mirror of https://github.com/CISOfy/lynis.git
146 lines
7.1 KiB
Bash
146 lines
7.1 KiB
Bash
#!/bin/sh
|
|
|
|
#################################################################################
|
|
#
|
|
# Lynis
|
|
# ------------------
|
|
#
|
|
# Copyright 2007-2013, Michael Boelen
|
|
# Copyright 2007-2019, CISOfy
|
|
#
|
|
# Website : https://cisofy.com
|
|
# Blog : http://linux-audit.com
|
|
# GitHub : https://github.com/CISOfy/lynis
|
|
#
|
|
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
|
|
# welcome to redistribute it under the terms of the GNU General Public License.
|
|
# See LICENSE file for usage of this software.
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Memory and processes
|
|
#
|
|
#################################################################################
|
|
#
|
|
InsertSection "${SECTION_MEMORY_AND_PROCESSES}"
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : PROC-3602
|
|
# Description : Query /proc/meminfo
|
|
Register --test-no PROC-3602 --os Linux --weight L --network NO --category security --description "Checking /proc/meminfo for memory details"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
if [ -f ${ROOTDIR}proc/meminfo ]; then
|
|
LogText "Result: found ${ROOTDIR}proc/meminfo"
|
|
Display --indent 2 --text "- Checking ${ROOTDIR}proc/meminfo" --result "${STATUS_FOUND}" --color GREEN
|
|
FIND=$(${AWKBINARY} '/^MemTotal/ { print $2, $3 }' ${ROOTDIR}proc/meminfo)
|
|
MEMORY_SIZE=$(echo ${FIND} | ${AWKBINARY} '{ print $1 }')
|
|
MEMORY_UNITS=$(echo ${FIND} | ${AWKBINARY} '{ print $2 }')
|
|
LogText "Result: Found ${MEMORY_SIZE} ${MEMORY_UNITS} memory"
|
|
Report "memory_size=${MEMORY_SIZE}"
|
|
Report "memory_units=${MEMORY_UNITS}"
|
|
else
|
|
LogText "Result: ${ROOTDIR}proc/meminfo file not found on this system"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : PROC-3604
|
|
# Description : Query /proc/meminfo
|
|
# Notes : TODO - prtconf replacement
|
|
Register --test-no PROC-3604 --os Solaris --weight L --network NO --category security --description "Query prtconf for memory details"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
LogText "Test: Searching /usr/sbin/prtconf"
|
|
if [ -x /usr/sbin/prtconf ]; then
|
|
Display --indent 2 --text "- Querying prtconf for installed memory" --result "${STATUS_DONE}" --color GREEN
|
|
MEMORY_SIZE=$(/usr/sbin/prtconf | ${GREPBINARY} "^Memory size:" | ${CUTBINARY} -d ' ' -f3)
|
|
MEMORY_UNITS=$(/usr/sbin/prtconf | ${GREPBINARY} "^Memory size:" | ${CUTBINARY} -d ' ' -f4)
|
|
LogText "Result: Found ${MEMORY_SIZE} ${MEMORY_UNITS} memory"
|
|
Report "memory_size=${MEMORY_SIZE}"
|
|
Report "memory_units=${MEMORY_UNITS}"
|
|
else
|
|
Display --indent 2 --text "- Querying prtconf for installed memory" --result "${STATUS_SKIPPED}" --color WHITE
|
|
LogText "Result: /usr/sbin/prtconf not found"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : PROC-3612
|
|
# Description : Searching for dead and zombie processes
|
|
# Notes : Don't perform test on Solaris
|
|
if [ ! "${OS}" = "Solaris" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no PROC-3612 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check dead or zombie processes"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
if [ "${OS}" = "AIX" ]; then
|
|
FIND=$(${PSBINARY} -Ae -o pid,stat,comm | ${AWKBINARY} '{ if ($2 ~ /Z|X/) print $1 }' | ${XARGSBINARY})
|
|
else
|
|
FIND=$(${PSBINARY} x -o pid,stat,comm | ${AWKBINARY} '{ if ($2 ~ /Z|X/) print $1 }' | ${XARGSBINARY})
|
|
fi
|
|
if [ -z "${FIND}" ]; then
|
|
LogText "Result: no zombie processes found"
|
|
Display --indent 2 --text "- Searching for dead/zombie processes" --result "${STATUS_NOT_FOUND}" --color GREEN
|
|
else
|
|
LogText "Result: found one or more dead or zombie processes"
|
|
LogText "Output: PIDs ${FIND}"
|
|
Display --indent 2 --text "- Searching for dead/zombie processes" --result "${STATUS_FOUND}" --color RED
|
|
ReportSuggestion ${TEST_NO} "Check the output of ps for dead or zombie processes"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : PROC-3614
|
|
# Description : Searching for heavy IO based waiting processes
|
|
# Notes : Don't perform test on Solaris
|
|
if [ ! "${OS}" = "Solaris" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no PROC-3614 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check heavy IO waiting based processes"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
if [ "${OS}" = "AIX" ]; then
|
|
FIND=$(${PSBINARY} -Ae -o pid,stat,comm | ${AWKBINARY} '{ if ($2=="D") print $1 }' | ${XARGSBINARY})
|
|
else
|
|
FIND=$(${PSBINARY} x -o pid,stat,comm | ${AWKBINARY} '{ if ($2=="D") print $1 }' | ${XARGSBINARY})
|
|
fi
|
|
if [ -z "${FIND}" ]; then
|
|
LogText "Result: No processes were waiting for IO requests to be handled first"
|
|
Display --indent 2 --text "- Searching for IO waiting processes" --result "${STATUS_NOT_FOUND}" --color GREEN
|
|
else
|
|
LogText "Result: found one or more processes which were waiting to get IO requests handled first"
|
|
LogText "More info: processes which show up with the status flag 'D' are often stuck, until a disk IO event finished. This can happen for example with network storage, where the connection or protocol settings are not logtext well configured."
|
|
LogText "Output: PIDs ${FIND}"
|
|
Display --indent 2 --text "- Searching for IO waiting processes" --result "${STATUS_FOUND}" --color RED
|
|
ReportSuggestion ${TEST_NO} "Check process listing for processes waiting for IO requests"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : PROC-3802
|
|
# Description : Check presence of prelink tooling
|
|
Register --test-no PROC-3802 --weight L --network NO --category security --description "Check presence of prelink tooling"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
if PackageIsInstalled "prelink"; then
|
|
LogText "Result: prelink packages is installed"
|
|
# TODO
|
|
# - Add item to website with rationale
|
|
#ReportSuggestion "${TEST_NO}" "Disable and remove prelinking of binaries"
|
|
AddHP 1 3
|
|
Display --indent 2 --text "- Search prelink tooling" --result "${STATUS_FOUND}" --color YELLOW
|
|
else
|
|
Display --indent 2 --text "- Search prelink tooling" --result "${STATUS_NOT_FOUND}" --color GREEN
|
|
LogText "Result: prelink package is NOT installed"
|
|
AddHP 3 3
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
|
|
|
|
WaitForKeyPress
|
|
|
|
#
|
|
#================================================================================
|
|
# Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com
|