prehistoric-systems/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2026-03-11 08:55:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add CrowdSec tooling check

Browse source
This commit is contained in:
naimo84 2025-04-24 11:17:38 +02:00
parent 2e24dd0a1e
commit 047f125a87
3 changed files with 48 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
include/binaries
View file

@ -172,6 +172,7 @@
evmctl) EVMCTLBINARY=${BINARY}; LogText " Found known binary: evmctl (IMA/EVM tool) - ${BINARY}" ;;
exim) EXIMBINARY="${BINARY}"; EXIMVERSION=$(${BINARY} -bV | grep 'Exim version' | awk '{ print $3 }' | xargs); LogText " Found known binary ${BINARY} (version ${EXIMVERSION})" ;;
fail2ban-server) FAIL2BANBINARY="${BINARY}"; LogText " Found known binary: fail2ban (IPS tool) - ${BINARY}" ;;
cscli) CROWDSECCLIBINARY="${BINARY}"; LogText " Found known binary: crowdsec (IPS tool) - ${BINARY}" ;;
file) FILEBINARY="${BINARY}"; LogText " Found known binary: file (file type detection) - ${BINARY}" ;;
find) FINDBINARY="${BINARY}"; LogText " Found known binary: find (search tool) - ${BINARY}" ;;
g++) GPLUSPLUSBINARY="${BINARY}"; COMPILER_INSTALLED=1; LogText " Found known binary: g++ (compiler) - ${BINARY}" ;;

1
include/consts
View file

@ -84,6 +84,7 @@ ETC_PATHS="/etc /usr/local/etc"
CONTROL_URL_PROTOCOL=""
CONTAINER_TYPE=""
CREATE_REPORT_FILE=1
CROWDSECCLIBINARY=""
CRYPTSETUPBINARY=""
CSUMBINARY=""
CURRENT_TS=0

46
include/tests_tooling
View file

@ -30,6 +30,7 @@
FAIL2BAN_FOUND=0
FAIL2BAN_EMAIL=0
FAIL2BAN_SILENT=0
CROWDSEC_FOUND=0
PERFORM_FAIL2BAN_TESTS=0
SNORT_FOUND=0
SNORT_RUNNING=0
@ -190,6 +191,51 @@
# Intrusion Detection and Prevention tools
#
#################################################################################
#
# Test : TOOL-5103
# Description : Check for CrowdSec
Register --test-no TOOL-5103 --weight L --network NO --category security --description "Check for presence of CrowdSec"
if [ ${SKIPTEST} -eq 0 ]; then
# CrowdSec presence
if [ -n "${CROWDSECCLIBINARY}" ]; then
CROWDSEC_FOUND=1
IDS_IPS_TOOL_FOUND=1
LogText "Result: CrowdSec is installed (${CROWDSECCLIBINARY})"
Report "ids_ips_tooling[]=fail2ban"
Display --indent 2 --text "- Checking presence of CrowdSec" --result "${STATUS_FOUND}" --color GREEN
else
LogText "Result: CrowdSec not present (fail2ban-server not found)"
fi
# CrowdSec configuration
LogText "Checking CrowdSec configuration file"
if [ -f /etc/crowdsec/config.yaml ]; then
CROWDSEC_CONFIG="/etc/crowdsec/config.yaml"
else
CROWDSEC_CONFIG=""
fi
# Continue if tooling is available and configuration file found
if [ ${CROWDSEC_FOUND} -eq 1 -a -n "${CROWDSEC_CONFIG}" ]; then
Report "crowdsec_config=${CROWDSEC_CONFIG}"
CROWDSECCLIENT=$(which cscli 2> /dev/null | grep -v "no [^ ]* in ")
if [ -n "${CROWDSECCLIENT}" ]; then
CROWDSEC_METRICS=$(cscli metrics 2> /dev/null)
if [ $? -gt 0 ]; then
LogText "Result: CrowdSec is not running"
Display --indent 4 --text "- Checking CrowdSec status" --result "${STATUS_NOT_RUNNING}" --color YELLOW
AddHP 0 3
else
LogText "Result: CrowdSec is running"
Display --indent 4 --text "- Checking CrowdSec status" --result "${STATUS_RUNNING}" --color GREEN
AddHP 3 3
fi
fi
fi
fi
#
#################################################################################
#
# Test : TOOL-5102
# Description : Check for Fail2ban