6308682cae
Combine AUTH-9218 and AUTH-9489
...
These two tests are essentially identical. There is no need separate
the DragonFly and FreeBSD tests. This will make it easier to add
support for other BSD systems.
2020-04-02 20:09:01 -05:00
4bcd695428
AUTH-9268 Add DragonFly
...
DragonFly also supports PAM. Rework to use the `--os` option of `Register`
rather than `--preqs-met` as the former can support a list.
2020-04-02 15:59:11 -05:00
52b72e7b0f
extended test KRNL-5830 to detect required reboots on Raspbian
2020-04-02 21:45:40 +02:00
38a5c2cb79
Added new test PHP-2382
2020-04-02 19:46:58 +02:00
6eb204a85d
[PRNT-2308] check for Port statement and minor adjustments to test
2020-04-02 14:45:44 +02:00
ca6fc134dd
Renamed spools to spoolers
2020-04-02 13:20:06 +02:00
4fe1cb92a5
[PRNT-2308] check also SSLListen statements
2020-04-02 13:15:03 +02:00
9642bcffc8
[CRYP-7902] Optionally check also certificates provided by packages
...
The package maintainers are not immune to mistakes or they might not
always provide timely updates, so let's check (optionally) more
certificates even if they are delivered by packages.
I found three expired certificates in my Debian/unstable system,
thanks to changed Lynis.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-04-02 12:52:13 +03:00
b5a2d11738
Added fallback for awk/tr, small code enhancement, added note
2020-04-02 09:28:41 +02:00
156f740ff2
The IsRunning function may have not everything defined early on, so added a fallback
2020-04-01 19:02:11 +02:00
4432f93044
[LOGG-2190] skip mysqld related entries
2020-04-01 16:32:52 +02:00
f232b4f9bb
Added quotes
2020-04-01 16:18:03 +02:00
7e3c9448df
[TIME-3104] search for files using find and strip potential characters that may be unexpected
2020-04-01 16:16:31 +02:00
8c501c7aa8
Merge pull request #885 from sanderu/master
...
Adding test FILE-6394
2020-04-01 13:43:58 +02:00
c5914c4e0f
Split count values so they are reported as individual items
2020-04-01 11:48:39 +02:00
179f7d3442
Enhance binaries report
...
Report also number of set-uid and set-gid binaries found.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-31 19:09:57 +03:00
288bca9334
Merge pull request #887 from bginsbach/fix-auth-9229
...
AUTH-9229 Do not use long options for sort
2020-03-31 16:35:48 +02:00
a38e2b535e
Corrected case where binaries were not checked while we do want to use dmidecode if it available
2020-03-31 16:31:41 +02:00
53ad72e791
Removed unneeded complexity regarding dmidecode, as binary checks are already done at this point
2020-03-31 16:25:27 +02:00
4ff61a6f46
Merge pull request #890 from bginsbach/add-pkg_info
...
Add pkg_info
2020-03-31 15:49:54 +02:00
e481d5a173
Merge pull request #888 from bginsbach/fix-auth-9230
...
Fix AUTH-9230 for systems without /etc/login.defs
2020-03-31 11:22:31 +02:00
94915ac2fe
Fix PKGS-7301 message nit
...
The comment is correct. It is FreeBSD pkg not NetBSD pkg.
2020-03-30 14:23:58 -05:00
eb7dbab1ee
Add pkg_info to PackageIsInstalled
...
The `pkg_info` command is used on a system using NetBSD pkgsrc to
determine which packages are installed.
2020-03-30 14:12:36 -05:00
2b1d5fa46f
Add NetBSD pkgsrc pkg_info to known binaries
...
The NetBSD pkgsrc package management system uses pkg_info for
determining information about packages. This is also the command
used in PKGS-7302.
2020-03-30 14:09:28 -05:00
f13d919dfa
PROC-3802 Only check for prelink package on Linux
...
The prelink package is Linux specific no need to check for it on
non-Linux systems.
2020-03-29 16:19:25 -05:00
90b17121ba
Fix AUTH-9230 for systems without /etc/login.defs
...
This fixes a bug where it was determined that /etc/login.defs didn't
exist as a prerequisite but then wasn't used to skip the test. Prevents
warnings from `grep(1)` for "no such file or directory".
2020-03-29 15:31:41 -05:00
18daa9f495
AUTH-9229 Do not use long options for sort
...
Use the standard `sort(1)` short option `-u` rather than `--unique`,
since not all versions support long options.
2020-03-29 15:06:36 -05:00
4732b640ae
Adding test FILE-6394
2020-03-28 19:23:00 +00:00
5c5cc43c6f
Check if system uses encrypted swap devices
...
Add test CRYP-7931 to check if the system uses any encrypted swap
devices.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-27 13:05:56 +02:00
603d5b16a2
[FINT-4339] define what file to check for
2020-03-25 19:40:05 +01:00
b8cdb04772
Corrected requirements to run tests
2020-03-25 19:33:55 +01:00
1e52ed0c0d
Added notes to NETW-3200 for future extending this test
2020-03-25 15:19:21 +01:00
04c969752a
[NETW-3200] corrected test
2020-03-25 15:15:42 +01:00
9b978a3581
Add specific control ID for warnings regarding usage of deprecated options
2020-03-25 15:03:21 +01:00
db117ae644
Merge branch 'master' of https://github.com/CISOfy/lynis
2020-03-25 10:11:34 +01:00
f644927a42
Improved warning message with 'how to resolve'
2020-03-25 10:11:25 +01:00
339e0c3207
[FILE-6374]: Summarize unhardened file system
...
Report total numbers of unhardened filesystems.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-25 09:18:16 +02:00
3c8e3b0adb
Merge pull request #862 from topimiettinen/blacklist-fs
...
FS module tests: check if modules are blacklisted
2020-03-24 13:34:05 +01:00
3c3feecbfb
Merge pull request #824 from Varbin/master
...
Add detection of OpenNTPD
2020-03-24 13:29:02 +01:00
f83025a283
Merge pull request #860 from topimiettinen/harden-mount-options
...
Harden mount options for /var, check also /dev and /run
2020-03-24 13:27:50 +01:00
dbfadc5446
Merge pull request #879 from topimiettinen/enhance-tomoyo-check
...
Enhance TOMOYO Linux check
2020-03-24 13:26:33 +01:00
18a570c0b8
Merge pull request #880 from konstruktoid/grphashrounds
...
Add test for group password hash rounds
2020-03-24 13:24:12 +01:00
bc09f921f0
fix indentation
...
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
2020-03-24 11:53:50 +01:00
0b9e2d85d6
fix tabs
...
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
2020-03-24 11:45:05 +01:00
5341fa7b29
AUTH-9229 isnt related to login.defs, add AUTH-9230
...
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
2020-03-24 11:44:14 +01:00
e09fe98b89
Enhance TOMOYO Linux check
...
Count and log unconfined processes, which are not using policy
profile 3.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-23 18:44:21 +02:00
0da82a18cb
FS module tests: check if modules are blacklisted
...
Check if FS modules are blacklisted.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-23 17:43:53 +02:00
8913374092
Run 'systemd-analyze security'
...
'systemd-analyze security' (available since systemd v240) makes a nice
overall evaluation of hardening levels of services in a system. More
details can be found with 'systemd-analyze security SERVICE' for each
service.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-23 17:31:32 +02:00
7bba7bd4af
Removed incorrect process name from list, enable --full as it is required for matching jitterentropy-rngd
2020-03-23 16:13:39 +01:00
dcddfdb6cc
Merge branch 'master' of https://github.com/CISOfy/lynis
2020-03-23 15:56:03 +01:00
1e74f9be9a
Fixed 'lynis show details' output
2020-03-23 15:55:40 +01:00
8f77116ce7
Merge pull request #876 from topimiettinen/enhance-apparmor-check
...
Enhance AppArmor check
2020-03-23 15:24:52 +01:00
7d1fe1231a
[CRYP-8005] added haveged, match against process name instead of full command line, code cleanup
2020-03-23 14:29:47 +01:00
1eb9218986
Merge branch 'master' of https://github.com/CISOfy/lynis
2020-03-23 13:19:29 +01:00
17bbaa8f7a
[AUTH-9229] make test only available for root
2020-03-23 13:19:10 +01:00
32cefdea0a
Merge pull request #878 from topimiettinen/check-ima-evm
...
Check IMA/EVM, dm-integrity and dm-verity statuses
2020-03-23 13:18:16 +01:00
122619d01f
Merge pull request #874 from topimiettinen/check-password-hashing-methods
...
Check password hashing methods
2020-03-23 12:49:20 +01:00
17ac4d2c1c
[AUTH-9252] corrected permission check
2020-03-23 10:44:45 +01:00
8ea39314f2
Check for dm-integrity and dm-verity
...
Detect tools for dm-integrity and dm-verity, check if some devices
in /dev/mapper/* use them and especially the system root device.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-23 10:35:38 +02:00
058b071ea2
Merge pull request #877 from bginsbach/auth-9268-add-bsd
...
Add FreeBSD and NetBSD to AUTH-9268
2020-03-22 15:16:09 +01:00
203a4d3480
Check IMA/EVM status
...
Check for evmctl (Extended Verification Module) tool and system IMA (Integrity Measurement
Architecture) status.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-22 11:21:52 +02:00
33ba896b41
Add FreeBSD and NetBSD to AUTH-9268
...
Add FreeBSD and NetBSD as both support PAM. Simplify the PREQS_MET
test by using a case rather than a long if or.
2020-03-21 20:03:37 -05:00
f56c3b5f94
Combine NetBSD and OpenBSD AUTH-9234 check
...
Both NetBSD and OpenBSD have `useradd(8)`, so they can share logic
checking `/etc/usermgmt.conf` for the default user UID range.
2020-03-21 16:16:34 -05:00
044c78452b
Add AUTH-9234 for NetBSD
2020-03-21 16:10:05 -05:00
e0e2096a25
Enhance AppArmor check
...
Count and log unconfined processes which have no AppArmor profile
applied.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-21 17:14:55 +02:00
26a54991ba
Check for software pseudo random number generators
...
Check for running audio-entropyd, havegd or jitterentropy-rngd.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-21 16:26:30 +02:00
148e5b5c14
Merge pull request #870 from bginsbach/boot-5260-linux
...
Make BOOT-5260 Linux only
2020-03-21 13:54:21 +01:00
1bb35b86b8
Merge pull request #873 from topimiettinen/fix-developer-profile
...
Fix developer profile
2020-03-21 13:50:03 +01:00
357b059c12
Merge pull request #871 from bginsbach/fix-find-not
...
Fix uses of non-standard find not operator
2020-03-21 13:43:28 +01:00
4a51ad031b
Check password hashing methods
...
Manual page crypt(5) gives recommendations for choosing password
hashing methods, so let's check if there are weakly encrypted
passwords in the system.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-21 12:50:38 +02:00
e98fcb9b73
Fix developer profile
...
Initialialize a few variables to let --profile developer.prf pass.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-20 22:26:51 +02:00
9c5451d29d
Make BOOT-5260 Linux only
...
Linux is the only OS with systemd so no need to check for systemd
single user mode on other operatings systems.
2020-03-20 14:40:20 -05:00
32d1155953
Fix uses of non-standard find not operator
...
Use ! rather than the non-standard -not find(1) operator.
2020-03-20 14:37:56 -05:00
52344913d3
Add a way to signify undetermined EOL
...
Replace setting an artificaly high date and converted date for
operating systems with no EOL (rolling) or the EOL is still to
be determined. This makes it easier for humans and saves making
a comparison (when using an artifically high converted time)
will always be false (EOL=0).
An example entry
os:AGreatOS 2.0:👎
The converted time (seconds since the epoch) could be specified as
zero but this typically means the OS is out of date (now), A value
of -1 is a convention indicating no EOL.
2020-03-20 13:42:28 -05:00
1f8b5fafde
Add OS to 'show eol' and make output easier to parse
2020-03-20 14:57:56 +01:00
38310223a6
Updated date/year
2020-03-20 14:50:25 +01:00
8c0b42cdae
Merge pull request #861 from topimiettinen/enhance-selinux-check
...
Enhance SELinux checks
2020-03-20 14:00:57 +01:00
bf7bd1415b
Merge pull request #867 from topimiettinen/check-dnssec-resolvectl
...
Check DNSSEC status with resolvectl when available
2020-03-20 09:46:40 +01:00
820d2ec607
Check DNSSEC status with resolvectl when available
...
'resolvectl statistics' shows if DNSSEC is supported by
systemd-resolved and upstream DNS servers.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-19 23:56:24 +02:00
fb9cdb5c43
Enhance SELinux checks
...
Display and log: permissive types (rules are not enforced), unconfined
processes (not confined by rules) and processes with initrc_t
type (generic type with weak rules).
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-19 19:45:37 +02:00
ddcf9bc713
[BOOT-5122] check for defined password in all GRUB configuration files
2020-03-19 15:52:03 +01:00
72e8f572bf
Harden mount options for /var, check also /dev and /run
...
There should not be any need for char/block devices in /var, so
propose nodev. Sockets are not affected.
Check also /dev for noexec,nosuid and /run for
nodev,nosuid. Historically there was /dev/MAKEDEV script but that's
long gone.
In case a file system is not found in /etc/fstab, check if they are
mounted otherwise (e.g. via systemd mount units).
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-19 16:39:02 +02:00
6d9ebe4136
Merge pull request #857 from topimiettinen/handle-kernel-img.conf
...
Check if /vmlinuz is missing due to /etc/kernel-img.conf
2020-03-19 15:33:47 +01:00
51d727d611
Merge pull request #858 from topimiettinen/fix-enabled-running-processes
...
Fix logging of running and enabled services
2020-03-19 15:32:54 +01:00
3aaeeea856
Check for rEFInd boot loader
...
Detect rEFInd boot loader (https://www.rodsbooks.com/refind/ ).
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-19 15:44:30 +02:00
80a67914c3
Fix logging of running and enabled services
...
Log lines for running and enabled services were mixed up, fix.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-19 15:25:59 +02:00
f15fbfa6ed
Check if /vmlinuz is missing due to /etc/kernel-img.conf
...
If /etc/kernel-img.conf has the line do_symlinks=No, Debian (probably
also Ubuntu) kernel packages will not update /vmlinuz
etc. symlinks. In that case, guess the kernel from uname -r.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-19 15:16:37 +02:00
671c443641
Merge pull request #845 from maczniak/master
...
[SSH-7408] fix OpenSSH server version check
2020-03-19 11:00:38 +01:00
b523352a59
Merge pull request #830 from Schmuuu/fix/vmlinuz-check
...
restructered test and fixed vmlinuz detection
2020-03-19 10:58:27 +01:00
bc4146555c
[PKGS-7388] Only perform test when all conditions are correct
2020-03-19 10:51:02 +01:00
8a42643373
Merge pull request #822 from pyllyukko/vmlinuz-raspbian
...
KRNL-5788 in Raspi: don't complain about missing /vmlinuz
2020-03-18 11:39:58 +01:00
6a5ea9471e
Merge pull request #828 from gfelkel/patch-1
...
FILE-6310 for HP-UX
2020-03-18 11:35:03 +01:00
6e3e93d585
[PKGS-7388] only perform check for Debian, Mint, Ubuntu
2020-03-17 16:05:14 +01:00
77dd0e0bbe
Merge pull request #853 from deltablot/php
...
Skip the PHP cli configuration file when looking for expose_php
2020-03-17 14:02:51 +01:00
d1db448c51
Skip pacman when it is the game instead of package manager
2020-03-17 13:02:59 +01:00
0b0b0ea905
Style improvement
2020-03-12 16:01:11 +01:00
83a9470b72
Merge pull request #829 from gfelkel/patch-2
...
AUTH-9228 for HP-UX
2020-03-12 15:59:33 +01:00
2f9f25a2bf
Merge pull request #842 from chifu1234/master
...
add basic xbps/void support
2020-03-11 15:53:57 +01:00
efc591c791
Merge pull request #846 from Skactor/patch-2
...
Update tests_shells
2020-03-11 15:52:33 +01:00
73491ec850
Merge pull request #843 from Skactor/patch-1
...
Update tests_ports_packages
2020-03-10 15:21:08 +01:00
Brian Ginsbach
Kristian S
Michael Boelen
Topi Miettinen
Sander
Thomas Sjögren