not look to be listening on a network port"
         elif [ ${COUNT} -eq 1 ]; then
             if [ "${FIND}" = "localhost:631" -o "${FIND}" = "127.0.0.1:631" ]; then
                 LogText "Result: CUPS daemon only running on localhost"

From 64033da973deb14d7632798904b5f24c06816390 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 2 Apr 2020 14:46:42 +0200
Subject: [PATCH 565/679] Updated log

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cf15b1d8..87873b19 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -129,7 +129,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - PKGS-7388 - only perform check for Debian/Ubuntu/Mint
 - PKGS-7410 - use multiple package managers when available
 - PKGS-7410 - added support for Zypper to test number of kernels
-- PRNT-2308 - check also SSLListen statements
+- PRNT-2308 - check also for Port and SSLListen statements
 - PROC-3602 - allow different root directory
 - PROC-3612 - show 'Not found' instead of 'OK'
 - PROC-3614 - show 'Not found' instead of 'OK'

From 38a5c2cb79bdf56352555f08472b9ea5c77d0e1f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 2 Apr 2020 19:46:58 +0200
Subject: [PATCH 566/679] Added new test PHP-2382

---
 CHANGELOG.md      |  1 +
 db/tests.db       |  1 +
 include/tests_php | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 38 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 87873b19..805a18d7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -62,6 +62,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - New test: INSE-8316 - test for NIS server
 - New test: NETW-2706 - check DNSSEC (systemd)
 - New test: NETW-3200 - determine enabled network protocols
+- New test: PHP-2382 - detect listen option in PHP (FPM)
 - New test: PROC-3802 - check presence of prelink tooling
 - New test: TIME-3180 - report if ntpctl cannot communicate with OpenNTPD
 - New test: TIME-3181 - check status of OpenNTPD time synchronisation
diff --git a/db/tests.db b/db/tests.db
index 48430806..ba9778d1 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -311,6 +311,7 @@ PHP-2374:test:security:php::Check PHP enable_dl option:
 PHP-2376:test:security:php::Check PHP allow_url_fopen option:
 PHP-2378:test:security:php::Check PHP allow_url_include option:
 PHP-2379:test:security:php::Check PHP suhosin extension status:
+PHP-2382:test:security:php::Check PHP listen option:
 PKGS-7301:test:security:ports_packages::Query NetBSD pkg:
 PKGS-7302:test:security:ports_packages::Query FreeBSD/NetBSD pkg_info:
 PKGS-7303:test:security:ports_packages::Query brew package manager:
diff --git a/include/tests_php b/include/tests_php
index a452781a..0f498fff 100644
--- a/include/tests_php
+++ b/include/tests_php
@@ -463,6 +463,42 @@
     #fi
 #
 #################################################################################
+#
+    # Test        : PHP-2382
+    # Description : Check listen option
+    # Background  : https://github.com/CISOfy/lynis/issues/837
+    if [ -n "${PHPINI_ALLFILES}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+    Register --test-no PHP-2382 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP expose_php option"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        FOUND=0
+        for FILE in ${PHPINI_ALLFILES}; do
+            # Don't look at this setting in cli configuration
+            case "${FILE}" in
+                */cli/*)
+                    continue
+                    ;;
+            esac
+            LogText "Test: Checking file ${FILE}"
+            FIND=$(${EGREPBINARY} -i "^listen = [0-9]{1,5}$" ${FILE})
+            if HasData "${FIND}"; then
+                LogText "Result: found listen on just a port number"
+                LogText "Data: ${FIND}"
+                LogText "Note: when possible, limit access to just localhost, so it can't be accessed from outside"
+                FOUND=1
+            fi
+        done
+
+        if [ ${FOUND} -eq 1 ]; then
+            Display --indent 4 --text "- Checking listen option" --result "${STATUS_SUGGESTION}" --color YELLOW
+            #ReportSuggestion "${TEST_NO}" "Limit the listening of FastCGI to just localhost or a local socket" "listen = 127.0.0.1:9000" "-"
+            AddHP 1 3
+        else
+            Display --indent 4 --text "- Checking listen option" --result "${STATUS_OK}" --color GREEN
+            AddHP 2 2
+        fi
+    fi
+#
+#################################################################################
 #
 
 WaitForKeyPress

From 52b72e7b0f8122541f4ffc3757238a6dd0dd6af7 Mon Sep 17 00:00:00 2001
From: Kristian S <kristian.s@outlook.de>
Date: Thu, 2 Apr 2020 21:29:18 +0200
Subject: [PATCH 567/679] extended test KRNL-5830 to detect required reboots on
 Raspbian

---
 CHANGELOG.md         |   1 +
 include/tests_kernel | 102 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 103 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 805a18d7..3d6905a9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -116,6 +116,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - KRNL-5788 - don't complain about missing /vmlinuz for Raspi
 - KRNL-5820 - extended check to include limits.d directory
 - KRNL-5830 - skip test partially when running non-privileged
+- KRNL-5830 - detect required reboots on Raspbian
 - LOGG-2154 - added support for rsyslog configurations
 - LOGG-2190 - skip mysqld related entries
 - MACF-6234 - SELinux tests extended
diff --git a/include/tests_kernel b/include/tests_kernel
index 4948e0dd..3a97ebde 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -31,6 +31,7 @@
     LINUXCONFIGFILE=""
     LINUXCONFIGFILE_ZIPPED=0
     LIMITS_DIRECTORY="${ROOTDIR}etc/security/limits.d"
+    APT_ARCHIVE_DIRECTORY="${ROOTDIR}var/cache/apt/archives"
 #
 #################################################################################
 #
@@ -773,6 +774,107 @@
             LogText "Result: /boot does not exist or not privileged to read files"
         fi
 
+        # Attempt to check for Raspbian if reboot is needed
+        # This check searches for apt package "raspberrypi-kernel-[package-date]", trys to extract the date of packaging from the filename
+        # and compares that date with the currently running kernel's build date (uname -v).
+        # Of course there can be a time difference between kernel build and kernel packaging, therefor a time difference of
+        # 3 days is accepted and it is assumed with only 3 days apart, this must be the same kernel version.
+        if [ ${REBOOT_NEEDED} -eq 2 ] && [ -d "${APT_ARCHIVE_DIRECTORY}" ]; then
+            LogText "Result: found folder ${APT_ARCHIVE_DIRECTORY}; assuming this is a debian based distribution"
+            LogText "Check: try to find raspberrypi-kernel file in ${APT_ARCHIVE_DIRECTORY} and extract package date from file name"
+
+            FOUND_KERNEL_DATE=$(${FINDBINARY} ${APT_ARCHIVE_DIRECTORY} -name "raspberrypi-kernel*" -printf "%T@ %Tc %p\n" 2> /dev/null \
+            | ${SORTBINARY} -nr | ${HEADBINARY} -1 | ${GREPBINARY} -o "raspberrypi-kernel.*deb" | ${EGREPBINARY} -o "\.[0-9]+" | ${SEDBINARY} 's/\.//g')
+
+            if [ -n "${FOUND_KERNEL_DATE}" ]; then
+                FOUND_KERNEL_IN_SECONDS=$(date -d "${FOUND_KERNEL_DATE}" "+%s" 2> /dev/null)
+            else
+                LogText "Result: Skipping this test, as there was no package date to extract"
+            fi
+
+            if [ -n "${FOUND_KERNEL_IN_SECONDS}" ] && [ ${FOUND_KERNEL_IN_SECONDS} -gt 1 ]; then
+                LogText "Result: Got package date: ${FOUND_KERNEL_DATE} (= ${FOUND_KERNEL_IN_SECONDS} seconds)"
+                UNAME_OUTPUT="$(${UNAMEBINARY} -v 2> /dev/null)"
+            else
+                LogText "Result: Skipping this test, as extracting the seconds of package date failed"
+            fi
+            
+            if [ -n "${UNAME_OUTPUT}" ]; then
+                LogText "Result: Got an output from 'uname -v'"
+                LogText "Check: Trying to extract kernel build date from 'uname -v' output"
+                next=""
+                for part in ${UNAME_OUTPUT}; do
+                    if [ -z "$next" ]; then
+                        if [ "${part}" = "Mon" ] || [ "${part}" = "Tue" ] || [ "${part}" = "Wed" ] || [ "${part}" = "Thu" ] || [ "${part}" = "Fri" ] || [ "${part}" = "Sat" ] || [ "${part}" = "Sun" ]; then
+                            next="month"
+                        fi
+                    elif [ "$next" = "month" ]; then
+                        if [ $(${ECHOCMD} "${part}" | ${EGREPBINARY} -c "[A-Z][a-z]") -ge 1 ]; then
+                            UNAME_DATE_MONTH="${part}"
+                            next="day"
+                        fi
+                    elif [ "${next}" = "day" ]; then
+                        if [ $(${ECHOCMD} ${part} | ${EGREPBINARY} -c "[0-9][0-9]") -ge 1 ]; then
+                            UNAME_DATE_DAY="${part}"
+                            next="time"
+                        fi
+                    elif [ "${next}" = "time" ]; then
+                        if [ $(${ECHOCMD} ${part} | ${EGREPBINARY} -c ":[0-9][0-9]:") -ge 1 ]; then
+                            next="year"
+                        fi
+                    elif [ "${next}" = "year" ]; then
+                        if [ $(${ECHOCMD} ${part} | ${EGREPBINARY} -c "[0-9][0-9]") -ge 1 ]; then
+                            UNAME_DATE_YEAR="${part}"
+                            break
+                        fi
+                    fi
+                done
+                if [ -n "${UNAME_DATE_MONTH}" ] && [ -n "${UNAME_DATE_DAY}" ] && [ -n "${UNAME_DATE_YEAR}" ]; then
+                    LogText "Result: Extracted kernel build date is: ${UNAME_DATE_DAY} ${UNAME_DATE_MONTH} ${UNAME_DATE_YEAR}"
+                    UNAME_DATE_IN_SECONDS=$(date -d "${UNAME_DATE_DAY} ${UNAME_DATE_MONTH} ${UNAME_DATE_YEAR}" "+%s" 2> /dev/null)
+                    LogText "Check: Comparing kernel build date in seconds (${UNAME_DATE_IN_SECONDS}s) with package date in seconds (${FOUND_KERNEL_IN_SECONDS}s)"
+                    if [ -n "${UNAME_DATE_IN_SECONDS}" ] && [ ${FOUND_KERNEL_IN_SECONDS} -ge ${UNAME_DATE_IN_SECONDS} ]; then
+                        LogText "Result: package creation date is older than running kernel. Hence, this check should be valid."
+                        LogText "Check if package create date and kernel build date are not more than 3 days apart."
+
+                        SECONDS_APART=$(( ${FOUND_KERNEL_IN_SECONDS} - ${UNAME_DATE_IN_SECONDS} ))
+                        if [ ${SECONDS_APART} -ge 60 ]; then
+                            MINUTES_APART=$(( ${SECONDS_APART} / 60 ))
+                            if [ ${MINUTES_APART} -ge 60 ]; then
+                                DAYS_APART=$(( ${MINUTES_APART} / 60 ))
+                                if [ ${DAYS_APART} -ge 24 ]; then DAYS_APART=$(( ${DAYS_APART} / 24 )); else DAYS_APART=0; fi
+                            else
+                                DAYS_APART=0
+                            fi
+                        else
+                            DAYS_APART=0
+                        fi
+                        # assuming kernels are packaged definitely within 3 days. ACCEPTED_TIME_DIFF needs a value in seconds
+                        ACCEPTED_TIME_DIFF=$((3 * 24 * 60 * 60))
+                        if [ ${FOUND_KERNEL_IN_SECONDS} -le $((${UNAME_DATE_IN_SECONDS} + ${ACCEPTED_TIME_DIFF})) ]; then
+                            LogText "Result: package create date and kernel build date are only ${DAYS_APART} day(s) apart."
+                            LogText "Result: Assuming no reboot needed."
+                            REBOOT_NEEDED=0
+                        else
+                            LogText "Result: package create date and kernel build date are ${DAYS_APART} day(s) apart."
+                            LogText "Result: Assuming reboot is needed."
+                            REBOOT_NEEDED=1
+                        fi
+                    else
+                        LogText "Result: Package's create date is older than running kernel, which is unexpected. Might not be a valid test. Skipping..."
+                    fi
+                else
+                    LogText "Result: Could not extract Day, Month and Year from 'uname -v' output"
+                fi
+            else
+                LogText "Result: Did not get output from 'uname -v'. Skipping test."
+            fi
+                
+            
+        else
+            LogText "Result: /var/cache/apt/archives/ does not exist"
+        fi
+
         # Display discovered status
         if [ ${REBOOT_NEEDED} -eq 0 ]; then
             Display --indent 2 --text "- Check if reboot is needed" --result "${STATUS_NO}" --color GREEN

From 4bcd695428d7fb81e6ab8000a1d906b2e5043a7c Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Thu, 2 Apr 2020 15:59:11 -0500
Subject: [PATCH 568/679] AUTH-9268 Add DragonFly

DragonFly also supports PAM. Rework to use the `--os` option of `Register`
rather than `--preqs-met` as the former can support a list.
---
 include/tests_authentication | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index d005882a..a0402042 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -817,13 +817,8 @@
     # Test        : AUTH-9268
     # Description : Searching available PAM files
     # Notes       : PAM is used on AIX, FreeBSD, Linux, HPUX, NetBSD, Solaris
-    case "${OS}" in
-        "AIX"|"FreeBSD"|"Linux"|"HPUX"|"NetBSD"|"Solaris")
-            PREQS_MET="YES" ;;
-        *)
-            PREQS_MET="NO" ;;
-    esac
-    Register --test-no AUTH-9268 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking presence pam.d files"
+    OS_USES_PAM="AIX DragonFly FreeBSD Linux HPUX NetBSD Solaris"
+    Register --test-no AUTH-9268 --os "${OS_USES_PAM}" --weight L --network NO --category security --description "Checking presence pam.d files"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
         LogText "Test: Searching pam modules"

From 6308682caee9a060e9915c8b85be36ef015ced7c Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Thu, 2 Apr 2020 14:00:23 -0500
Subject: [PATCH 569/679] Combine AUTH-9218 and AUTH-9489

These two tests are essentially identical. There is no need separate
the DragonFly and FreeBSD tests. This will make it easier to add
support for other BSD systems.
---
 db/tests.db                  |  1 -
 include/tests_authentication | 46 +-----------------------------------
 2 files changed, 1 insertion(+), 46 deletions(-)

diff --git a/db/tests.db b/db/tests.db
index 48430806..6f1b9974 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -49,7 +49,6 @@ AUTH-9406:test:security:authentication::Query LDAP servers in client configurati
 AUTH-9408:test:security:authentication::Logging of failed login attempts via /etc/login.defs:
 AUTH-9409:test:security:authentication:OpenBSD:Check for doas file:
 AUTH-9410:test:security:authentication:OpenBSD:Check for doas file permissions:
-AUTH-9489:test:security:authentication:DragonFly:Check login shells for passwordless accounts:
 BANN-7113:test:security:banners:FreeBSD:Check COPYRIGHT banner file:
 BANN-7124:test:security:banners::Check issue banner file:
 BANN-7126:test:security:banners::Check issue banner file contents:
diff --git a/include/tests_authentication b/include/tests_authentication
index d005882a..74389ad8 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -157,51 +157,7 @@
     # Test        : AUTH-9218
     # Description : Check login shells for passwordless accounts
     # Notes       : Results should be checked
-    Register --test-no AUTH-9218 --os FreeBSD --weight L --network NO --category security --description "Check login shells for passwordless accounts"
-    if [ ${SKIPTEST} -eq 0 ]; then
-        FOUND=0
-        LogText "Test: Checking login shells"
-        if [ -f ${ROOTDIR}etc/master.passwd ]; then
-            # Check for all shells, except: (/usr)/sbin/nologin /nonexistent
-            FIND=$(${GREPBINARY} "[a-z]:\*:" /etc/master.passwd | ${EGREPBINARY} -v '^#|/sbin/nologin|/usr/sbin/nologin|/nonexistent' | ${SEDBINARY} 's/ /!space!/g')
-            if [ "${FIND}" = "" ]; then
-                Display --indent 2 --text "- Login shells" --result "${STATUS_OK}" --color GREEN
-            else
-                Display --indent 2 --text "- Login shells" --result "${STATUS_WARNING}" --color RED
-                for LINE in ${FIND}; do
-                    LINE=$(echo ${LINE} | ${SEDBINARY} 's/!space!/ /g')
-                    SHELL=$(echo ${LINE} | ${AWKBINARY} -F: '{ print $10 }')
-                    LogText "Output: ${LINE}"
-                    if [ -z "${SHELL}" ]; then
-                        LogText "Result: found no shell on line"
-                    else
-                        LogText "Result: found possible harmful shell ${SHELL}"
-                        if [ -f ${SHELL} ]; then
-                            LogText "Result: shell ${SHELL} does exist"
-                            FOUND=1
-                        else
-                            LogText "Result: shell ${SHELL} does not exist"
-                            ReportSuggestion "${TEST_NO}" "Determine if account is needed, as shell ${SHELL} does not exist"
-                        fi
-                    fi
-                done
-                if [ ${FOUND} -eq 1 ]; then
-                    ReportWarning "${TEST_NO}" "Possible harmful shell found (for passwordless account!)"
-                fi
-            fi
-          else
-            Display --indent 2 --text "- Login shells" --result "${STATUS_SKIPPED}" --color WHITE
-            LogText "Result: No /etc/master.passwd file found"
-        fi
-        unset LINE SHELL
-    fi
-#
-#################################################################################
-#
-    # Test        : AUTH-9489
-    # Description : Check login shells for passwordless accounts
-    # Notes       : Results should be checked
-    Register --test-no AUTH-9489 --os DragonFly --weight L --network NO --category security --description "Check login shells for passwordless accounts"
+    Register --test-no AUTH-9218 --os "DragonFly FreeBSD"  --weight L --network NO --category security --description "Check login shells for passwordless accounts"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
         LogText "Test: Checking login shells"

From 50a60fed876d13cecb9c61d18d8b7ead93a88043 Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Thu, 2 Apr 2020 14:37:31 -0500
Subject: [PATCH 570/679] AUTH-9218 add requires root

The `/etc/master.passwd` file on BSD systems is (or should be) read/write
root only. Skip the test if not being run as root.
---
 include/tests_authentication | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 74389ad8..8099eb0c 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -157,7 +157,7 @@
     # Test        : AUTH-9218
     # Description : Check login shells for passwordless accounts
     # Notes       : Results should be checked
-    Register --test-no AUTH-9218 --os "DragonFly FreeBSD"  --weight L --network NO --category security --description "Check login shells for passwordless accounts"
+    Register --test-no AUTH-9218 --os "DragonFly FreeBSD" --root-only YES --weight L --network NO --category security --description "Check login shells for passwordless accounts"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
         LogText "Test: Checking login shells"

From ac7ad92f227c5302ef46bee7d34fbf07dcf364b7 Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Thu, 2 Apr 2020 14:48:41 -0500
Subject: [PATCH 571/679] AUTH-9218 add NetBSD and OpenBSD

All of the BSDs have `/etc/master.passwd`.
---
 include/tests_authentication | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 8099eb0c..41b47955 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -157,7 +157,7 @@
     # Test        : AUTH-9218
     # Description : Check login shells for passwordless accounts
     # Notes       : Results should be checked
-    Register --test-no AUTH-9218 --os "DragonFly FreeBSD" --root-only YES --weight L --network NO --category security --description "Check login shells for passwordless accounts"
+    Register --test-no AUTH-9218 --os "DragonFly FreeBSD NetBSD OpenBSD" --root-only YES --weight L --network NO --category security --description "Check login shells for passwordless accounts"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
         LogText "Test: Checking login shells"

From ddb7ff1762c103516d568fc9a04c86a59b5385d6 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 3 Apr 2020 09:37:52 +0200
Subject: [PATCH 572/679] [NETW-2706] redirect errors to stderr

---
 include/tests_networking | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_networking b/include/tests_networking
index b182f605..ebca4ee2 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -197,7 +197,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         SKIP=0
         if [ -n "${RESOLVECTLBINARY}" ]; then
-	    DNSSEC_STATUS=$(${RESOLVECTLBINARY} statistics | ${AWKBINARY} -F ":" '/DNSSEC supported/ { print $2 }' | ${TRBINARY} -d ' ')
+            DNSSEC_STATUS=$(${RESOLVECTLBINARY} statistics 2> /dev/null | ${AWKBINARY} -F ":" '/DNSSEC supported/ { print $2 }' | ${TRBINARY} -d ' ')
             if [ "${DNSSEC_STATUS}" = "yes" ]; then
                 Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_OK}" --color GREEN
                 LogText "Result: DNSSEC supported by systemd-resolved and upstream DNS servers"

From f25ffdbb1f2402a8aa896882be0a79fd2da763ae Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 3 Apr 2020 09:37:52 +0200
Subject: [PATCH 573/679] [NETW-2706] redirect errors to stderr

---
 include/tests_networking | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_networking b/include/tests_networking
index b182f605..ebca4ee2 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -197,7 +197,7 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         SKIP=0
         if [ -n "${RESOLVECTLBINARY}" ]; then
-	    DNSSEC_STATUS=$(${RESOLVECTLBINARY} statistics | ${AWKBINARY} -F ":" '/DNSSEC supported/ { print $2 }' | ${TRBINARY} -d ' ')
+            DNSSEC_STATUS=$(${RESOLVECTLBINARY} statistics 2> /dev/null | ${AWKBINARY} -F ":" '/DNSSEC supported/ { print $2 }' | ${TRBINARY} -d ' ')
             if [ "${DNSSEC_STATUS}" = "yes" ]; then
                 Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_OK}" --color GREEN
                 LogText "Result: DNSSEC supported by systemd-resolved and upstream DNS servers"

From e2ad71ffe5907dcce88ca3511b8db904b82b574c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 3 Apr 2020 09:46:56 +0200
Subject: [PATCH 574/679] Updated log

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 805a18d7..49c72a2d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -90,7 +90,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - AUTH-9234 - NetBSD support
 - AUTH-9252 - corrected permission check
 - AUTH-9266 - skip .pam-old files in /etc/pam.d
-- AUTH-9268 - Perform test also on FreeBSD and NetBSD
+- AUTH-9268 - Perform test also on DragonFly, FreeBSD, and NetBSD
 - AUTH-9282 - fix: temporary variable was overwritten
 - AUTH-9408 - added support for pam_tally2 to log failed logins
 - BANN-7126 - additional words for login banner are accepted

From 235dbd38058c3c4e7bf34b7f1d7e61712860b9e4 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 3 Apr 2020 09:50:03 +0200
Subject: [PATCH 575/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 49c72a2d..ffa6ba4f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -93,6 +93,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - AUTH-9268 - Perform test also on DragonFly, FreeBSD, and NetBSD
 - AUTH-9282 - fix: temporary variable was overwritten
 - AUTH-9408 - added support for pam_tally2 to log failed logins
+- AUTH-9489 - test removedd as it is merged with AUTH-9218
 - BANN-7126 - additional words for login banner are accepted
 - BOOT-5122 - check for defined password in all GRUB configuration files
 - CONT-8106 - support newer 'docker info' output

From 4680f94d11961269d3f944e1365e270e4ef9587c Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 3 Apr 2020 14:02:52 +0200
Subject: [PATCH 576/679] [NETW-2706] allow usage of systemd-resolve and
 resolvectl, improved screen output and logging

---
 include/tests_networking | 37 +++++++++++++++++++++++--------------
 1 file changed, 23 insertions(+), 14 deletions(-)

diff --git a/include/tests_networking b/include/tests_networking
index ebca4ee2..485a2238 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -191,23 +191,32 @@
 #################################################################################
 #
     # Test        : NETW-2706
-    # Description : Check systemd-resolved and upstream DNSSEC status
-    if [ -n "${RESOLVECTLBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no NETW-2706 --preqs-met ${PREQS_MET} --weight L --network YES --category security --description "Check systemd-resolved and upstream DNSSEC status"
+    # Description : Check systemd-resolve output and upstream DNSSEC status
+    # Notes       : Ubuntu 16.04 uses systemd-resolve, newer ones most likely resolvectl
+    if [ -n "${RESOLVECTLBINARY}" ]; then
+        PREQS_MET="YES"
+        RESOLVE_CMD="${RESOLVECTLBINARY}"
+        RESOLVE_CMD_PARAM="statistics"
+    elif [ -n "$(command -v systemd-resolve 2> /dev/null)" ]; then
+        PREQS_MET="YES"
+        RESOLVE_CMD="$(command -v systemd-resolve 2> /dev/null)"
+        RESOLVE_CMD_PARAM="--statistics"
+    else
+        PREQS_MET="NO"
+    fi
+    Register --test-no NETW-2706 --preqs-met "${PREQS_MET}" --weight L --network YES --category security --description "Check systemd-resolved and upstream DNSSEC status"
     if [ ${SKIPTEST} -eq 0 ]; then
         SKIP=0
-        if [ -n "${RESOLVECTLBINARY}" ]; then
-            DNSSEC_STATUS=$(${RESOLVECTLBINARY} statistics 2> /dev/null | ${AWKBINARY} -F ":" '/DNSSEC supported/ { print $2 }' | ${TRBINARY} -d ' ')
-            if [ "${DNSSEC_STATUS}" = "yes" ]; then
-                Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_OK}" --color GREEN
-                LogText "Result: DNSSEC supported by systemd-resolved and upstream DNS servers"
-            else
-                Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_WARNING}" --color RED
-                LogText "Result: DNSSEC not supported by systemd-resolved or upstream DNS servers"
-            fi
+        DNSSEC_STATUS=$(${RESOLVE_CMD} ${RESOLVE_CMD_PARAM} 2> /dev/null | ${AWKBINARY} -F ":" '/DNSSEC supported/ { print $2 }' | ${TRBINARY} -d ' ')
+        if [ "${DNSSEC_STATUS}" = "yes" ]; then
+            Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_YES}" --color GREEN
+            LogText "Result: DNSSEC supported by systemd-resolved and upstream DNS servers"
+        elif [ "${DNSSEC_STATUS}" = "no" ]; then
+            Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_NO}" --color YELLOW
+            LogText "Result: DNSSEC not supported by systemd-resolved or upstream DNS servers"
         else
-            Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_SKIPPED}" --color YELLOW
-            LogText "Result: resolvectl not installed, test can't be fully performed"
+            Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_UNKNOWN}" --color RED
+            LogText "Result: command '${RESOLVE_CMD} ${RESOLVE_CMD_PARAM}' returned an error. Please run command manually to check for details."
         fi
     else
         LogText "Result: Test most likely skipped due to not having resolvectl"

From 032bb6988e7b94415cbe202dd26177e94803859f Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 4 Apr 2020 15:28:04 +0200
Subject: [PATCH 577/679] Added new test NETW-2400

---
 CHANGELOG.md             |  1 +
 db/tests.db              |  1 +
 include/tests_networking | 48 +++++++++++++++++++++++++++++++++++++++-
 3 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ffa6ba4f..fd54bf19 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -60,6 +60,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - New test: FINT-4341 - verify status of dm-verity (Linux)
 - New test: INSE-8314 - test for NIS client
 - New test: INSE-8316 - test for NIS server
+- New test: NETW-2400 - test hostname for valid characters and length
 - New test: NETW-2706 - check DNSSEC (systemd)
 - New test: NETW-3200 - determine enabled network protocols
 - New test: PHP-2382 - detect listen option in PHP (FPM)
diff --git a/db/tests.db b/db/tests.db
index 26960c00..62857946 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -287,6 +287,7 @@ NAME-4402:test:security:nameservices::Check duplicate line in /etc/hosts:
 NAME-4404:test:security:nameservices::Check /etc/hosts contains an entry for this server name:
 NAME-4406:test:security:nameservices::Check server hostname mapping:
 NAME-4408:test:security:nameservices::Check localhost to IP mapping:
+NETW-2400:test:basics:networking::Test hostname for valid characters and length:
 NETW-2600:test:security:networking:Linux:Checking IPv6 configuration:
 NETW-2704:test:security:networking::Basic nameserver configuration tests:
 NETW-2705:test:security:networking::Check availability two nameservers:
diff --git a/include/tests_networking b/include/tests_networking
index 485a2238..ea326ce0 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -34,6 +34,53 @@
     InsertSection "Networking"
 #
 #################################################################################
+#
+    # Test        : NETW-2400
+    # Description : Test hostname for valid characters and length
+    # Notes       : FQDN: max 253 characters
+    #             : component: a-z, 0-9, hyphen, not start with hyphen, max 63 characters
+    #               dots allowed as separator
+    Register --test-no NETW-2400 --weight L --network YES --category basics --description "Hostname length and value check"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        # Test first the fully qualified domain name
+        if [ ${#FQDN} -gt 253 ]; then
+            # Too long
+            LogText "Result: FQDN is more than 253 characters"
+            Display --indent 2 --text "- Hostname (FQDN length)" --result "${STATUS_WARNING}" --color RED
+            ReportWarning "${TEST_NO}" "Hostname is too long (more than 253 characters)"
+        elif [ ${#FQDN} -eq 0 ]; then
+            # FQDN not defined
+            LogText "Result: FQDN is not defined"
+            if IsVerbose; then Display --indent 2 --text "- Hostname (FQDN length)" --result "${STATUS_UNKNOWN}" --color YELLOW; fi
+        else
+            # Fine
+            LogText "Result: FQDN is defined and shorter than 253 characters (${#FQDN} characters)"
+            if IsVerbose; then Display --indent 2 --text "- Hostname (FQDN length)" --result "${STATUS_OK}" --color GREEN; fi
+        fi
+        # Now test short hostname
+        if [ ${#HOSTNAME} -eq 0 ]; then
+            if IsVerbose; then Display --indent 2 --text "- Hostname (FQDN length)" --result "${STATUS_NONE}" --color RED; fi
+            LogText "Result: hostname is not defined"
+        else
+            # Test length
+            if [ ${#HOSTNAME} -gt 63 ]; then
+                LogText "Result: hostname is more than 63 characters"
+                Display --indent 2 --text "- Hostname (length)" --result "${STATUS_WARNING}" --color RED
+            fi
+            # Test valid characters (normally a dot should not be in the name, but we can't be 100% sure we have short name)
+            FIND=$(echo "${HOSTNAME}" | ${TRBINARY} -d '[a-z0-9\.\-]')
+            if [ -z "${FIND}" ]; then
+                LogText "Result: good, no unexpected characters discovered in hostname"
+                if IsVerbose; then Display --indent 2 --text "- Hostname (allowed characters)" --result "${STATUS_OK}" --color GREEN; fi
+            else
+                LogText "Result: unexpected characters discovered in hostname (characters: ${FIND}), which may impact network connectivity"
+                Display --indent 2 --text "- Hostname (allowed characters)" --result "${STATUS_WARNING}" --color RED
+                ReportWarning "${TEST_NO}" "Hostname contains invalid characters" "hostname" "text:See log file for invalid characters"
+            fi
+        fi
+    fi
+#
+#################################################################################
 #
     # Test        : NETW-2600
     # Description : Gather IPv6 configuration
@@ -736,7 +783,6 @@
 #################################################################################
 #
 
-
 WaitForKeyPress
 
 #

From 9da066592962fd6a6c1eb05d3231d7c3d077fc33 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 4 Apr 2020 15:56:00 +0200
Subject: [PATCH 578/679] [NETW-2400] Improved logging

---
 include/tests_networking | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/tests_networking b/include/tests_networking
index ea326ce0..83a7aae0 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -54,7 +54,7 @@
             if IsVerbose; then Display --indent 2 --text "- Hostname (FQDN length)" --result "${STATUS_UNKNOWN}" --color YELLOW; fi
         else
             # Fine
-            LogText "Result: FQDN is defined and shorter than 253 characters (${#FQDN} characters)"
+            LogText "Result: FQDN is defined and not longer than 253 characters (${#FQDN} characters)"
             if IsVerbose; then Display --indent 2 --text "- Hostname (FQDN length)" --result "${STATUS_OK}" --color GREEN; fi
         fi
         # Now test short hostname
@@ -66,6 +66,8 @@
             if [ ${#HOSTNAME} -gt 63 ]; then
                 LogText "Result: hostname is more than 63 characters"
                 Display --indent 2 --text "- Hostname (length)" --result "${STATUS_WARNING}" --color RED
+            else
+                LogText "Result: hostnamed is defined and not longer than 63 characters"
             fi
             # Test valid characters (normally a dot should not be in the name, but we can't be 100% sure we have short name)
             FIND=$(echo "${HOSTNAME}" | ${TRBINARY} -d '[a-z0-9\.\-]')

From 49549f9155510442712711a6b2d0390ece24ccbc Mon Sep 17 00:00:00 2001
From: 0xD503 <ElectricalBrain@protonmail.com>
Date: Sun, 5 Apr 2020 22:01:29 +0100
Subject: [PATCH 579/679] Added Russian translation

Added Russian localization
---
 db/languages/ru | 76 ++++++++++++++++++++++++-------------------------
 1 file changed, 38 insertions(+), 38 deletions(-)

diff --git a/db/languages/ru b/db/languages/ru
index e16f1062..5153a319 100644
--- a/db/languages/ru
+++ b/db/languages/ru
@@ -1,38 +1,38 @@
-GEN_CHECKING="Checking"
-GEN_CURRENT_VERSION="Current version"
-GEN_DEBUG_MODE="Debug mode"
-GEN_INITIALIZE_PROGRAM="Initializing program"
-GEN_PHASE="phase"
-GEN_PLUGINS_ENABLED="Plugins enabled"
-GEN_VERBOSE_MODE="Verbose mode"
-GEN_UPDATE_AVAILABLE="update available"
-GEN_WHAT_TO_DO="What to do"
-NOTE_EXCEPTIONS_FOUND="Exceptions found"
-NOTE_EXCEPTIONS_FOUND_DETAILED="Some exceptional events or information was found"
-NOTE_PLUGINS_TAKE_TIME="Note: plugins have more extensive tests and may take several minutes to complete"
-SECTION_CUSTOM_TESTS="Custom Tests"
-SECTION_MALWARE="Malware"
-SECTION_MEMORY_AND_PROCESSES="Memory and Processes"
-STATUS_DONE="DONE"
-STATUS_FOUND="FOUND"
-STATUS_YES="YES"
-STATUS_NO="NO"
-STATUS_OFF="OFF"
-STATUS_OK="OK"
-STATUS_ON="ON"
-STATUS_NONE="NONE"
-STATUS_NOT_FOUND="NOT FOUND"
-STATUS_NOT_RUNNING="NOT RUNNING"
-STATUS_RUNNING="RUNNING"
-STATUS_SKIPPED="SKIPPED"
-STATUS_SUGGESTION="SUGGESTION"
-STATUS_UNKNOWN="UNKNOWN"
-STATUS_WARNING="WARNING"
-TEXT_YOU_CAN_HELP_LOGFILE="You can help by providing your log file"
-TEXT_UPDATE_AVAILABLE="update available"
-NOTE_SKIPPED_TESTS_NON_PRIVILEGED="Skipped tests due to non-privileged mode"
-STATUS_DISABLED="DISABLED"
-STATUS_ENABLED="ENABLED"
-STATUS_ERROR="ERROR"
-ERROR_NO_LICENSE="No license key configured"
-ERROR_NO_UPLOAD_SERVER="No upload server configured"
+GEN_CHECKING="Проверка"
+GEN_CURRENT_VERSION="Текущая версия"
+GEN_DEBUG_MODE="Режим отладки"
+GEN_INITIALIZE_PROGRAM="Инициализация программы"
+GEN_PHASE="Стадия"
+GEN_PLUGINS_ENABLED="Плагины включены"
+GEN_VERBOSE_MODE="Подробный режим"
+GEN_UPDATE_AVAILABLE="доступно обновление"
+GEN_WHAT_TO_DO="Что сделать"
+NOTE_EXCEPTIONS_FOUND="Найдены исключения"
+NOTE_EXCEPTIONS_FOUND_DETAILED="Были найдены некоторые исключительные события или информация"
+NOTE_PLUGINS_TAKE_TIME="Примечание: плагины имеют более обширные тесты и могут занять несколько минут до завершения"
+SECTION_CUSTOM_TESTS="Пользовательские тесты"
+SECTION_MALWARE="Вредоносное ПО"
+SECTION_MEMORY_AND_PROCESSES="Память и процессы"
+STATUS_DONE="Завершено"
+STATUS_FOUND="Найдено"
+STATUS_YES="ДА"
+STATUS_NO="НЕТ"
+STATUS_OFF="Выключено"
+STATUS_OK="ОК"
+STATUS_ON="Включено"
+STATUS_NONE="Отсутствует"
+STATUS_NOT_FOUND="НЕ НАЙДЕНО"
+STATUS_NOT_RUNNING="НЕ ЗАПУЩЕНО"
+STATUS_RUNNING="ЗАПУЩЕНО"
+STATUS_SKIPPED="ПРОПУЩЕНО"
+STATUS_SUGGESTION="ПРЕДЛОЖЕНИЕ"
+STATUS_UNKNOWN="НЕИЗВЕСТНО"
+STATUS_WARNING="ПРЕДУПРЕЖДЕНИЕ"
+TEXT_YOU_CAN_HELP_LOGFILE="Вы можете помочь предоставив ваш лог-файл"
+TEXT_UPDATE_AVAILABLE="доступно обновление"
+NOTE_SKIPPED_TESTS_NON_PRIVILEGED="Тесты пропущены из-за использования непривилегированного режима"
+STATUS_DISABLED="ОТКЛЮЧЕНО"
+STATUS_ENABLED="ВКЛЮЧЕНО"
+STATUS_ERROR="ОШИБКА"
+ERROR_NO_LICENSE="Лицензионный ключ не настроен"
+ERROR_NO_UPLOAD_SERVER="Загрузочный сервер не настроен"

From 798f5322f6908c80fb356b5022ce99012938e42b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 6 Apr 2020 16:23:31 +0200
Subject: [PATCH 580/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fd54bf19..3edd55cc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -78,6 +78,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - Added end-of-life data for Arch Linux and Debian
 - Detection and end-of-life data added for Amazon Linux
 - Detection of linux-lts on Arch Linux
+- Translations: Russian added
 
 ### Changed
 - Function: CheckItem() now returns only exit code (ITEM_FOUND is dropped)

From c368846a08d12901e7de43b525d3e055c7f67508 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 6 Apr 2020 20:47:45 +0200
Subject: [PATCH 581/679] Added support to require a detected and known package
 manager

---
 CHANGELOG.md                    |  1 +
 include/consts                  |  3 +++
 include/functions               | 27 ++++++++++++++++++++++++---
 include/tests_insecure_services | 22 +++++++++++-----------
 lynis                           | 11 +++++++++++
 5 files changed, 50 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3edd55cc..f21bd306 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -159,6 +159,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - Several code cleanups, simplification of commands, and code standardization
 - Tests using lsof may ignore individual threads (if supported)
 - Corrected end-of-life detection for CentOS 7 and CentOS 8
+- Tests can require detected package manager (--package-manager-required)
 - Do not show tool tips when quiet option is used
 - Improved screen output in several tests
 - Extended output of 'lynis update info'
diff --git a/include/consts b/include/consts
index 3969aad5..c1f65ea2 100644
--- a/include/consts
+++ b/include/consts
@@ -125,6 +125,7 @@ unset LANG
     GRSEC_FOUND=0
     GRUBCONFFILE=""
     GRUB2INSTALLBINARY=""
+    HAS_PACKAGE_MANAGER=0
     HAS_SYSTEMD=0
     HEADBINARY=""
     HELPER=""
@@ -222,6 +223,7 @@ unset LANG
     PGREPBINARY=""
     PIDFILE=""
     PKG_BINARY=""
+    PKGINFOBINARY=""
     PKGADMINBINARY=""
     PLUGINDIR=""
     PLUGIN_PHASE=0
@@ -324,6 +326,7 @@ unset LANG
     VULNERABLE_PACKAGES_FOUND=0
     WCBINARY=""
     XARGSBINARY=""
+    XBPSBINARY=""
     YUMBINARY=""
     ZYPPERBINARY=""
 
diff --git a/include/functions b/include/functions
index 492ade27..58ddabe9 100644
--- a/include/functions
+++ b/include/functions
@@ -2019,6 +2019,7 @@
     PackageIsInstalled() {
         exit_code=255
 
+        # First parameter is package name (or __dummy__ for initial test to see if package manager is available and works as expected)
         if [ $# -eq 1 ]; then
             package="$1"
         else
@@ -2056,7 +2057,21 @@
             output=$(${XBPSBINARY} ${package} 2> /dev/null | ${GREPBINARY} "^ii")
             exit_code=$?
         else
-            ReportException "PackageIsInstalled:01"
+            if [ "${package}" != "__dummy__" ]; then
+                ReportException "PackageIsInstalled:01 (test=${TEST_NO:-unknown})"
+            fi
+        fi
+
+        # Give thumbs up if dummy package is used during initial test for package manager availability
+        if [ "${package}" = "__dummy__" ]; then
+            # There should be no positive match on this dummy package
+            if [ ${exit_code} -eq 0 ]; then
+                exit_code=1
+            elif [ ${exit_code} -eq 255 ]; then
+                exit_code=1
+            else
+                exit_code=0
+            fi
         fi
 
         return ${exit_code}
@@ -2499,8 +2514,8 @@
     Register() {
         # Do not insert a log break, if previous test was not logged
         if [ ${SKIPLOGTEST} -eq 0 ]; then LogTextBreak; fi
-        ROOT_ONLY=0; SKIPTEST=0; SKIPLOGTEST=0; SKIPREASON=""; TEST_NEED_OS=""; PREQS_MET=""
-        TEST_CATEGORY=""; TEST_NEED_NETWORK=""; TEST_NEED_PLATFORM=""
+        ROOT_ONLY=0; SKIPTEST=0; SKIPLOGTEST=0; SKIPREASON=""; PREQS_MET=""
+        TEST_CATEGORY=""; TEST_NEED_NETWORK=""; TEST_NEED_OS=""; TEST_NEED_PKG_MGR=0; TEST_NEED_PLATFORM=""
         TOTAL_TESTS=$((TOTAL_TESTS + 1))
         while [ $# -ge 1 ]; do
             case $1 in
@@ -2524,6 +2539,9 @@
                     shift
                     TEST_NEED_OS=$1
                 ;;
+                --package-manager-required)
+                    TEST_NEED_PKG_MGR=1
+                ;;
                 --preqs-met)
                     shift
                     PREQS_MET=$1
@@ -2636,6 +2654,9 @@
         # Check for correct hardware platform
         if [ ${SKIPTEST} -eq 0 -a -n "${TEST_NEED_PLATFORM}" -a ! "${HARDWARE}" = "${TEST_NEED_PLATFORM}" ]; then SKIPTEST=1; SKIPREASON="Incorrect hardware platform"; fi
 
+        # Check for required (and discovered) package manager
+        if [ ${SKIPTEST} -eq 0 -a ${TEST_NEED_PKG_MGR} -eq 1 -a ${HAS_PACKAGE_MANAGER} -eq 0 ]; then SKIPTEST=1; SKIPREASON="Requires a known package manager to test presence of a particular package"; fi
+
         # Not all prerequisites met, like missing tool
         if [ ${SKIPTEST} -eq 0 -a "${PREQS_MET}" = "NO" ]; then SKIPTEST=1; if [ -z "${SKIPREASON}" ]; then SKIPREASON="Prerequisites not met (ie missing tool, other type of Linux distribution)"; fi; fi
 
diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index 3bc8dfdf..5c8af1fc 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -37,7 +37,7 @@
 #
     # Test        : INSE-8000
     # Description : Check for installed inetd package
-    Register --test-no INSE-8000 --weight L --network NO --category security --description "Installed inetd package"
+    Register --test-no INSE-8000 --package-manager-required --weight L --network NO --category security --description "Installed inetd package"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check for installed inetd daemon
         LogText "Test: Checking if inetd is installed"
@@ -134,7 +134,7 @@
 #
     # Test        : INSE-8100
     # Description : Check for installed xinetd daemon
-    Register --test-no INSE-8100 --weight L --network NO --category security --description "Check for installed xinetd daemon"
+    Register --test-no INSE-8100 --package-manager-required --weight L --network NO --category security --description "Check for installed xinetd daemon"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check for installed xinetd daemon
         LogText "Test: Checking for installed xinetd daemon"
@@ -250,7 +250,7 @@
     # Test        : INSE-8200
     # Description : Check if tcp_wrappers is installed when inetd/xinetd is active
     if [ ${INETD_ACTIVE} -eq 1 -o ${XINETD_ACTIVE} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no INSE-8200 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check if tcp_wrappers is installed when inetd/xinetd is active"
+    Register --test-no INSE-8200 --package-manager-required --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check if tcp_wrappers is installed when inetd/xinetd is active"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking if tcp_wrappers is installed"
         FOUND=0
@@ -272,7 +272,7 @@
 #
     # Test        : INSE-8300
     # Description : Check if rsh client is installed
-    Register --test-no INSE-8300 --weight L --network NO --category security --description "Check if rsh client is installed"
+    Register --test-no INSE-8300 --package-manager-required --weight L --network NO --category security --description "Check if rsh client is installed"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking if rsh client is installed"
         FOUND=0
@@ -328,7 +328,7 @@
 #
     # Test        : INSE-8304
     # Description : Check if rsh server is installed
-    Register --test-no INSE-8304 --weight L --network NO --category security --description "Check if rsh server is installed"
+    Register --test-no INSE-8304 --package-manager-required --weight L --network NO --category security --description "Check if rsh server is installed"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if rsh server is installed
         LogText "Test: Checking if rsh server is installed"
@@ -352,7 +352,7 @@
 #
     # Test        : INSE-8310
     # Description : Check if telnet client is installed
-    Register --test-no INSE-8310 --weight L --network NO --category security --description "Check if telnet client is installed"
+    Register --test-no INSE-8310 --package-manager-required --weight L --network NO --category security --description "Check if telnet client is installed"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if telnet client is installed
         LogText "Test: Checking if telnet client is installed"
@@ -373,7 +373,7 @@
 #
     # Test        : INSE-8312
     # Description : Check if telnet server is installed
-    Register --test-no INSE-8322 --weight L --network NO --category security --description "Check if telnet server is installed"
+    Register --test-no INSE-8322 --package-manager-required --weight L --network NO --category security --description "Check if telnet server is installed"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Check if TFTP server is installed
         LogText "Test: Checking if telnet server is installed"
@@ -398,7 +398,7 @@
 #
     # Test        : INSE-8314
     # Description : Check if NIS client is installed
-    Register --test-no INSE-8314 --weight L --network NO --category security --description "Check if NIS client is installed"
+    Register --test-no INSE-8314 --package-manager-required --weight L --network NO --category security --description "Check if NIS client is installed"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=""
         LogText "Test: Checking if NIS client is installed"
@@ -422,7 +422,7 @@
 #
     # Test        : INSE-8316
     # Description : Check if NIS server is installed
-    Register --test-no INSE-8316 --weight L --network NO --category security --description "Check if NIS server is installed"
+    Register --test-no INSE-8316 --package-manager-required --weight L --network NO --category security --description "Check if NIS server is installed"
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=""
         LogText "Test: Checking if NIS server is installed"
@@ -446,7 +446,7 @@
 #
     # Test        : INSE-8318
     # Description : Check if TFTP client is installed
-    Register --test-no INSE-8318 --weight L --network NO --category security --description "Check if TFTP client is installed"
+    Register --test-no INSE-8318 --package-manager-required --weight L --network NO --category security --description "Check if TFTP client is installed"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking if TFTP client is installed"
         FOUND=""
@@ -470,7 +470,7 @@
 #
     # Test        : INSE-8320
     # Description : Check if TFTP server is installed
-    Register --test-no INSE-8320 --weight L --network NO --category security --description "Check if TFTP server is installed"
+    Register --test-no INSE-8320 --package-manager-required --weight L --network NO --category security --description "Check if TFTP server is installed"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking if TFTP server is installed"
         FOUND=""
diff --git a/lynis b/lynis
index 881b8ade..d5dca003 100755
--- a/lynis
+++ b/lynis
@@ -524,6 +524,7 @@ ${NORMAL}
     if [ "${OS}" = "Linux" -a "${HOSTNAME}" = "${FQDN}" ]; then
         FQDN=$(hostname -f 2> /dev/null)
     fi
+
 #
 #################################################################################
 #
@@ -568,6 +569,7 @@ ${NORMAL}
     fi
     Report "test_category=${TEST_CATEGORY_TO_CHECK}"
     Report "test_group=${TEST_GROUP_TO_CHECK}"
+
 #
 #################################################################################
 #
@@ -630,6 +632,7 @@ ${NORMAL}
         echo "Make sure to execute ${PROGRAM_NAME} from untarred directory or check your installation."
         exit 1
     fi
+
 #
 #################################################################################
 #
@@ -817,6 +820,14 @@ ${NORMAL}
 #
 #################################################################################
 #
+    # Test if we have a package manager available by testing for a dummy package (should not exist)
+    if PackageIsInstalled "__dummy__"; then
+        HAS_PACKAGE_MANAGER=1
+        LogText "Informational: package manager is used"
+    else
+        LogText "Informational: no known package manager for this system"
+    fi
+
     # Use hardware detection capabilities
     IsVirtualMachine
     if IsContainer; then

From be75a089a740b3dad7c1bc720922a59926b37f27 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 7 Apr 2020 10:53:39 +0200
Subject: [PATCH 582/679] [PROC-3802] added package manager routine as
 dependency

---
 include/tests_memory_processes | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_memory_processes b/include/tests_memory_processes
index 65473cf4..2454f320 100644
--- a/include/tests_memory_processes
+++ b/include/tests_memory_processes
@@ -118,7 +118,7 @@
 #
     # Test        : PROC-3802
     # Description : Check presence of prelink tooling
-    Register --test-no PROC-3802 --os Linux --weight L --network NO --category security --description "Check presence of prelink tooling"
+    Register --test-no PROC-3802 --package-manager-required --os Linux --weight L --network NO --category security --description "Check presence of prelink tooling"
     if [ ${SKIPTEST} -eq 0 ]; then
         if PackageIsInstalled "prelink"; then
             LogText "Result: prelink packages is installed"

From e4d491d57414bf53b2d6b1996c5a98b8c7830fd0 Mon Sep 17 00:00:00 2001
From: Martin Churchill <martin.churchill@gmail.com>
Date: Wed, 8 Apr 2020 10:02:18 +0100
Subject: [PATCH 583/679]  [CRYP-7902] Fixes issue #902

 [CRYP-7902] Checks for SSL_CERTIFICATE_PATHS_TO_IGNORE fails to ignore sub-directories #902
---
 include/tests_crypto | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_crypto b/include/tests_crypto
index 466f6b52..1726735a 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -63,7 +63,7 @@
                             SKIP=0
                             # Now check if this path is on the to-be-ignored list
                             for D in ${SSL_CERTIFICATE_PATHS_TO_IGNORE}; do
-                                if Equals "${D}" "${SUBDIR}"; then
+                                if ContainsString "${D}" "${SUBDIR}"; then
                                     SKIP=1
                                     LogText "Result: skipping directory (${SUBDIR}) as it is on ignore list"
                                 fi

From 95b1ae044bd6aec13d994a9d65106bae6a061e22 Mon Sep 17 00:00:00 2001
From: Brian Ginsbach <brian.ginsbach@gmail.com>
Date: Wed, 8 Apr 2020 15:55:45 -0500
Subject: [PATCH 584/679] KRNL-5677 use platform instead of preqs-met

---
 include/tests_kernel | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index 4948e0dd..c62fec91 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -102,8 +102,7 @@
     # Description : Check CPU options and support (PAE, No eXecute, eXecute Disable)
     # More info   : pae and nx bit are both visible on AMD and Intel CPU's if supported
 
-    if [ "${HARDWARE}" = "x86_64" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
-    Register --test-no KRNL-5677 --preqs-met "${PREQS_MET}" --os Linux --weight L --network NO --category security --description "Check CPU options and support"
+    Register --test-no KRNL-5677 --platform x86_64 --os Linux --weight L --network NO --category security --description "Check CPU options and support"
     if [ ${SKIPTEST} -eq 0 ]; then
         Display --indent 2 --text "- Checking CPU support (NX/PAE)"
         LogText "Test: Checking /proc/cpuinfo"

From 51dfc34663b616b92ec1902f4474fff2129642a6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
 <konstruktoid@users.noreply.github.com>
Date: Wed, 22 Apr 2020 10:34:58 +0200
Subject: [PATCH 585/679] accept more restrictive file permissions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
 include/functions | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/functions b/include/functions
index 58ddabe9..8d5a5ef8 100644
--- a/include/functions
+++ b/include/functions
@@ -1286,7 +1286,7 @@
                 CHECK_PERMISSION=$(echo "${CHECK_PERMISSION}" | ${AWKBINARY} '{printf "%03d",$1}')
 
                 # First try stat command
-                LogText "Test: checking if file ${CHECKFILE} is ${CHECK_PERMISSION}"
+                LogText "Test: checking if file ${CHECKFILE} has the permissions set to ${CHECK_PERMISSION} or more restrictive"
                 if [ -n "${STATBINARY}" ]; then
 
                     case ${OS} in
@@ -1344,7 +1344,7 @@
                 DATA=$(echo "${DATA}" | ${AWKBINARY} '{printf "%03d",$1}')
 
                 if [ -n "${DATA}" ]; then
-                    if [ "${DATA}" = "${CHECK_PERMISSION}" ]; then
+                    if [ "${DATA}" -le "${CHECK_PERMISSION}" ]; then
                         LogText "Outcome: correct permissions (${DATA})"
                         return 0
                     fi

From fcdc07f8d9135b362f3198f31e9271b57baac767 Mon Sep 17 00:00:00 2001
From: Topi Miettinen <toiwoton@gmail.com>
Date: Sat, 25 Apr 2020 00:06:58 +0300
Subject: [PATCH 586/679] [CRYP-7902] Check also certificates in DER format

Check also certificates in DER (*.cer, *.der) format. Add
/etc/refind.d/keys to list of certificate paths.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
---
 CHANGELOG.md         |  1 +
 default.prf          |  2 +-
 include/tests_crypto | 19 +++++++++++++------
 3 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b982ac53..6c3974a2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -101,6 +101,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - BOOT-5122 - check for defined password in all GRUB configuration files
 - CONT-8106 - support newer 'docker info' output
 - CRYP-7902 - optionally check also certificates provided by packages
+- CRYP-7902 - check also certificates in DER format
 - CRYP-8002 - gather kernel entropy on Linux systems
 - FILE-6310 - support for HP-UX
 - FILE-6374 - changed log and allow root location to be changed
diff --git a/default.prf b/default.prf
index 6ff3eac2..fff29512 100644
--- a/default.prf
+++ b/default.prf
@@ -93,7 +93,7 @@ skip-plugins=no
 #skip-upgrade-test=yes
 
 # Locations where to search for SSL certificates (separate paths with a colon)
-ssl-certificate-paths=/etc/apache2:/etc/dovecot:/etc/httpd:/etc/letsencrypt:/etc/pki:/etc/postfix:/etc/ssl:/opt/psa/var/certificates:/usr/local/psa/var/certificates:/usr/local/share/ca-certificates:/usr/share/ca-certificates:/usr/share/gnupg:/var/www:/srv/www
+ssl-certificate-paths=/etc/apache2:/etc/dovecot:/etc/httpd:/etc/letsencrypt:/etc/pki:/etc/postfix:/etc/refind.d/keys:/etc/ssl:/opt/psa/var/certificates:/usr/local/psa/var/certificates:/usr/local/share/ca-certificates:/usr/share/ca-certificates:/usr/share/gnupg:/var/www:/srv/www
 ssl-certificate-paths-to-ignore=/etc/letsencrypt/archive:
 ssl-certificate-include-packages=no
 
diff --git a/include/tests_crypto b/include/tests_crypto
index 02fa0a80..f1aa1bdf 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -50,7 +50,7 @@
                     LASTSUBDIR=""
                     LogText "Result: found directory ${DIR}"
                     # Search for certificate files
-                    FILES=$(${FINDBINARY} ${DIR} -type f 2> /dev/null | ${EGREPBINARY} ".crt$|.pem$|^cert" | ${SORTBINARY} | ${SEDBINARY} 's/ /__space__/g')
+                    FILES=$(${FINDBINARY} ${DIR} -type f 2> /dev/null | ${EGREPBINARY} ".cer$|.crt$|.der$|.pem$|^cert" | ${SORTBINARY} | ${SEDBINARY} 's/ /__space__/g')
                     for FILE in ${FILES}; do
                         FILE=$(echo ${FILE} | ${SEDBINARY} 's/__space__/ /g')
                         # See if we need to skip this path
@@ -76,16 +76,23 @@
                             if [ ${CANREAD} -eq 1 ]; then
                                 # Only check the files that are not installed by a package, unless enabled by profile
                                 if [ ${SSL_CERTIFICATE_INCLUDE_PACKAGES} -eq 1 ] || ! FileInstalledByPackage "${FILE}"; then
+                                    echo ${FILE} | ${EGREPBINARY} --quiet ".cer$|.der$"
+                                    CER_DER=$?
                                     OUTPUT=$(${GREPBINARY} -q 'BEGIN CERT' "${FILE}")
-                                    if [ $? -eq 0 ]; then
+                                    if [ $? -eq 0 -o ${CER_DER} -eq 0 ]; then
                                         LogText "Result: file is a certificate file"
-                                        FIND=$(${OPENSSLBINARY} x509 -noout -in "${FILE}" -enddate 2> /dev/null | ${GREPBINARY} "^notAfter")
+                                        if [ ${CER_DER} -eq 0 ]; then
+                                            SSL_DER_OPT="-inform der"
+                                        else
+                                            SSL_DER_OPT=
+                                        fi
+                                        FIND=$(${OPENSSLBINARY} x509 -noout ${SSL_DER_OPT} -in "${FILE}" -enddate 2> /dev/null | ${GREPBINARY} "^notAfter")
                                         if [ $? -eq 0 ]; then
                                             # Check certificate where 'end date' has been expired
-                                            FIND=$(${OPENSSLBINARY} x509 -noout -checkend 0 -in "${FILE}" -enddate 2> /dev/null)
+                                            FIND=$(${OPENSSLBINARY} x509 -noout ${SSL_DER_OPT} -checkend 0 -in "${FILE}" -enddate 2> /dev/null)
                                             EXIT_CODE=$?
-                                            CERT_CN=$(${OPENSSLBINARY} x509 -noout -subject -in "${FILE}" 2> /dev/null | ${SEDBINARY} -e 's/^subject.*CN=\([a-zA-Z0-9\.\-\*]*\).*$/\1/')
-                                            CERT_NOTAFTER=$(${OPENSSLBINARY} x509 -noout -enddate -in "${FILE}" 2> /dev/null | ${AWKBINARY} -F= '{if ($1=="notAfter") { print $2 }}')
+                                            CERT_CN=$(${OPENSSLBINARY} x509 -noout ${SSL_DER_OPT} -subject -in "${FILE}" 2> /dev/null | ${SEDBINARY} -e 's/^subject.*CN=\([a-zA-Z0-9\.\-\*]*\).*$/\1/')
+                                            CERT_NOTAFTER=$(${OPENSSLBINARY} x509 -noout ${SSL_DER_OPT} -enddate -in "${FILE}" 2> /dev/null | ${AWKBINARY} -F= '{if ($1=="notAfter") { print $2 }}')
                                             Report "certificate[]=${FILE}|${EXIT_CODE}|cn:${CERT_CN};notafter:${CERT_NOTAFTER};|"
                                             if [ ${EXIT_CODE} -eq 0 ]; then 
                                                 LogText "Result: certificate ${FILE} seems to be correct and still valid"

From f081a9ed7e78f5ef86ab97a3222dbf01ad8aa7d5 Mon Sep 17 00:00:00 2001
From: Jeremias Cordoba <js.cordoba8321@gmail.com>
Date: Mon, 4 May 2020 15:51:03 -0700
Subject: [PATCH 587/679] Fix KRNL-5730 to properly check /proc/config.gz

When KRNL-5728 locates the kernel config it does not properly set LINUXCONFIGFILE
if config is found as /proc/config.gz. This causes KRNL-5730 to fail due to missing prereqs,
despite a kernel config existing.

Signed-off-by: Jeremias Cordoba <js.cordoba8321@gmail.com>
---
 include/tests_kernel | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index 72e5082b..e19a7679 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -235,12 +235,13 @@
     Register --test-no KRNL-5728 --os Linux --weight L --network NO --category security --description "Checking Linux kernel config"
     if [ ${SKIPTEST} -eq 0 ]; then
         CHECKFILE="${ROOTDIR}boot/config-$(uname -r)"
+        CHECKFILE_ZIPPED="${ROOTDIR}proc/config.gz"
         if [ -f ${CHECKFILE} ]; then
             LINUXCONFIGFILE="${CHECKFILE}"
             LogText "Result: found config (${LINUXCONFIGFILE})"
             Display --indent 2 --text "- Checking Linux kernel configuration file" --result "${STATUS_FOUND}" --color GREEN
-        elif [ -f ${ROOTDIR}proc/config.gz ]; then
-            LINUXCONFIGFILE="${CHECKFILE}"
+        elif [ -f ${CHECKFILE_ZIPPED} ]; then
+            LINUXCONFIGFILE="${CHECKFILE_ZIPPED}"
             LINUXCONFIGFILE_ZIPPED=1
             LogText "Result: found config: ${ROOTDIR}proc/config.gz (compressed)"
             Display --indent 2 --text "- Checking Linux kernel configuration file" --result "${STATUS_FOUND}" --color GREEN

From 2b0a0ba2e1b98563d4984c7bcb59769672c11bd0 Mon Sep 17 00:00:00 2001
From: Aditya Shastri <jayaramaditya1515@gmail.com>
Date: Thu, 14 May 2020 20:50:43 -0700
Subject: [PATCH 588/679] Addedd OS detection for Oracle Linux

---
 include/osdetection | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/osdetection b/include/osdetection
index 08fd931e..7ad153d6 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -195,6 +195,12 @@
                             OS_NAME="Manjaro"
                             OS_VERSION="Rolling release"
                         ;;
+                        "ol")
+                            LINUX_VERSION="Oracle Linux"
+                            OS_NAME="Oracle Linux"
+                            OS_REDHAT_OR_CLONE=1
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                        ;;
                         "opensuse-tumbleweed")
                             LINUX_VERSION="openSUSE Tumbleweed"
                             # It's rolling release but has a snapshot version (the date of the snapshot)

From 859298cc2a67a2307809cf427f26d8d4f8e4f99a Mon Sep 17 00:00:00 2001
From: Daniel Fernandez <9469737+danielf-5@users.noreply.github.com>
Date: Fri, 15 May 2020 23:56:43 -0500
Subject: [PATCH 589/679] Update README.md

---
 README.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index ccc5a4d3..67706f14 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,5 @@
 
+
 [![Linux Security Expert badge](https://badges.linuxsecurity.expert/tools/ranking/lynis.svg)](https://linuxsecurity.expert/tools/lynis/)
 [![Build Status](https://travis-ci.org/CISOfy/lynis.svg?branch=master)](https://travis-ci.org/CISOfy/lynis)
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/96/badge)](https://bestpractices.coreinfrastructure.org/projects/96)
@@ -14,7 +15,7 @@ Do you like this software? **Star the project** and become a [stargazer](https:/
 
 > Lynis - Security auditing and hardening tool, for UNIX-based systems.
 
-Lynis is a security auditing for system based on UNIX like Linux, macOS, BSD, and others. It performs an **in-depth security scan** and runs on the system itself. The primary goal is to test security defenses and **provide tips for further system hardening**. It will also scan for general system information, vulnerable software packages, and possible configuration issues. Lynis was commonly used by system administrators and auditors to assess the security defenses of their systems. Besides the "blue team", nowadays penetration testers also have Lynis in their toolkit.
+Lynis is a security auditing tool for systems based on UNIX like Linux, macOS, BSD, and others. It performs an **in-depth security scan** and runs on the system itself. The primary goal is to test security defenses and **provide tips for further system hardening**. It will also scan for general system information, vulnerable software packages, and possible configuration issues. Lynis was commonly used by system administrators and auditors to assess the security defenses of their systems. Besides the "blue team," nowadays penetration testers also have Lynis in their toolkit.
 
 We believe software should be **simple**, **updated on a regular basis**, and **open**. You should be able to trust, understand, and have the option to change the software. Many agree with us, as the software is being used by thousands every day to protect their systems.
 
@@ -57,7 +58,7 @@ If you want to run the software as `root`, we suggest changing the ownership of
 
 ### Software Package
 
-For Linux, BSD, macOS, there is typically a package available. The Lynis project also provides packages in RPM or DEB format. The [CISOfy software repository](https://packages.cisofy.com) can be used to install Lynis on systems running:
+For Linux, BSD, and macOS, there is typically a package available. The Lynis project also provides packages in RPM or DEB format. The [CISOfy software repository](https://packages.cisofy.com) can be used to install Lynis on systems running:
 `CentOS`, `Debian`, `Fedora`, `OEL`, `openSUSE`, `RHEL`, `Ubuntu`, and others.
 
 Some distributions may also have Lynis in their software repository: [![Repology](https://repology.org/badge/tiny-repos/lynis.svg)](https://repology.org/project/lynis/versions)
@@ -103,7 +104,7 @@ Lynis is collecting some awards and we are proud of that.
 
 > We love contributors.
 
-Do you have something to share? Or help out with translating Lynis into your own language? Create an issue or pull request on GitHub, or send us an e-mail: lynis-dev@cisofy.com.
+Do you have something to share? Want to help out with translating Lynis into your own language? Create an issue or pull request on GitHub, or send us an e-mail: lynis-dev@cisofy.com.
 
 More details can be found in the [Contributors Guide](https://github.com/CISOfy/lynis/blob/master/CONTRIBUTING.md).
 

From b74977db53472a6320e266aeef648f977df3dc1d Mon Sep 17 00:00:00 2001
From: Daniel Fernandez <9469737+danielf-5@users.noreply.github.com>
Date: Fri, 15 May 2020 23:57:31 -0500
Subject: [PATCH 590/679] Update HAPPY_USERS.md

---
 HAPPY_USERS.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/HAPPY_USERS.md b/HAPPY_USERS.md
index 049a9689..57c363a9 100644
--- a/HAPPY_USERS.md
+++ b/HAPPY_USERS.md
@@ -2,7 +2,7 @@
 
 ## Community
 
-Since 2007 the Lynis project helped many system administrators and security
+Since 2007, the Lynis project helped many system administrators and security
 professionals to scan their systems and perform system hardening. Happy users
 and contributors are the foundation of a healthy project.
 

From be4fdb8bc46cfcf58b9bb2081ef88ee4fbb3e6cf Mon Sep 17 00:00:00 2001
From: Daniel Fernandez <9469737+danielf-5@users.noreply.github.com>
Date: Fri, 15 May 2020 23:59:59 -0500
Subject: [PATCH 591/679] Update CONTRIBUTING.md

---
 CONTRIBUTING.md | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index f31b9eb3..66a7b19b 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,3 +1,4 @@
+
 # Contributions
 
 ## Helping out
@@ -6,13 +7,13 @@
 Run the tool in debug mode (use lynis audit system --profile developer.prf) and see if it shows any error.
 
 ### Report bugs
-Create an GitHub issue on the issue tracker
+Create a GitHub issue on the issue tracker.
 
 ### Suggest changes (pull request)
 When you find something that can be improved, fork the project and create a pull request.
 
 ### Translations
-See the db/languages directory
+See the db/languages directory.
 
 
 ## Developer Guidelines
@@ -30,13 +31,13 @@ Identation should be 4 spaces (no tab character).
 
 ### Comments
 Comments: use # sign followed by a space. When needed, create a comment block.
-Blank lines: allowed, one line maximum
+Blank lines: allowed, one line maximum.
 
 ### Functions
 All functions use CamelCase to clearly show a difference between shell built-in commands, or external commands.
 
 ### Variables
-Variables should be capitalized, with underscore as word separator (e.g. PROCESS_EXISTS=1)
+Variables should be capitalized, with underscore as word separator (e.g. PROCESS_EXISTS=1).
 
 
 ## Pull Requests
@@ -56,7 +57,7 @@ to this repository, you agree that you:
 
 4. Allow the project the [Unlimited Rights](#Unlimited-Rights) to your contribution
 
-If you have questions regarding development, send us an e-mail at [lynis-dev](mailto:lynis-dev@cisofy.com)
+If you have questions regarding development, send us an e-mail at [lynis-dev](mailto:lynis-dev@cisofy.com).
 
 
 ## Unlimited Rights

From f072f808a2a5f76566c8f49e87147f903c65c5a3 Mon Sep 17 00:00:00 2001
From: Jaimie <59117167+Jaimie85@users.noreply.github.com>
Date: Wed, 20 May 2020 15:41:46 +0200
Subject: [PATCH 592/679] Update nl

---
 db/languages/nl | 51 ++++++++++++++++++++++++++++---------------------
 1 file changed, 29 insertions(+), 22 deletions(-)

diff --git a/db/languages/nl b/db/languages/nl
index 21700617..31a694ee 100644
--- a/db/languages/nl
+++ b/db/languages/nl
@@ -1,38 +1,45 @@
+ERROR_NO_LICENSE="Geen licentiecode geconfigureerd"
+ERROR_NO_UPLOAD_SERVER="Geen upload server geconfigureerd"
 GEN_CHECKING="Zoeken naar"
+GEN_CURRENT_VERSION="Huidige versie"
+GEN_DEBUG_MODE="Debug modus"
+GEN_INITIALIZE_PROGRAM="Programma initialiseren"
+GEN_LATEST_VERSION="Laatste versie"
 GEN_PHASE="fase"
-GEN_INITIALIZE_PROGRAM="Initialiseren van programma"
-NOTE_PLUGINS_TAKE_TIME="Plugins hebben uitgebreidere testen en kunnen derhalve enkele minuten duren"
-NOTE_EXCEPTIONS_FOUND="Uitzonderingen gevonden"
-SECTION_CUSTOM_TESTS="Eigen Testen"
+GEN_PLUGINS_ENABLED="Plugins geactiveerd"
+GEN_VERBOSE_MODE="Verbose modus"
+GEN_UPDATE_AVAILABLE="Update beschikbaar"
+GEN_WHAT_TO_DO="Wat te doen"
+NOTE_EXCEPTIONS_FOUND="Bijzonderheden gevonden"
+NOTE_EXCEPTIONS_FOUND_DETAILED="Enkele bijzondere gebeurtenissen of informatie gevonden"
+NOTE_PLUGINS_TAKE_TIME="Let op: plugins hebben uitgebreidere testen en kunnen daardoor enkele minuten duren"
+NOTE_SKIPPED_TESTS_NON_PRIVILEGED="Overgeslagen testen vanwege beperkte rechten"
+SECTION_CUSTOM_TESTS="Eigen testen"
+SECTION_DATA_UPLOAD="Data upload"
+SECTION_INITIALIZING_PROGRAM="Programma initialiseren"
 SECTION_MALWARE="Kwaadaardige software (malware)"
 SECTION_MEMORY_AND_PROCESSES="Geheugen en Processen"
-STATUS_DONE="KLAAR"
+SECTION_SYSTEM_TOOLS="Systeem gereedschap"
 STATUS_DISABLED="UITGESCHAKELD"
+STATUS_DONE="KLAAR"
 STATUS_ENABLED="INGESCHAKELD"
+STATUS_ERROR="FOUT"
+STATUS_FAILED="MISLUKT"
 STATUS_FOUND="GEVONDEN"
-STATUS_NO="NEE"
-STATUS_NONE="GEEN"
-STATUS_NOT_FOUND="NIET GEVONDEN"
-STATUS_NOT_RUNNING="NIET ACTIEF"
+STATUS_OFF="UIT"
 STATUS_OK="OK"
 STATUS_ON="AAN"
-STATUS_OFF="UIT"
-STATUS_YES="JA"
+STATUS_NO="NEE"
+STATUS_NONE="GEEN"
+STATUS_NOT_CONFIGURED="NIET GECONFIGUREERD"
+STATUS_NOT_FOUND="NIET GEVONDEN"
+STATUS_NOT_RUNNING="NIET ACTIEF"
 STATUS_RUNNING="ACTIEF"
 STATUS_SKIPPED="OVERGESLAGEN"
 STATUS_SUGGESTION="SUGGESTIE"
 STATUS_UNKNOWN="ONBEKEND"
 STATUS_WARNING="WAARSCHUWING"
-GEN_CURRENT_VERSION="Huidige versie"
-GEN_DEBUG_MODE="Debug mode"
-GEN_PLUGINS_ENABLED="Plugins geactiveerd"
-GEN_VERBOSE_MODE="Verbose mode"
-GEN_UPDATE_AVAILABLE="update beschikbaar"
-GEN_WHAT_TO_DO="Wat te doen"
-NOTE_EXCEPTIONS_FOUND_DETAILED="Enkele uitzonderingen gevonden"
-NOTE_SKIPPED_TESTS_NON_PRIVILEGED="Overgeslagen testen vanwege beperkte rechten"
+STATUS_WEAK="ZWAK"
+STATUS_YES="JA"
 TEXT_YOU_CAN_HELP_LOGFILE="Help mee door je logbestand te delen"
 TEXT_UPDATE_AVAILABLE="update beschikbaar"
-STATUS_ERROR="FOUT"
-ERROR_NO_LICENSE="geen licentiecode configureerd"
-ERROR_NO_UPLOAD_SERVER="geen server configureerd voor uploads"

From 9fdfc062dd17820114c2721f211f2c0f36bf5494 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 2 Jun 2020 14:09:49 +0200
Subject: [PATCH 593/679] Add Gentoo

---
 include/osdetection | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/include/osdetection b/include/osdetection
index 7ad153d6..7483664b 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -183,6 +183,11 @@
                             OS_REDHAT_OR_CLONE=1
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                         ;;
+                        "gentoo")
+                            LINUX_VERSION="Gentoo"
+                            OS_NAME="Gentoo Linux"
+                            OS_VERSION="Rolling release"
+                        ;;
                         "pureos")
                             LINUX_VERSION="PureOS"
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')

From b285623ac2716d3adce9c444e3c9c2d5cf43dfbc Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 2 Jun 2020 16:30:43 +0200
Subject: [PATCH 594/679] Remove double space

---
 include/tests_filesystems | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_filesystems b/include/tests_filesystems
index aabdc2be..3ad603c5 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -236,7 +236,7 @@
     # Description : Query all HAMMER PFS mounts from /etc/fstab
     Register --test-no FILE-6439 --os DragonFly --weight L --network NO --category security --description "Checking HAMMER PFS mounts"
     if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: Query /etc/fstab for available HAMMER PFS  mount points"
+        LogText "Test: Query /etc/fstab for available HAMMER PFS mount points"
         FIND=$(${MOUNTBINARY} -p | ${AWKBINARY} '{ if ($3 == "null") { print $1":"$2":"$3":"$4":" }}')
         if [ -z "${FIND}" ]; then
             Display --indent 2 --text "- Querying HAMMER PFS mount points (mount -p)" --result "${STATUS_NONE}" --color WHITE

From 0b8c775a011ba7acf7a090ac54df165dd1b85062 Mon Sep 17 00:00:00 2001
From: Iain Cuthbertson <iain.cuthbertson@siftware.com>
Date: Tue, 2 Jun 2020 15:33:32 +0100
Subject: [PATCH 595/679] Adds uppercase option to the hostname validation
 regex

---
 include/tests_networking | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_networking b/include/tests_networking
index 83a7aae0..420f26ea 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -70,7 +70,7 @@
                 LogText "Result: hostnamed is defined and not longer than 63 characters"
             fi
             # Test valid characters (normally a dot should not be in the name, but we can't be 100% sure we have short name)
-            FIND=$(echo "${HOSTNAME}" | ${TRBINARY} -d '[a-z0-9\.\-]')
+            FIND=$(echo "${HOSTNAME}" | ${TRBINARY} -d '[a-zA-Z0-9\.\-]')
             if [ -z "${FIND}" ]; then
                 LogText "Result: good, no unexpected characters discovered in hostname"
                 if IsVerbose; then Display --indent 2 --text "- Hostname (allowed characters)" --result "${STATUS_OK}" --color GREEN; fi

From 05ea9f873d1e62c553242eb531d941c4ad06ae97 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 2 Jun 2020 16:34:35 +0200
Subject: [PATCH 596/679] [FILE-6330] corrected description

---
 include/tests_filesystems | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/tests_filesystems b/include/tests_filesystems
index 3ad603c5..fe4ae167 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -212,10 +212,11 @@
 #################################################################################
 #
     # Test        : FILE-6330
-    # Description : Query all ZFS mounts from /etc/fstab
+    # Description : Query ZFS mounts
+    # Note        : mount -p does not work under Linux
     Register --test-no FILE-6330 --os FreeBSD --weight L --network NO --category security --description "Checking ZFS file systems"
     if [ ${SKIPTEST} -eq 0 ]; then
-        LogText "Test: Query /etc/fstab for available ZFS mount points"
+        LogText "Test: Discover for available ZFS mount points"
         FIND=$(${MOUNTBINARY} -p | ${AWKBINARY} '{ if ($3 == "zfs") { print $1":"$2":"$3":"$4":" }}')
         if [ -z "${FIND}" ]; then
             Display --indent 2 --text "- Querying ZFS mount points (mount -p)" --result "${STATUS_NONE}" --color WHITE

From 3d7de495cc6b67ab1870ac9e66f1690fd17a2be4 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 2 Jun 2020 16:34:42 +0200
Subject: [PATCH 597/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b982ac53..3c699f64 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -103,6 +103,7 @@ Using the relevant options, the scan will change base on the intended goal.
 - CRYP-7902 - optionally check also certificates provided by packages
 - CRYP-8002 - gather kernel entropy on Linux systems
 - FILE-6310 - support for HP-UX
+- FILE-6330 - corrected description
 - FILE-6374 - changed log and allow root location to be changed
 - FILE-6374 - corrected condition to find 'defaults' flag in /etc/fstab
 - FILE-6430 - minor code improvements and show suggestion with more details

From 10402538fab978a869a5ee660078480f7000cda8 Mon Sep 17 00:00:00 2001
From: Steve8291 <hambling8@gmail.com>
Date: Thu, 11 Jun 2020 10:46:55 -0400
Subject: [PATCH 598/679] Fix typo in kernel options description

---
 default.prf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/default.prf b/default.prf
index 6ff3eac2..ce01db60 100644
--- a/default.prf
+++ b/default.prf
@@ -152,7 +152,7 @@ plugin=users
 #
 # Kernel options
 # ---------------
-# configdate=, followed by:
+# config-data=, followed by:
 #
 # - Type                     = Set to 'sysctl'
 # - Setting                  = value of sysctl key (e.g. kernel.sysrq)

From b3e1fc67c8f21217bc5e2a9a60b3ab3920982864 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
 <konstruktoid@users.noreply.github.com>
Date: Mon, 15 Jun 2020 01:35:00 +0200
Subject: [PATCH 599/679] add Fedora EOL, update other releases
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
 db/software-eol.db | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/db/software-eol.db b/db/software-eol.db
index b3285487..426560c8 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -48,6 +48,8 @@ os:FreeBSD 10.3:2018-04-30:0:
 os:FreeBSD 10.4:2018-10-31:0:
 os:FreeBSD 11.0:2017-11-30:0:
 os:FreeBSD 11.1:2018-09-30:0:
+os:FreeBSD 11.2:2019-10-31:1572476400:
+os:FreeBSD 12.0:2020-02-29:1582930800:
 #
 # NetBSD - https://www.netbsd.org/support/security/release.html and
 #          https://www.netbsd.org/releases/formal.html
@@ -102,8 +104,17 @@ os:NetBSD 9.0::-1:
 #
 os:OpenBSD 5.8:2016-09-01:0:
 os:OpenBSD 5.9:2017-04-11:0:
+os:OpenBSD 6.0:2017-09-10:0:
+os:OpenBSD 6.1:2018-04-15:0:
+os:OpenBSD 6.2:2018-10-18:0:
+os:OpenBSD 6.3:2019-05-03:0:
+os:OpenBSD 6.4:2019-10-17:0:
+os:OpenBSD 6.5:2020-05-19:0:
+os:OpenBSD 6.6:2020-10-01:0:
+os:OpenBSD 6.7:2021-05-01:0:
 #
-# Ubuntu - https://wiki.ubuntu.com/Kernel/LTSEnablementStack
+# Ubuntu - https://wiki.ubuntu.com/Kernel/LTSEnablementStack and
+#          https://wiki.ubuntu.com/Releases
 #
 os:Ubuntu 14.04:2019-05-01:1556661600:
 os:Ubuntu 14.10:2015-07-01:0:
@@ -116,6 +127,7 @@ os:Ubuntu 17.10:2018-07-01:1530396000:
 os:Ubuntu 18.04:2023-05-01:1682892000:
 os:Ubuntu 18.10:2019-07-18:1563400800:
 os:Ubuntu 19.04:2020-01-01:1577833200:
+os:Ubuntu 20.04:2025-04-01:1743458400
 #
 # Slackware - https://en.wikipedia.org/wiki/Slackware#Releases
 #
@@ -132,3 +144,12 @@ os:Slackware Linux 12.2:2013-12-09:1386540000:
 os:Slackware Linux 13.0:2018-07-05:1530738000:
 os:Slackware Linux 13.1:2018-07-05:1530738000:
 os:Slackware Linux 13.37:2018-07-05:1530738000:
+#
+# Fedora - https://fedoraproject.org/wiki/End_of_life
+#
+os:Fedora release 25:2017-12-12:1513033200
+os:Fedora release 26:2018-05-29:1527544800
+os:Fedora release 27:2018-11-30:1543532400
+os:Fedora release 28:2019-05-28:1558994400
+os:Fedora release 29:2019-11-26:1574722800
+os:Fedora release 30:2020-05-26:1590444000

From ca6326a12bf9af53a6e818bb60d9e09beb5bd485 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
 <konstruktoid@users.noreply.github.com>
Date: Mon, 15 Jun 2020 07:40:57 +0000
Subject: [PATCH 600/679] Update db/software-eol.db

Co-authored-by: Jaimie <59117167+Jaimie85@users.noreply.github.com>
---
 db/software-eol.db | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/db/software-eol.db b/db/software-eol.db
index 426560c8..6af4dba5 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -104,14 +104,14 @@ os:NetBSD 9.0::-1:
 #
 os:OpenBSD 5.8:2016-09-01:0:
 os:OpenBSD 5.9:2017-04-11:0:
-os:OpenBSD 6.0:2017-09-10:0:
-os:OpenBSD 6.1:2018-04-15:0:
-os:OpenBSD 6.2:2018-10-18:0:
-os:OpenBSD 6.3:2019-05-03:0:
-os:OpenBSD 6.4:2019-10-17:0:
-os:OpenBSD 6.5:2020-05-19:0:
-os:OpenBSD 6.6:2020-10-01:0:
-os:OpenBSD 6.7:2021-05-01:0:
+os:OpenBSD 6.0:2017-09-10:1505001600:
+os:OpenBSD 6.1:2018-04-15:1523750400:
+os:OpenBSD 6.2:2018-10-18:1539820800:
+os:OpenBSD 6.3:2019-05-03:1556841600:
+os:OpenBSD 6.4:2019-10-17:1571270400:
+os:OpenBSD 6.5:2020-05-19:1589846400:
+os:OpenBSD 6.6:2020-10-01:1601510400:
+os:OpenBSD 6.7:2021-05-01:1619827200:
 #
 # Ubuntu - https://wiki.ubuntu.com/Kernel/LTSEnablementStack and
 #          https://wiki.ubuntu.com/Releases

From 41ad9d380c1255a2b7e77e8e50e19ff650e8db1a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
 <konstruktoid@users.noreply.github.com>
Date: Tue, 16 Jun 2020 09:05:55 +0200
Subject: [PATCH 601/679] update all EOL dates to seconds to epoch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
 db/software-eol.db | 97 +++++++++++++++++++++++-----------------------
 1 file changed, 49 insertions(+), 48 deletions(-)

diff --git a/db/software-eol.db b/db/software-eol.db
index 6af4dba5..d55cfdaa 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -8,6 +8,7 @@
 # 4) converted date (seconds since epoch) or -1
 #
 # Date can be converted on Linux using: date "+%s" --date=2020-01-01
+# Seconds since epoch can be verified using: date -d @1467324000 +'%Y-%m-%d'
 #
 # Notes:
 # For rolling releases or releases that do not (currently have an EOL date, leave field three empty and set field four to -1.
@@ -40,55 +41,55 @@ os:Debian 10:2022-01-01:1640991600:
 #
 # FreeBSD - https://www.freebsd.org/security/unsupported.html
 #
-os:FreeBSD 9.3:2014-12-31:0:
-os:FreeBSD 10.0:2015-02-28:0:
-os:FreeBSD 10.1:2016-12-31:0:
-os:FreeBSD 10.2:2016-12-31:0:
-os:FreeBSD 10.3:2018-04-30:0:
-os:FreeBSD 10.4:2018-10-31:0:
-os:FreeBSD 11.0:2017-11-30:0:
-os:FreeBSD 11.1:2018-09-30:0:
+os:FreeBSD 9.3:2014-12-31:1419980400:
+os:FreeBSD 10.0:2015-02-28:1425078000:
+os:FreeBSD 10.1:2016-12-31:1483138800:
+os:FreeBSD 10.2:2016-12-31:1483138800:
+os:FreeBSD 10.3:2018-04-30:1525039200:
+os:FreeBSD 10.4:2018-10-31:1540940400:
+os:FreeBSD 11.0:2017-11-30:1511996400:
+os:FreeBSD 11.1:2018-09-30:1538258400:
 os:FreeBSD 11.2:2019-10-31:1572476400:
 os:FreeBSD 12.0:2020-02-29:1582930800:
 #
 # NetBSD - https://www.netbsd.org/support/security/release.html and
 #          https://www.netbsd.org/releases/formal.html
 #
-os:NetBSD 2.0:2008-01-19:0:
-os:NetBSD 2.0.1:2008-01-19:0:
-os:NetBSD 2.0.2:2008-01-19:0:
-os:NetBSD 2.0.3:2008-01-19:0:
-os:NetBSD 2.1:2008-01-19:0:
-os:NetBSD 3.0:2009-09-29:0:
-os:NetBSD 3.0.1:2009-09-29:0:
-os:NetBSD 3.0.2:2009-09-29:0:
-os:NetBSD 3.1:2009-09-29:0:
-os:NetBSD 4.0:2012-11-17:0:
-os:NetBSD 4.0.1:2012-11-17:0:
-os:NetBSD 5.0:2015-11-17:0:
-os:NetBSD 5.0.1:2015-10-17:0:
-os:NetBSD 5.0.2:2015-10-17:0:
-os:NetBSD 5.1:2015-10-17:0:
-os:NetBSD 5.1.1:2015-10-17:0:
-os:NetBSD 5.1.2:2015-10-17:0:
-os:NetBSD 5.1.3:2015-10-17:0:
-os:NetBSD 5.1.4:2015-10-17:0:
-os:NetBSD 5.1.5:2015-10-17:0:
-os:NetBSD 5.2.1:2015-10-17:0:
-os:NetBSD 5.2.2:2015-10-17:0:
-os:NetBSD 5.2.3:2015-10-17:0:
-os:NetBSD 6.0:2017-09-17:0:
-os:NetBSD 6.0.1:2017-09-17:0:
-os:NetBSD 6.0.2:2017-09-17:0:
-os:NetBSD 6.0.3:2017-09-17:0:
-os:NetBSD 6.0.4:2017-09-17:0:
-os:NetBSD 6.0.5:2017-09-17:0:
-os:NetBSD 6.1:2017-09-17:0:
-os:NetBSD 6.1.1:2017-09-17:0:
-os:NetBSD 6.1.2:2017-09-17:0:
-os:NetBSD 6.1.3:2017-09-17:0:
-os:NetBSD 6.1.4:2017-09-17:0:
-os:NetBSD 6.1.5:2017-09-17:0:
+os:NetBSD 2.0:2008-01-19:1200697200:
+os:NetBSD 2.0.1:2008-01-19:1200697200:
+os:NetBSD 2.0.2:2008-01-19:1200697200:
+os:NetBSD 2.0.3:2008-01-19:1200697200:
+os:NetBSD 2.1:2008-01-19:1200697200:
+os:NetBSD 3.0:2009-09-29:1254175200:
+os:NetBSD 3.0.1:2009-09-29:1254175200:
+os:NetBSD 3.0.2:2009-09-29:1254175200:
+os:NetBSD 3.1:2009-09-29:1254175200:
+os:NetBSD 4.0:2012-11-17:1353106800:
+os:NetBSD 4.0.1:2012-11-17:1353106800:
+os:NetBSD 5.0:2015-11-17:1447714800:
+os:NetBSD 5.0.1:2015-10-17:1445032800:
+os:NetBSD 5.0.2:2015-10-17:1445032800:
+os:NetBSD 5.1:2015-10-17:1445032800:
+os:NetBSD 5.1.1:2015-10-17:1445032800:
+os:NetBSD 5.1.2:2015-10-17:1445032800:
+os:NetBSD 5.1.3:2015-10-17:1445032800:
+os:NetBSD 5.1.4:2015-10-17:1445032800:
+os:NetBSD 5.1.5:2015-10-17:1445032800:
+os:NetBSD 5.2.1:2015-10-17:1445032800:
+os:NetBSD 5.2.2:2015-10-17:1445032800:
+os:NetBSD 5.2.3:2015-10-17:1445032800:
+os:NetBSD 6.0:2017-09-17:1505599200:
+os:NetBSD 6.0.1:2017-09-17:1505599200:
+os:NetBSD 6.0.2:2017-09-17:1505599200:
+os:NetBSD 6.0.3:2017-09-17:1505599200:
+os:NetBSD 6.0.4:2017-09-17:1505599200:
+os:NetBSD 6.0.5:2017-09-17:1505599200:
+os:NetBSD 6.1:2017-09-17:1505599200:
+os:NetBSD 6.1.1:2017-09-17:1505599200:
+os:NetBSD 6.1.2:2017-09-17:1505599200:
+os:NetBSD 6.1.3:2017-09-17:1505599200:
+os:NetBSD 6.1.4:2017-09-17:1505599200:
+os:NetBSD 6.1.5:2017-09-17:1505599200:
 os:NetBSD 7.0:2020-03-14:1584162000:
 os:NetBSD 7.0.1:2020-03-14:1584162000:
 os:NetBSD 7.0.2:2020-03-14:1584162000:
@@ -102,8 +103,8 @@ os:NetBSD 9.0::-1:
 #
 # OpenBSD - https://en.wikipedia.org/wiki/OpenBSD_version_history
 #
-os:OpenBSD 5.8:2016-09-01:0:
-os:OpenBSD 5.9:2017-04-11:0:
+os:OpenBSD 5.8:2016-09-01:1472680800:
+os:OpenBSD 5.9:2017-04-11:1491861600:
 os:OpenBSD 6.0:2017-09-10:1505001600:
 os:OpenBSD 6.1:2018-04-15:1523750400:
 os:OpenBSD 6.2:2018-10-18:1539820800:
@@ -117,9 +118,9 @@ os:OpenBSD 6.7:2021-05-01:1619827200:
 #          https://wiki.ubuntu.com/Releases
 #
 os:Ubuntu 14.04:2019-05-01:1556661600:
-os:Ubuntu 14.10:2015-07-01:0:
-os:Ubuntu 15.04:2016-01-01:0:
-os:Ubuntu 15.10:2016-07-01:0:
+os:Ubuntu 14.10:2015-07-01:1435701600:
+os:Ubuntu 15.04:2016-01-01:1451602800:
+os:Ubuntu 15.10:2016-07-01:1467324000:
 os:Ubuntu 16.04:2021-05-01:1619820000:
 os:Ubuntu 16.10:2017-07-01:1498860000:
 os:Ubuntu 17.04:2018-01-01:1514761200:

From 78e7ce36afbbcba56fd65723f4d455de4d19ed6e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
 <konstruktoid@users.noreply.github.com>
Date: Thu, 18 Jun 2020 10:15:13 +0200
Subject: [PATCH 602/679] add RHEL 6,7,8 EOL dates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(cherry picked from commit 6ce0aa41c64f8146716de25d613e66cf53f08b0e)
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
 db/software-eol.db | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/db/software-eol.db b/db/software-eol.db
index d55cfdaa..beb4eff1 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -114,6 +114,12 @@ os:OpenBSD 6.5:2020-05-19:1589846400:
 os:OpenBSD 6.6:2020-10-01:1601510400:
 os:OpenBSD 6.7:2021-05-01:1619827200:
 #
+# Red Hat Enterprise Linux - https://access.redhat.com/labs/plcc/
+#
+os:Red Hat Enterprise Linux Server release 6:2020-11-30:1606690800:
+os:Red Hat Enterprise Linux 7:2024-06-30:1719698400:
+os:Red Hat Enterprise Linux 8:2029-05-07:1872799200:
+#
 # Ubuntu - https://wiki.ubuntu.com/Kernel/LTSEnablementStack and
 #          https://wiki.ubuntu.com/Releases
 #

From 3b9eda53cc20e851c4456618f027bc9ea794ad30 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 18 Jun 2020 12:36:04 +0200
Subject: [PATCH 603/679] CVE-2019-13033 - Discovered by Sander Bos

---
 include/data_upload | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/include/data_upload b/include/data_upload
index 6718d6d3..eae2b5cc 100644
--- a/include/data_upload
+++ b/include/data_upload
@@ -77,6 +77,10 @@
         ExitFatal
     else
         Output "License key = ${LICENSE_KEY}"
+        # Create a temporary file to use during upload (prevent license key being displayed in process table)
+        CreateTempFile || ExitFatal
+        LICENSE_KEY_FILE="${TEMP_FILE}"
+        echo "${LICENSE_KEY}" | ${TRBINARY} -cd '[a-f0-9-]' > ${LICENSE_KEY_FILE}
     fi
 
 
@@ -129,8 +133,9 @@
 
         # License check
 
-        LogText "Command used: ${CURLBINARY}${CURL_OPTIONS} -s -S --data-urlencode "licensekey=${LICENSE_KEY}" --data-urlencode "collector_version=${PROGRAM_VERSION}" ${LICENSE_SERVER_URL} 2> /dev/null"
-        UPLOAD=$(${CURLBINARY}${CURL_OPTIONS} -s -S --data-urlencode "licensekey=${LICENSE_KEY}" --data-urlencode "collector_version=${PROGRAM_VERSION}" ${LICENSE_SERVER_URL} 2> /dev/null)
+        LogText "Command used: ${CURLBINARY}${CURL_OPTIONS} -s -S --data-urlencode "licensekey@${LICENSE_KEY_FILE}" --data-urlencode "collector_version=${PROGRAM_VERSION}" ${LICENSE_SERVER_URL} 2> /dev/null"
+        UPLOAD=$(${CURLBINARY}${CURL_OPTIONS} -s -S --data-urlencode "licensekey@${LICENSE_KEY_FILE}" --data-urlencode "collector_version=${PROGRAM_VERSION}" ${LICENSE_SERVER_URL} 2> /dev/null)
+
         EXITCODE=$?
         LogText "Exit code: ${EXITCODE}"
         if [ ${EXITCODE} -gt 0 ]; then
@@ -225,10 +230,10 @@
             Output "${WHITE}Found hostid: ${HOSTID}${NORMAL}"
             # Try to connect
             Output "Uploading data.."
-            LogText "Command used: ${CURLBINARY}${CURL_OPTIONS} -s -S --data-urlencode \"data@${REPORTFILE}\" --data-urlencode \"licensekey=${LICENSE_KEY}\" --data-urlencode \"hostid=${HOSTID}\" ${UPLOAD_URL}"
-            LogText "Tip: try running ${CURLBINARY}${CURL_OPTIONS} --data-urlencode \"data@${REPORTFILE}\" --data-urlencode \"licensekey=${LICENSE_KEY}\" --data-urlencode \"hostid=${HOSTID}\" ${UPLOAD_URL}"
+            LogText "Command used: ${CURLBINARY}${CURL_OPTIONS} -s -S --data-urlencode \"data@${REPORTFILE}\" --data-urlencode \"licensekey@${LICENSE_KEY_FILE}\" --data-urlencode \"hostid=${HOSTID}\" ${UPLOAD_URL}"
+            LogText "Tip: try running ${CURLBINARY}${CURL_OPTIONS} --data-urlencode \"data@${REPORTFILE}\" --data-urlencode \"licensekey@${LICENSE_KEY_FILE}\" --data-urlencode \"hostid=${HOSTID}\" ${UPLOAD_URL}"
             LogText "Tip: to just retry an upload, use: lynis upload-only"
-            UPLOAD=$(${CURLBINARY}${CURL_OPTIONS} -s -S --data-urlencode "data@${REPORTFILE}" --data-urlencode "licensekey=${LICENSE_KEY}" --data-urlencode "hostid=${HOSTID}" --data-urlencode "hostid2=${HOSTID2}" ${UPLOAD_URL} 2> /dev/null)
+            UPLOAD=$(${CURLBINARY}${CURL_OPTIONS} -s -S --data-urlencode "data@${REPORTFILE}" --data-urlencode "licensekey@${LICENSE_KEY_FILE}" --data-urlencode "hostid=${HOSTID}" --data-urlencode "hostid2=${HOSTID2}" ${UPLOAD_URL} 2> /dev/null)
             EXITCODE=$?
             LogText "Exit code: ${EXITCODE}"
             if [ ${EXITCODE} -gt 0 ]; then

From 3c3c4105b2086fc3ff556319cf0e3da08c8c1f95 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 18 Jun 2020 12:48:33 +0200
Subject: [PATCH 604/679] Updated log

---
 CHANGELOG.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3c699f64..3198681e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,11 +1,16 @@
 # Lynis Changelog
 
-## Lynis 3.0.0 (not released yet)
+## Lynis 3.0.0 (2020-06-18)
 
 This is a major release of Lynis and includes several big changes.
 Some of these changes may break your current usage of the tool, so test before
 deployment!
 
+### Security issues
+This release resolves two security issues
+* CVE-2020-13882 - Discovered by Sander Bos, code submission by Katarina Durechova
+* CVE-2019-13033 - Discovered by Sander Bos
+
 ### Breaking change: Non-interactive by default
 Lynis now runs non-interactive by default, to be more in line with the Unix
 philosophy. So the previously used '--quick' option is now default, and the tool

From 05ef9547ae42c9885c84058c575b01ef9ec903cf Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 18 Jun 2020 12:51:54 +0200
Subject: [PATCH 605/679] Release 3.0.0

---
 lynis | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lynis b/lynis
index 2d79fa4f..1b3803dc 100755
--- a/lynis
+++ b/lynis
@@ -43,9 +43,9 @@
     PROGRAM_WEBSITE="https://cisofy.com/lynis/"
 
     # Version details
-    PROGRAM_RELEASE_DATE="2020-03-20"
-    PROGRAM_RELEASE_TIMESTAMP=1584711965
-    PROGRAM_RELEASE_TYPE="pre-release" # pre-release or release
+    PROGRAM_RELEASE_DATE="2020-06-18"
+    PROGRAM_RELEASE_TIMESTAMP=1592477492
+    PROGRAM_RELEASE_TYPE="release" # pre-release or release
     PROGRAM_VERSION="3.0.0"
 
     # Source, documentation and license

From 6a9e94befb022530854c4b53496710fe344f7ad0 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 19 Jun 2020 11:10:22 +0200
Subject: [PATCH 606/679] Reordered items, added Kali Linux, improved exception
 message

---
 include/osdetection | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/include/osdetection b/include/osdetection
index 7483664b..88aa8209 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -188,11 +188,10 @@
                             OS_NAME="Gentoo Linux"
                             OS_VERSION="Rolling release"
                         ;;
-                        "pureos")
-                            LINUX_VERSION="PureOS"
-                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
-                            OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
-                            OS_NAME="PureOS"
+                        "kali")
+                            LINUX_VERSION="Kali"
+                            OS_NAME="Kali Linux"
+                            OS_VERSION="Rolling release"
                         ;;
                         "manjaro")
                             LINUX_VERSION="Manjaro"
@@ -217,11 +216,11 @@
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="openSUSE"
                         ;;
-                        "ubuntu")
-                            LINUX_VERSION="Ubuntu"
+                        "pureos")
+                            LINUX_VERSION="PureOS"
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
-                            OS_NAME="Ubuntu"
+                            OS_NAME="PureOS"
                         ;;
                         "raspbian")
                             LINUX_VERSION="Raspbian"
@@ -243,8 +242,14 @@
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                         ;;
+                        "ubuntu")
+                            LINUX_VERSION="Ubuntu"
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_NAME="Ubuntu"
+                        ;;
                         *)
-                            ReportException "OS Detection" "Unknown OS found in /etc/os-release"
+                            ReportException "OS Detection" "Unknown OS found in /etc/os-release - Please create issue on GitHub project page: ${PROGRAM_SOURCE}"
                         ;;
                     esac
                 fi

From 57a2ae2b8dfba55002e4537816a66d217b1ad3ca Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 19 Jun 2020 11:11:37 +0200
Subject: [PATCH 607/679] Switch to pre-release

---
 lynis | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lynis b/lynis
index 1b3803dc..9b0e5894 100755
--- a/lynis
+++ b/lynis
@@ -45,8 +45,8 @@
     # Version details
     PROGRAM_RELEASE_DATE="2020-06-18"
     PROGRAM_RELEASE_TIMESTAMP=1592477492
-    PROGRAM_RELEASE_TYPE="release" # pre-release or release
-    PROGRAM_VERSION="3.0.0"
+    PROGRAM_RELEASE_TYPE="pre-release" # pre-release or release
+    PROGRAM_VERSION="3.0.1"
 
     # Source, documentation and license
     PROGRAM_SOURCE="https://github.com/CISOfy/lynis"

From bd29a3e4e790d9825521ae9e9a04ffb3c01721d0 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 19 Jun 2020 11:11:47 +0200
Subject: [PATCH 608/679] Updated log

---
 CHANGELOG.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3198681e..86887a24 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Lynis Changelog
 
+## Lynis 3.0.1 (not released yet)
+
+### Changed
+- Added Kali Linux
+- Small code enhancements
+
+---------------------------------------------------------------------------------
+
 ## Lynis 3.0.0 (2020-06-18)
 
 This is a major release of Lynis and includes several big changes.

From 6aa63f1c95190b5c7b198f3a28473c93c5676b7a Mon Sep 17 00:00:00 2001
From: Alexander Lackner <lackner.alex@gmail.com>
Date: Sat, 20 Jun 2020 02:12:57 +0200
Subject: [PATCH 609/679] Update language files (de, de-AT, en)

---
 db/languages/de    | 37 ++++++++++++++++++++++---------------
 db/languages/de-AT |  1 +
 db/languages/en    | 10 +++++-----
 3 files changed, 28 insertions(+), 20 deletions(-)
 create mode 120000 db/languages/de-AT

diff --git a/db/languages/de b/db/languages/de
index 34b909e2..e1465aa2 100644
--- a/db/languages/de
+++ b/db/languages/de
@@ -1,38 +1,45 @@
-GEN_PHASE="Phase"
+ERROR_NO_LICENSE="Kein Lizenzschlüssel eingerichtet"
+ERROR_NO_UPLOAD_SERVER="Kein Upload-Server eingerichtet"
 GEN_CHECKING="Überprüfung"
 GEN_CURRENT_VERSION="Aktuelle Version"
 GEN_DEBUG_MODE="Debug-Modus"
-GEN_INITIALIZE_PROGRAM="Initiiere Programm"
+GEN_INITIALIZE_PROGRAM="Initialisiere Programm"
+GEN_LATEST_VERSION="Aktuellste Version"
+GEN_PHASE="Phase"
 GEN_PLUGINS_ENABLED="Plugins aktiviert"
-GEN_VERBOSE_MODE="Ausführlicher Modus"
 GEN_UPDATE_AVAILABLE="Aktualisierung verfügbar"
+GEN_VERBOSE_MODE="Ausführlicher Modus"
 GEN_WHAT_TO_DO="Was zu tun ist"
-NOTE_EXCEPTIONS_FOUND="Abweichungen gefunden"
 NOTE_EXCEPTIONS_FOUND_DETAILED="Einige außergewöhnliche Ereignisse oder Informationen wurden gefunden"
+NOTE_EXCEPTIONS_FOUND="Abweichungen gefunden"
 NOTE_PLUGINS_TAKE_TIME="Beachte: Plugins beinhalten eingehendere Tests und können mehrere Minuten benötigen, bis sie abgeschlossen sind"
+NOTE_SKIPPED_TESTS_NON_PRIVILEGED="Übersprungene Tests aufgrund nicht privilegiertem Modus"
 SECTION_CUSTOM_TESTS="Benutzerdefinierte Tests"
+SECTION_DATA_UPLOAD="Daten hochladen"
+SECTION_INITIALIZING_PROGRAM="Initialisiere Programm"
 SECTION_MALWARE="Malware"
 SECTION_MEMORY_AND_PROCESSES="Speicher und Prozesse"
+SECTION_SYSTEM_TOOLS="Systemwerkzeuge"
+STATUS_DISABLED="DEAKTIVIERT"
 STATUS_DONE="FERTIG"
+STATUS_ENABLED="AKTIVIERT"
+STATUS_ERROR="FEHLER"
+STATUS_FAILED="FEHLERHAFT"
 STATUS_FOUND="GEFUNDEN"
-STATUS_YES="JA"
 STATUS_NO="NEIN"
+STATUS_NONE="NICHTS"
+STATUS_NOT_CONFIGURED="NICHT KONFIGURIERT"
+STATUS_NOT_FOUND="NICHT GEFUNDEN"
+STATUS_NOT_RUNNING="LÄUFT NICHT"
 STATUS_OFF="AUS"
 STATUS_OK="OK"
 STATUS_ON="AN"
-STATUS_NONE="NICHTS"
-STATUS_NOT_FOUND="NICHT GEFUNDEN"
-STATUS_NOT_RUNNING="LÄUFT NICHT"
 STATUS_RUNNING="LÄUFT"
 STATUS_SKIPPED="ÜBERSPRUNGEN"
 STATUS_SUGGESTION="VORSCHLAG"
 STATUS_UNKNOWN="UNBEKANNT"
 STATUS_WARNING="WARNUNG"
-TEXT_YOU_CAN_HELP_LOGFILE="Sie können durch Übermittlung Ihrer Logdatei helfen"
+STATUS_WEAK="SCHWACH"
+STATUS_YES="JA"
 TEXT_UPDATE_AVAILABLE="Aktualisierung verfügbar"
-NOTE_SKIPPED_TESTS_NON_PRIVILEGED="Übersprungene Tests aufgrund nicht privilegiertem Modus"
-STATUS_DISABLED="DEAKTIVIERT"
-STATUS_ENABLED="AKTIVIERT"
-STATUS_ERROR="FEHLER"
-ERROR_NO_LICENSE="Kein Lizenzschlüssel eingerichtet"
-ERROR_NO_UPLOAD_SERVER="Kein Upload-Server eingerichtet"
+TEXT_YOU_CAN_HELP_LOGFILE="Sie können durch Übermittlung Ihrer Logdatei helfen"
diff --git a/db/languages/de-AT b/db/languages/de-AT
new file mode 120000
index 00000000..c42e816f
--- /dev/null
+++ b/db/languages/de-AT
@@ -0,0 +1 @@
+de
\ No newline at end of file
diff --git a/db/languages/en b/db/languages/en
index 716a584c..3a430644 100644
--- a/db/languages/en
+++ b/db/languages/en
@@ -10,8 +10,8 @@ GEN_PLUGINS_ENABLED="Plugins enabled"
 GEN_UPDATE_AVAILABLE="update available"
 GEN_VERBOSE_MODE="Verbose mode"
 GEN_WHAT_TO_DO="What to do"
-NOTE_EXCEPTIONS_FOUND="Exceptions found"
 NOTE_EXCEPTIONS_FOUND_DETAILED="Some exceptional events or information was found"
+NOTE_EXCEPTIONS_FOUND="Exceptions found"
 NOTE_PLUGINS_TAKE_TIME="Note: plugins have more extensive tests and may take several minutes to complete"
 NOTE_SKIPPED_TESTS_NON_PRIVILEGED="Skipped tests due to non-privileged mode"
 SECTION_CUSTOM_TESTS="Custom tests"
@@ -26,14 +26,14 @@ STATUS_ENABLED="ENABLED"
 STATUS_ERROR="ERROR"
 STATUS_FAILED="FAILED"
 STATUS_FOUND="FOUND"
-STATUS_OFF="OFF"
-STATUS_OK="OK"
-STATUS_ON="ON"
 STATUS_NO="NO"
 STATUS_NONE="NONE"
 STATUS_NOT_CONFIGURED="NOT CONFIGURED"
 STATUS_NOT_FOUND="NOT FOUND"
 STATUS_NOT_RUNNING="NOT RUNNING"
+STATUS_OFF="OFF"
+STATUS_OK="OK"
+STATUS_ON="ON"
 STATUS_RUNNING="RUNNING"
 STATUS_SKIPPED="SKIPPED"
 STATUS_SUGGESTION="SUGGESTION"
@@ -41,5 +41,5 @@ STATUS_UNKNOWN="UNKNOWN"
 STATUS_WARNING="WARNING"
 STATUS_WEAK="WEAK"
 STATUS_YES="YES"
-TEXT_YOU_CAN_HELP_LOGFILE="You can help by providing your log file"
 TEXT_UPDATE_AVAILABLE="update available"
+TEXT_YOU_CAN_HELP_LOGFILE="You can help by providing your log file"

From 4a71989d2e519391b52bbf050851699724db3744 Mon Sep 17 00:00:00 2001
From: Alexander L <lackner.alex@gmail.com>
Date: Sat, 20 Jun 2020 14:20:58 +0200
Subject: [PATCH 610/679] Update en

Sorting
---
 db/languages/en | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/db/languages/en b/db/languages/en
index 3a430644..7b697896 100644
--- a/db/languages/en
+++ b/db/languages/en
@@ -10,8 +10,8 @@ GEN_PLUGINS_ENABLED="Plugins enabled"
 GEN_UPDATE_AVAILABLE="update available"
 GEN_VERBOSE_MODE="Verbose mode"
 GEN_WHAT_TO_DO="What to do"
-NOTE_EXCEPTIONS_FOUND_DETAILED="Some exceptional events or information was found"
 NOTE_EXCEPTIONS_FOUND="Exceptions found"
+NOTE_EXCEPTIONS_FOUND_DETAILED="Some exceptional events or information was found"
 NOTE_PLUGINS_TAKE_TIME="Note: plugins have more extensive tests and may take several minutes to complete"
 NOTE_SKIPPED_TESTS_NON_PRIVILEGED="Skipped tests due to non-privileged mode"
 SECTION_CUSTOM_TESTS="Custom tests"

From dfb02e41791d9cc11aef47aaa3874fc63c512da8 Mon Sep 17 00:00:00 2001
From: Alexander L <lackner.alex@gmail.com>
Date: Sat, 20 Jun 2020 14:23:17 +0200
Subject: [PATCH 611/679] Update de

Sorting
---
 db/languages/de | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/db/languages/de b/db/languages/de
index e1465aa2..ef6711c8 100644
--- a/db/languages/de
+++ b/db/languages/de
@@ -10,8 +10,8 @@ GEN_PLUGINS_ENABLED="Plugins aktiviert"
 GEN_UPDATE_AVAILABLE="Aktualisierung verfügbar"
 GEN_VERBOSE_MODE="Ausführlicher Modus"
 GEN_WHAT_TO_DO="Was zu tun ist"
-NOTE_EXCEPTIONS_FOUND_DETAILED="Einige außergewöhnliche Ereignisse oder Informationen wurden gefunden"
 NOTE_EXCEPTIONS_FOUND="Abweichungen gefunden"
+NOTE_EXCEPTIONS_FOUND_DETAILED="Einige außergewöhnliche Ereignisse oder Informationen wurden gefunden"
 NOTE_PLUGINS_TAKE_TIME="Beachte: Plugins beinhalten eingehendere Tests und können mehrere Minuten benötigen, bis sie abgeschlossen sind"
 NOTE_SKIPPED_TESTS_NON_PRIVILEGED="Übersprungene Tests aufgrund nicht privilegiertem Modus"
 SECTION_CUSTOM_TESTS="Benutzerdefinierte Tests"

From b7b132721e166d9809e081e4c082a9e843b2d345 Mon Sep 17 00:00:00 2001
From: Simon Biewald <simon@fam-biewald.de>
Date: Sat, 20 Jun 2020 17:08:56 +0200
Subject: [PATCH 612/679] check permissions of files used by rsh

The old rsh (remote shell) grants access to users and hosts in the files
/etc/hosts.equiv and ~/r(login|hosts). If attackers can write to those
files, he can logon as a different user or even root (in case of roots
.r(login|hosts) only) to the system. While the rsh daemon usually checks
for non-root owners or write permissions, this may not be the case on
any system.

Those files might affect other services as well (rlogin, rcp, ...).

As hostnames and usernames are not verified securely, the use of rsh and
similar commands discouraged. It may still be in use on legacy systems
even today, so it should be secured as much as possible if not possible
to remove/replace.
---
 default.prf | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/default.prf b/default.prf
index 6ff3eac2..7f1a6899 100644
--- a/default.prf
+++ b/default.prf
@@ -303,6 +303,9 @@ permfile=/etc/motd:rw-r--r--:root:root:WARN:
 permfile=/etc/passwd:rw-r--r--:root:-:WARN:
 permfile=/etc/passwd-:rw-r--r--:root:-:WARN:
 permfile=/etc/ssh/sshd_config:rw-------:root:-:WARN:
+permfile=/etc/hosts.equiv:rw-r--r--:root:root:WARN:
+permfile=/root/.rhosts:rw-------:root:root:WARN:
+permfile=/root/.rlogin:rw-------:root:root:WARN:
 
 # These permissions differ by OS
 #permfile=/etc/gshadow:---------:root:-:WARN:

From 5cd33746a0a0a7fc85c888c12215749117a661e0 Mon Sep 17 00:00:00 2001
From: Simon Biewald <simon@fam-biewald.de>
Date: Sat, 20 Jun 2020 17:45:34 +0200
Subject: [PATCH 613/679] add (Open)SSH equivalents to rhost files

SSH also supports host based authentication. In contrast to the totally
insecure rsh, the hostnames are checked cryptographically. The
authorization checks are still done with the same syntax as with rsh.
In addition to the old rhosts/rlogin (and eqviv) file, SSH adds the
slogin file. This must not be writable as well, as attackers could
elevate their privileges.
---
 default.prf | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/default.prf b/default.prf
index 7f1a6899..26e10fc0 100644
--- a/default.prf
+++ b/default.prf
@@ -304,8 +304,10 @@ permfile=/etc/passwd:rw-r--r--:root:-:WARN:
 permfile=/etc/passwd-:rw-r--r--:root:-:WARN:
 permfile=/etc/ssh/sshd_config:rw-------:root:-:WARN:
 permfile=/etc/hosts.equiv:rw-r--r--:root:root:WARN:
+permfile=/etc/shosts.equiv:rw-r--r--:root:root:WARN:
 permfile=/root/.rhosts:rw-------:root:root:WARN:
 permfile=/root/.rlogin:rw-------:root:root:WARN:
+permfile=/root/.shosts:rw-------:root:root:WARN:
 
 # These permissions differ by OS
 #permfile=/etc/gshadow:---------:root:-:WARN:

From 06b3cbe52909fefab3800b7eafd1dcd348f79486 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 21 Jun 2020 12:36:36 +0200
Subject: [PATCH 614/679] Reordered items

---
 db/software-eol.db | 48 ++++++++++++++++++++++++----------------------
 1 file changed, 25 insertions(+), 23 deletions(-)

diff --git a/db/software-eol.db b/db/software-eol.db
index beb4eff1..997ad72e 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -39,6 +39,15 @@ os:Debian 8:2020-06-30:1593468000:
 os:Debian 9:2022-01-01:1640991600:
 os:Debian 10:2022-01-01:1640991600:
 #
+# Fedora - https://fedoraproject.org/wiki/End_of_life
+#
+os:Fedora release 25:2017-12-12:1513033200
+os:Fedora release 26:2018-05-29:1527544800
+os:Fedora release 27:2018-11-30:1543532400
+os:Fedora release 28:2019-05-28:1558994400
+os:Fedora release 29:2019-11-26:1574722800
+os:Fedora release 30:2020-05-26:1590444000
+#
 # FreeBSD - https://www.freebsd.org/security/unsupported.html
 #
 os:FreeBSD 9.3:2014-12-31:1419980400:
@@ -120,22 +129,6 @@ os:Red Hat Enterprise Linux Server release 6:2020-11-30:1606690800:
 os:Red Hat Enterprise Linux 7:2024-06-30:1719698400:
 os:Red Hat Enterprise Linux 8:2029-05-07:1872799200:
 #
-# Ubuntu - https://wiki.ubuntu.com/Kernel/LTSEnablementStack and
-#          https://wiki.ubuntu.com/Releases
-#
-os:Ubuntu 14.04:2019-05-01:1556661600:
-os:Ubuntu 14.10:2015-07-01:1435701600:
-os:Ubuntu 15.04:2016-01-01:1451602800:
-os:Ubuntu 15.10:2016-07-01:1467324000:
-os:Ubuntu 16.04:2021-05-01:1619820000:
-os:Ubuntu 16.10:2017-07-01:1498860000:
-os:Ubuntu 17.04:2018-01-01:1514761200:
-os:Ubuntu 17.10:2018-07-01:1530396000:
-os:Ubuntu 18.04:2023-05-01:1682892000:
-os:Ubuntu 18.10:2019-07-18:1563400800:
-os:Ubuntu 19.04:2020-01-01:1577833200:
-os:Ubuntu 20.04:2025-04-01:1743458400
-#
 # Slackware - https://en.wikipedia.org/wiki/Slackware#Releases
 #
 os:Slackware Linux 8.1:2012-08-01:1343768400:
@@ -152,11 +145,20 @@ os:Slackware Linux 13.0:2018-07-05:1530738000:
 os:Slackware Linux 13.1:2018-07-05:1530738000:
 os:Slackware Linux 13.37:2018-07-05:1530738000:
 #
-# Fedora - https://fedoraproject.org/wiki/End_of_life
+# Ubuntu - https://wiki.ubuntu.com/Kernel/LTSEnablementStack and
+#          https://wiki.ubuntu.com/Releases
 #
-os:Fedora release 25:2017-12-12:1513033200
-os:Fedora release 26:2018-05-29:1527544800
-os:Fedora release 27:2018-11-30:1543532400
-os:Fedora release 28:2019-05-28:1558994400
-os:Fedora release 29:2019-11-26:1574722800
-os:Fedora release 30:2020-05-26:1590444000
+os:Ubuntu 14.04:2019-05-01:1556661600:
+os:Ubuntu 14.10:2015-07-01:1435701600:
+os:Ubuntu 15.04:2016-01-01:1451602800:
+os:Ubuntu 15.10:2016-07-01:1467324000:
+os:Ubuntu 16.04:2021-05-01:1619820000:
+os:Ubuntu 16.10:2017-07-01:1498860000:
+os:Ubuntu 17.04:2018-01-01:1514761200:
+os:Ubuntu 17.10:2018-07-01:1530396000:
+os:Ubuntu 18.04:2023-05-01:1682892000:
+os:Ubuntu 18.10:2019-07-18:1563400800:
+os:Ubuntu 19.04:2020-01-01:1577833200:
+os:Ubuntu 20.04:2025-04-01:1743458400
+#
+# EOF
\ No newline at end of file

From f855fe7a047956336a0484e669d8202fd0cbfa04 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 21 Jun 2020 12:40:03 +0200
Subject: [PATCH 615/679] Added Linux Mint

---
 db/software-eol.db | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/db/software-eol.db b/db/software-eol.db
index 997ad72e..5b74ad08 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -61,6 +61,12 @@ os:FreeBSD 11.1:2018-09-30:1538258400:
 os:FreeBSD 11.2:2019-10-31:1572476400:
 os:FreeBSD 12.0:2020-02-29:1582930800:
 #
+# Linux Mint
+#
+os:Linux Mint 18:2021-04-01:1617228000:
+os:Linux Mint 19:2023-04-01:1680300000:
+os:Linux Mint 20:2025-04-01:1743458400:
+#
 # NetBSD - https://www.netbsd.org/support/security/release.html and
 #          https://www.netbsd.org/releases/formal.html
 #

From 22644edc5031022a294711bf0714f25d47483ab7 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 21 Jun 2020 12:40:43 +0200
Subject: [PATCH 616/679] Added missing colons

---
 db/software-eol.db | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/db/software-eol.db b/db/software-eol.db
index 5b74ad08..a5a1101e 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -41,12 +41,12 @@ os:Debian 10:2022-01-01:1640991600:
 #
 # Fedora - https://fedoraproject.org/wiki/End_of_life
 #
-os:Fedora release 25:2017-12-12:1513033200
-os:Fedora release 26:2018-05-29:1527544800
-os:Fedora release 27:2018-11-30:1543532400
-os:Fedora release 28:2019-05-28:1558994400
-os:Fedora release 29:2019-11-26:1574722800
-os:Fedora release 30:2020-05-26:1590444000
+os:Fedora release 25:2017-12-12:1513033200:
+os:Fedora release 26:2018-05-29:1527544800:
+os:Fedora release 27:2018-11-30:1543532400:
+os:Fedora release 28:2019-05-28:1558994400:
+os:Fedora release 29:2019-11-26:1574722800:
+os:Fedora release 30:2020-05-26:1590444000:
 #
 # FreeBSD - https://www.freebsd.org/security/unsupported.html
 #
@@ -165,6 +165,6 @@ os:Ubuntu 17.10:2018-07-01:1530396000:
 os:Ubuntu 18.04:2023-05-01:1682892000:
 os:Ubuntu 18.10:2019-07-18:1563400800:
 os:Ubuntu 19.04:2020-01-01:1577833200:
-os:Ubuntu 20.04:2025-04-01:1743458400
+os:Ubuntu 20.04:2025-04-01:1743458400:
 #
 # EOF
\ No newline at end of file

From 251cb979026a986e56f158bb9e28416136f4bcd5 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 21 Jun 2020 12:40:51 +0200
Subject: [PATCH 617/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 86887a24..5014a413 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 ### Changed
 - Added Kali Linux
+- End-of-life database updated
 - Small code enhancements
 
 ---------------------------------------------------------------------------------

From b2350f2f6c497a9e3fec173c0bb0257072fc1a5a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 21 Jun 2020 12:52:50 +0200
Subject: [PATCH 618/679] Add log entry to help troubleshooting users that
 still use old-style configuration entries in profile

---
 include/profiles | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/profiles b/include/profiles
index da2124f7..113250d1 100644
--- a/include/profiles
+++ b/include/profiles
@@ -50,6 +50,7 @@
             Display --text " "
             Display --text "=================================================================================================="
             Display --text " "
+            LogText "Insight: Profile '${PROFILE}' contians one or more old-style configuration entries"
             ReportWarning "GEN-0020" "Your profile contains one or more old-style configuration entries"
             sleep 10
         fi

From aebd5ed9b340376dc9a3e19b0108217850d87d31 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 21 Jun 2020 12:57:05 +0200
Subject: [PATCH 619/679] Remove unneeded line in log to prevent double entry

---
 include/profiles | 1 -
 1 file changed, 1 deletion(-)

diff --git a/include/profiles b/include/profiles
index 113250d1..2b0885ce 100644
--- a/include/profiles
+++ b/include/profiles
@@ -557,7 +557,6 @@
 
     Display --indent 2 --text "- Checking profiles..." --result "DONE" --color GREEN
 
-LogTextBreak
 
 #================================================================================
 # Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com

From 6d9b530bf493e83c423c7c4058b4bbb44a85db46 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 21 Jun 2020 13:14:08 +0200
Subject: [PATCH 620/679] [KRNL-5830] improved detection for non-symlinked
 kernel on disk

---
 include/tests_kernel | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/tests_kernel b/include/tests_kernel
index 72e5082b..d445bb65 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -674,7 +674,10 @@
                         LogText "Result: found a symlink, retrieving destination"
                         FOUND_VMLINUZ=$(readlink "${FOUND_VMLINUZ}")
                         LogText "Result: destination file is ${FOUND_VMLINUZ}"
-                        VERSION_ON_DISK=$(echo ${FOUND_VMLINUZ} | ${SEDBINARY} 's/^vmlinuz-//')
+                        VERSION_ON_DISK=$(echo ${FOUND_VMLINUZ} | ${SEDBINARY} 's#^/boot/##' | ${SEDBINARY} 's/^vmlinuz-//')
+                        LogText "Result: version derived from file name is '${VERSION_ON_DISK}'"
+                    elif [ -f "${FOUND_VMLINUZ}" ]; then
+                        VERSION_ON_DISK=$(echo ${FOUND_VMLINUZ} | ${SEDBINARY} 's#^/boot/##' | ${SEDBINARY} 's/^vmlinuz-//')
                         LogText "Result: version derived from file name is '${VERSION_ON_DISK}'"
                     fi
 

From 74c4298eab7ce660c896721c064218f66f563c83 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 21 Jun 2020 13:15:09 +0200
Subject: [PATCH 621/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5014a413..ee1b29bc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@
 ## Lynis 3.0.1 (not released yet)
 
 ### Changed
+- KRNL-5830 - Improved version detection for non-symlinked kernel
 - Added Kali Linux
 - End-of-life database updated
 - Small code enhancements

From c02ce49ce336abb146afc18d262bc7aab5365dc3 Mon Sep 17 00:00:00 2001
From: Steve8291 <hambling8@gmail.com>
Date: Sun, 21 Jun 2020 10:47:28 -0400
Subject: [PATCH 622/679] fix stderr output from cryptsetup status

Redirected stderr to /dev/null to silence output of `cryptsetup status /swap.img`
This was causing error output from my cron script.
Otherwise, if the swap file is not encrypted then the following error will be printed:
`Device swap.img not found`
---
 include/tests_crypto | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_crypto b/include/tests_crypto
index 02fa0a80..ddf1406a 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -186,7 +186,7 @@
             if ${CRYPTSETUPBINARY} isLuks "${BLOCK_DEV}" 2> /dev/null; then
                 LogText "Result: Found LUKS encrypted swap device: ${BLOCK_DEV}"
                 ENCRYPTED_SWAPS=$((ENCRYPTED_SWAPS +1))
-            elif ${CRYPTSETUPBINARY} status "${BLOCK_DEV}" | ${GREPBINARY} --quiet "cipher:"; then
+            elif ${CRYPTSETUPBINARY} status "${BLOCK_DEV}" 2> /dev/null | ${GREPBINARY} --quiet "cipher:"; then
                 LogText "Result: Found non-LUKS encrypted swap device: ${BLOCK_DEV}"
                 ENCRYPTED_SWAPS=$((ENCRYPTED_SWAPS +1))
             else

From a2f8bdc5f8b4c67338f7cf9995f74df06d572b27 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 22 Jun 2020 10:18:01 +0200
Subject: [PATCH 623/679] [BOOT-5122] presence check for grub.d added

---
 include/tests_boot_services | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/include/tests_boot_services b/include/tests_boot_services
index 8ad83d7c..fe5707e4 100644
--- a/include/tests_boot_services
+++ b/include/tests_boot_services
@@ -332,8 +332,12 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
 
-        CONF_FILES=$(${FINDBINARY} /etc/grub.d -type f -name "[0-9][0-9]*" -print0 | ${TRBINARY} '\0' ' ' | ${TRBINARY} -d '[:cntrl:]')
-        CONF_FILES="${GRUBCONFFILE} ${ROOTDIR}boot/grub/custom.cfg ${CONF_FILES}"
+        if [ "${ROOTDIR}etc/grub.d" ]; then
+            CONF_FILES=$(${FINDBINARY} "${ROOTDIR}etc/grub.d" -type f -name "[0-9][0-9]*" -print0 | ${TRBINARY} '\0' ' ' | ${TRBINARY} -d '[:cntrl:]')
+            CONF_FILES="${GRUBCONFFILE} ${ROOTDIR}boot/grub/custom.cfg ${CONF_FILES}"
+        else
+            CONF_FILES="${GRUBCONFFILE} ${ROOTDIR}boot/grub/custom.cfg"
+        fi
 
         for FILE in ${CONF_FILES}; do
             if [ -f "${FILE}" ]; then

From 6d6781a2ae9e57624ce834915fec6b040c5e4188 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 22 Jun 2020 10:18:56 +0200
Subject: [PATCH 624/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ee1b29bc..3baafee1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@
 ## Lynis 3.0.1 (not released yet)
 
 ### Changed
+- BOOT-5122 - Presence check for grub.d added
 - KRNL-5830 - Improved version detection for non-symlinked kernel
 - Added Kali Linux
 - End-of-life database updated

From 75738ceeab380e852739a9b78e0d907f3e611478 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 22 Jun 2020 10:25:02 +0200
Subject: [PATCH 625/679] Fix for language detection, unset LANG as right place

---
 CHANGELOG.md   | 1 +
 include/consts | 4 ----
 lynis          | 5 +++++
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3baafee1..deaac158 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@
 - BOOT-5122 - Presence check for grub.d added
 - KRNL-5830 - Improved version detection for non-symlinked kernel
 - Added Kali Linux
+- Fix: language detection
 - End-of-life database updated
 - Small code enhancements
 
diff --git a/include/consts b/include/consts
index 7968ef1f..1a75ae68 100644
--- a/include/consts
+++ b/include/consts
@@ -33,10 +33,6 @@ BIN_PATHS="/bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin \
 
 ETC_PATHS="/etc /usr/local/etc"
 
-# Do not use specific language, fall back to default
-# Some tools with translated strings are very hard to parse
-unset LANG
-
 #
 #################################################################################
 #
diff --git a/lynis b/lynis
index 9b0e5894..76722baa 100755
--- a/lynis
+++ b/lynis
@@ -241,6 +241,11 @@
         echo "Could not find languages directory (file: ${DBDIR}/languages/en)"
         exit 1
     fi
+
+    # Now that we have determined the language, we unset it from shell
+    # Some tools with translated strings are very hard to parse
+    unset LANG
+
 #
 #################################################################################
 #

From c6cc6fb8c73b7ba8a46ad55efb16315ef8ee2f35 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 22 Jun 2020 14:27:30 +0200
Subject: [PATCH 626/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index deaac158..6f4b61a0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 ### Changed
 - BOOT-5122 - Presence check for grub.d added
+- CRYP-7931 - Redirect errors (e.g. when swap is not encrypted)
 - KRNL-5830 - Improved version detection for non-symlinked kernel
 - Added Kali Linux
 - Fix: language detection

From d7870e3f5cdf72f76e9560c61aba715fef800601 Mon Sep 17 00:00:00 2001
From: Alexander Lackner <lackner.alex@gmail.com>
Date: Mon, 22 Jun 2020 20:44:58 +0200
Subject: [PATCH 627/679] Added macOS Big Sur (11.0)

---
 include/osdetection | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/osdetection b/include/osdetection
index 88aa8209..f4d3b50d 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -62,6 +62,7 @@
                     10.13 | 10.13.[0-9]*) OS_FULLNAME="macOS High Sierra (${OS_VERSION})" ;;
                     10.14 | 10.14.[0-9]*) OS_FULLNAME="macOS Mojave (${OS_VERSION})" ;;
                     10.15 | 10.15.[0-9]*) OS_FULLNAME="macOS Catalina (${OS_VERSION})" ;;
+                    11.0 | 11.0[0-9]*) OS_FULLNAME="macOS Big Sur (${OS_VERSION})" ;;
                     *) echo "Unknown macOS version. Do you know what version it is? Create an issue at ${PROGRAM_SOURCE}" ;;
                 esac
             else

From 8596156ca16e3767638e4307a2dd9274b7a987f6 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 23 Jun 2020 10:36:32 +0200
Subject: [PATCH 628/679] Updated log

---
 CHANGELOG.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6f4b61a0..1397cee3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,12 +2,16 @@
 
 ## Lynis 3.0.1 (not released yet)
 
+### Added
+- Detection of macOS Big Sur (11.0)
+- Detection of Kali Linux
+
 ### Changed
 - BOOT-5122 - Presence check for grub.d added
 - CRYP-7931 - Redirect errors (e.g. when swap is not encrypted)
 - KRNL-5830 - Improved version detection for non-symlinked kernel
-- Added Kali Linux
 - Fix: language detection
+- German translation updated
 - End-of-life database updated
 - Small code enhancements
 

From 44fb7efd6475fb149601b3979b80da62ebf58d66 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 23 Jun 2020 10:57:45 +0200
Subject: [PATCH 629/679] Strip quotes in locale output, e.g. macOS

---
 lynis | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lynis b/lynis
index 76722baa..492cc2f4 100755
--- a/lynis
+++ b/lynis
@@ -216,7 +216,7 @@
 
     # Extract the short notation of the language (first two characters).
     if [ -x "$(command -v locale 2> /dev/null)" ]; then
-        LANGUAGE=$(locale | egrep "^LANG=" | cut -d= -f2 | cut -d_ -f1 | egrep "^[a-z]{2}$")
+        LANGUAGE=$(locale | egrep "^LANG=" | cut -d= -f2 | cut -d_ -f1 | tr -d '"' | egrep "^[a-z]{2}$")
         # Try locale command if shell variable had no value
         if [ -z "${DISPLAY_LANG}" ]; then
             DISPLAY_LANG=$(locale | egrep "^LANG=" | cut -d= -f2)

From 610f70d5aa5a8e5930b7b0329e1e7c8347367f43 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 23 Jun 2020 13:56:13 +0200
Subject: [PATCH 630/679] [INSE-8312] corrected text

---
 include/tests_insecure_services | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_insecure_services b/include/tests_insecure_services
index 5c8af1fc..d6d87245 100644
--- a/include/tests_insecure_services
+++ b/include/tests_insecure_services
@@ -385,7 +385,7 @@
         if [ ${FOUND} -eq 1 ]; then
             LogText "Result: telnet server is installed"
             Display --indent 2 --text "- Installed telnet server package" --result "${STATUS_FOUND}" --color YELLOW
-            ReportSuggestion "${TEST_NO}" "Removing the ${FOUND} package and replace with SSH when possible"
+            ReportSuggestion "${TEST_NO}" "Removing the telnet server package and replace with SSH when possible"
             Report "insecure_service[]=telnet-server"
         else
             LogText "Result: telnet server is NOT installed"

From 36f86d76c441d5cfd090f637ca68388f5353c646 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 23 Jun 2020 13:57:14 +0200
Subject: [PATCH 631/679] [AUTH-9229] added option to look for LOCKED accounts

---
 include/tests_authentication | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index bf8cabe8..49ba49db 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -293,8 +293,8 @@
         if [ -e ${ROOTDIR}etc/shadow ]; then SHADOW="${ROOTDIR}etc/shadow"; fi
         FIND=$(${CAT_BINARY} ${ROOTDIR}etc/passwd ${SHADOW} | ${AWKBINARY} -F : '{print length($2) ":" $2 }' | while read METHOD; do
             case ${METHOD} in
-                1:\* | 1:x | 0: | *:!*)
-                    # disabled | shadowed | no password | locked account
+                1:\* | 1:x | 0: | *:!* | *LOCK*)
+                    # disabled | shadowed | no password | locked account (can be literal *LOCK* or something like LOCKED)
                     ;;
                 *:\$5\$*| *:\$6\$*)
                     # sha256crypt | sha512crypt: check number of rounds, should be >5000

From d61d7f5ab7e5ef785b2c9b514773318c0bd4571b Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 23 Jun 2020 13:57:36 +0200
Subject: [PATCH 632/679] Updated log

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1397cee3..d09087be 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,8 +7,10 @@
 - Detection of Kali Linux
 
 ### Changed
+- AUTH-9229 - Added option for LOCKED accounts
 - BOOT-5122 - Presence check for grub.d added
 - CRYP-7931 - Redirect errors (e.g. when swap is not encrypted)
+- INSE-8312 - corrected text on screen
 - KRNL-5830 - Improved version detection for non-symlinked kernel
 - Fix: language detection
 - German translation updated

From c707b7d100dd902e7f183812504bc24428420c64 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 24 Jun 2020 08:09:12 +0200
Subject: [PATCH 633/679] [MALW-3280] added additional BitDefender process

---
 include/tests_malware | 44 +++++++++++++++++++++----------------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/include/tests_malware b/include/tests_malware
index a5ed3e06..5e3c6fca 100644
--- a/include/tests_malware
+++ b/include/tests_malware
@@ -102,28 +102,6 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         FOUND=0
 
-        # ESET security products
-        LogText "Test: checking process esets_daemon"
-        if IsRunning "esets_daemon"; then
-            FOUND=1
-            ESET_DAEMON_RUNNING=1
-            MALWARE_SCANNER_INSTALLED=1
-            if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} ESET daemon" --result "${STATUS_FOUND}" --color GREEN; fi
-            LogText "Result: found ESET security product"
-            Report "malware_scanner[]=eset"
-        fi
-
-        # Bitdefender (macOS)
-        LogText "Test: checking process epagd"
-        if IsRunning "epagd"; then
-            FOUND=1
-            BITDEFENDER_DAEMON_RUNNING=1
-            MALWARE_SCANNER_INSTALLED=1
-            if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} Bitdefender agent" --result "${STATUS_FOUND}" --color GREEN; fi
-            LogText "Result: found Bitdefender security product"
-            Report "malware_scanner[]=bitdefender"
-        fi
-
         # Avast (macOS)
         LogText "Test: checking process com.avast.daemon"
         if IsRunning "com.avast.daemon"; then
@@ -146,6 +124,17 @@
             Report "malware_scanner[]=avira"
         fi
 
+        # Bitdefender (macOS)
+        LogText "Test: checking process epagd"
+        if IsRunning "bdagentd" || IsRunning "epagd"; then
+            FOUND=1
+            BITDEFENDER_DAEMON_RUNNING=1
+            MALWARE_SCANNER_INSTALLED=1
+            if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} Bitdefender agent" --result "${STATUS_FOUND}" --color GREEN; fi
+            LogText "Result: found Bitdefender security product"
+            Report "malware_scanner[]=bitdefender"
+        fi
+
         # CrowdStrike falcon-sensor
         LogText "Test: checking process falcon-sensor (CrowdStrike)"
         if IsRunning "falcon-sensor"; then
@@ -168,6 +157,17 @@
             Report "malware_scanner[]=cylance-protect"
         fi
 
+        # ESET security products
+        LogText "Test: checking process esets_daemon"
+        if IsRunning "esets_daemon"; then
+            FOUND=1
+            ESET_DAEMON_RUNNING=1
+            MALWARE_SCANNER_INSTALLED=1
+            if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} ESET daemon" --result "${STATUS_FOUND}" --color GREEN; fi
+            LogText "Result: found ESET security product"
+            Report "malware_scanner[]=eset"
+        fi
+
         # Kaspersky products
         LogText "Test: checking process wdserver or klnagent (Kaspersky)"
         # wdserver is too generic to match on, so we want to ensure that it is related to Kaspersky first

From 0b655363226d09e8802cd12a93e392756d6f7920 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 24 Jun 2020 08:09:48 +0200
Subject: [PATCH 634/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d09087be..3fa1c226 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@
 - CRYP-7931 - Redirect errors (e.g. when swap is not encrypted)
 - INSE-8312 - corrected text on screen
 - KRNL-5830 - Improved version detection for non-symlinked kernel
+- MALW-3280 - Extended detection of BitDefender
 - Fix: language detection
 - German translation updated
 - End-of-life database updated

From 18ec88d1749d65695fefc4fec0991e2681214758 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 24 Jun 2020 09:23:16 +0200
Subject: [PATCH 635/679] Updated log

---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3fa1c226..67fd4932 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,7 +10,8 @@
 - AUTH-9229 - Added option for LOCKED accounts
 - BOOT-5122 - Presence check for grub.d added
 - CRYP-7931 - Redirect errors (e.g. when swap is not encrypted)
-- INSE-8312 - corrected text on screen
+- INSE-8312 - Corrected text on screen
+- KRNL-5728 - Handle zipped kernel configuration correctly
 - KRNL-5830 - Improved version detection for non-symlinked kernel
 - MALW-3280 - Extended detection of BitDefender
 - Fix: language detection

From e3ccca4ac0dbedaf98cba26a3ec9bc630125d530 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
 <konstruktoid@users.noreply.github.com>
Date: Thu, 25 Jun 2020 15:33:31 +0200
Subject: [PATCH 636/679] add SUSE Linux Enterprise Server EOL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
 db/software-eol.db | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/db/software-eol.db b/db/software-eol.db
index a5a1101e..c42e244a 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -151,6 +151,11 @@ os:Slackware Linux 13.0:2018-07-05:1530738000:
 os:Slackware Linux 13.1:2018-07-05:1530738000:
 os:Slackware Linux 13.37:2018-07-05:1530738000:
 #
+# SuSE - https://www.suse.com/lifecycle/
+#
+os:SUSE Linux Enterprise Server 12:2024-10-31:1730329200:
+os:SUSE Linux Enterprise Server 15:2028-07-31:1848607200:
+#
 # Ubuntu - https://wiki.ubuntu.com/Kernel/LTSEnablementStack and
 #          https://wiki.ubuntu.com/Releases
 #
@@ -167,4 +172,4 @@ os:Ubuntu 18.10:2019-07-18:1563400800:
 os:Ubuntu 19.04:2020-01-01:1577833200:
 os:Ubuntu 20.04:2025-04-01:1743458400:
 #
-# EOF
\ No newline at end of file
+# EOF

From 68c6bdff162de22480c61170bdce7c5dad0f51e1 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jun 2020 09:34:40 +0200
Subject: [PATCH 637/679] [AUTH-9229] escaped exclamation mark

---
 include/tests_authentication | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 49ba49db..1a78f8a2 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -293,7 +293,7 @@
         if [ -e ${ROOTDIR}etc/shadow ]; then SHADOW="${ROOTDIR}etc/shadow"; fi
         FIND=$(${CAT_BINARY} ${ROOTDIR}etc/passwd ${SHADOW} | ${AWKBINARY} -F : '{print length($2) ":" $2 }' | while read METHOD; do
             case ${METHOD} in
-                1:\* | 1:x | 0: | *:!* | *LOCK*)
+                1:\* | 1:x | 0: | *:\!* | *LOCK*)
                     # disabled | shadowed | no password | locked account (can be literal *LOCK* or something like LOCKED)
                     ;;
                 *:\$5\$*| *:\$6\$*)

From 9f0bbf52ea761374b6ae70b3126c71d4c572b096 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jun 2020 09:44:39 +0200
Subject: [PATCH 638/679] [FIRE-4534] set initial state

---
 include/tests_firewalls | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/tests_firewalls b/include/tests_firewalls
index 20f87e1e..d3ff1e3d 100644
--- a/include/tests_firewalls
+++ b/include/tests_firewalls
@@ -407,6 +407,8 @@
     Register --test-no FIRE-4534 --weight L --os "macOS" --network NO --category security --description "Check for presence of outbound firewalls on macOS"
     if [ ${SKIPTEST} -eq 0 ]; then
 
+        FOUND=0
+
         # Little Snitch Daemon (macOS)
         LogText "Test: checking process Little Snitch Daemon"
         if IsRunning --full "Little Snitch Daemon"; then

From f00637d43348b701705244d978926138e5da7d42 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jun 2020 09:45:09 +0200
Subject: [PATCH 639/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 67fd4932..d32bd9d1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@
 - AUTH-9229 - Added option for LOCKED accounts
 - BOOT-5122 - Presence check for grub.d added
 - CRYP-7931 - Redirect errors (e.g. when swap is not encrypted)
+- FIRE-4535 - Set initial firewall state
 - INSE-8312 - Corrected text on screen
 - KRNL-5728 - Handle zipped kernel configuration correctly
 - KRNL-5830 - Improved version detection for non-symlinked kernel

From 871f95cbf3afd86b4a197a8466b8e5d387284972 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jun 2020 09:53:23 +0200
Subject: [PATCH 640/679] Use BSD style format when calling stat

---
 include/functions | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/functions b/include/functions
index 8d5a5ef8..4ff5b43a 100644
--- a/include/functions
+++ b/include/functions
@@ -1290,7 +1290,8 @@
                 if [ -n "${STATBINARY}" ]; then
 
                     case ${OS} in
-                        *BSD)
+                        *BSD | "macOS")
+                            # BSD and macOS have no --format, only short notation
                             DATA=$(${STATBINARY} -f "%OLp" ${CHECKFILE})
                         ;;
                         *)

From ee3a3df60178c4bcf23a7784b8b7b3e12f3b9b3e Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jun 2020 09:54:05 +0200
Subject: [PATCH 641/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d32bd9d1..dcc594df 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,7 @@
 - KRNL-5728 - Handle zipped kernel configuration correctly
 - KRNL-5830 - Improved version detection for non-symlinked kernel
 - MALW-3280 - Extended detection of BitDefender
+- Generic improvements for macOS
 - Fix: language detection
 - German translation updated
 - End-of-life database updated

From e6c6fdc9a8e0ea26d42d95cbeced60a0e039e4e7 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jun 2020 10:24:37 +0200
Subject: [PATCH 642/679] [AUTH-9229] Undo escaping exclamation mark and
 disabling test for AIX and macOS

---
 include/tests_authentication | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 1a78f8a2..e8f5c834 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -285,15 +285,24 @@
     # Test        : AUTH-9229
     # Description : Check password hashing methods vs. recommendations in crypt(5)
     # Notes       : Applicable to all Unix-like OS
+    #               Does not work correctly on AIX and macOS (unknown why)
     #               Requires read access to /etc/shadow (if it exists)
-    Register --test-no AUTH-9229 --root-only YES --weight L --network NO --category security --description "Check password hashing methods"
+    case ${OS} in
+        "AIX" | "macOS")
+            PREQS_MET="NO"
+        ;;
+        *)
+            PREQS_MET="YES"
+        ;;
+    esac
+    Register --test-no AUTH-9229 --preqs-met ${PREQS_MET} --root-only YES --weight L --network NO --category security --description "Check password hashing methods"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking password hashing methods"
         SHADOW="";
         if [ -e ${ROOTDIR}etc/shadow ]; then SHADOW="${ROOTDIR}etc/shadow"; fi
         FIND=$(${CAT_BINARY} ${ROOTDIR}etc/passwd ${SHADOW} | ${AWKBINARY} -F : '{print length($2) ":" $2 }' | while read METHOD; do
             case ${METHOD} in
-                1:\* | 1:x | 0: | *:\!* | *LOCK*)
+                1:\* | 1:x | 0: | *:!* | *LOCK*)
                     # disabled | shadowed | no password | locked account (can be literal *LOCK* or something like LOCKED)
                     ;;
                 *:\$5\$*| *:\$6\$*)

From 968aa931e4aa97428eb2bf71f8899ad829f2e858 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jun 2020 10:25:59 +0200
Subject: [PATCH 643/679] Bump release date

---
 lynis | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lynis b/lynis
index 492cc2f4..10f736c5 100755
--- a/lynis
+++ b/lynis
@@ -43,8 +43,8 @@
     PROGRAM_WEBSITE="https://cisofy.com/lynis/"
 
     # Version details
-    PROGRAM_RELEASE_DATE="2020-06-18"
-    PROGRAM_RELEASE_TIMESTAMP=1592477492
+    PROGRAM_RELEASE_DATE="2020-06-26"
+    PROGRAM_RELEASE_TIMESTAMP=1593159916
     PROGRAM_RELEASE_TYPE="pre-release" # pre-release or release
     PROGRAM_VERSION="3.0.1"
 

From 5c05fab0e96b9f00cd0babc0d38db6b9e59a8347 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 26 Jun 2020 10:26:10 +0200
Subject: [PATCH 644/679] Updated log

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dcc594df..e4079515 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,7 @@
 - Detection of Kali Linux
 
 ### Changed
-- AUTH-9229 - Added option for LOCKED accounts
+- AUTH-9229 - Added option for LOCKED accounts, disabled test for AIX/macOS
 - BOOT-5122 - Presence check for grub.d added
 - CRYP-7931 - Redirect errors (e.g. when swap is not encrypted)
 - FIRE-4535 - Set initial firewall state

From dcf9bd0938885de930d99a1371e95a830e83bd6b Mon Sep 17 00:00:00 2001
From: Wes Price <wprice@hawaii.edu>
Date: Fri, 26 Jun 2020 12:29:21 -1000
Subject: [PATCH 645/679] [AUTH-9229] resolving syntax error on MacOS Catalina

---
 include/tests_authentication | 82 +++++++++++++++++++-----------------
 1 file changed, 44 insertions(+), 38 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index e8f5c834..38d9caa1 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -295,50 +295,56 @@
             PREQS_MET="YES"
         ;;
     esac
+
+    function ParsePasswordEntry() {
+        METHOD=$1
+        case ${METHOD} in
+            1:\* | 1:x | 0: | *:!* | *LOCK*)
+                # disabled | shadowed | no password | locked account (can be literal *LOCK* or something like LOCKED)
+                ;;
+            *:\$5\$*| *:\$6\$*)
+                # sha256crypt | sha512crypt: check number of rounds, should be >5000
+                ROUNDS=$(echo "${METHOD}" | sed -n 's/.*rounds=\([0-9]*\)\$.*/\1/gp')
+                if [ -z "${ROUNDS}" ]; then
+                    echo 'sha256crypt/sha512crypt(default<=5000rounds)'
+                elif [ "${ROUNDS}" -le 5000 ]; then
+                    echo 'sha256crypt/sha512crypt(<=5000rounds)'
+                fi
+                ;;
+            *:\$y\$* | *:\$gy\$* | *:\$2b\$* | *:\$7\$*)
+                # yescrypt | gost-yescrypt | bcrypt | scrypt
+                ;;
+            *:_*)
+                echo bsdicrypt
+                ;;
+            *:\$1\$*)
+                echo md5crypt
+                ;;
+            *:\$3\$*)
+                echo NT
+                ;;
+            *:\$md5*)
+                echo SunMD5
+                ;;
+            *:\$sha1*)
+                echo sha1crypt
+                ;;
+            13:* | 178:*)
+                echo bigcrypt/descrypt
+                ;;
+            *)
+                echo "Unknown password hashing method ${METHOD}. Please report to lynis-dev@cisofy.com"
+                ;;
+        esac
+    }
+
     Register --test-no AUTH-9229 --preqs-met ${PREQS_MET} --root-only YES --weight L --network NO --category security --description "Check password hashing methods"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking password hashing methods"
         SHADOW="";
         if [ -e ${ROOTDIR}etc/shadow ]; then SHADOW="${ROOTDIR}etc/shadow"; fi
         FIND=$(${CAT_BINARY} ${ROOTDIR}etc/passwd ${SHADOW} | ${AWKBINARY} -F : '{print length($2) ":" $2 }' | while read METHOD; do
-            case ${METHOD} in
-                1:\* | 1:x | 0: | *:!* | *LOCK*)
-                    # disabled | shadowed | no password | locked account (can be literal *LOCK* or something like LOCKED)
-                    ;;
-                *:\$5\$*| *:\$6\$*)
-                    # sha256crypt | sha512crypt: check number of rounds, should be >5000
-                    ROUNDS=$(echo "${METHOD}" | sed -n 's/.*rounds=\([0-9]*\)\$.*/\1/gp')
-                    if [ -z "${ROUNDS}" ]; then
-                        echo 'sha256crypt/sha512crypt(default<=5000rounds)'
-                    elif [ "${ROUNDS}" -le 5000 ]; then
-                        echo 'sha256crypt/sha512crypt(<=5000rounds)'
-                    fi
-                    ;;
-                *:\$y\$* | *:\$gy\$* | *:\$2b\$* | *:\$7\$*)
-                    # yescrypt | gost-yescrypt | bcrypt | scrypt
-                    ;;
-                *:_*)
-                    echo bsdicrypt
-                    ;;
-                *:\$1\$*)
-                    echo md5crypt
-                    ;;
-                *:\$3\$*)
-                    echo NT
-                    ;;
-                *:\$md5*)
-                    echo SunMD5
-                    ;;
-                *:\$sha1*)
-                    echo sha1crypt
-                    ;;
-                13:* | 178:*)
-                    echo bigcrypt/descrypt
-                    ;;
-                *)
-                    echo "Unknown password hashing method ${METHOD}. Please report to lynis-dev@cisofy.com"
-                    ;;
-            esac
+            ParsePasswordEntry ${METHOD}
         done | ${SORTBINARY} -u | ${TRBINARY} '\n' ' ')
         if [ -z "${FIND}" ]; then
             Display --indent 2 --text "- Password hashing methods" --result "${STATUS_OK}" --color GREEN

From 96e7ba5aaa2f31d2879bc349dcee7ccf4f874386 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 27 Jun 2020 10:21:24 +0200
Subject: [PATCH 646/679] Activate test for all operating systems, remove
 function keyword

---
 include/tests_authentication | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/include/tests_authentication b/include/tests_authentication
index 38d9caa1..3dbe08f7 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -285,18 +285,9 @@
     # Test        : AUTH-9229
     # Description : Check password hashing methods vs. recommendations in crypt(5)
     # Notes       : Applicable to all Unix-like OS
-    #               Does not work correctly on AIX and macOS (unknown why)
     #               Requires read access to /etc/shadow (if it exists)
-    case ${OS} in
-        "AIX" | "macOS")
-            PREQS_MET="NO"
-        ;;
-        *)
-            PREQS_MET="YES"
-        ;;
-    esac
 
-    function ParsePasswordEntry() {
+    ParsePasswordEntry() {
         METHOD=$1
         case ${METHOD} in
             1:\* | 1:x | 0: | *:!* | *LOCK*)
@@ -338,7 +329,7 @@
         esac
     }
 
-    Register --test-no AUTH-9229 --preqs-met ${PREQS_MET} --root-only YES --weight L --network NO --category security --description "Check password hashing methods"
+    Register --test-no AUTH-9229 --root-only YES --weight L --network NO --category security --description "Check password hashing methods"
     if [ ${SKIPTEST} -eq 0 ]; then
         LogText "Test: Checking password hashing methods"
         SHADOW="";

From b94a842e19f7b408fc4a8ede324cd32cf35af020 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 27 Jun 2020 10:21:31 +0200
Subject: [PATCH 647/679] Updated log

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e4079515..c62639b2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,7 @@
 - Detection of Kali Linux
 
 ### Changed
-- AUTH-9229 - Added option for LOCKED accounts, disabled test for AIX/macOS
+- AUTH-9229 - Added option for LOCKED accounts and bugfix for older bash versions
 - BOOT-5122 - Presence check for grub.d added
 - CRYP-7931 - Redirect errors (e.g. when swap is not encrypted)
 - FIRE-4535 - Set initial firewall state

From 5b11c468ebcfee6f4fb28eee1d2070188d4411b5 Mon Sep 17 00:00:00 2001
From: Chris Lynch <chrislynch8@gmail.com>
Date: Sat, 27 Jun 2020 10:44:31 +0100
Subject: [PATCH 648/679] Fix for Issues #964 - Pop!_OS added to osdetection

---
 include/osdetection | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/osdetection b/include/osdetection
index f4d3b50d..ac099bde 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -217,6 +217,12 @@
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                             OS_NAME="openSUSE"
                         ;;
+                        "pop")
+                            LINUX_VERSION="Pop!_OS"
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_NAME="Pop!_OS"
+                        ;;
                         "pureos")
                             LINUX_VERSION="PureOS"
                             OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')

From 0eaa9bc9c5f42ff5da396ca0f2eef0d05e1eef87 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sat, 27 Jun 2020 13:31:52 +0200
Subject: [PATCH 649/679] Updated log

---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c62639b2..b9541fb1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,8 +3,9 @@
 ## Lynis 3.0.1 (not released yet)
 
 ### Added
-- Detection of macOS Big Sur (11.0)
 - Detection of Kali Linux
+- Detection of macOS Big Sur (11.0)
+- Detection of Pop!_OS
 
 ### Changed
 - AUTH-9229 - Added option for LOCKED accounts and bugfix for older bash versions

From ea38da3439efca23bebc859679b7a63a7ec36450 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 28 Jun 2020 14:58:23 +0200
Subject: [PATCH 650/679] Add /etc/os-release detection of Linux Mint

---
 include/osdetection | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/osdetection b/include/osdetection
index ac099bde..783662ad 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -194,6 +194,12 @@
                             OS_NAME="Kali Linux"
                             OS_VERSION="Rolling release"
                         ;;
+                        "linuxmint")
+                            LINUX_VERSION="Linux Mint"
+                            OS_NAME="Linux Mint"
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                        ;;
                         "manjaro")
                             LINUX_VERSION="Manjaro"
                             OS_FULLNAME="Manjaro Linux"

From ac28c281b6656300618ecc8538242b5c98105f5d Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Sun, 28 Jun 2020 14:58:32 +0200
Subject: [PATCH 651/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b9541fb1..4d38dade 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 
 ### Added
 - Detection of Kali Linux
+- Detection of Linux Mint
 - Detection of macOS Big Sur (11.0)
 - Detection of Pop!_OS
 

From 1da058d6defcbfa4729b99526fdafcd1ae5295ce Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 30 Jun 2020 09:01:29 +0200
Subject: [PATCH 652/679] Corrected Amazon Linux entries

Switched entries and added a note. Due to matching by regular expression, the shortest match would otherwise always win.
---
 db/software-eol.db | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/db/software-eol.db b/db/software-eol.db
index c42e244a..2412a203 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -16,8 +16,9 @@
 #
 # Amazon Linux
 #
-os:Amazon Linux:2020-06-30:1593468000:
+# Note: shortest entry is listed at end due to regular expression matching being used
 os:Amazon Linux 2:2023-06-26:1687730400:
+os:Amazon Linux:2020-06-30:1593468000:
 #
 # Arch Linux
 #

From 9d523959529363c93e183bb523e4c467eb931070 Mon Sep 17 00:00:00 2001
From: Kepi <kepi@igloonet.cz>
Date: Thu, 2 Jul 2020 18:22:03 +0200
Subject: [PATCH 653/679] [FILE-6430] Don't grep nonexistant modprobe.d files

We don't want to grep files in modprobe.d when dir is empty. Uses same approach
as in USB-1000.
---
 include/tests_filesystems | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/include/tests_filesystems b/include/tests_filesystems
index fe4ae167..bfe451ab 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -830,12 +830,15 @@
                     AddHP 3 3
                     if IsDebug; then Display --indent 6 --text "- Module ${FS} not present in the kernel" --result OK --color GREEN; fi
                 fi
-                FIND1=$(${EGREPBINARY} "blacklist ${FS}" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#")
-                FIND2=$(${EGREPBINARY} "install ${FS} /bin/true" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#")
-                if [ -n "${FIND1}" ] || [ -n "${FIND2}" ]; then
-                    Display --indent 4 --text "- Module $FS is blacklisted" --result "OK" --color GREEN
-                    LogText "Result: module ${FS} is blacklisted"
-                fi
+                FIND=$(${LSBINARY} ${ROOTDIR}etc/modprobe.d/* 2> /dev/null)
+                if [ -n "${FIND}" ]; then
+		                FIND1=$(${EGREPBINARY} "blacklist ${FS}" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#")
+		                FIND2=$(${EGREPBINARY} "install ${FS} /bin/true" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#")
+                    if [ -n "${FIND1}" ] || [ -n "${FIND2}" ]; then
+                        Display --indent 4 --text "- Module $FS is blacklisted" --result "OK" --color GREEN
+                        LogText "Result: module ${FS} is blacklisted"
+                    fi
+		            fi
             done
             if [ ${FOUND} -eq 1 ]; then
                 Display --indent 4 --text "- Discovered kernel modules: ${AVAILABLE_MODPROBE_FS}"

From f94817f66f4344e9fee676480bf4e04167ebc52c Mon Sep 17 00:00:00 2001
From: Kepi <kepi@igloonet.cz>
Date: Thu, 2 Jul 2020 22:47:13 +0200
Subject: [PATCH 654/679] Command line option for slow test threshold

IMHO it should be OK to run long tests if we count with it.

Example:

    lynis audit system --slow-warning 300

Will warn when test takes longer than 300 seconds, instead of default 10.
---
 extras/bash_completion.d/lynis |  2 +-
 include/consts                 |  1 +
 include/functions              |  2 +-
 include/parameters             | 17 +++++++++++++++++
 lynis                          |  1 +
 5 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/extras/bash_completion.d/lynis b/extras/bash_completion.d/lynis
index 8732ede3..7eee7375 100644
--- a/extras/bash_completion.d/lynis
+++ b/extras/bash_completion.d/lynis
@@ -179,7 +179,7 @@ _lynis()
         *)
             COMPREPLY=( $( compgen -W ' \
                 --auditor --cronjob --debug --quick --quiet --logfile --no-colors --no-log --pentest --reverse-colors \
-                --tests --tests-from-category --tests-from-group --upload --verbose' -- "$cur" ) )
+                --tests --tests-from-category --tests-from-group --upload --verbose --slow-warning' -- "$cur" ) )
             ;;
     esac
 
diff --git a/include/consts b/include/consts
index 1a75ae68..053147a4 100644
--- a/include/consts
+++ b/include/consts
@@ -273,6 +273,7 @@ ETC_PATHS="/etc /usr/local/etc"
     SKIP_VM_DETECTION=0
     SKIPREASON=""
     SKIPPED_TESTS_ROOTONLY=""
+    SLOW_TEST_THRESHOLD=10
     SMTPCTLBINARY=""
     SNORTBINARY=""
     SSHKEYSCANBINARY=""
diff --git a/include/functions b/include/functions
index 4ff5b43a..e0f75a64 100644
--- a/include/functions
+++ b/include/functions
@@ -2586,7 +2586,7 @@
         CURRENT_TS=$(GetTimestamp)
         if [ ${PREVIOUS_TS} -gt 0 ]; then
             SLOW_TEST=0
-            TIME_THRESHOLD=10  # seconds
+            TIME_THRESHOLD=$SLOW_TEST_THRESHOLD  # seconds
 
             # Calculate timing and determine if we use seconds or nanoseconds (more precise)
             TIME_DIFF=$((CURRENT_TS - PREVIOUS_TS))
diff --git a/include/parameters b/include/parameters
index 8668b683..242899e6 100644
--- a/include/parameters
+++ b/include/parameters
@@ -423,6 +423,23 @@
                 QUIET=1
             ;;
 
+            # Warning when test is slow
+            --slow-warning)
+                if [ $# -gt 1 ]; then
+                    shift
+
+                    if [ "$1" -gt 0 ] 2>/dev/null; then
+                        SLOW_TEST_THRESHOLD="$1"
+                    else
+                        echo "Argument has to be number."
+                        exit 1
+                    fi
+                else
+                    echo "Specify threshold as number of seconds above which should Lynis warn about long test."
+                    exit 1
+                fi
+            ;;
+
             --tests-category | --tests-categories | --view-categories | --list-categories | --show-categories)
                 echo "Error: Deprecated option ($1)"
                 exit 1
diff --git a/lynis b/lynis
index 10f736c5..bfa1c308 100755
--- a/lynis
+++ b/lynis
@@ -453,6 +453,7 @@ ${YELLOW}Note: ${WHITE}Cancelling the program can leave temporary files behind${
     ${GRAY}--verbose${NORMAL}                         : Show more details on screen
     ${GRAY}--version (-V)${NORMAL}                    : Display version number and quit
     ${GRAY}--wait${NORMAL}                            : Wait between a set of tests
+    ${GRAY}--slow-warning ${BROWN}<seconds>${NORMAL}  : Threshold for slow test warning in seconds (default 10)
 
     ${WHITE}Enterprise options${NORMAL}
     ${GRAY}--plugindir ${BROWN}<path>${NORMAL}                : Define path of available plugins

From 7b6624f85dac6b6806495b0dcfff2d5d2b51d75a Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 6 Jul 2020 09:25:56 +0200
Subject: [PATCH 655/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4d38dade..1ec27aec 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@
 - KRNL-5728 - Handle zipped kernel configuration correctly
 - KRNL-5830 - Improved version detection for non-symlinked kernel
 - MALW-3280 - Extended detection of BitDefender
+- Fix: hostid generation routine would sometimes show too short IDs
 - Generic improvements for macOS
 - Fix: language detection
 - German translation updated

From 6eae35e564fba2183a1d6a2cddaa656d841756f9 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 6 Jul 2020 09:26:27 +0200
Subject: [PATCH 656/679] Fix for too short IDs due to hexdump output missing
 leading or trailing zeroes

---
 include/helper_generate | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/include/helper_generate b/include/helper_generate
index 67b58b66..f3a8d909 100644
--- a/include/helper_generate
+++ b/include/helper_generate
@@ -51,8 +51,10 @@ if [ $# -gt 0 ]; then
                 ;;
                 *)
                     # xxd does not exist on FreeBSD
-                    HOSTID=$(head -c20 < /dev/urandom | hexdump -ve '"%.2x"')
-                    HOSTID2=$(head -c32 < /dev/urandom | hexdump -ve '"%.2x"')
+                    # Note: hexdump may omit leading or trailing zeroes.
+                    # Take 100 characters as input, turn to hex, then take first 40/64.
+                    HOSTID=$(head -c100 < /dev/urandom | hexdump -ve '"%.2x"' | head -c40)
+                    HOSTID2=$(head -c100 < /dev/urandom | hexdump -ve '"%.2x"' | head -c64)
                 ;;
             esac
 

From 2c928a41510171bb87bedcb913216554a8d7b7ec Mon Sep 17 00:00:00 2001
From: Simon Erkelens <github@casa-laguna.net>
Date: Tue, 7 Jul 2020 15:05:50 +1200
Subject: [PATCH 657/679] Update HAPPY_USERS.md

---
 HAPPY_USERS.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/HAPPY_USERS.md b/HAPPY_USERS.md
index 57c363a9..53677c52 100644
--- a/HAPPY_USERS.md
+++ b/HAPPY_USERS.md
@@ -33,3 +33,6 @@ installed on all my systems to uncover unexpected configuration issues. The
 valuable feedback and contributions give me the energy to continue to work on
 its development, even after 12+ years!
 
+* Catalyst.net IT - January 2020
+Lynis gave us great insight in to the security state of our systems, as well as where we can improve.
+

From 6355360972136ee8eb9d8781f8732fee2812d441 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 7 Jul 2020 12:29:57 +0200
Subject: [PATCH 658/679] Update CHANGELOG.md

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1ec27aec..f54709c8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@
 - AUTH-9229 - Added option for LOCKED accounts and bugfix for older bash versions
 - BOOT-5122 - Presence check for grub.d added
 - CRYP-7931 - Redirect errors (e.g. when swap is not encrypted)
+- FILE-6430 - Don't grep nonexistant modprobe.d files
 - FIRE-4535 - Set initial firewall state
 - INSE-8312 - Corrected text on screen
 - KRNL-5728 - Handle zipped kernel configuration correctly

From b2be7c160e865252d0c589089e444a259576904f Mon Sep 17 00:00:00 2001
From: Simon Biewald <simon@fam-biewald.de>
Date: Thu, 9 Jul 2020 18:19:35 +0200
Subject: [PATCH 659/679] detect and test for timesyncd w/o working timedatectl

On systems without dbus timedatectl does not work.

Thus it is checked if timesyncd currently runs and when
/run/systemd/timesyncd/synchronized was last modified.
Timesyncd touches this file on any sucessfull synchronization.
This is documented in systemd-timesyncd(8).

The new test for successfull documentation has the id TIME-3185.
---
 include/tests_time | 57 ++++++++++++++++++++++++++++++++--------------
 1 file changed, 40 insertions(+), 17 deletions(-)

diff --git a/include/tests_time b/include/tests_time
index 7c15d0a3..1985aa44 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -124,23 +124,11 @@
         fi
 
         # Check timedate daemon (systemd)
-        if [ -n "${TIMEDATECTL}" ]; then
-            FIND=$(${TIMEDATECTL} status | ${EGREPBINARY} "(NTP|System clock) synchronized: yes")
-            if [ -n "${FIND}" ]; then
-                # Check for systemd-timesyncd
-                if [ -f ${ROOTDIR}etc/systemd/timesyncd.conf ]; then
-                    LogText "Result: found ${ROOTDIR}etc/systemd/timesyncd.conf"
-                    FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="systemd-timesyncd"
-                    Display --indent 2 --text "- NTP daemon found: systemd (timesyncd)" --result "${STATUS_FOUND}" --color GREEN
-                    SYSTEMD_NTP_ENABLED=1
-                else
-                    LogText "Result: ${ROOTDIR}etc/systemd/timesyncd.conf does not exist"
-                fi
-            else
-                LogText "Result: time synchronization not performed according timedatectl command"
-            fi
-        else
-            LogText "Result: timedatectl command not available on this system"
+        FIND=$(${PSBINARY} ax | ${GREPBINARY} "systemd-timesyncd" | ${GREPBINARY} -v "grep")
+        if [  -n "${FIND}" ]; then
+            FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="systemd-timesyncd"
+            Display --indent 2 --text "- NTP daemon found: systemd (timesyncd)" --result "${STATUS_FOUND}" --color GREEN
+            LogText "Result: Found running systemd-timesyncd in process list"
         fi
 
         # Check crontab for OpenBSD/FreeBSD
@@ -581,6 +569,41 @@
             ReportWarning "${TEST_NO}" "OpenNTPD has no peers" "${NTPCTLBINARY} -s status"
         fi
     fi
+
+#
+#################################################################################
+#
+
+    # Test        : TIME-3185
+    # Description : Check systemd-timesyncd synchronized time
+
+    if [ "${NTP_DAEMON}" = "systemd-timesyncd" ]; then
+        PREQS_MET="YES"
+    else
+        PREQS_MET="NO"
+    fi
+
+
+    Register --test-no TIME-3185 --preqs-met "${PREQS_MET}" --weight L --network NO --category "time" --description "Check systemd-timesyncd synchronized time"
+    if [ ${SKIPTEST} -eq 0 ]; then
+        if [ -e /run/systemd/timesync/synchronized ]; then
+           FIND=$(( $(date +%s) - $(stat -L --format %Y /run/systemd/timesync/synchronized) ))
+           # Check if last sync was more than 2048 seconds (= the default of systemd) ago
+           if [ ${FIND} -ge 2048 ]; then
+               COLOR=RED
+               ReportWarning "${TEST_NO}" "systemd-timesyncd did not synchronized the time recently."
+           else
+               COLOR=GREEN
+           fi
+           Display --indent 2 --text "- Last time synchronization" --result "${FIND}s" --color "${COLOR}"
+           LogText "Result: systemd-timesyncd synchronized time ${FIND} seconds ago."
+        else
+           Display --indent 2 --text "- Last time synchronization" --result "${STATUS_NOT_FOUND}" --color RED
+           ReportWarning "${TEST_NO}" "systemd-timesyncd never successfully synchronized time"
+        fi
+    fi
+
+
 #
 #################################################################################
 #

From 38b6105c6061c01b7075a76c23a9e73a962692bf Mon Sep 17 00:00:00 2001
From: Simon Biewald <simon@fam-biewald.de>
Date: Thu, 9 Jul 2020 18:27:02 +0200
Subject: [PATCH 660/679] add new test to test database

---
 db/tests.db        | 1 +
 include/tests_time | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/db/tests.db b/db/tests.db
index 32347102..26fc8f87 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -419,6 +419,7 @@ TIME-3170:test:security:time::Check configuration files:
 TIME-3180:test:security:time::Report if ntpctl cannot communicate with OpenNTPD:
 TIME-3181:test:security:time::Check status of OpenNTPD time synchronisation
 TIME-3182:test:security:time::Check OpenNTPD has working peers
+TIME-3185:test:security:time::Check systemd-timesyncd synchronized time
 TOOL-5002:test:security:tooling::Checking for automation tools:
 TOOL-5102:test:security:tooling::Check for presence of Fail2ban:
 TOOL-5104:test:security:tooling::Enabled tests for Fail2ban:
diff --git a/include/tests_time b/include/tests_time
index 1985aa44..1fb512ae 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -584,7 +584,7 @@
     fi
 
 
-    Register --test-no TIME-3185 --preqs-met "${PREQS_MET}" --weight L --network NO --category "time" --description "Check systemd-timesyncd synchronized time"
+    Register --test-no TIME-3185 --preqs-met "${PREQS_MET}" --weight L --network NO --category "security" --description "Check systemd-timesyncd synchronized time"
     if [ ${SKIPTEST} -eq 0 ]; then
         if [ -e /run/systemd/timesync/synchronized ]; then
            FIND=$(( $(date +%s) - $(stat -L --format %Y /run/systemd/timesync/synchronized) ))

From df7c6257a56d54a001859c209b92f7e74589cd13 Mon Sep 17 00:00:00 2001
From: Simon Biewald <simon@fam-biewald.de>
Date: Thu, 9 Jul 2020 18:41:09 +0200
Subject: [PATCH 661/679] compare correct stuff in openntpd tests

I accidentially compared rubbish in the openntpd tests,
thus they were not executed at all.
Additionally, == was used instead of =.
---
 include/tests_time | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/tests_time b/include/tests_time
index 7c15d0a3..79e7aa2e 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -532,7 +532,7 @@
 #
     # Test        : TIME-3180
     # Description : Report if ntpctl cannot communicate with OpenNTPD
-    if [ "${NTPD_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" == "openntpd" ]; then
+    if [ "${NTP_DAEMON_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" = "openntpd" ]; then
         PREQS_MET="YES"
     else
         PREQS_MET="NO"
@@ -548,7 +548,7 @@
 #
     # Test        : TIME-3181
     # Description : Check status of OpenNTPD time synchronisation
-    if [ "${NTPD_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" == "openntpd" ] && [ "${OPENNTPD_COMMUNICATION}" -eq 1 ]; then
+    if [ "${NTP_DAEMON_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" = "openntpd" ] && [ "${OPENNTPD_COMMUNICATION}" -eq 1 ]; then
         PREQS_MET="YES"
     else
         PREQS_MET="NO"
@@ -567,7 +567,7 @@
     # Test        : TIME-3182
     # Description : Check OpenNTPD has working peers
 
-    if [ "${NTPD_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" == "openntpd" ] && [ "${OPENNTPD_COMMUNICATION}" -eq 1 ]; then
+    if [ "${NTP_DAEMON_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" = "openntpd" ] && [ "${OPENNTPD_COMMUNICATION}" -eq 1 ]; then
         PREQS_MET="YES"
     else
         PREQS_MET="NO"

From 9107867fa1307a7ec65f250efbc2440665078fb0 Mon Sep 17 00:00:00 2001
From: Simon Biewald <simon@fam-biewald.de>
Date: Thu, 9 Jul 2020 18:57:01 +0200
Subject: [PATCH 662/679] use correct regex and comparison to match peers

---
 include/tests_time | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/tests_time b/include/tests_time
index 79e7aa2e..eee5cbfc 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -576,8 +576,8 @@
     Register --test-no TIME-3182 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Check OpenNTPD has working peers"
     if [ ${SKIPTEST} -eq 0 ]; then
         # Format is "xx/yy peers valid, ..."
-        FIND=$(${NTPCTLBINARY} -s status | ${EGREPBINARY} -o "[0-9]{1,4}/" | ${EGREPBINARY} -o "[0-9]{1,4}" )
-        if [ -n "${FIND}" ] || [ "${FIND}" -eq 0 ]; then
+        FIND=$(${NTPCTLBINARY} -s status | ${EGREPBINARY} -o '[0-9]+/[0-9]+' | ${CUTBINARY} -d '/' -f 1)
+        if [ -z "${FIND}" ] || [ "${FIND}" -eq 0 ]; then
             ReportWarning "${TEST_NO}" "OpenNTPD has no peers" "${NTPCTLBINARY} -s status"
         fi
     fi

From d4639b3c6a98544269d5d7e59146de2e74ef1530 Mon Sep 17 00:00:00 2001
From: Simon Biewald <simon@fam-biewald.de>
Date: Fri, 10 Jul 2020 00:29:35 +0200
Subject: [PATCH 663/679] find more cron ntp clients, iterate over cron files
 with glob

---
 include/tests_time | 42 ++++++++++++++++--------------------------
 1 file changed, 16 insertions(+), 26 deletions(-)

diff --git a/include/tests_time b/include/tests_time
index 7c15d0a3..842e3495 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -146,17 +146,20 @@
         # Check crontab for OpenBSD/FreeBSD
         # Check anacrontab for Linux
         CRONTAB_FILES="/etc/anacrontab /etc/crontab"
+        # Regex for matching multiple time synchronisation binaries
+        # Partial sanity check for sntp and ntpdig, but this does not consider all corner cases
+        CRONTAB_REGEX='ntpdate|rdate|sntp.+-(s|j|--adj)|ntpdig.+-(S|s)'
         for I in ${CRONTAB_FILES}; do
             if [ -f ${I} ]; then
-                LogText "Test: checking for ntpdate or rdate in crontab file ${I}"
-                FIND=$(${EGREPBINARY} "ntpdate|rdate" ${I} | ${GREPBINARY} -v '^#')
+                LogText "Test: checking for ntpdate, rdate, sntp or ntpdig in crontab file ${I}"
+                FIND=$(${EGREPBINARY} "${CRONTAB_REGEX}" ${I} | ${GREPBINARY} -v '^#')
                 if [ -n "${FIND}" ]; then
                     FOUND=1; NTP_CONFIG_TYPE_SCHEDULED=1
                     Display --indent 2 --text "- Checking NTP client in crontab file (${I})" --result "${STATUS_FOUND}" --color GREEN
-                    LogText "Result: found ntpdate or rdate reference in crontab file ${I}"
+                    LogText "Result: found ntpdate, rdate, sntp or ntpdig reference in crontab file ${I}"
                 else
                     #Display --indent 2 --text "- Checking NTP client in crontab file (${I})" --result "${STATUS_NOT_FOUND}" --color WHITE
-                    LogText "Result: no ntpdate or rdate reference found in crontab file ${I}"
+                    LogText "Result: no ntpdate, rdate, sntp or ntpdig reference found in crontab file ${I}"
                 fi
             else
                 LogText "Result: crontab file ${I} not found"
@@ -169,31 +172,18 @@
 
         # Check cron jobs
         for I in ${CRON_DIRS}; do
-            if [ -d ${I} ]; then
-                if FileIsReadable ${I}; then
-                    FIND=$(${FINDBINARY} ${I} -type f -a ! -name ".placeholder" -print 2> /dev/null | ${SEDBINARY} 's/ /__space__/g' | ${TRBINARY} '\n' '\0' | ${TRBINARY} -cd '[:print:]\0' | ${TRBINARY} '\0' ' ')
+            for J in "${I}"/*; do  # iterate over folders in a safe way
+                # Check: regular file, readable and not called .placeholder
+                FIND=$(echo "${J}" | ${EGREPBINARY} '/.placeholder$')
+                if [ -f "${J}" ] && [ -r "${J}" ] && [ -z "${FIND}" ]; then
+                    LogText "Test: checking for ntpdate, rdate, sntp or ntpdig in ${J}"
+                    FIND=$("${EGREPBINARY}" "${CRONTAB_REGEX}" "${J}" | "${GREPBINARY}" -v "^#")
                     if [ -n "${FIND}" ]; then
-                        for J in ${FIND}; do
-                            # Place back spaces if needed
-                            J=$(echo ${J} | ${SEDBINARY} 's/__space__/ /g')
-                            LogText "Test: checking for ntpdate or rdate in ${J}"
-                            if FileIsReadable ${J}; then
-                                FIND2=$(${EGREPBINARY} "rdate|ntpdate" "${J}" | ${GREPBINARY} -v "^#")
-                                if [ -n "${FIND2}" ]; then
-                                    LogText "Positive match found: ${FIND2}"
-                                    FOUND=1; FOUND_IN_CRON=1; NTP_CONFIG_TYPE_SCHEDULED=1
-                                fi
-                            else
-                                LogText "Result: could not test in file '${J}' as it is not readable"
-                            fi
-                        done
-                    else
-                        LogText "Result: ${I} is empty, skipping search in directory"
+                        FOUND=1; FOUND_IN_CRON=1; NTP_CONFIG_TYPE_SCHEDULED=1
+                        LogText "Result: found ntpdate, rdate, sntp or ntpdig in ${J}"
                     fi
-                else
-                    LogText "Result: could not search in directory due to permissions"
                 fi
-            fi
+            done
         done
 
         if [ ${FOUND_IN_CRON} -eq 1 ]; then

From 092fe08c400a0b7eb4f6ace7ac4ebaf6c4c9bec6 Mon Sep 17 00:00:00 2001
From: Simon Biewald <simon@fam-biewald.de>
Date: Fri, 10 Jul 2020 00:40:36 +0200
Subject: [PATCH 664/679] shellcheck: check exit code directly

---
 include/tests_time | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/include/tests_time b/include/tests_time
index eee5cbfc..c85e2876 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -86,9 +86,8 @@
             # Reason: openntpd syncs only if large time corrections are not required or -s is passed.
             #         This might be not intended by the administrator (-s is NOT the default!)
             FIND=$(${PSBINARY} ax | ${GREPBINARY} "ntpd: ntp engine" | ${GREPBINARY} -v "grep")
-            ${NTPCTLBINARY} -s status > /dev/null 2> /dev/null
             # Status code 0 is when communication over the socket is successfull
-            if [ "$?" -eq 0 ]; then
+            if ${NTPCTLBINARY} -s status > /dev/null 2> /dev/null; then
                 FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="openntpd"
                 LogText "result: found openntpd (method: ntpctl)"
                 OPENNTPD_COMMUNICATION=1

From 7ba220811f309ae69751821858e5b39bbc5c3cb7 Mon Sep 17 00:00:00 2001
From: Simon Biewald <simon@fam-biewald.de>
Date: Fri, 10 Jul 2020 00:41:45 +0200
Subject: [PATCH 665/679] use = instead of ==

---
 include/tests_time | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/tests_time b/include/tests_time
index c85e2876..153397e2 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -100,7 +100,7 @@
                 LogText "result: running openntpd not found, but ntpctl is instaalled"
             fi
 
-            if [ "${NTP_DAEMON}" == "openntpd" ]; then
+            if [ "${NTP_DAEMON}" = "openntpd" ]; then
                 Display --indent 2 --text "- NTP daemon found: OpenNTPD" --result "${STATUS_FOUND}" --color GREEN
             fi
         fi

From e27208a342aee4ac5c1c19cac0f27700201a7708 Mon Sep 17 00:00:00 2001
From: Simon Biewald <simon@fam-biewald.de>
Date: Fri, 10 Jul 2020 00:48:12 +0200
Subject: [PATCH 666/679] use STATBINARY, put filename in variable

---
 include/tests_time | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/include/tests_time b/include/tests_time
index 1fb512ae..e3cf4ac8 100644
--- a/include/tests_time
+++ b/include/tests_time
@@ -585,11 +585,12 @@
 
 
     Register --test-no TIME-3185 --preqs-met "${PREQS_MET}" --weight L --network NO --category "security" --description "Check systemd-timesyncd synchronized time"
+    SYNCHRONIZED_FILE="/run/systemd/timesync/synchronized"
     if [ ${SKIPTEST} -eq 0 ]; then
-        if [ -e /run/systemd/timesync/synchronized ]; then
-           FIND=$(( $(date +%s) - $(stat -L --format %Y /run/systemd/timesync/synchronized) ))
+        if [ -e "${SYNCHRONIZED_FILE}" ]; then
+           FIND=$(( $(date +%s) - $(${STATBINARY} -L --format %Y "${SYNCHRONIZED_FILE}") ))
            # Check if last sync was more than 2048 seconds (= the default of systemd) ago
-           if [ ${FIND} -ge 2048 ]; then
+           if [ "${FIND}" -ge 2048 ]; then
                COLOR=RED
                ReportWarning "${TEST_NO}" "systemd-timesyncd did not synchronized the time recently."
            else
@@ -602,7 +603,7 @@
            ReportWarning "${TEST_NO}" "systemd-timesyncd never successfully synchronized time"
         fi
     fi
-
+    unset SYNCHRONIZED_FILE
 
 #
 #################################################################################

From baf5f7ad4d6456ecf21f9987f9140d08dd0025c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?=
 <konstruktoid@users.noreply.github.com>
Date: Tue, 21 Jul 2020 23:56:47 +0200
Subject: [PATCH 667/679] add Microsoft Defender ATP, malware scanner
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
---
 include/binaries | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/binaries b/include/binaries
index 6bbea4af..ae2c2824 100644
--- a/include/binaries
+++ b/include/binaries
@@ -219,6 +219,7 @@
                             maldet)                 LMDBINARY="${BINARY}";             MALWARE_SCANNER_INSTALLED=1;           LogText "  Found known binary: maldet (Linux Malware Detect, malware scanner) - ${BINARY}" ;;
                             md5)                    MD5BINARY="${BINARY}";             LogText "  Found known binary: md5 (hash tool) - ${BINARY}" ;;
                             md5sum)                 MD5BINARY="${BINARY}";             LogText "  Found known binary: md5sum (hash tool) - ${BINARY}" ;;
+                            mdatp)                  MDATPBINARY="${BINARY}";           MALWARE_SCANNER_INSTALLED=1;           LogText "  Found known binary: mdatp (Microsoft Defender ATP, malware scanner) - ${BINARY}" ;;
                             modprobe)               MODPROBEBINARY="${BINARY}";        LogText "  Found known binary: modprobe (kernel modules) - ${BINARY}" ;;
                             mount)                  MOUNTBINARY="${BINARY}";           LogText "  Found known binary: mount (disk utility) - ${BINARY}" ;;
                             mtree)                  MTREEBINARY="${BINARY}";           LogText "  Found known binary: mtree (mapping directory tree) - ${BINARY}" ;;

From 9b388518deb5a339f21d2d0997de718a77a1c68f Mon Sep 17 00:00:00 2001
From: 0ri0n <github@quantumpacket.com>
Date: Sun, 26 Jul 2020 23:33:34 -0400
Subject: [PATCH 668/679] Add PHP 7.4 Detection Paths

---
 include/tests_php | 41 +++++++++++++++++++++++++++++++++++------
 1 file changed, 35 insertions(+), 6 deletions(-)

diff --git a/include/tests_php b/include/tests_php
index 0f498fff..cd19da63 100644
--- a/include/tests_php
+++ b/include/tests_php
@@ -36,6 +36,7 @@
                 ${ROOTDIR}etc/php7.1/php.ini \
                 ${ROOTDIR}etc/php7.2/php.ini \
                 ${ROOTDIR}etc/php7.3/php.ini \
+                ${ROOTDIR}etc/php7.4/php.ini \
                 ${ROOTDIR}etc/php/cgi-php5/php.ini \
                 ${ROOTDIR}etc/php/cli-php5/php.ini \
                 ${ROOTDIR}etc/php/apache2-php5/php.ini \
@@ -45,24 +46,29 @@
                 ${ROOTDIR}etc/php/apache2-php7.1/php.ini \
                 ${ROOTDIR}etc/php/apache2-php7.2/php.ini \
                 ${ROOTDIR}etc/php/apache2-php7.3/php.ini \
+                ${ROOTDIR}etc/php/apache2-php7.4/php.ini \
                 ${ROOTDIR}etc/php/cgi-php5.5/php.ini \
                 ${ROOTDIR}etc/php/cgi-php5.6/php.ini \
                 ${ROOTDIR}etc/php/cgi-php7.0/php.ini \
                 ${ROOTDIR}etc/php/cgi-php7.1/php.ini \
                 ${ROOTDIR}etc/php/cgi-php7.2/php.ini \
                 ${ROOTDIR}etc/php/cgi-php7.3/php.ini \
+                ${ROOTDIR}etc/php/cgi-php7.4/php.ini \
                 ${ROOTDIR}etc/php/cli-php5.5/php.ini \
                 ${ROOTDIR}etc/php/cli-php5.6/php.ini \
                 ${ROOTDIR}etc/php/cli-php7.0/php.ini \
                 ${ROOTDIR}etc/php/cli-php7.1/php.ini \
                 ${ROOTDIR}etc/php/cli-php7.2/php.ini \
                 ${ROOTDIR}etc/php/cli-php7.3/php.ini \
+                ${ROOTDIR}etc/php/cli-php7.4/php.ini \
                 ${ROOTDIR}etc/php/embed-php5.5/php.ini \
                 ${ROOTDIR}etc/php/embed-php5.6/php.ini \
                 ${ROOTDIR}etc/php/embed-php7.0/php.ini \
                 ${ROOTDIR}etc/php/embed-php7.1/php.ini \
                 ${ROOTDIR}etc/php/embed-php7.2/php.ini \
                 ${ROOTDIR}etc/php/embed-php7.3/php.ini \
+                ${ROOTDIR}etc/php/embed-php7.4/php.ini \
+                ${ROOTDIR}etc/php/fpm-php7.4/php.ini \
                 ${ROOTDIR}etc/php/fpm-php7.3/php.ini \
                 ${ROOTDIR}etc/php/fpm-php7.2/php.ini \
                 ${ROOTDIR}etc/php/fpm-php7.1/php.ini \
@@ -71,7 +77,9 @@
                 ${ROOTDIR}etc/php/fpm-php5.6/php.ini \
                 ${ROOTDIR}etc/php5/cgi/php.ini \
                 ${ROOTDIR}etc/php5/cli/php.ini \
-                ${ROOTDIR}etc/php5/cli-php5.4/php.ini ${ROOTDIR}etc/php5/cli-php5.5/php.ini ${ROOTDIR}etc/php5/cli-php5.6/php.ini \
+                ${ROOTDIR}etc/php5/cli-php5.4/php.ini \
+                ${ROOTDIR}etc/php5/cli-php5.5/php.ini \
+                ${ROOTDIR}etc/php5/cli-php5.6/php.ini \
                 ${ROOTDIR}etc/php5/apache2/php.ini \
                 ${ROOTDIR}etc/php5/fpm/php.ini \
                 ${ROOTDIR}private/etc/php.ini \
@@ -79,10 +87,12 @@
                 ${ROOTDIR}etc/php/7.1/apache2/php.ini \
                 ${ROOTDIR}etc/php/7.2/apache2/php.ini \
                 ${ROOTDIR}etc/php/7.3/apache2/php.ini \
+                ${ROOTDIR}etc/php/7.4/apache2/php.ini \
                 ${ROOTDIR}etc/php/7.0/cli/php.ini ${ROOTDIR}etc/php/7.0/fpm/php.ini \
                 ${ROOTDIR}etc/php/7.1/cli/php.ini ${ROOTDIR}etc/php/7.1/fpm/php.ini \
                 ${ROOTDIR}etc/php/7.2/cli/php.ini ${ROOTDIR}etc/php/7.2/fpm/php.ini \
                 ${ROOTDIR}etc/php/7.3/cli/php.ini ${ROOTDIR}etc/php/7.3/fpm/php.ini \
+                ${ROOTDIR}etc/php/7.4/cli/php.ini ${ROOTDIR}etc/php/7.4/fpm/php.ini \
                 ${ROOTDIR}var/www/conf/php.ini \
                 ${ROOTDIR}usr/local/etc/php.ini ${ROOTDIR}usr/local/lib/php.ini \
                 ${ROOTDIR}usr/local/etc/php5/cgi/php.ini \
@@ -92,6 +102,7 @@
                 ${ROOTDIR}usr/local/php71/lib/php.ini \
                 ${ROOTDIR}usr/local/php72/lib/php.ini \
                 ${ROOTDIR}usr/local/php73/lib/php.ini \
+                ${ROOTDIR}usr/local/php74/lib/php.ini \
                 ${ROOTDIR}usr/local/zend/etc/php.ini \
                 ${ROOTDIR}usr/pkg/etc/php.ini \
                 ${ROOTDIR}opt/cpanel/ea-php54/root/etc/php.ini \
@@ -101,6 +112,7 @@
                 ${ROOTDIR}opt/cpanel/ea-php71/root/etc/php.ini \
                 ${ROOTDIR}opt/cpanel/ea-php72/root/etc/php.ini \
                 ${ROOTDIR}opt/cpanel/ea-php73/root/etc/php.ini \
+                ${ROOTDIR}opt/cpanel/ea-php74/root/etc/php.ini \
                 ${ROOTDIR}opt/alt/php44/etc/php.ini \
                 ${ROOTDIR}opt/alt/php51/etc/php.ini \
                 ${ROOTDIR}opt/alt/php52/etc/php.ini \
@@ -112,27 +124,42 @@
                 ${ROOTDIR}opt/alt/php71/etc/php.ini \
                 ${ROOTDIR}opt/alt/php72/etc/php.ini \
                 ${ROOTDIR}opt/alt/php73/etc/php.ini \
+                ${ROOTDIR}opt/alt/php74/etc/php.ini \
                 ${ROOTDIR}etc/opt/remi/php56/php.ini \
                 ${ROOTDIR}etc/opt/remi/php70/php.ini \
                 ${ROOTDIR}etc/opt/remi/php71/php.ini \
                 ${ROOTDIR}etc/opt/remi/php72/php.ini \
-                ${ROOTDIR}etc/opt/remi/php73/php.ini"
+                ${ROOTDIR}etc/opt/remi/php73/php.ini \
+                ${ROOTDIR}etc/opt/remi/php74/php.ini"
     # HEADS-UP: OpenBSD, last two releases are supported, and snapshots of -current
     PHPINILOCS="${PHPINILOCS} \
-                ${ROOTDIR}etc/php-5.6.ini ${ROOTDIR}etc/php-7.0.ini ${ROOTDIR}etc/php-7.1.ini ${ROOTDIR}etc/php-7.2.ini ${ROOTDIR}etc/php-7.3.ini"
+                ${ROOTDIR}etc/php-5.6.ini \
+                ${ROOTDIR}etc/php-7.0.ini \
+                ${ROOTDIR}etc/php-7.1.ini \
+                ${ROOTDIR}etc/php-7.2.ini \
+                ${ROOTDIR}etc/php-7.3.ini \
+                ${ROOTDIR}etc/php-7.4.ini"
 
     PHPINIDIRS="${ROOTDIR}etc/php5/conf.d \
                 ${ROOTDIR}etc/php/7.0/cli/conf.d \
                 ${ROOTDIR}etc/php/7.1/cli/conf.d \
                 ${ROOTDIR}etc/php/7.2/cli/conf.d \
                 ${ROOTDIR}etc/php/7.3/cli/conf.d \
+                ${ROOTDIR}etc/php/7.4/cli/conf.d \
                 ${ROOTDIR}etc/php/7.0/fpm/conf.d \
                 ${ROOTDIR}etc/php/7.1/fpm/conf.d \
                 ${ROOTDIR}etc/php/7.2/fpm/conf.d \
                 ${ROOTDIR}etc/php/7.3/fpm/conf.d \
+                ${ROOTDIR}etc/php/7.4/fpm/conf.d \
                 ${ROOTDIR}etc/php.d \
-                ${ROOTDIR}opt/cpanel/ea-php54/root/etc/php.d ${ROOTDIR}opt/cpanel/ea-php55/root/etc/php.d ${ROOTDIR}opt/cpanel/ea-php56/root/etc/php.d ${ROOTDIR}opt/cpanel/ea-php70/root/etc/php.d \
-                ${ROOTDIR}opt/cpanel/ea-php71/root/etc/php.d ${ROOTDIR}opt/cpanel/ea-php72/root/etc/php.d ${ROOTDIR}opt/cpanel/ea-php73/root/etc/php.d \
+                ${ROOTDIR}opt/cpanel/ea-php54/root/etc/php.d \
+                ${ROOTDIR}opt/cpanel/ea-php55/root/etc/php.d \
+                ${ROOTDIR}opt/cpanel/ea-php56/root/etc/php.d \
+                ${ROOTDIR}opt/cpanel/ea-php70/root/etc/php.d \
+                ${ROOTDIR}opt/cpanel/ea-php71/root/etc/php.d \
+                ${ROOTDIR}opt/cpanel/ea-php72/root/etc/php.d \
+                ${ROOTDIR}opt/cpanel/ea-php73/root/etc/php.d \
+                ${ROOTDIR}opt/cpanel/ea-php74/root/etc/php.d \
                 ${ROOTDIR}opt/alt/php44/etc/php.d.all \
                 ${ROOTDIR}opt/alt/php51/etc/php.d.all \
                 ${ROOTDIR}opt/alt/php52/etc/php.d.all \
@@ -144,11 +171,13 @@
                 ${ROOTDIR}opt/alt/php71/etc/php.d.all \
                 ${ROOTDIR}opt/alt/php72/etc/php.d.all \
                 ${ROOTDIR}opt/alt/php73/etc/php.d.all \
+                ${ROOTDIR}opt/alt/php74/etc/php.d.all \
                 ${ROOTDIR}usr/local/lib/php.conf.d \
                 ${ROOTDIR}usr/local/php70/lib/php.conf.d \
                 ${ROOTDIR}usr/local/php71/lib/php.conf.d \
                 ${ROOTDIR}usr/local/php72/lib/php.conf.d \
-                ${ROOTDIR}usr/local/php73/lib/php.conf.d"
+                ${ROOTDIR}usr/local/php73/lib/php.conf.d \
+                ${ROOTDIR}usr/local/php74/lib/php.conf.d"
     # HEADS-UP: OpenBSD, last two releases are supported, and snapshots of -current
     PHPINIDIRS="${PHPINIDIRS} \
                 ${ROOTDIR}etc/php-5.6 ${ROOTDIR}etc/php-7.0 ${ROOTDIR}etc/php-7.1 ${ROOTDIR}etc/php-7.2 ${ROOTDIR}etc/php-7.3"

From f988e573dbaef07c35589e18980c7e223bc98d6d Mon Sep 17 00:00:00 2001
From: 0ri0n <github@quantumpacket.com>
Date: Mon, 27 Jul 2020 13:59:46 -0400
Subject: [PATCH 669/679] Add missing PHP 7.4 check for BSD

---
 include/tests_php | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/include/tests_php b/include/tests_php
index cd19da63..32211f1a 100644
--- a/include/tests_php
+++ b/include/tests_php
@@ -88,13 +88,19 @@
                 ${ROOTDIR}etc/php/7.2/apache2/php.ini \
                 ${ROOTDIR}etc/php/7.3/apache2/php.ini \
                 ${ROOTDIR}etc/php/7.4/apache2/php.ini \
-                ${ROOTDIR}etc/php/7.0/cli/php.ini ${ROOTDIR}etc/php/7.0/fpm/php.ini \
-                ${ROOTDIR}etc/php/7.1/cli/php.ini ${ROOTDIR}etc/php/7.1/fpm/php.ini \
-                ${ROOTDIR}etc/php/7.2/cli/php.ini ${ROOTDIR}etc/php/7.2/fpm/php.ini \
-                ${ROOTDIR}etc/php/7.3/cli/php.ini ${ROOTDIR}etc/php/7.3/fpm/php.ini \
-                ${ROOTDIR}etc/php/7.4/cli/php.ini ${ROOTDIR}etc/php/7.4/fpm/php.ini \
+                ${ROOTDIR}etc/php/7.0/cli/php.ini \
+                ${ROOTDIR}etc/php/7.0/fpm/php.ini \
+                ${ROOTDIR}etc/php/7.1/cli/php.ini \
+                ${ROOTDIR}etc/php/7.1/fpm/php.ini \
+                ${ROOTDIR}etc/php/7.2/cli/php.ini \
+                ${ROOTDIR}etc/php/7.2/fpm/php.ini \
+                ${ROOTDIR}etc/php/7.3/cli/php.ini \
+                ${ROOTDIR}etc/php/7.3/fpm/php.ini \
+                ${ROOTDIR}etc/php/7.4/cli/php.ini \
+                ${ROOTDIR}etc/php/7.4/fpm/php.ini \
                 ${ROOTDIR}var/www/conf/php.ini \
-                ${ROOTDIR}usr/local/etc/php.ini ${ROOTDIR}usr/local/lib/php.ini \
+                ${ROOTDIR}usr/local/etc/php.ini \
+                ${ROOTDIR}usr/local/lib/php.ini \
                 ${ROOTDIR}usr/local/etc/php5/cgi/php.ini \
                 ${ROOTDIR}usr/local/php54/lib/php.ini \
                 ${ROOTDIR}usr/local/php56/lib/php.ini \
@@ -180,7 +186,12 @@
                 ${ROOTDIR}usr/local/php74/lib/php.conf.d"
     # HEADS-UP: OpenBSD, last two releases are supported, and snapshots of -current
     PHPINIDIRS="${PHPINIDIRS} \
-                ${ROOTDIR}etc/php-5.6 ${ROOTDIR}etc/php-7.0 ${ROOTDIR}etc/php-7.1 ${ROOTDIR}etc/php-7.2 ${ROOTDIR}etc/php-7.3"
+                ${ROOTDIR}etc/php-5.6 \
+                ${ROOTDIR}etc/php-7.0 \
+                ${ROOTDIR}etc/php-7.1 \
+                ${ROOTDIR}etc/php-7.2 \
+                ${ROOTDIR}etc/php-7.3 \
+                ${ROOTDIR}etc/php-7.4"
 #
 #################################################################################
 #

From 65cc4daa57f873368c2933a53ec8fb619c7a4c16 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 4 Aug 2020 09:26:50 +0200
Subject: [PATCH 670/679] Update CHANGELOG.md

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f54709c8..de8f2837 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@
 - Detection of Linux Mint
 - Detection of macOS Big Sur (11.0)
 - Detection of Pop!_OS
+- Detection of PHP 7.4 
 
 ### Changed
 - AUTH-9229 - Added option for LOCKED accounts and bugfix for older bash versions

From c0ddfd0f77ac0ae57e20fda65a1fa06d79e70284 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Tue, 4 Aug 2020 09:39:05 +0200
Subject: [PATCH 671/679] Changed suggestion text for 4+ months old version

---
 lynis | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lynis b/lynis
index 10f736c5..963e6b0d 100755
--- a/lynis
+++ b/lynis
@@ -778,7 +778,7 @@ ${NORMAL}
     if [ ${NOW} -gt ${RELEASE_PLUS_TIMEDIFF} ]; then
         # Show if release is old, only if we didn't show it with normal update check
         if [ ${UPDATE_AVAILABLE} -eq 0 ]; then
-            ReportSuggestion "LYNIS" "This release is more than 4 months old. Consider upgrading"
+            ReportSuggestion "LYNIS" "This release is more than 4 months old. Check the website or GitHub to see if there is an update available."
         fi
         OLD_RELEASE=1
     fi

From 138cce7f9c9ea5bb87c97527893d4e9b6457c995 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Wed, 5 Aug 2020 11:50:37 +0200
Subject: [PATCH 672/679] Update CHANGELOG.md

---
 CHANGELOG.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index de8f2837..c4935044 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,8 @@
 - Detection of Linux Mint
 - Detection of macOS Big Sur (11.0)
 - Detection of Pop!_OS
-- Detection of PHP 7.4 
+- Detection of PHP 7.4
+- Malware detection tool: Microsoft Defender ATP
 
 ### Changed
 - AUTH-9229 - Added option for LOCKED accounts and bugfix for older bash versions

From 33d8e8e00b94312e303dabb490d1165702380d8c Mon Sep 17 00:00:00 2001
From: Steve Kolenich <stephen.kolenich@tutanota.com>
Date: Thu, 6 Aug 2020 20:15:18 -0400
Subject: [PATCH 673/679] Adding Alpine Linux to OSDetection

---
 include/osdetection | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/include/osdetection b/include/osdetection
index 783662ad..c2726d31 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -144,6 +144,12 @@
                 OS_ID=$(grep "^ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
                 if [ -n "${OS_ID}" ]; then
                     case ${OS_ID} in
+                        "alpine")
+                            LINUX_VERSION="Alpine Linux"
+                            OS_NAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                            OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                        ;;
                         "amzn")
                             LINUX_VERSION="Amazon Linux"
                             OS_NAME="Amazon Linux"
@@ -268,6 +274,9 @@
                 fi
             fi
 
+            # Alpine
+            if [ -e "/etc/alpine-release" ]; then LINUX_VERSION="Alpine Linux"; OS_VERSION=$(cat /etc/alpine-release); fi
+
             # Amazon
             if [ -z "${LINUX_VERSION}" -a -e "/etc/system-release" ]; then
                 FIND=$(grep "^Amazon" /etc/system-release)

From 7df0b8618b5cce39961b245a3c582af4294276d7 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 7 Aug 2020 11:56:19 +0200
Subject: [PATCH 674/679] Updated log

---
 CHANGELOG.md | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e2be50de..213fbe89 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,16 +3,21 @@
 ## Lynis 3.0.1 (not released yet)
 
 ### Added
+- Detection of Alpine Linux
 - Detection of Kali Linux
 - Detection of Linux Mint
 - Detection of macOS Big Sur (11.0)
 - Detection of Pop!_OS
 - Detection of PHP 7.4
 - Malware detection tool: Microsoft Defender ATP
+- New flag: --slow-warning to allow tests more time before showing a warning
+- Test TIME-3185 to check systemd-timesyncd synchronized time
+- rsh host file permissions
 
 ### Changed
 - AUTH-9229 - Added option for LOCKED accounts and bugfix for older bash versions
 - BOOT-5122 - Presence check for grub.d added
+- CRYP-7902 - Added support for certificates in DER format
 - CRYP-7931 - Redirect errors (e.g. when swap is not encrypted)
 - FILE-6430 - Don't grep nonexistant modprobe.d files
 - FIRE-4535 - Set initial firewall state
@@ -20,12 +25,14 @@
 - KRNL-5728 - Handle zipped kernel configuration correctly
 - KRNL-5830 - Improved version detection for non-symlinked kernel
 - MALW-3280 - Extended detection of BitDefender
+- TIME-3104 - Find more time synchronization commands
+- TIME-3182 - Corrected detection of time peers
 - Fix: hostid generation routine would sometimes show too short IDs
-- Generic improvements for macOS
 - Fix: language detection
+- Generic improvements for macOS
 - German translation updated
 - End-of-life database updated
-- Small code enhancements
+- Several minor code enhancements
 
 ---------------------------------------------------------------------------------
 
@@ -135,7 +142,6 @@ Using the relevant options, the scan will change base on the intended goal.
 - BOOT-5122 - check for defined password in all GRUB configuration files
 - CONT-8106 - support newer 'docker info' output
 - CRYP-7902 - optionally check also certificates provided by packages
-- CRYP-7902 - check also certificates in DER format
 - CRYP-8002 - gather kernel entropy on Linux systems
 - FILE-6310 - support for HP-UX
 - FILE-6330 - corrected description

From a1f794cc75295fc458c0121903cfe82a1353ee78 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Thu, 3 Sep 2020 10:54:21 +0200
Subject: [PATCH 675/679] Don't provide suggestion to install pseudo rng at
 this moment

---
 include/tests_crypto | 44 +++++++++++++++++++++++++++++---------------
 1 file changed, 29 insertions(+), 15 deletions(-)

diff --git a/include/tests_crypto b/include/tests_crypto
index ddf1406a..40828175 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -21,6 +21,10 @@
 # Cryptography
 #
 #################################################################################
+#
+    RNG_FOUND=0
+#
+#################################################################################
 #
     InsertSection "Cryptography"
 #
@@ -181,20 +185,28 @@
     if [ ${SKIPTEST} -eq 0 ]; then
         ENCRYPTED_SWAPS=0
         UNENCRYPTED_SWAPS=0
-        SWAPS=$(${SWAPONBINARY} --show=NAME --noheadings)
-        for BLOCK_DEV in ${SWAPS}; do
-            if ${CRYPTSETUPBINARY} isLuks "${BLOCK_DEV}" 2> /dev/null; then
-                LogText "Result: Found LUKS encrypted swap device: ${BLOCK_DEV}"
-                ENCRYPTED_SWAPS=$((ENCRYPTED_SWAPS +1))
-            elif ${CRYPTSETUPBINARY} status "${BLOCK_DEV}" 2> /dev/null | ${GREPBINARY} --quiet "cipher:"; then
-                LogText "Result: Found non-LUKS encrypted swap device: ${BLOCK_DEV}"
-                ENCRYPTED_SWAPS=$((ENCRYPTED_SWAPS +1))
-            else
-                LogText "Result: Found unencrypted swap device: ${BLOCK_DEV}"
-                UNENCRYPTED_SWAPS=$((UNENCRYPTED_SWAPS +1))
-            fi
-        done
-        Display --indent 2 --text "- Found ${ENCRYPTED_SWAPS} encrypted and ${UNENCRYPTED_SWAPS} unencrypted swap devices in use." --result OK --color WHITE
+        # Redirect errors, as RHEL 5/6 and others don't have the --show option
+        SWAPS=$(${SWAPONBINARY} --show=NAME --noheadings 2> /dev/null)
+        if [ $? -eq 0 ]; then
+            for BLOCK_DEV in ${SWAPS}; do
+                if ${CRYPTSETUPBINARY} isLuks "${BLOCK_DEV}" 2> /dev/null; then
+                    LogText "Result: Found LUKS encrypted swap device: ${BLOCK_DEV}"
+                    ENCRYPTED_SWAPS=$((ENCRYPTED_SWAPS + 1))
+                    Report "encrypted_swap[]=${BLOCK_DEV},LUKS"
+                elif ${CRYPTSETUPBINARY} status "${BLOCK_DEV}" 2> /dev/null | ${GREPBINARY} --quiet "cipher:"; then
+                    LogText "Result: Found non-LUKS encrypted swap device: ${BLOCK_DEV}"
+                    ENCRYPTED_SWAPS=$((ENCRYPTED_SWAPS + 1))
+                    Report "encrypted_swap[]=${BLOCK_DEV},other"
+                else
+                    LogText "Result: Found unencrypted swap device: ${BLOCK_DEV}"
+                    UNENCRYPTED_SWAPS=$((UNENCRYPTED_SWAPS +1))
+                    Report "non_encrypted_swap[]=${BLOCK_DEV}"
+                fi
+            done
+            Display --indent 2 --text "- Found ${ENCRYPTED_SWAPS} encrypted and ${UNENCRYPTED_SWAPS} unencrypted swap devices in use." --result OK --color WHITE
+        else
+            LogText "Result: skipping testing as swapon returned an error."
+        fi
     fi
 #
 #################################################################################
@@ -232,6 +244,7 @@
                 if IsRunning "rngd"; then
                     Display --indent 2 --text "- HW RNG & rngd" --result "${STATUS_YES}" --color GREEN
                     LogText "Result: rngd is running"
+                    RNG_FOUND=1
                 else
                     Display --indent 2 --text "- HW RNG & rngd" --result "${STATUS_NO}" --color YELLOW
                     # TODO - enable suggestion when website has listing for this control
@@ -263,8 +276,9 @@
         done
         if [ -z "${FOUND}" ]; then
             Display --indent 2 --text "- SW prng" --result "${STATUS_NO}" --color YELLOW
-            ReportSuggestion "${TEST_NO}" "Utilize software pseudo random number generators"
+            # ReportSuggestion "${TEST_NO}" "Utilize software pseudo random number generators"
         else
+            RNG_FOUND=1
             Display --indent 2 --text "- SW prng" --result "${STATUS_YES}" --color GREEN
             LogText "Result: found ${FOUND} running"
         fi

From 768d8a62e8de6f63d5ace28b92dffed17a0a6061 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 2 Oct 2020 10:55:36 +0200
Subject: [PATCH 676/679] Updated log

---
 CHANGELOG.md         | 3 ++-
 include/tests_crypto | 4 ++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c4935044..3181544b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,7 +13,8 @@
 ### Changed
 - AUTH-9229 - Added option for LOCKED accounts and bugfix for older bash versions
 - BOOT-5122 - Presence check for grub.d added
-- CRYP-7931 - Redirect errors (e.g. when swap is not encrypted)
+- CRYP-7931 - Redirect errors
+- CRYP-7931 - Added data to report
 - FILE-6430 - Don't grep nonexistant modprobe.d files
 - FIRE-4535 - Set initial firewall state
 - INSE-8312 - Corrected text on screen
diff --git a/include/tests_crypto b/include/tests_crypto
index 40828175..976ba7b1 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -285,6 +285,10 @@
     fi
 #
 #################################################################################
+#
+    Report "rng_found=${RNG_FOUND}"
+#
+#################################################################################
 #
 
 WaitForKeyPress

From 5e0a4e685d84cf736c1c4795cd1b95bb24005eff Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 2 Oct 2020 10:57:58 +0200
Subject: [PATCH 677/679] Added CloudLinux

---
 include/osdetection | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/osdetection b/include/osdetection
index c2726d31..9910b307 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -173,6 +173,12 @@
                             OS_REDHAT_OR_CLONE=1
                             OS_VERSION="Rolling release"
                         ;;
+                        "cloudlinux")
+                            LINUX_VERSION="CloudLinux"
+                            OS_NAME="CloudLinux"
+                            OS_REDHAT_OR_CLONE=1
+                            OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+                        ;;
                         "coreos")
                             LINUX_VERSION="CoreOS"
                             OS_NAME="CoreOS Linux"

From 11be8b03ae5c2e79625e6c6af1ca3c773f478132 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Fri, 2 Oct 2020 10:58:06 +0200
Subject: [PATCH 678/679] Updated log

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3181544b..5a28590a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,7 @@
 ## Lynis 3.0.1 (not released yet)
 
 ### Added
+- Detection of CloudLinux
 - Detection of Kali Linux
 - Detection of Linux Mint
 - Detection of macOS Big Sur (11.0)

From 21b5493a1cb679d68e3da15ffdfc4f0a46a76776 Mon Sep 17 00:00:00 2001
From: Michael Boelen <michael.boelen@cisofy.com>
Date: Mon, 5 Oct 2020 13:22:39 +0200
Subject: [PATCH 679/679] Release 3.0.1

---
 CHANGELOG.md | 2 +-
 lynis        | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 57a314b6..0728f8c9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,6 @@
 # Lynis Changelog
 
-## Lynis 3.0.1 (not released yet)
+## Lynis 3.0.1 (2020-10-05)
 
 ### Added
 - Detection of Alpine Linux
diff --git a/lynis b/lynis
index 09f6f727..4d5306ff 100755
--- a/lynis
+++ b/lynis
@@ -43,9 +43,9 @@
     PROGRAM_WEBSITE="https://cisofy.com/lynis/"
 
     # Version details
-    PROGRAM_RELEASE_DATE="2020-06-26"
-    PROGRAM_RELEASE_TIMESTAMP=1593159916
-    PROGRAM_RELEASE_TYPE="pre-release" # pre-release or release
+    PROGRAM_RELEASE_DATE="2020-10-05"
+    PROGRAM_RELEASE_TIMESTAMP=1601896929
+    PROGRAM_RELEASE_TYPE="release" # pre-release or release
     PROGRAM_VERSION="3.0.1"
 
     # Source, documentation and license