tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-23 13:54:35 +02:00
Code Issues Packages Projects Releases Wiki Activity

Added detection of ESET products and logging of malware scanner to report

Browse Source
This commit is contained in:
mboelen 2015-09-28 11:00:34 +02:00
parent c127b9beb3
commit cf11b95c3f
1 changed files with 37 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
include/tests_malware
View File

@ -23,6 +23,9 @@
################################################################################# #################################################################################
# #
CLAMD_RUNNING=0 CLAMD_RUNNING=0
CLAMSCAN_INSTALLED=0
ESET_DAEMON_RUNNING=0
FRESHCLAM_DAEMON_RUNNING=0
MCAFEE_SCANNER_RUNNING=0 MCAFEE_SCANNER_RUNNING=0
MALWARE_SCANNER_INSTALLED=0 MALWARE_SCANNER_INSTALLED=0
SOPHOS_SCANNER_RUNNING=0 SOPHOS_SCANNER_RUNNING=0
@ -39,6 +42,7 @@
logtext "Result: Found ${CHKROOTKITBINARY}" logtext "Result: Found ${CHKROOTKITBINARY}"
MALWARE_SCANNER_INSTALLED=1 MALWARE_SCANNER_INSTALLED=1
AddHP 2 2 AddHP 2 2
report "malware_scanner[]=chkrootkit"
else else
logtext "Result: chkrootkit not found" logtext "Result: chkrootkit not found"
fi fi
@ -56,6 +60,7 @@
logtext "Result: Found ${RKHUNTERBINARY}" logtext "Result: Found ${RKHUNTERBINARY}"
MALWARE_SCANNER_INSTALLED=1 MALWARE_SCANNER_INSTALLED=1
AddHP 2 2 AddHP 2 2
report "malware_scanner[]=rkhunter"
else else
logtext "Result: Rootkit Hunter not found" logtext "Result: Rootkit Hunter not found"
fi fi
@ -73,6 +78,7 @@
logtext "Result: Found ${LMDBINARY}" logtext "Result: Found ${LMDBINARY}"
MALWARE_SCANNER_INSTALLED=1 MALWARE_SCANNER_INSTALLED=1
AddHP 2 2 AddHP 2 2
report "malware_scanner[]=lmd"
else else
logtext "Result: LMD not found" logtext "Result: LMD not found"
fi fi
@ -85,6 +91,21 @@
Register --test-no MALW-3280 --weight L --network NO --description "Check if anti-virus tool is installed" Register --test-no MALW-3280 --weight L --network NO --description "Check if anti-virus tool is installed"
if [ ${SKIPTEST} -eq 0 ]; then if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0 FOUND=0
# ESET security products
logtext "Test: checking process esets_daemon"
IsRunning esets_daemon
if [ ${RUNNING} -eq 1 ]; then
FOUND=1
Display --indent 2 --text "- Checking ESET daemon" --result "FOUND" --color GREEN
logtext "Result: found ESET security product"
ESET_DAEMON_RUNNING=1
MALWARE_SCANNER_INSTALLED=1
AddHP 2 2
report "malware_scanner[]=eset"
fi
# McAfee products
logtext "Test: checking process cma or cmdagent (McAfee)" logtext "Test: checking process cma or cmdagent (McAfee)"
# cma is too generic to match on, so we want to ensure that it is related to McAfee first # cma is too generic to match on, so we want to ensure that it is related to McAfee first
if [ -x /opt/McAfee/cma/bin/cma ]; then if [ -x /opt/McAfee/cma/bin/cma ]; then
@ -100,28 +121,31 @@
logtext "Result: Found McAfee" logtext "Result: Found McAfee"
MALWARE_SCANNER_INSTALLED=1 MALWARE_SCANNER_INSTALLED=1
AddHP 2 2 AddHP 2 2
report "malware_scanner[]=mcafee"
fi fi
# Sophos savscand/SophosScanD # Sophos savscand/SophosScanD
logtext "Test: checking process savscand" logtext "Test: checking process savscand"
IsRunning savscand IsRunning savscand
if [ ${RUNNING} -eq 1 ]; then if [ ${RUNNING} -eq 1 ]; then
FOUND=1 FOUND=1
SOPHOS_SCANNER_RUNNING=1; SOPHOS_SCANNER_RUNNING=1
fi fi
logtext "Test: checking process SophosScanD" logtext "Test: checking process SophosScanD"
IsRunning SophosScanD IsRunning SophosScanD
if [ ${RUNNING} -eq 1 ]; then if [ ${RUNNING} -eq 1 ]; then
FOUND=1 FOUND=1
SOPHOS_SCANNER_RUNNING=1; SOPHOS_SCANNER_RUNNING=1
fi fi
if [ ${SOPHOS_SCANNER_RUNNING} -eq 1 ]; then if [ ${SOPHOS_SCANNER_RUNNING} -eq 1 ]; then
Display --indent 2 --text "- Checking Sophos" --result "FOUND" --color GREEN Display --indent 2 --text "- Checking Sophos" --result "FOUND" --color GREEN
logtext "Result: Found Sophos" logtext "Result: Found Sophos"
MALWARE_SCANNER_INSTALLED=1 MALWARE_SCANNER_INSTALLED=1
AddHP 2 2 AddHP 2 2
report "malware_scanner[]=sophos"
fi fi
if [ ${FOUND} -eq 0 ]; then if [ ${FOUND} -eq 0 ]; then
logtext "Result: no commercial anti-virus tool found" logtext "Result: no commercial anti-virus tools found"
AddHP 0 3 AddHP 0 3
fi fi
fi fi
@ -137,6 +161,7 @@
Display --indent 2 --text "- Checking ClamAV scanner" --result "FOUND" --color GREEN Display --indent 2 --text "- Checking ClamAV scanner" --result "FOUND" --color GREEN
logtext "Result: Found ${CLAMSCANBINARY}" logtext "Result: Found ${CLAMSCANBINARY}"
MALWARE_SCANNER_INSTALLED=1 MALWARE_SCANNER_INSTALLED=1
CLAMSCAN_INSTALLED=1
AddHP 2 2 AddHP 2 2
else else
logtext "Result: clamscan couldn't be found" logtext "Result: clamscan couldn't be found"
@ -171,6 +196,7 @@
logtext "Test: checking running freshclam daemon" logtext "Test: checking running freshclam daemon"
IsRunning freshclam IsRunning freshclam
if [ ${RUNNING} -eq 1 ]; then if [ ${RUNNING} -eq 1 ]; then
FRESHCLAM_DAEMON_RUNNING=1
Display --indent 4 --text "- Checking freshclam" --result "FOUND" --color GREEN Display --indent 4 --text "- Checking freshclam" --result "FOUND" --color GREEN
logtext "Result: found running freshclam process" logtext "Result: found running freshclam process"
AddHP 2 2 AddHP 2 2
@ -193,6 +219,7 @@
logtext "Result: Found ClamXav clamscan installed" logtext "Result: Found ClamXav clamscan installed"
Display --indent 2 --text "- Checking presence of ClamXav AV scanner" --result "FOUND" --color GREEN Display --indent 2 --text "- Checking presence of ClamXav AV scanner" --result "FOUND" --color GREEN
MALWARE_SCANNER_INSTALLED=1 MALWARE_SCANNER_INSTALLED=1
CLAMSCAN_INSTALLED=1
AddHP 3 3 AddHP 3 3
else else
logtext "Result: ClamXav malware scanner not found" logtext "Result: ClamXav malware scanner not found"
@ -201,6 +228,13 @@
fi fi
# #
################################################################################# #################################################################################
#
# Check if we found any of the ClamAV components
if [ ${CLAMSCAN_INSTALLED} -eq 1 -o ${CLAMD_RUNNING} -eq 1 -o ${FRESHCLAM_DAEMON_RUNNING} -eq 1 ]; then
report "malware_scanner[]=clamav"
fi
#
#################################################################################
# #
report "malware_scanner_installed=${MALWARE_SCANNER_INSTALLED}" report "malware_scanner_installed=${MALWARE_SCANNER_INSTALLED}"