tyler.durden
/
lynis
mirror of https://github.com/CISOfy/lynis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added detection of ESET products and logging of malware scanner to report

This commit is contained in:
mboelen 2015-09-28 11:00:34 +02:00
parent c127b9beb3
commit cf11b95c3f
1 changed files with 37 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
include/tests_malware
View File

@ -23,6 +23,9 @@
#################################################################################
#
CLAMD_RUNNING=0
CLAMSCAN_INSTALLED=0
ESET_DAEMON_RUNNING=0
FRESHCLAM_DAEMON_RUNNING=0
MCAFEE_SCANNER_RUNNING=0
MALWARE_SCANNER_INSTALLED=0
SOPHOS_SCANNER_RUNNING=0
@ -39,6 +42,7 @@
logtext "Result: Found ${CHKROOTKITBINARY}"
MALWARE_SCANNER_INSTALLED=1
AddHP 2 2
report "malware_scanner[]=chkrootkit"
else
logtext "Result: chkrootkit not found"
fi
@ -56,6 +60,7 @@
logtext "Result: Found ${RKHUNTERBINARY}"
MALWARE_SCANNER_INSTALLED=1
AddHP 2 2
report "malware_scanner[]=rkhunter"
else
logtext "Result: Rootkit Hunter not found"
fi
@ -73,6 +78,7 @@
logtext "Result: Found ${LMDBINARY}"
MALWARE_SCANNER_INSTALLED=1
AddHP 2 2
report "malware_scanner[]=lmd"
else
logtext "Result: LMD not found"
fi
@ -85,6 +91,21 @@
Register --test-no MALW-3280 --weight L --network NO --description "Check if anti-virus tool is installed"
if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0
# ESET security products
logtext "Test: checking process esets_daemon"
IsRunning esets_daemon
if [ ${RUNNING} -eq 1 ]; then
FOUND=1
Display --indent 2 --text "- Checking ESET daemon" --result "FOUND" --color GREEN
logtext "Result: found ESET security product"
ESET_DAEMON_RUNNING=1
MALWARE_SCANNER_INSTALLED=1
AddHP 2 2
report "malware_scanner[]=eset"
fi
# McAfee products
logtext "Test: checking process cma or cmdagent (McAfee)"
# cma is too generic to match on, so we want to ensure that it is related to McAfee first
if [ -x /opt/McAfee/cma/bin/cma ]; then
@ -100,28 +121,31 @@
logtext "Result: Found McAfee"
MALWARE_SCANNER_INSTALLED=1
AddHP 2 2
report "malware_scanner[]=mcafee"
fi
# Sophos savscand/SophosScanD
logtext "Test: checking process savscand"
IsRunning savscand
if [ ${RUNNING} -eq 1 ]; then
FOUND=1
SOPHOS_SCANNER_RUNNING=1;
SOPHOS_SCANNER_RUNNING=1
fi
logtext "Test: checking process SophosScanD"
IsRunning SophosScanD
if [ ${RUNNING} -eq 1 ]; then
FOUND=1
SOPHOS_SCANNER_RUNNING=1;
SOPHOS_SCANNER_RUNNING=1
fi
if [ ${SOPHOS_SCANNER_RUNNING} -eq 1 ]; then
Display --indent 2 --text "- Checking Sophos" --result "FOUND" --color GREEN
logtext "Result: Found Sophos"
MALWARE_SCANNER_INSTALLED=1
AddHP 2 2
report "malware_scanner[]=sophos"
fi
if [ ${FOUND} -eq 0 ]; then
logtext "Result: no commercial anti-virus tool found"
logtext "Result: no commercial anti-virus tools found"
AddHP 0 3
fi
fi
@ -137,6 +161,7 @@
Display --indent 2 --text "- Checking ClamAV scanner" --result "FOUND" --color GREEN
logtext "Result: Found ${CLAMSCANBINARY}"
MALWARE_SCANNER_INSTALLED=1
CLAMSCAN_INSTALLED=1
AddHP 2 2
else
logtext "Result: clamscan couldn't be found"
@ -171,6 +196,7 @@
logtext "Test: checking running freshclam daemon"
IsRunning freshclam
if [ ${RUNNING} -eq 1 ]; then
FRESHCLAM_DAEMON_RUNNING=1
Display --indent 4 --text "- Checking freshclam" --result "FOUND" --color GREEN
logtext "Result: found running freshclam process"
AddHP 2 2
@ -193,6 +219,7 @@
logtext "Result: Found ClamXav clamscan installed"
Display --indent 2 --text "- Checking presence of ClamXav AV scanner" --result "FOUND" --color GREEN
MALWARE_SCANNER_INSTALLED=1
CLAMSCAN_INSTALLED=1
AddHP 3 3
else
logtext "Result: ClamXav malware scanner not found"
@ -201,6 +228,13 @@
fi
#
#################################################################################
#
# Check if we found any of the ClamAV components
if [ ${CLAMSCAN_INSTALLED} -eq 1 -o ${CLAMD_RUNNING} -eq 1 -o ${FRESHCLAM_DAEMON_RUNNING} -eq 1 ]; then
report "malware_scanner[]=clamav"
fi
#
#################################################################################
#
report "malware_scanner_installed=${MALWARE_SCANNER_INSTALLED}"