From d96628d9b1d116e3fa7d909e0d2b323653d5d6d7 Mon Sep 17 00:00:00 2001 From: Sander Date: Fri, 14 May 2021 11:56:48 +0000 Subject: [PATCH 001/108] Adding HTTP-6660 test --- include/tests_webservers | 39 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-) diff --git a/include/tests_webservers b/include/tests_webservers index 6e0a3b3d..d3634ece 100644 --- a/include/tests_webservers +++ b/include/tests_webservers @@ -48,6 +48,8 @@ TMPFILE="${TEMP_FILE}" CreateTempFile || ExitFatal TMPFILE2="${TEMP_FILE}" + CreateTempFile || ExitFatal + TMPFILE3="${TEMP_FILE}" # ################################################################################# # @@ -300,8 +302,42 @@ # ################################################################################# # - # Test : HTTP-6660 TODO + # Test : HTTP-6660 # Description : Search for "TraceEnable off" in configuration files + if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi + Register --test-no HTTP-6660 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking Apache security setting: TraceEnable" + if [ ${SKIPTEST} -eq 0 ]; then + for DIR in ${sTEST_APACHE_TARGETS}; do + if [ -d ${DIR} ]; then + find ${DIR} -name "*.conf" -print >> ${TMPFILE3} + fi + done + + # Check all Apache conf-files for TraceEnable + if [ -f ${TMPFILE3} ]; then + Display --indent 2 --text '- Checking TraceEnable setting in:' + for APACHE_CONFFILE in $(cat ${TMPFILE3}); do + TRACEENABLE=$( ${GREPBINARY} -i -E '^TraceEnable' ${APACHE_CONFFILE} | ${AWKBINARY} '{print $2}' ) + if [ ! ${TRACEENABLE} ]; then + LogText "Result: no TraceEnable setting found in ${APACHE_CONFFILE}" + Display --indent 4 --text " ${APACHE_CONFFILE}" --result "${STATUS_NOT_FOUND}" --color WHITE + else + TRACEENABLED_SETTING=$( echo ${TRACEENABLE} | tr 'A-Z' 'a-z' ) + if [ x${TRACEENABLED_SETTING} == x'off' ]; then + LogText "Result: found TraceEnable setting set to 'off' in ${APACHE_CONFFILE}" + Report "Apache setting: 'TraceEnable Off' in ${APACHE_CONFFILE}" + Display --indent 4 --text " ${APACHE_CONFFILE}" --result "${STATUS_FOUND}" --color GREEN + else + LogText "Result: found TraceEnable setting set to '"${TRACEENABLE}"' in ${APACHE_CONFFILE}" + Report "Apache setting: 'TraceEnable "${TRACEENABLE}"' in ${APACHE_CONFFILE}" + Display --indent 4 --text " ${APACHE_CONFFILE}" --result "${STATUS_SUGGESTION}" --color YELLOW + ReportSuggestion "${TEST_NO}" "Consider setting 'TraceEnable Off' in ${APACHE_CONFFILE}" "Set TraceEnable to 'On' or 'extended' for testing and diagnostic purposes only." + fi + fi + done + rm -f ${TMPFILE3} + fi + fi # ################################################################################# # @@ -608,6 +644,7 @@ # Remove temp file (double check) if [ -n "${TMPFILE}" ]; then if [ -f ${TMPFILE} ]; then rm -f ${TMPFILE}; fi; fi if [ -n "${TMPFILE2}" ]; then if [ -f ${TMPFILE2} ]; then rm -f ${TMPFILE2}; fi; fi + if [ -n "${TMPFILE3}" ]; then if [ -f ${TMPFILE3} ]; then rm -f ${TMPFILE3}; fi; fi WaitForKeyPress From 2e6415a3b3987f3b7c5e383fa5c0f7771f5af85d Mon Sep 17 00:00:00 2001 From: pyllyukko Date: Sun, 23 Jan 2022 10:36:55 +0200 Subject: [PATCH 002/108] perf_event_paranoid -> 2|3 The value of 3 was introduced in c76a4ca and the source was this[1]. The documentation in the source notes that the value of 3 requires a patch for the Linux kernel. Vanilla kernel has the "maximum" value of 2[2]. [1] https://docs.clip-os.org/clipos/kernel.html#sysctl-security-tuning [2] https://www.kernel.org/doc/html/v5.7/admin-guide/sysctl/kernel.html#perf-event-paranoid --- default.prf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/default.prf b/default.prf index aadc4495..79c0a48c 100644 --- a/default.prf +++ b/default.prf @@ -197,7 +197,7 @@ config-data=sysctl;kernel.exec-shield;1;1;No description;sysctl -a;url:https;//k config-data=sysctl;kernel.kptr_restrict;2;1;Restrict access to kernel symbols;sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security; config-data=sysctl;kernel.maps_protect;1;1;Restrict access to /proc/[pid]/maps;sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security; config-data=sysctl;kernel.modules_disabled;1;1;Restrict module loading once this sysctl value is loaded;sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security; -config-data=sysctl;kernel.perf_event_paranoid;3;1;Restrict unprivileged access to the perf_event_open() system call.;sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security; +config-data=sysctl;kernel.perf_event_paranoid;2|3;1;Restrict unprivileged access to the perf_event_open() system call.;sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security; config-data=sysctl;kernel.randomize_va_space;2;1;Randomize of memory address locations (ASLR);sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security; config-data=sysctl;kernel.suid_dumpable;0;1;Restrict core dumps;sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security; config-data=sysctl;kernel.sysrq;0;1;Disable magic SysRQ;sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security; From 3140a245da2c709e379c34ca6f3495428f0c7e5e Mon Sep 17 00:00:00 2001 From: Zafer Balkan Date: Fri, 5 Aug 2022 15:45:35 +0300 Subject: [PATCH 003/108] Added wazuh-agent as a remote syslog capability --- include/tests_logging | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/include/tests_logging b/include/tests_logging index b6acdbe5..ed87ff17 100644 --- a/include/tests_logging +++ b/include/tests_logging @@ -28,6 +28,7 @@ METALOG_RUNNING=0 RFC3195D_RUNNING=0 RSYSLOG_RUNNING=0 + WAZUH_AGENT_RUNNING=0 SOLARIS_LOGHOST="" SOLARIS_LOGHOST_FOUND=0 SOLARIS_LOGHOST_LOCALHOST=0 @@ -220,6 +221,23 @@ fi # ################################################################################# +# + # Test : LOGG-2144 + # Description : Check for wazuh-agent presence on Linux systems + Register --test-no LOGG-2144 --os Linux --weight L --network NO --category security --description "Checking wazuh-agent" + if [ ${SKIPTEST} -eq 0 ]; then + LogText "Result: Searching for wazuh-agent instances in the process list" + if IsRunning "wazuh-agent"; then + LogText "Result: Found wazuh-agent in process list" + Display --indent 4 --text "- Checking wazuh-agent status" --result "${STATUS_FOUND}" --color GREEN + WAZUH_AGENT_RUNNING=1 + else + LogText "Result: wazuh-agent NOT found in process list" + Display --indent 4 --text "- Checking wazuh-agent daemon status" --result "${STATUS_NOT_FOUND}" --color WHITE + fi + fi +# +################################################################################# # # Test : LOGG-2146 # Description : Check for logrotate (/etc/logrotate.conf and logrotate.d) @@ -446,6 +464,21 @@ fi fi + # Test wazuh-agent configuration for syslog configuration + if [ ${WAZUH_AGENT_RUNNING} ]; then + WAZUH_AGENT_CONF="/var/ossec/etc/ossec.conf" + fi + + if [ -f ${WAZUH_AGENT_CONF} ]; then + LogText "Test: Checking Wazuh agent configuration for remote syslog forwarding" + FIND=$(${EGREPBINARY} '/var/log/syslog' ${WAZUH_AGENT_CONF}) + if [ "${FIND}" ]; then + DESTINATION=$(${EGREPBINARY} -o '
([A-Za-z0-9\.\-\_]*)
' ${WAZUH_AGENT_CONF} | sed 's/
//' | sed 's/<\/address>//') + LogText "Result: found destination ${DESTINATION} configured for remote logging with wazuh" + REMOTE_LOGGING_ENABLED=1 + fi + fi + # Show result if [ ${REMOTE_LOGGING_ENABLED} -eq 0 ]; then Report "remote_syslog_configured=0" From fe5990f20875d85ce8fcdbc06f4a760cddd5a5b9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Tue, 23 Aug 2022 11:56:25 +0200 Subject: [PATCH 004/108] remove whitespaces MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- include/tests_databases | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/tests_databases b/include/tests_databases index f5bc22ae..7c829cd3 100644 --- a/include/tests_databases +++ b/include/tests_databases @@ -85,7 +85,7 @@ LogText "Test: Trying to login to local MySQL server without password" # "-u root --password=" avoids ~/.my.cnf authentication settings - # "plugin = 'mysql_native_password' AND authentication_string = ''" avoids false positives when secure plugins are used + # "plugin = 'mysql_native_password' AND authentication_string = ''" avoids false positives when secure plugins are used FIND=$(${MYSQLCLIENTBINARY} --default-auth=mysql_native_password --no-defaults -u root --password= --silent --batch --execute="SELECT count(*) FROM mysql.user WHERE user = 'root' AND plugin = 'mysql_native_password' AND authentication_string = ''" mysql > /dev/null 2>&1; echo $?) if [ "${FIND}" = "0" ]; then LogText "Result: Login succeeded, no MySQL root password set!" @@ -213,7 +213,7 @@ ReportWarning "${TEST_NO}" "PostgreSQL configuration file ${CF} is world readable and might leak sensitive details" "${CF}" "Use chmod 600 to change file permissions" else LogText "Result: great, configuration file ${CF} is not world readable" - fi + fi done fi # From fc62b39f34b32f5d31502578f4f9a78b494b331d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Tue, 23 Aug 2022 11:57:05 +0200 Subject: [PATCH 005/108] find redis.conf if /snap directory exists MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- include/tests_databases | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/include/tests_databases b/include/tests_databases index 7c829cd3..153e74ac 100644 --- a/include/tests_databases +++ b/include/tests_databases @@ -302,6 +302,12 @@ if [ ${QNAP_DEVICE} -eq 1 ]; then PATHS="${PATHS} ${ROOTDIR}share/CACHEDEV1_DATA/.qpkg/QKVM/usr/etc/redis.conf" fi + if [ -d "/snap" ]; then + for SNAP_PATH in $(${FINDBINARY} /snap -name 'redis.conf' -type f); do + PATHS="${PATHS} ${SNAP_PATH}" + done + fi + ALLFILES=$(${LSBINARY} ${ROOTDIR}etc/redis.conf 2> /dev/null) FOUND=0 for DIR in ${PATHS}; do From 4f6eeb7537077d145860e19f83d44f59d182ea2c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Wed, 24 Aug 2022 10:17:54 +0200 Subject: [PATCH 006/108] remove file from path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- include/tests_databases | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/tests_databases b/include/tests_databases index 153e74ac..34bace85 100644 --- a/include/tests_databases +++ b/include/tests_databases @@ -303,7 +303,7 @@ PATHS="${PATHS} ${ROOTDIR}share/CACHEDEV1_DATA/.qpkg/QKVM/usr/etc/redis.conf" fi if [ -d "/snap" ]; then - for SNAP_PATH in $(${FINDBINARY} /snap -name 'redis.conf' -type f); do + for SNAP_PATH in $(${FINDBINARY} /snap -name 'redis.conf' -type f | ${SEDBINARY} 's/redis.conf$//g'); do PATHS="${PATHS} ${SNAP_PATH}" done fi From 49bbf25abe606f3ff598f5ff58ffdddcc59ec949 Mon Sep 17 00:00:00 2001 From: Ximalas Date: Mon, 26 Sep 2022 10:05:39 +0200 Subject: [PATCH 007/108] Update tests_database: Redis configuration file On FreeBSD the Redis configuration file is typically stored as /usr/local/etc/redis.conf. --- include/tests_databases | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/tests_databases b/include/tests_databases index e973d23f..7a3252c0 100644 --- a/include/tests_databases +++ b/include/tests_databases @@ -311,7 +311,7 @@ if [ ${REDIS_RUNNING} -eq 1 ]; then PREQS_METS="YES"; else PREQS_MET="NO"; SKIPREASON="Redis not running"; fi Register --test-no DBS-1882 --weight L --network NO --preqs-met "${PREQS_MET}" --skip-reason "${SKIPREASON}" --category security --description "Redis configuration file" if [ ${SKIPTEST} -eq 0 ]; then - PATHS="${ROOTDIR}etc/redis ${ROOTDIR}usr/local/etc/redis ${ROOTDIR}usr/local/redis/etc" + PATHS="${ROOTDIR}etc/redis ${ROOTDIR}usr/local/etc ${ROOTDIR}usr/local/etc/redis ${ROOTDIR}usr/local/redis/etc" if [ ${QNAP_DEVICE} -eq 1 ]; then PATHS="${PATHS} ${ROOTDIR}share/CACHEDEV1_DATA/.qpkg/QKVM/usr/etc/redis.conf" fi From 051052cc153bd78adfb1b41cb0949dcae08ca82e Mon Sep 17 00:00:00 2001 From: pyllyukko Date: Thu, 17 Nov 2022 18:47:44 +0200 Subject: [PATCH 008/108] Added Slackware support for PackageIsInstalled() function --- include/functions | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/include/functions b/include/functions index 38cc46b3..f27211d0 100644 --- a/include/functions +++ b/include/functions @@ -2086,6 +2086,10 @@ elif [ -n "${PKGINFOBINARY}" ]; then output=$(${PKGINFOBINARY} -q -e ${package} >/dev/null 2>&1) exit_code=$? # 0=package installed, 1=package not installed + # Slackware also has RPM for some reason and that's why this test precedes the RPMBINARY test + elif [ "${OS_NAME}" = "Slackware Linux" -a -d "${ROOTDIR}/var/lib/pkgtools/packages" ]; then + output=$( ls ${ROOTDIR}/var/lib/pkgtools/packages/ 2> /dev/null | ${GREPBINARY} "^${package}-[^-]\+-[^-]\+-[^-]\+$" ) + exit_code=$? elif [ -n "${RPMBINARY}" ]; then output=$(${RPMBINARY} --quiet -q ${package} > /dev/null 2>&1) exit_code=$? From 31c22f2daa59963823e3821b281f178d342f4afb Mon Sep 17 00:00:00 2001 From: pyllyukko Date: Thu, 5 Jan 2023 14:43:29 +0200 Subject: [PATCH 009/108] Added "prosecute" & "report" to LEGAL_BANNER_STRINGS https://xkcd.com/838/ --- include/tests_banners | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/tests_banners b/include/tests_banners index cd148f30..0694e9de 100644 --- a/include/tests_banners +++ b/include/tests_banners @@ -27,7 +27,7 @@ ################################################################################# # BANNER_FILES="${ROOTDIR}etc/issue ${ROOTDIR}etc/issue.net ${ROOTDIR}etc/motd" - LEGAL_BANNER_STRINGS="audit access authori condition connect consent continu criminal enforce evidence forbidden intrusion law legal legislat log monitor owner penal policy policies privacy private prohibited record restricted secure subject system terms warning" + LEGAL_BANNER_STRINGS="audit access authori condition connect consent continu criminal enforce evidence forbidden intrusion law legal legislat log monitor owner penal policy policies privacy private prohibited prosecute record report restricted secure subject system terms warning" # ################################################################################# # From e618acaf965a3778b5ee9121a3c27f1d65e730ec Mon Sep 17 00:00:00 2001 From: noci2012 Date: Sun, 8 Jan 2023 00:40:36 +0100 Subject: [PATCH 010/108] Update some EOL date --- db/software-eol.db | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/db/software-eol.db b/db/software-eol.db index f8242d35..c01890a5 100644 --- a/db/software-eol.db +++ b/db/software-eol.db @@ -40,7 +40,7 @@ os:Arch Linux::-1: os:CentOS release 5:2017-03-31:1490911200: os:CentOS release 6:2020-11-30:1606690800: os:CentOS Linux 7:2024-06-30:1719698400: -os:CentOS Linux 8:2029-05-31:1874872800: +os:CentOS Linux 8:2021-12-31:1640905200: # # Debian - https://wiki.debian.org/DebianReleases#Production_Releases # @@ -48,8 +48,9 @@ os:Debian 5.0:2012-02-06:1328482800: os:Debian 6.0:2016-02-29:1456700400: os:Debian 7:2018-05-31:1527717600: os:Debian 8:2020-06-30:1593468000: -os:Debian 9:2022-01-01:1640991600: -os:Debian 10:2022-01-01:1640991600: +os:Debian 9:2022-07-01:1656626400: +os:Debian 10:2022-09-10:1665266400: +os:Debian 11:2024-07-01:1719784800: # # Fedora - https://fedoraproject.org/wiki/End_of_life # @@ -134,6 +135,7 @@ os:Mageia 4:2015-09-19:1442613600 os:Mageia 5:2017-12-31:1514674800 os:Mageia 6:2019-09-30:1569794400 os:Mageia 7:2020-12-30:1609282800 +os:Mageia 8::-1 # # NetBSD - https://www.netbsd.org/support/security/release.html and # https://www.netbsd.org/releases/formal.html @@ -195,7 +197,12 @@ os:OpenBSD 6.3:2019-05-03:1556841600: os:OpenBSD 6.4:2019-10-17:1571270400: os:OpenBSD 6.5:2020-05-19:1589846400: os:OpenBSD 6.6:2020-10-01:1601510400: -os:OpenBSD 6.7:2021-05-01:1619827200: +os:Open166569840021-05-01:1619827200: +os:OpenBSD 6.8:2021-10-14:1665698400: +os:OpenBSD 6.9:2022-04-21:1650492000: +os:OpenBSD 7.0:2022-10-20:1666216800: +os:OpenBSD 7.1:2023-05-01:1682892000: +os:OpenBSD 7.2::-1 # # Red Hat Enterprise Linux - https://access.redhat.com/labs/plcc/ # From b64f7c8f53860514ec7e3716b0fb9231cf85ac25 Mon Sep 17 00:00:00 2001 From: noci2012 Date: Sun, 8 Jan 2023 00:41:56 +0100 Subject: [PATCH 011/108] Typo in previous paste --- db/software-eol.db | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/db/software-eol.db b/db/software-eol.db index c01890a5..fc565be3 100644 --- a/db/software-eol.db +++ b/db/software-eol.db @@ -197,7 +197,7 @@ os:OpenBSD 6.3:2019-05-03:1556841600: os:OpenBSD 6.4:2019-10-17:1571270400: os:OpenBSD 6.5:2020-05-19:1589846400: os:OpenBSD 6.6:2020-10-01:1601510400: -os:Open166569840021-05-01:1619827200: +os:OpenBSD 6.7:2021-05-01:1619827200: os:OpenBSD 6.8:2021-10-14:1665698400: os:OpenBSD 6.9:2022-04-21:1650492000: os:OpenBSD 7.0:2022-10-20:1666216800: From ef3a8338a07febf0a56421d8536c18917ef0b1f5 Mon Sep 17 00:00:00 2001 From: al-lac Date: Fri, 27 Jan 2023 15:12:17 +0100 Subject: [PATCH 012/108] osdetection: add macOS Ventura --- include/osdetection | 1 + 1 file changed, 1 insertion(+) diff --git a/include/osdetection b/include/osdetection index 989b1b38..bed25033 100644 --- a/include/osdetection +++ b/include/osdetection @@ -64,6 +64,7 @@ 10.15 | 10.15.[0-9]*) OS_FULLNAME="macOS Catalina (${OS_VERSION})" ;; 11 | 11.[0-9]*) OS_FULLNAME="macOS Big Sur (${OS_VERSION})" ;; 12 | 12.[0-9]*) OS_FULLNAME="macOS Monterey (${OS_VERSION})" ;; + 13 | 13.[0-9]*) OS_FULLNAME="macOS Ventura (${OS_VERSION})" ;; *) echo "Unknown macOS version. Do you know what version it is? Create an issue at ${PROGRAM_SOURCE}" ;; esac else From 349975103fae73567cec495d0c9bddcba9b2fc9d Mon Sep 17 00:00:00 2001 From: Johannes Segitz Date: Thu, 23 Feb 2023 13:17:25 +0100 Subject: [PATCH 013/108] tests_mac_frameworks: check for existance of semanage binary. It's not installed everywhere, causing this error message: /usr/share/lynis/include/tests_mac_frameworks: line 161: permissive: command not found /usr/share/lynis/include/tests_mac_frameworks: line 162: permissive: command not found --- include/tests_mac_frameworks | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/include/tests_mac_frameworks b/include/tests_mac_frameworks index cda343ad..ca454529 100644 --- a/include/tests_mac_frameworks +++ b/include/tests_mac_frameworks @@ -158,10 +158,14 @@ Display --indent 6 --text "- Checking current mode and config file" --result "${STATUS_WARNING}" --color RED fi Display --indent 8 --text "Current SELinux mode: ${FIND}" - PERMISSIVE=$(${SEMANAGEBINARY} permissive --list --noheading | ${TRBINARY} '\n' ' ') - NPERMISSIVE=$(${SEMANAGEBINARY} permissive --list --noheading | ${WCBINARY} -l) - Display --indent 8 --text "Found ${NPERMISSIVE} permissive SELinux object types" - LogText "Permissive SELinux object types: ${PERMISSIVE}" + if [ -x "$SEMANAGEBINARY" ]; then + PERMISSIVE=$(${SEMANAGEBINARY} permissive --list --noheading | ${TRBINARY} '\n' ' ') + NPERMISSIVE=$(${SEMANAGEBINARY} permissive --list --noheading | ${WCBINARY} -l) + Display --indent 8 --text "Found ${NPERMISSIVE} permissive SELinux object types" + LogText "Permissive SELinux object types: ${PERMISSIVE}" + else + LogText "Result: semanage binary NOT found, can't analyse permissive domains" + fi UNCONFINED=$(${PSBINARY} -eo label,pid,command | ${GREPBINARY} '[u]nconfined_t' | ${TRBINARY} '\n' ' ') INITRC=$(${PSBINARY} -eo label,pid,command | ${GREPBINARY} '[i]nitrc_t' | ${TRBINARY} '\n' ' ') NUNCONFINED=$(${PSBINARY} -eo label | ${GREPBINARY} '[u]nconfined_t' | ${WCBINARY} -l) From 02ad15862d2dae7f4e8434556467a1b6ca5490fe Mon Sep 17 00:00:00 2001 From: DemurAIdev Date: Mon, 6 Mar 2023 11:45:01 +0700 Subject: [PATCH 014/108] ID Languages add --- db/languages/id | 107 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 107 insertions(+) create mode 100644 db/languages/id diff --git a/db/languages/id b/db/languages/id new file mode 100644 index 00000000..4a7b26f4 --- /dev/null +++ b/db/languages/id @@ -0,0 +1,107 @@ +ERROR_NO_LICENSE="Tidak ada kunci lisensi yang dikonfigurasi" +ERROR_NO_UPLOAD_SERVER="Tidak ada server unggahan yang dikonfigurasi" +GEN_CHECKING="Memeriksa" +GEN_CURRENT_VERSION="Versi sekarang" +GEN_DEBUG_MODE="Debug mode" +GEN_INITIALIZE_PROGRAM="Inisialisasi program" +GEN_LATEST_VERSION="Versi terbaru" +GEN_PHASE="fase" +GEN_PLUGINS_ENABLED="Plugin diaktifkan" +GEN_UPDATE_AVAILABLE="update tersedia" +GEN_VERBOSE_MODE="Verbose mode" +GEN_WHAT_TO_DO="Apa yang harus dilakukan" +NOTE_EXCEPTIONS_FOUND="Pengecualian ditemukan" +NOTE_EXCEPTIONS_FOUND_DETAILED="Beberapa peristiwa atau informasi luar biasa ditemukan" +NOTE_PLUGINS_TAKE_TIME="Note: plugin memiliki pengujian yang lebih ekstensif dan mungkin memerlukan waktu beberapa menit untuk menyelesaikannya" +NOTE_SKIPPED_TESTS_NON_PRIVILEGED="Tes yang dilewati karena mode non-istimewa" +#SECTION_ACCOUNTING="Accounting" +#SECTION_BANNERS_AND_IDENTIFICATION="Banners and identification" +#SECTION_BASICS="Basics" +#SECTION_BOOT_AND_SERVICES="Boot and services" +#SECTION_CONTAINERS="Containers" +#SECTION_CRYPTOGRAPHY="Cryptography" +SECTION_CUSTOM_TESTS="Tes kustom" +#SECTION_DATABASES="Databases" +#SECTION_DATA_UPLOAD="Data upload" +#SECTION_DOWNLOADS="Downloads" +#SECTION_EMAIL_AND_MESSAGING="Software: e-mail and messaging" +#SECTION_FILE_INTEGRITY="Software: file integrity" +#SECTION_FILE_PERMISSIONS="File Permissions" +#SECTION_FILE_SYSTEMS="File systems" +#SECTION_FIREWALLS="Software: firewalls" +#SECTION_GENERAL="General" +#SECTION_HARDENING="Hardening" +#SECTION_HOME_DIRECTORIES="Home directories" +#SECTION_IMAGE="Image" +#SECTION_INITIALIZING_PROGRAM="Initializing program" +#SECTION_INSECURE_SERVICES="Insecure services" +#SECTION_KERNEL_HARDENING="Kernel Hardening" +#SECTION_KERNEL="Kernel" +#SECTION_LDAP_SERVICES="LDAP Services" +#SECTION_LOGGING_AND_FILES="Logging and files" +SECTION_MALWARE="Software: Malware" +SECTION_MEMORY_AND_PROCESSES="Memory and Processes" +SECTION_NAME_SERVICES="Name services" +SECTION_NETWORKING="Networking" +SECTION_PERMISSIONS="Permissions" +SECTION_PORTS_AND_PACKAGES="Ports and packages" +SECTION_PRINTERS_AND_SPOOLS="Printers and Spools" +SECTION_PROGRAM_DETAILS="Program Details" +SECTION_SCHEDULED_TASKS="Scheduled tasks" +SECTION_SECURITY_FRAMEWORKS="Security frameworks" +SECTION_SHELLS="Shells" +SECTION_SNMP_SUPPORT="SNMP Support" +SECTION_SOFTWARE="Software" +SECTION_SQUID_SUPPORT="Squid Support" +SECTION_SSH_SUPPORT="SSH Support" +SECTION_STORAGE="Storage" +SECTION_SYSTEM_INTEGRITY="Software: System integrity" +SECTION_SYSTEM_TOOLING="Software: System tooling" +SECTION_SYSTEM_TOOLS="System tools" +SECTION_TIME_AND_SYNCHRONIZATION="Time and Synchronization" +SECTION_USB_DEVICES="USB Devices" +SECTION_USERS_GROUPS_AND_AUTHENTICATION="Users, Groups and Authentication" +SECTION_VIRTUALIZATION="Virtualization" +SECTION_WEBSERVER="Software: webserver" +STATUS_ACTIVE="ACTIVE" +STATUS_CHECK_NEEDED="CHECK NEEDED" +STATUS_DEBUG="DEBUG" +STATUS_DEFAULT="DEFAULT" +STATUS_DIFFERENT="DIFFERENT" +STATUS_DISABLED="DISABLED" +STATUS_DONE="DONE" +STATUS_ENABLED="ENABLED" +STATUS_ERROR="ERROR" +STATUS_EXPOSED="EXPOSED" +STATUS_FAILED="FAILED" +STATUS_FILES_FOUND="FILES FOUND" +STATUS_FOUND="FOUND" +STATUS_HARDENED="HARDENED" +STATUS_INSTALLED="INSTALLED" +STATUS_LOCAL_ONLY="LOCAL ONLY" +STATUS_MEDIUM="MEDIUM" +STATUS_NO="NO" +STATUS_NO_UPDATE="NO UPDATE" +STATUS_NON_DEFAULT="NON DEFAULT" +STATUS_NONE="NONE" +STATUS_NOT_CONFIGURED="NOT CONFIGURED" +STATUS_NOT_DISABLED="NOT DISABLED" +STATUS_NOT_ENABLED="NOT ENABLED" +STATUS_NOT_FOUND="NOT FOUND" +STATUS_NOT_RUNNING="NOT RUNNING" +STATUS_OFF="OFF" +STATUS_OK="OK" +STATUS_ON="ON" +STATUS_PARTIALLY_HARDENED="PARTIALLY HARDENED" +STATUS_PROTECTED="PROTECTED" +STATUS_RUNNING="RUNNING" +STATUS_SKIPPED="SKIPPED" +STATUS_SUGGESTION="SUGGESTION" +STATUS_UNKNOWN="UNKNOWN" +STATUS_UNSAFE="UNSAFE" +STATUS_UPDATE_AVAILABLE="UPDATE TERSEDIA" +STATUS_WARNING="WARNING" +STATUS_WEAK="WEAK" +STATUS_YES="YES" +TEXT_UPDATE_AVAILABLE="update tersedia" +TEXT_YOU_CAN_HELP_LOGFILE="Anda dapat membantu dengan memberikan file log Anda" From 833508a59017ee9e4a44829e10f17a9fc7cbadbf Mon Sep 17 00:00:00 2001 From: xnoguer Date: Wed, 5 Apr 2023 15:58:26 -0400 Subject: [PATCH 015/108] Adding php.ini files for versions 8.0, 8.1 and 8.2 --- include/tests_php | 68 ++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 64 insertions(+), 4 deletions(-) diff --git a/include/tests_php b/include/tests_php index 23738198..90fde471 100644 --- a/include/tests_php +++ b/include/tests_php @@ -37,6 +37,9 @@ ${ROOTDIR}etc/php7.2/php.ini \ ${ROOTDIR}etc/php7.3/php.ini \ ${ROOTDIR}etc/php7.4/php.ini \ + ${ROOTDIR}etc/php8.0/php.ini \ + ${ROOTDIR}etc/php8.1/php.ini \ + ${ROOTDIR}etc/php8.2/php.ini \ ${ROOTDIR}etc/php/cgi-php5/php.ini \ ${ROOTDIR}etc/php/cli-php5/php.ini \ ${ROOTDIR}etc/php/apache2-php5/php.ini \ @@ -47,6 +50,9 @@ ${ROOTDIR}etc/php/apache2-php7.2/php.ini \ ${ROOTDIR}etc/php/apache2-php7.3/php.ini \ ${ROOTDIR}etc/php/apache2-php7.4/php.ini \ + ${ROOTDIR}etc/php/apache2-php8.0/php.ini \ + ${ROOTDIR}etc/php/apache2-php8.1/php.ini \ + ${ROOTDIR}etc/php/apache2-php8.2/php.ini \ ${ROOTDIR}etc/php/cgi-php5.5/php.ini \ ${ROOTDIR}etc/php/cgi-php5.6/php.ini \ ${ROOTDIR}etc/php/cgi-php7.0/php.ini \ @@ -54,6 +60,9 @@ ${ROOTDIR}etc/php/cgi-php7.2/php.ini \ ${ROOTDIR}etc/php/cgi-php7.3/php.ini \ ${ROOTDIR}etc/php/cgi-php7.4/php.ini \ + ${ROOTDIR}etc/php/cgi-php8.0/php.ini \ + ${ROOTDIR}etc/php/cgi-php8.1/php.ini \ + ${ROOTDIR}etc/php/cgi-php8.2/php.ini \ ${ROOTDIR}etc/php/cli-php5.5/php.ini \ ${ROOTDIR}etc/php/cli-php5.6/php.ini \ ${ROOTDIR}etc/php/cli-php7.0/php.ini \ @@ -61,6 +70,9 @@ ${ROOTDIR}etc/php/cli-php7.2/php.ini \ ${ROOTDIR}etc/php/cli-php7.3/php.ini \ ${ROOTDIR}etc/php/cli-php7.4/php.ini \ + ${ROOTDIR}etc/php/cli-php8.0/php.ini \ + ${ROOTDIR}etc/php/cli-php8.1/php.ini \ + ${ROOTDIR}etc/php/cli-php8.2/php.ini \ ${ROOTDIR}etc/php/embed-php5.5/php.ini \ ${ROOTDIR}etc/php/embed-php5.6/php.ini \ ${ROOTDIR}etc/php/embed-php7.0/php.ini \ @@ -68,6 +80,12 @@ ${ROOTDIR}etc/php/embed-php7.2/php.ini \ ${ROOTDIR}etc/php/embed-php7.3/php.ini \ ${ROOTDIR}etc/php/embed-php7.4/php.ini \ + ${ROOTDIR}etc/php/embed-php8.0/php.ini \ + ${ROOTDIR}etc/php/embed-php8.1/php.ini \ + ${ROOTDIR}etc/php/embed-php8.2/php.ini \ + ${ROOTDIR}etc/php/fpm-php8.2/php.ini \ + ${ROOTDIR}etc/php/fpm-php8.1/php.ini \ + ${ROOTDIR}etc/php/fpm-php8.0/php.ini \ ${ROOTDIR}etc/php/fpm-php7.4/php.ini \ ${ROOTDIR}etc/php/fpm-php7.3/php.ini \ ${ROOTDIR}etc/php/fpm-php7.2/php.ini \ @@ -88,6 +106,9 @@ ${ROOTDIR}etc/php/7.2/apache2/php.ini \ ${ROOTDIR}etc/php/7.3/apache2/php.ini \ ${ROOTDIR}etc/php/7.4/apache2/php.ini \ + ${ROOTDIR}etc/php/8.0/apache2/php.ini \ + ${ROOTDIR}etc/php/8.1/apache2/php.ini \ + ${ROOTDIR}etc/php/8.2/apache2/php.ini \ ${ROOTDIR}etc/php/7.0/cli/php.ini \ ${ROOTDIR}etc/php/7.0/fpm/php.ini \ ${ROOTDIR}etc/php/7.1/cli/php.ini \ @@ -98,6 +119,12 @@ ${ROOTDIR}etc/php/7.3/fpm/php.ini \ ${ROOTDIR}etc/php/7.4/cli/php.ini \ ${ROOTDIR}etc/php/7.4/fpm/php.ini \ + ${ROOTDIR}etc/php/8.0/cli/php.ini \ + ${ROOTDIR}etc/php/8.0/fpm/php.ini \ + ${ROOTDIR}etc/php/8.1/cli/php.ini \ + ${ROOTDIR}etc/php/8.1/fpm/php.ini \ + ${ROOTDIR}etc/php/8.2/cli/php.ini \ + ${ROOTDIR}etc/php/8.2/fpm/php.ini \ ${ROOTDIR}var/www/conf/php.ini \ ${ROOTDIR}usr/local/etc/php.ini \ ${ROOTDIR}usr/local/lib/php.ini \ @@ -109,6 +136,9 @@ ${ROOTDIR}usr/local/php72/lib/php.ini \ ${ROOTDIR}usr/local/php73/lib/php.ini \ ${ROOTDIR}usr/local/php74/lib/php.ini \ + ${ROOTDIR}usr/local/php80/lib/php.ini \ + ${ROOTDIR}usr/local/php81/lib/php.ini \ + ${ROOTDIR}usr/local/php82/lib/php.ini \ ${ROOTDIR}usr/local/zend/etc/php.ini \ ${ROOTDIR}usr/pkg/etc/php.ini \ ${ROOTDIR}opt/cpanel/ea-php54/root/etc/php.ini \ @@ -119,6 +149,9 @@ ${ROOTDIR}opt/cpanel/ea-php72/root/etc/php.ini \ ${ROOTDIR}opt/cpanel/ea-php73/root/etc/php.ini \ ${ROOTDIR}opt/cpanel/ea-php74/root/etc/php.ini \ + ${ROOTDIR}opt/cpanel/ea-php80/root/etc/php.ini \ + ${ROOTDIR}opt/cpanel/ea-php81/root/etc/php.ini \ + ${ROOTDIR}opt/cpanel/ea-php82/root/etc/php.ini \ ${ROOTDIR}opt/alt/php44/etc/php.ini \ ${ROOTDIR}opt/alt/php51/etc/php.ini \ ${ROOTDIR}opt/alt/php52/etc/php.ini \ @@ -131,12 +164,18 @@ ${ROOTDIR}opt/alt/php72/etc/php.ini \ ${ROOTDIR}opt/alt/php73/etc/php.ini \ ${ROOTDIR}opt/alt/php74/etc/php.ini \ + ${ROOTDIR}opt/alt/php80/etc/php.ini \ + ${ROOTDIR}opt/alt/php81/etc/php.ini \ + ${ROOTDIR}opt/alt/php82/etc/php.ini \ ${ROOTDIR}etc/opt/remi/php56/php.ini \ ${ROOTDIR}etc/opt/remi/php70/php.ini \ ${ROOTDIR}etc/opt/remi/php71/php.ini \ ${ROOTDIR}etc/opt/remi/php72/php.ini \ ${ROOTDIR}etc/opt/remi/php73/php.ini \ - ${ROOTDIR}etc/opt/remi/php74/php.ini" + ${ROOTDIR}etc/opt/remi/php74/php.ini \ + ${ROOTDIR}etc/opt/remi/php80/php.ini \ + ${ROOTDIR}etc/opt/remi/php81/php.ini \ + ${ROOTDIR}etc/opt/remi/php82/php.ini" # HEADS-UP: OpenBSD, last two releases are supported, and snapshots of -current PHPINILOCS="${PHPINILOCS} \ ${ROOTDIR}etc/php-5.6.ini \ @@ -144,7 +183,10 @@ ${ROOTDIR}etc/php-7.1.ini \ ${ROOTDIR}etc/php-7.2.ini \ ${ROOTDIR}etc/php-7.3.ini \ - ${ROOTDIR}etc/php-7.4.ini" + ${ROOTDIR}etc/php-7.4.ini \ + ${ROOTDIR}etc/php-8.0.ini \ + ${ROOTDIR}etc/php-8.1.ini \ + ${ROOTDIR}etc/php-8.2.ini" PHPINIDIRS="${ROOTDIR}etc/php5/conf.d \ ${ROOTDIR}etc/php/7.0/cli/conf.d \ @@ -152,11 +194,17 @@ ${ROOTDIR}etc/php/7.2/cli/conf.d \ ${ROOTDIR}etc/php/7.3/cli/conf.d \ ${ROOTDIR}etc/php/7.4/cli/conf.d \ + ${ROOTDIR}etc/php/8.0/cli/conf.d \ + ${ROOTDIR}etc/php/8.1/cli/conf.d \ + ${ROOTDIR}etc/php/8.2/cli/conf.d \ ${ROOTDIR}etc/php/7.0/fpm/conf.d \ ${ROOTDIR}etc/php/7.1/fpm/conf.d \ ${ROOTDIR}etc/php/7.2/fpm/conf.d \ ${ROOTDIR}etc/php/7.3/fpm/conf.d \ ${ROOTDIR}etc/php/7.4/fpm/conf.d \ + ${ROOTDIR}etc/php/8.0/fpm/conf.d \ + ${ROOTDIR}etc/php/8.1/fpm/conf.d \ + ${ROOTDIR}etc/php/8.2/fpm/conf.d \ ${ROOTDIR}etc/php.d \ ${ROOTDIR}opt/cpanel/ea-php54/root/etc/php.d \ ${ROOTDIR}opt/cpanel/ea-php55/root/etc/php.d \ @@ -166,6 +214,9 @@ ${ROOTDIR}opt/cpanel/ea-php72/root/etc/php.d \ ${ROOTDIR}opt/cpanel/ea-php73/root/etc/php.d \ ${ROOTDIR}opt/cpanel/ea-php74/root/etc/php.d \ + ${ROOTDIR}opt/cpanel/ea-php80/root/etc/php.d \ + ${ROOTDIR}opt/cpanel/ea-php81/root/etc/php.d \ + ${ROOTDIR}opt/cpanel/ea-php82/root/etc/php.d \ ${ROOTDIR}opt/alt/php44/etc/php.d.all \ ${ROOTDIR}opt/alt/php51/etc/php.d.all \ ${ROOTDIR}opt/alt/php52/etc/php.d.all \ @@ -178,12 +229,18 @@ ${ROOTDIR}opt/alt/php72/etc/php.d.all \ ${ROOTDIR}opt/alt/php73/etc/php.d.all \ ${ROOTDIR}opt/alt/php74/etc/php.d.all \ + ${ROOTDIR}opt/alt/php80/etc/php.d.all \ + ${ROOTDIR}opt/alt/php81/etc/php.d.all \ + ${ROOTDIR}opt/alt/php82/etc/php.d.all \ ${ROOTDIR}usr/local/lib/php.conf.d \ ${ROOTDIR}usr/local/php70/lib/php.conf.d \ ${ROOTDIR}usr/local/php71/lib/php.conf.d \ ${ROOTDIR}usr/local/php72/lib/php.conf.d \ ${ROOTDIR}usr/local/php73/lib/php.conf.d \ - ${ROOTDIR}usr/local/php74/lib/php.conf.d" + ${ROOTDIR}usr/local/php74/lib/php.conf.d \ + ${ROOTDIR}usr/local/php80/lib/php.conf.d \ + ${ROOTDIR}usr/local/php81/lib/php.conf.d \ + ${ROOTDIR}usr/local/php82/lib/php.conf.d" # HEADS-UP: OpenBSD, last two releases are supported, and snapshots of -current PHPINIDIRS="${PHPINIDIRS} \ ${ROOTDIR}etc/php-5.6 \ @@ -191,7 +248,10 @@ ${ROOTDIR}etc/php-7.1 \ ${ROOTDIR}etc/php-7.2 \ ${ROOTDIR}etc/php-7.3 \ - ${ROOTDIR}etc/php-7.4" + ${ROOTDIR}etc/php-7.4 \ + ${ROOTDIR}etc/php-8.0 \ + ${ROOTDIR}etc/php-8.1 \ + ${ROOTDIR}etc/php-8.2" # ################################################################################# # From fd64aa24d64b1281c4d72bc63db80538988caffc Mon Sep 17 00:00:00 2001 From: xnoguer Date: Tue, 18 Apr 2023 16:46:19 -0400 Subject: [PATCH 016/108] Adding test MALW-3291 in order to solve issue 1322 (related to issue 994) --- db/tests.db | 1 + include/consts | 1 + include/tests_malware | 18 ++++++++++++++++++ 3 files changed, 20 insertions(+) diff --git a/db/tests.db b/db/tests.db index e4dc8fbd..206b6008 100644 --- a/db/tests.db +++ b/db/tests.db @@ -275,6 +275,7 @@ MALW-3284:test:security:malware::Check for clamd: MALW-3286:test:security:malware::Check for freshclam: MALW-3288:test:security:malware::Check for ClamXav: MALW-3290:test:security:malware::Presence of malware scanner: +MALW-3291:test:security:malware::Check for Microsoft Defender Antivirus: NAME-4016:test:security:nameservices::Check /etc/resolv.conf default domain: NAME-4018:test:security:nameservices::Check /etc/resolv.conf search domains: NAME-4020:test:security:nameservices::Check non default options: diff --git a/include/consts b/include/consts index 5d618429..714f4a92 100644 --- a/include/consts +++ b/include/consts @@ -169,6 +169,7 @@ ETC_PATHS="/etc /usr/local/etc" MACHINEID="" MACHINE_ROLE="" MALWARE_SCANNER_INSTALLED=0 + MDATPBINARY="" MIN_PASSWORD_LENGTH=-1 MONGODB_RUNNING=0 MOUNTBINARY="" diff --git a/include/tests_malware b/include/tests_malware index 40336fa5..04f7ea76 100644 --- a/include/tests_malware +++ b/include/tests_malware @@ -354,6 +354,24 @@ fi # ################################################################################# +# + # Test : MALW-3291 + # Description : Check if Microsoft Defender Antivirus is installed + Register --test-no MALW-3291 --weight L --network NO --category security --description "Check for mdatp" + if [ ${SKIPTEST} -eq 0 ]; then + LogText "Test: checking presence mdatp" + if [ ! "${MDATPBINARY}" = "" ]; then + Display --indent 2 --text "- Checking Microsoft Defender Antivirus" --result "${STATUS_FOUND}" --color GREEN + LogText "Result: Found ${MDATPBINARY}" + MALWARE_SCANNER_INSTALLED=1 + AddHP 2 2 + Report "malware_scanner[]=mdatp" + else + LogText "Result: mdatp couldn't be found" + fi + fi +# +################################################################################# # # Test : MALW-3286 # Description : Check running freshclam if clamd process is running From 6f1797fb59c23ad4f545ca5ef458ff56199d8152 Mon Sep 17 00:00:00 2001 From: xnoguer Date: Sun, 23 Apr 2023 17:38:21 -0400 Subject: [PATCH 017/108] Using grep -E --- include/binaries | 2 -- include/functions | 9 +++++++-- include/tests_authentication | 32 ++++++++++++++++---------------- include/tests_boot_services | 14 +++++++------- include/tests_containers | 2 +- include/tests_crypto | 4 ++-- include/tests_databases | 4 ++-- include/tests_file_integrity | 8 ++++---- include/tests_file_permissions | 2 +- include/tests_filesystems | 14 +++++++------- include/tests_firewalls | 6 +++--- include/tests_homedirs | 4 ++-- include/tests_insecure_services | 2 +- include/tests_kernel | 18 +++++++++--------- include/tests_logging | 24 ++++++++++++------------ include/tests_mail_messaging | 10 +++++----- include/tests_nameservices | 8 ++++---- include/tests_networking | 2 +- include/tests_php | 18 +++++++++--------- include/tests_ports_packages | 8 ++++---- include/tests_printers_spoolers | 6 +++--- include/tests_scheduling | 16 ++++++++-------- include/tests_shells | 2 +- include/tests_squid | 2 +- include/tests_ssh | 4 ++-- include/tests_storage | 8 ++++---- include/tests_time | 18 +++++++++--------- include/tests_tooling | 4 ++-- include/tests_usb | 12 ++++++------ include/tests_webservers | 6 +++--- 30 files changed, 136 insertions(+), 133 deletions(-) diff --git a/include/binaries b/include/binaries index 7aabba42..c8fdc1e2 100644 --- a/include/binaries +++ b/include/binaries @@ -169,7 +169,6 @@ domainname) DOMAINNAMEBINARY="${BINARY}"; LogText " Found known binary: domainname (NIS domain) - ${BINARY}" ;; dpkg) DPKGBINARY="${BINARY}"; LogText " Found known binary: dpkg (package management) - ${BINARY}" ;; xbps-query) XBPSBINARY="${BINARY}"; LogText " Found known binary: xbps (package management) - ${BINARY}" ;; - egrep) EGREPBINARY=${BINARY}; LogText " Found known binary: egrep (text search) - ${BINARY}" ;; equery) EQUERYBINARY="${BINARY}"; LogText " Found known binary: query (package manager) - ${BINARY}" ;; evmctl) EVMCTLBINARY=${BINARY}; LogText " Found known binary: evmctl (IMA/EVM tool) - ${BINARY}" ;; exim) EXIMBINARY="${BINARY}"; EXIMVERSION=$(${BINARY} -bV | grep 'Exim version' | awk '{ print $3 }' | xargs); LogText " Found known binary ${BINARY} (version ${EXIMVERSION})" ;; @@ -341,7 +340,6 @@ [ "${AWKBINARY:-}" ] || ExitFatal "awk binary not found" [ "${CAT_BINARY:-}" ] || ExitFatal "cat binary not found" [ "${CUTBINARY:-}" ] || ExitFatal "cut binary not found" - [ "${EGREPBINARY:-}" ] || ExitFatal "egrep binary not found" [ "${FINDBINARY:-}" ] || ExitFatal "find binary not found" [ "${GREPBINARY:-}" ] || ExitFatal "grep binary not found" [ "${HEADBINARY:-}" ] || ExitFatal "head binary not found" diff --git a/include/functions b/include/functions index 38cc46b3..841586be 100644 --- a/include/functions +++ b/include/functions @@ -1315,7 +1315,7 @@ return 2 else for CHECK_PERMISSION in ${CHECKPERMISSION_FULL}; do - DATA=$(echo ${CHECK_PERMISSION} | ${EGREPBINARY} "[rwx]") + DATA=$(echo ${CHECK_PERMISSION} | ${GREPBINARY} -E "[rwx]") if [ $? -eq 0 ]; then # add a dummy character as first character so it looks like output is a normal file CHECK_PERMISSION=$(echo "-${CHECK_PERMISSION}" | ${AWKBINARY} '{k=0;for(i=0;i<=8;i++)k+=((substr($1,i+2,1)~/[rwx]/)*2^(8-i));if(k)printf("%0o",k)}') @@ -1608,7 +1608,7 @@ # This search is not foolproof LogText "Performing simple ps scan (busybox)" PSOPTIONS=" -o args=" - FIND=$(${PSBINARY:-ps} ${PSOPTIONS} | ${EGREPBINARY:-egrep} "( |/)${search}" | ${GREPBINARY:-grep} -v "grep") + FIND=$(${PSBINARY:-ps} ${PSOPTIONS} | ${GREPBINARY:-grep} -E "( |/)${search}" | ${GREPBINARY:-grep} -v "grep") else if [ -n "${users}" ]; then for u in ${users}; do @@ -3103,6 +3103,11 @@ unsafe=1 LogText "Security alert: file is not owned by active user, but can write to it" fi + # File is not owned by active user, and not readable by him + if [ ! -O "${FILE}" -a ! -r "${FILE}" ]; then + unsafe=1 + LogText "Security alert: file is not readable by active user" + fi fi # Check file permissions diff --git a/include/tests_authentication b/include/tests_authentication index 0552d646..3ec54d64 100644 --- a/include/tests_authentication +++ b/include/tests_authentication @@ -42,9 +42,9 @@ LogText "Test: Searching accounts with UID 0" # Check if device is a QNAP, as the root user is called admin, and not root if [ ${QNAP_DEVICE} -eq 1 ]; then - FIND=$(${GREPBINARY} ':0:' ${ROOTDIR}etc/passwd | ${EGREPBINARY} -v '^#|^admin:|^(\+:\*)?:0:0:::' | ${CUTBINARY} -d ":" -f1,3 | ${GREPBINARY} ':0') + FIND=$(${GREPBINARY} ':0:' ${ROOTDIR}etc/passwd | ${GREPBINARY} -E -v '^#|^admin:|^(\+:\*)?:0:0:::' | ${CUTBINARY} -d ":" -f1,3 | ${GREPBINARY} ':0') else - FIND=$(${GREPBINARY} ':0:' ${ROOTDIR}etc/passwd | ${EGREPBINARY} -v '^#|^root:|^(\+:\*)?:0:0:::' | ${CUTBINARY} -d ":" -f1,3 | ${GREPBINARY} ':0') + FIND=$(${GREPBINARY} ':0:' ${ROOTDIR}etc/passwd | ${GREPBINARY} -E -v '^#|^root:|^(\+:\*)?:0:0:::' | ${CUTBINARY} -d ":" -f1,3 | ${GREPBINARY} ':0') fi if [ -n "${FIND}" ]; then Display --indent 2 --text "- Administrator accounts" --result "${STATUS_WARNING}" --color RED @@ -163,7 +163,7 @@ LogText "Test: Checking login shells" if [ -f ${ROOTDIR}etc/master.passwd ]; then # Check for all shells, except: (/usr)/sbin/nologin /nonexistent - FIND=$(${GREPBINARY} "[a-z]:\*:" ${ROOTDIR}etc/master.passwd | ${EGREPBINARY} -v '^#|/sbin/nologin|/usr/sbin/nologin|/nonexistent' | ${SEDBINARY} 's/ /!space!/g') + FIND=$(${GREPBINARY} "[a-z]:\*:" ${ROOTDIR}etc/master.passwd | ${GREPBINARY} -E -v '^#|/sbin/nologin|/usr/sbin/nologin|/nonexistent' | ${SEDBINARY} 's/ /!space!/g') if [ -z "${FIND}" ]; then Display --indent 2 --text "- Login shells" --result "${STATUS_OK}" --color GREEN else @@ -499,13 +499,13 @@ Register --test-no AUTH-9240 --weight L --network NO --category security --description "Query NIS+ authentication support" if [ ${SKIPTEST} -eq 0 ]; then if [ -f /etc/nsswitch.conf ]; then - FIND=$(${EGREPBINARY} "^passwd" /etc/nsswitch.conf | ${EGREPBINARY} "compat|nisplus") + FIND=$(${GREPBINARY} -E "^passwd" /etc/nsswitch.conf | ${GREPBINARY} -E "compat|nisplus") if [ -z "${FIND}" ]; then LogText "Result: NIS+ authentication not enabled" Display --indent 2 --text "- NIS+ authentication support" --result "${STATUS_NOT_ENABLED}" --color WHITE else - FIND2=$(${EGREPBINARY} "^passwd_compat" ${ROOTDIR}etc/nsswitch.conf | ${GREPBINARY} "nisplus") - FIND3=$(${EGREPBINARY} "^passwd" ${ROOTDIR}etc/nsswitch.conf | ${GREPBINARY} "nisplus") + FIND2=$(${GREPBINARY} -E "^passwd_compat" ${ROOTDIR}etc/nsswitch.conf | ${GREPBINARY} "nisplus") + FIND3=$(${GREPBINARY} -E "^passwd" ${ROOTDIR}etc/nsswitch.conf | ${GREPBINARY} "nisplus") if [ -n "${FIND2}" -o -n "${FIND3}" ]; then LogText "Result: NIS+ authentication enabled" Display --indent 2 --text "- NIS+ authentication support" --result "${STATUS_ENABLED}" --color GREEN @@ -526,13 +526,13 @@ Register --test-no AUTH-9242 --weight L --network NO --category security --description "Query NIS authentication support" if [ ${SKIPTEST} -eq 0 ]; then if [ -f /etc/nsswitch.conf ]; then - FIND=$(${EGREPBINARY} "^passwd" /etc/nsswitch.conf | ${EGREPBINARY} "compat|nis" | ${GREPBINARY} -v "nisplus") + FIND=$(${GREPBINARY} -E "^passwd" /etc/nsswitch.conf | ${GREPBINARY} -E "compat|nis" | ${GREPBINARY} -v "nisplus") if [ -z "${FIND}" ]; then LogText "Result: NIS authentication not enabled" Display --indent 2 --text "- NIS authentication support" --result "${STATUS_NOT_ENABLED}" --color WHITE else - FIND2=$(${EGREPBINARY} "^passwd_compat" /etc/nsswitch.conf | ${GREPBINARY} "nis" | ${GREPBINARY} -v "nisplus") - FIND3=$(${EGREPBINARY} "^passwd" /etc/nsswitch.conf | ${GREPBINARY} "nis" | ${GREPBINARY} -v "nisplus") + FIND2=$(${GREPBINARY} -E "^passwd_compat" /etc/nsswitch.conf | ${GREPBINARY} "nis" | ${GREPBINARY} -v "nisplus") + FIND3=$(${GREPBINARY} -E "^passwd" /etc/nsswitch.conf | ${GREPBINARY} "nis" | ${GREPBINARY} -v "nisplus") if [ -n "${FIND2}" -o -n "${FIND3}" ]; then LogText "Result: NIS authentication enabled" Display --indent 2 --text "- NIS authentication support" --result "${STATUS_ENABLED}" --color GREEN @@ -737,7 +737,7 @@ LogText "Result: file ${ROOTDIR}etc/pam.conf exists" Display --indent 2 --text "- PAM configuration files (pam.conf)" --result "${STATUS_FOUND}" --color GREEN LogText "Test: searching PAM configuration files" - FIND=$(${EGREPBINARY} -v "^#" ${ROOTDIR}etc/pam.conf | ${EGREPBINARY} -v "^$" | ${SEDBINARY} 's/[[:space:]]/ /g' | ${SEDBINARY} 's/ / /g' | ${SEDBINARY} 's/ /:space:/g') + FIND=$(${GREPBINARY} -E -v "^#" ${ROOTDIR}etc/pam.conf | ${GREPBINARY} -E -v "^$" | ${SEDBINARY} 's/[[:space:]]/ /g' | ${SEDBINARY} 's/ / /g' | ${SEDBINARY} 's/ /:space:/g') if [ -z "${FIND}" ]; then LogText "Result: File has no configuration options defined (empty, or only filled with comments and empty lines)" else @@ -1017,7 +1017,7 @@ LogText "Data: Days since epoch is ${DAYS_SINCE_EPOCH}" LogText "Test: collecting accounts which have an expired password (last day changed + maximum change time)" # Skip fields with a !, *, or x, or !* (field $3 is last changed, $5 is maximum changed) - FIND=$(${EGREPBINARY} -v ":[\!\*x]([\*\!])?:" /etc/shadow | ${AWKBINARY} -v today=${DAYS_SINCE_EPOCH} -F: '{ if (($5!="") && (today>$3+$5)) { print $1 }}') + FIND=$(${GREPBINARY} -E -v ":[\!\*x]([\*\!])?:" /etc/shadow | ${AWKBINARY} -v today=${DAYS_SINCE_EPOCH} -F: '{ if (($5!="") && (today>$3+$5)) { print $1 }}') if [ -n "${FIND}" ]; then for ACCOUNT in ${FIND}; do LogText "Result: password of user ${ACCOUNT} has been expired" @@ -1109,8 +1109,8 @@ TEST_PERFORMED=1 LogText "Result: file ${ROOTDIR}etc/inittab exists" LogText "Test: checking presence sulogin for single user mode" - FIND=$(${EGREPBINARY} "^[a-zA-Z0-9~]+:S:(respawn|wait):/sbin/sulogin" /etc/inittab) - FIND2=$(${EGREPBINARY} "^su:S:(respawn|wait):/sbin/sulogin" /etc/inittab) + FIND=$(${GREPBINARY} -E "^[a-zA-Z0-9~]+:S:(respawn|wait):/sbin/sulogin" /etc/inittab) + FIND2=$(${GREPBINARY} -E "^su:S:(respawn|wait):/sbin/sulogin" /etc/inittab) if [ -n "${FIND}" -o -n "${FIND2}" ]; then FOUND=1 LogText "Result: found sulogin, so single user is protected" @@ -1147,7 +1147,7 @@ # Mark test as performed only when at least 1 target exists (e.g. Ubuntu 14.04 has limited systemd support) TEST_PERFORMED=1 LogText "Result: found target ${I}" - FIND=$(${EGREPBINARY} "^ExecStart=" ${FILE} | ${GREPBINARY} "sulogin") + FIND=$(${GREPBINARY} -E "^ExecStart=" ${FILE} | ${GREPBINARY} "sulogin") if [ "${FIND}" = "" ]; then LogText "Result: did not find sulogin specified, possible risk of getting into single user mode without authentication" else @@ -1486,7 +1486,7 @@ Register --test-no AUTH-9402 --weight L --network NO --category security --description "Query LDAP authentication support" if [ ${SKIPTEST} -eq 0 ]; then if [ -f ${ROOTDIR}etc/nsswitch.conf ]; then - FIND=$(${EGREPBINARY} "^passwd" ${ROOTDIR}etc/nsswitch.conf | ${GREPBINARY} "ldap") + FIND=$(${GREPBINARY} -E "^passwd" ${ROOTDIR}etc/nsswitch.conf | ${GREPBINARY} "ldap") if [ "${FIND}" = "" ]; then LogText "Result: LDAP authentication not enabled" Display --indent 2 --text "- LDAP authentication support" --result "${STATUS_NOT_ENABLED}" --color WHITE @@ -1514,7 +1514,7 @@ LogText "Result: file ${FILE} exists, LDAP being used" LDAP_CLIENT_CONFIG_FILE="${FILE}" LogText "Test: checking LDAP servers in file ${FILE}" - FIND=$(${EGREPBINARY} "^host " ${FILE} | ${AWKBINARY} '{ print $2 }') + FIND=$(${GREPBINARY} -E "^host " ${FILE} | ${AWKBINARY} '{ print $2 }') for SERVER in ${FIND}; do Display --indent 6 --text "LDAP server: ${SERVER}" LogText "Result: found LDAP server ${SERVER}" diff --git a/include/tests_boot_services b/include/tests_boot_services index 5901cd70..967b98a6 100644 --- a/include/tests_boot_services +++ b/include/tests_boot_services @@ -460,7 +460,7 @@ BOOT_LOADER_FOUND=1 Display --indent 2 --text "- Checking presence LILO" --result "${STATUS_OK}" --color GREEN LogText "Checking password option LILO" - FIND=$(${EGREPBINARY} 'password[[:space:]]?=' ${LILOCONFFILE} | ${GREPBINARY} -v "^#") + FIND=$(${GREPBINARY} -E 'password[[:space:]]?=' ${LILOCONFFILE} | ${GREPBINARY} -v "^#") if [ -z "${FIND}" ]; then if [ "${MACHINE_ROLE}" = "server" -o "${MACHINE_ROLE}" = "workstation" ]; then Display --indent 4 --text "- Password option presence " --result "${STATUS_WARNING}" --color RED @@ -605,7 +605,7 @@ else # FreeBSD (Read /etc/rc.conf file for enabled services) LogText "Searching for services at startup (rc.conf)" - FIND=$(${EGREPBINARY} -v -i '^#|none' ${ROOTDIR}etc/rc.conf | ${EGREPBINARY} -i '_enable.*(yes|on|1)' | ${SORTBINARY} | ${AWKBINARY} -F= '{ print $1 }' | ${SEDBINARY} 's/_enable//') + FIND=$(${GREPBINARY} -E -v -i '^#|none' ${ROOTDIR}etc/rc.conf | ${GREPBINARY} -E -i '_enable.*(yes|on|1)' | ${SORTBINARY} | ${AWKBINARY} -F= '{ print $1 }' | ${SEDBINARY} 's/_enable//') fi COUNT=0 for ITEM in ${FIND}; do @@ -715,7 +715,7 @@ if [ -n "${CHKCONFIGBINARY}" ]; then LogText "Result: chkconfig binary found, trying that to discover information" LogText "Searching for services at startup (chkconfig, runlevel 3 and 5)" - FIND=$(${CHKCONFIGBINARY} --list | ${EGREPBINARY} '3:on|5:on' | ${AWKBINARY} '{ print $1 }') + FIND=$(${CHKCONFIGBINARY} --list | ${GREPBINARY} -E '3:on|5:on' | ${AWKBINARY} '{ print $1 }') COUNT=0 Report "boot_service_tool=chkconfig" for ITEM in ${FIND}; do @@ -947,7 +947,7 @@ if [ -f ${ROOTDIR}usr/lib/systemd/system/rescue.service ]; then LogText "Result: file /usr/lib/systemd/system/rescue.service" LogText "Test: checking presence sulogin for single user mode" - FIND=$(${EGREPBINARY} "^ExecStart=.*sulogin" ${ROOTDIR}usr/lib/systemd/system/rescue.service) + FIND=$(${GREPBINARY} -E "^ExecStart=.*sulogin" ${ROOTDIR}usr/lib/systemd/system/rescue.service) if [ -n "${FIND}" ]; then FOUND=1 LogText "Result: found sulogin, so single user is protected" @@ -981,14 +981,14 @@ Report "running_service[]=${ITEM}" COUNT=$((COUNT + 1 )) done - LogText "Note: Run rcctl ls all | egrep '^(pf|check_quotas|library_aslr)$' to see all daemons" + LogText "Note: Run rcctl ls all | grep -E '^(pf|check_quotas|library_aslr)$' to see all daemons" Display --indent 2 --text "- Check running daemons (rcctl)" --result "${STATUS_DONE}" --color GREEN Display --indent 8 --text "Result: found ${COUNT} running daemons" LogText "Result: Found ${COUNT} running daemons" # OpenBSD (Ask rcctl(8) for enabled daemons) LogText "Searching for enabled daemons (rcctl)" - FIND=$(${RCCTLBINARY} ls on | ${EGREPBINARY} -v '^(pf|check_quotas|library_aslr)$') + FIND=$(${RCCTLBINARY} ls on | ${GREPBINARY} -E -v '^(pf|check_quotas|library_aslr)$') COUNT=0 Report "boot_service_tool=rcctl" for ITEM in ${FIND}; do @@ -996,7 +996,7 @@ Report "boot_service[]=${ITEM}" COUNT=$((COUNT + 1 )) done - LogText "Note: Run rcctl ls all | egrep '^(pf|check_quotas|library_aslr)$' to see all daemons" + LogText "Note: Run rcctl ls all | grep -E '^(pf|check_quotas|library_aslr)$' to see all daemons" Display --indent 2 --text "- Check enabled daemons at boot (rcctl)" --result "${STATUS_DONE}" --color GREEN Display --indent 8 --text "Result: found ${COUNT} enabled daemons at boot" LogText "Result: Found ${COUNT} enabled daemons at boot" diff --git a/include/tests_containers b/include/tests_containers index af10997d..a02ea268 100644 --- a/include/tests_containers +++ b/include/tests_containers @@ -137,7 +137,7 @@ # Check total of containers LogText "Test: checking total amount of Docker containers" - DOCKER_CONTAINERS_TOTAL=$(${DOCKERBINARY} info 2> /dev/null | ${EGREPBINARY} "^[ \t]?Containers: " | ${AWKBINARY} '{ print $2 }') + DOCKER_CONTAINERS_TOTAL=$(${DOCKERBINARY} info 2> /dev/null | ${GREPBINARY} -E "^[ \t]?Containers: " | ${AWKBINARY} '{ print $2 }') if [ -z "${DOCKER_CONTAINERS_TOTAL}" ]; then DOCKER_CONTAINERS_TOTAL=0 fi diff --git a/include/tests_crypto b/include/tests_crypto index 89ad1e62..a643b6c0 100644 --- a/include/tests_crypto +++ b/include/tests_crypto @@ -54,7 +54,7 @@ LASTSUBDIR="" LogText "Result: found directory ${DIR}" # Search for certificate files - FILES=$(${FINDBINARY} ${DIR} -type f 2> /dev/null | ${EGREPBINARY} ".cer$|.crt$|.der$|.pem$|^cert" | ${SORTBINARY} | ${SEDBINARY} 's/ /__space__/g') + FILES=$(${FINDBINARY} ${DIR} -type f 2> /dev/null | ${GREPBINARY} -E ".cer$|.crt$|.der$|.pem$|^cert" | ${SORTBINARY} | ${SEDBINARY} 's/ /__space__/g') for FILE in ${FILES}; do FILE=$(echo ${FILE} | ${SEDBINARY} 's/__space__/ /g') # See if we need to skip this path @@ -80,7 +80,7 @@ if [ ${CANREAD} -eq 1 ]; then # Only check the files that are not installed by a package, unless enabled by profile if [ ${SSL_CERTIFICATE_INCLUDE_PACKAGES} -eq 1 ] || ! FileInstalledByPackage "${FILE}"; then - echo ${FILE} | ${EGREPBINARY} -q ".cer$|.der$" + echo ${FILE} | ${GREPBINARY} -E -q ".cer$|.der$" CER_DER=$? OUTPUT=$(${GREPBINARY} -q 'BEGIN CERT' "${FILE}") if [ $? -eq 0 -o ${CER_DER} -eq 0 ]; then diff --git a/include/tests_databases b/include/tests_databases index e973d23f..181dac6c 100644 --- a/include/tests_databases +++ b/include/tests_databases @@ -45,7 +45,7 @@ # Description : Check if MySQL is being used Register --test-no DBS-1804 --weight L --network NO --category security --description "Checking active MySQL process" if [ ${SKIPTEST} -eq 0 ]; then - FIND=$(${PSBINARY} ax | ${EGREPBINARY} "mariadb|mysqld|mysqld_safe" | ${GREPBINARY} -v "grep") + FIND=$(${PSBINARY} ax | ${GREPBINARY} -E "mariadb|mysqld|mysqld_safe" | ${GREPBINARY} -v "grep") if [ -z "${FIND}" ]; then if [ ${DEBUG} -eq 1 ]; then Display --indent 2 --text "- MySQL process status" --result "${STATUS_NOT_FOUND}" --color WHITE --debug; fi LogText "Result: MySQL process not active" @@ -244,7 +244,7 @@ # reco: recovery (optional) Register --test-no DBS-1840 --weight L --network NO --category security --description "Checking active Oracle processes" if [ ${SKIPTEST} -eq 0 ]; then - FIND=$(${PSBINARY} ax | ${EGREPBINARY} "ora_pmon|ora_smon|tnslsnr" | ${GREPBINARY} -v "grep") + FIND=$(${PSBINARY} ax | ${GREPBINARY} -E "ora_pmon|ora_smon|tnslsnr" | ${GREPBINARY} -v "grep") if [ -z "${FIND}" ]; then if [ ${DEBUG} -eq 1 ]; then Display --indent 2 --text "- Oracle processes status" --result "${STATUS_NOT_FOUND}" --color WHITE --debug; fi LogText "Result: Oracle process(es) not active" diff --git a/include/tests_file_integrity b/include/tests_file_integrity index 8a38b97e..daf49196 100644 --- a/include/tests_file_integrity +++ b/include/tests_file_integrity @@ -104,7 +104,7 @@ if [ -n "${AIDEBINARY}" -a -n "${AIDECONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi Register --test-no FINT-4316 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Presence of AIDE database and size check" if [ ${SKIPTEST} -eq 0 ]; then - AIDE_DB=$(${EGREPBINARY} '(^database|^database_in)=' ${AIDECONFIG} | ${SEDBINARY} "s/.*://") + AIDE_DB=$(${GREPBINARY} -E '(^database|^database_in)=' ${AIDECONFIG} | ${SEDBINARY} "s/.*://") if case ${AIDE_DB} in @@*) ;; *) false;; esac; then I=$(${GREPBINARY} "@@define.*DBDIR" ${AIDECONFIG} | ${AWKBINARY} '{print $3}') AIDE_DB=$(echo ${AIDE_DB} | ${SEDBINARY} "s#.*}#${I}#") @@ -330,7 +330,7 @@ ROOTDEVICE=$(${MOUNTBINARY} | ${AWKBINARY} '/ on \/ type / { print $1 }') for DEVICE in /dev/mapper/*; do if [ -e "${DEVICE}" ]; then - FIND=$(${INTEGRITYSETUPBINARY} status "${DEVICE}" | ${EGREPBINARY} 'type:.*INTEGRITY') + FIND=$(${INTEGRITYSETUPBINARY} status "${DEVICE}" | ${GREPBINARY} -E 'type:.*INTEGRITY') if [ ! -z "${FIND}" ]; then FOUND=1 LogText "Result: found dm-integrity device ${DEVICE}" @@ -370,7 +370,7 @@ ROOTDEVICE=$(${MOUNTBINARY} | ${AWKBINARY} '/ on \/ type / { print $1 }') for DEVICE in /dev/mapper/*; do if [ -e "${DEVICE}" ]; then - FIND=$(${VERITYSETUPBINARY} status "${DEVICE}" | ${EGREPBINARY} 'type:.*VERITY') + FIND=$(${VERITYSETUPBINARY} status "${DEVICE}" | ${GREPBINARY} -E 'type:.*VERITY') if [ ! -z "${FIND}" ]; then FOUND=1 LogText "Result: found dm-verity device ${DEVICE}" @@ -404,7 +404,7 @@ if [ ! "${AIDEBINARY}" = "" -a -n "${AIDECONFIG}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi Register --test-no FINT-4402 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "AIDE configuration: Checksums (SHA256 or SHA512)" if [ ${SKIPTEST} -eq 0 ]; then - FIND=$(${GREPBINARY} -v "^#" ${AIDECONFIG} | ${EGREPBINARY} "= .*(sha256|sha512)") + FIND=$(${GREPBINARY} -v "^#" ${AIDECONFIG} | ${GREPBINARY} -E "= .*(sha256|sha512)") if [ -z "${FIND}" ]; then LogText "Result: No SHA256 or SHA512 found for creating checksums" Display --indent 6 --text "- AIDE config (Checksum)" --result Suggestion --color YELLOW diff --git a/include/tests_file_permissions b/include/tests_file_permissions index 32598f45..924dad12 100644 --- a/include/tests_file_permissions +++ b/include/tests_file_permissions @@ -35,7 +35,7 @@ FOUND=0 for PROFILE in ${PROFILES}; do LogText "Using profile ${PROFILE} for baseline." - FILES=$(${EGREPBINARY} '^permfile=|^permdir=' ${PROFILE} | ${CUTBINARY} -d= -f2 | ${CUTBINARY} -d: -f1) + FILES=$(${GREPBINARY} -E '^permfile=|^permdir=' ${PROFILE} | ${CUTBINARY} -d= -f2 | ${CUTBINARY} -d: -f1) for F in ${FILES}; do LogText "Test: checking file/directory ${F}" if [ -f "${F}" ]; then diff --git a/include/tests_filesystems b/include/tests_filesystems index ab6191aa..93af33ed 100644 --- a/include/tests_filesystems +++ b/include/tests_filesystems @@ -356,7 +356,7 @@ # Proc should be mounted with 'hidepid=2' or 'hidepid=1' at least # https://www.kernel.org/doc/html/latest/filesystems/proc.html#chapter-4-configuring-procfs LogText "Test: check proc mount with incorrect mount options" - FIND=$(${MOUNTBINARY} | ${EGREPBINARY} "${ROOTDIR}proc " | ${EGREPBINARY} -o "hidepid=([0-9]|[a-z][a-z]*)") + FIND=$(${MOUNTBINARY} | ${GREPBINARY} -E "${ROOTDIR}proc " | ${GREPBINARY} -E -o "hidepid=([0-9]|[a-z][a-z]*)") if [ "${FIND}" = "hidepid=4" -o "${FIND}" = "hidepid=ptraceable" ]; then # https://lwn.net/Articles/817137/ Display --indent 2 --text "- Testing /proc mount (hidepid)" --result "${STATUS_OK}" --color GREEN LogText "Result: proc mount mounted with ${FIND}" @@ -504,7 +504,7 @@ fi LogText "Test: Checking acl option on xfs root file system" - FIND=$(${MOUNTBINARY} | ${AWKBINARY} '{ if ($3=="/" && $5~/xfs/) { print $6 } }' | ${EGREPBINARY} 'no_acl|no_user_xattr') + FIND=$(${MOUNTBINARY} | ${AWKBINARY} '{ if ($3=="/" && $5~/xfs/) { print $6 } }' | ${GREPBINARY} -E 'no_acl|no_user_xattr') if [ -z "${FIND}" ]; then FOUND=1 # some other tests to do ? @@ -638,7 +638,7 @@ NDEVMOUNTS=$(mount | ${AWKBINARY} '{print $6}' | ${GREPBINARY} -v nodev | ${WCBINARY} -l) NEXECMOUNTS=$(mount | ${AWKBINARY} '{print $6}' | ${GREPBINARY} -v noexec | ${WCBINARY} -l) NSUIDMOUNTS=$(mount | ${AWKBINARY} '{print $6}' | ${GREPBINARY} -v nosuid | ${WCBINARY} -l) - NWRITEANDEXECMOUNTS=$(mount | ${AWKBINARY} '{print $6}' | ${GREPBINARY} -v noexec | ${EGREPBINARY} -v '^\(ro[,)]' | ${WCBINARY} -l) + NWRITEANDEXECMOUNTS=$(mount | ${AWKBINARY} '{print $6}' | ${GREPBINARY} -v noexec | ${GREPBINARY} -E -v '^\(ro[,)]' | ${WCBINARY} -l) LogText "Result: Total without nodev:${NDEVMOUNTS} noexec:${NEXECMOUNTS} nosuid:${NSUIDMOUNTS} ro or noexec (W^X): ${NWRITEANDEXECMOUNTS}, of total ${NMOUNTS}" Display --indent 2 --text "- Total without nodev:${NDEVMOUNTS} noexec:${NEXECMOUNTS} nosuid:${NSUIDMOUNTS} ro or noexec (W^X): ${NWRITEANDEXECMOUNTS} of total ${NMOUNTS}" fi @@ -814,13 +814,13 @@ AVAILABLE_MODPROBE_FS="" for FS in ${LIST_FS_NOT_SUPPORTED}; do # Check if filesystem is present in modprobe output - FIND=$(${MODPROBEBINARY} -v -n ${FS} 2>/dev/null | ${EGREPBINARY} "/${FS}.ko" | ${TAILBINARY} -1) + FIND=$(${MODPROBEBINARY} -v -n ${FS} 2>/dev/null | ${GREPBINARY} -E "/${FS}.ko" | ${TAILBINARY} -1) if [ -n "${FIND}" ]; then LogText "Result: found ${FS} support in the kernel (output = ${FIND})" Debug "Module ${FS} present in the kernel" LogText "Test: Checking if ${FS} is active" # Check if FS is present in lsmod output - FIND=$(${LSMODBINARY} | ${EGREPBINARY} "^${FS}") + FIND=$(${LSMODBINARY} | ${GREPBINARY} -E "^${FS}") if IsEmpty "${FIND}"; then LogText "Result: module ${FS} is currently not loaded in the kernel." AddHP 2 3 @@ -837,8 +837,8 @@ fi FIND=$(${LSBINARY} ${ROOTDIR}etc/modprobe.d/* 2> /dev/null) if [ -n "${FIND}" ]; then - FIND1=$(${EGREPBINARY} "^blacklist \+${FS}$" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#") - FIND2=$(${EGREPBINARY} "^install \+${FS} \+/bin/true$" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#") + FIND1=$(${GREPBINARY} -E "^blacklist \+${FS}$" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#") + FIND2=$(${GREPBINARY} -E "^install \+${FS} \+/bin/true$" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#") if [ -n "${FIND1}" ] || [ -n "${FIND2}" ]; then Display --indent 4 --text "- Module $FS is blacklisted" --result "OK" --color GREEN LogText "Result: module ${FS} is blacklisted" diff --git a/include/tests_firewalls b/include/tests_firewalls index 44d6c441..6852b536 100644 --- a/include/tests_firewalls +++ b/include/tests_firewalls @@ -112,7 +112,7 @@ TABLES="filter" for TABLE in ${TABLES}; do LogText "Test: gathering information from table ${TABLE}" - FIND="$FIND""\n"$(${IPTABLESBINARY} -t ${TABLE} --numeric --list | ${EGREPBINARY} -z -o -w '[A-Z]+' | tr -d '\0' | ${AWKBINARY} -v t=${TABLE} 'NR%2 {printf "%s %s ",t, $0 ; next;}1') + FIND="$FIND""\n"$(${IPTABLESBINARY} -t ${TABLE} --numeric --list | ${GREPBINARY} -E -z -o -w '[A-Z]+' | tr -d '\0' | ${AWKBINARY} -v t=${TABLE} 'NR%2 {printf "%s %s ",t, $0 ; next;}1') done echo "${FIND}" | while read -r line; do @@ -154,7 +154,7 @@ if [ -n "${IPTABLESBINARY}" -a ${IPTABLES_ACTIVE} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi Register --test-no FIRE-4512 --preqs-met ${PREQS_MET} --os Linux --weight L --network NO --root-only YES --category security --description "Check iptables for empty ruleset" if [ ${SKIPTEST} -eq 0 ]; then - FIND=$(${IPTABLESBINARY} --list --numeric 2> /dev/null | ${EGREPBINARY} -v "^(Chain|target|$)" | ${WCBINARY} -l | ${TRBINARY} -d ' ') + FIND=$(${IPTABLESBINARY} --list --numeric 2> /dev/null | ${GREPBINARY} -E -v "^(Chain|target|$)" | ${WCBINARY} -l | ${TRBINARY} -d ' ') if [ -n "${FIND}" ]; then FIREWALL_ACTIVE=1 if [ ${FIND} -le 5 ]; then @@ -506,7 +506,7 @@ Register --test-no FIRE-4540 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --root-only YES --category security --description "Check for empty nftables configuration" if [ ${SKIPTEST} -eq 0 ]; then # Check for empty ruleset - NFT_RULES_LENGTH=$(${NFTBINARY} --stateless list ruleset 2> /dev/null | ${EGREPBINARY} -v "table|chain|;$|}$|^$" | ${WCBINARY} -l) + NFT_RULES_LENGTH=$(${NFTBINARY} --stateless list ruleset 2> /dev/null | ${GREPBINARY} -E -v "table|chain|;$|}$|^$" | ${WCBINARY} -l) if [ ${NFT_RULES_LENGTH} -le 3 ]; then FIREWALL_EMPTY_RULESET=1 LogText "Result: this firewall set has 3 rules or less and is considered to be empty" diff --git a/include/tests_homedirs b/include/tests_homedirs index 3e5f1b78..77de47f4 100644 --- a/include/tests_homedirs +++ b/include/tests_homedirs @@ -57,7 +57,7 @@ if [ ${SKIPTEST} -eq 0 ]; then # Check if users' home directories permissions are 750 or more restrictive FOUND=0 - USERDATA=$(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }') + USERDATA=$(${GREPBINARY} -E -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }') while read -r LINE; do USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1) DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6) @@ -93,7 +93,7 @@ EOF if [ ${SKIPTEST} -eq 0 ]; then # Check if users own their home directories FOUND=0 - USERDATA=$(${EGREPBINARY} -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }') + USERDATA=$(${GREPBINARY} -E -v '^(daemon|git|halt|root|shutdown|sync)' ${ROOTDIR}etc/passwd | ${AWKBINARY} -F: '($7 !~ "/(false|nologin)$") { print }') while read -r LINE; do USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1) DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6) diff --git a/include/tests_insecure_services b/include/tests_insecure_services index f01966f2..c86070c0 100644 --- a/include/tests_insecure_services +++ b/include/tests_insecure_services @@ -298,7 +298,7 @@ #if [ ${SKIPTEST} -eq 0 ]; then # # Check presence of Rsh Trust Files # FOUND=0 - # for LINE in $(${CAT_BINARY} /etc/passwd | ${EGREPBINARY} -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }'); do + # for LINE in $(${CAT_BINARY} /etc/passwd | ${GREPBINARY} -E -v '^(root|halt|sync|shutdown)' | ${AWKBINARY} -F: '($7 !="/sbin/nologin" && $7 != "/bin/false") { print }'); do # USER=$(echo ${LINE} | ${CUTBINARY} -d: -f1) # DIR=$(echo ${LINE} | ${CUTBINARY} -d: -f6) # if [ -d ${DIR} ]; then diff --git a/include/tests_kernel b/include/tests_kernel index ad914bfb..bba8080f 100644 --- a/include/tests_kernel +++ b/include/tests_kernel @@ -49,7 +49,7 @@ LogText "Exception: can't find the target of the symlink of /etc/systemd/system/default.target" ReportException "${TEST_NO}:01" else - FIND2=$(${ECHOCMD} ${FIND} | ${EGREPBINARY} "runlevel5|graphical") + FIND2=$(${ECHOCMD} ${FIND} | ${GREPBINARY} -E "runlevel5|graphical") if HasData "${FIND2}"; then LogText "Result: Found match on runlevel5/graphical" Display --indent 2 --text "- Checking default runlevel" --result "runlevel 5" --color GREEN @@ -401,7 +401,7 @@ elif [ -e ${ROOTDIR}etc/rpi-issue ]; then FINDKERNEL="raspberrypi-kernel" LogText "Result: ${ROOTDIR}vmlinuz missing due to Raspbian" - elif $(${EGREPBINARY} -q 'do_symlinks.*=.*No' ${ROOTDIR}etc/kernel-img.conf); then + elif $(${GREPBINARY} -E -q 'do_symlinks.*=.*No' ${ROOTDIR}etc/kernel-img.conf); then FINDKERNEL="linux-image-$(uname -r)" LogText "Result: ${ROOTDIR}vmlinuz missing due to /etc/kernel-img.conf item do_symlinks = No" else @@ -414,8 +414,8 @@ else LogText "Result: found kernel '${FINDKERNEL}' which will be used for further testing" LogText "Test: Using apt-cache policy to determine if there is an update available" - FINDINSTALLED=$(apt-cache policy ${FINDKERNEL} | ${EGREPBINARY} 'Installed' | ${CUTBINARY} -d ':' -f2 | ${TRBINARY} -d ' ') - FINDCANDIDATE=$(apt-cache policy ${FINDKERNEL} | ${EGREPBINARY} 'Candidate' | ${CUTBINARY} -d ':' -f2 | ${TRBINARY} -d ' ') + FINDINSTALLED=$(apt-cache policy ${FINDKERNEL} | ${GREPBINARY} -E 'Installed' | ${CUTBINARY} -d ':' -f2 | ${TRBINARY} -d ' ') + FINDCANDIDATE=$(apt-cache policy ${FINDKERNEL} | ${GREPBINARY} -E 'Candidate' | ${CUTBINARY} -d ':' -f2 | ${TRBINARY} -d ' ') LogText "Kernel installed: ${FINDINSTALLED}" LogText "Kernel candidate: ${FINDCANDIDATE}" if IsEmpty "${FINDINSTALLED}"; then @@ -826,7 +826,7 @@ LogText "Check: try to find raspberrypi-kernel file in ${APT_ARCHIVE_DIRECTORY} and extract package date from file name" FOUND_KERNEL_DATE=$(${FINDBINARY} ${APT_ARCHIVE_DIRECTORY} -name "raspberrypi-kernel*" -printf "%T@ %Tc %p\n" 2> /dev/null \ - | ${SORTBINARY} -nr | ${HEADBINARY} -1 | ${GREPBINARY} -o "raspberrypi-kernel.*deb" | ${EGREPBINARY} -o "\.[0-9]+" | ${SEDBINARY} 's/\.//g') + | ${SORTBINARY} -nr | ${HEADBINARY} -1 | ${GREPBINARY} -o "raspberrypi-kernel.*deb" | ${GREPBINARY} -E -o "\.[0-9]+" | ${SEDBINARY} 's/\.//g') if [ -n "${FOUND_KERNEL_DATE}" ]; then FOUND_KERNEL_IN_SECONDS=$(date -d "${FOUND_KERNEL_DATE}" "+%s" 2> /dev/null) @@ -851,21 +851,21 @@ next="month" fi elif [ "$next" = "month" ]; then - if [ $(${ECHOCMD} "${part}" | ${EGREPBINARY} -c "[A-Z][a-z]") -ge 1 ]; then + if [ $(${ECHOCMD} "${part}" | ${GREPBINARY} -E -c "[A-Z][a-z]") -ge 1 ]; then UNAME_DATE_MONTH="${part}" next="day" fi elif [ "${next}" = "day" ]; then - if [ $(${ECHOCMD} ${part} | ${EGREPBINARY} -c "[0-9][0-9]") -ge 1 ]; then + if [ $(${ECHOCMD} ${part} | ${GREPBINARY} -E -c "[0-9][0-9]") -ge 1 ]; then UNAME_DATE_DAY="${part}" next="time" fi elif [ "${next}" = "time" ]; then - if [ $(${ECHOCMD} ${part} | ${EGREPBINARY} -c ":[0-9][0-9]:") -ge 1 ]; then + if [ $(${ECHOCMD} ${part} | ${GREPBINARY} -E -c ":[0-9][0-9]:") -ge 1 ]; then next="year" fi elif [ "${next}" = "year" ]; then - if [ $(${ECHOCMD} ${part} | ${EGREPBINARY} -c "[0-9][0-9]") -ge 1 ]; then + if [ $(${ECHOCMD} ${part} | ${GREPBINARY} -E -c "[0-9][0-9]") -ge 1 ]; then UNAME_DATE_YEAR="${part}" break fi diff --git a/include/tests_logging b/include/tests_logging index b6acdbe5..04bee67d 100644 --- a/include/tests_logging +++ b/include/tests_logging @@ -45,7 +45,7 @@ Register --test-no LOGG-2130 --weight L --network NO --category security --description "Check for running syslog daemon" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Searching for a logging daemon" - FIND=$(${PSBINARY} ax | ${EGREPBINARY} "syslogd|syslog-ng|metalog|systemd-journal" | ${GREPBINARY} -v "grep") + FIND=$(${PSBINARY} ax | ${GREPBINARY} -E "syslogd|syslog-ng|metalog|systemd-journal" | ${GREPBINARY} -v "grep") if [ -z "${FIND}" ]; then Display --indent 2 --text "- Checking for a running log daemon" --result "${STATUS_WARNING}" --color RED LogText "Result: Could not find a syslog daemon like syslog, syslog-ng, rsyslog, metalog, systemd-journal" @@ -261,7 +261,7 @@ Register --test-no LOGG-2148 --weight L --preqs-met ${PREQS_MET} --network NO --category security --description "Checking logrotated files" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking which files are rotated with logrotate and if they exist" - FIND=$(${LOGROTATEBINARY} -d -v ${ROOTDIR}etc/logrotate.conf 2>&1 | ${EGREPBINARY} "considering log|skipping" | ${GREPBINARY} -v '*' | ${SORTBINARY} -u | ${AWKBINARY} '{ if ($2!="log") { print "File:"$2":does_not_exist" } else { print "File:"$3":exists" } }') + FIND=$(${LOGROTATEBINARY} -d -v ${ROOTDIR}etc/logrotate.conf 2>&1 | ${GREPBINARY} -E "considering log|skipping" | ${GREPBINARY} -v '*' | ${SORTBINARY} -u | ${AWKBINARY} '{ if ($2!="log") { print "File:"$2":does_not_exist" } else { print "File:"$3":exists" } }') if [ -z "${FIND}" ]; then LogText "Result: nothing found" else @@ -280,7 +280,7 @@ Register --test-no LOGG-2150 --weight L --preqs-met ${PREQS_MET} --network NO --category security --description "Checking directories in logrotate configuration" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking which directories can be found in logrotate configuration" - FIND=$(${LOGROTATEBINARY} -d -v ${ROOTDIR}etc/logrotate.conf 2>&1 | ${EGREPBINARY} "considering log|skipping" | ${GREPBINARY} -v '*' | ${SORTBINARY} -u | ${AWKBINARY} '{ if ($2=="log") { print $3 } }' | ${SEDBINARY} 's@/[^/]*$@@g' | ${SORTBINARY} -u) + FIND=$(${LOGROTATEBINARY} -d -v ${ROOTDIR}etc/logrotate.conf 2>&1 | ${GREPBINARY} -E "considering log|skipping" | ${GREPBINARY} -v '*' | ${SORTBINARY} -u | ${AWKBINARY} '{ if ($2=="log") { print $3 } }' | ${SEDBINARY} 's@/[^/]*$@@g' | ${SORTBINARY} -u) if IsEmpty "${FIND}"; then LogText "Result: nothing found" else @@ -345,7 +345,7 @@ if [ ${SOLARIS_LOGHOST_FOUND} -eq 1 ] && [ -n "${SOLARIS_LOGHOST}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi Register --test-no LOGG-2153 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking loghost is localhost" if [ ${SKIPTEST} -eq 0 ]; then - FIND=$(echo "${SOLARIS_LOGHOST}" | ${AWKBINARY} '{ print $1 }' | ${EGREPBINARY} "::1|127.0.0.1|127.1") + FIND=$(echo "${SOLARIS_LOGHOST}" | ${AWKBINARY} '{ print $1 }' | ${GREPBINARY} -E "::1|127.0.0.1|127.1") if [ -n "${FIND}" ]; then SOLARIS_LOGHOST_LOCALHOST=1 LogText "Result: loghost entry is localhost (default)" @@ -371,7 +371,7 @@ TARGET="${ROOTDIR}etc/rsyslog.conf" if [ -f ${TARGET} ]; then LogText "Test: analyzing file ${TARGET} for remote target" - DATA=$(${EGREPBINARY} "@@?([a-zA-Z0-9\-])+(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?" ${TARGET} | ${GREPBINARY} -v "#" | ${TRBINARY} -cd "[:print:]\n" | ${SEDBINARY} 's/[[:blank:]]\{1,\}/:space:/g') + DATA=$(${GREPBINARY} -E "@@?([a-zA-Z0-9\-])+(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?" ${TARGET} | ${GREPBINARY} -v "#" | ${TRBINARY} -cd "[:print:]\n" | ${SEDBINARY} 's/[[:blank:]]\{1,\}/:space:/g') if [ -z "${DATA}" ]; then LogText "Result: no remote target found" else @@ -391,7 +391,7 @@ for F in ${FILES}; do F=$(echo ${F} | ${SEDBINARY} 's/:space:/ /g') LogText "Test: analyzing file ${F} for remote target" - DATA=$(${EGREPBINARY} "@@?([a-zA-Z0-9\-])+(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?" ${F} | ${GREPBINARY} -v "#" | ${TRBINARY} -cd "[:print:]\n" | ${SEDBINARY} 's/[[:blank:]]\{1,\}/:space:/g') + DATA=$(${GREPBINARY} -E "@@?([a-zA-Z0-9\-])+(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?(\.)?(([a-zA-Z0-9-])+)?" ${F} | ${GREPBINARY} -v "#" | ${TRBINARY} -cd "[:print:]\n" | ${SEDBINARY} 's/[[:blank:]]\{1,\}/:space:/g') if [ -n "${DATA}" ]; then LogText "Result: found remote target" REMOTE_LOGGING_ENABLED=1 @@ -403,7 +403,7 @@ done else # Check new style configuration (omrelp/omfwd). This can be all on one line or even split over multiple lines. - DATA=$(${EGREPBINARY} "target=\"([a-zA-Z0-9\-])" ${F}) + DATA=$(${GREPBINARY} -E "target=\"([a-zA-Z0-9\-])" ${F}) if [ -n "${DATA}" ]; then LogText "Result: most likely remote log host is used, as keyword 'target' is used" REMOTE_LOGGING_ENABLED=1 @@ -424,7 +424,7 @@ if [ -f ${SYSLOGD_CONF} ]; then LogText "Test: check if logs are also logged to a remote logging host" - FIND=$(${EGREPBINARY} "@[a-zA-Z0-9]|destination\s.+(udp|tcp).+\sport" ${SYSLOGD_CONF} | ${GREPBINARY} -v "^#" | ${GREPBINARY} -v "[a-zA-Z0-9]@") + FIND=$(${GREPBINARY} -E "@[a-zA-Z0-9]|destination\s.+(udp|tcp).+\sport" ${SYSLOGD_CONF} | ${GREPBINARY} -v "^#" | ${GREPBINARY} -v "[a-zA-Z0-9]@") if [ -n "${FIND}" ]; then FIND2=$(echo "${FIND}" | ${GREPBINARY} -v "@loghost") if [ ${SOLARIS_LOGHOST_LOCALHOST} -eq 1 ] && [ -z "${FIND2}" ]; then @@ -435,9 +435,9 @@ fi else # Search for configured destinations with an IP address or hostname, then determine which ones are used as a log destination - DESTINATIONS=$(${GREPBINARY} "^destination" ${SYSLOGD_CONF} | ${EGREPBINARY} "(udp|tcp)" | ${GREPBINARY} "port" | ${AWKBINARY} '{print $2}') + DESTINATIONS=$(${GREPBINARY} "^destination" ${SYSLOGD_CONF} | ${GREPBINARY} -E "(udp|tcp)" | ${GREPBINARY} "port" | ${AWKBINARY} '{print $2}') for DESTINATION in ${DESTINATIONS}; do - FIND2=$(${GREPBINARY} "log" ${SYSLOGD_CONF} | ${GREPBINARY} "source" | ${EGREPBINARY} "destination\(${DESTINATION}\)") + FIND2=$(${GREPBINARY} "log" ${SYSLOGD_CONF} | ${GREPBINARY} "source" | ${GREPBINARY} -E "destination\(${DESTINATION}\)") if [ -n "${FIND2}" ]; then LogText "Result: found destination ${DESTINATION} configured for remote logging" REMOTE_LOGGING_ENABLED=1 @@ -539,7 +539,7 @@ if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: checking open log files with lsof" if [ -n "${LSOFBINARY}" ]; then - FIND=$(${LSOFBINARY}${LSOF_EXTRA_OPTIONS} -n 2>&1 | ${GREPBINARY} "log$" | ${EGREPBINARY} -v "WARNING|Output information" | ${AWKBINARY} '{ if ($5=="REG") { print $9 } }' | ${SORTBINARY} -u | ${GREPBINARY} -v "^$") + FIND=$(${LSOFBINARY}${LSOF_EXTRA_OPTIONS} -n 2>&1 | ${GREPBINARY} "log$" | ${GREPBINARY} -E -v "WARNING|Output information" | ${AWKBINARY} '{ if ($5=="REG") { print $9 } }' | ${SORTBINARY} -u | ${GREPBINARY} -v "^$") for I in ${FIND}; do LogText "Found logfile: ${I}" done @@ -572,7 +572,7 @@ LSOF_GREP="${LSOF_GREP}|anacron|awk|run-parts" fi - FIND=$(${LSOFBINARY}${LSOF_EXTRA_OPTIONS} -n +L 1 2>&1 | ${EGREPBINARY} -vw "${LSOF_GREP}" | ${EGREPBINARY} -v '/dev/zero|/\[aio\]' | ${AWKBINARY} '{ if ($5=="REG") { printf "%s(%s)\n", $10, $1 } }' | ${GREPBINARY} -v "^$" | ${SORTBINARY} -u) + FIND=$(${LSOFBINARY}${LSOF_EXTRA_OPTIONS} -n +L 1 2>&1 | ${GREPBINARY} -E -vw "${LSOF_GREP}" | ${GREPBINARY} -E -v '/dev/zero|/\[aio\]' | ${AWKBINARY} '{ if ($5=="REG") { printf "%s(%s)\n", $10, $1 } }' | ${GREPBINARY} -v "^$" | ${SORTBINARY} -u) if [ -n "${FIND}" ]; then LogText "Result: found one or more files which are deleted, but still in use" for I in ${FIND}; do diff --git a/include/tests_mail_messaging b/include/tests_mail_messaging index a8e9ec3b..8d4ae929 100644 --- a/include/tests_mail_messaging +++ b/include/tests_mail_messaging @@ -70,18 +70,18 @@ unset FIND FIND2 FIND3 FIND4 # Local Only - FIND=$(echo "${EXIM_ROUTERS}" | ${EGREPBINARY} '^nonlocal') + FIND=$(echo "${EXIM_ROUTERS}" | ${GREPBINARY} -E '^nonlocal') # Internet Host - FIND2=$(echo "${EXIM_ROUTERS}" | ${EGREPBINARY} '^dnslookup_relay_to_domains') + FIND2=$(echo "${EXIM_ROUTERS}" | ${GREPBINARY} -E '^dnslookup_relay_to_domains') # Smarthost or Satellite - FIND3=$(echo "${EXIM_ROUTERS}" | ${EGREPBINARY} '^smarthost') + FIND3=$(echo "${EXIM_ROUTERS}" | ${GREPBINARY} -E '^smarthost') if [ -n "${FIND}" ]; then EXIM_TYPE="LOCAL ONLY" elif [ -n "${FIND2}" ]; then EXIM_TYPE="INTERNET HOST" elif [ -n "${FIND3}" ]; then - FIND4=$(echo "${EXIM_ROUTERS}" | ${EGREPBINARY} '^hub_user_smarthost') + FIND4=$(echo "${EXIM_ROUTERS}" | ${GREPBINARY} -E '^hub_user_smarthost') if [ -n "${FIND4}" ]; then EXIM_TYPE="SATELLITE" else @@ -415,7 +415,7 @@ Register --test-no MAIL-8920 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check OpenSMTPD status" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: check smtpd status" - FIND=$(${PSBINARY} ax | ${EGREPBINARY} "(/smtpd|smtpd: \[priv\]|smtpd: smtp)" | ${GREPBINARY} -v "grep") + FIND=$(${PSBINARY} ax | ${GREPBINARY} -E "(/smtpd|smtpd: \[priv\]|smtpd: smtp)" | ${GREPBINARY} -v "grep") if [ ! "${FIND}" = "" ]; then LogText "Result: found running smtpd process" Display --indent 2 --text "- OpenSMTPD status" --result "${STATUS_RUNNING}" --color GREEN diff --git a/include/tests_nameservices b/include/tests_nameservices index 8c483d08..c35b4171 100644 --- a/include/tests_nameservices +++ b/include/tests_nameservices @@ -339,7 +339,7 @@ Register --test-no NAME-4210 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check DNS banner" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Trying to determine version from banner" - FIND=$(${DIGBINARY} @localhost version.bind chaos txt | ${GREPBINARY} "^version.bind" | ${GREPBINARY} TXT | ${EGREPBINARY} "[0-9].[0-9].[0-9]*") + FIND=$(${DIGBINARY} @localhost version.bind chaos txt | ${GREPBINARY} "^version.bind" | ${GREPBINARY} TXT | ${GREPBINARY} -E "[0-9].[0-9].[0-9]*") if [ "${FIND}" = "" ]; then LogText "Result: no useful information in banner found" Display --indent 4 --text "- Checking BIND version in banner" --result "${STATUS_OK}" --color GREEN @@ -571,7 +571,7 @@ Register --test-no NAME-4402 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check duplicate line in /etc/hosts" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: check duplicate line in ${ROOTDIR}etc/hosts" - OUTPUT=$(${AWKBINARY} '{ print $1, $2 }' ${ROOTDIR}etc/hosts | ${EGREPBINARY} -v '^(#|$)' | ${EGREPBINARY} "[a-f0-9]" | ${SORTBINARY} | ${UNIQBINARY} -d) + OUTPUT=$(${AWKBINARY} '{ print $1, $2 }' ${ROOTDIR}etc/hosts | ${GREPBINARY} -E -v '^(#|$)' | ${GREPBINARY} -E "[a-f0-9]" | ${SORTBINARY} | ${UNIQBINARY} -d) if [ -z "${OUTPUT}" ]; then LogText "Result: OK, no duplicate lines found" Display --indent 4 --text "- Duplicate entries in hosts file" --result "${STATUS_NONE}" --color GREEN @@ -592,7 +592,7 @@ if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Check /etc/hosts contains an entry for this server name" if [ -n "${HOSTNAME}" ]; then - DATA=$(${EGREPBINARY} -v '^(#|$|^::1\s|localhost)' ${ROOTDIR}etc/hosts | ${GREPBINARY} -i ${HOSTNAME}) + DATA=$(${GREPBINARY} -E -v '^(#|$|^::1\s|localhost)' ${ROOTDIR}etc/hosts | ${GREPBINARY} -i ${HOSTNAME}) if [ -n "${DATA}" ]; then LogText "Result: Found entry for ${HOSTNAME} in ${ROOTDIR}etc/hosts" Display --indent 4 --text "- Presence of configured hostname in /etc/hosts" --result "${STATUS_FOUND}" --color GREEN @@ -615,7 +615,7 @@ Register --test-no NAME-4406 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check server hostname mapping" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Check server hostname not locally mapped in ${ROOTDIR}etc/hosts" - DATA=$(${EGREPBINARY} -v '^(#|$)' ${ROOTDIR}etc/hosts | ${EGREPBINARY} '^(localhost|::1)\s' | ${GREPBINARY} -w ${HOSTNAME}) + DATA=$(${GREPBINARY} -E -v '^(#|$)' ${ROOTDIR}etc/hosts | ${GREPBINARY} -E '^(localhost|::1)\s' | ${GREPBINARY} -w ${HOSTNAME}) if [ -n "${DATA}" ]; then LogText "Result: Found this server hostname mapped to a local address" LogText "Output: ${DATA}" diff --git a/include/tests_networking b/include/tests_networking index 7faf7125..116f3760 100644 --- a/include/tests_networking +++ b/include/tests_networking @@ -280,7 +280,7 @@ Register --test-no NETW-3001 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Find default gateway (route)" if [ $SKIPTEST -eq 0 ]; then LogText "Test: Searching default gateway(s)" - FIND=$(${NETSTATBINARY} -rn | ${EGREPBINARY} "^0.0.0.0|default" | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f2) + FIND=$(${NETSTATBINARY} -rn | ${GREPBINARY} -E "^0.0.0.0|default" | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f2) if [ -n "${FIND}" ]; then for I in ${FIND}; do LogText "Result: Found default gateway ${I}" diff --git a/include/tests_php b/include/tests_php index 23738198..858bc14b 100644 --- a/include/tests_php +++ b/include/tests_php @@ -285,9 +285,9 @@ # Test : PHP-2368 # Description : Check php register_globals option # Notes : Don't test for it if PHP version is 5.4.0 or later (it has been removed) - if [ -n "${PHPINIFILE}" -a -n "${PHPVERSION}" -a -n "${EGREPBINARY}" ]; then + if [ -n "${PHPINIFILE}" -a -n "${PHPVERSION}" -a -n "${GREPBINARY} -E" ]; then if [ -f "${PHPINIFILE}" ]; then - FIND=$(echo ${PHPVERSION} | ${EGREPBINARY} "^(4.|5.[0-3])") + FIND=$(echo ${PHPVERSION} | ${GREPBINARY} -E "^(4.|5.[0-3])") if [ -z "${FIND}" ]; then PREQS_MET="NO"; Debug "Found most likely PHP version 5.4.0 or higher (${PHPVERSION}) which does not use register_globals" else @@ -305,7 +305,7 @@ Register --test-no PHP-2368 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP register_globals option" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking PHP register_globals option" - FIND=$(${EGREPBINARY} -i 'register_globals.*(on|yes|1)' ${PHPINIFILE} | ${GREPBINARY} -v '^;') + FIND=$(${GREPBINARY} -E -i 'register_globals.*(on|yes|1)' ${PHPINIFILE} | ${GREPBINARY} -v '^;') if [ -n "${FIND}" ]; then Display --indent 4 --text "- Checking register_globals option" --result "${STATUS_WARNING}" --color RED ReportWarning "${TEST_NO}" "PHP option register_globals option is turned on, which can be a risk for variable value overwriting" @@ -338,7 +338,7 @@ ;; esac LogText "Test: Checking file ${FILE}" - FIND=$(${EGREPBINARY} -i 'expose_php.*(on|yes|1)' ${FILE} | ${GREPBINARY} -v '^;') + FIND=$(${GREPBINARY} -E -i 'expose_php.*(on|yes|1)' ${FILE} | ${GREPBINARY} -v '^;') if HasData "${FIND}"; then LogText "Result: found a a possible match on expose_php setting" LogText "Data: ${FIND}" @@ -367,7 +367,7 @@ Register --test-no PHP-2374 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP enable_dl option" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking PHP enable_dl option" - FIND=$(${EGREPBINARY} -i 'enable_dl.*(on|yes|1)' ${PHPINIFILE} | ${GREPBINARY} -v '^;') + FIND=$(${GREPBINARY} -E -i 'enable_dl.*(on|yes|1)' ${PHPINIFILE} | ${GREPBINARY} -v '^;') if [ -n "${FIND}" ]; then Display --indent 4 --text "- Checking enable_dl option" --result "${STATUS_ON}" --color YELLOW Report "Result: enable_dl option is turned on, which can be used to enable more modules dynamically and circumventing security controls" @@ -389,7 +389,7 @@ Register --test-no PHP-2376 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP allow_url_fopen option" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking PHP allow_url_fopen option" - FIND=$(${EGREPBINARY} -i 'allow_url_fopen.*(off|no|0)' ${PHPINIFILE} | ${GREPBINARY} -v '^;') + FIND=$(${GREPBINARY} -E -i 'allow_url_fopen.*(off|no|0)' ${PHPINIFILE} | ${GREPBINARY} -v '^;') if [ -z "${FIND}" ]; then Display --indent 4 --text "- Checking allow_url_fopen option" --result "${STATUS_ON}" --color YELLOW LogText "Result: allow_url_fopen option is turned on, which can be used for downloads via PHP and is a security risk" @@ -412,7 +412,7 @@ Register --test-no PHP-2378 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check PHP allow_url_include option" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking PHP allow_url_include option" - FIND=$(${EGREPBINARY} -i 'allow_url_include.*(off|no|0)' ${PHPINIFILE} | ${GREPBINARY} -v '^;') + FIND=$(${GREPBINARY} -E -i 'allow_url_include.*(off|no|0)' ${PHPINIFILE} | ${GREPBINARY} -v '^;') if [ -z "${FIND}" ]; then Display --indent 4 --text "- Checking allow_url_include option" --result "${STATUS_ON}" --color YELLOW Report "Result: allow_url_include option is turned on, which can be used for downloads via PHP and is a risk" @@ -436,7 +436,7 @@ #if [ ${SKIPTEST} -eq 0 ]; then # FOUND=0 # SIMULATION=0 - # MAJOR_VERSION=$(echo ${PHPVERSION} | ${EGREPBINARY} "^7") + # MAJOR_VERSION=$(echo ${PHPVERSION} | ${GREPBINARY} -E "^7") # if [ "${OS}" = "OpenBSD" ]; then # FOUND=1 # On OpenBSD, Suhosin is hard linked into PHP # SIMULATION=off @@ -519,7 +519,7 @@ ;; esac LogText "Test: Checking file ${FILE}" - FIND=$(${EGREPBINARY} -i "^listen = [0-9]{1,5}$" ${FILE}) + FIND=$(${GREPBINARY} -E -i "^listen = [0-9]{1,5}$" ${FILE}) if HasData "${FIND}"; then LogText "Result: found listen on just a port number" LogText "Data: ${FIND}" diff --git a/include/tests_ports_packages b/include/tests_ports_packages index 9ca1948d..0e938cfe 100644 --- a/include/tests_ports_packages +++ b/include/tests_ports_packages @@ -836,7 +836,7 @@ Register --test-no PKGS-7383 --preqs-met ${PREQS_MET} --os Linux --weight M --network NO --category security --description "Check for YUM package update management" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: YUM package update management" - FIND=$(${YUMBINARY} repolist 2>/dev/null | ${GREPBINARY} repolist | ${SEDBINARY} 's/[[:blank:]]//g' | ${SEDBINARY} 's/[,.]//g' | ${AWKBINARY} -F ":" '{print $2}' | ${EGREPBINARY} "^[0-9]+$") + FIND=$(${YUMBINARY} repolist 2>/dev/null | ${GREPBINARY} repolist | ${SEDBINARY} 's/[[:blank:]]//g' | ${SEDBINARY} 's/[,.]//g' | ${AWKBINARY} -F ":" '{print $2}' | ${GREPBINARY} -E "^[0-9]+$") if [ -z "${FIND}" -o "${FIND}" = "0" ]; then LogText "Result: YUM package update management failed" Display --indent 2 --text "- YUM package management consistency" --result "${STATUS_WARNING}" --color RED @@ -1030,7 +1030,7 @@ if [ ${OPTION_DEBIAN_SKIP_SECURITY_REPOSITORY} -eq 0 ]; then if [ -f ${ROOTDIR}etc/apt/sources.list ]; then LogText "Searching for security.debian.org/security.ubuntu.com or security repositories in /etc/apt/sources.list file" - FIND=$(${EGREPBINARY} "security.debian.org|security.ubuntu.com|security/? " ${ROOTDIR}etc/apt/sources.list | ${GREPBINARY} -v '#' | ${SEDBINARY} 's/ /!space!/g') + FIND=$(${GREPBINARY} -E "security.debian.org|security.ubuntu.com|security/? " ${ROOTDIR}etc/apt/sources.list | ${GREPBINARY} -v '#' | ${SEDBINARY} 's/ /!space!/g') if [ -n "${FIND}" ]; then FOUND=1 Display --indent 2 --text "- Checking security repository in sources.list file" --result "${STATUS_OK}" --color GREEN @@ -1043,7 +1043,7 @@ fi if [ -d /etc/apt/sources.list.d ]; then LogText "Searching for security.debian.org/security.ubuntu.com or security repositories in /etc/apt/sources.list.d directory" - FIND=$(${EGREPBINARY} -r "security.debian.org|security.ubuntu.com|security/? " /etc/apt/sources.list.d | ${GREPBINARY} -v '#' | ${SEDBINARY} 's/ /!space!/g') + FIND=$(${GREPBINARY} -E -r "security.debian.org|security.ubuntu.com|security/? " /etc/apt/sources.list.d | ${GREPBINARY} -v '#' | ${SEDBINARY} 's/ /!space!/g') if [ -n "${FIND}" ]; then FOUND=1 Display --indent 2 --text "- Checking security repository in sources.list.d directory" --result "${STATUS_OK}" --color GREEN @@ -1338,7 +1338,7 @@ if [ "${DPKGBINARY}" ]; then TESTED=1 KERNEL_PKG_NAMES="linux-image-[0-9]|raspberrypi-kernel|pve-kernel-[0-9]" - KERNELS=$(${DPKGBINARY} -l 2> /dev/null | ${EGREPBINARY} "${KERNEL_PKG_NAMES}" | ${WCBINARY} -l) + KERNELS=$(${DPKGBINARY} -l 2> /dev/null | ${GREPBINARY} -E "${KERNEL_PKG_NAMES}" | ${WCBINARY} -l) if [ ${KERNELS} -eq 0 ]; then LogText "Result: found no kernels from dpkg -l output, which is unexpected" elif [ ${KERNELS} -gt 5 ]; then diff --git a/include/tests_printers_spoolers b/include/tests_printers_spoolers index 851b0edd..d9318c3b 100644 --- a/include/tests_printers_spoolers +++ b/include/tests_printers_spoolers @@ -144,14 +144,14 @@ LogText "Test: Checking CUPS daemon listening network addresses" # Search for Port statement - FIND=$(${EGREPBINARY} "^Port 631" ${CUPSD_CONFIG_FILE}) + FIND=$(${GREPBINARY} -E "^Port 631" ${CUPSD_CONFIG_FILE}) if [ -n "${FIND}" ]; then LogText "Result: found CUPS listening on port 631 (most likely all interfaces)" PORT_FOUND=1 fi # Checking network addresses - FIND=$(${EGREPBINARY} "^(SSL)?Listen" ${CUPSD_CONFIG_FILE} | ${GREPBINARY} -v "/" | ${AWKBINARY} '{ print $2 }') + FIND=$(${GREPBINARY} -E "^(SSL)?Listen" ${CUPSD_CONFIG_FILE} | ${GREPBINARY} -v "/" | ${AWKBINARY} '{ print $2 }') COUNT=0 for ITEM in ${FIND}; do LogText "Result: found network address: ${ITEM}" @@ -222,7 +222,7 @@ QDAEMON_CONFIG_FILE="${ROOTDIR}etc/qconfig" FileIsReadable ${QDAEMON_CONFIG_FILE} if [ ${CANREAD} -eq 1 ]; then - FIND=$(${GREPBINARY} -v "^\*" ${QDAEMON_CONFIG_FILE} | ${EGREPBINARY} "backend|device") + FIND=$(${GREPBINARY} -v "^\*" ${QDAEMON_CONFIG_FILE} | ${GREPBINARY} -E "backend|device") if [ -n "${FIND}" ]; then LogText "Result: printers are defined in ${QDAEMON_CONFIG_FILE}" Display --indent 2 --text "- Checking /etc/qconfig file" --result "${STATUS_FOUND}" --color GREEN diff --git a/include/tests_scheduling b/include/tests_scheduling index 3aa004c6..10fa0766 100644 --- a/include/tests_scheduling +++ b/include/tests_scheduling @@ -35,7 +35,7 @@ # Description : Check cron daemon Register --test-no SCHD-7702 --weight L --network NO --category security --description "Check status of cron daemon" if [ ${SKIPTEST} -eq 0 ]; then - FIND=$(${PSBINARY} aux | ${EGREPBINARY} "( cron$|/cron(d)? )") + FIND=$(${PSBINARY} aux | ${GREPBINARY} -E "( cron$|/cron(d)? )") if IsEmpty "${FIND}"; then LogText "Result: no cron daemon found" else @@ -55,12 +55,12 @@ BAD_FILE_PERMISSIONS=0 BAD_FILE_OWNERSHIP=0 FindCronJob() { - sCRONJOBS=$(${EGREPBINARY} '^([0-9*])' $1 | ${TRBINARY} '\t' ' ' | ${TRBINARY} -s ' ' | ${TRBINARY} ' ' ',' | ${SORTBINARY}) + sCRONJOBS=$(${GREPBINARY} -E '^([0-9*])' $1 | ${TRBINARY} '\t' ' ' | ${TRBINARY} -s ' ' | ${TRBINARY} ' ' ',' | ${SORTBINARY}) } CRONTAB_FILE="${ROOTDIR}etc/crontab" if [ -f ${CRONTAB_FILE} ]; then - ${EGREPBINARY} -q -s 'lynis audit system' ${CRONTAB_FILE} && LYNIS_CRONJOB="file:/etc/crontab" + ${GREPBINARY} -E -q -s 'lynis audit system' ${CRONTAB_FILE} && LYNIS_CRONJOB="file:/etc/crontab" if IsWorldWritable ${CRONTAB_FILE}; then LogText "Result: insecure file permissions for cronjob file ${CRONTAB_FILE}"; Report "insecure_fileperms_cronjob[]=${CRONTAB_FILE}"; BAD_FILE_PERMISSIONS=1; AddHP 0 5; fi if ! IsOwnedByRoot ${CRONTAB_FILE}; then LogText "Result: incorrect owner found for cronjob file ${CRONTAB_FILE}"; Report "bad_fileowner_cronjob[]=${CRONTAB_FILE}"; BAD_FILE_OWNERSHIP=1; AddHP 0 5; fi FindCronJob ${CRONTAB_FILE} @@ -86,7 +86,7 @@ if IsWorldWritable ${FILE}; then LogText "Result: insecure file permissions for cronjob file ${J}"; Report "insecure_fileperms_cronjob[]=${J}"; BAD_FILE_PERMISSIONS=1; AddHP 0 5; fi if ! IsOwnedByRoot ${FILE}; then LogText "Result: incorrect owner found for cronjob file ${J}"; Report "bad_fileowner_cronjob[]=${J}"; BAD_FILE_OWNERSHIP=1; AddHP 0 5; fi FILENAME=$(echo ${FILE} | ${AWKBINARY} -F/ '{print $NF}') - if [ "${FILENAME}" = "lynis" ]; then ${EGREPBINARY} -q -s 'lynis audit system' ${CRONTAB_FILE} && LYNIS_CRONJOB="file:${FILE}"; fi + if [ "${FILENAME}" = "lynis" ]; then ${GREPBINARY} -E -q -s 'lynis audit system' ${CRONTAB_FILE} && LYNIS_CRONJOB="file:${FILE}"; fi FindCronJob ${FILE} if HasData "${sCRONJOBS}"; then for K in ${sCRONJOBS}; do @@ -121,7 +121,7 @@ if IsWorldWritable ${FILE}; then LogText "Result: insecure file permissions for cronjob file ${FILE}"; Report "insecure_fileperms_cronjob[]=${FILE}"; BAD_FILE_PERMISSIONS=1; AddHP 0 5; fi if ! IsOwnedByRoot ${FILE}; then LogText "Result: incorrect owner found for cronjob file ${FILE}"; Report "bad_fileowner_cronjob[]=${FILE}"; BAD_FILE_OWNERSHIP=1; AddHP 0 5; fi FILENAME=$(echo ${FILE} | ${AWKBINARY} -F/ '{print $NF}') - if [ "${FILENAME}" = "lynis" ]; then ${EGREPBINARY} -q -s 'lynis audit system' ${CRONTAB_FILE} && LYNIS_CRONJOB="file:${FILE}"; fi + if [ "${FILENAME}" = "lynis" ]; then ${GREPBINARY} -E -q -s 'lynis audit system' ${CRONTAB_FILE} && LYNIS_CRONJOB="file:${FILE}"; fi LogText "Result: Found cronjob (${I}): ${FILE}" Report "cronjob[]=${FILE}" done @@ -141,7 +141,7 @@ FIND=$(${FINDBINARY} /var/spool/cron/crontabs -xdev -type f -print 2> /dev/null) for I in ${FIND}; do if FileIsReadable ${I}; then - ${EGREPBINARY} -q -s 'lynis audit system' ${I} && LYNIS_CRONJOB="file:${I}" + ${GREPBINARY} -E -q -s 'lynis audit system' ${I} && LYNIS_CRONJOB="file:${I}" FindCronJob ${I} for FILE in ${sCRONJOBS}; do LogText "Found cronjob (/var/spool/cron/crontabs): ${I} (${FILE})" @@ -154,7 +154,7 @@ FIND=$(find ${ROOTDIR}var/spool/cron -type f -print) for I in ${FIND}; do if FileIsReadable ${I}; then - ${EGREPBINARY} -q -s 'lynis audit system' ${I} && LYNIS_CRONJOB="file:${I}" + ${GREPBINARY} -E -q -s 'lynis audit system' ${I} && LYNIS_CRONJOB="file:${I}" FindCronJob ${I} for FILE in ${sCRONJOBS}; do LogText "Found cronjob in ${ROOTDIR}var/spool/cron: ${I} (${FILE})" @@ -169,7 +169,7 @@ if [ "${OS}" = "Linux" ]; then if [ -f /etc/anacrontab ]; then LogText "Test: checking anacrontab" - sANACRONJOBS=$(${EGREPBINARY} '^([0-9@])' /etc/anacrontab | ${TRBINARY} '\t' ' ' | ${TRBINARY} -s ' ' | ${TRBINARY} ' ' ',' | ${SORTBINARY}) + sANACRONJOBS=$(${GREPBINARY} -E '^([0-9@])' /etc/anacrontab | ${TRBINARY} '\t' ' ' | ${TRBINARY} -s ' ' | ${TRBINARY} ' ' ',' | ${SORTBINARY}) if [ -n "${sANACRONJOBS}" ]; then Report "scheduler[]=anacron" for I in ${sANACRONJOBS}; do diff --git a/include/tests_shells b/include/tests_shells index 8ecbde2c..b046b608 100644 --- a/include/tests_shells +++ b/include/tests_shells @@ -52,7 +52,7 @@ Register --test-no SHLL-6202 --os FreeBSD --weight L --network NO --category security --description "Check console TTYs" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking console TTYs" - FIND=$(${EGREPBINARY} '^console' ${ROOTDIR}etc/ttys | ${GREPBINARY} -v 'insecure') + FIND=$(${GREPBINARY} -E '^console' ${ROOTDIR}etc/ttys | ${GREPBINARY} -v 'insecure') if [ -z "${FIND}" ]; then Display --indent 2 --text "- Checking console TTYs" --result "${STATUS_OK}" --color GREEN LogText "Result: console is secured against single user mode without password." diff --git a/include/tests_squid b/include/tests_squid index c486108c..1eb43955 100644 --- a/include/tests_squid +++ b/include/tests_squid @@ -42,7 +42,7 @@ LogText "Test: Searching for a Squid daemon" FOUND=0 # Check running processes - FIND=$(${PSBINARY} ax | ${EGREPBINARY} "(squid|squid3) " | ${GREPBINARY} -v "grep") + FIND=$(${PSBINARY} ax | ${GREPBINARY} -E "(squid|squid3) " | ${GREPBINARY} -v "grep") if [ -n "${FIND}" ]; then SQUID_DAEMON_RUNNING=1 LogText "Result: Squid daemon is running" diff --git a/include/tests_ssh b/include/tests_ssh index fb784d83..6ab6f193 100644 --- a/include/tests_ssh +++ b/include/tests_ssh @@ -299,7 +299,7 @@ if [ ${SKIPTEST} -eq 0 ]; then FOUND=0 # AllowUsers - FIND=$(${EGREPBINARY} -i "^AllowUsers" ${SSH_DAEMON_OPTIONS_FILE} | ${AWKBINARY} '{ print $2 }') + FIND=$(${GREPBINARY} -E -i "^AllowUsers" ${SSH_DAEMON_OPTIONS_FILE} | ${AWKBINARY} '{ print $2 }') if [ -n "${FIND}" ]; then LogText "Result: AllowUsers set, with value ${FIND}" Display --indent 4 --text "- OpenSSH option: AllowUsers" --result "${STATUS_FOUND}" --color GREEN @@ -310,7 +310,7 @@ fi # AllowGroups - FIND=$(${EGREPBINARY} -i "^AllowGroups" ${SSH_DAEMON_OPTIONS_FILE} | ${AWKBINARY} '{ print $2 }') + FIND=$(${GREPBINARY} -E -i "^AllowGroups" ${SSH_DAEMON_OPTIONS_FILE} | ${AWKBINARY} '{ print $2 }') if [ -n "${FIND}" ]; then LogText "Result: AllowUsers set ${FIND}" Display --indent 4 --text "- OpenSSH option: AllowGroups" --result "${STATUS_FOUND}" --color GREEN diff --git a/include/tests_storage b/include/tests_storage index ac60502c..29785e6c 100644 --- a/include/tests_storage +++ b/include/tests_storage @@ -38,8 +38,8 @@ if [ -d "${ROOTDIR}etc/modprobe.d" ]; then FIND=$(${LSBINARY} ${ROOTDIR}etc/modprobe.d/* 2> /dev/null) if [ -n "${FIND}" ]; then - FIND1=$(${EGREPBINARY} "blacklist (ohci1394|firewire[-_]ohci|firewire-core)" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#") - FIND2=$(${EGREPBINARY} "install (ohci1394|firewire[-_]ohci|firewire-core) /bin/(false|true)" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#") + FIND1=$(${GREPBINARY} -E "blacklist (ohci1394|firewire[-_]ohci|firewire-core)" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#") + FIND2=$(${GREPBINARY} -E "install (ohci1394|firewire[-_]ohci|firewire-core) /bin/(false|true)" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#") if [ -n "${FIND1}" ] || [ -n "${FIND2}" ]; then FOUND=1 LogText "Result: found firewire ohci driver in disabled state" @@ -49,8 +49,8 @@ fi fi if [ -f "${ROOTDIR}etc/modprobe.conf" ]; then - FIND1=$(${EGREPBINARY} -r "blacklist (ohci1394|firewire[-_]ohci|firewire-core)" "${ROOTDIR}etc/modprobe.conf" | ${GREPBINARY} -v "#") - FIND2=$(${EGREPBINARY} -r "install (ohci1394|firewire[-_]ohci|firewire-core) /bin/(false|true)" "${ROOTDIR}etc/modprobe.conf" | ${GREPBINARY} -v "#") + FIND1=$(${GREPBINARY} -E -r "blacklist (ohci1394|firewire[-_]ohci|firewire-core)" "${ROOTDIR}etc/modprobe.conf" | ${GREPBINARY} -v "#") + FIND2=$(${GREPBINARY} -E -r "install (ohci1394|firewire[-_]ohci|firewire-core) /bin/(false|true)" "${ROOTDIR}etc/modprobe.conf" | ${GREPBINARY} -v "#") if [ -n "${FIND1}" ] || [ -n "${FIND2}" ]; then FOUND=1 LogText "Result: found firewire ohci driver in disabled state" diff --git a/include/tests_time b/include/tests_time index df9a86b7..7ff6755e 100644 --- a/include/tests_time +++ b/include/tests_time @@ -139,7 +139,7 @@ for I in ${CRONTAB_FILES}; do if [ -f ${I} ]; then LogText "Test: checking for ntpdate, rdate, sntp or ntpdig in crontab file ${I}" - FIND=$(${EGREPBINARY} "${CRONTAB_REGEX}" ${I} | ${GREPBINARY} -v '^#') + FIND=$(${GREPBINARY} -E "${CRONTAB_REGEX}" ${I} | ${GREPBINARY} -v '^#') if [ -n "${FIND}" ]; then FOUND=1; NTP_CONFIG_TYPE_SCHEDULED=1 Display --indent 2 --text "- Checking NTP client in crontab file (${I})" --result "${STATUS_FOUND}" --color GREEN @@ -161,10 +161,10 @@ for I in ${CRON_DIRS}; do for J in "${I}"/*; do # iterate over folders in a safe way # Check: regular file, readable and not called .placeholder - FIND=$(echo "${J}" | ${EGREPBINARY} '/.placeholder$') + FIND=$(echo "${J}" | ${GREPBINARY} -E '/.placeholder$') if [ -f "${J}" ] && [ -r "${J}" ] && [ -z "${FIND}" ]; then LogText "Test: checking for ntpdate, rdate, sntp or ntpdig in ${J}" - FIND=$("${EGREPBINARY}" "${CRONTAB_REGEX}" "${J}" | "${GREPBINARY}" -v "^#") + FIND=$("${GREPBINARY} -E" "${CRONTAB_REGEX}" "${J}" | "${GREPBINARY}" -v "^#") if [ -n "${FIND}" ]; then FOUND=1; FOUND_IN_CRON=1; NTP_CONFIG_TYPE_SCHEDULED=1 LogText "Result: found ntpdate, rdate, sntp or ntpdig in ${J}" @@ -232,7 +232,7 @@ Register --test-no TIME-3106 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check systemd NTP time synchronization status" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Check the status of time synchronization via timedatectl" - FIND=$(${TIMEDATECTL} status | ${EGREPBINARY} "(NTP|System clock) synchronized: yes") + FIND=$(${TIMEDATECTL} status | ${GREPBINARY} -E "(NTP|System clock) synchronized: yes") if [ -z "${FIND}" ]; then LogText "Result: time not synchronized via NTP" ReportSuggestion "${TEST_NO}" "Check timedatectl output. Synchronization via NTP is enabled, but status reflects it is not synchronized" @@ -273,7 +273,7 @@ else for ITEM in ${FIND}; do LogText "Found stratum 16 peer: ${ITEM}" - FIND2=$(${EGREPBINARY} "^ntp-ignore-stratum-16-peer=${ITEM}" ${PROFILE}) + FIND2=$(${GREPBINARY} -E "^ntp-ignore-stratum-16-peer=${ITEM}" ${PROFILE}) if IsEmpty "${FIND2}"; then COUNT=$((COUNT + 1)) Report "ntp_stratum_16_peer[]=${ITEM}" @@ -303,7 +303,7 @@ Register --test-no TIME-3120 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check unreliable NTP peers" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking unreliable ntp peers" - FIND=$(${NTPQBINARY} -p -n | ${EGREPBINARY} "^(-|#)" | ${AWKBINARY} '{ print $1 }' | ${SEDBINARY} 's/^-//g') + FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} -E "^(-|#)" | ${AWKBINARY} '{ print $1 }' | ${SEDBINARY} 's/^-//g') if [ -z "${FIND}" ]; then Display --indent 2 --text "- Checking unreliable ntp peers" --result "${STATUS_NONE}" --color GREEN LogText "Result: No unreliable peers found" @@ -371,7 +371,7 @@ Register --test-no TIME-3132 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check NTP falsetickers" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking preferred time source" - FIND=$(${NTPQBINARY} -p -n | ${EGREPBINARY} '^x') + FIND=$(${NTPQBINARY} -p -n | ${GREPBINARY} -E '^x') if [ -z "${FIND}" ]; then Display --indent 2 --text "- Checking falsetickers" --result "${STATUS_OK}" --color GREEN LogText "Result: No falsetickers found (items preceding with an 'x')" @@ -455,7 +455,7 @@ else LogText "Result: ${FILE} is not empty, which is fine" Display --indent 2 --text "- Checking NTP step-tickers file" --result "${STATUS_OK}" --color GREEN - sFIND=$(${AWKBINARY} '/^[a-z0-9]/ { print $1 }' ${FILE} | ${EGREPBINARY} -v "^127." | ${EGREPBINARY} -v "^::1") + sFIND=$(${AWKBINARY} '/^[a-z0-9]/ { print $1 }' ${FILE} | ${GREPBINARY} -E -v "^127." | ${GREPBINARY} -E -v "^::1") for I in ${sFIND}; do FIND=$(${GREPBINARY} ^${I} ${FILE} | wc -l) if [ ${FIND} -gt 0 ]; then @@ -553,7 +553,7 @@ Register --test-no TIME-3182 --preqs-met "${PREQS_MET}" --weight L --network NO --category security --description "Check OpenNTPD has working peers" if [ ${SKIPTEST} -eq 0 ]; then # Format is "xx/yy peers valid, ..." - FIND=$(${NTPCTLBINARY} -s status | ${EGREPBINARY} -o '[0-9]+/[0-9]+' | ${CUTBINARY} -d '/' -f 1) + FIND=$(${NTPCTLBINARY} -s status | ${GREPBINARY} -E -o '[0-9]+/[0-9]+' | ${CUTBINARY} -d '/' -f 1) if [ -z "${FIND}" ] || [ "${FIND}" -eq 0 ]; then ReportWarning "${TEST_NO}" "OpenNTPD has no peers" "${NTPCTLBINARY} -s status" fi diff --git a/include/tests_tooling b/include/tests_tooling index 083f5045..30c506c0 100644 --- a/include/tests_tooling +++ b/include/tests_tooling @@ -259,8 +259,8 @@ # # Check email alert configuration # LogText "Test: checking for email actions within ${FAIL2BAN_CONFIG}" # - # FIND=$(${EGREPBINARY} "^action = \%\(action_m.*\)s" ${FAIL2BAN_CONFIG}) - # FIND2=$(${EGREPBINARY} "^action = \%\(action_\)s" ${FAIL2BAN_CONFIG}) + # FIND=$(${GREPBINARY} -E "^action = \%\(action_m.*\)s" ${FAIL2BAN_CONFIG}) + # FIND2=$(${GREPBINARY} -E "^action = \%\(action_\)s" ${FAIL2BAN_CONFIG}) # # if [ -n "${FIND}" ]; then # FAIL2BAN_EMAIL=1 diff --git a/include/tests_usb b/include/tests_usb index d99d5a66..81c184df 100644 --- a/include/tests_usb +++ b/include/tests_usb @@ -54,8 +54,8 @@ if [ -d /etc/modprobe.d ]; then FIND=$(${LSBINARY} ${ROOTDIR}etc/modprobe.d/* 2> /dev/null) if [ -n "${FIND}" ]; then - FIND=$(${EGREPBINARY} -r "install usb[-_]storage /bin/(false|true)" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#") - FIND2=$(${EGREPBINARY} -r "^blacklist usb[-_]storage" ${ROOTDIR}etc/modprobe.d/*) + FIND=$(${GREPBINARY} -E -r "install usb[-_]storage /bin/(false|true)" ${ROOTDIR}etc/modprobe.d/* | ${GREPBINARY} -v "#") + FIND2=$(${GREPBINARY} -E -r "^blacklist usb[-_]storage" ${ROOTDIR}etc/modprobe.d/*) if [ -n "${FIND}" -o -n "${FIND2}" ]; then FOUND=1 LogText "Result: found usb-storage driver in disabled state (blacklisted)" @@ -65,7 +65,7 @@ fi fi if [ -f ${ROOTDIR}etc/modprobe.conf ]; then - FIND=$(${EGREPBINARY} "install usb[-_]storage /bin/(false|true)" ${ROOTDIR}etc/modprobe.conf | ${GREPBINARY} "usb-storage" | ${GREPBINARY} -v "#") + FIND=$(${GREPBINARY} -E "install usb[-_]storage /bin/(false|true)" ${ROOTDIR}etc/modprobe.conf | ${GREPBINARY} "usb-storage" | ${GREPBINARY} -v "#") if [ -n "${FIND}" ]; then FOUND=1 LogText "Result: found usb-storage driver in disabled state" @@ -316,11 +316,11 @@ Display --indent 4 --text "- RuleFile" --result "${STATUS_FOUND}" --color GREEN AddHP 1 1 - USBGUARD_RULES_ALLOW=$(${EGREPBINARY} -c "^allow" ${USBGUARD_RULES}) + USBGUARD_RULES_ALLOW=$(${GREPBINARY} -E -c "^allow" ${USBGUARD_RULES}) Display --indent 6 --text "- Controllers & Devices allow" --result "${USBGUARD_RULES_ALLOW}" --color WHITE - USBGUARD_RULES_BLOCK=$(${EGREPBINARY} -c "^block" ${USBGUARD_RULES}) + USBGUARD_RULES_BLOCK=$(${GREPBINARY} -E -c "^block" ${USBGUARD_RULES}) Display --indent 6 --text "- Controllers & Devices block" --result "${USBGUARD_RULES_BLOCK}" --color WHITE - USBGUARD_RULES_REJECT=$(${EGREPBINARY} -c "^reject" ${USBGUARD_RULES}) + USBGUARD_RULES_REJECT=$(${GREPBINARY} -E -c "^reject" ${USBGUARD_RULES}) Display --indent 6 --text "- Controllers & Devices reject" --result "${USBGUARD_RULES_REJECT}" --color WHITE else LogText "Result: RuleFile not found (\"man usbguard\" for instructions to install initial policies)" diff --git a/include/tests_webservers b/include/tests_webservers index e0ca5737..1dbde636 100644 --- a/include/tests_webservers +++ b/include/tests_webservers @@ -63,7 +63,7 @@ Display --indent 2 --text "- Checking Apache" --result "${STATUS_NOT_FOUND}" --color WHITE else LogText "Test: Scanning for Apache binary" - IS_APACHE=$(${HTTPDBINARY} -v 2> /dev/null | ${EGREPBINARY} '[aA]pache') + IS_APACHE=$(${HTTPDBINARY} -v 2> /dev/null | ${GREPBINARY} -E '[aA]pache') if IsEmpty "${IS_APACHE}"; then LogText "Result: ${HTTPDBINARY} is not Apache" Display --indent 2 --text "- Checking Apache (binary ${HTTPDBINARY})" --result "NO MATCH" --color WHITE @@ -203,7 +203,7 @@ #if [ ${SKIPTEST} -eq 0 ]; then # # Testing Debian style # LogText "Test: searching loaded/enabled Apache modules" - # apachectl -t -D DUMP_MODULES 2>&1 | ${EGREPBINARY} -v "(Loaded Modules|Syntax OK)" | ${SEDBINARY} 's/(\(shared\|static\))//' | ${SEDBINARY} 's/ //' + # apachectl -t -D DUMP_MODULES 2>&1 | ${GREPBINARY} -E -v "(Loaded Modules|Syntax OK)" | ${SEDBINARY} 's/(\(shared\|static\))//' | ${SEDBINARY} 's/ //' # for I in ${APACHE_MODULES_ENABLED_LOCS}; do # LogText "Test: checking ${I}" # if [ -d ${I} ]; then @@ -381,7 +381,7 @@ done # Sort all discovered configuration lines and store unique ones. Also strip out the mime types configured in nginx - SORTFILE=$(${SORTBINARY} -u ${TMPFILE} | ${SEDBINARY} 's/ /:space:/g' | ${EGREPBINARY} -v "(application|audio|image|text|video)/" | ${EGREPBINARY} -v "({|})") + SORTFILE=$(${SORTBINARY} -u ${TMPFILE} | ${SEDBINARY} 's/ /:space:/g' | ${GREPBINARY} -E -v "(application|audio|image|text|video)/" | ${GREPBINARY} -E -v "({|})") for I in ${SORTFILE}; do I=$(echo ${I} | ${SEDBINARY} 's/:space:/ /g') Report "nginx_config_option[]=${I}"; From 09c03ce222c03996b652142bb89cc541b28a3243 Mon Sep 17 00:00:00 2001 From: xnoguer Date: Sun, 23 Apr 2023 17:40:16 -0400 Subject: [PATCH 018/108] Using grep -E --- lynis | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/lynis b/lynis index 3f6d3b84..5aa219b7 100755 --- a/lynis +++ b/lynis @@ -148,13 +148,25 @@ # Perform a basic check for permissions. After including functions, using SafePerms() IGNORE_FILE_PERMISSION_ISSUES=0 - FILES_TO_CHECK="consts functions" + FILES_TO_CHECK="consts functions parameters binaries osdetection data_upload" ISSUE=0 ISSUE_TYPE="" SHOWPERMERROR=0 for FILE in ${FILES_TO_CHECK}; do + SUGGESTED_PERMS=640 + if [ ${PRIVILEGED} -eq 0 ]; then + SUGGESTED_PERMS=644 + fi + + # First check if files are readable so the shell can execute them + if [ ! -r ${INCLUDEDIR}/${FILE} ]; then + ISSUE=1 + ISSUE_TYPE="perms" + echo "[!] Change file permissions of ${INCLUDEDIR}/${FILE} to ${SUGGESTED_PERMS}."; echo " Command: chmod ${SUGGESTED_PERMS} ${INCLUDEDIR}/${FILE}" + fi + PERMS=$(ls -l ${INCLUDEDIR}/${FILE} | cut -c 2-10) GROUPPERMS=$(ls -l ${INCLUDEDIR}/${FILE} | cut -c 5-7) GROUPOWNERID=$(ls -n ${INCLUDEDIR}/${FILE} | awk '{ print $4 }') @@ -163,11 +175,11 @@ # Check permissions of include/X file (400, 600, 640, 644) if [ "${PERMS}" = "rwxrwxrwx" ]; then - ISSUE=1; ISSUE_TYPE="perms"; echo "[!] Change file permissions of ${INCLUDEDIR}/${FILE} to 640."; echo " Command: chmod 640 ${INCLUDEDIR}/${FILE}" + ISSUE=1; ISSUE_TYPE="perms"; echo "[!] Change file permissions of ${INCLUDEDIR}/${FILE} to ${SUGGESTED_PERMS}."; echo " Command: chmod ${SUGGESTED_PERMS} ${INCLUDEDIR}/${FILE}" elif [ ! "${PERMS}" = "r--------" -a ! "${PERMS}" = "rw-------" -a ! "${PERMS}" = "rw-r-----" -a ! "${PERMS}" = "rw-r--r--" ]; then # If group ID equals user ID, we consider permissions to be fine (probably default umask) if [ ! "${GROUPOWNERID}" = "${OWNERID}" ]; then - ISSUE=1; ISSUE_TYPE="perms"; echo "[!] Change file permissions of ${INCLUDEDIR}/${FILE} to 640."; echo " Command: chmod 640 ${INCLUDEDIR}/${FILE}" + ISSUE=1; ISSUE_TYPE="perms"; echo "[!] Change file permissions of ${INCLUDEDIR}/${FILE} to ${SUGGESTED_PERMS}."; echo " Command: chmod ${SUGGESTED_PERMS} ${INCLUDEDIR}/${FILE}" fi fi @@ -193,7 +205,7 @@ if [ ${ISSUE} -eq 1 ]; then printf "\n[X] Security check failed\n\n Why do I see this error?\n -------------------------------\n This is a protection mechanism to prevent the root user from executing user created files. The files may be altered, or including malicious pieces of script.\n\n What can I do?\n ---------------------\n Option 1) Check if a trusted user created the files (e.g. due to using Git, Homebrew or similar).\n If you trust these files, you can decide to continue this run by pressing ENTER.\n" if [ "${ISSUE_TYPE}" = "perms" ]; then - printf "\n Option 2) Change permissions of the related files.\n\n Commands (full directory):\n # chmod 640 include/*\n # ./lynis audit system" + printf "\n Option 2) Change permissions of the related files.\n\n Commands (full directory):\n # chmod ${SUGGESTED_PERMS} include/*\n # ./lynis audit system" elif [ "${ISSUE_TYPE}" = "owner" ]; then printf "\n Option 2) Change ownership of the related files (or full directory).\n\n Commands (full directory):\n # cd ..\n # chown -R 0:0 lynis\n # cd lynis\n # ./lynis audit system" fi @@ -217,10 +229,10 @@ # Extract the short notation of the language (first two characters). if [ -x "$(command -v locale 2> /dev/null)" ]; then - LANGUAGE=$(locale | egrep "^LANG=" | cut -d= -f2 | cut -d_ -f1 | tr -d '"' | egrep "^[a-z]{2}$") + LANGUAGE=$(locale | grep -E "^LANG=" | cut -d= -f2 | cut -d_ -f1 | tr -d '"' | grep -E "^[a-z]{2}$") # Try locale command if shell variable had no value if [ -z "${DISPLAY_LANG}" ]; then - DISPLAY_LANG=$(locale | egrep "^LANG=" | cut -d= -f2) + DISPLAY_LANG=$(locale | grep -E "^LANG=" | cut -d= -f2) fi else LANGUAGE="en" @@ -1036,7 +1048,7 @@ ${NORMAL} if SafeFile ${INCLUDE_FILE}; then . ${INCLUDE_FILE} else - LogText "Exception: skipping test category ${INCLUDE_TEST}, file ${INCLUDE_FILE} has bad permissions (should be 640, 600 or 400)" + LogText "Exception: skipping test category ${INCLUDE_TEST}, file ${INCLUDE_FILE} has bad permissions (should be 644, 640, 600 or 400)" ReportWarning "NONE" "Invalid permissions on tests file tests_${INCLUDE_TEST}" # Insert a section and warn user also on screen InsertSection "${SECTION_GENERAL}" @@ -1063,7 +1075,7 @@ ${NORMAL} LogText "Result: file permissions fine, running custom tests" . ${INCLUDEDIR}/tests_custom else - LogText "Exception: skipping custom tests, file has bad permissions (should be 640, 600 or 400)" + LogText "Exception: skipping custom tests, file has bad permissions (should be 644, 640, 600 or 400)" ReportWarning "NONE" "Invalid permissions on custom tests file" Display --indent 2 --text "- Running custom tests... " --result "${STATUS_WARNING}" --color RED fi From c7b73837db1f68820befd06a63f2ab855a00d5f9 Mon Sep 17 00:00:00 2001 From: xnoguer Date: Sun, 23 Apr 2023 17:44:44 -0400 Subject: [PATCH 019/108] Removing changes from another branch --- include/functions | 5 ----- 1 file changed, 5 deletions(-) diff --git a/include/functions b/include/functions index 841586be..9c52044b 100644 --- a/include/functions +++ b/include/functions @@ -3103,11 +3103,6 @@ unsafe=1 LogText "Security alert: file is not owned by active user, but can write to it" fi - # File is not owned by active user, and not readable by him - if [ ! -O "${FILE}" -a ! -r "${FILE}" ]; then - unsafe=1 - LogText "Security alert: file is not readable by active user" - fi fi # Check file permissions From ea9c6dbcc8c6db00160db7691e7407ed83fab361 Mon Sep 17 00:00:00 2001 From: xnoguer Date: Sun, 23 Apr 2023 17:51:58 -0400 Subject: [PATCH 020/108] Removing --- lynis | 22 +++++----------------- 1 file changed, 5 insertions(+), 17 deletions(-) diff --git a/lynis b/lynis index 5aa219b7..1f401b97 100755 --- a/lynis +++ b/lynis @@ -148,25 +148,13 @@ # Perform a basic check for permissions. After including functions, using SafePerms() IGNORE_FILE_PERMISSION_ISSUES=0 - FILES_TO_CHECK="consts functions parameters binaries osdetection data_upload" + FILES_TO_CHECK="consts functions" ISSUE=0 ISSUE_TYPE="" SHOWPERMERROR=0 for FILE in ${FILES_TO_CHECK}; do - SUGGESTED_PERMS=640 - if [ ${PRIVILEGED} -eq 0 ]; then - SUGGESTED_PERMS=644 - fi - - # First check if files are readable so the shell can execute them - if [ ! -r ${INCLUDEDIR}/${FILE} ]; then - ISSUE=1 - ISSUE_TYPE="perms" - echo "[!] Change file permissions of ${INCLUDEDIR}/${FILE} to ${SUGGESTED_PERMS}."; echo " Command: chmod ${SUGGESTED_PERMS} ${INCLUDEDIR}/${FILE}" - fi - PERMS=$(ls -l ${INCLUDEDIR}/${FILE} | cut -c 2-10) GROUPPERMS=$(ls -l ${INCLUDEDIR}/${FILE} | cut -c 5-7) GROUPOWNERID=$(ls -n ${INCLUDEDIR}/${FILE} | awk '{ print $4 }') @@ -229,10 +217,10 @@ # Extract the short notation of the language (first two characters). if [ -x "$(command -v locale 2> /dev/null)" ]; then - LANGUAGE=$(locale | grep -E "^LANG=" | cut -d= -f2 | cut -d_ -f1 | tr -d '"' | grep -E "^[a-z]{2}$") + LANGUAGE=$(locale | egrep "^LANG=" | cut -d= -f2 | cut -d_ -f1 | tr -d '"' | grep -E "^[a-z]{2}$") # Try locale command if shell variable had no value if [ -z "${DISPLAY_LANG}" ]; then - DISPLAY_LANG=$(locale | grep -E "^LANG=" | cut -d= -f2) + DISPLAY_LANG=$(locale | egrep "^LANG=" | cut -d= -f2) fi else LANGUAGE="en" @@ -1048,7 +1036,7 @@ ${NORMAL} if SafeFile ${INCLUDE_FILE}; then . ${INCLUDE_FILE} else - LogText "Exception: skipping test category ${INCLUDE_TEST}, file ${INCLUDE_FILE} has bad permissions (should be 644, 640, 600 or 400)" + LogText "Exception: skipping test category ${INCLUDE_TEST}, file ${INCLUDE_FILE} has bad permissions (should be 640, 600 or 400)" ReportWarning "NONE" "Invalid permissions on tests file tests_${INCLUDE_TEST}" # Insert a section and warn user also on screen InsertSection "${SECTION_GENERAL}" @@ -1075,7 +1063,7 @@ ${NORMAL} LogText "Result: file permissions fine, running custom tests" . ${INCLUDEDIR}/tests_custom else - LogText "Exception: skipping custom tests, file has bad permissions (should be 644, 640, 600 or 400)" + LogText "Exception: skipping custom tests, file has bad permissions (should be 640, 600 or 400)" ReportWarning "NONE" "Invalid permissions on custom tests file" Display --indent 2 --text "- Running custom tests... " --result "${STATUS_WARNING}" --color RED fi From 25a5d7af40070566cebc6a19c8f4841aabca100e Mon Sep 17 00:00:00 2001 From: xnoguer Date: Sun, 23 Apr 2023 17:53:22 -0400 Subject: [PATCH 021/108] Removing --- lynis | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lynis b/lynis index 1f401b97..a92e3556 100755 --- a/lynis +++ b/lynis @@ -163,11 +163,11 @@ # Check permissions of include/X file (400, 600, 640, 644) if [ "${PERMS}" = "rwxrwxrwx" ]; then - ISSUE=1; ISSUE_TYPE="perms"; echo "[!] Change file permissions of ${INCLUDEDIR}/${FILE} to ${SUGGESTED_PERMS}."; echo " Command: chmod ${SUGGESTED_PERMS} ${INCLUDEDIR}/${FILE}" + ISSUE=1; ISSUE_TYPE="perms"; echo "[!] Change file permissions of ${INCLUDEDIR}/${FILE} to 640."; echo " Command: chmod 640 ${INCLUDEDIR}/${FILE}" elif [ ! "${PERMS}" = "r--------" -a ! "${PERMS}" = "rw-------" -a ! "${PERMS}" = "rw-r-----" -a ! "${PERMS}" = "rw-r--r--" ]; then # If group ID equals user ID, we consider permissions to be fine (probably default umask) if [ ! "${GROUPOWNERID}" = "${OWNERID}" ]; then - ISSUE=1; ISSUE_TYPE="perms"; echo "[!] Change file permissions of ${INCLUDEDIR}/${FILE} to ${SUGGESTED_PERMS}."; echo " Command: chmod ${SUGGESTED_PERMS} ${INCLUDEDIR}/${FILE}" + ISSUE=1; ISSUE_TYPE="perms"; echo "[!] Change file permissions of ${INCLUDEDIR}/${FILE} to 640."; echo " Command: chmod 640 ${INCLUDEDIR}/${FILE}" fi fi @@ -217,10 +217,10 @@ # Extract the short notation of the language (first two characters). if [ -x "$(command -v locale 2> /dev/null)" ]; then - LANGUAGE=$(locale | egrep "^LANG=" | cut -d= -f2 | cut -d_ -f1 | tr -d '"' | grep -E "^[a-z]{2}$") + LANGUAGE=$(locale | grep -E "^LANG=" | cut -d= -f2 | cut -d_ -f1 | tr -d '"' | grep -E "^[a-z]{2}$") # Try locale command if shell variable had no value if [ -z "${DISPLAY_LANG}" ]; then - DISPLAY_LANG=$(locale | egrep "^LANG=" | cut -d= -f2) + DISPLAY_LANG=$(locale | grep -E "^LANG=" | cut -d= -f2) fi else LANGUAGE="en" From 346b843662376002e34c2e92a1914ae5233c56b0 Mon Sep 17 00:00:00 2001 From: xnoguer Date: Sun, 23 Apr 2023 17:54:01 -0400 Subject: [PATCH 022/108] Removing --- lynis | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lynis b/lynis index a92e3556..3a628424 100755 --- a/lynis +++ b/lynis @@ -193,7 +193,7 @@ if [ ${ISSUE} -eq 1 ]; then printf "\n[X] Security check failed\n\n Why do I see this error?\n -------------------------------\n This is a protection mechanism to prevent the root user from executing user created files. The files may be altered, or including malicious pieces of script.\n\n What can I do?\n ---------------------\n Option 1) Check if a trusted user created the files (e.g. due to using Git, Homebrew or similar).\n If you trust these files, you can decide to continue this run by pressing ENTER.\n" if [ "${ISSUE_TYPE}" = "perms" ]; then - printf "\n Option 2) Change permissions of the related files.\n\n Commands (full directory):\n # chmod ${SUGGESTED_PERMS} include/*\n # ./lynis audit system" + printf "\n Option 2) Change permissions of the related files.\n\n Commands (full directory):\n # chmod 640 include/*\n # ./lynis audit system" elif [ "${ISSUE_TYPE}" = "owner" ]; then printf "\n Option 2) Change ownership of the related files (or full directory).\n\n Commands (full directory):\n # cd ..\n # chown -R 0:0 lynis\n # cd lynis\n # ./lynis audit system" fi From c845cecb6fb709d3bc81e0519688ff2bd5a5fe61 Mon Sep 17 00:00:00 2001 From: xnoguer Date: Sun, 23 Apr 2023 19:00:16 -0400 Subject: [PATCH 023/108] Fixing test --- include/tests_php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/tests_php b/include/tests_php index 858bc14b..04502f68 100644 --- a/include/tests_php +++ b/include/tests_php @@ -285,7 +285,7 @@ # Test : PHP-2368 # Description : Check php register_globals option # Notes : Don't test for it if PHP version is 5.4.0 or later (it has been removed) - if [ -n "${PHPINIFILE}" -a -n "${PHPVERSION}" -a -n "${GREPBINARY} -E" ]; then + if [ -n "${PHPINIFILE}" -a -n "${PHPVERSION}" -a -n "${GREPBINARY}" ]; then if [ -f "${PHPINIFILE}" ]; then FIND=$(echo ${PHPVERSION} | ${GREPBINARY} -E "^(4.|5.[0-3])") if [ -z "${FIND}" ]; then From 7d494da5c49e9ac48bedf8043bd002aa213f879b Mon Sep 17 00:00:00 2001 From: xnoguer Date: Tue, 25 Apr 2023 10:06:02 -0400 Subject: [PATCH 024/108] Checking for errors, not only warning in docker info output --- include/tests_containers | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/tests_containers b/include/tests_containers index af10997d..c8d23b2a 100644 --- a/include/tests_containers +++ b/include/tests_containers @@ -107,7 +107,7 @@ LogText "Result: disabling further Docker tests as docker version gave exit code other than zero (0)" RUN_DOCKER_TESTS=0 fi - FIND=$(${DOCKERBINARY} info 2>&1 | ${GREPBINARY} "^WARNING:" | ${CUTBINARY} -d " " -f 2- | ${SEDBINARY} 's/ /:space:/g') + FIND=$(${DOCKERBINARY} info 2>&1 | ${GREPBINARY} -E "^WARNING:|^ERROR:" | ${CUTBINARY} -d " " -f 2- | ${SEDBINARY} 's/ /:space:/g') if [ ! "${FIND}" = "" ]; then LogText "Result: found warning(s) in output" for I in ${FIND}; do From e1cb35f28fdc4d9340087f581c5408cc629679d6 Mon Sep 17 00:00:00 2001 From: xnoguer Date: Thu, 27 Apr 2023 17:31:32 -0400 Subject: [PATCH 025/108] Adding package libpam-passwdqc as suggestion --- include/tests_authentication | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/tests_authentication b/include/tests_authentication index 0552d646..4f3e8287 100644 --- a/include/tests_authentication +++ b/include/tests_authentication @@ -717,7 +717,7 @@ if [ ${FOUND} -eq 0 ]; then Display --indent 2 --text "- PAM password strength tools" --result "${STATUS_SUGGESTION}" --color YELLOW LogText "Result: no PAM modules for password strength testing found" - ReportSuggestion "${TEST_NO}" "Install a PAM module for password strength testing like pam_cracklib or pam_passwdqc" + ReportSuggestion "${TEST_NO}" "Install a PAM module for password strength testing like pam_cracklib or pam_passwdqc or libpam-passwdqc" AddHP 0 3 else Display --indent 2 --text "- PAM password strength tools" --result "${STATUS_OK}" --color GREEN From dde2299e69810261c3f1e181ce82bf93c07397ae Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Tue, 2 May 2023 08:42:59 +0000 Subject: [PATCH 026/108] Updated log --- CHANGELOG.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ad1cbeb8..ab464ab6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,7 +3,11 @@ ## Lynis 3.0.9 (not released yet) ### Changed -- DBS-1820 - added newer style format for Mongo authorization setting +- DBS-1820 - Added newer style format for Mongo authorization setting +- FILE-6410 - Locations added for plocate +- SSH-7408 - Only test Compression if sshd version < 7.4 +- Improved fetching timestamp +- Minor changes such as typos --------------------------------------------------------------------------------- From 87624e7c758dd3f208f40405863b198b3dd36080 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Tue, 2 May 2023 08:47:25 +0000 Subject: [PATCH 027/108] Release version 3.0.9 --- CHANGELOG.md | 2 +- lynis | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ab464ab6..eba36baf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Lynis Changelog -## Lynis 3.0.9 (not released yet) +## Lynis 3.0.9 (2023-05-02) ### Changed - DBS-1820 - Added newer style format for Mongo authorization setting diff --git a/lynis b/lynis index 3f6d3b84..2378b4cd 100755 --- a/lynis +++ b/lynis @@ -43,10 +43,10 @@ PROGRAM_WEBSITE="https://cisofy.com/lynis/" # Version details - PROGRAM_RELEASE_DATE="2022-05-17" - PROGRAM_RELEASE_TIMESTAMP=1652791205 + PROGRAM_RELEASE_DATE="2023-05-02" + PROGRAM_RELEASE_TIMESTAMP=1683017189 PROGRAM_RELEASE_TYPE="release" # pre-release or release - PROGRAM_VERSION="3.0.8" + PROGRAM_VERSION="3.0.9" # Source, documentation and license PROGRAM_SOURCE="https://github.com/CISOfy/lynis" From 2b82fa6ebad1d82ba41acdce50dbdbb7aae56abe Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Tue, 2 May 2023 16:22:13 -0400 Subject: [PATCH 028/108] osdetection: add OpenEmbedded and Poky Signed-off-by: Armin Kuster --- include/osdetection | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/include/osdetection b/include/osdetection index 989b1b38..e5974e5f 100644 --- a/include/osdetection +++ b/include/osdetection @@ -308,6 +308,12 @@ OS_REDHAT_OR_CLONE=1 OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') ;; + "nodistro") + LINUX_VERSION="openembedded" + OS_NAME="OpenEmbedded" + OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') + OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') + ;; "opensuse-tumbleweed") LINUX_VERSION="openSUSE Tumbleweed" # It's rolling release but has a snapshot version (the date of the snapshot) @@ -330,6 +336,14 @@ OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') OS_VERSION_FULL=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') ;; + "poky") + LINUX_VERSION="Poky" + OS_NAME="openembedded" + LINUX_VERSION_LIKE="openembedded" + OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') + OS_VERSION_FULL=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') + + ;; "pop") LINUX_VERSION="Pop!_OS" LINUX_VERSION_LIKE="Ubuntu" From ae129b24beb9e9fc3cde7f45e33fea41a694efd5 Mon Sep 17 00:00:00 2001 From: Xavier Noguer Date: Thu, 18 May 2023 22:02:30 +0000 Subject: [PATCH 029/108] Adding missing test number for suggestion --- include/tests_nameservices | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/tests_nameservices b/include/tests_nameservices index 8c483d08..5431b0ff 100644 --- a/include/tests_nameservices +++ b/include/tests_nameservices @@ -485,7 +485,7 @@ LogText "Result: ypldap is running" Display --indent 2 --text "- Checking ypldap status" --result "${STATUS_FOUND}" --color GREEN else - ReportSuggestion "Disable the usage of NIS/NIS+ and use an alternative like LDAP or Kerberos instead" + ReportSuggestion "${TEST_NO}" "Disable the usage of NIS/NIS+ and use an alternative like LDAP or Kerberos instead" fi else LogText "Result: ypbind is not active" From 6fdfa0a0129e2866ebdc233d771722d09034d9cc Mon Sep 17 00:00:00 2001 From: Xavier Noguer Date: Fri, 19 May 2023 23:12:39 +0000 Subject: [PATCH 030/108] Replacing deprecated option -i --- include/tests_databases | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/tests_databases b/include/tests_databases index e973d23f..dbc1d857 100644 --- a/include/tests_databases +++ b/include/tests_databases @@ -216,8 +216,8 @@ Register --test-no DBS-1828 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Test PostgreSQL configuration" if [ ${SKIPTEST} -eq 0 ]; then - FIND_PATHS="${ROOTDIR}etc/postgres ${ROOTDIR}var/lib/postgres/data ${ROOTDIR}usr/local/pgsql/data" - CONFIG_FILES=$(${FINDBINARY} -L ${FIND_PATHS} -type f -name "*.conf" -print0 2> /dev/null | ${TRBINARY} -cd '[:print:]\0' | ${TRBINARY} -d '\n' | ${TRBINARY} '\0' '\n' | xargs -i sh -c 'test -r "{}" && echo "{}"' | ${SEDBINARY} "s/ /:space:/g") + FIND_PATHS="${ROOTDIR}etc/postgres ${ROOTDIR}etc/postgresql ${ROOTDIR}var/lib/postgres/data ${ROOTDIR}usr/local/pgsql/data" + CONFIG_FILES=$(${FINDBINARY} -L ${FIND_PATHS} -type f -name "*.conf" -print0 2> /dev/null | ${TRBINARY} -cd '[:print:]\0' | ${TRBINARY} -d '\n' | ${TRBINARY} '\0' '\n' | xargs -I{} sh -c 'test -r "{}" && echo "{}"' | ${SEDBINARY} "s/ /:space:/g") for CF in ${CONFIG_FILES}; do Report "postgresql_config_file[]=${CF}" LogText "Found configuration file (${CF})" From dbf263dbbd218e6bdf19e7d096c9595e40a8fee1 Mon Sep 17 00:00:00 2001 From: Xavier Noguer Date: Sat, 20 May 2023 15:58:12 +0000 Subject: [PATCH 031/108] Looking for configuration files in all /usr/local/pgsql/data* directories --- include/tests_databases | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/tests_databases b/include/tests_databases index e973d23f..aeacaa4a 100644 --- a/include/tests_databases +++ b/include/tests_databases @@ -216,7 +216,8 @@ Register --test-no DBS-1828 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Test PostgreSQL configuration" if [ ${SKIPTEST} -eq 0 ]; then - FIND_PATHS="${ROOTDIR}etc/postgres ${ROOTDIR}var/lib/postgres/data ${ROOTDIR}usr/local/pgsql/data" + FIND_PATHS=$(${LSBINARY} -d ${ROOTDIR}usr/local/pgsql/data* 2> /dev/null) + FIND_PATHS="${FIND_PATHS} ${ROOTDIR}etc/postgres ${ROOTDIR}var/lib/postgres/data ${ROOTDIR}usr/local/pgsql/data" CONFIG_FILES=$(${FINDBINARY} -L ${FIND_PATHS} -type f -name "*.conf" -print0 2> /dev/null | ${TRBINARY} -cd '[:print:]\0' | ${TRBINARY} -d '\n' | ${TRBINARY} '\0' '\n' | xargs -i sh -c 'test -r "{}" && echo "{}"' | ${SEDBINARY} "s/ /:space:/g") for CF in ${CONFIG_FILES}; do Report "postgresql_config_file[]=${CF}" From 9f36e17ee0afd881468c496da3d1ae4ba80956b3 Mon Sep 17 00:00:00 2001 From: Xavier Noguer Date: Tue, 23 May 2023 15:07:42 +0000 Subject: [PATCH 032/108] Added tests considering Wazuh for file integrity and tooling --- db/tests.db | 2 ++ include/tests_file_integrity | 19 +++++++++++++++++++ include/tests_hardening | 2 +- include/tests_tooling | 29 +++++++++++++++++++++++++++++ 4 files changed, 51 insertions(+), 1 deletion(-) diff --git a/db/tests.db b/db/tests.db index e4dc8fbd..69a68bc9 100644 --- a/db/tests.db +++ b/db/tests.db @@ -148,6 +148,7 @@ FINT-4338:test:security:file_integrity::osqueryd syscheck daemon running: FINT-4339:test:security:file_integrity:Linux:Check IMA/EVM Status FINT-4340:test:security:file_integrity:Linux:Check dm-integrity status FINT-4341:test:security:file_integrity:Linux:Check dm-verity status +FINT-4344:test:security:file_integrity::Wazuh syscheck daemon running: FINT-4350:test:security:file_integrity::File integrity software installed: FINT-4402:test:security:file_integrity::Checksums (SHA256 or SHA512): FIRE-4502:test:security:firewalls:Linux:Check iptables kernel module: @@ -437,6 +438,7 @@ TOOL-5102:test:security:tooling::Check for presence of Fail2ban: TOOL-5104:test:security:tooling::Enabled tests for Fail2ban: TOOL-5120:test:security:tooling::Presence of Snort IDS: TOOL-5122:test:security:tooling::Snort IDS configuration file: +TOOL-5128:test:security:tooling::Check for active Wazuh daemon: TOOL-5130:test:security:tooling::Check for active Suricata daemon: TOOL-5160:test:security:tooling::Check for active OSSEC daemon: TOOL-5190:test:security:tooling::Check presence of available IDS/IPS tooling: diff --git a/include/tests_file_integrity b/include/tests_file_integrity index 8a38b97e..a0bf497f 100644 --- a/include/tests_file_integrity +++ b/include/tests_file_integrity @@ -398,6 +398,25 @@ fi # ################################################################################# +# + # Test : FINT-4344 + # Description : Check if Wazuh system integrity tool is running + Register --test-no FINT-4344 --weight L --network NO --category security --description "Wazuh syscheck daemon running" + if [ ${SKIPTEST} -eq 0 ]; then + LogText "Test: Checking if Wazuh syscheck daemon is running" + if IsRunning "wazuh-syscheckd"; then + LogText "Result: syscheck (Wazuh) active" + Report "file_integrity_tool[]=wazuh" + FILE_INT_TOOL="wazuh-syscheck" + FILE_INT_TOOL_FOUND=1 + Display --indent 4 --text "- Wazuh (syscheck)" --result "${STATUS_FOUND}" --color GREEN + else + LogText "Result: syscheck (Wazuh) is not active" + if IsVerbose; then Display --indent 4 --text "- Wazuh" --result "${STATUS_NOT_FOUND}" --color WHITE; fi + fi + fi +# +################################################################################# # # Test : FINT-4402 (was FINT-4316) # Description : Check if AIDE is configured to use SHA256 or SHA512 checksums diff --git a/include/tests_hardening b/include/tests_hardening index c414edb6..8ca04d6d 100644 --- a/include/tests_hardening +++ b/include/tests_hardening @@ -99,7 +99,7 @@ else Display --indent 4 --text "- Installed malware scanner" --result "${STATUS_NOT_FOUND}" --color RED fi - ReportSuggestion "${TEST_NO}" "Harden the system by installing at least one malware scanner, to perform periodic file system scans" "-" "Install a tool like rkhunter, chkrootkit, OSSEC" + ReportSuggestion "${TEST_NO}" "Harden the system by installing at least one malware scanner, to perform periodic file system scans" "-" "Install a tool like rkhunter, chkrootkit, OSSEC, Wazuh" AddHP 1 3 LogText "Result: no malware scanner found" fi diff --git a/include/tests_tooling b/include/tests_tooling index 083f5045..2ef9f81b 100644 --- a/include/tests_tooling +++ b/include/tests_tooling @@ -428,6 +428,35 @@ fi # ################################################################################# +# + # Test : TOOL-5128 + # Description : Check for Wazuh daemon + Register --test-no TOOL-5128 --weight L --network NO --category security --description "Check for active Wazuh daemon" + if [ ${SKIPTEST} -eq 0 ]; then + # Server side + if IsRunning "wazuh-analysisd"; then + IDS_IPS_TOOL_FOUND=1 + Report "ids_ips_tooling[]=wazuh" + Report "ids_ips_tooling[]=wazuh-analysisd" + LogText "Result: Wazuh analysis daemon is active" + Display --indent 2 --text "- Checking presence of Wazuh (analysis)" --result "${STATUS_FOUND}" --color GREEN + else + LogText "Result: Wazuh analysis daemon not active" + fi + + # Client side + if IsRunning "wazuh-agentd"; then + IDS_IPS_TOOL_FOUND=1 + Report "ids_ips_tooling[]=wazuh" + Report "ids_ips_tooling[]=wazuh-agentd" + LogText "Result: Wazuh agent daemon is active" + Display --indent 2 --text "- Checking presence of Wazuh (agent)" --result "${STATUS_FOUND}" --color GREEN + else + LogText "Result: Wazuh agent daemon not active" + fi + fi +# +################################################################################# # # Test : TOOL-5190 # Description : Check for an IDS/IPS tool From 1e70cd0b9252f4d0e2b231c2b7c482cbee6560f0 Mon Sep 17 00:00:00 2001 From: Xavier Noguer Date: Tue, 30 May 2023 08:04:36 +0000 Subject: [PATCH 033/108] Fixing missing or erroneous test number comments --- include/tests_insecure_services | 4 +++- include/tests_system_integrity | 2 ++ include/tests_tooling | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/include/tests_insecure_services b/include/tests_insecure_services index f01966f2..b27ff168 100644 --- a/include/tests_insecure_services +++ b/include/tests_insecure_services @@ -371,7 +371,7 @@ # ################################################################################# # - # Test : INSE-8312 + # Test : INSE-8322 # Description : Check if telnet server is installed Register --test-no INSE-8322 --package-manager-required --weight L --network NO --category security --description "Check if telnet server is installed" if [ ${SKIPTEST} -eq 0 ]; then @@ -492,6 +492,8 @@ # ################################################################################# # + # Test : INSE-8050 + # Description : Check for insecure services on macOS if [ -n "${LAUNCHCTL_BINARY}" ]; then PREQS_MET="YES"; SKIPREASON=""; else PREQS_MET="NO"; SKIPREASON="No launchctl binary on this system"; fi Register --test-no INSE-8050 --os "macOS" --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight M --network NO --category security --description "Check for insecure services on macOS" if [ ${SKIPTEST} -eq 0 ]; then diff --git a/include/tests_system_integrity b/include/tests_system_integrity index befe09a0..9c5b1e51 100644 --- a/include/tests_system_integrity +++ b/include/tests_system_integrity @@ -30,6 +30,8 @@ # ################################################################################# # + # Test : SINT-7010 + # Description : System Integrity Status if [ -x ${ROOTDIR}/usr/bin/csrutil ]; then PREQS_MET="YES"; else PREQS_MET="NO"; SKIPREASON="No CSrutil binary found"; fi Register --test-no SINT-7010 --os MacOS --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight H --network NO --category security --description "System Integrity Status" if [ ${SKIPTEST} -eq 0 ]; then diff --git a/include/tests_tooling b/include/tests_tooling index 083f5045..cda48616 100644 --- a/include/tests_tooling +++ b/include/tests_tooling @@ -400,7 +400,7 @@ # ################################################################################# # - # Test : TOOL-5160 + # Test : TOOL-5126 # Description : Check for OSSEC Register --test-no TOOL-5126 --weight L --network NO --category security --description "Check for active OSSEC daemon" if [ ${SKIPTEST} -eq 0 ]; then From aa7085bf929bac4d454ed8f4c5dad413d3234f3d Mon Sep 17 00:00:00 2001 From: Ben Perry Date: Tue, 30 May 2023 18:19:46 +1000 Subject: [PATCH 034/108] Update tests_malware --- include/tests_malware | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/include/tests_malware b/include/tests_malware index 40336fa5..41814b43 100644 --- a/include/tests_malware +++ b/include/tests_malware @@ -39,6 +39,7 @@ MALWARE_SCANNER_INSTALLED=0 MALWARE_DAEMON_RUNNING=0 ROOTKIT_SCANNER_FOUND=0 + SENTINELONE_SCANNER_FOUND=0 SOPHOS_SCANNER_RUNNING=0 SYMANTEC_SCANNER_RUNNING=0 SYNOLOGY_DAEMON_RUNNING=0 @@ -231,6 +232,20 @@ Report "malware_scanner[]=mcafee" fi + # SentinelOne + LogText "Text: checking process sentineld (SentinelOne)" + if isRunning "sentineld"; then SENTINELONE_SCANNER_RUNNING=1; fi # macOS + if isRunning "s1-agent"; then SENTINELONE_SCANNER_RUNNING=1; fi # Linux + if isRunning "SentinelAgent"; then SENTINELONE_SCANNER_RUNNING=1; fi # Windows + if [ ${SENTINELONE_SCANNER_RUNNING} -eq 1 ]; then + FOUND=1 + if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} SentinelOne" --result "${STATUS_FOUND}" --color GREEN; fi + LogText "Result: Found SentinelOne" + MALWARE_DAEMON_RUNNING=1 + MALWARE_SCANNER_INSTALLED=1 + Report "malware_scanner[]=sentinelone" + fi + # Sophos savscand/SophosScanD LogText "Test: checking process savscand" if IsRunning "savscand"; then From b16b4628c7d7bb585c50e7a0f8d7f75fc2308cf4 Mon Sep 17 00:00:00 2001 From: Xavier Noguer Date: Tue, 30 May 2023 08:38:17 +0000 Subject: [PATCH 035/108] Fixing test numbers in db/tests.db with the actual numbers used for those tests --- db/tests.db | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/db/tests.db b/db/tests.db index e4dc8fbd..5e7acf4c 100644 --- a/db/tests.db +++ b/db/tests.db @@ -204,7 +204,7 @@ INSE-8200:test:security:insecure_services::Usage of TCP wrappers: INSE-8300:test:security:insecure_services::Presence of rsh client: INSE-8302:test:security:insecure_services::Presence of rsh server: INSE-8310:test:security:insecure_services::Presence of telnet client: -INSE-8312:test:security:insecure_services::Presence of telnet server: +INSE-8322:test:security:insecure_services::Presence of telnet server: INSE-8314:test:security:insecure_services::Presence of NIS client: INSE-8316:test:security:insecure_services::Presence of NIS server: INSE-8318:test:security:insecure_services::Presence of TFTP client: @@ -438,7 +438,7 @@ TOOL-5104:test:security:tooling::Enabled tests for Fail2ban: TOOL-5120:test:security:tooling::Presence of Snort IDS: TOOL-5122:test:security:tooling::Snort IDS configuration file: TOOL-5130:test:security:tooling::Check for active Suricata daemon: -TOOL-5160:test:security:tooling::Check for active OSSEC daemon: +TOOL-5126:test:security:tooling::Check for active OSSEC daemon: TOOL-5190:test:security:tooling::Check presence of available IDS/IPS tooling: USB-1000:test:security:storage:Linux:Check if USB storage is disabled: USB-2000:test:security:storage:Linux:Check USB authorizations: From 6963e4e408fcebc16e00d5e286abfefd93627423 Mon Sep 17 00:00:00 2001 From: Xavier Noguer Date: Tue, 30 May 2023 14:56:11 +0000 Subject: [PATCH 036/108] Updating parsing of arch-audit since arch-audit modified its output --- include/tests_ports_packages | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/tests_ports_packages b/include/tests_ports_packages index 9ca1948d..6ffe1b54 100644 --- a/include/tests_ports_packages +++ b/include/tests_ports_packages @@ -347,12 +347,13 @@ Register --test-no PKGS-7322 --os "Linux" --preqs-met ${PREQS_MET} --skip-reason "${SKIPREASON}" --weight L --network NO --category security --description "Discover vulnerable packages with arch-audit" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: checking arch-audit output for vulnerable packages" - FIND=$(${ARCH_AUDIT_BINARY} | ${SEDBINARY} 's/\.\..*$//' | ${SEDBINARY} 's/, //g' | ${SEDBINARY} 's/\(\["\|"\]\)//g' | ${SEDBINARY} 's/""/,/g' | ${AWKBINARY} '{ if($1=="Package") { print $2"|"$6"|"}}' | ${AWKBINARY} -F'|' 'NF>1{a[$1] = a[$1]","$2}END{for(i in a){print i""a[i]"|"}}' | ${SEDBINARY} 's/,/|cve=/' | ${SORTBINARY}) + FIND=$(${ARCH_AUDIT_BINARY} | ${SEDBINARY} 's/ High risk!//' | ${SEDBINARY} 's/ Medium risk!//' | ${SEDBINARY} 's/ Low risk!//' | ${SEDBINARY} 's/\.\..*$//' | ${SEDBINARY} 's/, /,/g' | ${SEDBINARY} 's/\(\["\|"\]\)//g' | ${SEDBINARY} 's/""/,/g' | ${AWKBINARY} '{if ($0 ~ /is affected by CVE\-/) {print $1"|"$5"|"} else {ORS=""; print $1"|"; for (i=5; i<=NF; i++)print $i; print "\n"; ORS="\n"}}'| ${AWKBINARY} -F'|' 'NF>1{a[$1] = a[$1]","$2}END{for(i in a){print i""a[i]"|"}}' | ${SEDBINARY} 's/,CVE-/|cve=CVE-/' | ${SORTBINARY}) if [ -z "${FIND}" ]; then LogText "Result: no vulnerable packages found with arch-audit" AddHP 10 10 else LogText "Result: found one or more vulnerable packages" + VULNERABLE_PACKAGES_FOUND=1 for ITEM in ${FIND}; do LogText "Found line: ${ITEM}" Report "vulnerable_package[]=${ITEM}" From be5a63a45bd3454ed5bdd3f96a2f287c228307dd Mon Sep 17 00:00:00 2001 From: Jay Keller <70912302+digitalcheetah@users.noreply.github.com> Date: Sat, 10 Jun 2023 11:03:48 +0000 Subject: [PATCH 037/108] Update osdetection with Guix Closes issue #1379 --- include/osdetection | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/include/osdetection b/include/osdetection index 989b1b38..4c51a7a8 100644 --- a/include/osdetection +++ b/include/osdetection @@ -260,6 +260,12 @@ OS_NAME="Gentoo Linux" OS_VERSION="Rolling release" ;; + "guix") + LINUX_VERSION="Guix" + OS_FULLNAME="Guix System" + OS_NAME="Guix" + OS_VERSION="Rolling release" + ;; "ipfire") LINUX_VERSION="IPFire" OS_NAME="IPFire" From 5214132e97313bc0660317605e816d2b72296617 Mon Sep 17 00:00:00 2001 From: Jay Keller <70912302+digitalcheetah@users.noreply.github.com> Date: Sat, 10 Jun 2023 11:20:10 +0000 Subject: [PATCH 038/108] Update osdetection with LSDK This should close issue #1393. --- include/osdetection | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/include/osdetection b/include/osdetection index 989b1b38..fe92c500 100644 --- a/include/osdetection +++ b/include/osdetection @@ -278,6 +278,11 @@ OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') ;; + "lsdk") + LINUX_VERSION="NXP LSDK" + OS_NAME="NXP LSDK" + OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') + ;; "mageia") LINUX_VERSION="Mageia" OS_NAME="Mageia" From 6e3cea8c87c04dce721b8c7afa9027a810af5f96 Mon Sep 17 00:00:00 2001 From: rpmbuild Date: Sun, 30 Jul 2023 09:37:10 +0200 Subject: [PATCH 039/108] use grep -E instead of egrep if possible --- include/binaries | 9 +++++++++ include/tests_time | 2 +- lynis | 4 ++-- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/include/binaries b/include/binaries index 7aabba42..8b174eed 100644 --- a/include/binaries +++ b/include/binaries @@ -337,6 +337,15 @@ Report "binaries_sgid_count=${SGID_BINARIES}" Report "binary_paths=${BINARY_PATHS_FOUND}" + # If grep is capable of extended regexp, use that instead of egrep to avoid annoying warning + if [ "${GREPBINARY:-}" ] ; then + ${GREPBINARY} --help | ${GREPBINARY} -e "extended-regexp" > /dev/null + if [ $? -eq 0 ] ; then + EGREPBINARY="${GREPBINARY} -E" + fi + fi + + # Test if the basic system tools are defined. These will be used during the audit. [ "${AWKBINARY:-}" ] || ExitFatal "awk binary not found" [ "${CAT_BINARY:-}" ] || ExitFatal "cat binary not found" diff --git a/include/tests_time b/include/tests_time index df9a86b7..f20beed8 100644 --- a/include/tests_time +++ b/include/tests_time @@ -164,7 +164,7 @@ FIND=$(echo "${J}" | ${EGREPBINARY} '/.placeholder$') if [ -f "${J}" ] && [ -r "${J}" ] && [ -z "${FIND}" ]; then LogText "Test: checking for ntpdate, rdate, sntp or ntpdig in ${J}" - FIND=$("${EGREPBINARY}" "${CRONTAB_REGEX}" "${J}" | "${GREPBINARY}" -v "^#") + FIND=$(${EGREPBINARY} "${CRONTAB_REGEX}" "${J}" | "${GREPBINARY}" -v "^#") if [ -n "${FIND}" ]; then FOUND=1; FOUND_IN_CRON=1; NTP_CONFIG_TYPE_SCHEDULED=1 LogText "Result: found ntpdate, rdate, sntp or ntpdig in ${J}" diff --git a/lynis b/lynis index 3f6d3b84..fd891d8e 100755 --- a/lynis +++ b/lynis @@ -217,10 +217,10 @@ # Extract the short notation of the language (first two characters). if [ -x "$(command -v locale 2> /dev/null)" ]; then - LANGUAGE=$(locale | egrep "^LANG=" | cut -d= -f2 | cut -d_ -f1 | tr -d '"' | egrep "^[a-z]{2}$") + LANGUAGE=$(locale | grep -e "^LANG=" | cut -d= -f2 | cut -d_ -f1 | tr -d '"' | grep -E -e "^[a-z]{2}$") # Try locale command if shell variable had no value if [ -z "${DISPLAY_LANG}" ]; then - DISPLAY_LANG=$(locale | egrep "^LANG=" | cut -d= -f2) + DISPLAY_LANG=$(locale | grep -e "^LANG=" | cut -d= -f2) fi else LANGUAGE="en" From e797d2d3bf59e9ab5bbdcd5cc7a5c1668500370f Mon Sep 17 00:00:00 2001 From: "Samuel Henrique (samueloph)" Date: Wed, 2 Aug 2023 17:19:58 +0000 Subject: [PATCH 040/108] Update Amazon Linux EOL dates and add Amazon Linux 2023 Sources: AL2023 EOL: https://docs.aws.amazon.com/linux/al2023/release-notes/support-info-by-support-statement.html#support-info-by-support-statement-eol AL2 EOL: https://aws.amazon.com/amazon-linux-2/faqs/ AL EOL: https://aws.amazon.com/blogs/aws/update-on-amazon-linux-ami-end-of-life/ --- db/software-eol.db | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/db/software-eol.db b/db/software-eol.db index f8242d35..ff33a056 100644 --- a/db/software-eol.db +++ b/db/software-eol.db @@ -28,8 +28,9 @@ os:Alpine 3.8:2020-05-01:1588305600 # Amazon Linux # # Note: shortest entry is listed at end due to regular expression matching being used -os:Amazon Linux 2:2023-06-26:1687730400: -os:Amazon Linux:2020-06-30:1593468000: +os:Amazon Linux 2023:2028-03-15:1836691200: +os:Amazon Linux 2:2025-06-30:1751241600: +os:Amazon Linux:2023-12-31:1703980800: # # Arch Linux # From a23853eebd86573a3af9c889250cd7f916d2e3cd Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:24:18 +0200 Subject: [PATCH 041/108] Add STATUS_NOT_ACTIVE --- db/languages/en | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/en b/db/languages/en index 3fc11069..52ace1f7 100644 --- a/db/languages/en +++ b/db/languages/en @@ -84,6 +84,7 @@ STATUS_NO="NO" STATUS_NO_UPDATE="NO UPDATE" STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NONE="NONE" +STATUS_NOT_ACTIVE="NOT ACTIVE" STATUS_NOT_CONFIGURED="NOT CONFIGURED" STATUS_NOT_DISABLED="NOT DISABLED" STATUS_NOT_ENABLED="NOT ENABLED" From e1bcfe955e3ad5b1f339eb584f83a8aae6ad919b Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:24:47 +0200 Subject: [PATCH 042/108] Add STATUS_NOT_ACTIVE --- db/languages/az | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/az b/db/languages/az index ffdf4254..24a0ca70 100644 --- a/db/languages/az +++ b/db/languages/az @@ -82,6 +82,7 @@ STATUS_FOUND="Tapıldı" #STATUS_MEDIUM="MEDIUM" #STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NONE="Yox" +STATUS_NOT_ACTIVE="NOT ACTIVE" #STATUS_NOT_CONFIGURED="NOT CONFIGURED" #STATUS_NOT_DISABLED="NOT DISABLED" #STATUS_NOT_ENABLED="NOT ENABLED" From c3bdaa1e08b9bec567558046f4205d1e52a8f258 Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:25:13 +0200 Subject: [PATCH 043/108] Add STATUS_NOT_ACTIVE --- db/languages/cn | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/cn b/db/languages/cn index 76f181ca..11826db3 100644 --- a/db/languages/cn +++ b/db/languages/cn @@ -83,6 +83,7 @@ STATUS_FOUND="找到" #STATUS_MEDIUM="MEDIUM" #STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NONE="没有" +STATUS_NOT_ACTIVE="NOT ACTIVE" #STATUS_NOT_CONFIGURED="NOT CONFIGURED" #STATUS_NOT_DISABLED="NOT DISABLED" #STATUS_NOT_ENABLED="NOT ENABLED" From 59d4261ab1c7e633eec70e4956634f9d58f13e09 Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:25:30 +0200 Subject: [PATCH 044/108] Add STATUS_NOT_ACTIVE --- db/languages/da | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/da b/db/languages/da index 21cac946..1bd77089 100644 --- a/db/languages/da +++ b/db/languages/da @@ -83,6 +83,7 @@ STATUS_FOUND="FUNDET" #STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NONE="INGEN" STATUS_NO="NEJ" +STATUS_NOT_ACTIVE="NOT ACTIVE" #STATUS_NOT_CONFIGURED="NOT CONFIGURED" #STATUS_NOT_DISABLED="NOT DISABLED" STATUS_NOT_ENABLED="IKKE AKTIVERET" From 03bbf37faba788cabc4b86c01125a35fb2d2b955 Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:25:47 +0200 Subject: [PATCH 045/108] Add STATUS_NOT_ACTIVE --- db/languages/de | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/de b/db/languages/de index fad25db9..942693a3 100644 --- a/db/languages/de +++ b/db/languages/de @@ -84,6 +84,7 @@ STATUS_NO="NEIN" STATUS_NO_UPDATE="KEINE AKTUALISIERUNG" STATUS_NON_DEFAULT="NICHT STANDARD" STATUS_NONE="NICHTS" +STATUS_NOT_ACTIVE="NOT ACTIVE" STATUS_NOT_CONFIGURED="NICHT KONFIGURIERT" STATUS_NOT_DISABLED="NICHT DEAKTIVIERT" STATUS_NOT_ENABLED="NICHT AKTIVIERT" From ae1903ca2b0f75fae4de64ffd32bbb43c25b0188 Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:26:14 +0200 Subject: [PATCH 046/108] Add STATUS_NOT_ACTIVE --- db/languages/es | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/es b/db/languages/es index fceb261f..1ad53db5 100644 --- a/db/languages/es +++ b/db/languages/es @@ -85,6 +85,7 @@ STATUS_NO_UPDATE="SIN ACTUALIZACIÓN" STATUS_NO="NO" STATUS_NON_DEFAULT="NO POR DEFECTO" STATUS_NONE="NINGUNO" +STATUS_NOT_ACTIVE="NOT ACTIVE" STATUS_NOT_CONFIGURED="NO CONFIGURADO" STATUS_NOT_DISABLED="NO DESHABILITADO" STATUS_NOT_ENABLED="NO HABILITADO" From 2eb902c87e578d343941a74617692f9e0072e9b3 Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:26:32 +0200 Subject: [PATCH 047/108] Add STATUS_NOT_ACTIVE --- db/languages/fi | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/fi b/db/languages/fi index 85e6593a..e8dc3564 100644 --- a/db/languages/fi +++ b/db/languages/fi @@ -83,6 +83,7 @@ STATUS_FOUND="LÖYTYNYT" STATUS_NO="EI" #STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NONE="EI MITÄÄN" +STATUS_NOT_ACTIVE="NOT ACTIVE" #STATUS_NOT_CONFIGURED="NOT CONFIGURED" #STATUS_NOT_DISABLED="NOT DISABLED" #STATUS_NOT_ENABLED="NOT ENABLED" From 07864eb469d1a5605d43836a0913a231e053e291 Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:26:51 +0200 Subject: [PATCH 048/108] Add STATUS_NOT_ACTIVE --- db/languages/fr | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/fr b/db/languages/fr index d85d643d..d0be5c99 100644 --- a/db/languages/fr +++ b/db/languages/fr @@ -84,6 +84,7 @@ STATUS_NO="NON" STATUS_NO_UPDATE="PAS DE MISE A JOUR" STATUS_NON_DEFAULT="PAS PAR DÉFAUT" STATUS_NONE="AUCUN" +STATUS_NOT_ACTIVE="NOT ACTIVE" STATUS_NOT_CONFIGURED="NON CONFIGURÉ" STATUS_NOT_DISABLED="NON DESACTIVÉ" STATUS_NOT_ENABLED="NON ACTIVÉ" From 5db08f896c69e1e0d74dbd7e35f9bb8fe05b49fb Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:27:08 +0200 Subject: [PATCH 049/108] Add STATUS_NOT_ACTIVE --- db/languages/gr | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/gr b/db/languages/gr index 8d285f96..15c3e509 100644 --- a/db/languages/gr +++ b/db/languages/gr @@ -82,6 +82,7 @@ STATUS_FOUND="ΒΡΕΘΗΚΕ" #STATUS_MEDIUM="MEDIUM" #STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NONE="ΚΑΝΕΝΑ" +STATUS_NOT_ACTIVE="NOT ACTIVE" #STATUS_NOT_CONFIGURED="NOT CONFIGURED" #STATUS_NOT_DISABLED="NOT DISABLED" #STATUS_NOT_ENABLED="NOT ENABLED" From 7ada6c3166458285394c416033a595baaa7aae7c Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:27:25 +0200 Subject: [PATCH 050/108] Add STATUS_NOT_ACTIVE --- db/languages/he | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/he b/db/languages/he index 83859123..9755bcf7 100644 --- a/db/languages/he +++ b/db/languages/he @@ -82,6 +82,7 @@ STATUS_FOUND="נמצא" #STATUS_MEDIUM="MEDIUM" #STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NONE="אין כלל" +STATUS_NOT_ACTIVE="NOT ACTIVE" #STATUS_NOT_CONFIGURED="NOT CONFIGURED" #STATUS_NOT_DISABLED="NOT DISABLED" #STATUS_NOT_ENABLED="NOT ENABLED" From f4b7556f6cd0b38e9194535c797aabad8ab3e900 Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:27:40 +0200 Subject: [PATCH 051/108] Add STATUS_NOT_ACTIVE --- db/languages/hu | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/hu b/db/languages/hu index 1d055bd8..90ae29e1 100644 --- a/db/languages/hu +++ b/db/languages/hu @@ -83,6 +83,7 @@ STATUS_FOUND="FOUND" #STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NO="NEM" STATUS_NONE="NONE" +STATUS_NOT_ACTIVE="NOT ACTIVE" #STATUS_NOT_CONFIGURED="NOT CONFIGURED" #STATUS_NOT_DISABLED="NOT DISABLED" #STATUS_NOT_ENABLED="NOT ENABLED" From 3d1969f3acf1155053b41fe3928d04a5ffb8bee4 Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:27:55 +0200 Subject: [PATCH 052/108] Add STATUS_NOT_ACTIVE --- db/languages/it | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/it b/db/languages/it index 3f3a8853..26ff3076 100644 --- a/db/languages/it +++ b/db/languages/it @@ -83,6 +83,7 @@ STATUS_FOUND="TROVATO" #STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NONE="NESSUNO" STATUS_NO="NO" +STATUS_NOT_ACTIVE="NOT ACTIVE" STATUS_NOT_CONFIGURED="NON CONFIGURATO" #STATUS_NOT_DISABLED="NOT DISABLED" #STATUS_NOT_ENABLED="NOT ENABLED" From 2538a02c97ebf0ba69b3200a8e0b2ccc39f75410 Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:28:10 +0200 Subject: [PATCH 053/108] Add STATUS_NOT_ACTIVE --- db/languages/ja | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/ja b/db/languages/ja index 3e3de50c..846b1eb1 100644 --- a/db/languages/ja +++ b/db/languages/ja @@ -83,6 +83,7 @@ STATUS_FOUND="見つかりました" STATUS_NO="いいえ" #STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NONE="なし" +STATUS_NOT_ACTIVE="NOT ACTIVE" #STATUS_NOT_CONFIGURED="NOT CONFIGURED" #STATUS_NOT_DISABLED="NOT DISABLED" #STATUS_NOT_ENABLED="NOT ENABLED" From 98f8318256771c795ca145461f86ba3e0cea00cc Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:28:25 +0200 Subject: [PATCH 054/108] Add STATUS_NOT_ACTIVE --- db/languages/ko | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/ko b/db/languages/ko index dba75b76..72d31d79 100644 --- a/db/languages/ko +++ b/db/languages/ko @@ -83,6 +83,7 @@ STATUS_FOUND="발견" STATUS_NO="아니오" #STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NONE="없음" +STATUS_NOT_ACTIVE="NOT ACTIVE" #STATUS_NOT_CONFIGURED="NOT CONFIGURED" #STATUS_NOT_DISABLED="NOT DISABLED" #STATUS_NOT_ENABLED="NOT ENABLED" From 4c8af4da3b527746c0e04f6124da975321d3b3d4 Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:28:41 +0200 Subject: [PATCH 055/108] Add STATUS_NOT_ACTIVE --- db/languages/nb-NO | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/nb-NO b/db/languages/nb-NO index 84ddf269..ea3e8832 100644 --- a/db/languages/nb-NO +++ b/db/languages/nb-NO @@ -83,6 +83,7 @@ STATUS_FOUND="FUNNET" #STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NO="NEI" STATUS_NONE="INGEN" +STATUS_NOT_ACTIVE="NOT ACTIVE" #STATUS_NOT_CONFIGURED="NOT CONFIGURED" #STATUS_NOT_DISABLED="NOT DISABLED" #STATUS_NOT_ENABLED="NOT ENABLED" From 0102139e256720ec0842ab0db1ce13119145ef00 Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:28:53 +0200 Subject: [PATCH 056/108] Add STATUS_NOT_ACTIVE --- db/languages/nl | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/nl b/db/languages/nl index 4c22b9fe..cdb92423 100644 --- a/db/languages/nl +++ b/db/languages/nl @@ -83,6 +83,7 @@ STATUS_FOUND="GEVONDEN" #STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NO="NEE" STATUS_NONE="GEEN" +STATUS_NOT_ACTIVE="NOT ACTIVE" STATUS_NOT_CONFIGURED="NIET GECONFIGUREERD" #STATUS_NOT_DISABLED="NOT DISABLED" #STATUS_NOT_ENABLED="NOT ENABLED" From 03e23ac43cad01355cec830d3f93f889e8128ec1 Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:29:10 +0200 Subject: [PATCH 057/108] Add STATUS_NOT_ACTIVE --- db/languages/pl | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/pl b/db/languages/pl index 200bac79..887d0a7d 100644 --- a/db/languages/pl +++ b/db/languages/pl @@ -83,6 +83,7 @@ #STATUS_NON_DEFAULT="NON DEFAULT" #STATUS_NONE="NONE" #STATUS_NO="NO" +STATUS_NOT_ACTIVE="NOT ACTIVE" #STATUS_NOT_CONFIGURED="NOT CONFIGURED" #STATUS_NOT_DISABLED="NOT DISABLED" #STATUS_NOT_ENABLED="NOT ENABLED" From e69f02e8357701db5ac0d591a3fd2599fa3df242 Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:29:23 +0200 Subject: [PATCH 058/108] Add STATUS_NOT_ACTIVE --- db/languages/pt | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/pt b/db/languages/pt index 740fab6a..483fabd6 100644 --- a/db/languages/pt +++ b/db/languages/pt @@ -83,6 +83,7 @@ STATUS_FOUND="ENCONTRADO" STATUS_NO="NÃO" #STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NONE="NENHUM" +STATUS_NOT_ACTIVE="NOT ACTIVE" #STATUS_NOT_CONFIGURED="NOT CONFIGURED" #STATUS_NOT_DISABLED="NOT DISABLED" #STATUS_NOT_ENABLED="NOT ENABLED" From ead7df73fe92ffc5eafe76a5484fdca5df3983ed Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:29:39 +0200 Subject: [PATCH 059/108] Add STATUS_NOT_ACTIVE --- db/languages/ru | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/ru b/db/languages/ru index c24603b6..55a4717b 100644 --- a/db/languages/ru +++ b/db/languages/ru @@ -82,6 +82,7 @@ STATUS_LOCAL_ONLY="ТОЛЬКО ЛОКАЛЬНО" STATUS_MEDIUM="СРЕДНИЙ" STATUS_NON_DEFAULT="НЕ ПО УМОЛЧАНИЮ" STATUS_NONE="Отсутствует" +STATUS_NOT_ACTIVE="NOT ACTIVE" STATUS_NOT_CONFIGURED="НЕ СКОНФИГУРИРОВАНО" STATUS_NOT_DISABLED="НЕ ОТКЛЮЧЕНО" STATUS_NOT_ENABLED="НЕ ВКЛЮЧЕНО" From e36fd3a5c0e60f3a53b233c77255f913937e0a6f Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:29:52 +0200 Subject: [PATCH 060/108] Add STATUS_NOT_ACTIVE --- db/languages/se | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/se b/db/languages/se index d77717b4..e5a90859 100644 --- a/db/languages/se +++ b/db/languages/se @@ -83,6 +83,7 @@ STATUS_FOUND="HITTAD" #STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NONE="INGEN" STATUS_NO="NEJ" +STATUS_NOT_ACTIVE="NOT ACTIVE" #STATUS_NOT_CONFIGURED="NOT CONFIGURED" #STATUS_NOT_DISABLED="NOT DISABLED" #STATUS_NOT_ENABLED="NOT ENABLED" From e2ad42711523d6c939fadf7b8bdabea8d03490f9 Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:30:05 +0200 Subject: [PATCH 061/108] Add STATUS_NOT_ACTIVE --- db/languages/sk | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/sk b/db/languages/sk index 7f021ade..45a18943 100644 --- a/db/languages/sk +++ b/db/languages/sk @@ -83,6 +83,7 @@ STATUS_FOUND="NÁJDENÉ" #STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NONE="ŽIADNE" STATUS_NO="NIE" +STATUS_NOT_ACTIVE="NOT ACTIVE" #STATUS_NOT_CONFIGURED="NOT CONFIGURED" #STATUS_NOT_DISABLED="NOT DISABLED" #STATUS_NOT_ENABLED="NOT ENABLED" From b2b6cd057eab9727ce8fc300e6b54e1021d81993 Mon Sep 17 00:00:00 2001 From: Amaury Korb <92906119+amkorb@users.noreply.github.com> Date: Wed, 2 Aug 2023 23:30:17 +0200 Subject: [PATCH 062/108] Add STATUS_NOT_ACTIVE --- db/languages/tr | 1 + 1 file changed, 1 insertion(+) diff --git a/db/languages/tr b/db/languages/tr index 62dcb514..585cfed5 100644 --- a/db/languages/tr +++ b/db/languages/tr @@ -83,6 +83,7 @@ STATUS_FOUND="BULUNDU" STATUS_NO="HAYIR" #STATUS_NON_DEFAULT="NON DEFAULT" STATUS_NONE="YOK" +STATUS_NOT_ACTIVE="NOT ACTIVE" #STATUS_NOT_CONFIGURED="NOT CONFIGURED" #STATUS_NOT_DISABLED="NOT DISABLED" #STATUS_NOT_ENABLED="NOT ENABLED" From c65da1aec9894e18645d3e760fd3bf179278f770 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Thu, 3 Aug 2023 11:44:41 +0000 Subject: [PATCH 063/108] Release 3.0.9 --- CHANGELOG.md | 2 +- lynis | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index eba36baf..eb3a4677 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Lynis Changelog -## Lynis 3.0.9 (2023-05-02) +## Lynis 3.0.9 (2023-08-03) ### Changed - DBS-1820 - Added newer style format for Mongo authorization setting diff --git a/lynis b/lynis index 2378b4cd..d538deda 100755 --- a/lynis +++ b/lynis @@ -43,8 +43,8 @@ PROGRAM_WEBSITE="https://cisofy.com/lynis/" # Version details - PROGRAM_RELEASE_DATE="2023-05-02" - PROGRAM_RELEASE_TIMESTAMP=1683017189 + PROGRAM_RELEASE_DATE="2023-08-03" + PROGRAM_RELEASE_TIMESTAMP=1691062820 PROGRAM_RELEASE_TYPE="release" # pre-release or release PROGRAM_VERSION="3.0.9" From 5e8755c15f2e54d5d6f9500e14cc746bf8b05d82 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Thu, 3 Aug 2023 15:42:02 +0200 Subject: [PATCH 064/108] Update CHANGELOG.md --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index eb3a4677..248c1528 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Lynis Changelog +## Lynis 3.1.0 (not released yet) + +### Changed +- STATUS_NOT_ACTIVE variable added to translation files + +--------------------------------------------------------------------------------- + ## Lynis 3.0.9 (2023-08-03) ### Changed From 66d1e90bf4dd40bb5829c53e1d81676718d6d9f2 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Thu, 3 Aug 2023 23:43:36 +0200 Subject: [PATCH 065/108] Update CHANGELOG.md --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 248c1528..3612e209 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ ## Lynis 3.1.0 (not released yet) ### Changed +- Updated Amazon Linux EOL dates and addition of Amazon Linux 2023 - STATUS_NOT_ACTIVE variable added to translation files --------------------------------------------------------------------------------- From 5e7aa8eb1a131fb5bcdbe4dd92c70e4aee884766 Mon Sep 17 00:00:00 2001 From: Samuel Henrique Date: Fri, 4 Aug 2023 19:00:31 +0100 Subject: [PATCH 066/108] software-eol.db: Add new Debian/Ubuntu releases and update EOL dates --- db/software-eol.db | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/db/software-eol.db b/db/software-eol.db index ff33a056..1d861c66 100644 --- a/db/software-eol.db +++ b/db/software-eol.db @@ -44,13 +44,16 @@ os:CentOS Linux 7:2024-06-30:1719698400: os:CentOS Linux 8:2029-05-31:1874872800: # # Debian - https://wiki.debian.org/DebianReleases#Production_Releases +# https://wiki.debian.org/LTS # os:Debian 5.0:2012-02-06:1328482800: os:Debian 6.0:2016-02-29:1456700400: os:Debian 7:2018-05-31:1527717600: os:Debian 8:2020-06-30:1593468000: -os:Debian 9:2022-01-01:1640991600: -os:Debian 10:2022-01-01:1640991600: +os:Debian 9:2022-06-30:1656547200: +os:Debian 10:2024-06-30:1719705600: +os:Debian 11:2026-06-30:1782777600: +os:Debian 12:2028-06-30:1845936000: # # Fedora - https://fedoraproject.org/wiki/End_of_life # @@ -240,6 +243,7 @@ os:Ubuntu 18.04:2023-05-01:1682892000: os:Ubuntu 18.10:2019-07-18:1563400800: os:Ubuntu 19.04:2020-01-01:1577833200: os:Ubuntu 20.04:2025-04-01:1743458400: +os:Ubuntu 22.04:2027-04-01:1806537600: # # OmniosCE - https://omniosce.org/releasenotes.html # From 461edd3e1f2708801ac987617a03b730eb10d362 Mon Sep 17 00:00:00 2001 From: al-lac Date: Mon, 7 Aug 2023 09:55:28 +0200 Subject: [PATCH 067/108] Add OS support for macOS Sonoma (14.x) --- include/osdetection | 1 + 1 file changed, 1 insertion(+) diff --git a/include/osdetection b/include/osdetection index bed25033..0f88c7f0 100644 --- a/include/osdetection +++ b/include/osdetection @@ -65,6 +65,7 @@ 11 | 11.[0-9]*) OS_FULLNAME="macOS Big Sur (${OS_VERSION})" ;; 12 | 12.[0-9]*) OS_FULLNAME="macOS Monterey (${OS_VERSION})" ;; 13 | 13.[0-9]*) OS_FULLNAME="macOS Ventura (${OS_VERSION})" ;; + 14 | 14.[0-9]*) OS_FULLNAME="macOS Sonoma (${OS_VERSION})" ;; *) echo "Unknown macOS version. Do you know what version it is? Create an issue at ${PROGRAM_SOURCE}" ;; esac else From 9d9cedee4ef4b1ab79d7288cb9bb3242d92b4939 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Tue, 8 Aug 2023 09:11:02 +0000 Subject: [PATCH 068/108] Only quote binary, not the option -E --- include/tests_time | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/tests_time b/include/tests_time index 7ff6755e..b68bc102 100644 --- a/include/tests_time +++ b/include/tests_time @@ -164,7 +164,7 @@ FIND=$(echo "${J}" | ${GREPBINARY} -E '/.placeholder$') if [ -f "${J}" ] && [ -r "${J}" ] && [ -z "${FIND}" ]; then LogText "Test: checking for ntpdate, rdate, sntp or ntpdig in ${J}" - FIND=$("${GREPBINARY} -E" "${CRONTAB_REGEX}" "${J}" | "${GREPBINARY}" -v "^#") + FIND=$("${GREPBINARY}" -E "${CRONTAB_REGEX}" "${J}" | "${GREPBINARY}" -v "^#") if [ -n "${FIND}" ]; then FOUND=1; FOUND_IN_CRON=1; NTP_CONFIG_TYPE_SCHEDULED=1 LogText "Result: found ntpdate, rdate, sntp or ntpdig in ${J}" From f74428a3d7a57536959f25824cadf64c1cd5e9e9 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Tue, 8 Aug 2023 11:09:37 +0000 Subject: [PATCH 069/108] Updated log --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3612e209..fffcfe4f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ ### Changed - Updated Amazon Linux EOL dates and addition of Amazon Linux 2023 - STATUS_NOT_ACTIVE variable added to translation files +- MALW-3280 - Correction to detect com.avast.daemon --------------------------------------------------------------------------------- From 0d77a367c59a0b5f1bdcb46380a518519160503b Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Tue, 8 Aug 2023 11:15:34 +0000 Subject: [PATCH 070/108] [MALW-3280] Correction to detect com.avast.daemon --- include/tests_malware | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/tests_malware b/include/tests_malware index 40336fa5..2b3b6cb6 100644 --- a/include/tests_malware +++ b/include/tests_malware @@ -128,7 +128,7 @@ # Avast (macOS) LogText "Test: checking process com.avast.daemon" - if IsRunning "com.avast.daemon"; then + if IsRunning --full "com.avast.daemon"; then FOUND=1 AVAST_DAEMON_RUNNING=1 MALWARE_DAEMON_RUNNING=1 From 1bfcc9b1469fab0884df3d3a581089ebc79b79b9 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Wed, 13 Sep 2023 16:07:41 +0200 Subject: [PATCH 071/108] Update tests_malware Corrected variable --- include/tests_malware | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/tests_malware b/include/tests_malware index 41814b43..b016a46d 100644 --- a/include/tests_malware +++ b/include/tests_malware @@ -39,7 +39,7 @@ MALWARE_SCANNER_INSTALLED=0 MALWARE_DAEMON_RUNNING=0 ROOTKIT_SCANNER_FOUND=0 - SENTINELONE_SCANNER_FOUND=0 + SENTINELONE_SCANNER_RUNNING=0 SOPHOS_SCANNER_RUNNING=0 SYMANTEC_SCANNER_RUNNING=0 SYNOLOGY_DAEMON_RUNNING=0 From bf197ffd7fb949adcbc00b1136c6d3cf6bd3001a Mon Sep 17 00:00:00 2001 From: Stefan Baumgartner Date: Sun, 17 Sep 2023 10:24:52 +0200 Subject: [PATCH 072/108] Update tests_malware Fix incorrect "IsRunning" invocations for SentinelOne detection. --- include/tests_malware | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/include/tests_malware b/include/tests_malware index 9798fbff..87a721bc 100644 --- a/include/tests_malware +++ b/include/tests_malware @@ -234,9 +234,9 @@ # SentinelOne LogText "Text: checking process sentineld (SentinelOne)" - if isRunning "sentineld"; then SENTINELONE_SCANNER_RUNNING=1; fi # macOS - if isRunning "s1-agent"; then SENTINELONE_SCANNER_RUNNING=1; fi # Linux - if isRunning "SentinelAgent"; then SENTINELONE_SCANNER_RUNNING=1; fi # Windows + if IsRunning "sentineld"; then SENTINELONE_SCANNER_RUNNING=1; fi # macOS + if IsRunning "s1-agent"; then SENTINELONE_SCANNER_RUNNING=1; fi # Linux + if IsRunning "SentinelAgent"; then SENTINELONE_SCANNER_RUNNING=1; fi # Windows if [ ${SENTINELONE_SCANNER_RUNNING} -eq 1 ]; then FOUND=1 if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} SentinelOne" --result "${STATUS_FOUND}" --color GREEN; fi From bc36b3ec63bfebcc45ebf9a4dd2f550726de8c1e Mon Sep 17 00:00:00 2001 From: Xavier Noguer Date: Tue, 19 Sep 2023 16:12:52 +0000 Subject: [PATCH 073/108] Avoiding warning because of hyphen. Due to changes in grep 3.8 --- include/tests_kernel | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/tests_kernel b/include/tests_kernel index bba8080f..201d803e 100644 --- a/include/tests_kernel +++ b/include/tests_kernel @@ -692,7 +692,7 @@ else # Match on items like /boot/vm5.3.7 or /boot/vmlinuz-5.3.7-1-default. Sort based on versions (-v) and then find the last item # Note: ignore a rescue kernel (e.g. CentOS) - FOUND_VMLINUZ=$(${LSBINARY} -v ${ROOTDIR}boot/vm[l0-9]* 2> /dev/null | ${GREPBINARY} -v '\-rescue\-' | ${TAILBINARY} -1) + FOUND_VMLINUZ=$(${LSBINARY} -v ${ROOTDIR}boot/vm[l0-9]* 2> /dev/null | ${GREPBINARY} -v '\-rescue-' | ${TAILBINARY} -1) LogText "Result: found ${FOUND_VMLINUZ}" fi From 04a73a9c19bfe5e707cb1f8aeb0ba8f6dbf9a6f7 Mon Sep 17 00:00:00 2001 From: Xavier Noguer Date: Tue, 19 Sep 2023 16:46:20 +0000 Subject: [PATCH 074/108] Reverting change from another PR --- include/tests_php | 65 +++-------------------------------------------- 1 file changed, 4 insertions(+), 61 deletions(-) diff --git a/include/tests_php b/include/tests_php index beb1eca3..b5f53d9a 100644 --- a/include/tests_php +++ b/include/tests_php @@ -37,9 +37,6 @@ ${ROOTDIR}etc/php7.2/php.ini \ ${ROOTDIR}etc/php7.3/php.ini \ ${ROOTDIR}etc/php7.4/php.ini \ - ${ROOTDIR}etc/php8.0/php.ini \ - ${ROOTDIR}etc/php8.1/php.ini \ - ${ROOTDIR}etc/php8.2/php.ini \ ${ROOTDIR}etc/php/cgi-php5/php.ini \ ${ROOTDIR}etc/php/cli-php5/php.ini \ ${ROOTDIR}etc/php/apache2-php5/php.ini \ @@ -50,9 +47,6 @@ ${ROOTDIR}etc/php/apache2-php7.2/php.ini \ ${ROOTDIR}etc/php/apache2-php7.3/php.ini \ ${ROOTDIR}etc/php/apache2-php7.4/php.ini \ - ${ROOTDIR}etc/php/apache2-php8.0/php.ini \ - ${ROOTDIR}etc/php/apache2-php8.1/php.ini \ - ${ROOTDIR}etc/php/apache2-php8.2/php.ini \ ${ROOTDIR}etc/php/cgi-php5.5/php.ini \ ${ROOTDIR}etc/php/cgi-php5.6/php.ini \ ${ROOTDIR}etc/php/cgi-php7.0/php.ini \ @@ -60,9 +54,6 @@ ${ROOTDIR}etc/php/cgi-php7.2/php.ini \ ${ROOTDIR}etc/php/cgi-php7.3/php.ini \ ${ROOTDIR}etc/php/cgi-php7.4/php.ini \ - ${ROOTDIR}etc/php/cgi-php8.0/php.ini \ - ${ROOTDIR}etc/php/cgi-php8.1/php.ini \ - ${ROOTDIR}etc/php/cgi-php8.2/php.ini \ ${ROOTDIR}etc/php/cli-php5.5/php.ini \ ${ROOTDIR}etc/php/cli-php5.6/php.ini \ ${ROOTDIR}etc/php/cli-php7.0/php.ini \ @@ -70,9 +61,6 @@ ${ROOTDIR}etc/php/cli-php7.2/php.ini \ ${ROOTDIR}etc/php/cli-php7.3/php.ini \ ${ROOTDIR}etc/php/cli-php7.4/php.ini \ - ${ROOTDIR}etc/php/cli-php8.0/php.ini \ - ${ROOTDIR}etc/php/cli-php8.1/php.ini \ - ${ROOTDIR}etc/php/cli-php8.2/php.ini \ ${ROOTDIR}etc/php/embed-php5.5/php.ini \ ${ROOTDIR}etc/php/embed-php5.6/php.ini \ ${ROOTDIR}etc/php/embed-php7.0/php.ini \ @@ -80,12 +68,6 @@ ${ROOTDIR}etc/php/embed-php7.2/php.ini \ ${ROOTDIR}etc/php/embed-php7.3/php.ini \ ${ROOTDIR}etc/php/embed-php7.4/php.ini \ - ${ROOTDIR}etc/php/embed-php8.0/php.ini \ - ${ROOTDIR}etc/php/embed-php8.1/php.ini \ - ${ROOTDIR}etc/php/embed-php8.2/php.ini \ - ${ROOTDIR}etc/php/fpm-php8.2/php.ini \ - ${ROOTDIR}etc/php/fpm-php8.1/php.ini \ - ${ROOTDIR}etc/php/fpm-php8.0/php.ini \ ${ROOTDIR}etc/php/fpm-php7.4/php.ini \ ${ROOTDIR}etc/php/fpm-php7.3/php.ini \ ${ROOTDIR}etc/php/fpm-php7.2/php.ini \ @@ -106,9 +88,6 @@ ${ROOTDIR}etc/php/7.2/apache2/php.ini \ ${ROOTDIR}etc/php/7.3/apache2/php.ini \ ${ROOTDIR}etc/php/7.4/apache2/php.ini \ - ${ROOTDIR}etc/php/8.0/apache2/php.ini \ - ${ROOTDIR}etc/php/8.1/apache2/php.ini \ - ${ROOTDIR}etc/php/8.2/apache2/php.ini \ ${ROOTDIR}etc/php/7.0/cli/php.ini \ ${ROOTDIR}etc/php/7.0/fpm/php.ini \ ${ROOTDIR}etc/php/7.1/cli/php.ini \ @@ -119,12 +98,6 @@ ${ROOTDIR}etc/php/7.3/fpm/php.ini \ ${ROOTDIR}etc/php/7.4/cli/php.ini \ ${ROOTDIR}etc/php/7.4/fpm/php.ini \ - ${ROOTDIR}etc/php/8.0/cli/php.ini \ - ${ROOTDIR}etc/php/8.0/fpm/php.ini \ - ${ROOTDIR}etc/php/8.1/cli/php.ini \ - ${ROOTDIR}etc/php/8.1/fpm/php.ini \ - ${ROOTDIR}etc/php/8.2/cli/php.ini \ - ${ROOTDIR}etc/php/8.2/fpm/php.ini \ ${ROOTDIR}var/www/conf/php.ini \ ${ROOTDIR}usr/local/etc/php.ini \ ${ROOTDIR}usr/local/lib/php.ini \ @@ -136,9 +109,6 @@ ${ROOTDIR}usr/local/php72/lib/php.ini \ ${ROOTDIR}usr/local/php73/lib/php.ini \ ${ROOTDIR}usr/local/php74/lib/php.ini \ - ${ROOTDIR}usr/local/php80/lib/php.ini \ - ${ROOTDIR}usr/local/php81/lib/php.ini \ - ${ROOTDIR}usr/local/php82/lib/php.ini \ ${ROOTDIR}usr/local/zend/etc/php.ini \ ${ROOTDIR}usr/pkg/etc/php.ini \ ${ROOTDIR}opt/cpanel/ea-php54/root/etc/php.ini \ @@ -164,18 +134,12 @@ ${ROOTDIR}opt/alt/php72/etc/php.ini \ ${ROOTDIR}opt/alt/php73/etc/php.ini \ ${ROOTDIR}opt/alt/php74/etc/php.ini \ - ${ROOTDIR}opt/alt/php80/etc/php.ini \ - ${ROOTDIR}opt/alt/php81/etc/php.ini \ - ${ROOTDIR}opt/alt/php82/etc/php.ini \ ${ROOTDIR}etc/opt/remi/php56/php.ini \ ${ROOTDIR}etc/opt/remi/php70/php.ini \ ${ROOTDIR}etc/opt/remi/php71/php.ini \ ${ROOTDIR}etc/opt/remi/php72/php.ini \ ${ROOTDIR}etc/opt/remi/php73/php.ini \ - ${ROOTDIR}etc/opt/remi/php74/php.ini \ - ${ROOTDIR}etc/opt/remi/php80/php.ini \ - ${ROOTDIR}etc/opt/remi/php81/php.ini \ - ${ROOTDIR}etc/opt/remi/php82/php.ini" + ${ROOTDIR}etc/opt/remi/php74/php.ini" # HEADS-UP: OpenBSD, last two releases are supported, and snapshots of -current PHPINILOCS="${PHPINILOCS} \ ${ROOTDIR}etc/php-5.6.ini \ @@ -183,10 +147,7 @@ ${ROOTDIR}etc/php-7.1.ini \ ${ROOTDIR}etc/php-7.2.ini \ ${ROOTDIR}etc/php-7.3.ini \ - ${ROOTDIR}etc/php-7.4.ini \ - ${ROOTDIR}etc/php-8.0.ini \ - ${ROOTDIR}etc/php-8.1.ini \ - ${ROOTDIR}etc/php-8.2.ini" + ${ROOTDIR}etc/php-7.4.ini" PHPINIDIRS="${ROOTDIR}etc/php5/conf.d \ ${ROOTDIR}etc/php/7.0/cli/conf.d \ @@ -194,17 +155,11 @@ ${ROOTDIR}etc/php/7.2/cli/conf.d \ ${ROOTDIR}etc/php/7.3/cli/conf.d \ ${ROOTDIR}etc/php/7.4/cli/conf.d \ - ${ROOTDIR}etc/php/8.0/cli/conf.d \ - ${ROOTDIR}etc/php/8.1/cli/conf.d \ - ${ROOTDIR}etc/php/8.2/cli/conf.d \ ${ROOTDIR}etc/php/7.0/fpm/conf.d \ ${ROOTDIR}etc/php/7.1/fpm/conf.d \ ${ROOTDIR}etc/php/7.2/fpm/conf.d \ ${ROOTDIR}etc/php/7.3/fpm/conf.d \ ${ROOTDIR}etc/php/7.4/fpm/conf.d \ - ${ROOTDIR}etc/php/8.0/fpm/conf.d \ - ${ROOTDIR}etc/php/8.1/fpm/conf.d \ - ${ROOTDIR}etc/php/8.2/fpm/conf.d \ ${ROOTDIR}etc/php.d \ ${ROOTDIR}opt/cpanel/ea-php54/root/etc/php.d \ ${ROOTDIR}opt/cpanel/ea-php55/root/etc/php.d \ @@ -214,9 +169,6 @@ ${ROOTDIR}opt/cpanel/ea-php72/root/etc/php.d \ ${ROOTDIR}opt/cpanel/ea-php73/root/etc/php.d \ ${ROOTDIR}opt/cpanel/ea-php74/root/etc/php.d \ - ${ROOTDIR}opt/cpanel/ea-php80/root/etc/php.d \ - ${ROOTDIR}opt/cpanel/ea-php81/root/etc/php.d \ - ${ROOTDIR}opt/cpanel/ea-php82/root/etc/php.d \ ${ROOTDIR}opt/alt/php44/etc/php.d.all \ ${ROOTDIR}opt/alt/php51/etc/php.d.all \ ${ROOTDIR}opt/alt/php52/etc/php.d.all \ @@ -229,18 +181,12 @@ ${ROOTDIR}opt/alt/php72/etc/php.d.all \ ${ROOTDIR}opt/alt/php73/etc/php.d.all \ ${ROOTDIR}opt/alt/php74/etc/php.d.all \ - ${ROOTDIR}opt/alt/php80/etc/php.d.all \ - ${ROOTDIR}opt/alt/php81/etc/php.d.all \ - ${ROOTDIR}opt/alt/php82/etc/php.d.all \ ${ROOTDIR}usr/local/lib/php.conf.d \ ${ROOTDIR}usr/local/php70/lib/php.conf.d \ ${ROOTDIR}usr/local/php71/lib/php.conf.d \ ${ROOTDIR}usr/local/php72/lib/php.conf.d \ ${ROOTDIR}usr/local/php73/lib/php.conf.d \ - ${ROOTDIR}usr/local/php74/lib/php.conf.d \ - ${ROOTDIR}usr/local/php80/lib/php.conf.d \ - ${ROOTDIR}usr/local/php81/lib/php.conf.d \ - ${ROOTDIR}usr/local/php82/lib/php.conf.d" + ${ROOTDIR}usr/local/php74/lib/php.conf.d" # HEADS-UP: OpenBSD, last two releases are supported, and snapshots of -current PHPINIDIRS="${PHPINIDIRS} \ ${ROOTDIR}etc/php-5.6 \ @@ -248,10 +194,7 @@ ${ROOTDIR}etc/php-7.1 \ ${ROOTDIR}etc/php-7.2 \ ${ROOTDIR}etc/php-7.3 \ - ${ROOTDIR}etc/php-7.4 \ - ${ROOTDIR}etc/php-8.0 \ - ${ROOTDIR}etc/php-8.1 \ - ${ROOTDIR}etc/php-8.2" + ${ROOTDIR}etc/php-7.4" # ################################################################################# # From a5dbda51b9b44d9f2131271d8dfae0784fbf17c9 Mon Sep 17 00:00:00 2001 From: Xavier Noguer Date: Tue, 19 Sep 2023 16:47:23 +0000 Subject: [PATCH 075/108] Reverting change from another PR --- include/tests_php | 3 --- 1 file changed, 3 deletions(-) diff --git a/include/tests_php b/include/tests_php index b5f53d9a..04502f68 100644 --- a/include/tests_php +++ b/include/tests_php @@ -119,9 +119,6 @@ ${ROOTDIR}opt/cpanel/ea-php72/root/etc/php.ini \ ${ROOTDIR}opt/cpanel/ea-php73/root/etc/php.ini \ ${ROOTDIR}opt/cpanel/ea-php74/root/etc/php.ini \ - ${ROOTDIR}opt/cpanel/ea-php80/root/etc/php.ini \ - ${ROOTDIR}opt/cpanel/ea-php81/root/etc/php.ini \ - ${ROOTDIR}opt/cpanel/ea-php82/root/etc/php.ini \ ${ROOTDIR}opt/alt/php44/etc/php.ini \ ${ROOTDIR}opt/alt/php51/etc/php.ini \ ${ROOTDIR}opt/alt/php52/etc/php.ini \ From 83e9ee4e0cb72f2d899d899f8e69c6bb6088f201 Mon Sep 17 00:00:00 2001 From: D3vil0p3r Date: Sun, 1 Oct 2023 13:15:37 +0200 Subject: [PATCH 076/108] added Athena OS detection --- include/osdetection | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/include/osdetection b/include/osdetection index b09bd2f0..97490723 100644 --- a/include/osdetection +++ b/include/osdetection @@ -181,6 +181,12 @@ OS_FULLNAME="Artix Linux" OS_VERSION="Rolling release" ;; + "athena") + LINUX_VERSION="Athena OS" + OS_NAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') + OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') + OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') + ;; "bunsenlabs") LINUX_VERSION="BunsenLabs" OS_NAME="BunsenLabs" From ddd6e703063a9c03764b2538ee18749ef5be0bd5 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Sat, 7 Oct 2023 11:35:09 +0200 Subject: [PATCH 077/108] Update CHANGELOG.md --- CHANGELOG.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index fffcfe4f..807bbc51 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,9 +3,17 @@ ## Lynis 3.1.0 (not released yet) ### Changed +- MALW-3280 - Correction to detect com.avast.daemon +- OS detection added for Guix System, macOS Ventura (13.x)/Sonoma (14.x), NXP LSDK, OpenEmbedded "nodistro", and The Yocto Projects distro "Poky" - Updated Amazon Linux EOL dates and addition of Amazon Linux 2023 - STATUS_NOT_ACTIVE variable added to translation files -- MALW-3280 - Correction to detect com.avast.daemon +- End-of-life dates updated +- Fixing missing or erroneous test number comments +- Wazuh for file integrity and tooling +- Updated parsing output of arch-audit +- Added support for SentinelOne detection +- Replacing deprecated option -i for xargs +- Path detection for PostgreSQL improved --------------------------------------------------------------------------------- From 01d38785285417f751f4abc22f18965c7d529e73 Mon Sep 17 00:00:00 2001 From: Steve Kolenich Date: Thu, 7 Dec 2023 10:36:43 -0500 Subject: [PATCH 078/108] Added Alpine Linux EOL dates --- db/software-eol.db | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/db/software-eol.db b/db/software-eol.db index 880b3279..e113bf53 100644 --- a/db/software-eol.db +++ b/db/software-eol.db @@ -16,6 +16,10 @@ # # Alpine - https://alpinelinux.org/releases/ # +os:Alpine 3.19:2025-11-01:1761955200 +os:Alpine 3.18:2025-05-09:1746748800 +os:Alpine 3.17:2024-11-22:1732233600 +os:Alpine 3.16:2024-05-23:1716422400 os:Alpine 3.15:2023-11-01:1698793200 os:Alpine 3.14:2023-05-01:1682899200 os:Alpine 3.13:2022-11-01:1667275200 From 90ece5444507578dceb25ff34236bea259134a62 Mon Sep 17 00:00:00 2001 From: Hugo Rodrigues Date: Wed, 13 Dec 2023 12:40:05 +0000 Subject: [PATCH 079/108] Fixed Alpine Linux installed package detection --- include/functions | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/functions b/include/functions index 9c52044b..71a938c4 100644 --- a/include/functions +++ b/include/functions @@ -2099,7 +2099,7 @@ output=$(${XBPSBINARY} ${package} 2> /dev/null | ${GREPBINARY} "^ii") exit_code=$? elif [ -n "${APKBINARY}" ]; then - output=$(${APKBINARY} search ${package} 2> /dev/null | ${GREPBINARY} ${package}) + output=$(${APKBINARY} list --installed ${package} 2> /dev/null | ${GREPBINARY} ${package}) exit_code=$? else if [ "${package}" != "__dummy__" ]; then From d73378077796b899d7788c43ecfc706735edda09 Mon Sep 17 00:00:00 2001 From: Simon Taylor Date: Thu, 14 Dec 2023 16:09:03 +0200 Subject: [PATCH 080/108] Add files via upload --- software-eol.db | 276 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 276 insertions(+) create mode 100644 software-eol.db diff --git a/software-eol.db b/software-eol.db new file mode 100644 index 00000000..41a5af1b --- /dev/null +++ b/software-eol.db @@ -0,0 +1,276 @@ +# +# End-of-life for operating systems and software +# +# This file has 4 fields: +# 1) category +# 2) name +# 3) date (human-readable) or empty +# 4) converted date (seconds since epoch) or -1 +# +# Date can be converted on Linux using: date "+%s" --date=2020-01-01 +# Seconds since epoch can be verified using: date -d @1467324000 +'%Y-%m-%d' +# +# Notes: +# For rolling releases or releases that do not (currently have an EOL date, leave field three empty and set field four to -1. +# Full string for CentOS can be something like 'CentOS Linux 8 (Core)'. As this does not correctly match, shorter string is used for matching. +# +# AIX - https://www.ibm.com/support/pages/aix-support-lifecycle-information +# +os:AIX 7300-02:2026-11-30:1796032800: +os:AIX 7300-01:2025-12-31:1767175200: +os:AIX 7300-00:2024-12-31:1735639200: +os:AIX 7200-05::-1: +os:AIX 7200-04:2022-11-30:1669802400: +os:AIX 7200-03:2021-09-30:1632996000: +os:AIX 7200-02:2020-10-31:1604138400: +os:AIX 7200-01:2019-11-30:1575108000: +os:AIX 7200-00:2018-12-30:1546164000: +os:AIX 7100:2023-04-30:1682848800: +os:AIX 6:2017-04-30:1493546400: +os:AIX 5:2012-04-30:1335780000: +os:AIX 4:2003-12-31:1072864800: +os:AIX 3:1997-12-31:883562400: +# +# Alpine - https://alpinelinux.org/releases/ +# +os:Alpine 3.15:2023-11-01:1698793200 +os:Alpine 3.14:2023-05-01:1682899200 +os:Alpine 3.13:2022-11-01:1667275200 +os:Alpine 3.12:2022-05-01:1651377600 +os:Alpine 3.11:2021-11-01:1635739200 +os:Alpine 3.10:2021-05-01:1619841600 +os:Alpine 3.9:2020-11-01:1604203200 +os:Alpine 3.8:2020-05-01:1588305600 +# +# Amazon Linux +# +# Note: shortest entry is listed at end due to regular expression matching being used +os:Amazon Linux 2:2023-06-26:1687730400: +os:Amazon Linux:2020-06-30:1593468000: +# +# Arch Linux +# +os:Arch Linux::-1: +# +# CentOS +# +os:CentOS release 5:2017-03-31:1490911200: +os:CentOS release 6:2020-11-30:1606690800: +os:CentOS Linux 7:2024-06-30:1719698400: +os:CentOS Linux 8:2029-05-31:1874872800: +# +# Debian - https://wiki.debian.org/DebianReleases#Production_Releases +# +os:Debian 5.0:2012-02-06:1328482800: +os:Debian 6.0:2016-02-29:1456700400: +os:Debian 7:2018-05-31:1527717600: +os:Debian 8:2020-06-30:1593468000: +os:Debian 9:2022-01-01:1640991600: +os:Debian 10:2022-01-01:1640991600: +# +# Fedora - https://fedoraproject.org/wiki/End_of_life +# +os:Fedora release 25:2017-12-12:1513033200: +os:Fedora release 26:2018-05-29:1527544800: +os:Fedora release 27:2018-11-30:1543532400: +os:Fedora release 28:2019-05-28:1558994400: +os:Fedora release 29:2019-11-26:1574722800: +os:Fedora release 30:2020-05-26:1590444000: +# +# FreeBSD - https://www.freebsd.org/security/unsupported.html +# +os:FreeBSD 9.3:2014-12-31:1419980400: +os:FreeBSD 10.0:2015-02-28:1425078000: +os:FreeBSD 10.1:2016-12-31:1483138800: +os:FreeBSD 10.2:2016-12-31:1483138800: +os:FreeBSD 10.3:2018-04-30:1525039200: +os:FreeBSD 10.4:2018-10-31:1540940400: +os:FreeBSD 11.0:2017-11-30:1511996400: +os:FreeBSD 11.1:2018-09-30:1538258400: +os:FreeBSD 11.2:2019-10-31:1572476400: +os:FreeBSD 12.0:2020-02-29:1582930800: +# +# Linux Mint +# +os:Linux Mint 18:2021-04-01:1617228000: +os:Linux Mint 19:2023-04-01:1680300000: +os:Linux Mint 20:2025-04-01:1743458400: +# +# macOS - https://support.apple.com/en_US/downloads/macos and +# https://apple.stackexchange.com/a/282788 and +# https://en.wikipedia.org/wiki/Category:MacOS_versions +# +os:Mac OS X 10.0 \(Cheetah\):2002-09-18:1032300000: +os:Mac OS X 10.1 \(Puma\):2003-11-10:1068418800: +os:Mac OS X 10.2 \(Jaguar\):2005-05-16:1116194400: +os:Mac OS X 10.3 \(Panther\):2007-11-15:1195081200: +os:Mac OS X 10.4 \(Tiger\):2009-09-10:1252533600: +os:Mac OS X 10.5 \(Leopard\):2011-06-23:1308780000: +os:Mac OS X 10.6 \(Snow Leopard\):2013-12-16:1387148400: +os:Mac OS X 10.7 \(Lion\):2014-11-17:1416178800: +os:Mac OS X 10.8 \(Mountain Lion\):2015-10-21:1445378400: +os:Mac OS X 10.9 \(Mavericks\):2016-10-24:1477260000: +os:Mac OS X 10.10 \(Yosemite\):2017-10-31:1509404400: +os:Mac OS X 10.11 \(El Capitan\):2018-10-30:1540854000: +os:macOS Sierra \(10.12\):2016-10-24:1477260000: +os:macOS Sierra \(10.12.1\):2016-12-13:1481583600: +os:macOS Sierra \(10.12.2\):2017-01-23:1485126000: +os:macOS Sierra \(10.12.3\):2017-03-27:1490565600: +os:macOS Sierra \(10.12.4\):2017-05-15:1494799200: +os:macOS Sierra \(10.12.5\):2017-07-19:1500415200: +os:macOS Sierra \(10.12.6\):2019-10-29:1572303600: +os:macOS High Sierra \(10.13\):2017-10-31:1509404400: +os:macOS High Sierra \(10.13.1\):2017-12-06:1512514800: +os:macOS High Sierra \(10.13.2\):2018-01-23:1516662000: +os:macOS High Sierra \(10.13.3\):2018-03-29:1522274400: +os:macOS High Sierra \(10.13.4\):2018-06-01:1527804000: +os:macOS High Sierra \(10.13.5\):2018-07-09:1531087200: +os:macOS High Sierra \(10.13.6\)::-1: +os:macOS Mojave \(10.14\):2018-10-30:1540854000: +os:macOS Mojave \(10.14.1\):2018-12-05:1543964400: +os:macOS Mojave \(10.14.2\):2019-01-22:1548111600: +os:macOS Mojave \(10.14.3\):2019-03-25:1553468400: +os:macOS Mojave \(10.14.4\):2019-05-13:1557698400: +os:macOS Mojave \(10.14.5\):2019-07-22:1563746400: +os:macOS Mojave \(10.14.6\)::-1: +os:macOS Catalina \(10.15\):2019-10-29:1572303600: +os:macOS Catalina \(10.15.1\):2019-12-10:1575932400: +os:macOS Catalina \(10.15.2\):2020-01-28:1580166000: +os:macOS Catalina \(10.15.3\):2020-03-24:1585004400: +os:macOS Catalina \(10.15.4\):2020-05-26:1590444000: +os:macOS Catalina \(10.15.5\):2020-07-15:1594764000: +os:macOS Catalina \(10.15.6\):2020-09-24:1600898400: +os:macOS Catalina \(10.15.7\)::-1: +# +# Mageia - https://www.mageia.org/en/support/ +# +os:Mageia 1:2012-12-01:1354316400 +os:Mageia 2:2013-11-22:1385074800 +os:Mageia 3:2014-11-26:1416956400 +os:Mageia 4:2015-09-19:1442613600 +os:Mageia 5:2017-12-31:1514674800 +os:Mageia 6:2019-09-30:1569794400 +os:Mageia 7:2020-12-30:1609282800 +# +# NetBSD - https://www.netbsd.org/support/security/release.html and +# https://www.netbsd.org/releases/formal.html +# +os:NetBSD 2.0:2008-01-19:1200697200: +os:NetBSD 2.0.1:2008-01-19:1200697200: +os:NetBSD 2.0.2:2008-01-19:1200697200: +os:NetBSD 2.0.3:2008-01-19:1200697200: +os:NetBSD 2.1:2008-01-19:1200697200: +os:NetBSD 3.0:2009-09-29:1254175200: +os:NetBSD 3.0.1:2009-09-29:1254175200: +os:NetBSD 3.0.2:2009-09-29:1254175200: +os:NetBSD 3.1:2009-09-29:1254175200: +os:NetBSD 4.0:2012-11-17:1353106800: +os:NetBSD 4.0.1:2012-11-17:1353106800: +os:NetBSD 5.0:2015-11-17:1447714800: +os:NetBSD 5.0.1:2015-10-17:1445032800: +os:NetBSD 5.0.2:2015-10-17:1445032800: +os:NetBSD 5.1:2015-10-17:1445032800: +os:NetBSD 5.1.1:2015-10-17:1445032800: +os:NetBSD 5.1.2:2015-10-17:1445032800: +os:NetBSD 5.1.3:2015-10-17:1445032800: +os:NetBSD 5.1.4:2015-10-17:1445032800: +os:NetBSD 5.1.5:2015-10-17:1445032800: +os:NetBSD 5.2.1:2015-10-17:1445032800: +os:NetBSD 5.2.2:2015-10-17:1445032800: +os:NetBSD 5.2.3:2015-10-17:1445032800: +os:NetBSD 6.0:2017-09-17:1505599200: +os:NetBSD 6.0.1:2017-09-17:1505599200: +os:NetBSD 6.0.2:2017-09-17:1505599200: +os:NetBSD 6.0.3:2017-09-17:1505599200: +os:NetBSD 6.0.4:2017-09-17:1505599200: +os:NetBSD 6.0.5:2017-09-17:1505599200: +os:NetBSD 6.1:2017-09-17:1505599200: +os:NetBSD 6.1.1:2017-09-17:1505599200: +os:NetBSD 6.1.2:2017-09-17:1505599200: +os:NetBSD 6.1.3:2017-09-17:1505599200: +os:NetBSD 6.1.4:2017-09-17:1505599200: +os:NetBSD 6.1.5:2017-09-17:1505599200: +os:NetBSD 7.0:2020-03-14:1584162000: +os:NetBSD 7.0.1:2020-03-14:1584162000: +os:NetBSD 7.0.2:2020-03-14:1584162000: +os:NetBSD 7.1:2020-03-14:1584162000: +os:NetBSD 7.1.1:2020-03-14:1584162000: +os:NetBSD 7.1.1:2020-03-14:1584162000: +os:NetBSD 7.2:2020-03-14:1584162000: +os:NetBSD 8.0::-1: +os:NetBSD 8.1::-1: +os:NetBSD 9.0::-1: +# +# OpenBSD - https://en.wikipedia.org/wiki/OpenBSD_version_history +# +os:OpenBSD 5.8:2016-09-01:1472680800: +os:OpenBSD 5.9:2017-04-11:1491861600: +os:OpenBSD 6.0:2017-09-10:1505001600: +os:OpenBSD 6.1:2018-04-15:1523750400: +os:OpenBSD 6.2:2018-10-18:1539820800: +os:OpenBSD 6.3:2019-05-03:1556841600: +os:OpenBSD 6.4:2019-10-17:1571270400: +os:OpenBSD 6.5:2020-05-19:1589846400: +os:OpenBSD 6.6:2020-10-01:1601510400: +os:OpenBSD 6.7:2021-05-01:1619827200: +# +# Red Hat Enterprise Linux - https://access.redhat.com/labs/plcc/ +# +os:Red Hat Enterprise Linux Server release 6:2020-11-30:1606690800: +os:Red Hat Enterprise Linux 7:2024-06-30:1719698400: +os:Red Hat Enterprise Linux 8:2029-05-07:1872799200: +# +# Slackware - https://en.wikipedia.org/wiki/Slackware#Releases +# +os:Slackware Linux 8.1:2012-08-01:1343768400: +os:Slackware Linux 9.0:2012-08-01:1343768400: +os:Slackware Linux 9.1:2012-08-01:1343768400: +os:Slackware Linux 10.0:2012-08-01:1343768400: +os:Slackware Linux 10.1:2012-08-01:1343768400: +os:Slackware Linux 10.2:2012-08-01:1343768400: +os:Slackware Linux 11.0:2012-08-01:1343768400: +os:Slackware Linux 12.0:2012-08-01:1343768400: +os:Slackware Linux 12.1:2013-12-09:1386540000: +os:Slackware Linux 12.2:2013-12-09:1386540000: +os:Slackware Linux 13.0:2018-07-05:1530738000: +os:Slackware Linux 13.1:2018-07-05:1530738000: +os:Slackware Linux 13.37:2018-07-05:1530738000: +# +# SuSE - https://www.suse.com/lifecycle/ +# +os:SUSE Linux Enterprise Server 12:2024-10-31:1730329200: +os:SUSE Linux Enterprise Server 15:2028-07-31:1848607200: +# +# Ubuntu - https://wiki.ubuntu.com/Kernel/LTSEnablementStack and +# https://wiki.ubuntu.com/Releases +# +os:Ubuntu 14.04:2019-05-01:1556661600: +os:Ubuntu 14.10:2015-07-01:1435701600: +os:Ubuntu 15.04:2016-01-01:1451602800: +os:Ubuntu 15.10:2016-07-01:1467324000: +os:Ubuntu 16.04:2021-05-01:1619820000: +os:Ubuntu 16.10:2017-07-01:1498860000: +os:Ubuntu 17.04:2018-01-01:1514761200: +os:Ubuntu 17.10:2018-07-01:1530396000: +os:Ubuntu 18.04:2023-05-01:1682892000: +os:Ubuntu 18.10:2019-07-18:1563400800: +os:Ubuntu 19.04:2020-01-01:1577833200: +os:Ubuntu 20.04:2025-04-01:1743458400: +# +# OmniosCE - https://omniosce.org/releasenotes.html +# +os:OmniOS Community Edition v11 r151022:2020-05-11:1589148000: +os:OmniOS Community Edition v11 r151024:2018-11-04:1541286000: +os:OmniOS Community Edition v11 r151026:2019-05-05:1557007200: +os:OmniOS Community Edition v11 r151028:2019-11-04:1572822000: +os:OmniOS Community Edition v11 r151030::-1: +os:OmniOS Community Edition v11 r151032:2020-11-03:1604358000: +os:OmniOS Community Edition v11 r151034::-1: +# +## Oracle Solaris - https://www.oracle.com/us/support/library/lifetime-support-hardware-301321.pdf (p. 34) +# The list below contains Premier Support End only +# +os:Oracle Solaris 11.3:2021-01-01:1609455600: +os:Oracle Solaris 11.4:2031-11-01:1951254000: +# +# EOF From beb64d0c6710f0a2eff6bb4ad60f017476f9475c Mon Sep 17 00:00:00 2001 From: Decrypt Date: Thu, 29 Feb 2024 10:40:46 +0100 Subject: [PATCH 081/108] Update .gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index e53091c1..a9cbffac 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ .bzrignore custom.prf *.swp +.DS_Store From 767b8917ca64f6fead04676f9a9ca80be316dca4 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Wed, 6 Mar 2024 11:38:06 +0100 Subject: [PATCH 082/108] Update .gitignore --- .gitignore | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index a9cbffac..ef5bbe6b 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,5 @@ .bzr .bzrignore +.DS_Store custom.prf *.swp -.DS_Store From 9ee5b7142b29c2404a6b5ecb5b86606510f52de0 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Wed, 6 Mar 2024 14:32:57 +0000 Subject: [PATCH 083/108] Update changelog --- CHANGELOG.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 807bbc51..f1da1f2c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,9 @@ ## Lynis 3.1.0 (not released yet) +### Added +- Translation: Indonesian + ### Changed - MALW-3280 - Correction to detect com.avast.daemon - OS detection added for Guix System, macOS Ventura (13.x)/Sonoma (14.x), NXP LSDK, OpenEmbedded "nodistro", and The Yocto Projects distro "Poky" From e2e0998e9ebfa94e6f4bf4cfa503811967e959c7 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Mon, 11 Mar 2024 09:49:33 +0000 Subject: [PATCH 084/108] Release 3.1.0 --- CHANGELOG.md | 3 ++- lynis | 6 +++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f1da1f2c..369cb8a7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Lynis Changelog -## Lynis 3.1.0 (not released yet) +## Lynis 3.1.0 (2024-03-11) ### Added - Translation: Indonesian @@ -12,6 +12,7 @@ - STATUS_NOT_ACTIVE variable added to translation files - End-of-life dates updated - Fixing missing or erroneous test number comments +- Detection of SentinelOne corrected - Wazuh for file integrity and tooling - Updated parsing output of arch-audit - Added support for SentinelOne detection diff --git a/lynis b/lynis index ab769b24..fd4dea60 100755 --- a/lynis +++ b/lynis @@ -43,10 +43,10 @@ PROGRAM_WEBSITE="https://cisofy.com/lynis/" # Version details - PROGRAM_RELEASE_DATE="2023-08-03" - PROGRAM_RELEASE_TIMESTAMP=1691062820 + PROGRAM_RELEASE_DATE="2024-03-11" + PROGRAM_RELEASE_TIMESTAMP=1710148530 PROGRAM_RELEASE_TYPE="release" # pre-release or release - PROGRAM_VERSION="3.0.9" + PROGRAM_VERSION="3.1.0" # Source, documentation and license PROGRAM_SOURCE="https://github.com/CISOfy/lynis" From 126b8053aa08b739f5d41a0ace498fd82e7e79b1 Mon Sep 17 00:00:00 2001 From: Florian Sonnenschein Date: Mon, 11 Mar 2024 12:14:31 +0100 Subject: [PATCH 085/108] PKGS-7303: Added version numbers to brew packages. This allows lynis enterprise to render the software packages in the webinterface. --- include/tests_ports_packages | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/include/tests_ports_packages b/include/tests_ports_packages index 81babdc3..5fded96e 100644 --- a/include/tests_ports_packages +++ b/include/tests_ports_packages @@ -127,11 +127,15 @@ LogText "Test: Querying brew to get package list" Display --indent 4 --text "- Querying brew for installed packages" LogText "Output:"; LogText "-----" - GPACKAGES=$(brew list) - for J in ${GPACKAGES}; do - LogText "Found package ${J}" - INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${J}" - done + GPACKAGES=$(brew list --versions) + while IFS= read -r PKG; do + PACKAGE_NAME=$(echo ${PKG} | ${CUTBINARY} -d ' ' -f1) + PACKAGE_VERSION=$(echo ${PKG} | ${CUTBINARY} -d ' ' -f2) + LogText "Found package: ${PACKAGE_NAME} (version: ${PACKAGE_VERSION})" + INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${PACKAGE_NAME},${PACKAGE_VERSION}" + done << EOF +$GPACKAGES +EOF else LogText "Result: brew can NOT be found on this system" fi From 998007c9713482ef698f137b4700a4dfbc6e4f8a Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Tue, 12 Mar 2024 08:39:59 +0100 Subject: [PATCH 086/108] Update CHANGELOG.md --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 369cb8a7..72c6598b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Lynis Changelog +## Lynis 3.1.1 (not released yet) + +### Changed +- DBS-1882 - Redis configuration file path added for FreeBSD (/usr/local/etc/redis.conf) + +--------------------------------------------------------------------------------- + ## Lynis 3.1.0 (2024-03-11) ### Added From 6aa69919bedd3dbedf43deb8c103023078c3c45d Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Tue, 12 Mar 2024 08:40:32 +0100 Subject: [PATCH 087/108] Switch to pre-release --- lynis | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lynis b/lynis index fd4dea60..5446bcb6 100755 --- a/lynis +++ b/lynis @@ -43,10 +43,10 @@ PROGRAM_WEBSITE="https://cisofy.com/lynis/" # Version details - PROGRAM_RELEASE_DATE="2024-03-11" + PROGRAM_RELEASE_DATE="2024-03-12" PROGRAM_RELEASE_TIMESTAMP=1710148530 - PROGRAM_RELEASE_TYPE="release" # pre-release or release - PROGRAM_VERSION="3.1.0" + PROGRAM_RELEASE_TYPE="pre-release" # pre-release or release + PROGRAM_VERSION="3.1.1" # Source, documentation and license PROGRAM_SOURCE="https://github.com/CISOfy/lynis" From 1d3de505798c2a0fc150d9488eefe5f3ce386deb Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Tue, 12 Mar 2024 13:38:04 +0100 Subject: [PATCH 088/108] Update tests_databases --- include/tests_databases | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/tests_databases b/include/tests_databases index 34bace85..bcf0a3a6 100644 --- a/include/tests_databases +++ b/include/tests_databases @@ -302,8 +302,8 @@ if [ ${QNAP_DEVICE} -eq 1 ]; then PATHS="${PATHS} ${ROOTDIR}share/CACHEDEV1_DATA/.qpkg/QKVM/usr/etc/redis.conf" fi - if [ -d "/snap" ]; then - for SNAP_PATH in $(${FINDBINARY} /snap -name 'redis.conf' -type f | ${SEDBINARY} 's/redis.conf$//g'); do + if [ -d "${ROOTDIR}snap" ]; then + for SNAP_PATH in $(${FINDBINARY} ${ROOTDIR}snap -name 'redis.conf' -type f | ${SEDBINARY} 's/redis.conf$//g'); do PATHS="${PATHS} ${SNAP_PATH}" done fi From 990a590f3c6120f639b696a40add5cb4a8037cb8 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Tue, 12 Mar 2024 13:41:07 +0100 Subject: [PATCH 089/108] Update CHANGELOG.md --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 72c6598b..e7370a26 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,7 @@ ### Changed - DBS-1882 - Redis configuration file path added for FreeBSD (/usr/local/etc/redis.conf) +- DBS-1882 - Check /snap directory location for Redis configuration file --------------------------------------------------------------------------------- From a2649bd5001a4f714b2e4e3a70f06f86d0b2befd Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Sun, 17 Mar 2024 10:28:13 +0000 Subject: [PATCH 090/108] Added ArcoLinux --- include/osdetection | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/include/osdetection b/include/osdetection index b09bd2f0..61f290d7 100644 --- a/include/osdetection +++ b/include/osdetection @@ -176,6 +176,11 @@ OS_FULLNAME="Arch Linux 32" OS_VERSION="Rolling release" ;; + "arcolinux") + LINUX_VERSION="ArcoLinux" + OS_FULLNAME="ArcoLinux" + OS_VERSION="Rolling release" + ;; "artix") LINUX_VERSION="Artix Linux" OS_FULLNAME="Artix Linux" From 60afce6d8110ee9e88ac9e9d0e0346b1cf222b5e Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Sun, 17 Mar 2024 10:29:40 +0000 Subject: [PATCH 091/108] Release 3.1.1 --- CHANGELOG.md | 5 ++++- lynis | 6 +++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e7370a26..1f3028dd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,9 @@ # Lynis Changelog -## Lynis 3.1.1 (not released yet) +## Lynis 3.1.1 (2024-03-17) + +### Added +- Detection of ArcoLinux ### Changed - DBS-1882 - Redis configuration file path added for FreeBSD (/usr/local/etc/redis.conf) diff --git a/lynis b/lynis index 5446bcb6..055939bc 100755 --- a/lynis +++ b/lynis @@ -43,9 +43,9 @@ PROGRAM_WEBSITE="https://cisofy.com/lynis/" # Version details - PROGRAM_RELEASE_DATE="2024-03-12" - PROGRAM_RELEASE_TIMESTAMP=1710148530 - PROGRAM_RELEASE_TYPE="pre-release" # pre-release or release + PROGRAM_RELEASE_DATE="2024-03-17" + PROGRAM_RELEASE_TIMESTAMP=1710671337 + PROGRAM_RELEASE_TYPE="release" # pre-release or release PROGRAM_VERSION="3.1.1" # Source, documentation and license From 9b40ce578119b552eb972af75d5efaeac7e36ba9 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Mon, 18 Mar 2024 09:27:09 +0000 Subject: [PATCH 092/108] Merged files and moved AIX changes to the right file --- db/software-eol.db | 17 +++ software-eol.db | 276 --------------------------------------------- 2 files changed, 17 insertions(+), 276 deletions(-) delete mode 100644 software-eol.db diff --git a/db/software-eol.db b/db/software-eol.db index e113bf53..342db780 100644 --- a/db/software-eol.db +++ b/db/software-eol.db @@ -14,6 +14,23 @@ # For rolling releases or releases that do not (currently have an EOL date, leave field three empty and set field four to -1. # Full string for CentOS can be something like 'CentOS Linux 8 (Core)'. As this does not correctly match, shorter string is used for matching. # +# AIX - https://www.ibm.com/support/pages/aix-support-lifecycle-information +# +os:AIX 7300-02:2026-11-30:1796032800: +os:AIX 7300-01:2025-12-31:1767175200: +os:AIX 7300-00:2024-12-31:1735639200: +os:AIX 7200-05::-1: +os:AIX 7200-04:2022-11-30:1669802400: +os:AIX 7200-03:2021-09-30:1632996000: +os:AIX 7200-02:2020-10-31:1604138400: +os:AIX 7200-01:2019-11-30:1575108000: +os:AIX 7200-00:2018-12-30:1546164000: +os:AIX 7100:2023-04-30:1682848800: +os:AIX 6:2017-04-30:1493546400: +os:AIX 5:2012-04-30:1335780000: +os:AIX 4:2003-12-31:1072864800: +os:AIX 3:1997-12-31:883562400: +# # Alpine - https://alpinelinux.org/releases/ # os:Alpine 3.19:2025-11-01:1761955200 diff --git a/software-eol.db b/software-eol.db deleted file mode 100644 index 41a5af1b..00000000 --- a/software-eol.db +++ /dev/null @@ -1,276 +0,0 @@ -# -# End-of-life for operating systems and software -# -# This file has 4 fields: -# 1) category -# 2) name -# 3) date (human-readable) or empty -# 4) converted date (seconds since epoch) or -1 -# -# Date can be converted on Linux using: date "+%s" --date=2020-01-01 -# Seconds since epoch can be verified using: date -d @1467324000 +'%Y-%m-%d' -# -# Notes: -# For rolling releases or releases that do not (currently have an EOL date, leave field three empty and set field four to -1. -# Full string for CentOS can be something like 'CentOS Linux 8 (Core)'. As this does not correctly match, shorter string is used for matching. -# -# AIX - https://www.ibm.com/support/pages/aix-support-lifecycle-information -# -os:AIX 7300-02:2026-11-30:1796032800: -os:AIX 7300-01:2025-12-31:1767175200: -os:AIX 7300-00:2024-12-31:1735639200: -os:AIX 7200-05::-1: -os:AIX 7200-04:2022-11-30:1669802400: -os:AIX 7200-03:2021-09-30:1632996000: -os:AIX 7200-02:2020-10-31:1604138400: -os:AIX 7200-01:2019-11-30:1575108000: -os:AIX 7200-00:2018-12-30:1546164000: -os:AIX 7100:2023-04-30:1682848800: -os:AIX 6:2017-04-30:1493546400: -os:AIX 5:2012-04-30:1335780000: -os:AIX 4:2003-12-31:1072864800: -os:AIX 3:1997-12-31:883562400: -# -# Alpine - https://alpinelinux.org/releases/ -# -os:Alpine 3.15:2023-11-01:1698793200 -os:Alpine 3.14:2023-05-01:1682899200 -os:Alpine 3.13:2022-11-01:1667275200 -os:Alpine 3.12:2022-05-01:1651377600 -os:Alpine 3.11:2021-11-01:1635739200 -os:Alpine 3.10:2021-05-01:1619841600 -os:Alpine 3.9:2020-11-01:1604203200 -os:Alpine 3.8:2020-05-01:1588305600 -# -# Amazon Linux -# -# Note: shortest entry is listed at end due to regular expression matching being used -os:Amazon Linux 2:2023-06-26:1687730400: -os:Amazon Linux:2020-06-30:1593468000: -# -# Arch Linux -# -os:Arch Linux::-1: -# -# CentOS -# -os:CentOS release 5:2017-03-31:1490911200: -os:CentOS release 6:2020-11-30:1606690800: -os:CentOS Linux 7:2024-06-30:1719698400: -os:CentOS Linux 8:2029-05-31:1874872800: -# -# Debian - https://wiki.debian.org/DebianReleases#Production_Releases -# -os:Debian 5.0:2012-02-06:1328482800: -os:Debian 6.0:2016-02-29:1456700400: -os:Debian 7:2018-05-31:1527717600: -os:Debian 8:2020-06-30:1593468000: -os:Debian 9:2022-01-01:1640991600: -os:Debian 10:2022-01-01:1640991600: -# -# Fedora - https://fedoraproject.org/wiki/End_of_life -# -os:Fedora release 25:2017-12-12:1513033200: -os:Fedora release 26:2018-05-29:1527544800: -os:Fedora release 27:2018-11-30:1543532400: -os:Fedora release 28:2019-05-28:1558994400: -os:Fedora release 29:2019-11-26:1574722800: -os:Fedora release 30:2020-05-26:1590444000: -# -# FreeBSD - https://www.freebsd.org/security/unsupported.html -# -os:FreeBSD 9.3:2014-12-31:1419980400: -os:FreeBSD 10.0:2015-02-28:1425078000: -os:FreeBSD 10.1:2016-12-31:1483138800: -os:FreeBSD 10.2:2016-12-31:1483138800: -os:FreeBSD 10.3:2018-04-30:1525039200: -os:FreeBSD 10.4:2018-10-31:1540940400: -os:FreeBSD 11.0:2017-11-30:1511996400: -os:FreeBSD 11.1:2018-09-30:1538258400: -os:FreeBSD 11.2:2019-10-31:1572476400: -os:FreeBSD 12.0:2020-02-29:1582930800: -# -# Linux Mint -# -os:Linux Mint 18:2021-04-01:1617228000: -os:Linux Mint 19:2023-04-01:1680300000: -os:Linux Mint 20:2025-04-01:1743458400: -# -# macOS - https://support.apple.com/en_US/downloads/macos and -# https://apple.stackexchange.com/a/282788 and -# https://en.wikipedia.org/wiki/Category:MacOS_versions -# -os:Mac OS X 10.0 \(Cheetah\):2002-09-18:1032300000: -os:Mac OS X 10.1 \(Puma\):2003-11-10:1068418800: -os:Mac OS X 10.2 \(Jaguar\):2005-05-16:1116194400: -os:Mac OS X 10.3 \(Panther\):2007-11-15:1195081200: -os:Mac OS X 10.4 \(Tiger\):2009-09-10:1252533600: -os:Mac OS X 10.5 \(Leopard\):2011-06-23:1308780000: -os:Mac OS X 10.6 \(Snow Leopard\):2013-12-16:1387148400: -os:Mac OS X 10.7 \(Lion\):2014-11-17:1416178800: -os:Mac OS X 10.8 \(Mountain Lion\):2015-10-21:1445378400: -os:Mac OS X 10.9 \(Mavericks\):2016-10-24:1477260000: -os:Mac OS X 10.10 \(Yosemite\):2017-10-31:1509404400: -os:Mac OS X 10.11 \(El Capitan\):2018-10-30:1540854000: -os:macOS Sierra \(10.12\):2016-10-24:1477260000: -os:macOS Sierra \(10.12.1\):2016-12-13:1481583600: -os:macOS Sierra \(10.12.2\):2017-01-23:1485126000: -os:macOS Sierra \(10.12.3\):2017-03-27:1490565600: -os:macOS Sierra \(10.12.4\):2017-05-15:1494799200: -os:macOS Sierra \(10.12.5\):2017-07-19:1500415200: -os:macOS Sierra \(10.12.6\):2019-10-29:1572303600: -os:macOS High Sierra \(10.13\):2017-10-31:1509404400: -os:macOS High Sierra \(10.13.1\):2017-12-06:1512514800: -os:macOS High Sierra \(10.13.2\):2018-01-23:1516662000: -os:macOS High Sierra \(10.13.3\):2018-03-29:1522274400: -os:macOS High Sierra \(10.13.4\):2018-06-01:1527804000: -os:macOS High Sierra \(10.13.5\):2018-07-09:1531087200: -os:macOS High Sierra \(10.13.6\)::-1: -os:macOS Mojave \(10.14\):2018-10-30:1540854000: -os:macOS Mojave \(10.14.1\):2018-12-05:1543964400: -os:macOS Mojave \(10.14.2\):2019-01-22:1548111600: -os:macOS Mojave \(10.14.3\):2019-03-25:1553468400: -os:macOS Mojave \(10.14.4\):2019-05-13:1557698400: -os:macOS Mojave \(10.14.5\):2019-07-22:1563746400: -os:macOS Mojave \(10.14.6\)::-1: -os:macOS Catalina \(10.15\):2019-10-29:1572303600: -os:macOS Catalina \(10.15.1\):2019-12-10:1575932400: -os:macOS Catalina \(10.15.2\):2020-01-28:1580166000: -os:macOS Catalina \(10.15.3\):2020-03-24:1585004400: -os:macOS Catalina \(10.15.4\):2020-05-26:1590444000: -os:macOS Catalina \(10.15.5\):2020-07-15:1594764000: -os:macOS Catalina \(10.15.6\):2020-09-24:1600898400: -os:macOS Catalina \(10.15.7\)::-1: -# -# Mageia - https://www.mageia.org/en/support/ -# -os:Mageia 1:2012-12-01:1354316400 -os:Mageia 2:2013-11-22:1385074800 -os:Mageia 3:2014-11-26:1416956400 -os:Mageia 4:2015-09-19:1442613600 -os:Mageia 5:2017-12-31:1514674800 -os:Mageia 6:2019-09-30:1569794400 -os:Mageia 7:2020-12-30:1609282800 -# -# NetBSD - https://www.netbsd.org/support/security/release.html and -# https://www.netbsd.org/releases/formal.html -# -os:NetBSD 2.0:2008-01-19:1200697200: -os:NetBSD 2.0.1:2008-01-19:1200697200: -os:NetBSD 2.0.2:2008-01-19:1200697200: -os:NetBSD 2.0.3:2008-01-19:1200697200: -os:NetBSD 2.1:2008-01-19:1200697200: -os:NetBSD 3.0:2009-09-29:1254175200: -os:NetBSD 3.0.1:2009-09-29:1254175200: -os:NetBSD 3.0.2:2009-09-29:1254175200: -os:NetBSD 3.1:2009-09-29:1254175200: -os:NetBSD 4.0:2012-11-17:1353106800: -os:NetBSD 4.0.1:2012-11-17:1353106800: -os:NetBSD 5.0:2015-11-17:1447714800: -os:NetBSD 5.0.1:2015-10-17:1445032800: -os:NetBSD 5.0.2:2015-10-17:1445032800: -os:NetBSD 5.1:2015-10-17:1445032800: -os:NetBSD 5.1.1:2015-10-17:1445032800: -os:NetBSD 5.1.2:2015-10-17:1445032800: -os:NetBSD 5.1.3:2015-10-17:1445032800: -os:NetBSD 5.1.4:2015-10-17:1445032800: -os:NetBSD 5.1.5:2015-10-17:1445032800: -os:NetBSD 5.2.1:2015-10-17:1445032800: -os:NetBSD 5.2.2:2015-10-17:1445032800: -os:NetBSD 5.2.3:2015-10-17:1445032800: -os:NetBSD 6.0:2017-09-17:1505599200: -os:NetBSD 6.0.1:2017-09-17:1505599200: -os:NetBSD 6.0.2:2017-09-17:1505599200: -os:NetBSD 6.0.3:2017-09-17:1505599200: -os:NetBSD 6.0.4:2017-09-17:1505599200: -os:NetBSD 6.0.5:2017-09-17:1505599200: -os:NetBSD 6.1:2017-09-17:1505599200: -os:NetBSD 6.1.1:2017-09-17:1505599200: -os:NetBSD 6.1.2:2017-09-17:1505599200: -os:NetBSD 6.1.3:2017-09-17:1505599200: -os:NetBSD 6.1.4:2017-09-17:1505599200: -os:NetBSD 6.1.5:2017-09-17:1505599200: -os:NetBSD 7.0:2020-03-14:1584162000: -os:NetBSD 7.0.1:2020-03-14:1584162000: -os:NetBSD 7.0.2:2020-03-14:1584162000: -os:NetBSD 7.1:2020-03-14:1584162000: -os:NetBSD 7.1.1:2020-03-14:1584162000: -os:NetBSD 7.1.1:2020-03-14:1584162000: -os:NetBSD 7.2:2020-03-14:1584162000: -os:NetBSD 8.0::-1: -os:NetBSD 8.1::-1: -os:NetBSD 9.0::-1: -# -# OpenBSD - https://en.wikipedia.org/wiki/OpenBSD_version_history -# -os:OpenBSD 5.8:2016-09-01:1472680800: -os:OpenBSD 5.9:2017-04-11:1491861600: -os:OpenBSD 6.0:2017-09-10:1505001600: -os:OpenBSD 6.1:2018-04-15:1523750400: -os:OpenBSD 6.2:2018-10-18:1539820800: -os:OpenBSD 6.3:2019-05-03:1556841600: -os:OpenBSD 6.4:2019-10-17:1571270400: -os:OpenBSD 6.5:2020-05-19:1589846400: -os:OpenBSD 6.6:2020-10-01:1601510400: -os:OpenBSD 6.7:2021-05-01:1619827200: -# -# Red Hat Enterprise Linux - https://access.redhat.com/labs/plcc/ -# -os:Red Hat Enterprise Linux Server release 6:2020-11-30:1606690800: -os:Red Hat Enterprise Linux 7:2024-06-30:1719698400: -os:Red Hat Enterprise Linux 8:2029-05-07:1872799200: -# -# Slackware - https://en.wikipedia.org/wiki/Slackware#Releases -# -os:Slackware Linux 8.1:2012-08-01:1343768400: -os:Slackware Linux 9.0:2012-08-01:1343768400: -os:Slackware Linux 9.1:2012-08-01:1343768400: -os:Slackware Linux 10.0:2012-08-01:1343768400: -os:Slackware Linux 10.1:2012-08-01:1343768400: -os:Slackware Linux 10.2:2012-08-01:1343768400: -os:Slackware Linux 11.0:2012-08-01:1343768400: -os:Slackware Linux 12.0:2012-08-01:1343768400: -os:Slackware Linux 12.1:2013-12-09:1386540000: -os:Slackware Linux 12.2:2013-12-09:1386540000: -os:Slackware Linux 13.0:2018-07-05:1530738000: -os:Slackware Linux 13.1:2018-07-05:1530738000: -os:Slackware Linux 13.37:2018-07-05:1530738000: -# -# SuSE - https://www.suse.com/lifecycle/ -# -os:SUSE Linux Enterprise Server 12:2024-10-31:1730329200: -os:SUSE Linux Enterprise Server 15:2028-07-31:1848607200: -# -# Ubuntu - https://wiki.ubuntu.com/Kernel/LTSEnablementStack and -# https://wiki.ubuntu.com/Releases -# -os:Ubuntu 14.04:2019-05-01:1556661600: -os:Ubuntu 14.10:2015-07-01:1435701600: -os:Ubuntu 15.04:2016-01-01:1451602800: -os:Ubuntu 15.10:2016-07-01:1467324000: -os:Ubuntu 16.04:2021-05-01:1619820000: -os:Ubuntu 16.10:2017-07-01:1498860000: -os:Ubuntu 17.04:2018-01-01:1514761200: -os:Ubuntu 17.10:2018-07-01:1530396000: -os:Ubuntu 18.04:2023-05-01:1682892000: -os:Ubuntu 18.10:2019-07-18:1563400800: -os:Ubuntu 19.04:2020-01-01:1577833200: -os:Ubuntu 20.04:2025-04-01:1743458400: -# -# OmniosCE - https://omniosce.org/releasenotes.html -# -os:OmniOS Community Edition v11 r151022:2020-05-11:1589148000: -os:OmniOS Community Edition v11 r151024:2018-11-04:1541286000: -os:OmniOS Community Edition v11 r151026:2019-05-05:1557007200: -os:OmniOS Community Edition v11 r151028:2019-11-04:1572822000: -os:OmniOS Community Edition v11 r151030::-1: -os:OmniOS Community Edition v11 r151032:2020-11-03:1604358000: -os:OmniOS Community Edition v11 r151034::-1: -# -## Oracle Solaris - https://www.oracle.com/us/support/library/lifetime-support-hardware-301321.pdf (p. 34) -# The list below contains Premier Support End only -# -os:Oracle Solaris 11.3:2021-01-01:1609455600: -os:Oracle Solaris 11.4:2031-11-01:1951254000: -# -# EOF From f5b85c65e99f11399dd8f5d5084792db02d980e4 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Mon, 18 Mar 2024 09:28:51 +0000 Subject: [PATCH 093/108] Switch to pre-release --- CHANGELOG.md | 7 +++++++ lynis | 6 +++--- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1f3028dd..74b939e0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Lynis Changelog +## Lynis 3.1.2 (not released yet) + +### Changed +- Correction of software EOL database and inclusion of AIX entries + +--------------------------------------------------------------------------------- + ## Lynis 3.1.1 (2024-03-17) ### Added diff --git a/lynis b/lynis index 055939bc..9ae06b67 100755 --- a/lynis +++ b/lynis @@ -43,10 +43,10 @@ PROGRAM_WEBSITE="https://cisofy.com/lynis/" # Version details - PROGRAM_RELEASE_DATE="2024-03-17" + PROGRAM_RELEASE_DATE="2024-03-18" PROGRAM_RELEASE_TIMESTAMP=1710671337 - PROGRAM_RELEASE_TYPE="release" # pre-release or release - PROGRAM_VERSION="3.1.1" + PROGRAM_RELEASE_TYPE="pre-release" # pre-release or release + PROGRAM_VERSION="3.1.2" # Source, documentation and license PROGRAM_SOURCE="https://github.com/CISOfy/lynis" From 6f81b6502b978135ecda8a28c51881cc15daa0be Mon Sep 17 00:00:00 2001 From: Erasure5959 <154384607+Erasure5959@users.noreply.github.com> Date: Mon, 18 Mar 2024 15:21:27 +0200 Subject: [PATCH 094/108] Update osdetection - add support for OSMC Add detection support for OSMC. --- include/osdetection | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/include/osdetection b/include/osdetection index 61f290d7..579538bb 100644 --- a/include/osdetection +++ b/include/osdetection @@ -348,6 +348,12 @@ OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') OS_NAME="openSUSE" ;; + "osmc") + LINUX_VERSION="OSMC" + LINUX_VERSION_LIKE="Debian" + OS_NAME="Open Source Media Center" + OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') + ;; "parrot") LINUX_VERSION="Parrot" OS_NAME="Parrot GNU/Linux" From 6476036b023b006ed84af16420ac08e65216a42c Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Mon, 18 Mar 2024 14:28:09 +0100 Subject: [PATCH 095/108] Update CHANGELOG.md --- CHANGELOG.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 74b939e0..5fd046bf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,9 @@ ## Lynis 3.1.2 (not released yet) +### Added +- Detection of Open Source Media Center (OSMC) + ### Changed - Correction of software EOL database and inclusion of AIX entries From 967b9f1ec7ff504c91805bbf6f8e6ff170d05173 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Tue, 19 Mar 2024 11:53:28 +0100 Subject: [PATCH 096/108] Update CHANGELOG.md --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5fd046bf..f6dfd05b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ ## Lynis 3.1.2 (not released yet) ### Added +- Detection of Athena OS - Detection of Open Source Media Center (OSMC) ### Changed From f36e39063a1410c24d1a2f85284600004154bd44 Mon Sep 17 00:00:00 2001 From: Ikko Eltociear Ashimine Date: Fri, 22 Mar 2024 14:42:14 +0900 Subject: [PATCH 097/108] Update osdetection minor fix --- include/osdetection | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/osdetection b/include/osdetection index ef4bd587..22648dde 100644 --- a/include/osdetection +++ b/include/osdetection @@ -445,7 +445,7 @@ OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') ;; *) - ReportException "OS Detection" "Unknown OS found in /etc/os-release - Please create an issue on GitHub and share the the contents (cat /etc/os-release): ${PROGRAM_SOURCE}" + ReportException "OS Detection" "Unknown OS found in /etc/os-release - Please create an issue on GitHub and share the contents (cat /etc/os-release): ${PROGRAM_SOURCE}" ;; esac fi From 58d084ef71333cb4302a560426a538507e40b74e Mon Sep 17 00:00:00 2001 From: TCH Date: Tue, 26 Mar 2024 20:50:50 +0100 Subject: [PATCH 098/108] Update osdetection --- include/osdetection | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/include/osdetection b/include/osdetection index ef4bd587..e5789c88 100644 --- a/include/osdetection +++ b/include/osdetection @@ -332,6 +332,12 @@ OS_REDHAT_OR_CLONE=1 OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') ;; + "nobara") + LINUX_VERSION="Nobara" + OS_NAME="Nobara Linux" + OS_REDHAT_OR_CLONE=1 + OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') + ;; "nodistro") LINUX_VERSION="openembedded" OS_NAME="OpenEmbedded" From afd0eaddf07e9950eedbded537a96dda6cfe44d1 Mon Sep 17 00:00:00 2001 From: Tobias Svenblad <59305921+tsvenbla@users.noreply.github.com> Date: Thu, 28 Mar 2024 22:01:14 +0200 Subject: [PATCH 099/108] Added regex for NETW-3200 in tests_networking Changed the check /bin/true to /bin/(true|false) to be more inclusive and get rid of false positives. --- include/tests_networking | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/tests_networking b/include/tests_networking index 116f3760..44a65708 100644 --- a/include/tests_networking +++ b/include/tests_networking @@ -750,7 +750,7 @@ UNCOMMON_PROTOCOL_DISABLED=0 # First check modprobe.conf if [ -f ${ROOTDIR}etc/modprobe.conf ]; then - DATA=$(${GREPBINARY} "^install \+${P} \+/bin/true$" ${ROOTDIR}etc/modprobe.conf) + DATA=$(${GREPBINARY} "^install \+${P} \+/bin/(true|false)$" ${ROOTDIR}etc/modprobe.conf) if [ -n "${DATA}" ]; then LogText "Result: found ${P} module disabled via modprobe.conf" UNCOMMON_PROTOCOL_DISABLED=1 @@ -759,7 +759,7 @@ # Then additional modprobe configuration files if [ -d ${ROOTDIR}etc/modprobe.d ]; then # Return file names (-l) and suppress errors (-s) - DATA=$(${GREPBINARY} -l -s "^install \+${P} \+/bin/true$" ${ROOTDIR}etc/modprobe.d/*) + DATA=$(${GREPBINARY} -l -s "^install \+${P} \+/bin/(true|false)$" ${ROOTDIR}etc/modprobe.d/*) if [ -n "${DATA}" ]; then UNCOMMON_PROTOCOL_DISABLED=1 for F in ${DATA}; do From 48cb2c7cb89e09ad4c56607bd39ce52eafba639f Mon Sep 17 00:00:00 2001 From: Constacalm <163557834+Constacalm@users.noreply.github.com> Date: Mon, 1 Apr 2024 14:48:23 +0300 Subject: [PATCH 100/108] Update osdetection (ALT Linux) Consider to update osdetection script to detect ALT Linux distro in issue #1465 (https://github.com/CISOfy/lynis/issues/1465) --- include/osdetection | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/include/osdetection b/include/osdetection index ef4bd587..3aab00ab 100644 --- a/include/osdetection +++ b/include/osdetection @@ -160,6 +160,11 @@ OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') ;; + "altlinux") + LINUX_VERSION="ALT Linux" + OS_NAME="altlinux" + OS_VERSION=$(grep "^ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"') + ;; "amzn") LINUX_VERSION="Amazon Linux" OS_NAME="Amazon Linux" From 75818a636cd07461974e2eb3d9838d3d722c87b1 Mon Sep 17 00:00:00 2001 From: vk6xebec <59078659+vk6xebec@users.noreply.github.com> Date: Sun, 7 Apr 2024 11:02:14 +0800 Subject: [PATCH 101/108] McAfee antivirus has been deprecated As of 1 Oct 2023, McAfee antivirus for Linux has been deprecated https://www.mcafee.com/support/?locale=no-NO&articleId=TS103384&page=shell&shell=article-view --- include/tests_malware | 29 ++++++++++++----------------- 1 file changed, 12 insertions(+), 17 deletions(-) diff --git a/include/tests_malware b/include/tests_malware index 87a721bc..a4a51315 100644 --- a/include/tests_malware +++ b/include/tests_malware @@ -46,23 +46,18 @@ TRENDMICRO_DSA_DAEMON_RUNNING=0 # ################################################################################# -# - # Test : MALW-3274 - # Description : Check for installed tool (McAfee VirusScan for Command Line) - Register --test-no MALW-3274 --weight L --network NO --category security --description "Check for McAfee VirusScan Command Line" - if [ ${SKIPTEST} -eq 0 ]; then - LogText "Test: checking presence McAfee VirusScan for Command Line" - if [ -x /usr/local/uvscan/uvscan ]; then - Display --indent 2 --text "- ${GEN_CHECKING} McAfee VirusScan for Command Line" --result "${STATUS_FOUND}" --color GREEN - LogText "Result: Found ${MCAFEECLBINARY}" - MALWARE_SCANNER_INSTALLED=1 - AddHP 2 2 - Report "malware_scanner[]=mcafeecl" - else - LogText "Result: McAfee VirusScan for Command Line not found" - fi - fi -# +# Test : MALW-3274 +# Description : Check for installed tool (McAfee VirusScan for Command Line) +Register --test-no MALW-3274 --weight L --network NO --category security --description "Check for McAfee VirusScan Command Line" +if [ ${SKIPTEST} -eq 0 ]; then + LogText "Test: checking presence McAfee VirusScan for Command Line" + if [ -x /usr/local/uvscan/uvscan ]; then + Display --indent 2 --text "- ${GEN_CHECKING} McAfee VirusScan for Command Line" --result "${STATUS_FOUND}" --color RED + LogText "Result: Found ${MCAFEECLBINARY}" + MALWARE_SCANNER_INSTALLED=0 + AddHP 0 2 + LogText "Result: McAfee Antivirus for Linux has been deprecated as of 1 Oct 2023 and will not receive updates. Please use another antivirus instead." +fi ################################################################################# # # Test : MALW-3275 From c9f89cd5f41bfbcb8f6d3cf720c4aa2da3e3feb2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?O=C4=9Fuz=20Ersen?= Date: Wed, 10 Apr 2024 13:20:24 +0300 Subject: [PATCH 102/108] Update tr --- db/languages/tr | 172 ++++++++++++++++++++++++------------------------ 1 file changed, 86 insertions(+), 86 deletions(-) diff --git a/db/languages/tr b/db/languages/tr index 585cfed5..3df59a53 100644 --- a/db/languages/tr +++ b/db/languages/tr @@ -1,108 +1,108 @@ -ERROR_NO_LICENSE="Lisans anahtarı yapılandırılmamış" -ERROR_NO_UPLOAD_SERVER="Yükleme sunucusu yapılandırılmamış" -GEN_CHECKING="Kontrol ediyor" -GEN_CURRENT_VERSION="Mevcut Sürüm" +ERROR_NO_LICENSE="Lisans anahtarı yapılandırılmadı" +ERROR_NO_UPLOAD_SERVER="Yükleme sunucusu yapılandırılmadı" +GEN_CHECKING=" Denetleniyor" +GEN_CURRENT_VERSION="Geçerli sürüm" GEN_DEBUG_MODE="Hata ayıklama modu" GEN_INITIALIZE_PROGRAM="Program başlatılıyor" -GEN_LATEST_VERSION="Son sürüm" -GEN_PHASE="faz" -GEN_PLUGINS_ENABLED="Yapılandırılmış eklentiler" -GEN_UPDATE_AVAILABLE="güncelleme mevcut" -GEN_VERBOSE_MODE="Detay modu" +GEN_LATEST_VERSION="En son sürüm" +GEN_PHASE="evre" +GEN_PLUGINS_ENABLED="Etkinleştirilen eklentiler" +GEN_UPDATE_AVAILABLE="güncelleme var" +GEN_VERBOSE_MODE="Ayrıntılı mod" GEN_WHAT_TO_DO="Yapılması gerekenler" -NOTE_EXCEPTIONS_FOUND_DETAILED="Bazı istisnai durumlar ve bilgiler bulundu" NOTE_EXCEPTIONS_FOUND="İstisnalar bulundu" -NOTE_PLUGINS_TAKE_TIME="Not: eklentiler daha detaylı testler içermektedir ve tamamlanmaları uzun sürebilir" +NOTE_EXCEPTIONS_FOUND_DETAILED="Bazı istisnai olaylar veya bilgiler bulundu" +NOTE_PLUGINS_TAKE_TIME="Not: eklentiler daha kapsamlı testlere sahiptir ve tamamlanması birkaç dakika sürebilir" NOTE_SKIPPED_TESTS_NON_PRIVILEGED="Yetkisiz çalışma nedeniyle atlanan testler" -#SECTION_ACCOUNTING="Accounting" -#SECTION_BANNERS_AND_IDENTIFICATION="Banners and identification" -#SECTION_BASICS="Basics" -#SECTION_BOOT_AND_SERVICES="Boot and services" -#SECTION_CONTAINERS="Containers" -#SECTION_CRYPTOGRAPHY="Cryptography" +SECTION_ACCOUNTING="Hesaplama" +SECTION_BANNERS_AND_IDENTIFICATION="Afişler ve tanımlama" +SECTION_BASICS="Temel Bilgiler" +SECTION_BOOT_AND_SERVICES="Önyükleme ve hizmetler" +SECTION_CONTAINERS="Konteynerler" +SECTION_CRYPTOGRAPHY="Kriptografi" SECTION_CUSTOM_TESTS="Özel testler" -#SECTION_DATABASES="Databases" -#SECTION_DATA_UPLOAD="Data upload" -#SECTION_DOWNLOADS="Downloads" -#SECTION_EMAIL_AND_MESSAGING="Software: e-mail and messaging" -#SECTION_FILE_INTEGRITY="Software: file integrity" -#SECTION_FILE_PERMISSIONS="File Permissions" -#SECTION_FILE_SYSTEMS="File systems" -#SECTION_FIREWALLS="Software: firewalls" -#SECTION_GENERAL="General" -#SECTION_HARDENING="Hardening" -#SECTION_HOME_DIRECTORIES="Home directories" -#SECTION_IMAGE="Image" -#SECTION_INITIALIZING_PROGRAM="Initializing program" -#SECTION_INSECURE_SERVICES="Insecure services" -#SECTION_KERNEL_HARDENING="Kernel Hardening" -#SECTION_KERNEL="Kernel" -#SECTION_LDAP_SERVICES="LDAP Services" -#SECTION_LOGGING_AND_FILES="Logging and files" -SECTION_MALWARE="Kötücül yazılım" -SECTION_MEMORY_AND_PROCESSES="Bellek ve Prosesler" -#SECTION_NAME_SERVICES="Name services" -#SECTION_NETWORKING="Networking" -#SECTION_PERMISSIONS="Permissions" -#SECTION_PORTS_AND_PACKAGES="Ports and packages" -#SECTION_PRINTERS_AND_SPOOLS="Printers and Spools" -#SECTION_PROGRAM_DETAILS="Program Details" -#SECTION_SCHEDULED_TASKS="Scheduled tasks" -#SECTION_SECURITY_FRAMEWORKS="Security frameworks" -#SECTION_SHELLS="Shells" -#SECTION_SNMP_SUPPORT="SNMP Support" -#SECTION_SOFTWARE="Software" -#SECTION_SQUID_SUPPORT="Squid Support" -#SECTION_SSH_SUPPORT="SSH Support" -#SECTION_STORAGE="Storage" -#SECTION_SYSTEM_INTEGRITY="Software: System integrity" -#SECTION_SYSTEM_TOOLING="Software: System tooling" -#SECTION_SYSTEM_TOOLS="System tools" -#SECTION_TIME_AND_SYNCHRONIZATION="Time and Synchronization" -#SECTION_USB_DEVICES="USB Devices" -#SECTION_USERS_GROUPS_AND_AUTHENTICATION="Users, Groups and Authentication" -#SECTION_VIRTUALIZATION="Virtualization" -#SECTION_WEBSERVER="Software: webserver" -#STATUS_ACTIVE="ACTIVE" -#STATUS_CHECK_NEEDED="CHECK NEEDED" -#STATUS_DEBUG="DEBUG" -#STATUS_DEFAULT="DEFAULT" -#STATUS_DIFFERENT="DIFFERENT" -STATUS_DISABLED="ETKİSİZLEŞTİRİLMİŞ" +SECTION_DATA_UPLOAD="Veri yükleme" +SECTION_DATABASES="Veri tabanları" +SECTION_DOWNLOADS="İndirilenler" +SECTION_EMAIL_AND_MESSAGING="Yazılım: e-posta ve mesajlaşma" +SECTION_FILE_INTEGRITY="Yazılım: dosya bütünlüğü" +SECTION_FILE_PERMISSIONS="Dosya izinleri" +SECTION_FILE_SYSTEMS="Dosya sistemleri" +SECTION_FIREWALLS="Yazılım: güvenlik duvarları" +SECTION_GENERAL="Genel" +SECTION_HARDENING="Sıkılaştırma" +SECTION_HOME_DIRECTORIES="Ev dizinleri" +SECTION_IMAGE="Kalıp" +SECTION_INITIALIZING_PROGRAM="Program başlatılıyor" +SECTION_INSECURE_SERVICES="Güvensiz hizmetler" +SECTION_KERNEL="Çekirdek" +SECTION_KERNEL_HARDENING="Çekirdek Sıkılaştırma" +SECTION_LDAP_SERVICES="LDAP Hizmetleri" +SECTION_LOGGING_AND_FILES="Günlük kaydı ve dosyalar" +SECTION_MALWARE="Yazılım: Kötü Amaçlı Yazılım" +SECTION_MEMORY_AND_PROCESSES="Bellek ve Süreçler" +SECTION_NAME_SERVICES="Ad hizmetleri" +SECTION_NETWORKING="Ağ İletişimi" +SECTION_PERMISSIONS="İzinler" +SECTION_PORTS_AND_PACKAGES="Bağlantı noktaları ve paketler" +SECTION_PRINTERS_AND_SPOOLS="Yazıcılar ve Biriktiriciler" +SECTION_PROGRAM_DETAILS="Program Ayrıntıları" +SECTION_SCHEDULED_TASKS="Zamanlanan görevler" +SECTION_SECURITY_FRAMEWORKS="Güvenlik çerçeveleri" +SECTION_SHELLS="Kabuklar" +SECTION_SNMP_SUPPORT="SNMP Desteği" +SECTION_SOFTWARE="Yazılım" +SECTION_SQUID_SUPPORT="Squid Desteği" +SECTION_SSH_SUPPORT="SSH Desteği" +SECTION_STORAGE="Depolama" +SECTION_SYSTEM_INTEGRITY="Yazılım: Sistem bütünlüğü" +SECTION_SYSTEM_TOOLING="Yazılım: Sistem araçları" +SECTION_SYSTEM_TOOLS="Sistem araçları" +SECTION_TIME_AND_SYNCHRONIZATION="Zaman ve Eşzamanlama" +SECTION_USB_DEVICES="USB Aygıtları" +SECTION_USERS_GROUPS_AND_AUTHENTICATION="Kullanıcılar, Gruplar ve Kimlik Doğrulama" +SECTION_VIRTUALIZATION="Sanallaştırma" +SECTION_WEBSERVER="Yazılım: web sunucusu" +STATUS_ACTIVE=" ETKİN" +STATUS_CHECK_NEEDED=" DENETİM GEREKLI" +STATUS_DEBUG="HATA AYIKLAMA" +STATUS_DEFAULT="ÖNTANIMLI" +STATUS_DIFFERENT="FARKLI" +STATUS_DISABLED="DEVRE DIŞI BIRAKILDI" STATUS_DONE="TAMAMLANDI" -STATUS_ENABLED="ETKİNLEŞTİRİLMİŞ" +STATUS_ENABLED="ETKİNLEŞTİRİLDİ" STATUS_ERROR="HATA" -#STATUS_EXPOSED="EXPOSED" -#STATUS_FAILED="FAILED" -#STATUS_FILES_FOUND="FILES FOUND" +STATUS_EXPOSED="AÇIKTA BIRAKILDI" +STATUS_FAILED="BAŞARISIZ" +STATUS_FILES_FOUND="DOSYALAR BULUNDU" STATUS_FOUND="BULUNDU" -#STATUS_HARDENED="HARDENED" -#STATUS_INSTALLED="INSTALLED" -#STATUS_LOCAL_ONLY="LOCAL ONLY" -#STATUS_MEDIUM="MEDIUM" +STATUS_HARDENED="SIKILAŞTIRILDI" +STATUS_INSTALLED="KURULU" +STATUS_LOCAL_ONLY="YALNIZCA YEREL" +STATUS_MEDIUM="ORTA" STATUS_NO="HAYIR" -#STATUS_NON_DEFAULT="NON DEFAULT" +STATUS_NO_UPDATE="GÜNCELLEME YOK" +STATUS_NON_DEFAULT="ÖNTANIMLI OLMAYAN" STATUS_NONE="YOK" -STATUS_NOT_ACTIVE="NOT ACTIVE" -#STATUS_NOT_CONFIGURED="NOT CONFIGURED" -#STATUS_NOT_DISABLED="NOT DISABLED" -#STATUS_NOT_ENABLED="NOT ENABLED" +STATUS_NOT_ACTIVE="ETKİN DEĞİL" +STATUS_NOT_CONFIGURED="YAPILANDIRILMADI" +STATUS_NOT_DISABLED="DEVRE DIŞI BIRAKILMADI" +STATUS_NOT_ENABLED="ETKİNLEŞTİRİLMEDİ" STATUS_NOT_FOUND="BULUNAMADI" STATUS_NOT_RUNNING="ÇALIŞMIYOR" -#STATUS_NO_UPDATE="NO UPDATE" STATUS_OFF="KAPALI" STATUS_OK="TAMAM" STATUS_ON="AÇIK" -#STATUS_PARTIALLY_HARDENED="PARTIALLY HARDENED" -#STATUS_PROTECTED="PROTECTED" +STATUS_PARTIALLY_HARDENED="KISMEN SIKILAŞTIRILDI" +STATUS_PROTECTED="KORUMALI" STATUS_RUNNING="ÇALIŞIYOR" STATUS_SKIPPED="ATLANDI" STATUS_SUGGESTION="ÖNERİ" STATUS_UNKNOWN="BİLİNMİYOR" -#STATUS_UNSAFE="UNSAFE" -#STATUS_UPDATE_AVAILABLE="UPDATE AVAILABLE" +STATUS_UNSAFE="GÜVENLİ DEĞİL" +STATUS_UPDATE_AVAILABLE="GÜNCELLEME VAR" STATUS_WARNING="UYARI" -#STATUS_WEAK="WEAK" +STATUS_WEAK="ZAYIF" STATUS_YES="EVET" -TEXT_UPDATE_AVAILABLE="güncelleme mevcut" -TEXT_YOU_CAN_HELP_LOGFILE="Log dosyanızı göndererek yardımcı olabilirsiniz" +TEXT_UPDATE_AVAILABLE="güncelleme var" +TEXT_YOU_CAN_HELP_LOGFILE="Günlük dosyanızı göndererek yardımcı olabilirsiniz" From aec1f594324d073cd0582c2da5f6ccbb160d1415 Mon Sep 17 00:00:00 2001 From: gonzalo Date: Sat, 4 May 2024 07:52:47 +0200 Subject: [PATCH 103/108] Update binaries Fix a showing error for grep --help on OpenBSD. Discovered by me, fixed by @mboelen --- include/binaries | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/binaries b/include/binaries index b495013c..a2b4895a 100644 --- a/include/binaries +++ b/include/binaries @@ -338,7 +338,7 @@ # If grep is capable of extended regexp, use that instead of egrep to avoid annoying warning if [ "${GREPBINARY:-}" ] ; then - ${GREPBINARY} --help | ${GREPBINARY} -e "extended-regexp" > /dev/null + ${GREPBINARY} --help 2> /dev/null | ${GREPBINARY} -e "extended-regexp" > /dev/null if [ $? -eq 0 ] ; then EGREPBINARY="${GREPBINARY} -E" fi From 740baf29af6d2204c2c9d0fd40c29deb7a9e54f3 Mon Sep 17 00:00:00 2001 From: "Andre @ ARK-ICT" Date: Thu, 9 May 2024 20:45:45 +0200 Subject: [PATCH 104/108] postgresDB fixes for almalinux, rockylinux and freebsd. Tested on almalinux8/9, rockylinux9 and freebsd13 --- include/tests_databases | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/include/tests_databases b/include/tests_databases index 10bbc36a..82e3fa10 100644 --- a/include/tests_databases +++ b/include/tests_databases @@ -186,8 +186,10 @@ # Test : DBS-1826 # Description : Check if PostgreSQL is being used Register --test-no DBS-1826 --weight L --network NO --category security --description "Checking active PostgreSQL processes" + for PROCES in postgres postmaster + do if [ ${SKIPTEST} -eq 0 ]; then - if IsRunning "postgres"; then + if IsRunning "${PROCES}"; then Display --indent 2 --text "- PostgreSQL processes status" --result "${STATUS_FOUND}" --color GREEN LogText "Result: PostgreSQL is active" POSTGRESQL_RUNNING=1 @@ -195,9 +197,10 @@ Report "postgresql_running=${POSTGRESQL_RUNNING}" else if [ ${DEBUG} -eq 1 ]; then Display --indent 2 --text "- PostgreSQL processes status" --result "${STATUS_NOT_FOUND}" --color WHITE --debug; fi - LogText "Result: PostgreSQL process not active" + LogText "Result: PostgreSQL process ${PROCES} not active" fi fi + done # ################################################################################# # @@ -211,14 +214,15 @@ # Arch /var/lib/postgres/data/postgresql.conf # CentOS/Fedora /var/lib/pgsql/data/postgresql.conf # Ubuntu /etc/postgresql/x.y/main/postgresql.conf + # FreeBSD /var/db/postgres/data[0-9][0-9]/postgresql.conf if [ "${POSTGRESQL_RUNNING}" -eq 1 ]; then PREQS_MET="YES"; SKIPREASON=""; else PREQS_MET="NO"; SKIPREASON="PostgreSQL not installed or not running"; fi Register --test-no DBS-1828 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Test PostgreSQL configuration" if [ ${SKIPTEST} -eq 0 ]; then FIND_PATHS=$(${LSBINARY} -d ${ROOTDIR}usr/local/pgsql/data* 2> /dev/null) - FIND_PATHS="${FIND_PATHS} ${ROOTDIR}etc/postgres ${ROOTDIR}etc/postgresql ${ROOTDIR}var/lib/postgres/data ${ROOTDIR}usr/local/pgsql/data" - CONFIG_FILES=$(${FINDBINARY} -L ${FIND_PATHS} -type f -name "*.conf" -print0 2> /dev/null | ${TRBINARY} -cd '[:print:]\0' | ${TRBINARY} -d '\n' | ${TRBINARY} '\0' '\n' | xargs -i sh -c 'test -r "{}" && echo "{}"' | ${SEDBINARY} "s/ /:space:/g") + FIND_PATHS="${FIND_PATHS} ${ROOTDIR}etc/postgres ${ROOTDIR}etc/postgresql ${ROOTDIR}var/lib/postgres/data ${ROOTDIR}usr/local/pgsql/data ${ROOTDIR}var/lib/pgsql/data ${ROOTDIR}var/db/postgres/data[0-9][0-9]" + CONFIG_FILES=$(${FINDBINARY} -L ${FIND_PATHS} -type f -name "*.conf" -print0 2> /dev/null | ${TRBINARY} -cd '[:print:]\0' | ${TRBINARY} -d '\n' | ${TRBINARY} '\0' '\n' | xargs -I'{}' sh -c 'test -r "{}" && echo "{}"' | ${SEDBINARY} "s/ /:space:/g") for CF in ${CONFIG_FILES}; do Report "postgresql_config_file[]=${CF}" LogText "Found configuration file (${CF})" From 353b1e0bbf5987e60ac62e8d01adae844b0f36da Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Fri, 10 May 2024 12:58:41 +0200 Subject: [PATCH 105/108] Update CHANGELOG.md --- CHANGELOG.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f6dfd05b..74ed8b0f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,7 +7,8 @@ - Detection of Open Source Media Center (OSMC) ### Changed -- Correction of software EOL database and inclusion of AIX entries +- Correction of software EOL database and inclusion of AIX entries +- DBS-1826 - PostgreSQL detection improved for AlmaLinux, Rocky Linux, and FreeBSD --------------------------------------------------------------------------------- From 0ff7965a80d0fa300cf518385a90d69655381af5 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Fri, 10 May 2024 14:49:47 +0200 Subject: [PATCH 106/108] Update lynis Update the copyright line (year), it was very outdated --- lynis | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lynis b/lynis index 9ae06b67..ee6cc596 100755 --- a/lynis +++ b/lynis @@ -52,7 +52,7 @@ PROGRAM_SOURCE="https://github.com/CISOfy/lynis" PROGRAM_PACKAGE="https://packages.cisofy.com/" PROGRAM_DOCUMENTATION="https://cisofy.com/docs/" - PROGRAM_COPYRIGHT="2007-2021, ${PROGRAM_AUTHOR} - ${PROGRAM_WEBSITE}" + PROGRAM_COPYRIGHT="2007-2024, ${PROGRAM_AUTHOR} - ${PROGRAM_WEBSITE}" PROGRAM_LICENSE="${PROGRAM_NAME} comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under the terms of the GNU General Public License. See the LICENSE file for details about using this software." From b8064bc5def38b4e098f4f09c94489949a42fab3 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Tue, 14 May 2024 06:50:26 +0000 Subject: [PATCH 107/108] Don't reset status of malware scanner, as there might be two available. Small change to format --- include/tests_malware | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/include/tests_malware b/include/tests_malware index 7d6f7baf..0857ef43 100644 --- a/include/tests_malware +++ b/include/tests_malware @@ -46,18 +46,19 @@ TRENDMICRO_DSA_DAEMON_RUNNING=0 # ################################################################################# -# Test : MALW-3274 -# Description : Check for installed tool (McAfee VirusScan for Command Line) -Register --test-no MALW-3274 --weight L --network NO --category security --description "Check for McAfee VirusScan Command Line" -if [ ${SKIPTEST} -eq 0 ]; then - LogText "Test: checking presence McAfee VirusScan for Command Line" - if [ -x /usr/local/uvscan/uvscan ]; then - Display --indent 2 --text "- ${GEN_CHECKING} McAfee VirusScan for Command Line" --result "${STATUS_FOUND}" --color RED - LogText "Result: Found ${MCAFEECLBINARY}" - MALWARE_SCANNER_INSTALLED=0 - AddHP 0 2 - LogText "Result: McAfee Antivirus for Linux has been deprecated as of 1 Oct 2023 and will not receive updates. Please use another antivirus instead." -fi +# + # Test : MALW-3274 + # Description : Check for installed tool (McAfee VirusScan for Command Line) + Register --test-no MALW-3274 --weight L --network NO --category security --description "Check for McAfee VirusScan Command Line" + if [ ${SKIPTEST} -eq 0 ]; then + LogText "Test: checking presence McAfee VirusScan for Command Line" + if [ -x /usr/local/uvscan/uvscan ]; then + Display --indent 2 --text "- ${GEN_CHECKING} McAfee VirusScan for Command Line (deprecated)" --result "${STATUS_FOUND}" --color RED + LogText "Result: Found ${MCAFEECLBINARY}" + AddHP 0 2 + LogText "Result: McAfee Antivirus for Linux has been deprecated as of 1 Oct 2023 and will not receive updates. Please use another antivirus instead." + fi + fi ################################################################################# # # Test : MALW-3275 From eeec52b1604ef850c7d8b63dab0a72bb197a3000 Mon Sep 17 00:00:00 2001 From: Michael Boelen Date: Tue, 14 May 2024 11:40:50 +0200 Subject: [PATCH 108/108] Update tests_mac_frameworks Changed check from is executable to is not empty --- include/tests_mac_frameworks | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/tests_mac_frameworks b/include/tests_mac_frameworks index ca454529..207a98f5 100644 --- a/include/tests_mac_frameworks +++ b/include/tests_mac_frameworks @@ -158,7 +158,7 @@ Display --indent 6 --text "- Checking current mode and config file" --result "${STATUS_WARNING}" --color RED fi Display --indent 8 --text "Current SELinux mode: ${FIND}" - if [ -x "$SEMANAGEBINARY" ]; then + if [ -n "${SEMANAGEBINARY}" ]; then PERMISSIVE=$(${SEMANAGEBINARY} permissive --list --noheading | ${TRBINARY} '\n' ' ') NPERMISSIVE=$(${SEMANAGEBINARY} permissive --list --noheading | ${WCBINARY} -l) Display --indent 8 --text "Found ${NPERMISSIVE} permissive SELinux object types"