mirror of https://github.com/CISOfy/lynis.git
614 lines
32 KiB
Bash
614 lines
32 KiB
Bash
#!/bin/sh
|
|
|
|
#################################################################################
|
|
#
|
|
# Lynis
|
|
# ------------------
|
|
#
|
|
# Copyright 2007-2013, Michael Boelen
|
|
# Copyright 2007-2020, CISOfy
|
|
#
|
|
# Website : https://cisofy.com
|
|
# Blog : http://linux-audit.com
|
|
# GitHub : https://github.com/CISOfy/lynis
|
|
#
|
|
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
|
|
# welcome to redistribute it under the terms of the GNU General Public License.
|
|
# See LICENSE file for usage of this software.
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Time
|
|
#
|
|
#################################################################################
|
|
#
|
|
InsertSection "Time and Synchronization"
|
|
#
|
|
#################################################################################
|
|
#
|
|
CRON_DIRS="${ROOTDIR}etc/cron.d ${ROOTDIR}etc/cron.hourly ${ROOTDIR}etc/cron.daily ${ROOTDIR}etc/cron.weekly ${ROOTDIR}etc/cron.monthly ${ROOTDIR}var/spool/crontabs"
|
|
CHRONY_CONF_FILE=""
|
|
NTP_DAEMON=""
|
|
NTP_DAEMON_RUNNING=0
|
|
NTP_CONFIG_FOUND=0
|
|
NTP_CONFIG_TYPE_DAEMON=0
|
|
NTP_CONFIG_TYPE_SCHEDULED=0
|
|
NTP_CONFIG_TYPE_EVENTBASED=0
|
|
NTP_CONFIG_TYPE_STARTUP=0
|
|
NTPD_RUNNING=0 # Specific for ntpd
|
|
OPENNTPD_COMMUNICATION=0 # if ntpctl can communicate
|
|
SYSTEMD_NTP_ENABLED=0
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : TIME-3104
|
|
# Description : Check for a running NTP daemon
|
|
if [ -f /sys/hypervisor/type ]; then
|
|
# TODO: Skip NTP tests if we are in a DomU xen instance
|
|
FIND=$(cat /sys/hypervisor/type)
|
|
if [ "${FIND}" = "xen" ]; then PREQS_MET="NO"; else PREQS_MET="YES"; fi
|
|
elif [ -f /sbin/sysctl ] && [ "$(/sbin/sysctl -n security.jail.jailed 2>/dev/null || echo 0)" -eq 1 ]; then
|
|
# Skip NTP tests if we're in a FreeBSD jail
|
|
PREQS_MET="NO"
|
|
else
|
|
PREQS_MET="YES"
|
|
fi
|
|
Register --test-no TIME-3104 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for running NTP daemon or client"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
# Linux/FreeBSD (ntpdate), OpenBSD (ntpd, rdate), Chrony, systemd-timesyncd
|
|
LogText "Test: Searching for a running NTP daemon or available client"
|
|
FOUND=0
|
|
|
|
SEARCH_FILES="${ROOTDIR}etc/chrony.conf ${ROOTDIR}etc/chrony/chrony.conf"
|
|
for FILE in ${SEARCH_FILES}; do
|
|
if [ -f ${FILE} ]; then LogText "result: found chrony configuration: ${FILE}"; CHRONY_CONF_FILE="${FILE}"; fi
|
|
done
|
|
if [ -n "${CHRONY_CONF_FILE}" ]; then
|
|
if IsRunning "chronyd"; then
|
|
FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="chronyd"
|
|
Display --indent 2 --text "- NTP daemon found: chronyd" --result "${STATUS_FOUND}" --color GREEN
|
|
else
|
|
LogText "Result: found chrony configuration, but no running daemon"
|
|
fi
|
|
else
|
|
LogText "Result: no chrony configuration found"
|
|
fi
|
|
|
|
# Check time daemon (eg DragonFly BSD)
|
|
if IsRunning "dntpd"; then
|
|
FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="dntpd"
|
|
Display --indent 2 --text "- NTP daemon found: dntpd" --result "${STATUS_FOUND}" --color GREEN
|
|
fi
|
|
|
|
# Check for OpenNTPD, ntpctl comes with a "regular" install
|
|
if [ -n "${NTPCTLBINARY}" ]; then
|
|
# In contrast to timectl, "synchronised: yes" is not grepped.
|
|
# Reason: openntpd syncs only if large time corrections are not required or -s is passed.
|
|
# This might be not intended by the administrator (-s is NOT the default!)
|
|
FIND=$(${PSBINARY} ax | ${GREPBINARY} "ntpd: ntp engine" | ${GREPBINARY} -v "grep")
|
|
${NTPCTLBINARY} -s status > /dev/null 2> /dev/null
|
|
# Status code 0 is when communication over the socket is successfull
|
|
if [ "$?" -eq 0 ]; then
|
|
FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="openntpd"
|
|
LogText "result: found openntpd (method: ntpctl)"
|
|
OPENNTPD_COMMUNICATION=1
|
|
elif [ -n "${FIND}" ] ; then
|
|
# Reasons for ntpctl to fail might be someone spawned a new process thus overwriting the socket,
|
|
# then ended it, but another openntpd process is still running
|
|
FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="openntpd"
|
|
LogText "result: found openntpd (method: ps)"
|
|
else
|
|
LogText "result: running openntpd not found, but ntpctl is instaalled"
|
|
fi
|
|
|
|
if [ "${NTP_DAEMON}" == "openntpd" ]; then
|
|
Display --indent 2 --text "- NTP daemon found: OpenNTPD" --result "${STATUS_FOUND}" --color GREEN
|
|
fi
|
|
fi
|
|
|
|
# Check running processes (ntpd from ntp.org)
|
|
# As checking by process name is ambigiouse (openntpd has the same process name),
|
|
# this check will be skipped if openntpd has been found.
|
|
FIND=$(${PSBINARY} ax | ${GREPBINARY} "ntpd" | ${GREPBINARY} -v "dntpd" | ${GREPBINARY} -v "ntpd: " | ${GREPBINARY} -v "grep")
|
|
if [ "${NTP_DAEMON}" != "openntpd" ] && [ -n "${FIND}" ]; then
|
|
FOUND=1; NTPD_RUNNING=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1
|
|
NTP_DAEMON="ntpd"
|
|
LogText "Result: found running NTP daemon in process list"
|
|
Display --indent 2 --text "- NTP daemon found: ntpd" --result "${STATUS_FOUND}" --color GREEN
|
|
fi
|
|
|
|
# Check time daemon (eg NetBSD)
|
|
if IsRunning "timed"; then
|
|
FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="timed"
|
|
Display --indent 2 --text "- NTP daemon found: timed" --result "${STATUS_FOUND}" --color GREEN
|
|
fi
|
|
|
|
# Check timedate daemon (systemd)
|
|
if [ -n "${TIMEDATECTL}" ]; then
|
|
FIND=$(${TIMEDATECTL} status | ${EGREPBINARY} "(NTP|System clock) synchronized: yes")
|
|
if [ -n "${FIND}" ]; then
|
|
# Check for systemd-timesyncd
|
|
if [ -f ${ROOTDIR}etc/systemd/timesyncd.conf ]; then
|
|
LogText "Result: found ${ROOTDIR}etc/systemd/timesyncd.conf"
|
|
FOUND=1; NTP_DAEMON_RUNNING=1; NTP_CONFIG_TYPE_DAEMON=1; NTP_DAEMON="systemd-timesyncd"
|
|
Display --indent 2 --text "- NTP daemon found: systemd (timesyncd)" --result "${STATUS_FOUND}" --color GREEN
|
|
SYSTEMD_NTP_ENABLED=1
|
|
else
|
|
LogText "Result: ${ROOTDIR}etc/systemd/timesyncd.conf does not exist"
|
|
fi
|
|
else
|
|
LogText "Result: time synchronization not performed according timedatectl command"
|
|
fi
|
|
else
|
|
LogText "Result: timedatectl command not available on this system"
|
|
fi
|
|
|
|
# Check crontab for OpenBSD/FreeBSD
|
|
# Check anacrontab for Linux
|
|
CRONTAB_FILES="/etc/anacrontab /etc/crontab"
|
|
for I in ${CRONTAB_FILES}; do
|
|
if [ -f ${I} ]; then
|
|
LogText "Test: checking for ntpdate or rdate in crontab file ${I}"
|
|
FIND=$(${EGREPBINARY} "ntpdate|rdate" ${I} | ${GREPBINARY} -v '^#')
|
|
if [ -n "${FIND}" ]; then
|
|
FOUND=1; NTP_CONFIG_TYPE_SCHEDULED=1
|
|
Display --indent 2 --text "- Checking NTP client in crontab file (${I})" --result "${STATUS_FOUND}" --color GREEN
|
|
LogText "Result: found ntpdate or rdate reference in crontab file ${I}"
|
|
else
|
|
#Display --indent 2 --text "- Checking NTP client in crontab file (${I})" --result "${STATUS_NOT_FOUND}" --color WHITE
|
|
LogText "Result: no ntpdate or rdate reference found in crontab file ${I}"
|
|
fi
|
|
else
|
|
LogText "Result: crontab file ${I} not found"
|
|
fi
|
|
done
|
|
|
|
# Notes: only test for normal files. File /etc/cron.d/FIFO on solaris is a special file and test may hang
|
|
# Linux systems may have a .placeholder file
|
|
FOUND_IN_CRON=0
|
|
|
|
# Check cron jobs
|
|
for I in ${CRON_DIRS}; do
|
|
if [ -d ${I} ]; then
|
|
if FileIsReadable ${I}; then
|
|
FIND=$(${FINDBINARY} ${I} -type f -a ! -name ".placeholder" -print 2> /dev/null | ${SEDBINARY} 's/ /__space__/g' | ${TRBINARY} '\n' '\0' | ${TRBINARY} -cd '[:print:]\0' | ${TRBINARY} '\0' ' ')
|
|
if [ -n "${FIND}" ]; then
|
|
for J in ${FIND}; do
|
|
# Place back spaces if needed
|
|
J=$(echo ${J} | ${SEDBINARY} 's/__space__/ /g')
|
|
LogText "Test: checking for ntpdate or rdate in ${J}"
|
|
if FileIsReadable ${J}; then
|
|
FIND2=$(${EGREPBINARY} "rdate|ntpdate" "${J}" | ${GREPBINARY} -v "^#")
|
|
if [ -n "${FIND2}" ]; then
|
|
LogText "Positive match found: ${FIND2}"
|
|
FOUND=1; FOUND_IN_CRON=1; NTP_CONFIG_TYPE_SCHEDULED=1
|
|
fi
|
|
else
|
|
LogText "Result: could not test in file '${J}' as it is not readable"
|
|
fi
|
|
done
|
|
else
|
|
LogText "Result: ${I} is empty, skipping search in directory"
|
|
fi
|
|
else
|
|
LogText "Result: could not search in directory due to permissions"
|
|
fi
|
|
fi
|
|
done
|
|
|
|
if [ ${FOUND_IN_CRON} -eq 1 ]; then
|
|
Display --indent 2 --text "- Checking NTP client in cron files" --result "${STATUS_FOUND}" --color GREEN
|
|
LogText "Result: found ntpdate or rdate in cron directory"
|
|
else
|
|
LogText "Result: no ntpdate or rdate found in cron directories"
|
|
fi
|
|
|
|
# Checking if ntpdate is performed by event
|
|
LogText "Test: checking for file /etc/network/if-up.d/ntpdate"
|
|
if [ -f /etc/network/if-up.d/ntpdate ]; then
|
|
LogText "Result: found ntpdate action when network interface comes up"
|
|
FOUND=1
|
|
NTP_CONFIG_TYPE_EVENTBASED=1
|
|
Display --indent 2 --text "- Checking event based ntpdate (if-up)" --result "${STATUS_FOUND}" --color GREEN
|
|
else
|
|
LogText "Result: file /etc/network/if-up.d/ntpdate does not exist"
|
|
fi
|
|
|
|
# Configuration file for *BSD
|
|
if [ -f /etc/rc.conf ]; then
|
|
LogText "Test: Checking if ntpdate is enabled at startup in *BSD"
|
|
FIND=$(${GREPBINARY} 'ntpdate_enable="YES"' /etc/rc.conf)
|
|
if [ -n "${FIND}" ]; then
|
|
LogText "Result: ntpdate is enabled in rc.conf"
|
|
FOUND=1
|
|
NTP_CONFIG_TYPE_STARTUP=1
|
|
# Only show suggestion when ntpdate is enabled, however ntpd is not running
|
|
if [ ${NTP_DAEMON_RUNNING} -eq 0 ]; then
|
|
ReportSuggestion "${TEST_NO}" "Although ntpdate is enabled in rc.conf, it is advised to run it at least daily or use a NTP daemon"
|
|
fi
|
|
else
|
|
LogText "Result: ntpdate is not enabled in rc.conf"
|
|
fi
|
|
fi
|
|
|
|
if [ ${FOUND} -eq 0 ]; then
|
|
if [ ${ISVIRTUALMACHINE} -eq 1 ]; then
|
|
LogText "Result: Skipping display warning, as virtual machines usually don't need time synchronization in the VM itself"
|
|
else
|
|
Display --indent 2 --text "- Checking for a running NTP daemon or client" --result "${STATUS_WARNING}" --color RED
|
|
LogText "Result: Could not find a NTP daemon or client"
|
|
ReportSuggestion "${TEST_NO}" "Use NTP daemon or NTP client to prevent time issues."
|
|
AddHP 0 2
|
|
fi
|
|
else
|
|
Display --indent 2 --text "- Checking for a running NTP daemon or client" --result "${STATUS_OK}" --color GREEN
|
|
LogText "Result: Found a time syncing daemon/client."
|
|
AddHP 3 3
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : TIME-3106
|
|
# Description : Check status of systemd time synchronization
|
|
if [ ${SYSTEMD_NTP_ENABLED} -eq 1 -a -n "${TIMEDATECTL}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no TIME-3106 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check systemd NTP time synchronization status"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
LogText "Test: Check the status of time synchronization via timedatectl"
|
|
FIND=$(${TIMEDATECTL} status | ${EGREPBINARY} "(NTP|System clock) synchronized: yes")
|
|
if [ -z "${FIND}" ]; then
|
|
LogText "Result: time not synchronized via NTP"
|
|
ReportSuggestion "${TEST_NO}" "Check timedatectl output. Synchronization via NTP is enabled, but status reflects it is not synchronized"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : TIME-3112
|
|
# Description : Check for valid associations from ntpq peers list
|
|
if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no TIME-3112 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check active NTP associations ID's"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
LogText "Test: Checking for NTP association ID's from ntpq peers list"
|
|
FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} "No association ID's returned")
|
|
if [ -z "${FIND}" ]; then
|
|
Display --indent 2 --text "- Checking valid association ID's" --result "${STATUS_FOUND}" --color GREEN
|
|
LogText "Result: Found one or more association ID's"
|
|
else
|
|
Display --indent 2 --text "- Checking valid association ID's" --result "${STATUS_WARNING}" --color RED
|
|
ReportSuggestion "${TEST_NO}" "Check ntp.conf for properly configured NTP servers and a correctly functioning name service."
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : TIME-3116
|
|
# Description : Check for stratum 16 peers
|
|
if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no TIME-3116 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check peers with stratum value of 16"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
COUNT=0
|
|
LogText "Test: Checking stratum 16 sources from ntpq peers list"
|
|
FIND=$(${NTPQBINARY} -p -n | ${AWKBINARY} '{ if ($2!=".POOL." && $3=="16") { print $1 }}')
|
|
if [ -z "${FIND}" ]; then
|
|
Display --indent 2 --text "- Checking high stratum ntp peers" --result "${STATUS_OK}" --color GREEN
|
|
LogText "Result: All peers are lower than stratum 16"
|
|
else
|
|
for ITEM in ${FIND}; do
|
|
LogText "Found stratum 16 peer: ${ITEM}"
|
|
FIND2=$(${EGREPBINARY} "^ntp-ignore-stratum-16-peer=${ITEM}" ${PROFILE})
|
|
if IsEmpty "${FIND2}"; then
|
|
COUNT=$((COUNT + 1))
|
|
Report "ntp_stratum_16_peer[]=${ITEM}"
|
|
else
|
|
LogText "Output: host ${ITEM} ignored by profile"
|
|
fi
|
|
done
|
|
# Check if one or more high stratum time servers are found
|
|
if [ ${COUNT} -eq 0 ]; then
|
|
Display --indent 2 --text "- Checking high stratum ntp peers" --result "${STATUS_OK}" --color GREEN
|
|
LogText "Result: all non local servers are lower than stratum 16, or whitelisted within the scan profile"
|
|
else
|
|
Display --indent 2 --text "- Checking high stratum ntp peers" --result "${STATUS_WARNING}" --color RED
|
|
LogText "Result: Found ${COUNT} high stratum (16) peers)"
|
|
ReportSuggestion "${TEST_NO}" "Check ntpq peers output for stratum 16 peers"
|
|
fi
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : TIME-3120
|
|
# Description : Check unreliable peers from peer list
|
|
# Notes : Items with # are too far away (network distance)
|
|
# Items with - are not chosen due clustering algorithm
|
|
if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no TIME-3120 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check unreliable NTP peers"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
LogText "Test: Checking unreliable ntp peers"
|
|
FIND=$(${NTPQBINARY} -p -n | ${EGREPBINARY} "^(-|#)" | ${AWKBINARY} '{ print $1 }' | ${SEDBINARY} 's/^-//g')
|
|
if [ -z "${FIND}" ]; then
|
|
Display --indent 2 --text "- Checking unreliable ntp peers" --result "${STATUS_NONE}" --color GREEN
|
|
LogText "Result: No unreliable peers found"
|
|
else
|
|
Display --indent 2 --text "- Checking unreliable ntp peers" --result "${STATUS_FOUND}" --color YELLOW
|
|
LogText "Result: Found one or more unreliable peers (marked with a minus or dash sign)"
|
|
for I in ${FIND}; do
|
|
LogText "Unreliable peer: ${I}"
|
|
Report "ntp_unreliable_peer[]=${I}"
|
|
done
|
|
ReportSuggestion "${TEST_NO}" "Check ntpq peers output for unreliable ntp peers and correct/replace them"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : TIME-3124
|
|
# Description : Check selected time source
|
|
if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no TIME-3124 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check selected time source"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
LogText "Test: Checking selected time source"
|
|
FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} '^*' | ${AWKBINARY} '{ if ($4=="l") { print $1 } }')
|
|
FIND2=$(${NTPQBINARY} -p -n | ${GREPBINARY} '^*' | ${AWKBINARY} '{ print $1 }')
|
|
if [ -z "${FIND}" -a -n "${FIND2}" ]; then
|
|
Display --indent 2 --text "- Checking selected time source" --result "${STATUS_OK}" --color GREEN
|
|
FIND2=$(echo ${FIND2} | ${SEDBINARY} 's/*//g')
|
|
LogText "Result: Found selected time source (value: ${FIND2})"
|
|
else
|
|
Display --indent 2 --text "- Checking selected time source" --result "${STATUS_WARNING}" --color RED
|
|
LogText "Result: Found local source as selected time source. This could indicate that no external sources are available to sync with."
|
|
LogText "Local source: ${FIND}"
|
|
ReportSuggestion "${TEST_NO}" "Check ntpq peers output for selected time source"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : TIME-3128
|
|
# Description : Check time source candidates
|
|
if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no TIME-3128 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check preferred time source"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
LogText "Test: Checking preferred time source"
|
|
FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} '^+' | ${AWKBINARY} '{ print $1 }')
|
|
if [ -z "${FIND}" ]; then
|
|
Display --indent 2 --text "- Checking time source candidates" --result "${STATUS_NONE}" --color YELLOW
|
|
LogText "Result: No other time source candidates found"
|
|
ReportSuggestion "${TEST_NO}" "Check ntpq peers output for time source candidates"
|
|
else
|
|
Display --indent 2 --text "- Checking time source candidates" --result "${STATUS_OK}" --color GREEN
|
|
LogText "Result: Found one or more candidates to synchronize time with."
|
|
for I in ${FIND}; do
|
|
I=$(echo ${I} | ${SEDBINARY} 's/+//g')
|
|
LogText "Candidate found: ${I}"
|
|
done
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : TIME-3132
|
|
# Description : Check ntpq falsetickers
|
|
if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no TIME-3132 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check NTP falsetickers"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
LogText "Test: Checking preferred time source"
|
|
FIND=$(${NTPQBINARY} -p -n | ${EGREPBINARY} '^x')
|
|
if [ -z "${FIND}" ]; then
|
|
Display --indent 2 --text "- Checking falsetickers" --result "${STATUS_OK}" --color GREEN
|
|
LogText "Result: No falsetickers found (items preceding with an 'x')"
|
|
else
|
|
Display --indent 2 --text "- Checking falsetickers" --result "${STATUS_NONE}" --color YELLOW
|
|
LogText "Result: Found one or more falsetickers (items preceding with an 'x')"
|
|
for I in ${FIND}; do
|
|
I=$(echo ${I} | ${SEDBINARY} 's/x//g')
|
|
LogText "Falseticker found: ${I}"
|
|
Report "ntp_falseticker[]=${I}"
|
|
done
|
|
ReportSuggestion "${TEST_NO}" "Check ntpq peers output for falsetickers"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : TIME-3136
|
|
# Description : Check ntpq reported ntp version (Linux)
|
|
if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no TIME-3136 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check NTP protocol version"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
LogText "Test: Checking NTP protocol version (ntpq -c ntpversion)"
|
|
FIND=$(${NTPQBINARY} -c ntpversion | ${AWKBINARY} '{ if ($1=="NTP" && $2=="version" && $5=="is") { print $6 } }')
|
|
if [ -z "${FIND}" ]; then
|
|
Display --indent 2 --text "- Checking NTP version" --result "${STATUS_UNKNOWN}" --color YELLOW
|
|
LogText "Result: No NTP version found"
|
|
ReportSuggestion "${TEST_NO}" "Check ntpq output for NTP protocol version"
|
|
else
|
|
Display --indent 2 --text "- Checking NTP version" --result "${STATUS_FOUND}" --color GREEN
|
|
LogText "Result: Found NTP version ${FIND}"
|
|
Report "ntp_version=${FIND}"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : TIME-3146
|
|
# Description : Check /etc/default/ntpdate (Linux)
|
|
# Notes : ntpdate-debian binary
|
|
#if [ ${NTPD_RUNNING} -eq 1 -a -n "${NTPQBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
#Register --test-no TIME-3146 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check /etc/default/ntpdate"
|
|
#if [ ${SKIPTEST} -eq 0 ]; then
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : TIME-3148
|
|
# Description : Check if TZ variable is set (Linux)
|
|
# Notes : without TZ variable set, a lot of unneeded calls might be performed.
|
|
Register --test-no TIME-3148 --os Linux --weight L --network NO --category performance --description "Check TZ variable"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
LogText "Test: testing for TZ variable"
|
|
FIND="${TZ:=notset}"
|
|
LogText "Result: found TZ variable with value ${FIND}"
|
|
if [ "${FIND}" = "notset" ]; then
|
|
Report "tz_variable_empty=1"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : TIME-3160
|
|
# Description : Check empty NTP step-tickers
|
|
# Notes : Mostly applies to Red Hat and clones
|
|
FILE="${ROOTDIR}etc/ntp/step-tickers"
|
|
if [ "${NTPD_RUNNING}" -eq 1 -a -n "${NTPQBINARY}" -a -f "${FILE}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no TIME-3160 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check empty NTP step-tickers"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
FOUND=0
|
|
OUTPUT=$(${AWKBINARY} '/^[a-z0-9]/ { print $1 }' ${FILE})
|
|
if [ -z "${OUTPUT}" ]; then
|
|
if [ ${OS_REDHAT_OR_CLONE} -eq 1 -a -f "${FILE}" ]; then
|
|
# On RedHat if step-ticker file exists but is empty, the ntpdate start script uses the servers listed in ntp.conf for the initial time synchronization
|
|
LogText "Result: ${FILE} exists and it is empty. On RedHat the initial time synchronization will be done with the servers listed in ntp.conf."
|
|
Display --indent 2 --text "- Checking NTP step-tickers file" --result "${STATUS_OK}" --color GREEN
|
|
else
|
|
LogText "Result: ${FILE} is empty. The step-tickers contain no configured NTP servers"
|
|
Display --indent 2 --text "- Checking NTP step-tickers file" --result "EMPTY FILE" --color YELLOW
|
|
ReportSuggestion "${TEST_NO}" "Use step-tickers file for quicker time synchronization"
|
|
fi
|
|
else
|
|
LogText "Result: ${FILE} is not empty, which is fine"
|
|
Display --indent 2 --text "- Checking NTP step-tickers file" --result "${STATUS_OK}" --color GREEN
|
|
sFIND=$(${AWKBINARY} '/^[a-z0-9]/ { print $1 }' ${FILE} | ${EGREPBINARY} -v "^127." | ${EGREPBINARY} -v "^::1")
|
|
for I in ${sFIND}; do
|
|
FIND=$(${GREPBINARY} ^${I} ${FILE} | wc -l)
|
|
if [ ${FIND} -gt 0 ]; then
|
|
LogText "Result: $I exist in ${FILE}"
|
|
else
|
|
LogText "Result: ${I} does NOT exist in ${FILE}"
|
|
FOUND=1
|
|
fi
|
|
done
|
|
if [ ${FOUND} -eq 1 ]; then
|
|
Display --indent 4 --text "- Checking step-tickers ntp servers entries" --result "SOME MISSING" --color YELLOW
|
|
ReportSuggestion "${TEST_NO}" "Some time servers missing in step-tickers file"
|
|
AddHP 3 4
|
|
else
|
|
Display --indent 4 --text "- Checking step-tickers ntp servers entries" --result "${STATUS_OK}" --color GREEN
|
|
LogText "Result: all time servers are in step-tickers file"
|
|
AddHP 4 4
|
|
fi
|
|
fi
|
|
LogText "Information: step-tickers is used by ntpdate where as ntp.conf is the configuration file for the ntpd daemon. ntpdate is initially run to set the clock before ntpd to make sure time is within 1000 sec."
|
|
LogText "Risk: ntp will not run at boot if the time difference between the server and client by more then 1000 sec."
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : TIME-3170
|
|
# Description : Check file permissions and ownership of configuration files
|
|
# Notes : Files should be owned by root, or the user running
|
|
# Group owner should have only read access
|
|
# Other should preferably have no access, or read-only at max
|
|
|
|
FILE_ARRAY="${ROOTDIR}etc/chrony.conf ${ROOTDIR}usr/pkg/etc/chrony.conf \
|
|
${ROOTDIR}etc/inet/ntp.conf ${ROOTDIR}etc/ntp.conf ${ROOTDIR}usr/local/etc/ntp.conf\
|
|
${ROOTDIR}etc/ntpd.conf ${ROOTDIR}etc/openntpd/ntpd.conf ${ROOTDIR}usr/local/etc/ntpd.conf"
|
|
|
|
Register --test-no TIME-3170 --weight L --network NO --category security --description "Check configuration files"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
for FILE in ${FILE_ARRAY}; do
|
|
if [ -f ${FILE} ]; then
|
|
LogText "Result: found ${FILE}"
|
|
if IsWorldWritable ${FILE}; then
|
|
ReportWarning "${TEST_NO}" "Found world writable configuration file" "${FILE}" ""
|
|
fi
|
|
Report "ntp_config_file[]=${FILE}"
|
|
NTP_CONFIG_FOUND=1
|
|
fi
|
|
done
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : TIME-3180
|
|
# Description : Report if ntpctl cannot communicate with OpenNTPD
|
|
if [ "${NTPD_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" == "openntpd" ]; then
|
|
PREQS_MET="YES"
|
|
else
|
|
PREQS_MET="NO"
|
|
fi
|
|
Register --test-no TIME-3180 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Report if ntpctl cannot communicate with OpenNTPD"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
if [ "${OPENNTPD_COMMUNICATION}" -eq 0 ]; then
|
|
ReportWarning "${TEST_NO}" "OpenNTPD found, but ntpctl cannot communicate with" "${NTPCTLBINARY} -s status" "Restart OpenNTPD"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : TIME-3181
|
|
# Description : Check status of OpenNTPD time synchronisation
|
|
if [ "${NTPD_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" == "openntpd" ] && [ "${OPENNTPD_COMMUNICATION}" -eq 1 ]; then
|
|
PREQS_MET="YES"
|
|
else
|
|
PREQS_MET="NO"
|
|
fi
|
|
|
|
Register --test-no TIME-3181 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Check status of OpenNTPD time synchronisation"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
FIND=$(${NTPCTLBINARY} -s status | ${GREPBINARY} "clock synced" )
|
|
if [ -z "${FIND}" ]; then
|
|
ReportWarning "${TEST_NO}" "OpenNTPD is not synchronising system time" "${NTPCTLBINARY} -s status" "text:Set time manually once or check network connectivity."
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : TIME-3182
|
|
# Description : Check OpenNTPD has working peers
|
|
|
|
if [ "${NTPD_RUNNING}" -eq 1 ] && [ -n "${NTPCTLBINARY}" ] && [ "${NTP_DAEMON}" == "openntpd" ] && [ "${OPENNTPD_COMMUNICATION}" -eq 1 ]; then
|
|
PREQS_MET="YES"
|
|
else
|
|
PREQS_MET="NO"
|
|
fi
|
|
|
|
Register --test-no TIME-3182 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Check OpenNTPD has working peers"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
# Format is "xx/yy peers valid, ..."
|
|
FIND=$(${NTPCTLBINARY} -s status | ${EGREPBINARY} -o "[0-9]{1,4}/" | ${EGREPBINARY} -o "[0-9]{1,4}" )
|
|
if [ -n "${FIND}" ] || [ "${FIND}" -eq 0 ]; then
|
|
ReportWarning "${TEST_NO}" "OpenNTPD has no peers" "${NTPCTLBINARY} -s status"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
|
|
Report "ntp_config_found=${NTP_CONFIG_FOUND}"
|
|
Report "ntp_config_type_daemon=${NTP_CONFIG_TYPE_DAEMON}"
|
|
Report "ntp_config_type_eventbased=${NTP_CONFIG_TYPE_EVENTBASED}"
|
|
Report "ntp_config_type_scheduled=${NTP_CONFIG_TYPE_SCHEDULED}"
|
|
Report "ntp_config_type_startup=${NTP_CONFIG_TYPE_STARTUP}"
|
|
Report "ntp_daemon=${NTP_DAEMON}"
|
|
Report "ntp_daemon_running=${NTP_DAEMON_RUNNING}"
|
|
#
|
|
#################################################################################
|
|
#
|
|
# For VMs check ntpd.conf : tinker panic 0
|
|
|
|
# OS Time daemons Configuration file
|
|
# --------------------------------------------
|
|
# AIX xntpd /etc/ntp.conf
|
|
# HP
|
|
# Linux ntpd /etc/ntp.conf
|
|
# chrony /etc/chrony.conf
|
|
# OpenBSD ntpd /etc/ntpd.conf
|
|
# Solaris xntpd /etc/inet/ntp.conf
|
|
|
|
WaitForKeyPress
|
|
|
|
#
|
|
#================================================================================
|
|
# Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com
|