tyler.durden
/
lynis
mirror of https://github.com/CISOfy/lynis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
lynis/include/tests_malware

220 lines
8.7 KiB
Bash
Raw Blame History

#!/bin/sh
#################################################################################
#
# Lynis
# ------------------
#
# Copyright 2007-2015, Michael Boelen (michael.boelen@cisofy.com), The Netherlands
# Web site: http://cisofy.com
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Malware scanners
#
#################################################################################
#
InsertSection "Software: Malware scanners"
#
#################################################################################
#
CLAMD_RUNNING=0
MALWARE_SCANNER_INSTALLED=0
#
#################################################################################
#
# Test : MALW-3275
# Description : Check for installed tool (chkrootkit)
Register --test-no MALW-3275 --weight L --network NO --description "Check for chkrootkit"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: checking presence chkrootkit"
if [ ! "${CHKROOTKITBINARY}" = "" ]; then
Display --indent 2 --text "- Checking chkrootkit" --result "FOUND" --color GREEN
logtext "Result: Found ${CHKROOTKITBINARY}"
MALWARE_SCANNER_INSTALLED=1
AddHP 2 2
else
logtext "Result: chkrootkit not found"
fi
fi
#
#################################################################################
#
# Test : MALW-3276
# Description : Check for installed tool (Rootkit Hunter)
Register --test-no MALW-3276 --weight L --network NO --description "Check for Rootkit Hunter"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: checking presence Rootkit Hunter"
if [ ! "${RKHUNTERBINARY}" = "" ]; then
Display --indent 2 --text "- Checking Rootkit Hunter" --result "FOUND" --color GREEN
logtext "Result: Found ${RKHUNTERBINARY}"
MALWARE_SCANNER_INSTALLED=1
AddHP 2 2
else
logtext "Result: Rootkit Hunter not found"
fi
fi
#
#################################################################################
#
# Test : MALW-3280
# Description : Check if an anti-virus tool is installed
Register --test-no MALW-3280 --weight L --network NO --description "Check for clamscan"
if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0
MCAFEE_RUNNING=0
logtext "Test: checking process cma or cmdagent (McAfee)"
# cma is too generic to match on, so we want to ensure that it is related to McAfee first
if [ -x /opt/McAfee/cma/bin/cma ]; then
IsRunning cma
if [ ${RUNNING} -eq 1 ]; then MCAFEE_RUNNING=1; fi
else
IsRunning cmdagent
if [ ${RUNNING} -eq 1 ]; then MCAFEE_RUNNING=1; fi
fi
if [ ${MCAFEE_RUNNING} -eq 1 ]; then
FOUND=1
Display --indent 2 --text "- Checking McAfee" --result "FOUND" --color GREEN
logtext "Result: Found McAfee"
MALWARE_SCANNER_INSTALLED=1
AddHP 2 2
fi
logtext "Test: checking process SophosScanD"
IsRunning SophosScanD
if [ ${RUNNING} -eq 1 ]; then
FOUND=1
Display --indent 2 --text "- Checking Sophos" --result "FOUND" --color GREEN
logtext "Result: Found Sophos"
MALWARE_SCANNER_INSTALLED=1
AddHP 2 2
fi
if [ ${FOUND} -eq 0 ]; then
logtext "Result: no commercial anti-virus tool found"
AddHP 0 3
fi
fi
#
#################################################################################
#
# Test : MALW-3282
# Description : Check if clamscan is installed
Register --test-no MALW-3282 --weight L --network NO --description "Check for clamscan"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: checking presence clamscan"
if [ ! "${CLAMSCANBINARY}" = "" ]; then
Display --indent 2 --text "- Checking ClamAV scanner" --result "FOUND" --color GREEN
logtext "Result: Found ${CLAMSCANBINARY}"
MALWARE_SCANNER_INSTALLED=1
AddHP 2 2
else
logtext "Result: clamscan couldn't be found"
fi
fi
#
#################################################################################
#
# Test : MALW-3284
# Description : Check running clamd process
Register --test-no MALW-3284 --weight L --network NO --description "Check for clamd"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: checking running ClamAV daemon (clamd)"
IsRunning clamd
if [ ${RUNNING} -eq 1 ]; then
Display --indent 2 --text "- Checking ClamAV daemon" --result "FOUND" --color GREEN
logtext "Result: found running clamd process"
MALWARE_SCANNER_INSTALLED=1
CLAMD_RUNNING=1
else
logtext "Result: clamd not running"
fi
fi
#
#################################################################################
#
# Test : MALW-3286
# Description : Check running freshclam if clamd process is running
if [ ${CLAMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no MALW-3286 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check for freshclam"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: checking running freshclam daemon"
IsRunning freshclam
if [ ${RUNNING} -eq 1 ]; then
Display --indent 4 --text "- Checking freshclam" --result "FOUND" --color GREEN
logtext "Result: found running freshclam process"
AddHP 2 2
else
Display --indent 4 --text "- Checking freshclam" --result "SUGGESTION" --color YELLOW
logtext "Result: freshclam is not running"
ReportSuggestion ${TEST_NO} "Confirm that freshclam is properly configured and keeps updating the ClamAV database"
fi
fi
#
#################################################################################
#
# Test : MALW-3288
# Description : Check for ClamXav (Mac OS X)
#
#################################################################################
#
Register --test-no MALW-3288 --weight L --network NO --description "Check for ClamXav"
if [ ${SKIPTEST} -eq 0 ]; then
if [ -d /Applications/ClamXav.app/Contents/Resources/ScanningEngine/bin/ ]; then
CLAMSCANBINARY=`ls /Applications/ClamXav.app/Contents/Resources/ScanningEngine/bin/ 2> /dev/null | grep 'clamscan'`
if [ ! "${CLAMSCANBINARY}" = "" ]; then
logtext "Result: Found ClamXav clamscan installed"
Display --indent 2 --text "- Checking presence of ClamXav AV scanner" --result "FOUND" --color GREEN
MALWARE_SCANNER_INSTALLED=1
AddHP 3 3
else
logtext "Result: ClamXav malware scanner not found"
AddHP 0 3
fi
else
logtext "Result: could not find ClamXav location"
fi
fi
#
#################################################################################
#
# Test : MALW-3204
# Description : Check for LMD
#
#################################################################################
#
# Test : MALW-3292
# Description : Check if at least one malware scanner is installed
# Register --test-no MALW-3292 --weight L --network NO --description "Check for at least one malware scanner"
# if [ ${SKIPTEST} -eq 0 ]; then
# if [ ${MALWARE_SCANNER_INSTALLED} -eq 1 ]; then
# logtext "Result: At least one malware scanner is installed"
# Display --indent 2 --text "- Checking presence malware scanner" --result "FOUND" --color GREEN
# #AddHP 3 3
# else
# logtext "Result: No malware scanners found"
# Display --indent 2 --text "- Checking presence malware scanner" --result "NOT FOUND" --color YELLOW
# ReportSuggestion ${TEST_NO} "Install at least one malware scanner to perform periodic integrity tests on the system"
# #AddHP 0 3
# fi
# fi
#
#################################################################################
#
# Other projects: maldetect (rfxn)
#
#################################################################################
#
report "malware_scanner_installed=${MALWARE_SCANNER_INSTALLED}"
wait_for_keypress
#
#================================================================================
# Lynis - Copyright 2007-2015, Michael Boelen, CISOfy - https://cisofy.com
Reference in New Issue View Git Blame Copy Permalink