mirror of https://github.com/CISOfy/lynis.git
Modified [SSH-7408] -- made it widely usable.
Modified [SSH-7408] in such a way that every option for SSH server might be added in SSHOPS with expected (and wrong) values (like it was described in comment).
This commit is contained in:
parent
9ca47fd220
commit
f28fd77583
|
@ -83,15 +83,59 @@
|
||||||
# Test : SSH-7408
|
# Test : SSH-7408
|
||||||
# Description : Check SSH specific defined options
|
# Description : Check SSH specific defined options
|
||||||
if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
||||||
Register --test-no SSH-7408 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH defined options"
|
Register --test-no SSH-7408 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH specific defined options"
|
||||||
if [ ${SKIPTEST} -eq 0 ]; then
|
if [ ${SKIPTEST} -eq 0 ]; then
|
||||||
logtext "Test: Checking all specific defined options in ${SSH_DAEMON_CONFIG}"
|
logtext "Test: Checking specific defined options in ${SSH_DAEMON_CONFIG}"
|
||||||
FIND=`grep -v "^#" ${SSH_DAEMON_CONFIG} | grep -v "^$" | ${AWKBINARY} '{gsub("\t"," ");print}' | sed 's/ /!space!/g'`
|
## SSHOPTIONS scheme:
|
||||||
for I in ${FIND}; do
|
## <OptionName>:<ExpectedValue>,<MediumScoreValue>,<WrongValue>
|
||||||
I=`echo ${I} | sed 's/!space!/ /g'`
|
## Example:
|
||||||
logtext "Found SSH option: ${I}"
|
## PermitRootLogin:NO,WITHOUT-PASSWORD,YES
|
||||||
|
SSHOPS="Protocol:2,,1"
|
||||||
|
|
||||||
|
for I in ${SSHOPS};
|
||||||
|
do
|
||||||
|
OPTIONNAME=`echo ${I} | cut -d ':' -f1`
|
||||||
|
|
||||||
|
EXPECTEDVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f1`
|
||||||
|
MEDIUMSCOREDVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f2`
|
||||||
|
WRONGVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f3`
|
||||||
|
|
||||||
|
FOUNDVALUE=`awk -v OPT="${OPTIONNAME}" 'index($0, OPT) == 1 { print toupper($2) }' ${SSH_DAEMON_CONFIG}`
|
||||||
|
|
||||||
|
logtext "Test: Checking ${OPTIONNAME} in ${SSH_DAEMON_CONFIG}"
|
||||||
|
|
||||||
|
if [ ! "${FOUNDVALUE}" = "" ]; then
|
||||||
|
logtext "Result: Option ${OPTIONNAME} found in ${SSH_DAEMON_CONFIG}"
|
||||||
|
logtext "Result: Option ${OPTIONNAME} value is ${FOUNDVALUE}"
|
||||||
|
|
||||||
|
if [ "${FOUNDVALUE}" = "${EXPECTEDVALUE}" ]; then
|
||||||
|
logtext "Result: SSH option ${OPTIONNAME} is configured very well"
|
||||||
|
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result OK --color GREEN
|
||||||
|
AddHP 3 3
|
||||||
|
|
||||||
|
elif [ "${FOUNDVALUE}" = "${MEDIUMSCOREDVALUE}" ]; then
|
||||||
|
logtext "Result: SSH option ${OPTIONNAME} is configured totally wrong"
|
||||||
|
ReportSuggestion ${TEST_NO} "Harder SSH option: ${OPTIONNAME}"
|
||||||
|
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "MEDIUM" --color YELLOW
|
||||||
|
AddHP 1 3
|
||||||
|
|
||||||
|
elif [ "${FOUNDVALUE}" = "${WRONGVALUE}" ]; then
|
||||||
|
logtext "Result: SSH option ${OPTIONNAME} is configured totally wrong"
|
||||||
|
ReportWarning ${TEST_NO} "M" "Unsafe configured SSH option: ${OPTIONNAME}"
|
||||||
|
ReportSuggestion ${TEST_NO} "Reconfigure ${OPTIONNAME}"
|
||||||
|
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result WARNING --color RED
|
||||||
|
AddHP 0 3
|
||||||
|
|
||||||
|
else
|
||||||
|
logtext "Result: Value of SSH option ${OPTIONNAME} is unknown (not defined)"
|
||||||
|
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result DEFAULT --color WHITE
|
||||||
|
fi
|
||||||
|
|
||||||
|
else
|
||||||
|
logtext "Result: Option ${OPTIONNAME} not found in ${SSH_DAEMON_CONFIG}"
|
||||||
|
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "NOT FOUND" --color WHITE
|
||||||
|
fi
|
||||||
done
|
done
|
||||||
Display --indent 4 --text "- Checking defined SSH options" --result "DONE" --color GREEN
|
|
||||||
fi
|
fi
|
||||||
#
|
#
|
||||||
#################################################################################
|
#################################################################################
|
||||||
|
|
Loading…
Reference in New Issue