#!/bin/sh ################################################################################# # # Lynis # ------------------ # # Copyright 2007-2015, Michael Boelen (michael.boelen@cisofy.com), The Netherlands # Web site: http://cisofy.com # # Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are # welcome to redistribute it under the terms of the GNU General Public License. # See LICENSE file for usage of this software. # ################################################################################# # # Malware scanners # ################################################################################# # InsertSection "Software: Malware scanners" # ################################################################################# # CLAMD_RUNNING=0 MALWARE_SCANNER_INSTALLED=0 # ################################################################################# # # Test : MALW-3275 # Description : Check for installed tool (chkrootkit) Register --test-no MALW-3275 --weight L --network NO --description "Check for chkrootkit" if [ ${SKIPTEST} -eq 0 ]; then logtext "Test: checking presence chkrootkit" if [ ! "${CHKROOTKITBINARY}" = "" ]; then Display --indent 2 --text "- Checking chkrootkit" --result "FOUND" --color GREEN logtext "Result: Found ${CHKROOTKITBINARY}" MALWARE_SCANNER_INSTALLED=1 AddHP 2 2 else logtext "Result: chkrootkit not found" fi fi # ################################################################################# # # Test : MALW-3276 # Description : Check for installed tool (Rootkit Hunter) Register --test-no MALW-3276 --weight L --network NO --description "Check for Rootkit Hunter" if [ ${SKIPTEST} -eq 0 ]; then logtext "Test: checking presence Rootkit Hunter" if [ ! "${RKHUNTERBINARY}" = "" ]; then Display --indent 2 --text "- Checking Rootkit Hunter" --result "FOUND" --color GREEN logtext "Result: Found ${RKHUNTERBINARY}" MALWARE_SCANNER_INSTALLED=1 AddHP 2 2 else logtext "Result: Rootkit Hunter not found" fi fi # ################################################################################# # # Test : MALW-3280 # Description : Check if an anti-virus tool is installed Register --test-no MALW-3280 --weight L --network NO --description "Check for clamscan" if [ ${SKIPTEST} -eq 0 ]; then FOUND=0 MCAFEE_RUNNING=0 logtext "Test: checking process cma or cmdagent (McAfee)" # cma is too generic to match on, so we want to ensure that it is related to McAfee first if [ -x /opt/McAfee/cma/bin/cma ]; then IsRunning cma if [ ${RUNNING} -eq 1 ]; then MCAFEE_RUNNING=1; fi else IsRunning cmdagent if [ ${RUNNING} -eq 1 ]; then MCAFEE_RUNNING=1; fi fi if [ ${MCAFEE_RUNNING} -eq 1 ]; then FOUND=1 Display --indent 2 --text "- Checking McAfee" --result "FOUND" --color GREEN logtext "Result: Found McAfee" MALWARE_SCANNER_INSTALLED=1 AddHP 2 2 fi logtext "Test: checking process SophosScanD" IsRunning SophosScanD if [ ${RUNNING} -eq 1 ]; then FOUND=1 Display --indent 2 --text "- Checking Sophos" --result "FOUND" --color GREEN logtext "Result: Found Sophos" MALWARE_SCANNER_INSTALLED=1 AddHP 2 2 fi if [ ${FOUND} -eq 0 ]; then logtext "Result: no commercial anti-virus tool found" AddHP 0 3 fi fi # ################################################################################# # # Test : MALW-3282 # Description : Check if clamscan is installed Register --test-no MALW-3282 --weight L --network NO --description "Check for clamscan" if [ ${SKIPTEST} -eq 0 ]; then logtext "Test: checking presence clamscan" if [ ! "${CLAMSCANBINARY}" = "" ]; then Display --indent 2 --text "- Checking ClamAV scanner" --result "FOUND" --color GREEN logtext "Result: Found ${CLAMSCANBINARY}" MALWARE_SCANNER_INSTALLED=1 AddHP 2 2 else logtext "Result: clamscan couldn't be found" fi fi # ################################################################################# # # Test : MALW-3284 # Description : Check running clamd process Register --test-no MALW-3284 --weight L --network NO --description "Check for clamd" if [ ${SKIPTEST} -eq 0 ]; then logtext "Test: checking running ClamAV daemon (clamd)" IsRunning clamd if [ ${RUNNING} -eq 1 ]; then Display --indent 2 --text "- Checking ClamAV daemon" --result "FOUND" --color GREEN logtext "Result: found running clamd process" MALWARE_SCANNER_INSTALLED=1 CLAMD_RUNNING=1 else logtext "Result: clamd not running" fi fi # ################################################################################# # # Test : MALW-3286 # Description : Check running freshclam if clamd process is running if [ ${CLAMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi Register --test-no MALW-3286 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check for freshclam" if [ ${SKIPTEST} -eq 0 ]; then logtext "Test: checking running freshclam daemon" IsRunning freshclam if [ ${RUNNING} -eq 1 ]; then Display --indent 4 --text "- Checking freshclam" --result "FOUND" --color GREEN logtext "Result: found running freshclam process" AddHP 2 2 else Display --indent 4 --text "- Checking freshclam" --result "SUGGESTION" --color YELLOW logtext "Result: freshclam is not running" ReportSuggestion ${TEST_NO} "Confirm that freshclam is properly configured and keeps updating the ClamAV database" fi fi # ################################################################################# # # Test : MALW-3288 # Description : Check for ClamXav (Mac OS X) # ################################################################################# # Register --test-no MALW-3288 --weight L --network NO --description "Check for ClamXav" if [ ${SKIPTEST} -eq 0 ]; then if [ -d /Applications/ClamXav.app/Contents/Resources/ScanningEngine/bin/ ]; then CLAMSCANBINARY=`ls /Applications/ClamXav.app/Contents/Resources/ScanningEngine/bin/ 2> /dev/null | grep 'clamscan'` if [ ! "${CLAMSCANBINARY}" = "" ]; then logtext "Result: Found ClamXav clamscan installed" Display --indent 2 --text "- Checking presence of ClamXav AV scanner" --result "FOUND" --color GREEN MALWARE_SCANNER_INSTALLED=1 AddHP 3 3 else logtext "Result: ClamXav malware scanner not found" AddHP 0 3 fi else logtext "Result: could not find ClamXav location" fi fi # ################################################################################# # # Test : MALW-3204 # Description : Check for LMD # ################################################################################# # # Test : MALW-3292 # Description : Check if at least one malware scanner is installed # Register --test-no MALW-3292 --weight L --network NO --description "Check for at least one malware scanner" # if [ ${SKIPTEST} -eq 0 ]; then # if [ ${MALWARE_SCANNER_INSTALLED} -eq 1 ]; then # logtext "Result: At least one malware scanner is installed" # Display --indent 2 --text "- Checking presence malware scanner" --result "FOUND" --color GREEN # #AddHP 3 3 # else # logtext "Result: No malware scanners found" # Display --indent 2 --text "- Checking presence malware scanner" --result "NOT FOUND" --color YELLOW # ReportSuggestion ${TEST_NO} "Install at least one malware scanner to perform periodic integrity tests on the system" # #AddHP 0 3 # fi # fi # ################################################################################# # # Other projects: maldetect (rfxn) # ################################################################################# # report "malware_scanner_installed=${MALWARE_SCANNER_INSTALLED}" wait_for_keypress # #================================================================================ # Lynis - Copyright 2007-2015, Michael Boelen, CISOfy - https://cisofy.com