tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-28 08:14:10 +02:00
Code Issues Packages Projects Releases Wiki Activity

[NETW-3015] added support for ip binary

Browse Source
This commit is contained in:
Michael Boelen 2019-03-21 09:34:26 +01:00
parent 943e09db01
commit ea8c032ea9
No known key found for this signature in database
GPG Key ID: 26141F77A09D7F04
1 changed files with 30 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
include/tests_networking
View File

@ -507,35 +507,54 @@
# #
# Test : NETW-3015 # Test : NETW-3015
# Description : Checking promiscuous interfaces (Linux) # Description : Checking promiscuous interfaces (Linux)
# Note : Need ifconfig binary at this moment (does not work on Arch Linux) Register --test-no NETW-3015 --os Linux --weight L --network NO --category security --description "Checking promiscuous interfaces (Linux)"
if [ ! "${IFCONFIGBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no NETW-3015 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking promiscuous interfaces (Linux)"
if [ ${SKIPTEST} -eq 0 ]; then if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Checking promiscuous interfaces (Linux)" FOUNDPROMISC=99
NETWORK=$(${IFCONFIGBINARY} 2> /dev/null | ${GREPBINARY} Link | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f1) NETWORK=""
if [ ! "${NETWORK}" = "" ]; then USE_IP_INSTEAD_IFCONFIG=0
if [ ! -z "${IPBINARY}" ]; then
LogText "Test: Using ip binary to retrieve network interfaces"
NETWORK=$(${IPBINARY} -o link 2> /dev/null | ${GREPBINARY} "^[0-9]" | ${AWKBINARY} '{print $2 }' | ${TRBINARY} -d ':')
USE_IP_INSTEAD_IFCONFIG=1
elif [ ! -z "${IFCONFIGBINARY}" ]; then
LogText "Test: Using ifconfig binary to retrieve network interfaces"
NETWORK=$(${IFCONFIGBINARY} 2> /dev/null | ${GREPBINARY} Link | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f1)
fi
LogText "Test: Checking all interfaces to discover any with promiscuous mode enabled"
if [ ! -z "${NETWORK}" ]; then
FOUNDPROMISC=0
for I in ${NETWORK}; do for I in ${NETWORK}; do
FIND=$(${IFCONFIGBINARY} ${I} 2> /dev/null | ${GREPBINARY} PROMISC) if [ ${USE_IP_INSTEAD_IFCONFIG} -eq 1 ]; then
if [ ! "${FIND}" = "" ]; then FIND=$(${IPBINARY} -o -d link show ${I} 2> /dev/null | ${GREPBINARY} 'promiscuity 1')
else
FIND=$(${IFCONFIGBINARY} ${I} 2> /dev/null | ${GREPBINARY} PROMISC)
fi
if [ ! -z "${FIND}" ]; then
LogText "Result: Promiscuous interface: ${I}" LogText "Result: Promiscuous interface: ${I}"
ISWHITELISTED=$(${GREPBINARY} "^if_promisc:${I}:" ${PROFILE}) ISWHITELISTED=$(${GREPBINARY} "^if_promisc:${I}:" ${PROFILE})
if [ "${ISWHITELISTED}" = "" ]; then if [ -z "${ISWHITELISTED}" ]; then
FOUNDPROMISC=1 FOUNDPROMISC=1
ReportWarning ${TEST_NO} "Found promiscuous interface (${I})" ReportWarning ${TEST_NO} "Found promiscuous interface" "${I}" "text:Determine if this mode is required or whitelist interface in profile"
LogText "Note: some tools put an interface into promiscuous mode, to capture/log network traffic" LogText "Note: some tools put an interface into promiscuous mode, to capture/log network traffic"
else else
LogText "Result: Found promiscuous interface ${I} (*whitelisted via profile*)" LogText "Result: Found promiscuous interface ${I} (*whitelisted via profile*)"
fi fi
fi fi
done done
else
LogText "Result: no network interfaces discovered, so nothing tested"
fi fi
# Show result # Show result
if [ ${FOUNDPROMISC} -eq 0 ]; then if [ ${FOUNDPROMISC} -eq 0 ]; then
Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_OK}" --color GREEN Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_OK}" --color GREEN
LogText "Result: No promiscuous interfaces found" LogText "Result: No promiscuous interfaces found"
else elif [ ${FOUNDPROMISC} -eq 1 ]; then
Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_WARNING}" --color RED Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_WARNING}" --color RED
else
Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_UNKNOWN}" --color YELLOW
fi fi
fi fi
# #