prehistoric-systems/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2026-03-11 08:55:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge a99d86031f into 52ed89ce35

Browse source
This commit is contained in:
pyllyukko 2026-02-09 02:59:01 -08:00 committed by GitHub
commit 5da9a3a740
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 41 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

41
include/tests_crypto
View file

@ -137,6 +137,47 @@
fi
fi
#
#################################################################################
#
# Test : CRYP-7903
# Description : Check for extraneous CA certificates
if [ "${LINUX_VERSION}" = "Debian" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no CRYP-7903 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check for extraneous CA certificates"
if [ ${SKIPTEST} -eq 0 ]; then
FOUNDPROBLEM=0
# CERTSDIR and LOCALCERTSDIR from update-ca-certificates
for DIR in /usr/share/ca-certificates /usr/local/share/ca-certificates; do
if [ -d "${DIR}" ]; then
FileIsReadable "${DIR}"
if [ ${CANREAD} -eq 0 ]; then
LogText "Result: can not read directory ${DIR} (no permission)"
continue
fi
FILES=$(${FINDBINARY} ${DIR} -type f 2> /dev/null | ${GREPBINARY} -E ".cer$|.crt$|.der$|.pem$|^cert" | ${SORTBINARY} | ${SEDBINARY} 's/ /__space__/g')
for FILE in ${FILES}; do
FILE="$(echo "${FILE}" | ${SEDBINARY} 's/__space__/ /g')"
FileIsReadable "${FILE}"
if [ ${CANREAD} -eq 0 ]; then
LogText "Result: can not read file ${FILE} (no permission)"
continue
fi
if ! FileInstalledByPackage "${FILE}"
then
LogText "Result: certificate ${FILE} not provided by any package"
FOUNDPROBLEM=1
fi
done
fi
done
if [ ${FOUNDPROBLEM} -eq 0 ]; then
Display --indent 2 --text "- Checking for extraneous CA certificates" --result "${STATUS_NONE}" --color GREEN
else
Display --indent 2 --text "- Checking for extraneous CA certificates" --result "${STATUS_FOUND}" --color YELLOW
ReportSuggestion "${TEST_NO}" "Check your CA certificates that are not provided by any package and verify that they are legit"
fi
fi
#
#################################################################################
#