tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-27 07:44:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1130 from ocafebabe/cmd_support

Browse Source 
Initial draft for Cmd support
This commit is contained in:
Michael Boelen 2021-04-15 08:35:31 +02:00 committed by GitHub
commit f41a2ead38
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 58 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/binaries
View File

@ -152,6 +152,7 @@
clang) CLANGBINARY=${BINARY}; COMPILER_INSTALLED=1; LogText " Found known binary: clang (compiler) - ${BINARY}" ;; clang) CLANGBINARY=${BINARY}; COMPILER_INSTALLED=1; LogText " Found known binary: clang (compiler) - ${BINARY}" ;;
cfagent) CFAGENTBINARY="${BINARY}"; FILE_INT_TOOL_FOUND=1; LogText " Found known binary: cfengine agent (configuration tool) - ${BINARY}" ;; cfagent) CFAGENTBINARY="${BINARY}"; FILE_INT_TOOL_FOUND=1; LogText " Found known binary: cfengine agent (configuration tool) - ${BINARY}" ;;
chkrootkit) CHKROOTKITBINARY="${BINARY}"; MALWARE_SCANNER_INSTALLED=1; LogText " Found known binary: chkrootkit (malware scanner) - ${BINARY}" ;; chkrootkit) CHKROOTKITBINARY="${BINARY}"; MALWARE_SCANNER_INSTALLED=1; LogText " Found known binary: chkrootkit (malware scanner) - ${BINARY}" ;;
cmd_daemon) CMDBINARY=${BINARY}; LogText " Found known binary: cmd (audit framework) - ${BINARY}" ;;
comm) COMMBINARY="${BINARY}"; LogText " Found known binary: comm (file compare) - ${BINARY}" ;; comm) COMMBINARY="${BINARY}"; LogText " Found known binary: comm (file compare) - ${BINARY}" ;;
cryptsetup) CRYPTSETUPBINARY="${BINARY}"; LogText " Found known binary: cryptsetup (block device encryption) - ${BINARY}" ;; cryptsetup) CRYPTSETUPBINARY="${BINARY}"; LogText " Found known binary: cryptsetup (block device encryption) - ${BINARY}" ;;
csum) CSUMBINARY="${BINARY}"; LogText " Found known binary: csum (hashing tool on AIX) - ${BINARY}" ;; csum) CSUMBINARY="${BINARY}"; LogText " Found known binary: csum (hashing tool on AIX) - ${BINARY}" ;;

1
include/consts
View File

@ -70,6 +70,7 @@ ETC_PATHS="/etc /usr/local/etc"
CLAMCONF_BINARY="" CLAMCONF_BINARY=""
CLAMSCANBINARY="" CLAMSCANBINARY=""
CLANGBINARY="" CLANGBINARY=""
CMDBINARY=""
COLORS=1 COLORS=1
COMPLIANCE_ENABLE_CIS=0 COMPLIANCE_ENABLE_CIS=0
COMPLIANCE_ENABLE_HIPAA=0 COMPLIANCE_ENABLE_HIPAA=0

56
include/tests_accounting
View File

@ -24,7 +24,10 @@
# #
AUDITD_CONF_LOCS="${ROOTDIR}etc ${ROOTDIR}etc/audit" AUDITD_CONF_LOCS="${ROOTDIR}etc ${ROOTDIR}etc/audit"
AUDITD_CONF_FILE="" AUDITD_CONF_FILE=""
CMD_CONF_LOCS="${ROOTDIR}etc ${ROOTDIR}etc/cmd"
CMD_CONF_FILE=""
LINUX_AUDITD_RUNNING=0 LINUX_AUDITD_RUNNING=0
LINUX_CMD_RUNNING=0
AUDIT_DAEMON_RUNNING=0 AUDIT_DAEMON_RUNNING=0
SOLARIS_AUDITD_RUNNING=0 SOLARIS_AUDITD_RUNNING=0
# #
@ -414,6 +417,59 @@
fi fi
# #
################################################################################# #################################################################################
#
# Test : ACCT-9670
# Description : Check cmd status
if [ -n "${CMDBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no ACCT-9670 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for cmd"
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Check cmd status"
if IsRunning "cmd_daemon"; then
LogText "Result: cmd running"
Display --indent 2 --text "- Checking cmd" --result "${STATUS_ENABLED}" --color GREEN
LINUX_CMD_RUNNING=1
AUDIT_DAEMON_RUNNING=1
Report "audit_trail_tool[]=cmd"
Report "linux_cmd_running=1"
AddHP 4 4
else
LogText "Result: cmd not active"
Display --indent 2 --text "- Checking cmd" --result "${STATUS_NOT_FOUND}" --color WHITE
if [ ! "${VMTYPE}" = "openvz" ]; then
ReportSuggestion "${TEST_NO}" "Install cmd to collect audit information"
fi
AddHP 0 1
Report "linux_cmd_running=0"
fi
fi
#
#################################################################################
#
# Test : ACCT-9672
# Description : Check cmd configuration file
if [ -n "${CMDBINARY}" -a ${LINUX_CMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no ACCT-9672 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for cmd configuration file"
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Checking cmd configuration file"
for DIR in ${CMD_CONF_LOCS}; do
if [ -f ${DIR}/config.ini ]; then
CMD_CONF_FILE="${DIR}/config.ini"
LogText "Result: Found ${DIR}/config.ini"
else
LogText "Result: ${DIR}/config.ini not found"
fi
done
# Check if we discovered the configuration file. It should be there is the binaries are available and process is running
if [ -n "${CMD_CONF_FILE}" ]; then
Display --indent 4 --text "- Checking cmd configuration file" --result "${STATUS_OK}" --color GREEN
else
LogText "Result: could not find cmd configuration file"
Display --indent 4 --text "- Checking cmd configuration file" --result "${STATUS_FOUND}" --color RED
ReportSuggestion "${TEST_NO}" "Determine the location of cmd configuration file"
fi
fi
#
#################################################################################
# #
Report "audit_daemon_running=${AUDIT_DAEMON_RUNNING}" Report "audit_daemon_running=${AUDIT_DAEMON_RUNNING}"
# #