tyler.durden
/
lynis
mirror of https://github.com/CISOfy/lynis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
lynis/include/tests_firewalls

359 lines
17 KiB
Bash
Raw Blame History

#!/bin/sh
#################################################################################
#
# Lynis
# ------------------
#
# Copyright 2007-2015, Michael Boelen, CISOfy (michael.boelen@cisofy.com)
# Web site: https://cisofy.com
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Firewalls
#
#################################################################################
#
InsertSection "Software: firewalls"
#
#################################################################################
#
IPTABLES_ACTIVE=0
IPTABLES_INKERNEL_ACTIVE=0
IPTABLES_MODULE_ACTIVE=0
FIREWALL_ACTIVE=0
FIREWALL_SOFTWARE=""
#
#################################################################################
#
# Test : FIRE-4511
# Description : Check iptables kernel module
Register --test-no FIRE-4511 --os Linux --weight L --network NO --description "Check iptables kernel module"
if [ ${SKIPTEST} -eq 0 ]; then
FIND=`lsmod | awk '{ print $1 }' | grep "^ip*_tables"`
if [ ! "${FIND}" = "" ]; then
FIREWALL_ACTIVE=1
FIREWALL_SOFTWARE="iptables"
IPTABLES_ACTIVE=1
IPTABLES_MODULE_ACTIVE=1
Display --indent 2 --text "- Checking iptables kernel module" --result FOUND --color GREEN
logtext "Result: Found iptables in loaded kernel modules"
for I in ${FIND}; do
logtext "Found module: ${I}"
done
else
Display --indent 2 --text "- Checking iptables kernel module" --result "NOT FOUND" --color WHITE
# If we can't find an active module, try to find the Linux configuration file and check that
if [ -f /proc/config.gz ]; then
LINUXCONFIGFILE="/proc/config.gz"; tCATCMD="zcat";
fi
sLINUXCONFIGFILE="/boot/config-`uname -r`"
if [ -f ${sLINUXCONFIGFILE} ]; then
LINUXCONFIGFILE=${sLINUXCONFIGFILE}; tCATCMD="cat";
fi
# If we have a kernel configuration file, use it for testing
# Do not perform test if we already found it in kernel module list, to avoid triggered it in the upcoming
# tests, when using iptables --list
if [ ! "${LINUXCONFIGFILE}" = "" ]; then
if [ -f ${LINUXCONFIGFILE} -a ${IPTABLES_MODULE_ACTIVE} -eq 0 ]; then
logtext "Result: found kernel configuration file (${LINUXCONFIGFILE})"
FIND=`${tCATCMD} ${LINUXCONFIGFILE} | grep -v '^#' | grep "CONFIG_IP_NF_IPTABLES" | head -n 1`
if [ ! "${FIND}" = "" ]; then
HAVEMOD=`echo ${FIND} | cut -d '=' -f2`
# Do not use iptables if it's compiled as a module (=m), since we already tested for it in the
# active list.
if [ "${HAVEMOD}" = "y" ]; then
logtext "Result: iptables available as a module in the configuration"
IPTABLES_ACTIVE=1
IPTABLES_INKERNEL_ACTIVE=1
FIREWALL_ACTIVE=1
FIREWALL_SOFTWARE="iptables"
Display --indent 2 --text "- Checking iptables in config file" --result FOUND --color GREEN
else
logtext "Result: no iptables found in Linux kernel config file"
fi
else
logtext "Result: no Linux configuration file found"
Display --indent 2 --text "- Checking iptables in config file" --result "NOT FOUND" --color WHITE
fi
fi
fi
fi
fi
#
#################################################################################
#
# Test : FIRE-4512
# Description : Check iptables for empty ruleset (should have at least 10 or more rules)
if [ ! "${IPTABLESBINARY}" = "" -a ${IPTABLES_ACTIVE} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no FIRE-4512 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --root-only YES --description "Check iptables for empty ruleset"
if [ ${SKIPTEST} -eq 0 ]; then
FIND=`${IPTABLESBINARY} --list --numeric 2> /dev/null | egrep -v "^(Chain|target|$)" | wc -l | tr -d ' '`
if [ ! "${FIND}" = "" ]; then
FIREWALL_ACTIVE=1
if [ ${FIND} -le 10 ]; then
# Firewall is active, but clearly needs configuration
logtext "Result: iptables ruleset seems to be empty (found ${FIND} rules)"
Display --indent 4 --text "- Checking for empty ruleset" --result WARNING --color RED
ReportWarning ${TEST_NO} "L" "iptables module(s) loaded, but no rules active"
else
logtext "Result: one or more rules are available (${FIND} rules)"
Display --indent 4 --text "- Checking for empty ruleset" --result OK --color GREEN
fi
fi
fi
#
#################################################################################
#
# Test : FIRE-4513
# Description : Check iptables for unused rules
if [ ! "${IPTABLESBINARY}" = "" -a ${IPTABLES_ACTIVE} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no FIRE-4513 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --root-only YES --description "Check iptables for unused rules"
if [ ${SKIPTEST} -eq 0 ]; then
FIND=`${IPTABLESBINARY} --list --numeric --line-numbers --verbose | awk '{ if ($2=="0") print $1 }' | xargs`
if [ "${FIND}" = "" ]; then
Display --indent 4 --text "- Checking for unused rules" --result OK --color GREEN
logtext "Result: There are no unused rules present"
else
Display --indent 4 --text "- Checking for unused rules" --result FOUND --color YELLOW
logtext "Result: Found one or more possible unused rules"
logtext "Description: Unused rules can be a sign that the firewall rules aren't optimized or up-to-date"
logtext "Note: Sometimes rules aren't triggered but still in use. Keep this in mind before cleaning up rules."
logtext "Output: iptables rule numbers: ${FIND}"
#ReportWarning ${TEST_NO} "L" "Found possible unused iptables rules ($FIND)"
ReportSuggestion ${TEST_NO} "Check iptables rules to see which rules are currently not used"
logtext "Tip: iptables --list --numeric --line-numbers --verbose"
fi
fi
#
#################################################################################
#
# Test : FIRE-4518
# Description : Checking status of pf firewall components
Register --test-no FIRE-4518 --weight L --network NO --description "Check pf firewall components"
if [ ${SKIPTEST} -eq 0 ]; then
PFFOUND=0; PFLOGDFOUND=0
# Check status with pfctl
logtext "Test: checking pf status via pfctl"
if [ ! "${PFCTLBINARY}" = "" ]; then
FIND=`${PFCTLBINARY} -sa 2>&1 | grep "^Status" | head -1 | awk '{ print $2 }'`
if [ "${FIND}" = "Enabled" ]; then
Display --indent 2 --text "- Checking pf status (pfctl)" --result ENABLED --color GREEN
logtext "Result: pf is enabled"
PFFOUND=1
AddHP 3 3
else
if [ "${FIND}" = "Disabled" ]; then
Display --indent 2 --text "- Checking pf status (pfctl)" --result DISABLED --color RED
logtext "Result: pf is disabled"
AddHP 0 3
else
Display --indent 2 --text "- Checking pf status (pfctl)" --result UNKNOWN --color YELLOW
ReportException ${TEST_NO} "Unknown status of pf firewall"
fi
fi
fi
# If we didn't find the status to be enabled, stop searching
if [ ${PFFOUND} -eq 0 ]; then
# Check for pf kernel module (FreeBSD and similar)
logtext "Test: searching for pf kernel module"
if [ ! "${KLDSTATBINARY}" = "" ]; then
FIND=`${KLDSTATBINARY} | grep 'pf.ko'`
if [ "${FIND}" = "" ]; then
logtext "Result: Can not find pf KLD"
else
logtext "Result: pf KLD loaded"
PFFOUND=1
fi
else
logtext "Result: no kldstat binary, skipping this part"
fi
IsRunning pflogd
if [ ${RUNNING} -eq 1 ]; then
logtext "Result: found pflog daemon in process list"
Display --indent 4 --text "- Checking pflogd status" --result ACTIVE --color GREEN
PFFOUND=1
PFLOGDFOUND=1
else
logtext "Result: pflog daemon not found in process list"
fi
fi
if [ ${PFFOUND} -eq 1 ]; then
FIREWALL_ACTIVE=1
FIREWALL_SOFTWARE="pf"
else
logtext "Result: pf not running on this system"
fi
fi
#
#################################################################################
#
# Test : FIRE-4520
# Description : Check pf configuration consistency
if [ ${PFFOUND} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no FIRE-4520 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check pf configuration consistency"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: check /etc/pf.conf"
# Test for warnings (-n don't load the rules)
if [ -f /etc/pf.conf ]; then
logtext "Result: /etc/pf.conf exists"
# Check results from pfctl
PFWARNINGS=`pfctl -n -f /etc/pf.conf -vvv 2>&1 | grep -i 'warning'`
if [ "${PFWARNINGS}" = "" ]; then
Display --indent 4 --text "- Checking pf configuration consistency" --result OK --color GREEN
logtext "Result: no pf filter warnings found"
else
Display --indent 4 --text "- Checking pf configuration consistency" --result WARNING --color RED
logtext "Result: found one or more warnings in the pf filter rules"
ReportWarning ${TEST_NO} "H" "Found one or more warnings in pf configuration file"
ReportSuggestion ${TEST_NO} "Run 'pfctl -n -f /etc/pf.conf -vvv' to see available pf warnings"
fi
else
logtext "Result: /etc/pf.conf does NOT exist"
fi
fi
#
#################################################################################
#
# Test : FIRE-4522
# Description : Check ipchains
#
#################################################################################
#
# Test : FIRE-4524
# Description : Check for CSF (ConfigServer Security & Firewall)
Register --test-no FIRE-4524 --weight L --network NO --description "Check for CSF presence"
if [ ${SKIPTEST} -eq 0 ]; then
FILE="/etc/csf/csf.conf"
logtext "Test: check ${FILE}"
if [ -f ${FILE} ]; then
logtext "Result: ${FILE} exists"
FIREWALL_ACTIVE=1
FIREWALL_SOFTWARE="csf"
Display --indent 2 --text "- Checking CSF status (configuration file)" --result FOUND --color GREEN
else
logtext "Result: ${FILE} does NOT exist"
fi
fi
#
#################################################################################
#
# Test : FIRE-4526
# Description : Check ipf (Solaris)
if [ ! "${IPFBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no FIRE-4526 --os Solaris --preqs-met ${PREQS_MET} --weight L --network NO --description "Check ipf status"
if [ ${SKIPTEST} -eq 0 ]; then
FIND=`${IPFBINARY} -n -V | grep "^Running" | awk '{ print $2 }'`
if [ "${FIND}" = "yes" ]; then
Display --indent 4 --text "- Checking ipf status" --result RUNNING --color GREEN
logtext "Result: ipf is enabled and running"
FIREWALL_ACTIVE=1
FIREWALL_SOFTWARE="ipf"
else
Display --indent 4 --text "- Checking ipf status" --result "NOT RUNNING" --color YELLOW
logtext "Result: ipf is not running"
fi
fi
#
#################################################################################
#
# Test : FIRE-4530
# Description : Check IPFW (FreeBSD)
Register --test-no FIRE-4530 --os FreeBSD --weight L --network NO --description "Check IPFW status"
if [ ${SKIPTEST} -eq 0 ]; then
if [ ! "${SYSCTLBINARY}" = "" ]; then
# For now, only check for IPv4.
FIND=`${SYSCTLBINARY} net.inet.ip.fw.enable | awk '{ print $2 }'`
if [ "${FIND}" = "1" ]; then
Display --indent 2 --text "- Checking IPFW status" --result RUNNING --color GREEN
logtext "Result: IPFW is running for IPv4"
FIREWALL_ACTIVE=1
FIREWALL_SOFTWARE="ipfw"
IPFW_ENABLED=`service -e | grep -o ipfw`
if [ "${IPFW_ENABLED}" = "ipfw" ]; then
Display --indent 4 --text "- IPFW enabled in /etc/rc.conf" --result YES --color GREEN
logtext "Result: IPFW is enabled at start-up for IPv4"
else
Display --indent 4 --text "- ipfw enabled in /etc/rc.conf" --result NO --color YELLOW
logtext "Result: IPFW is disabled at start-up for IPv4"
fi
else
Display --indent 2 --text "- Checking IPFW status" --result "NOT RUNNING" --color YELLOW
logtext "Result: IPFW is not running for IPv4"
fi
else
Display --indent 2 --text "- Checking IPFW" --result SKIPPED --color YELLOW
ReportException "${TEST_NO}:1" "No IPFW test available (sysctl missing)"
fi
fi
#
#################################################################################
#
# Test : FIRE-4532
# Description : Check Application Firewall in Mac OS X
if [ -x /usr/libexec/ApplicationFirewall/socketfilterfw ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no FIRE-4532 --weight L --os "MacOS" --preqs-met ${PREQS_MET} --network NO --description "Check Mac OS X application firewall"
if [ ${SKIPTEST} -eq 0 ]; then
FIND=`/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate 2> /dev/null | grep "Firewall is enabled"`
if [ ! "${FIND}" = "" ]; then
Display --indent 2 --text "- Checking Mac OS X: Application Firewall" --result ENABLED --color GREEN
AddHP 3 3
logtext "Result: application firewall of Mac OS X is enabled"
APPLICATION_FIREWALL_ACTIVE=1
report "app_fw[]=macosx-app-fw"
else
Display --indent 2 --text "- Checking IPFW" --result DISABLED --color YELLOW
AddHP 1 3
logtext "Result: application firewall of Mac OS X is disabled"
fi
fi
#
#################################################################################
#
# Test : FIRE-4590
# Description : Check if at least one firewall if active
Register --test-no FIRE-4590 --weight L --network NO --description "Check firewall status"
if [ ${SKIPTEST} -eq 0 ]; then
if [ ${FIREWALL_ACTIVE} -eq 1 ]; then
Display --indent 2 --text "- Checking host based firewall" --result ACTIVE --color GREEN
logtext "Result: host based firewall or packet filter is active"
report "manual[]=Verify if there is a formal process for testing and applying firewall rules"
report "manual[]=Verify all traffic is filtered the right way between the different security zones"
report "manual[]=Verify if a list is available with all required services"
# YYY Solaris ipf (determine default policy)
report "manual[]=Make sure an explicit deny all is the default policy for all unmatched traffic"
AddHP 5 5
else
Display --indent 2 --text "- Checking host based firewall" --result "NOT ACTIVE" --color YELLOW
logtext "Result: no host based firewall/packet filter found or configured"
ReportSuggestion ${TEST_NO} "Configure a firewall/packet filter to filter incoming and outgoing traffic"
AddHP 0 5
fi
fi
#
#################################################################################
#
# Report firewall installed for now, if we found one active. Next step would be determining binaries first and apply additional checks.
report "firewall_installed=${FIREWALL_ACTIVE}"
report "firewall_active=${FIREWALL_ACTIVE}"
report "firewall_software=${FIREWALL_SOFTWARE}"
wait_for_keypress
#
#================================================================================
# Lynis - Copyright 2007-2015, Michael Boelen, CISOfy - https://cisofy.com
Reference in New Issue View Git Blame Copy Permalink