tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-26 23:34:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

Detect when weak protocols are used, simplify nginx test

Browse Source
This commit is contained in:
mboelen 2016-04-27 16:51:12 +02:00
parent 1825d91c85
commit f109c318d9
3 changed files with 17 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/consts
View File

@ -123,6 +123,7 @@ unset LANG
NGINX_SSL_PROTOCOLS=0 NGINX_SSL_PROTOCOLS=0
NGINX_RETURN_FOUND=0 NGINX_RETURN_FOUND=0
NGINX_ROOT_FOUND=0 NGINX_ROOT_FOUND=0
NGINX_WEAK_SSL_PROTOCOL_FOUND=0
NTPD_ROLE="" NTPD_ROLE=""
ORACLE_RUNNING=0 ORACLE_RUNNING=0
OS=""; OS_MODE="" OS=""; OS_MODE=""

22
include/functions
View File

@ -1415,6 +1415,12 @@
NGINX_SSL_PROTOCOLS=1 NGINX_SSL_PROTOCOLS=1
VALUE=`echo ${VALUE} | sed 's/;$//' | tr '[:upper:]' '[:lower:]'` VALUE=`echo ${VALUE} | sed 's/;$//' | tr '[:upper:]' '[:lower:]'`
for ITEM in ${VALUE}; do for ITEM in ${VALUE}; do
LogText "Result: found protocol ${ITEM}"
case ${ITEM} in
"sslv2" | "sslv3")
NGINX_WEAK_SSL_PROTOCOL_FOUND=1
;;
esac
Report "ssl_tls_protocol_enabled[]=${ITEM}" Report "ssl_tls_protocol_enabled[]=${ITEM}"
ReportDetails --service nginx --field protocol --value "${ITEM}" ReportDetails --service nginx --field protocol --value "${ITEM}"
done done
@ -1746,24 +1752,24 @@
case $1 in case $1 in
--description) --description)
shift shift
TEST_DESCRIPTION=$1 TEST_DESCRIPTION="desc:$1;"
;; ;;
--field) --field)
shift shift
TEST_FIELD=$1 TEST_FIELD="field:$1;"
;; ;;
--preferredvalue|--preferred-value) --preferredvalue|--preferred-value)
shift shift
TEST_PREFERRED_VALUE=$1 TEST_PREFERRED_VALUE="prefval:$1;"
;; ;;
# Other details # Other details
--other) --other)
shift shift
TEST_OTHER=$1 TEST_OTHER="other:$1;"
;; ;;
--service) --service)
shift shift
TEST_SERVICE=$1 TEST_SERVICE="service:$1;"
;; ;;
--test) --test)
shift shift
@ -1771,7 +1777,7 @@
;; ;;
--value) --value)
shift shift
TEST_VALUE=$1 TEST_VALUE="value:$1;"
;; ;;
*) *)
@ -1781,7 +1787,9 @@
esac esac
shift # Go to next parameter shift # Go to next parameter
done done
Report "details[]=${TEST_ID}|service:${TEST_SERVICE}|desc:${TEST_DESCRIPTION};field:${TEST_FIELD};prefval:${TEST_PREFERRED_VALUE};value:${TEST_VALUE};other:${TEST_OTHER}|" if [ "${TEST_ID}" = "" ]; then TEST_ID="-"; fi
if [ "${TEST_SERVICE}" = "" ]; then TEST_SERVICE="-"; fi
Report "details[]=${TEST_ID}|${TEST_SERVICE}|${TEST_DESCRIPTION}${TEST_FIELD}${TEST_PREFERRED_VALUE}${TEST_VALUE}${TEST_OTHER}|"
} }
# Log exceptions # Log exceptions

3
include/tests_webservers
View File

@ -504,8 +504,7 @@
if [ ${NGINX_SSL_PROTOCOLS} -eq 1 ]; then if [ ${NGINX_SSL_PROTOCOLS} -eq 1 ]; then
Display --indent 8 --text "- Protocols configured" --result "YES" --color GREEN Display --indent 8 --text "- Protocols configured" --result "YES" --color GREEN
FIND=`${GREPBINARY} "ssl_protocols" ${NGINX_CONF_LOCATION} | ${GREPBINARY} "SSLv[123]"` if [ ${NGINX_WEAK_SSL_PROTOCOL_FOUND} -eq 0 ]; then
if [ "${FIND}" = "" ]; then
Display --indent 10 --text "- Insecure protocols found" --result "NO" --color GREEN Display --indent 10 --text "- Insecure protocols found" --result "NO" --color GREEN
else else
Display --indent 10 --text "- Insecure protocols found" --result "YES" --color RED Display --indent 10 --text "- Insecure protocols found" --result "YES" --color RED