tyler.durden
/
lynis
mirror of https://github.com/CISOfy/lynis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #883 from topimiettinen/check-encrypted-swap-devices 

Check if system uses encrypted swap devices
This commit is contained in:
Michael Boelen 2020-04-12 16:22:22 +02:00 committed by GitHub
parent a166691199 5c5cc43c6f
commit ce3c80b44f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@ -51,6 +51,7 @@ Using the relevant options, the scan will change base on the intended goal.
- New test: BOOT-5109 - test presence rEFInd boot loader
- New test: BOOT-5264 - run systemd-analyze security
- New test: CRYP-7930 - test for LUKS encryption
- New test: CRYP-7931 - determine if system uses encrypted swap
- New test: CRYP-8004 - presence of hardware random number generator
- New test: CRYP-8005 - presence of software random number generator
- New test: DBS-1828 - PostgreSQL configuration files

1
db/tests.db
View File

@ -88,6 +88,7 @@ CONT-8108:test:security:containers::Check file permissions for Docker files:
CORE-1000:test:performance:system_integrity::Check all system binaries:
CRYP-7902:test:security:crypto::Check expire date of SSL certificates:
CRYP-7930:test:security:crypto:Linux:Determine if system uses LUKS encryption:
CRYP-7931:test:security:crypto:Linux:Determine if system uses encrypted swap:
CRYP-8002:test:security:crypto:Linux:Gather kernel entropy:
CRYP-8004:test:security:crypto:Linux:Presence of hardware random number generators:
CRYP-8005:test:security:crypto:Linux:Presence of software pseudo random number generators:

1
include/binaries
View File

@ -284,6 +284,7 @@
sha256|sha256sum) SHA256SUMBINARY="${BINARY}"; LogText " Found known binary: sha256/sha256sum (crypto hashing) - ${BINARY}" ;;
ssh-keyscan) SSHKEYSCANBINARY="${BINARY}"; LogText " Found known binary: ssh-keyscan (scanner for SSH keys) - ${BINARY}" ;;
suricata) SURICATABINARY="${BINARY}"; LogText " Found known binary: suricata (IDS) - ${BINARY}" ;;
swapon) SWAPONBINARY="${BINARY}"; LogText " Found known binary: swapon (swap device tool) - ${BINARY}" ;;
swupd) SWUPDBINARY="${BINARY}"; LogText " Found known binary: swupd (package manager) - ${BINARY}" ;;
sysctl) SYSCTLBINARY="${BINARY}"; LogText " Found known binary: sysctl (kernel parameters) - ${BINARY}" ;;
syslog-ng) SYSLOGNGBINARY="${BINARY}"; SYSLOGNGVERSION=$(${BINARY} -V 2>&1 | grep "^syslog-ng" | awk '{ print $2 }'); LogText "Found ${BINARY} (version ${SYSLOGNGVERSION})" ;;

25
include/tests_crypto
View File

@ -173,6 +173,31 @@
fi
#
#################################################################################
#
# Test : CRYP-7931
# Description : Determine if system uses encrypted swap
if [ -e "${SWAPONBINARY}" -a -e "${CRYPTSETUPBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no CRYP-7931 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --root-only YES --category security --description "Determine if system uses encrypted swap"
if [ ${SKIPTEST} -eq 0 ]; then
ENCRYPTED_SWAPS=0
UNENCRYPTED_SWAPS=0
SWAPS=$(${SWAPONBINARY} --show=NAME --noheadings)
for BLOCK_DEV in ${SWAPS}; do
if ${CRYPTSETUPBINARY} isLuks "${BLOCK_DEV}" 2> /dev/null; then
LogText "Result: Found LUKS encrypted swap device: ${BLOCK_DEV}"
ENCRYPTED_SWAPS=$((ENCRYPTED_SWAPS +1))
elif ${CRYPTSETUPBINARY} status "${BLOCK_DEV}" | ${GREPBINARY} --quiet "cipher:"; then
LogText "Result: Found non-LUKS encrypted swap device: ${BLOCK_DEV}"
ENCRYPTED_SWAPS=$((ENCRYPTED_SWAPS +1))
else
LogText "Result: Found unencrypted swap device: ${BLOCK_DEV}"
UNENCRYPTED_SWAPS=$((UNENCRYPTED_SWAPS +1))
fi
done
Display --indent 2 --text "- Found ${ENCRYPTED_SWAPS} encrypted and ${UNENCRYPTED_SWAPS} unencrypted swap devices in use." --result OK --color WHITE
fi
#
#################################################################################
#
# Test : CRYP-8002
# Description : Gather available kernel entropy