tyler.durden
/
lynis
mirror of https://github.com/CISOfy/lynis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
3,283 Commits 2 Branches 62 Tags 17 MiB
Commit Graph

2157 Commits

Author SHA1 Message Date
Michael Boelen f644927a42
Improved warning message with 'how to resolve' 2020-03-25 10:11:25 +01:00
Topi Miettinen 339e0c3207
[FILE-6374]: Summarize unhardened file system 
Report total numbers of unhardened filesystems.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-25 09:18:16 +02:00
Michael Boelen 3c8e3b0adb
Merge pull request #862 from topimiettinen/blacklist-fs 
FS module tests: check if modules are blacklisted
 2020-03-24 13:34:05 +01:00
Michael Boelen 3c3feecbfb
Merge pull request #824 from Varbin/master 
Add detection of OpenNTPD
 2020-03-24 13:29:02 +01:00
Michael Boelen f83025a283
Merge pull request #860 from topimiettinen/harden-mount-options 
Harden mount options for /var, check also /dev and /run
 2020-03-24 13:27:50 +01:00
Michael Boelen dbfadc5446
Merge pull request #879 from topimiettinen/enhance-tomoyo-check 
Enhance TOMOYO Linux check
 2020-03-24 13:26:33 +01:00
Michael Boelen 18a570c0b8
Merge pull request #880 from konstruktoid/grphashrounds 
Add test for group password hash rounds
 2020-03-24 13:24:12 +01:00
Thomas Sjögren bc09f921f0 fix indentation 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2020-03-24 11:53:50 +01:00
Thomas Sjögren 0b9e2d85d6 fix tabs 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2020-03-24 11:45:05 +01:00
Thomas Sjögren 5341fa7b29 AUTH-9229 isnt related to login.defs, add AUTH-9230 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
 2020-03-24 11:44:14 +01:00
Topi Miettinen e09fe98b89 Enhance TOMOYO Linux check 
Count and log unconfined processes, which are not using policy
profile 3.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-23 18:44:21 +02:00
Topi Miettinen 0da82a18cb
FS module tests: check if modules are blacklisted 
Check if FS modules are blacklisted.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-23 17:43:53 +02:00
Topi Miettinen 8913374092 Run 'systemd-analyze security' 
'systemd-analyze security' (available since systemd v240) makes a nice
overall evaluation of hardening levels of services in a system. More
details can be found with 'systemd-analyze security SERVICE' for each
service.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-23 17:31:32 +02:00
Michael Boelen 7bba7bd4af
Removed incorrect process name from list, enable --full as it is required for matching jitterentropy-rngd 2020-03-23 16:13:39 +01:00
Michael Boelen dcddfdb6cc
Merge branch 'master' of https://github.com/CISOfy/lynis 2020-03-23 15:56:03 +01:00
Michael Boelen 1e74f9be9a
Fixed 'lynis show details' output 2020-03-23 15:55:40 +01:00
Michael Boelen 8f77116ce7
Merge pull request #876 from topimiettinen/enhance-apparmor-check 
Enhance AppArmor check
 2020-03-23 15:24:52 +01:00
Michael Boelen 7d1fe1231a
[CRYP-8005] added haveged, match against process name instead of full command line, code cleanup 2020-03-23 14:29:47 +01:00
Michael Boelen 1eb9218986
Merge branch 'master' of https://github.com/CISOfy/lynis 2020-03-23 13:19:29 +01:00
Michael Boelen 17bbaa8f7a
[AUTH-9229] make test only available for root 2020-03-23 13:19:10 +01:00
Michael Boelen 32cefdea0a
Merge pull request #878 from topimiettinen/check-ima-evm 
Check IMA/EVM, dm-integrity and dm-verity statuses
 2020-03-23 13:18:16 +01:00
Michael Boelen 122619d01f
Merge pull request #874 from topimiettinen/check-password-hashing-methods 
Check password hashing methods
 2020-03-23 12:49:20 +01:00
Michael Boelen 17ac4d2c1c
[AUTH-9252] corrected permission check 2020-03-23 10:44:45 +01:00
Topi Miettinen 8ea39314f2
Check for dm-integrity and dm-verity 
Detect tools for dm-integrity and dm-verity, check if some devices
in /dev/mapper/* use them and especially the system root device.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-23 10:35:38 +02:00
Michael Boelen 058b071ea2
Merge pull request #877 from bginsbach/auth-9268-add-bsd 
Add FreeBSD and NetBSD to AUTH-9268
 2020-03-22 15:16:09 +01:00
Topi Miettinen 203a4d3480
Check IMA/EVM status 
Check for evmctl (Extended Verification Module) tool and system IMA (Integrity Measurement
Architecture) status.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-22 11:21:52 +02:00
Brian Ginsbach 33ba896b41 Add FreeBSD and NetBSD to AUTH-9268 
Add FreeBSD and NetBSD as both support PAM. Simplify the PREQS_MET
test by using a case rather than a long if or.
 2020-03-21 20:03:37 -05:00
Brian Ginsbach f56c3b5f94 Combine NetBSD and OpenBSD AUTH-9234 check 
Both NetBSD and OpenBSD have `useradd(8)`, so they can share logic
checking `/etc/usermgmt.conf` for the default user UID range.
 2020-03-21 16:16:34 -05:00
Brian Ginsbach 044c78452b Add AUTH-9234 for NetBSD 2020-03-21 16:10:05 -05:00
Topi Miettinen e0e2096a25
Enhance AppArmor check 
Count and log unconfined processes which have no AppArmor profile
applied.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-21 17:14:55 +02:00
Topi Miettinen 26a54991ba
Check for software pseudo random number generators 
Check for running audio-entropyd, havegd or jitterentropy-rngd.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-21 16:26:30 +02:00
Michael Boelen 148e5b5c14
Merge pull request #870 from bginsbach/boot-5260-linux 
Make BOOT-5260 Linux only
 2020-03-21 13:54:21 +01:00
Michael Boelen 1bb35b86b8
Merge pull request #873 from topimiettinen/fix-developer-profile 
Fix developer profile
 2020-03-21 13:50:03 +01:00
Michael Boelen 357b059c12
Merge pull request #871 from bginsbach/fix-find-not 
Fix uses of non-standard find not operator
 2020-03-21 13:43:28 +01:00
Topi Miettinen 4a51ad031b
Check password hashing methods 
Manual page crypt(5) gives recommendations for choosing password
hashing methods, so let's check if there are weakly encrypted
passwords in the system.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-21 12:50:38 +02:00
Topi Miettinen e98fcb9b73
Fix developer profile 
Initialialize a few variables to let --profile developer.prf pass.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-20 22:26:51 +02:00
Brian Ginsbach 9c5451d29d Make BOOT-5260 Linux only 
Linux is the only OS with systemd so no need to check for systemd
single user mode on other operatings systems.
 2020-03-20 14:40:20 -05:00
Brian Ginsbach 32d1155953 Fix uses of non-standard find not operator 
Use ! rather than the non-standard -not find(1) operator.
 2020-03-20 14:37:56 -05:00
Brian Ginsbach 52344913d3 Add a way to signify undetermined EOL 
Replace setting an artificaly high date and converted date for
operating systems with no EOL (rolling) or the EOL is still to
be determined. This makes it easier for humans and saves making
a comparison (when using an artifically high converted time)
will always be false (EOL=0).

An example entry

        os:AGreatOS 2.0:👎

The converted time (seconds since the epoch) could be specified as
zero but this typically means the OS is out of date (now), A value
of -1 is a convention indicating no EOL.
 2020-03-20 13:42:28 -05:00
Michael Boelen 1f8b5fafde
Add OS to 'show eol' and make output easier to parse 2020-03-20 14:57:56 +01:00
Michael Boelen 38310223a6
Updated date/year 2020-03-20 14:50:25 +01:00
Michael Boelen 8c0b42cdae
Merge pull request #861 from topimiettinen/enhance-selinux-check 
Enhance SELinux checks
 2020-03-20 14:00:57 +01:00
Michael Boelen bf7bd1415b
Merge pull request #867 from topimiettinen/check-dnssec-resolvectl 
Check DNSSEC status with resolvectl when available
 2020-03-20 09:46:40 +01:00
Topi Miettinen 820d2ec607
Check DNSSEC status with resolvectl when available 
'resolvectl statistics' shows if DNSSEC is supported by
systemd-resolved and upstream DNS servers.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-19 23:56:24 +02:00
Topi Miettinen fb9cdb5c43
Enhance SELinux checks 
Display and log: permissive types (rules are not enforced), unconfined
processes (not confined by rules) and processes with initrc_t
type (generic type with weak rules).

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-19 19:45:37 +02:00
Michael Boelen ddcf9bc713
[BOOT-5122] check for defined password in all GRUB configuration files 2020-03-19 15:52:03 +01:00
Topi Miettinen 72e8f572bf
Harden mount options for /var, check also /dev and /run 
There should not be any need for char/block devices in /var, so
propose nodev. Sockets are not affected.

Check also /dev for noexec,nosuid and /run for
nodev,nosuid. Historically there was /dev/MAKEDEV script but that's
long gone.

In case a file system is not found in /etc/fstab, check if they are
mounted otherwise (e.g. via systemd mount units).

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-19 16:39:02 +02:00
Michael Boelen 6d9ebe4136
Merge pull request #857 from topimiettinen/handle-kernel-img.conf 
Check if /vmlinuz is missing due to /etc/kernel-img.conf
 2020-03-19 15:33:47 +01:00
Michael Boelen 51d727d611
Merge pull request #858 from topimiettinen/fix-enabled-running-processes 
Fix logging of running and enabled services
 2020-03-19 15:32:54 +01:00
Topi Miettinen 3aaeeea856
Check for rEFInd boot loader 
Detect rEFInd boot loader (https://www.rodsbooks.com/refind/).

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-19 15:44:30 +02:00
Topi Miettinen 80a67914c3
Fix logging of running and enabled services 
Log lines for running and enabled services were mixed up, fix.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-19 15:25:59 +02:00
Topi Miettinen f15fbfa6ed
Check if /vmlinuz is missing due to /etc/kernel-img.conf 
If /etc/kernel-img.conf has the line do_symlinks=No, Debian (probably
also Ubuntu) kernel packages will not update /vmlinuz
etc. symlinks. In that case, guess the kernel from uname -r.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-19 15:16:37 +02:00
Michael Boelen 671c443641
Merge pull request #845 from maczniak/master 
[SSH-7408] fix OpenSSH server version check
 2020-03-19 11:00:38 +01:00
Michael Boelen b523352a59
Merge pull request #830 from Schmuuu/fix/vmlinuz-check 
restructered test and fixed vmlinuz detection
 2020-03-19 10:58:27 +01:00
Michael Boelen bc4146555c
[PKGS-7388] Only perform test when all conditions are correct 2020-03-19 10:51:02 +01:00
Michael Boelen 8a42643373
Merge pull request #822 from pyllyukko/vmlinuz-raspbian 
KRNL-5788 in Raspi: don't complain about missing /vmlinuz
 2020-03-18 11:39:58 +01:00
Michael Boelen 6a5ea9471e
Merge pull request #828 from gfelkel/patch-1 
FILE-6310 for HP-UX
 2020-03-18 11:35:03 +01:00
Michael Boelen 6e3e93d585
[PKGS-7388] only perform check for Debian, Mint, Ubuntu 2020-03-17 16:05:14 +01:00
Michael Boelen 77dd0e0bbe
Merge pull request #853 from deltablot/php 
Skip the PHP cli configuration file when looking for expose_php
 2020-03-17 14:02:51 +01:00
Michael Boelen d1db448c51
Skip pacman when it is the game instead of package manager 2020-03-17 13:02:59 +01:00
Michael Boelen 0b0b0ea905
Style improvement 2020-03-12 16:01:11 +01:00
Michael Boelen 83a9470b72
Merge pull request #829 from gfelkel/patch-2 
AUTH-9228 for HP-UX
 2020-03-12 15:59:33 +01:00
Michael Boelen 2f9f25a2bf
Merge pull request #842 from chifu1234/master 
add basic xbps/void support
 2020-03-11 15:53:57 +01:00
Michael Boelen efc591c791
Merge pull request #846 from Skactor/patch-2 
Update tests_shells
 2020-03-11 15:52:33 +01:00
Michael Boelen 73491ec850
Merge pull request #843 from Skactor/patch-1 
Update tests_ports_packages
 2020-03-10 15:21:08 +01:00
Nicolas CARPi 600cb84310 Use a POSIX implementation to check for substring 
This works with all shells, even busybox.
 2020-03-05 21:42:54 +01:00
Nicolas CARPi 0593c69f2f Skip the PHP cli configuration file when looking for expose_php 
The expose_php configuration option is only relevant for non-cli PHP and
thus lynis should not look for it in config files that are for cli

Fix #849
 2020-03-05 00:53:27 +01:00
Michael Boelen 3f883106c9
Merge pull request #840 from deltablot/ssh 
Remove the test for ssh config VerifyReverseMapping
 2020-03-04 19:36:56 +01:00
Michael Boelen 28bd36d9c6
Added Fedora 2020-03-04 15:09:10 +01:00
Michael Boelen c0158da38e
Corrected test ID 2020-03-04 15:04:54 +01:00
Michael Boelen 5faf69af16
Code enhancement to avoid repetition 2020-03-04 15:02:39 +01:00
Michael Boelen 6e5f638640
Merge pull request #852 from craigcomstock/pureos 
Added detection of PureOS in /etc/os-release
 2020-03-04 14:58:59 +01:00
Michael Boelen e008907ff1
Remove 's' from word 'colours' 2020-03-04 14:51:13 +01:00
Michael Boelen b011b7a8d5
Merge pull request #850 from gcsgithub/soerelease 
Soerelease
 2020-03-04 14:48:19 +01:00
Craig Comstock 22ceeaa926
Added detection of PureOS in /etc/os-release 2020-03-03 13:56:33 -06:00
Mark Garrett 0cd256372c fix whitespace 2020-03-01 10:31:52 +11:00
Mark Garrett b2f676da7b allow for correct spelling for colour should drop the s from colours but didnt 2020-03-01 10:19:33 +11:00
Mark Garrett 30b1e4170b macosx add Catalina 10.15 2020-03-01 10:18:33 +11:00
Skactor fc7c5fb723
Update tests_shells 
Write function as variable due to careless error
 2020-02-25 15:48:55 +08:00
maczniak d8a3bc8afa fix CISOfy/lynis#844 2020-02-24 23:17:09 +09:00
Skactor 35e568e695
Update tests_ports_packages 
Incorrect constant name spelling
 2020-02-24 20:44:05 +08:00
Kevin 42b2831f75 add basic xbps/void support 2020-02-21 08:06:24 +01:00
Nicolas CARPi 91ad10d464 Remove the test for ssh config VerifyReverseMapping 
This option is deprecated since 2003. Having it in a config file raises
a warning and UseDNS (that is on by default) includes the
VerifyReverseMapping check.

See
3a961dc0d3

See #528
 2020-02-18 22:19:45 +01:00
Michael Boelen 3bbe34ea73
[CRYP-8004] enhanced after pulling in initital test 2020-02-15 14:09:56 +01:00
Michael Boelen 5ca8baf7a8
[USB-2000] improved testing for USB devices and filtering out possible incorrect state 2020-02-15 14:09:23 +01:00
Michael Boelen af70303aeb
Set preferred option to skip plugin executiont o --no-plugins, as that is more in line with the other 'no' options 2020-02-14 11:49:32 +01:00
Michael Boelen 3f834e6ad5
Merge pull request #821 from pyllyukko/CRYP-8004 
Added CRYP-8004
 2020-02-13 13:40:10 +01:00
Sascha Holzleiter 530ad1ef75 NETW-3014: Report correct promisc interface 2020-01-28 21:29:34 +01:00
Kristian Schuster 79a29381a4
restructered test and fixed vmlinuz detection 2020-01-26 19:13:26 +01:00
gfelkel 5bce9d598c
AUTH-9228 for HP-UX 
HP-UX also has /usr/sbin/pwck. For trusted systems, two additional options -s (check inconsistencies with the protected password database) and -l (check encrypted password lengths that are greater than 8 characters) are available.
 2020-01-23 13:30:46 +01:00
gfelkel d3287bd7ef
FILE-6310 for HP-UX 
HP-UX: /usr/sbin/mount reports "/home on /dev/…", so $1 has to be used
 2020-01-22 16:31:49 +01:00
Michael Boelen a7b48e40b0
[NETW-3015] check for promiscuity value that is higher than 0 instead of just 1 2020-01-11 11:31:40 +01:00
Michael Boelen 232b1cdc3f
[KRNL-5820] allow dash to define hard/soft value 2020-01-11 11:27:37 +01:00
Simon Biewald c58e296bd3
add openntpd detection and a few tests for it 2020-01-08 18:53:15 +01:00
pyllyukko 618a843017
KRNL-5788 in Raspi: don't complain about missing /vmlinuz 
The Raspberry Pi kernels reside within raspberrypi-kernel package[1].

[1] https://www.raspberrypi.org/documentation/linux/kernel/updating.md
 2020-01-07 22:27:27 +02:00
pyllyukko 40acdc111d
Added CRYP-8004 2020-01-06 21:22:00 +02:00
Michael Boelen b7da40c6ae
[KRNL-5830] derive kernel version from filename after obtaining symlink target 2019-12-23 15:41:26 +01:00
Michael Boelen ab4291242d
[KRNL-5830] check for symlink 2019-12-23 15:36:26 +01:00
Michael Boelen e5091772c5
Removed -o which had no purpose 2019-12-23 13:59:06 +01:00
Michael Boelen 35d248b74c
[FILE-6430] minor code improvements and show suggestion with more details 2019-12-18 19:20:48 +01:00
Michael Boelen cb59e92441
[MALW-3280] Added support for falcon-sensor by CrowdStrike 2019-12-18 12:22:51 +01:00
Michael Boelen 09f29a5e64
Code style improvement: quote argument 2019-12-18 12:17:46 +01:00
Michael Boelen 94ba30e765
[INSE-8050] corrected function call for showing suggestion 2019-12-18 12:04:32 +01:00
Michael Boelen c4b24c48a9
[INSE-8314] changed text of suggestion 2019-12-18 12:01:32 +01:00
Michael Boelen 2dfb901bcb
[PKGS-7410] Use multiple package managers when they are available on system. Also added support for Zypper for this test 2019-12-17 08:23:12 +01:00
Michael Boelen 11f8ce2361
[KRNL-5830] Use symlink, only test for 'version' keyword if needed, adjusted exception message 2019-12-17 08:03:51 +01:00
Michael Boelen 4e255617d3
[KRNL-5830] Fetch target for symlinked kernel 2019-12-16 09:47:40 +01:00
Michael Boelen d680fe549f
Switched from warnings to suggestions, corrected path selection for DIR variable 2019-12-13 12:59:43 +01:00
Michael Boelen f35a08ad28
Quoting should not be used when globbing 2019-12-13 12:40:29 +01:00
Michael Boelen 1b4b02d813
Decrease length of line breaks between tests 2019-12-13 12:36:19 +01:00
Michael Boelen bf4374bb19
[KRNL-5830] skip test partially if non-privileged 2019-12-13 12:35:38 +01:00
Michael Boelen fd84be485b
Improved permission check for BSD systems 2019-12-13 12:34:56 +01:00
Michael Boelen f00447fd1b
Style change, add curly brackets 2019-12-06 15:55:59 +01:00
Michael Boelen c7c44535e7
Merge pull request #800 from Schmuuu/core/fix-relative-path-detection 
don't fail relative paths check with spaces in PATH
 2019-12-06 15:39:55 +01:00
Michael Boelen 24c5a9fcea
Merge branch 'master' into master 2019-12-06 15:35:46 +01:00
Michael Boelen 6421c2e419
[BANN-7126] additional words for login banner are accepted 2019-12-06 09:49:06 +01:00
Michael Boelen 15ae5ea0c1
Added alias --use-cwd as that is more in line with other options (instead of --usecwd) 2019-12-04 08:01:56 +01:00
Michael Boelen c67696455f
Merge pull request #797 from Schmuuu/KRNL-5840/find-more-kernels 
KRNL-5840: add detection for proxmox and raspi kernel
 2019-12-03 14:32:52 +01:00
Michael Boelen 3e9902b35e
Merge pull request #798 from Schmuuu/OS-detection/detect-raspbian 
OS-Detection: add raspian detection
 2019-11-28 15:42:45 +01:00
Michael Boelen dd2cb31c7f
Merge pull request #799 from Schmuuu/ntp/set-NTP_CONFIG_FOUND 
do set variable NTP_CONFIG_FOUND if ntp config is found
 2019-11-28 15:05:01 +01:00
Michael Boelen ea03723093
Merge pull request #803 from dvehrs/PermTests 
Updated tests for file permissions to case statements
 2019-11-25 15:32:06 +01:00
Michael Boelen cad55d8bec
Merge pull request #802 from dvehrs/HCFP 
Updated permissions checks
 2019-11-25 15:28:00 +01:00
Michael Boelen 65f88e148b
Merge pull request #804 from Schmuuu/krnl/fix-wrong-limits-subfolder 
fix left over test folder with correct folder from variable
 2019-11-25 15:23:47 +01:00
Michael Boelen 35ca01eaac
Merge pull request #805 from Schmuuu/tests_php/add_some_php72_and_php73_support 
added additional php folders to check, plus added PHP72 and PHP73
 2019-11-25 15:23:11 +01:00
Michael Boelen f81ff3d7d6
Removed empty lines 2019-11-18 10:20:31 +01:00
Michael Boelen ffc9309338
Merge branch 'master' of https://github.com/CISOfy/lynis 2019-11-18 10:19:58 +01:00
Michael Boelen a07fcb3348
Add USR1 trap to show status such as active test 2019-11-18 10:19:43 +01:00
Michael Boelen 421b42c5b0
Merge pull request #809 from Marzal/master 
First fix in order make lynis work OK in AIX
 2019-11-13 11:21:43 +01:00
Michael Boelen 6d594b899f
Merge pull request #810 from neilmayhew/fix/773-home-9306 
Fix for false positive for some users on HOME-9306
 2019-11-13 11:18:04 +01:00
fbomj 2b8f761efa MALW-3280: Kaspersky detection 2019-11-06 21:49:54 +01:00
János Márkus d9013b13ac Fixes CISOfy/lynis#773 2019-11-03 11:48:03 +01:00
Neil Mayhew 9de8227674 Fix for false positive for some users on HOME-9306 
Closes #773

Patch from @church1e
 2019-11-01 18:12:33 -06:00
Marzal 8353483d1d grep doesn't work with '\|' in AIX. grep -E is more POSIX compliant. 2019-10-29 18:47:07 +01:00
Kristian Schuster d97221b851
added additional php folders to check, plus added PHP72 and PHP73 2019-10-24 00:14:42 +02:00
Kristian Schuster 32ee016810
fix: forgot to replace test folder with correct folder from variable 2019-10-23 23:06:03 +02:00
Dave Vehrs e6bf111f41 Updated tests for file permissions to case statements 2019-10-23 14:47:03 -06:00
Dave Vehrs 6dad2f476e Updated permissions checks 2019-10-23 12:31:20 -06:00
Kristian Schuster 4898e48e16
don't fail relative paths check with spaces in PATH 2019-10-22 21:43:37 +02:00
Kristian Schuster 62feaf3fff
do set variable NTP_CONFIG_FOUND if ntp config is found 2019-10-22 20:07:56 +02:00
Kristian Schuster 66a754fa18
OS-Detection: add raspian detection 2019-10-20 20:21:54 +02:00
Kristian Schuster ace2e27237
KRNL-5840: add detection for proxmox and raspi kernel 2019-10-20 19:55:34 +02:00
Kristian Schuster 62419033f5
fix for #781 - run lsblk without --paths 2019-10-19 00:34:25 +02:00
Michael Boelen c16133b255
Merge pull request #772 from Marzal/Marzal-test_storage 
Clean shellcheck warnings in STRG-1846
 2019-10-16 14:49:46 +02:00
Kristian Schuster 4eeb2899cc
add missing variables and replace '\s' to be posix conform 2019-10-15 21:52:53 +02:00
Michael Boelen 7932daca8f
Merge pull request #784 from Schmuuu/krnl/disabled-coredumps-detection 
KRNL-5820: add checks for disabled coredumps in systemd & etc/profile
 2019-10-15 16:06:44 +02:00
Michael Boelen 7ce61bb5dd
Merge pull request #778 from pyllyukko/SINT-7010-MacOS 
Test SINT-7010 in macOS only
 2019-10-15 15:43:26 +02:00
Michael Boelen 6c3fc531ec
Merge pull request #779 from pyllyukko/gradm-stderr 
Redirect gradm stderr to /dev/null
 2019-10-15 15:42:08 +02:00
Michael Boelen fda0d3cf4a
Merge pull request #770 from Schmuuu/master 
nginx-test: add log file detection for relative paths
 2019-10-15 15:40:30 +02:00
Michael Boelen 1f4092d8e0
Merge pull request #777 from pyllyukko/osdetection-slackware 
Slackware Linux OS detection
 2019-10-15 15:36:31 +02:00
Katarina Durechova 4bb78d721e Databases - variables initialization 2019-10-14 21:50:22 +02:00
Kristian Schuster 3bc70b425e
fix old limits check not working in a few cases 2019-10-13 23:08:19 +02:00
Kristian Schuster 7b52ff52c7
add check for disabled coredumps in etc/profile and systemd 2019-10-13 22:06:50 +02:00
pyllyukko b771437cd0
Redirect gradm stderr to /dev/null 
If the tool exists but the kernel doesn't have grsec, you'll get the
following error into stderr:

Could not open /dev/grsec.
open: No such file or directory
 2019-10-08 20:52:55 +03:00
pyllyukko c88953a815
Test SINT-7010 in macOS only 2019-10-08 20:31:35 +03:00
pyllyukko 52cef0ed87
Slackware Linux OS detection 2019-10-08 20:19:30 +03:00
Michael Boelen 52e1231433
Additional check to ensure pacman package manager is used instead of pacman game 2019-10-08 16:43:09 +02:00
Michael Boelen 87f5596952
Added new test DBS-1828 2019-10-08 15:15:18 +02:00
Michael Boelen f188bac7e8
Update description for FILE-6374 2019-10-08 15:10:02 +02:00
Marzal f77e56ed4b Prefer [ p ] && [ q ] as [ p -a q ] is not well defined. SC2166 2019-09-29 21:17:52 +02:00
Marzal a052a107d3 SC2086 2019-09-29 21:15:29 +02:00
Marzal 7d430d5abc rephrasing comment to avioid false positive in lynis-sdk 2019-09-29 21:13:47 +02:00
Kristian Schuster 51d3c56842
crypto-test: suppress errors when devs are not accessible for cryptsetup 2019-09-29 17:44:15 +02:00
Kristian Schuster 001cd85183
kernel-test: additional improvements for required reboot detection 2019-09-29 17:42:07 +02:00
Kristian Schuster 364b770c64
kernel-test: determine reboot requirement for more distros. Plus a few fixes 2019-09-28 00:39:12 +02:00
Kristian Schuster b38031803d
kernel-test: avoid grep errors if etc/security/limits.d does not exist 2019-09-27 00:07:45 +02:00
Kristian Schuster 07084501b6
kernel-test: add linux-lts detection for arch 2019-09-26 23:26:08 +02:00
Kristian Schuster d17d30d6a7
nginx-test: add log file detection for relative paths 2019-09-26 21:24:15 +02:00
Michael Boelen e64e49a551
Merge pull request #763 from Marzal/Marzal-F_isRunning 
Second version of #740 without shellcheck directives
 2019-09-22 15:07:53 +02:00
Michael Boelen a1b6d463b2
Fixed a typo 2019-09-21 16:31:06 +02:00
Michael Boelen 2c32e8e04d
Merge pull request #765 from Marzal/Marzal-AUTH-9282 
Fix auth-9282
 2019-09-21 15:49:58 +02:00
Michael Boelen ca1d7ace1d
Merge branch 'master' of https://github.com/CISOfy/lynis 2019-09-21 10:10:09 +02:00
Mike Robinson 8088d0ab77
Update tests_ldap 
Check was backwards
 2019-09-19 18:14:06 -06:00
Marzal 0e1e80bacf Double quote to prevent globbing and word splitting.SC2086 2019-09-19 23:36:36 +02:00
Marzal 42ac40aad6 Change variable name from FIND to FIND_P so is not reset by Register 2019-09-19 23:33:19 +02:00
Marzal ddd87371b5 Double quote to prevent globbing and word splitting.SC2086 Info 2019-09-19 20:01:31 +02:00
Marzal 09a60783a6 Prefer [ p ] && [ q ] as [ p -a q ] is not well defined.SC2166 2019-09-19 20:00:12 +02:00
Michael Boelen e48df09c4c
Fixed typo found by SDK 2019-09-19 19:10:13 +02:00
Michael Boelen 187016a051
Changed spacing 2019-09-19 15:23:37 +02:00
Michael Boelen c0f9c0ab84
Style and log improvements 2019-09-19 14:34:06 +02:00
Michael Boelen f389cc5d99
Merge pull request #761 from Schmuuu/master 
enhance nginx include config detection …
 2019-09-19 14:21:32 +02:00
Michael Boelen 36627a4eb7
Style improvements 2019-09-19 14:05:15 +02:00
Kristian Schuster ccb8b2b615
enhance nginx config detection to correctly include confs via relative path and wildcards 2019-09-18 20:47:09 +02:00
Michael Boelen 6cf0b28f2c
Bugfix: line had double print with incorrect quote 2019-09-17 20:13:14 +02:00
Michael Boelen 98017c78ca
Implemented several code style improvements 2019-09-17 14:04:30 +02:00
Michael Boelen 95e9e80834
Moved function 2019-09-14 13:23:28 +02:00
Michael Boelen 13a4dff7fe
Improved logging of HasCorrectFilePermissions function and use correct value when data has a value of zero 2019-09-14 13:22:50 +02:00
Michael Boelen 5c38a0bdb4
Tests using lsof may ignore threads (if supported) 2019-09-13 11:47:39 +02:00
Michael Boelen ca0239b4d9
[FILE-6374] corrected defaults flag, added root directory, and changed logging 2019-09-12 16:34:45 +02:00
Michael Boelen 79e5b52419
[SSH-7408] added forced-commands-only 2019-09-12 11:17:18 +02:00
Michael Boelen fa9fdd4322
[MAIL-8804] replaced static strings with translation-aware strings 2019-09-12 11:13:39 +02:00
lowkey 0fc887e830 Removed WARNINGs from unset certificate and private key 2019-09-11 10:47:28 -06:00
Michael Boelen fbcfab1adc
[LOGG-2154] support new-style rsyslog configuration for remote targets 2019-09-10 14:52:20 +02:00
Michael Boelen 9041517e2a
Added Debian and standardized others 2019-09-03 10:06:26 +02:00
Michael Boelen 0d58ee77a0
[CRYP-7930] replaced incorrect PATH column with alternative 2019-09-02 19:20:16 +02:00
Michael Boelen a87c2b10f9
Added CRYP-8002 2019-08-29 10:39:43 +02:00
Michael Boelen 4932ab8351
Disabled suggestion for now, as some people will just install a suggested tool to comply instead of determining if it really makes sense. So this suggestion requires more explanation before people turning it on. Also, promisc mode may be impacted, so users see a new issue show up while they just resolved another. 2019-08-28 15:43:10 +02:00
Michael Boelen 61404c1bf3
[TOOL-5160] added support for OSSEC agent daemon 2019-08-28 15:36:59 +02:00
Michael Boelen 7469b4aa72
[CONT-8106] support for newer 'docker info' output that includes additional space 2019-08-26 20:27:00 +02:00
Michael Boelen f89aa98408
Added FINT-4316 2019-08-26 08:02:11 +02:00
Michael Boelen 22a7f4fd6d
Combine multiple unsets into a single command 2019-08-26 08:01:43 +02:00
Michael Boelen d703d160ff
Added RHEL, renamed CentOS Linux name, reordered items 2019-08-22 14:20:30 +02:00
Michael Boelen d2deb63ebb
Added NETW-3200 2019-08-22 14:12:53 +02:00
Michael Boelen a72650252f
When audit target is missing, stop execution 2019-08-22 14:11:22 +02:00
Michael Boelen 2c4e7711db
Added CentOS and trigger an exception when a system has /etc/os-release but is not defined yet 2019-08-21 14:51:20 +02:00
Michael Boelen 4e39bafd78
New function to display exceptions 2019-08-21 14:50:32 +02:00
Michael Boelen 605e515c31
Updated forensics variable 2019-08-21 14:00:20 +02:00
Michael Boelen 65f1a5e811
Added initial support for DevOps mode to improve continuous integration 2019-08-21 13:59:28 +02:00
Michael Boelen d395e1a2da
[CRYP-7930] extend test to use cryptsetup/lsblk or crypttab file 2019-08-21 13:50:01 +02:00
Michael Boelen 3db7a3b944
Move -c also to list of deprecated items 2019-08-21 13:48:36 +02:00
Michael Boelen ee18e76e97
Preparations for forensics scan mode 2019-08-21 13:41:23 +02:00
Michael Boelen a714568842
Merge pull request #731 from chr0mag/cryp-7930 
[CRYP-7930] Modify to use 'lsblk' and 'cryptsetup'
 2019-08-21 12:31:36 +02:00
Michael Boelen 7dfd580320
Only escape backslash, question mark is not needed 2019-08-20 16:22:00 +02:00
Michael Boelen 8a7f8038b5
Do not show a tool tip if quiet option is used 2019-08-20 16:01:10 +02:00
Michael Boelen 32a895c843
Do not use find command when busybox is used 2019-08-20 15:57:04 +02:00
Michael Boelen e685182b18
Put in fail-safe options for systems using AIX or busybox 2019-08-20 14:49:34 +02:00
Michael Boelen a310c43176
Set hyphen as last character to allow it being matched 2019-08-20 14:24:06 +02:00
Michael Boelen e7d6aaa44d
Stop execution if unexpected characters were found. Also move hyphen to end to list, otherwise it may not work as a matchin character 2019-08-20 14:17:05 +02:00
Michael Boelen 3407a1dbe6
[FILE-7524] optimized test with new function and changed warning to suggestion 2019-08-17 16:49:11 +02:00
Michael Boelen 0a3f42afbc
New function HasCorrectFilePermissions 2019-08-17 16:48:46 +02:00
Yoni Weill 6164b41836 [HOME-9306] s/git-shell/git 2019-08-15 13:27:59 +03:00
Yoni Weill 8c3417dcc2 [HOME-9304] s/git-shell/git 2019-08-15 13:27:19 +03:00
Michael Boelen a4f13a8ab2
Only do Amazon Linux version detection if /etc/os-release does not exist 2019-08-13 22:09:06 +02:00
Michael Boelen e5b8047133
Added data and detection of Amazon Linux 2019-08-13 22:00:30 +02:00
Michael Boelen 914f343635
Corrected variable 2019-08-13 21:00:43 +02:00
Michael Boelen 2af2d0a895
[HOME-9306] Added git-shell to ignore list 2019-08-13 20:05:09 +02:00
Michael Boelen 368989d5c4
[HOME-9304] Added git-shell to ignore list 2019-08-13 20:04:14 +02:00
Michael Boelen 1930dbe6c2
Added support for pacman 2019-08-13 20:02:49 +02:00
Michael Boelen 3006b8dd26
[AUTH-9408] both backslash and brackets needs to be individually escaped 2019-08-08 15:05:23 +02:00
Michael Boelen fdc2977575
[AUTH-9408] corrected description 2019-08-08 13:28:17 +02:00
Michael Boelen b9fa5bce14
Added more text output for data uploads 2019-08-08 12:38:25 +02:00
Michael Boelen c86e24fced
Added missing $ 2019-08-08 12:10:30 +02:00
Michael Boelen f76cf70651
Missing } 2019-08-04 19:40:02 +02:00
Michael Boelen 48ba463376
Added support for swupd (Clear Linux OS) 2019-08-04 19:37:55 +02:00
Michael Boelen 04d2cb838b
Test for presence of /etc/hosts (e.g. Clear Linux OS), changed screen and log output 2019-08-04 19:20:16 +02:00
Michael Boelen d3355937a4
Don't quote in for loop to prevent glueing individual lines together 2019-08-04 19:19:12 +02:00
Michael Boelen f2b385fbf7
Initial support for Clear Linux OS 2019-08-04 19:18:16 +02:00
Michael Boelen da055ae0aa
More standardization of text and adding deprecated functions for transition period 2019-08-01 14:59:03 +02:00
David Marzal 28801e7ad7 Clean up of not used legacy functions and not used broken functions 2019-07-31 22:29:26 +02:00
Michael Boelen 3ea66d4298
[LOGG-2154] corrected output of files in /etc/rsyslog.d directory 2019-07-31 08:17:15 +02:00
Michael Boelen 4b77e27495
Reversed if/then to show correct status of minilogd 2019-07-31 08:03:21 +02:00
David Marzal 000838b154 Document --usecwd in helper_show and man 2019-07-29 15:22:48 +02:00
Michael Boelen 429ad46649
[LOGG-2154] added support for rsyslog configurations 2019-07-26 20:07:14 +02:00
Michael Boelen fa064a824b
[FINT-4334] improved process detection for lfd 2019-07-26 16:14:26 +02:00
Michael Boelen 9605f0fa80
Combined sort and uniq to sort -u 2019-07-26 15:34:02 +02:00
Michael Boelen 7f1742fc54
Replaced direct calls to tools 2019-07-26 14:14:54 +02:00
Michael Boelen 1c79357526
Merge pull request #720 from dvehrs/exim4 
Added certificate tests for Exim
 2019-07-26 14:07:39 +02:00
Michael Boelen 3af72e41c7
Improved selection of home directories for normal users in HOME-9304 and HOME-9306 2019-07-26 11:59:03 +02:00
Michael Boelen 2ec0268692
Merge pull request #732 from Marzal/Marzal-FILE-7524 
Changes for new profile format
 2019-07-26 11:33:38 +02:00
Michael Boelen 17137408d2
Use IsRunning exit code instead of variable 2019-07-26 11:32:48 +02:00
Michael Boelen 8321b98689
[AUTH-9408] double escape to prevent error message (awk: warning: escape sequence '\[' treated as plain '[') 2019-07-26 11:11:03 +02:00
Michael Boelen b7fb98a47f
[AUTH-9266] skip .pam-old files in /etc/pam.d (used by Ubuntu) 2019-07-26 10:57:44 +02:00
Michael Boelen d621355b7e
Set variable instead of using return, otherwise other parameters won't be checked 2019-07-26 09:00:47 +02:00
Michael Boelen b384fa2887
New option: --usecwd to run from current working directory 2019-07-25 11:34:58 +02:00
David b8a0190e82
Fix grep in PROFILEVALUE 
Make it work with new profile format
 2019-07-18 18:58:11 +02:00
David 4d5a0c59c7
Fix find fields in new profile format 
New format uses permfile= so it needs a new cut to filter the name file
 2019-07-18 18:52:36 +02:00
Michael Boelen d6cce1cd08
Test if profiles provided using the command line are readable 2019-07-18 11:54:11 +02:00
Michael Boelen dcd829076b
Move this check to the DiscoverProfiles function 2019-07-18 11:48:00 +02:00
Michael Boelen 4b0f5517f7
Textual change 2019-07-18 11:47:24 +02:00
Michael Boelen b53b894f33
Added file check when a profile is provided 2019-07-18 11:42:26 +02:00
Michael Boelen b7f7179f1e
Moved variables 2019-07-18 11:42:01 +02:00
Michael Boelen 0e9e0fab36
Merge pull request #730 from Marzal/Marzal-PRIVILEGED 
Fix $privileged var being overwrite
 2019-07-18 11:36:47 +02:00
Michael Boelen 87fef1c27b
Merge pull request #729 from Marzal/Marzal-strictmode 
strictmode fixes
 2019-07-18 11:36:23 +02:00
Michael Boelen 63043b536d
[AUTH-9408] added support for pam_tally2 to log failed logins 2019-07-18 11:33:28 +02:00
Julian Phillips e293af16aa Add FOUND var to unset list 2019-07-17 18:01:44 -07:00
Julian Phillips 84dd024887 [CRYP-7930] Modify to use 'lsblk' and 'cryptsetup' 
There are several challenges with the existing method of using
/etc/crypttab:

1)encrypted rootfs partitions are not typically listed in this
file (users are prompted for password in early boot instead)

2)the 'luks' option is the default option so it is possible for
/etc/crypttab entries to never have this set explicitly and any
block device configured as such will be missed currently

3)any device mounted manually, or using any other mechanism aside
from /etc/crypttab will be missed

This commit executes 'cryptsetup isLuks' on every block device in
the system to determine whether it is a LUKS device. This handles
all 3 cases mentioned above.

Test case wording was also updated to reflect the fact that it
only checks for LUKS entrypted block devices. So, plain dm-crypt
and TrueCrypt/VeraCrypt block device encryption is not detected.
Nor is any file system level encryption such as eCryptfs, EncFs,
gocryptfs.
 2019-07-17 16:18:12 -07:00
David d1cb74e7d9
Delete PRIVILEGED var from this file 
if PRIVILEGED is set in the file, it will overwrite the value in the main program always to 0.
This change depends in the other commit that set the variable in both cases.
 2019-07-17 23:28:51 +02:00
David 06413994cf
Initialize some vars to allow strict mode to work 
IsRunning():
To check if $users is empty in strict mode we need the var to be initializez

ReportException:
Some test call this function without the second parameter, this is not allowed in strict mode if we don't initialize the variable
 2019-07-17 23:16:47 +02:00
David 250fb965d3
Strict mode needs this vars initialized 2019-07-17 23:08:20 +02:00
Michael Boelen a4d15f77b5
Differentiate between a discovered binary and running process 2019-07-16 19:10:04 +02:00
Michael Boelen 9e56706aa6
Formatting and improved logging 2019-07-16 19:06:31 +02:00
Michael Boelen 2bd1b1b590
Format change 2019-07-16 19:05:28 +02:00
Michael Boelen d696d521c1
Extended IsRunning function to allow for searching by a combination of process name and user. 2019-07-16 19:04:53 +02:00
Michael Boelen 5869fa4eb1
[INSE-8050] added com.apple.ftp-proxy and improved text output 2019-07-16 14:35:00 +02:00
Michael Boelen a2c57e0b75
Added missing 'then' 2019-07-16 13:21:32 +02:00
Michael Boelen fa8bad20db
Use -n instead of ! -z 2019-07-16 13:20:30 +02:00
Michael Boelen a12aaa2d3a
Added quotes 2019-07-16 13:13:15 +02:00
Michael Boelen 2e192788bb
Added new tests INSE-8318 and INSE-8320 2019-07-16 13:12:17 +02:00
Michael Boelen f8564f2923
[STRG-1840] renamed to USB-1000 2019-07-15 20:04:38 +02:00
Michael Boelen 52610e1abe
[STRG-1842] renamed to USB-2000 2019-07-15 20:00:14 +02:00
Michael Boelen 7ec81715aa
Minor cleanup 2019-07-15 19:57:23 +02:00
Michael Boelen 08cbc6fe2e
Merge pull request #680 from Capashenn/patch_12 
fix issue #610 STRG-1842
 2019-07-15 19:53:33 +02:00
Michael Boelen 455fc26bf7
Small code enhancements 2019-07-15 19:39:04 +02:00
Michael Boelen 2e7c6c7816
[FINT-4328] correct text in log 2019-07-15 19:34:37 +02:00
Michael Boelen c1cf106d03
Show location for Lynis package and new documentation 2019-07-15 19:05:57 +02:00
Michael Boelen 7728213ac4
Merge branch 'master' into docu 2019-07-15 18:55:10 +02:00
Michael Boelen c074c81897
Initial work on GetReportData function 2019-07-14 15:12:25 +02:00
Michael Boelen ced78b52b0
Small markup changes 2019-07-14 15:11:45 +02:00
Michael Boelen 591bc05f4d
[SSH-7408] changed text in suggestion and report 2019-07-14 14:43:35 +02:00
Michael Boelen dbc6f9bc4c
[SCHD-7702] removed hardening points 2019-07-14 13:40:55 +02:00
Michael Boelen b025b3301a
Define relative or absolute path, depending on directory/file or being a binary 2019-07-14 13:36:45 +02:00
Michael Boelen 1df9630bcf
Merge pull request #676 from Capashenn/patch_8 
fix issue #659
 2019-07-14 13:30:16 +02:00
Michael Boelen 4b68c22f30
Use relative paths 2019-07-14 13:27:08 +02:00
David 8400849c58
Add missing commands to show command helper 
configure,generate,update,upload-only
 2019-07-14 13:26:03 +02:00
Michael Boelen 9ebddf0e0c
Merge pull request #675 from Capashenn/patch_7 
fix issues #666 #667
 2019-07-14 13:21:40 +02:00
Michael Boelen ceb9ea193d
Renamed INSE-8342 to INSE-8304 2019-07-14 13:16:48 +02:00
Michael Boelen 93e311e52e
Added INSE-8314 and INSE-8316 for NIS client and server 2019-07-14 13:13:02 +02:00
Michael Boelen 3f04235353
[INSE-8116] added rsync service 2019-07-14 13:06:23 +02:00
Michael Boelen 96434508d4
Disable testing for other tools, as xxd is not present on all systems by default 2019-07-14 12:18:22 +02:00
Michael Boelen ba32b1a001
Use xxd or hexdump, depending on OS 2019-07-14 12:18:05 +02:00
Michael Boelen 4829ae9722
Long format for od does not exist on BSD 2019-07-14 11:57:44 +02:00