diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 00000000..d630ab92
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,7 @@
+# See: https://editorconfig.org/
+
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f6dfd05b..f53f6618 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,11 +3,42 @@
## Lynis 3.1.2 (not released yet)
### Added
+- Detection of ALT Linux
- Detection of Athena OS
+- Detection of Container-Optimized OS from Google
+- Detection of Koozali SME Server
+- Detection of Nobara Linux
- Detection of Open Source Media Center (OSMC)
+- Detection of PostmarketOS
+- CRYP-7932 - macOS FileVault encryption test
+- FILE-6398 - Check if JBD (Journal Block Device) driver is loaded
+- FINT-4344 - Wazuh system running state
+- PKGS-7305 - Query macOS Apps in /Applications and CoreServices
+- File added: .editorconfig, which is used by editors to standardize formatting
### Changed
-- Correction of software EOL database and inclusion of AIX entries
+- Correction of software EOL database and inclusion of AIX entries
+- Support sysctl value perf_event_paranoid -> 2|3
+- Update of Turkish translation
+- Grammar and spell improvements
+- Improved package detection on Alpine Linux
+- Slackware support to check installed packges (functionPackageIsInstalled())
+- Added words prosecute/report to LEGAL_BANNER_STRINGS
+- Busybox support: Replace newer tr command syntax with older ascii specific operations
+- Added Wazuh as a malware scanner/antivirus and rootkit detection tool
+- AUTH-9262 - Corrected message with advised PAM libary (libpam-passwdqc)
+- CONT-8104 - Checking for errors, not only warning in docker info output
+- DBS-1826 - PostgreSQL detection improved for AlmaLinux, Rocky Linux, and FreeBSD
+- FILE-6344 - Test kernel version (major/minor)
+- KRNL-5622 - Use systemctl get-default instead of following link
+- LOGG-2144 - Check for wazuh-agent presence on Linux systems
+- MACF-6234 - Test if semanage binary is available
+- MALW-3200 - ESET Endpoint Antivirus added
+- MALW-3280 - McAfee Antivirus for Linux deprecated
+- MALW-3291 - Check if Microsoft Defender Antivirus is installe
+- NETW-3200 - Added regex to allow both /bin/true as /bin/false
+- PKGS-7303 - Added version numbers to brew packages
+- PKGS-7370 - Cron job check for debsums improved
---------------------------------------------------------------------------------
diff --git a/db/languages/az b/db/languages/az
index 24a0ca70..d5fce57b 100644
--- a/db/languages/az
+++ b/db/languages/az
@@ -106,3 +106,4 @@ STATUS_WARNING="Xəbərdarlıq"
STATUS_YES="Bəli"
TEXT_UPDATE_AVAILABLE="yeniləmə mövcud"
TEXT_YOU_CAN_HELP_LOGFILE="qeydləri gönderib kömek eyleyin"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/cn b/db/languages/cn
index 11826db3..2ca49dde 100644
--- a/db/languages/cn
+++ b/db/languages/cn
@@ -107,3 +107,4 @@ STATUS_WARNING="警告"
STATUS_YES="是"
TEXT_UPDATE_AVAILABLE="有可以更新的版本"
TEXT_YOU_CAN_HELP_LOGFILE="你可以通过记录日志来帮忙"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/da b/db/languages/da
index 1bd77089..b5c86332 100644
--- a/db/languages/da
+++ b/db/languages/da
@@ -106,3 +106,4 @@ STATUS_WEAK="SVAG"
STATUS_YES="JA"
TEXT_UPDATE_AVAILABLE="opdatering tilgængelig"
TEXT_YOU_CAN_HELP_LOGFILE="Du kan hjælpe ved at bidrage med din logfil"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/de b/db/languages/de
index 942693a3..7932153a 100644
--- a/db/languages/de
+++ b/db/languages/de
@@ -106,3 +106,4 @@ STATUS_WEAK="SCHWACH"
STATUS_YES="JA"
TEXT_UPDATE_AVAILABLE="Aktualisierung verfügbar"
TEXT_YOU_CAN_HELP_LOGFILE="Sie können durch Übermittlung Ihrer Logdatei helfen"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/en b/db/languages/en
index 52ace1f7..689cc57e 100644
--- a/db/languages/en
+++ b/db/languages/en
@@ -63,6 +63,7 @@ SECTION_USB_DEVICES="USB Devices"
SECTION_USERS_GROUPS_AND_AUTHENTICATION="Users, Groups and Authentication"
SECTION_VIRTUALIZATION="Virtualization"
SECTION_WEBSERVER="Software: webserver"
+SECTION_KERBEROS="Kerberos"
STATUS_ACTIVE="ACTIVE"
STATUS_CHECK_NEEDED="CHECK NEEDED"
STATUS_DEBUG="DEBUG"
diff --git a/db/languages/es b/db/languages/es
index 1ad53db5..cbaf7a4e 100644
--- a/db/languages/es
+++ b/db/languages/es
@@ -107,3 +107,4 @@ STATUS_WEAK="DÉBIL"
STATUS_YES="SÍ"
TEXT_UPDATE_AVAILABLE="Actualización disponible"
TEXT_YOU_CAN_HELP_LOGFILE="Puedes ayudar compartiendo tu archivo de registro"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/fi b/db/languages/fi
index e8dc3564..4b4e73c9 100644
--- a/db/languages/fi
+++ b/db/languages/fi
@@ -106,3 +106,4 @@ STATUS_WARNING="VAROITUS"
STATUS_YES="KYLLÄ"
TEXT_UPDATE_AVAILABLE="päivitys saatavilla"
TEXT_YOU_CAN_HELP_LOGFILE="Voit auttaa toimittamalla lokitiedoston"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/fr b/db/languages/fr
index d0be5c99..353b55e7 100644
--- a/db/languages/fr
+++ b/db/languages/fr
@@ -106,3 +106,4 @@ STATUS_WEAK="FAIBLE"
STATUS_YES="OUI"
TEXT_UPDATE_AVAILABLE="Mise à jour disponible"
TEXT_YOU_CAN_HELP_LOGFILE="Vous pouvez aider en envoyant votre fichier journal"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/gr b/db/languages/gr
index 15c3e509..2a45d7be 100644
--- a/db/languages/gr
+++ b/db/languages/gr
@@ -106,3 +106,4 @@ STATUS_WARNING="ΠΡΟΣΟΧΗ"
STATUS_YES="ΝΑΙ"
TEXT_UPDATE_AVAILABLE="διαθέσιμη ενημέρωση"
TEXT_YOU_CAN_HELP_LOGFILE="Μπορείτε να βοηθήσετε παρέχοντας το αρχείο καταγραφής"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/he b/db/languages/he
index 9755bcf7..ceeb17d8 100644
--- a/db/languages/he
+++ b/db/languages/he
@@ -106,3 +106,4 @@ STATUS_WARNING="אזהרה"
STATUS_YES="כן"
TEXT_UPDATE_AVAILABLE="עדכון זמין"
TEXT_YOU_CAN_HELP_LOGFILE="ניתן לעזור על ידי שליחת קובץ הלוג"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/hu b/db/languages/hu
index 90ae29e1..402b5272 100644
--- a/db/languages/hu
+++ b/db/languages/hu
@@ -106,3 +106,4 @@ STATUS_WARNING="FIGYELMEZTETÉS"
STATUS_YES="IGEN"
TEXT_UPDATE_AVAILABLE="frissítés elérhető"
TEXT_YOU_CAN_HELP_LOGFILE="You can help by providing your log file"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/id b/db/languages/id
index 4a7b26f4..b9b7b42c 100644
--- a/db/languages/id
+++ b/db/languages/id
@@ -105,3 +105,5 @@ STATUS_WEAK="WEAK"
STATUS_YES="YES"
TEXT_UPDATE_AVAILABLE="update tersedia"
TEXT_YOU_CAN_HELP_LOGFILE="Anda dapat membantu dengan memberikan file log Anda"
+#SECTION_KERBEROS="Kerberos"
+#STATUS_NOT_ACTIVE="NOT ACTIVE"
diff --git a/db/languages/it b/db/languages/it
index 26ff3076..0e4c0f19 100644
--- a/db/languages/it
+++ b/db/languages/it
@@ -106,3 +106,4 @@ STATUS_WEAK="DEBOLE"
STATUS_YES="SI"
TEXT_UPDATE_AVAILABLE="aggiornamento disponibile"
TEXT_YOU_CAN_HELP_LOGFILE="Puoi aiutare fornendoci il tuo file di log"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/ja b/db/languages/ja
index 846b1eb1..4bdcf67d 100644
--- a/db/languages/ja
+++ b/db/languages/ja
@@ -106,3 +106,4 @@ STATUS_WARNING="警告"
STATUS_YES="はい"
TEXT_UPDATE_AVAILABLE="アップデートが利用可能"
TEXT_YOU_CAN_HELP_LOGFILE="You can help by providing your log file"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/ko b/db/languages/ko
index 72d31d79..1c7cbca4 100644
--- a/db/languages/ko
+++ b/db/languages/ko
@@ -106,3 +106,4 @@ STATUS_WEAK="취약"
STATUS_YES="예"
TEXT_UPDATE_AVAILABLE="업데이트 가능"
TEXT_YOU_CAN_HELP_LOGFILE="로그 파일을 제공하면 도움을 받을 수 있습니다"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/nb-NO b/db/languages/nb-NO
index ea3e8832..4bba067b 100644
--- a/db/languages/nb-NO
+++ b/db/languages/nb-NO
@@ -106,3 +106,4 @@ STATUS_WARNING="ADVARSEL"
STATUS_YES="JA"
TEXT_UPDATE_AVAILABLE="oppdatering tilgjengelig"
TEXT_YOU_CAN_HELP_LOGFILE="Du kan bidra ved å laste opp din loggfil"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/nl b/db/languages/nl
index cdb92423..9600ba89 100644
--- a/db/languages/nl
+++ b/db/languages/nl
@@ -106,3 +106,4 @@ STATUS_WEAK="ZWAK"
STATUS_YES="JA"
TEXT_UPDATE_AVAILABLE="update beschikbaar"
TEXT_YOU_CAN_HELP_LOGFILE="Help mee door je logbestand te delen"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/pl b/db/languages/pl
index 887d0a7d..ad7d45f4 100644
--- a/db/languages/pl
+++ b/db/languages/pl
@@ -106,3 +106,4 @@ STATUS_NOT_ACTIVE="NOT ACTIVE"
#STATUS_YES="YES"
#TEXT_UPDATE_AVAILABLE="update available"
#TEXT_YOU_CAN_HELP_LOGFILE="You can help by providing your log file"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/pt b/db/languages/pt
index 483fabd6..8592e700 100644
--- a/db/languages/pt
+++ b/db/languages/pt
@@ -106,3 +106,4 @@ STATUS_WARNING="ATENÇÃO"
STATUS_YES="SIM"
TEXT_UPDATE_AVAILABLE="Atualização disponível"
TEXT_YOU_CAN_HELP_LOGFILE="Você pode ajudar fornecendo seu arquivo de log"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/ru b/db/languages/ru
index 55a4717b..92402178 100644
--- a/db/languages/ru
+++ b/db/languages/ru
@@ -106,3 +106,4 @@ STATUS_WEAK="СЛАБЫЙ"
STATUS_YES="ДА"
TEXT_UPDATE_AVAILABLE="доступно обновление"
TEXT_YOU_CAN_HELP_LOGFILE="Вы можете помочь, предоставив ваш лог-файл"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/se b/db/languages/se
index e5a90859..73418df1 100644
--- a/db/languages/se
+++ b/db/languages/se
@@ -106,3 +106,4 @@ STATUS_WARNING="VARNING"
STATUS_YES="JA"
TEXT_UPDATE_AVAILABLE="uppdatering tillgänglig"
TEXT_YOU_CAN_HELP_LOGFILE="Du kan hjälpa till genom att bidra med din loggfil"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/sk b/db/languages/sk
index 45a18943..be3d28bf 100644
--- a/db/languages/sk
+++ b/db/languages/sk
@@ -106,3 +106,4 @@ STATUS_WARNING="VAROVANIE"
STATUS_YES="ÁNO"
TEXT_UPDATE_AVAILABLE="aktualizácia k dispozícii"
TEXT_YOU_CAN_HELP_LOGFILE="Môžete pomôcť poskytnutím log súboru"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/languages/tr b/db/languages/tr
index 585cfed5..707b6bc3 100644
--- a/db/languages/tr
+++ b/db/languages/tr
@@ -1,108 +1,109 @@
-ERROR_NO_LICENSE="Lisans anahtarı yapılandırılmamış"
-ERROR_NO_UPLOAD_SERVER="Yükleme sunucusu yapılandırılmamış"
-GEN_CHECKING="Kontrol ediyor"
-GEN_CURRENT_VERSION="Mevcut Sürüm"
+ERROR_NO_LICENSE="Lisans anahtarı yapılandırılmadı"
+ERROR_NO_UPLOAD_SERVER="Yükleme sunucusu yapılandırılmadı"
+GEN_CHECKING=" Denetleniyor"
+GEN_CURRENT_VERSION="Geçerli sürüm"
GEN_DEBUG_MODE="Hata ayıklama modu"
GEN_INITIALIZE_PROGRAM="Program başlatılıyor"
-GEN_LATEST_VERSION="Son sürüm"
-GEN_PHASE="faz"
-GEN_PLUGINS_ENABLED="Yapılandırılmış eklentiler"
-GEN_UPDATE_AVAILABLE="güncelleme mevcut"
-GEN_VERBOSE_MODE="Detay modu"
+GEN_LATEST_VERSION="En son sürüm"
+GEN_PHASE="evre"
+GEN_PLUGINS_ENABLED="Etkinleştirilen eklentiler"
+GEN_UPDATE_AVAILABLE="güncelleme var"
+GEN_VERBOSE_MODE="Ayrıntılı mod"
GEN_WHAT_TO_DO="Yapılması gerekenler"
-NOTE_EXCEPTIONS_FOUND_DETAILED="Bazı istisnai durumlar ve bilgiler bulundu"
NOTE_EXCEPTIONS_FOUND="İstisnalar bulundu"
-NOTE_PLUGINS_TAKE_TIME="Not: eklentiler daha detaylı testler içermektedir ve tamamlanmaları uzun sürebilir"
+NOTE_EXCEPTIONS_FOUND_DETAILED="Bazı istisnai olaylar veya bilgiler bulundu"
+NOTE_PLUGINS_TAKE_TIME="Not: eklentiler daha kapsamlı testlere sahiptir ve tamamlanması birkaç dakika sürebilir"
NOTE_SKIPPED_TESTS_NON_PRIVILEGED="Yetkisiz çalışma nedeniyle atlanan testler"
-#SECTION_ACCOUNTING="Accounting"
-#SECTION_BANNERS_AND_IDENTIFICATION="Banners and identification"
-#SECTION_BASICS="Basics"
-#SECTION_BOOT_AND_SERVICES="Boot and services"
-#SECTION_CONTAINERS="Containers"
-#SECTION_CRYPTOGRAPHY="Cryptography"
+SECTION_ACCOUNTING="Hesaplama"
+SECTION_BANNERS_AND_IDENTIFICATION="Afişler ve tanımlama"
+SECTION_BASICS="Temel Bilgiler"
+SECTION_BOOT_AND_SERVICES="Önyükleme ve hizmetler"
+SECTION_CONTAINERS="Konteynerler"
+SECTION_CRYPTOGRAPHY="Kriptografi"
SECTION_CUSTOM_TESTS="Özel testler"
-#SECTION_DATABASES="Databases"
-#SECTION_DATA_UPLOAD="Data upload"
-#SECTION_DOWNLOADS="Downloads"
-#SECTION_EMAIL_AND_MESSAGING="Software: e-mail and messaging"
-#SECTION_FILE_INTEGRITY="Software: file integrity"
-#SECTION_FILE_PERMISSIONS="File Permissions"
-#SECTION_FILE_SYSTEMS="File systems"
-#SECTION_FIREWALLS="Software: firewalls"
-#SECTION_GENERAL="General"
-#SECTION_HARDENING="Hardening"
-#SECTION_HOME_DIRECTORIES="Home directories"
-#SECTION_IMAGE="Image"
-#SECTION_INITIALIZING_PROGRAM="Initializing program"
-#SECTION_INSECURE_SERVICES="Insecure services"
-#SECTION_KERNEL_HARDENING="Kernel Hardening"
-#SECTION_KERNEL="Kernel"
-#SECTION_LDAP_SERVICES="LDAP Services"
-#SECTION_LOGGING_AND_FILES="Logging and files"
-SECTION_MALWARE="Kötücül yazılım"
-SECTION_MEMORY_AND_PROCESSES="Bellek ve Prosesler"
-#SECTION_NAME_SERVICES="Name services"
-#SECTION_NETWORKING="Networking"
-#SECTION_PERMISSIONS="Permissions"
-#SECTION_PORTS_AND_PACKAGES="Ports and packages"
-#SECTION_PRINTERS_AND_SPOOLS="Printers and Spools"
-#SECTION_PROGRAM_DETAILS="Program Details"
-#SECTION_SCHEDULED_TASKS="Scheduled tasks"
-#SECTION_SECURITY_FRAMEWORKS="Security frameworks"
-#SECTION_SHELLS="Shells"
-#SECTION_SNMP_SUPPORT="SNMP Support"
-#SECTION_SOFTWARE="Software"
-#SECTION_SQUID_SUPPORT="Squid Support"
-#SECTION_SSH_SUPPORT="SSH Support"
-#SECTION_STORAGE="Storage"
-#SECTION_SYSTEM_INTEGRITY="Software: System integrity"
-#SECTION_SYSTEM_TOOLING="Software: System tooling"
-#SECTION_SYSTEM_TOOLS="System tools"
-#SECTION_TIME_AND_SYNCHRONIZATION="Time and Synchronization"
-#SECTION_USB_DEVICES="USB Devices"
-#SECTION_USERS_GROUPS_AND_AUTHENTICATION="Users, Groups and Authentication"
-#SECTION_VIRTUALIZATION="Virtualization"
-#SECTION_WEBSERVER="Software: webserver"
-#STATUS_ACTIVE="ACTIVE"
-#STATUS_CHECK_NEEDED="CHECK NEEDED"
-#STATUS_DEBUG="DEBUG"
-#STATUS_DEFAULT="DEFAULT"
-#STATUS_DIFFERENT="DIFFERENT"
-STATUS_DISABLED="ETKİSİZLEŞTİRİLMİŞ"
+SECTION_DATA_UPLOAD="Veri yükleme"
+SECTION_DATABASES="Veri tabanları"
+SECTION_DOWNLOADS="İndirilenler"
+SECTION_EMAIL_AND_MESSAGING="Yazılım: e-posta ve mesajlaşma"
+SECTION_FILE_INTEGRITY="Yazılım: dosya bütünlüğü"
+SECTION_FILE_PERMISSIONS="Dosya izinleri"
+SECTION_FILE_SYSTEMS="Dosya sistemleri"
+SECTION_FIREWALLS="Yazılım: güvenlik duvarları"
+SECTION_GENERAL="Genel"
+SECTION_HARDENING="Sıkılaştırma"
+SECTION_HOME_DIRECTORIES="Ev dizinleri"
+SECTION_IMAGE="Kalıp"
+SECTION_INITIALIZING_PROGRAM="Program başlatılıyor"
+SECTION_INSECURE_SERVICES="Güvensiz hizmetler"
+SECTION_KERNEL="Çekirdek"
+SECTION_KERNEL_HARDENING="Çekirdek Sıkılaştırma"
+SECTION_LDAP_SERVICES="LDAP Hizmetleri"
+SECTION_LOGGING_AND_FILES="Günlük kaydı ve dosyalar"
+SECTION_MALWARE="Yazılım: Kötü Amaçlı Yazılım"
+SECTION_MEMORY_AND_PROCESSES="Bellek ve Süreçler"
+SECTION_NAME_SERVICES="Ad hizmetleri"
+SECTION_NETWORKING="Ağ İletişimi"
+SECTION_PERMISSIONS="İzinler"
+SECTION_PORTS_AND_PACKAGES="Bağlantı noktaları ve paketler"
+SECTION_PRINTERS_AND_SPOOLS="Yazıcılar ve Biriktiriciler"
+SECTION_PROGRAM_DETAILS="Program Ayrıntıları"
+SECTION_SCHEDULED_TASKS="Zamanlanan görevler"
+SECTION_SECURITY_FRAMEWORKS="Güvenlik çerçeveleri"
+SECTION_SHELLS="Kabuklar"
+SECTION_SNMP_SUPPORT="SNMP Desteği"
+SECTION_SOFTWARE="Yazılım"
+SECTION_SQUID_SUPPORT="Squid Desteği"
+SECTION_SSH_SUPPORT="SSH Desteği"
+SECTION_STORAGE="Depolama"
+SECTION_SYSTEM_INTEGRITY="Yazılım: Sistem bütünlüğü"
+SECTION_SYSTEM_TOOLING="Yazılım: Sistem araçları"
+SECTION_SYSTEM_TOOLS="Sistem araçları"
+SECTION_TIME_AND_SYNCHRONIZATION="Zaman ve Eşzamanlama"
+SECTION_USB_DEVICES="USB Aygıtları"
+SECTION_USERS_GROUPS_AND_AUTHENTICATION="Kullanıcılar, Gruplar ve Kimlik Doğrulama"
+SECTION_VIRTUALIZATION="Sanallaştırma"
+SECTION_WEBSERVER="Yazılım: web sunucusu"
+STATUS_ACTIVE=" ETKİN"
+STATUS_CHECK_NEEDED=" DENETİM GEREKLI"
+STATUS_DEBUG="HATA AYIKLAMA"
+STATUS_DEFAULT="ÖNTANIMLI"
+STATUS_DIFFERENT="FARKLI"
+STATUS_DISABLED="DEVRE DIŞI BIRAKILDI"
STATUS_DONE="TAMAMLANDI"
-STATUS_ENABLED="ETKİNLEŞTİRİLMİŞ"
+STATUS_ENABLED="ETKİNLEŞTİRİLDİ"
STATUS_ERROR="HATA"
-#STATUS_EXPOSED="EXPOSED"
-#STATUS_FAILED="FAILED"
-#STATUS_FILES_FOUND="FILES FOUND"
+STATUS_EXPOSED="AÇIKTA BIRAKILDI"
+STATUS_FAILED="BAŞARISIZ"
+STATUS_FILES_FOUND="DOSYALAR BULUNDU"
STATUS_FOUND="BULUNDU"
-#STATUS_HARDENED="HARDENED"
-#STATUS_INSTALLED="INSTALLED"
-#STATUS_LOCAL_ONLY="LOCAL ONLY"
-#STATUS_MEDIUM="MEDIUM"
+STATUS_HARDENED="SIKILAŞTIRILDI"
+STATUS_INSTALLED="KURULU"
+STATUS_LOCAL_ONLY="YALNIZCA YEREL"
+STATUS_MEDIUM="ORTA"
STATUS_NO="HAYIR"
-#STATUS_NON_DEFAULT="NON DEFAULT"
+STATUS_NO_UPDATE="GÜNCELLEME YOK"
+STATUS_NON_DEFAULT="ÖNTANIMLI OLMAYAN"
STATUS_NONE="YOK"
-STATUS_NOT_ACTIVE="NOT ACTIVE"
-#STATUS_NOT_CONFIGURED="NOT CONFIGURED"
-#STATUS_NOT_DISABLED="NOT DISABLED"
-#STATUS_NOT_ENABLED="NOT ENABLED"
+STATUS_NOT_ACTIVE="ETKİN DEĞİL"
+STATUS_NOT_CONFIGURED="YAPILANDIRILMADI"
+STATUS_NOT_DISABLED="DEVRE DIŞI BIRAKILMADI"
+STATUS_NOT_ENABLED="ETKİNLEŞTİRİLMEDİ"
STATUS_NOT_FOUND="BULUNAMADI"
STATUS_NOT_RUNNING="ÇALIŞMIYOR"
-#STATUS_NO_UPDATE="NO UPDATE"
STATUS_OFF="KAPALI"
STATUS_OK="TAMAM"
STATUS_ON="AÇIK"
-#STATUS_PARTIALLY_HARDENED="PARTIALLY HARDENED"
-#STATUS_PROTECTED="PROTECTED"
+STATUS_PARTIALLY_HARDENED="KISMEN SIKILAŞTIRILDI"
+STATUS_PROTECTED="KORUMALI"
STATUS_RUNNING="ÇALIŞIYOR"
STATUS_SKIPPED="ATLANDI"
STATUS_SUGGESTION="ÖNERİ"
STATUS_UNKNOWN="BİLİNMİYOR"
-#STATUS_UNSAFE="UNSAFE"
-#STATUS_UPDATE_AVAILABLE="UPDATE AVAILABLE"
+STATUS_UNSAFE="GÜVENLİ DEĞİL"
+STATUS_UPDATE_AVAILABLE="GÜNCELLEME VAR"
STATUS_WARNING="UYARI"
-#STATUS_WEAK="WEAK"
+STATUS_WEAK="ZAYIF"
STATUS_YES="EVET"
-TEXT_UPDATE_AVAILABLE="güncelleme mevcut"
-TEXT_YOU_CAN_HELP_LOGFILE="Log dosyanızı göndererek yardımcı olabilirsiniz"
+TEXT_UPDATE_AVAILABLE="güncelleme var"
+TEXT_YOU_CAN_HELP_LOGFILE="Günlük dosyanızı göndererek yardımcı olabilirsiniz"
+#SECTION_KERBEROS="Kerberos"
diff --git a/db/tests.db b/db/tests.db
index 5b005e1b..f62e9a19 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -276,6 +276,7 @@ MALW-3284:test:security:malware::Check for clamd:
MALW-3286:test:security:malware::Check for freshclam:
MALW-3288:test:security:malware::Check for ClamXav:
MALW-3290:test:security:malware::Presence of malware scanner:
+MALW-3291:test:security:malware::Check for Microsoft Defender Antivirus:
NAME-4016:test:security:nameservices::Check /etc/resolv.conf default domain:
NAME-4018:test:security:nameservices::Check /etc/resolv.conf search domains:
NAME-4020:test:security:nameservices::Check non default options:
diff --git a/default.prf b/default.prf
index aadc4495..0e90fa04 100644
--- a/default.prf
+++ b/default.prf
@@ -144,6 +144,7 @@ plugin=software
plugin=system-integrity
plugin=systemd
plugin=users
+plugin=krb5
# Disable a particular plugin (will overrule an enabled plugin)
#disable-plugin=authentication
@@ -197,7 +198,7 @@ config-data=sysctl;kernel.exec-shield;1;1;No description;sysctl -a;url:https;//k
config-data=sysctl;kernel.kptr_restrict;2;1;Restrict access to kernel symbols;sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security;
config-data=sysctl;kernel.maps_protect;1;1;Restrict access to /proc/[pid]/maps;sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security;
config-data=sysctl;kernel.modules_disabled;1;1;Restrict module loading once this sysctl value is loaded;sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security;
-config-data=sysctl;kernel.perf_event_paranoid;3;1;Restrict unprivileged access to the perf_event_open() system call.;sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security;
+config-data=sysctl;kernel.perf_event_paranoid;2|3|4;1;Restrict unprivileged access to the perf_event_open() system call.;sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security;
config-data=sysctl;kernel.randomize_va_space;2;1;Randomize of memory address locations (ASLR);sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security;
config-data=sysctl;kernel.suid_dumpable;0;1;Restrict core dumps;sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security;
config-data=sysctl;kernel.sysrq;0;1;Disable magic SysRQ;sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security;
diff --git a/include/binaries b/include/binaries
index b495013c..46359b3c 100644
--- a/include/binaries
+++ b/include/binaries
@@ -196,6 +196,8 @@
iptables-save) IPTABLESSAVEBINARY="${BINARY}"; LogText " Found known binary: iptables-save (firewall) - ${BINARY}" ;;
istat) ISTATBINARY="${BINARY}"; LogText " Found known binary: istat (file information) - ${BINARY}" ;;
journalctl) JOURNALCTLBINARY="${BINARY}"; LogText " Found known binary: journalctl (systemd journal) - ${BINARY}" ;;
+ kadmin.local) KADMINLOCALBINARY="${BINARY}"; LogText " Found known binary: kadmin.local (krb5) - ${BINARY}" ;;
+ kdb5_util) KDB5UTILBINARY="${BINARY}"; LogText " Found known binary: kdb5_util (krb5) - ${BINARY}" ;;
kldstat) KLDSTATBINARY="${BINARY}"; LogText " Found known binary: kldstat (kernel modules) - ${BINARY}" ;;
kstat) KSTATBINARY="${BINARY}"; LogText " Found known binary: kstat (kernel statistics) - ${BINARY}" ;;
launchctl) LAUNCHCTL_BINARY="${BINARY}"; SERVICE_MANAGER="launchd"; LogText " Found known binary: launchctl (launchd client) - ${BINARY}" ;;
@@ -338,7 +340,7 @@
# If grep is capable of extended regexp, use that instead of egrep to avoid annoying warning
if [ "${GREPBINARY:-}" ] ; then
- ${GREPBINARY} --help | ${GREPBINARY} -e "extended-regexp" > /dev/null
+ ${GREPBINARY} --help 2> /dev/null | ${GREPBINARY} -e "extended-regexp" > /dev/null
if [ $? -eq 0 ] ; then
EGREPBINARY="${GREPBINARY} -E"
fi
diff --git a/include/consts b/include/consts
index 5d618429..faf41987 100644
--- a/include/consts
+++ b/include/consts
@@ -169,6 +169,7 @@ ETC_PATHS="/etc /usr/local/etc"
MACHINEID=""
MACHINE_ROLE=""
MALWARE_SCANNER_INSTALLED=0
+ MDATPBINARY=""
MIN_PASSWORD_LENGTH=-1
MONGODB_RUNNING=0
MOUNTBINARY=""
@@ -298,7 +299,9 @@ ETC_PATHS="/etc /usr/local/etc"
SSL_CERTIFICATE_INCLUDE_PACKAGES=0
SSL_CERTIFICATE_PATHS=""
SSL_CERTIFICATE_PATHS_TO_IGNORE=""
+ STATUS_NOT_ACTIVE=""
STUNNELBINARY=""
+ SURICATABINARY=""
SWUPDBINARY=""
SYSLOGNGBINARY=""
SYSTEMCTLBINARY=""
diff --git a/include/functions b/include/functions
index 9c52044b..df27db8b 100644
--- a/include/functions
+++ b/include/functions
@@ -2086,6 +2086,10 @@
elif [ -n "${PKGINFOBINARY}" ]; then
output=$(${PKGINFOBINARY} -q -e ${package} >/dev/null 2>&1)
exit_code=$? # 0=package installed, 1=package not installed
+ # Slackware also has RPM for some reason and that's why this test precedes the RPMBINARY test
+ elif [ "${OS_NAME}" = "Slackware Linux" -a -d "${ROOTDIR}/var/lib/pkgtools/packages" ]; then
+ output=$( ls ${ROOTDIR}/var/lib/pkgtools/packages/ 2> /dev/null | ${GREPBINARY} "^${package}-[^-]\+-[^-]\+-[^-]\+$" )
+ exit_code=$?
elif [ -n "${RPMBINARY}" ]; then
output=$(${RPMBINARY} --quiet -q ${package} > /dev/null 2>&1)
exit_code=$?
@@ -2099,7 +2103,7 @@
output=$(${XBPSBINARY} ${package} 2> /dev/null | ${GREPBINARY} "^ii")
exit_code=$?
elif [ -n "${APKBINARY}" ]; then
- output=$(${APKBINARY} search ${package} 2> /dev/null | ${GREPBINARY} ${package})
+ output=$(${APKBINARY} list --installed ${package} 2> /dev/null | ${GREPBINARY} ${package})
exit_code=$?
else
if [ "${package}" != "__dummy__" ]; then
@@ -2758,7 +2762,6 @@
if [ ${SKIPLOGTEST} -eq 0 ]; then LogText "Reason to skip: ${SKIPREASON}"; fi
TESTS_SKIPPED="${TEST_NO}|${TESTS_SKIPPED}"
fi
- unset SKIPREASON
# Save timestamp for next time the Register function is called
PREVIOUS_TEST="${TEST_NO}"
@@ -3171,7 +3174,7 @@
if [ ${PENTESTINGMODE} -eq 0 -a ${IS_PARAMETERS} -eq 0 ]; then
if [ ! "${GROUP}" = "root" -a ! "${GROUP}" = "wheel" -a ! "${GROUPID}" = "0" ]; then
- echo "Fatal error: group owner of directory $1 should be owned by root user, wheel or similar (found: ${GROUP})."
+ echo "Fatal error: group owner of directory $1 should be owned by root group, wheel or similar (found: ${GROUP})."
ExitFatal
fi
fi
diff --git a/include/osdetection b/include/osdetection
index ef4bd587..064da9b3 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -160,6 +160,11 @@
OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
;;
+ "altlinux")
+ LINUX_VERSION="ALT Linux"
+ OS_NAME="altlinux"
+ OS_VERSION=$(grep "^ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+ ;;
"amzn")
LINUX_VERSION="Amazon Linux"
OS_NAME="Amazon Linux"
@@ -221,6 +226,11 @@
OS_NAME="CoreOS Linux"
OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
;;
+ "cos")
+ LINUX_VERSION="Container-Optimized OS"
+ OS_NAME="Container-Optimized OS from Google"
+ OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+ ;;
"debian")
LINUX_VERSION="Debian"
OS_NAME="Debian"
@@ -290,6 +300,12 @@
OS_NAME="Kali Linux"
OS_VERSION="Rolling release"
;;
+ "koozali")
+ LINUX_VERSION="Koozali"
+ OS_NAME="Koozali SME Server"
+ OS_REDHAT_OR_CLONE=1
+ OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+ ;;
"linuxmint")
LINUX_VERSION="Linux Mint"
LINUX_VERSION_LIKE="Ubuntu"
@@ -314,6 +330,13 @@
OS_NAME="Manjaro"
OS_VERSION="Rolling release"
;;
+ "neon")
+ LINUX_VERSION="KDE Neon"
+ LINUX_VERSION_LIKE="Ubuntu"
+ OS_NAME="KDE Neon"
+ OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+ OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+ ;;
"nethserver")
LINUX_VERSION="NethServer"
OS_NAME="NethServer"
@@ -332,6 +355,12 @@
OS_REDHAT_OR_CLONE=1
OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
;;
+ "nobara")
+ LINUX_VERSION="Nobara"
+ OS_NAME="Nobara Linux"
+ OS_REDHAT_OR_CLONE=1
+ OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+ ;;
"nodistro")
LINUX_VERSION="openembedded"
OS_NAME="OpenEmbedded"
@@ -381,6 +410,13 @@
OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
OS_NAME="Pop!_OS"
;;
+ "postmarketos")
+ LINUX_VERSION="PostmarketOS"
+ LINUX_VERSION_LIKE="Alpine"
+ OS_NAME=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+ OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+ OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+ ;;
"pureos")
LINUX_VERSION="PureOS"
LINUX_VERSION_LIKE="Debian"
@@ -445,7 +481,7 @@
OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
;;
*)
- ReportException "OS Detection" "Unknown OS found in /etc/os-release - Please create an issue on GitHub and share the the contents (cat /etc/os-release): ${PROGRAM_SOURCE}"
+ ReportException "OS Detection" "Unknown OS found in /etc/os-release - Please create an issue on GitHub and share the contents (cat /etc/os-release): ${PROGRAM_SOURCE}"
;;
esac
fi
diff --git a/include/profiles b/include/profiles
index 6bf7758a..6d7c0aa7 100644
--- a/include/profiles
+++ b/include/profiles
@@ -56,7 +56,7 @@
fi
# Security check for unexpected and possibly harmful escape characters (hyphen should be listed as first or last character)
- DATA=$(grep -Ev '^$|^ |^#|^config:' "${PROFILE}" | tr -d '[:alnum:]/\[\]\(\)_\|,\.:;= \n\r-')
+ DATA=$(grep -Ev '^$|^ |^#|^config:' "${PROFILE}" | tr -d '[a-zA-Z0-9]/\[\]\(\)_\|,\.:;= \n\r-')
if ! IsEmpty "${DATA}"; then
DisplayWarning "Your profile '${PROFILE}' contains unexpected characters. See the log file for more information."
LogText "Found unexpected or possibly harmful characters in profile '${PROFILE}'. See which characters matched in the output below and compare them with your profile."
@@ -68,7 +68,7 @@
fi
# Now parse the profile and filter out unwanted characters
- DATA=$(grep -E "^config:|^[a-z-].*=" ${PROFILE} | tr -dc '[:alnum:]/\[\]\(\)_\|,\.:;= \n\r-' | sed 's/ /!space!/g')
+ DATA=$(grep -E "^config:|^[a-z-].*=" ${PROFILE} | tr -dc '[a-zA-Z0-9]/\[\]\(\)_\|,\.:;= \n\r-' | sed 's/ /!space!/g')
for CONFIGOPTION in ${DATA}; do
if ContainsString "^config:" "${CONFIGOPTION}"; then
# Old style configuration
@@ -352,7 +352,7 @@
# Which tests to skip (skip-test=ABCD-1234 or skip-test=ABCD-1234:subtest)
skip-test)
- STRING=$(echo ${VALUE} | tr '[:lower:]' '[:upper:]')
+ STRING=$(echo ${VALUE} | awk '{print toupper($0)}')
SKIP_TESTS="${SKIP_TESTS} ${STRING}"
;;
@@ -371,7 +371,7 @@
ssl-certificate-paths-to-ignore)
# Retrieve paths to ignore when searching for certificates. Strip special characters, replace possible spaces
- SSL_CERTIFICATE_PATHS_TO_IGNORE=$(echo ${VALUE} | tr -d '[:cntrl:]' | sed 's/ /__space__/g' | tr ':' ' ')
+ SSL_CERTIFICATE_PATHS_TO_IGNORE=$(echo ${VALUE} | tr -d '[\001-\037]' | sed 's/ /__space__/g' | tr ':' ' ')
Debug "SSL paths to ignore: ${SSL_CERTIFICATE_PATHS_TO_IGNORE}"
AddSetting "ssl-certificate-paths-to-ignore" "${SSL_CERTIFICATE_PATHS_TO_IGNORE}" "Paths that should be ignored for SSL certificates"
;;
@@ -479,7 +479,7 @@
# Deprecated: skip tests
test_skip_always)
- STRING=$(echo ${VALUE} | tr '[:lower:]' '[:upper:]')
+ STRING=$(echo ${VALUE} | awk '{print toupper($0)}')
SKIP_TESTS="${SKIP_TESTS} ${STRING}"
LogText "[deprecated option] Tests to be skipped: ${VALUE}"
DisplayToolTip "Replace deprecated option 'test_skip_always' and replace with 'skip-test' (add to custom.prf)"
diff --git a/include/tests_authentication b/include/tests_authentication
index 3ec54d64..08890980 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -717,7 +717,7 @@
if [ ${FOUND} -eq 0 ]; then
Display --indent 2 --text "- PAM password strength tools" --result "${STATUS_SUGGESTION}" --color YELLOW
LogText "Result: no PAM modules for password strength testing found"
- ReportSuggestion "${TEST_NO}" "Install a PAM module for password strength testing like pam_cracklib or pam_passwdqc"
+ ReportSuggestion "${TEST_NO}" "Install a PAM module for password strength testing like pam_cracklib or pam_passwdqc or libpam-passwdqc"
AddHP 0 3
else
Display --indent 2 --text "- PAM password strength tools" --result "${STATUS_OK}" --color GREEN
diff --git a/include/tests_banners b/include/tests_banners
index cd148f30..0694e9de 100644
--- a/include/tests_banners
+++ b/include/tests_banners
@@ -27,7 +27,7 @@
#################################################################################
#
BANNER_FILES="${ROOTDIR}etc/issue ${ROOTDIR}etc/issue.net ${ROOTDIR}etc/motd"
- LEGAL_BANNER_STRINGS="audit access authori condition connect consent continu criminal enforce evidence forbidden intrusion law legal legislat log monitor owner penal policy policies privacy private prohibited record restricted secure subject system terms warning"
+ LEGAL_BANNER_STRINGS="audit access authori condition connect consent continu criminal enforce evidence forbidden intrusion law legal legislat log monitor owner penal policy policies privacy private prohibited prosecute record report restricted secure subject system terms warning"
#
#################################################################################
#
diff --git a/include/tests_containers b/include/tests_containers
index a02ea268..96fed9e8 100644
--- a/include/tests_containers
+++ b/include/tests_containers
@@ -107,7 +107,7 @@
LogText "Result: disabling further Docker tests as docker version gave exit code other than zero (0)"
RUN_DOCKER_TESTS=0
fi
- FIND=$(${DOCKERBINARY} info 2>&1 | ${GREPBINARY} "^WARNING:" | ${CUTBINARY} -d " " -f 2- | ${SEDBINARY} 's/ /:space:/g')
+ FIND=$(${DOCKERBINARY} info 2>&1 | ${GREPBINARY} -E "^WARNING:|^ERROR:" | ${CUTBINARY} -d " " -f 2- | ${SEDBINARY} 's/ /:space:/g')
if [ ! "${FIND}" = "" ]; then
LogText "Result: found warning(s) in output"
for I in ${FIND}; do
diff --git a/include/tests_crypto b/include/tests_crypto
index a643b6c0..7b77b707 100644
--- a/include/tests_crypto
+++ b/include/tests_crypto
@@ -217,6 +217,33 @@
fi
#
#################################################################################
+#
+ # Test : CRYP-7932
+ # Description : Determine if system has enabled macOS FileVault encryption
+ Register --test-no CRYP-7932 --os macOS --weight L --network NO --category crypto --description "Determine if system has enabled macOS FileVault encryption"
+ if [ ${SKIPTEST} -eq 0 ]; then
+ if command -v fdesetup &> /dev/null; then
+ case $(fdesetup status) in
+ *"FileVault is On."*)
+ LogText "Result: FileVault is enabled."
+ Display --indent 2 --text "- FileVault is enabled." --result "${STATUS_OK}" --color GREEN
+ Report "encryption[]=filevault"
+ AddHP 3 3
+ ;;
+ *)
+ LogText "Result: FileVault is not enabled."
+ Display --indent 2 --text "- FileVault is not enabled." --result "${STATUS_WARNING}" --color RED
+ AddHP 0 3
+ ;;
+ esac
+ else
+ LogText "Result: fdesetup command not found. Unable to determine FileVault status."
+ Display --indent 2 --text "- Unable to determine FileVault status (fdesetup command not found)." --result "${STATUS_WARNING}" --color YELLOW
+ AddHP 0 3
+ fi
+ fi
+#
+#################################################################################
#
# Test : CRYP-8002
# Description : Gather available kernel entropy
diff --git a/include/tests_databases b/include/tests_databases
index 10bbc36a..82e3fa10 100644
--- a/include/tests_databases
+++ b/include/tests_databases
@@ -186,8 +186,10 @@
# Test : DBS-1826
# Description : Check if PostgreSQL is being used
Register --test-no DBS-1826 --weight L --network NO --category security --description "Checking active PostgreSQL processes"
+ for PROCES in postgres postmaster
+ do
if [ ${SKIPTEST} -eq 0 ]; then
- if IsRunning "postgres"; then
+ if IsRunning "${PROCES}"; then
Display --indent 2 --text "- PostgreSQL processes status" --result "${STATUS_FOUND}" --color GREEN
LogText "Result: PostgreSQL is active"
POSTGRESQL_RUNNING=1
@@ -195,9 +197,10 @@
Report "postgresql_running=${POSTGRESQL_RUNNING}"
else
if [ ${DEBUG} -eq 1 ]; then Display --indent 2 --text "- PostgreSQL processes status" --result "${STATUS_NOT_FOUND}" --color WHITE --debug; fi
- LogText "Result: PostgreSQL process not active"
+ LogText "Result: PostgreSQL process ${PROCES} not active"
fi
fi
+ done
#
#################################################################################
#
@@ -211,14 +214,15 @@
# Arch /var/lib/postgres/data/postgresql.conf
# CentOS/Fedora /var/lib/pgsql/data/postgresql.conf
# Ubuntu /etc/postgresql/x.y/main/postgresql.conf
+ # FreeBSD /var/db/postgres/data[0-9][0-9]/postgresql.conf
if [ "${POSTGRESQL_RUNNING}" -eq 1 ]; then PREQS_MET="YES"; SKIPREASON=""; else PREQS_MET="NO"; SKIPREASON="PostgreSQL not installed or not running"; fi
Register --test-no DBS-1828 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Test PostgreSQL configuration"
if [ ${SKIPTEST} -eq 0 ]; then
FIND_PATHS=$(${LSBINARY} -d ${ROOTDIR}usr/local/pgsql/data* 2> /dev/null)
- FIND_PATHS="${FIND_PATHS} ${ROOTDIR}etc/postgres ${ROOTDIR}etc/postgresql ${ROOTDIR}var/lib/postgres/data ${ROOTDIR}usr/local/pgsql/data"
- CONFIG_FILES=$(${FINDBINARY} -L ${FIND_PATHS} -type f -name "*.conf" -print0 2> /dev/null | ${TRBINARY} -cd '[:print:]\0' | ${TRBINARY} -d '\n' | ${TRBINARY} '\0' '\n' | xargs -i sh -c 'test -r "{}" && echo "{}"' | ${SEDBINARY} "s/ /:space:/g")
+ FIND_PATHS="${FIND_PATHS} ${ROOTDIR}etc/postgres ${ROOTDIR}etc/postgresql ${ROOTDIR}var/lib/postgres/data ${ROOTDIR}usr/local/pgsql/data ${ROOTDIR}var/lib/pgsql/data ${ROOTDIR}var/db/postgres/data[0-9][0-9]"
+ CONFIG_FILES=$(${FINDBINARY} -L ${FIND_PATHS} -type f -name "*.conf" -print0 2> /dev/null | ${TRBINARY} -cd '[:print:]\0' | ${TRBINARY} -d '\n' | ${TRBINARY} '\0' '\n' | xargs -I'{}' sh -c 'test -r "{}" && echo "{}"' | ${SEDBINARY} "s/ /:space:/g")
for CF in ${CONFIG_FILES}; do
Report "postgresql_config_file[]=${CF}"
LogText "Found configuration file (${CF})"
diff --git a/include/tests_filesystems b/include/tests_filesystems
index 93af33ed..cabc27e7 100644
--- a/include/tests_filesystems
+++ b/include/tests_filesystems
@@ -346,7 +346,13 @@
LINUX_KERNEL_MAJOR=$(echo $OS_KERNELVERSION | ${AWKBINARY} -F. '{print $1}')
LINUX_KERNEL_MINOR=$(echo $OS_KERNELVERSION | ${AWKBINARY} -F. '{print $2}')
if [ -n "${LINUX_KERNEL_MAJOR}" -a -n "${LINUX_KERNEL_MINOR}" ]; then
- if [ ${LINUX_KERNEL_MAJOR} -ge 3 -a ${LINUX_KERNEL_MINOR} -ge 3 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+ if [ ${LINUX_KERNEL_MAJOR} -ge 3 -a ${LINUX_KERNEL_MINOR} -ge 3 ]; then
+ PREQS_MET="YES";
+ elif [ ${LINUX_KERNEL_MAJOR} -ge 4 ]; then
+ PREQS_MET="YES";
+ else
+ PREQS_MET="NO";
+ fi
else
PREQS_MET="NO";
fi
@@ -726,11 +732,45 @@
#
#################################################################################
#
- # Test : FILE-6398 TODO
+ # Test : FILE-6398
# Description : Check if JBD (Journal Block Device) driver is loaded
-
- # Want to contribute to Lynis? Create this test
-
+ Register --test-no FILE-6398 --os Linux --weight L --network NO --category security --description "Checking if JBD (Journal Block Device) driver is loaded"
+ if [ ${SKIPTEST} -eq 0 ]; then
+ LogText "Test: Checking if JBD (Journal Block Device) driver is loaded"
+ NOTINUSE=0
+ # Cannot check if driver is loaded/present if kernel is monolithic
+ if [ ${MONOLITHIC_KERNEL} -eq 0 ]; then
+ JBD=$(${LSMODBINARY} | ${GREPBINARY} ^jbd)
+ if [ -n "${JBD}" ]; then
+ LogText "Result: JBD driver is loaded"
+ INUSE=$(echo ${JBD} | ${AWKBINARY} '{if ($3 -ne 0) {print $4}}')
+ if [ -n "${INUSE}" ]; then
+ LogText "Result: JBD driver is in use by drivers: ${INUSE}"
+ Report "JBD driver is in use by drivers: ${INUSE}"
+ Display --indent 2 --text "- JBD driver loaded and in use" --result "${STATUS_OK}" --color GREEN
+ else
+ NOTINUSE=1
+ LogText "Result: JBD driver loaded, but not in use"
+ Report "JBD driver is loaded, but not in use."
+ Display --indent 2 --text "- JBD driver loaded, but not in use" --result "${STATUS_SUGGESTION}" --color YELLOW
+ fi
+ else
+ NOTINUSE=2
+ LogText "Result: JBD driver not loaded"
+ Report "JBD driver not loaded."
+ Display --indent 2 --text "- JBD driver is not loaded" --result "${STATUS_CHECK_NEEDED}" --color YELLOW
+ fi
+ if [ ${NOTINUSE} -eq 1 ]; then
+ ReportSuggestion "${TEST_NO}" "The JBD (Journal Block Device) driver is loaded but not in use." "You are currently not using any filesystems with journaling, i.e. you have greater risk of data corruption in case of system crash."
+ elif [ ${NOTINUSE} -eq 2 ]; then
+ ReportSuggestion "${TEST_NO}" "The JBD (Journal Block Device) driver is not loaded." "Since boot-time, you have not been using any filesystems with journaling. Alternatively, reason could be driver is blacklisted."
+ fi
+ else
+ LogText "Kernel is monolithic - cannot check if JBD driver is part of compiled kernel."
+ Report "Kernel is monolithic - cannot check if JBD driver is part of compiled kernel."
+ Display --indent 2 --text "- JBD driver: unable to check" --result "${STATUS_UNKNOWN}" --color RED
+ fi
+ fi
#
#################################################################################
#
diff --git a/include/tests_kerberos b/include/tests_kerberos
new file mode 100644
index 00000000..9ef86267
--- /dev/null
+++ b/include/tests_kerberos
@@ -0,0 +1,188 @@
+#!/bin/sh
+
+InsertSection "${SECTION_KERBEROS}"
+
+#
+#########################################################################
+#
+
+ # Test : KRB-1000
+ # Description : Check that Kerberos principals have passwords that expire
+ Register --test-no KRB-1000 --weight L --network NO --description "Check for Kerberos KDC tools"
+ if [ -n "${KADMINLOCALBINARY}" ] && [ -n "${KDB5UTILBINARY}" ]
+ then
+ PREQS_MET="YES"
+ # Make sure krb5 debugging doesn't mess up the output
+ unset KRB5_TRACE
+ PRINCS="$(${KADMINLOCALBINARY} listprincs | ${TRBINARY:-tr} '\n' ' ')"
+ if [ -z "${PRINCS}" ]
+ then
+ PREQS_MET="NO"
+ fi
+ else
+ PREQS_MET="NO"
+ fi
+ if [ "${PREQS_MET}" = "YES" ]; then
+ Display --indent 2 --text "- Check for Kerberos KDC and principals" --result "${STATUS_FOUND}" --color GREEN
+ else
+ Display --indent 2 --text "- Check for Kerberos KDC and principals" --result "${STATUS_NOT_FOUND}" --color WHITE
+ fi
+
+ # Test : KRB-1010
+ # Description : Check that Kerberos principals have passwords that expire
+ Register --test-no KRB-1010 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check that Kerberos principals have passwords that expire"
+ if [ ${SKIPTEST} -eq 0 ]; then
+ FOUND=0
+ for I in ${PRINCS}
+ do
+ FIND="$(${KADMINLOCALBINARY} getprinc "${I}" | ${GREPBINARY} '^Password expiration date:')"
+ if [ "${FIND}" = "Password expiration date: [never]" ]
+ then
+ LogText "Result: Kerberos principal ${I} has a password/key that never expires"
+ FOUND=1
+ fi
+ done
+ if [ ${FOUND} -eq 1 ]; then
+ Display --indent 4 --text "- Principals without expiring password" --result "${STATUS_WARNING}" --color RED
+ ReportSuggestion "${TEST_NO}" "Make sure all your Kerberos principals have expiring passwords"
+ else
+ Display --indent 4 --text "- Principals without expiring password" --result "${STATUS_OK}" --color GREEN
+ fi
+ fi
+#
+#################################################################################
+#
+
+ # Test : KRB-1020
+ # Description : Check last password change for Kerberos principals
+ Register --test-no KRB-1020 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check last password change for Kerberos principals"
+ if [ ${SKIPTEST} -eq 0 ]; then
+ FOUND=0
+ for I in ${PRINCS}
+ do
+ FIND="$(${KADMINLOCALBINARY} getprinc "${I}" | ${SEDBINARY} -n '/^Last password change:\s\+/s/^Last password change:\s\+//p')"
+ if [ "${FIND}" = "[never]" ]
+ then
+ LogText "Result: Kerberos principal ${I} has a password/key that has never been changed"
+ FOUND=1
+ else
+ J="$(date -d "${FIND}" +%s)"
+ if [ ${J} -lt $((NOW - 60 * 60 * 24 * 365)) ]
+ then
+ LogText "Result: Kerberos principal ${I} has had a password/key change over a year ago"
+ FOUND=1
+ fi
+ fi
+ done
+ if [ ${FOUND} -eq 1 ]; then
+ Display --indent 4 --text "- Principals with late password change" --result "${STATUS_WARNING}" --color RED
+ ReportSuggestion "${TEST_NO}" "Enforce frequent password/key change for your Kerberos principals"
+ else
+ Display --indent 4 --text "- Principals with late password change" --result "${STATUS_OK}" --color GREEN
+ fi
+ fi
+
+#
+#################################################################################
+#
+
+ # Test : KRB-1030
+ # Description : Check that Kerberos principals have a policy associated to them
+ Register --test-no KRB5-1030 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check that Kerberos principals have a policy associated to them"
+ if [ ${SKIPTEST} -eq 0 ]; then
+ FOUND=0
+ for I in ${PRINCS}
+ do
+ FIND="$(${KADMINLOCALBINARY} getprinc "${I}" | ${GREPBINARY} '^Policy:')"
+ if [ "${FIND}" = "Policy: [none]" ]
+ then
+ LogText "Result: Kerberos principal ${I} does not have a policy associated to it"
+ FOUND=1
+ fi
+ done
+ if [ ${FOUND} -eq 1 ]; then
+ Display --indent 4 --text "- Principals without associated policy" --result "${STATUS_WARNING}" --color RED
+ ReportSuggestion "${TEST_NO}" "Make sure all your Kerberos principals have a policy associated to them"
+ else
+ Display --indent 4 --text "- Principals without associated policy" --result "${STATUS_OK}" --color GREEN
+ fi
+ fi
+
+#
+#################################################################################
+#
+
+ # Test : KRB-1040
+ # Description : Check various attributes for Kerberos principals
+ Register --test-no KRB5-1040 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check various attributes for Kerberos principals"
+ if [ ${SKIPTEST} -eq 0 ]; then
+ FOUND=0
+ for I in ${PRINCS}
+ do
+ J="$(${KADMINLOCALBINARY} getprinc "${I}" | ${SEDBINARY} -n 's/^Attributes:\s\+\(.\+\)$/\1/p')"
+ if ContainsString "^K/M@" "${I}" || \
+ ContainsString "^kadmin/admin@" "${I}" || \
+ ContainsString "^kadmin/changepw@" "${I}" || \
+ ContainsString "^krbtgt/" "${I}"
+ then
+ if ! ContainsString "\bLOCKDOWN_KEYS\b" "${J}"
+ then
+ LogText "Result: Sensitive Kerberos principal ${I} does not have the lockdown_keys attribute"
+ FOUND=1
+ fi
+ elif ContainsString "/admin@" "${I}"
+ then
+ if ! ContainsString "\bDISALLOW_TGT_BASED\b" "${J}"
+ then
+ LogText "Result: Kerberos admin principal ${I} does not have the disallow_tgt_based attribute"
+ FOUND=1
+ fi
+ elif ContainsString "^[^/$]+@" "${I}"
+ then
+ if ! ContainsString "\bREQUIRES_PRE_AUTH\b.+\bDISALLOW_SVR\b" "${J}"
+ then
+ LogText "Result: Regular Kerberos user principal ${I} does not have the requires_pre_auth and/or the disallow_svr attribute"
+ FOUND=1
+ fi
+ fi
+ done
+ if [ ${FOUND} -eq 1 ]; then
+ Display --indent 4 --text "- Checking principals for various attributes" --result "${STATUS_WARNING}" --color RED
+ ReportSuggestion "${TEST_NO}" "Harden your Kerberos principals with appropriate attributes"
+ else
+ Display --indent 4 --text "- Checking principals for various attributes" --result "${STATUS_OK}" --color GREEN
+ fi
+ fi
+
+#
+#################################################################################
+#
+
+ # Test : KRB-1050
+ # Description : Check for weak crypto
+ Register --test-no KRB-1050 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check for weak crypto"
+ if [ ${SKIPTEST} -eq 0 ]; then
+ FIND=$(${KDB5UTILBINARY} tabdump keyinfo | ${AWKBINARY} '$4 ~ /(des|arcfour|cbc|sha1)/{print$1,$4}')
+ if [ -n "${FIND}" ]; then
+ while read I J
+ do
+ LogText "Result: Kerberos principal ${I} has a key with weak cryptographic algorithm ${J}"
+ done << EOF
+${FIND}
+EOF
+ Display --indent 4 --text "- Principals with weak crypto" --result "${STATUS_WARNING}" --color RED
+ ReportSuggestion "${TEST_NO}" "Remove weak (des|arcfour|cbc|sha1) cryptographic keys from principals"
+ else
+ Display --indent 4 --text "- Principals with weak crypto" --result "${STATUS_OK}" --color GREEN
+ fi
+ fi
+
+#
+#################################################################################
+#
+
+unset PRINCS
+unset I
+unset J
+
+#EOF
diff --git a/include/tests_kernel b/include/tests_kernel
index bba8080f..15bfded2 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -41,28 +41,17 @@
if [ ${SKIPTEST} -eq 0 ]; then
# Checking if we can find the systemd default target
LogText "Test: Checking for systemd default.target"
- if [ -L ${ROOTDIR}etc/systemd/system/default.target ]; then
- LogText "Result: symlink found"
- if HasData "${READLINKBINARY}"; then
- FIND=$(${READLINKBINARY} ${ROOTDIR}etc/systemd/system/default.target)
- if ! HasData "${FIND}"; then
- LogText "Exception: can't find the target of the symlink of /etc/systemd/system/default.target"
- ReportException "${TEST_NO}:01"
- else
- FIND2=$(${ECHOCMD} ${FIND} | ${GREPBINARY} -E "runlevel5|graphical")
- if HasData "${FIND2}"; then
- LogText "Result: Found match on runlevel5/graphical"
- Display --indent 2 --text "- Checking default runlevel" --result "runlevel 5" --color GREEN
- Report "linux_default_runlevel=5"
- else
- LogText "Result: No match found on runlevel, defaulting to runlevel 3"
- Display --indent 2 --text "- Checking default runlevel" --result "runlevel 3" --color GREEN
- Report "linux_default_runlevel=3"
- fi
- fi
+ if [ $(${SYSTEMCTLBINARY} get-default) ]; then
+ FIND=$(${SYSTEMCTLBINARY} get-default)
+ FIND2=$(${ECHOCMD} ${FIND} | ${EGREPBINARY} "runlevel5|graphical")
+ if HasData "${FIND2}"; then
+ LogText "Result: Found match on runlevel5/graphical"
+ Display --indent 2 --text "- Checking default runlevel" --result "runlevel 5" --color GREEN
+ Report "linux_default_runlevel=5"
else
- LogText "Result: No readlink binary, can't determine where symlink is pointing to"
- Display --indent 2 --text "- Checking default run level" --result "${STATUS_UNKNOWN}" --color YELLOW
+ LogText "Result: No match found on runlevel, defaulting to runlevel 3"
+ Display --indent 2 --text "- Checking default runlevel" --result "runlevel 3" --color GREEN
+ Report "linux_default_runlevel=3"
fi
else
LogText "Result: no systemd found, so trying inittab"
@@ -467,7 +456,7 @@
SYSD_CORED_BASE_STORAGE_FOUND=$(${GREPBINARY} -v "^ *#" ${ROOTDIR}etc/systemd/coredump.conf 2> /dev/null | ${SEDBINARY} 's/^ *//g' | ${GREPBINARY} -i "^Storage=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g')
SYSD_CORED_BASE_STORAGE_NR_ENABLED=$(${ECHOCMD} "${SYSD_CORED_BASE_STORAGE_FOUND}" | ${SEDBINARY} 's/none//g' | ${WCBINARY} | ${AWKBINARY} '{print $2}')
SYSD_CORED_BASE_STORAGE_NR_DISABLED=$(${ECHOCMD} "${SYSD_CORED_BASE_STORAGE_FOUND}" | ${GREPBINARY} -o "none" | ${WCBINARY} | ${AWKBINARY} '{print $2}')
- # check conf files in possibly existing coredump.conf.d folders
+ # check conf files in possibly existing coredump.conf.d folders
# using find instead of grep -r to stay POSIX compliant. On AIX and HPUX grep -r is not available.
# while there could be multiple files overwriting each other, we are checking the number of occurrences
SYSD_CORED_SUB_PROCSIZEMAX_NR_DISABLED=$(${FINDBINARY} -L /etc/systemd/coredump.conf.d/ /run/systemd/coredump.conf.d/ /usr/lib/systemd/coredump.conf.d/ -type f -iname "*.conf" -exec ${SEDBINARY} 's/^ *//g' {} \; 2> /dev/null | ${GREPBINARY} -i "^ProcessSizeMax=" | ${CUTBINARY} -d'=' -f2 | ${SEDBINARY} 's/ .*$//g ; s/\([A-Z][a-z]*\)*$//g' | ${GREPBINARY} "^0 *$" | ${WCBINARY} -l)
@@ -531,7 +520,7 @@
Display --indent 4 --text "- configuration in ${ROOTDIR}etc/profile" --result "${STATUS_ERROR}" --color YELLOW
fi
fi
-
+
# Limits options
for DIR in "/" "/usr/"; do
LogText "Test: Checking presence ${DIR}etc/security/limits.conf"
@@ -692,7 +681,7 @@
else
# Match on items like /boot/vm5.3.7 or /boot/vmlinuz-5.3.7-1-default. Sort based on versions (-v) and then find the last item
# Note: ignore a rescue kernel (e.g. CentOS)
- FOUND_VMLINUZ=$(${LSBINARY} -v ${ROOTDIR}boot/vm[l0-9]* 2> /dev/null | ${GREPBINARY} -v '\-rescue\-' | ${TAILBINARY} -1)
+ FOUND_VMLINUZ=$(${LSBINARY} -v ${ROOTDIR}boot/vm[l0-9]* 2> /dev/null | ${GREPBINARY} -v '\-rescue-' | ${TAILBINARY} -1)
LogText "Result: found ${FOUND_VMLINUZ}"
fi
@@ -840,7 +829,7 @@
else
LogText "Result: Skipping this test, as extracting the seconds of package date failed"
fi
-
+
if [ -n "${UNAME_OUTPUT}" ]; then
LogText "Result: Got an output from 'uname -v'"
LogText "Check: Trying to extract kernel build date from 'uname -v' output"
@@ -911,8 +900,7 @@
else
LogText "Result: Did not get output from 'uname -v'. Skipping test."
fi
-
-
+
else
LogText "Result: /var/cache/apt/archives/ does not exist"
fi
diff --git a/include/tests_logging b/include/tests_logging
index 04bee67d..d560da64 100644
--- a/include/tests_logging
+++ b/include/tests_logging
@@ -28,6 +28,7 @@
METALOG_RUNNING=0
RFC3195D_RUNNING=0
RSYSLOG_RUNNING=0
+ WAZUH_AGENT_RUNNING=0
SOLARIS_LOGHOST=""
SOLARIS_LOGHOST_FOUND=0
SOLARIS_LOGHOST_LOCALHOST=0
@@ -220,6 +221,23 @@
fi
#
#################################################################################
+#
+ # Test : LOGG-2144
+ # Description : Check for wazuh-agent presence on Linux systems
+ Register --test-no LOGG-2144 --os Linux --weight L --network NO --category security --description "Checking wazuh-agent"
+ if [ ${SKIPTEST} -eq 0 ]; then
+ LogText "Result: Searching for wazuh-agent instances in the process list"
+ if IsRunning "wazuh-agent"; then
+ LogText "Result: Found wazuh-agent in process list"
+ Display --indent 4 --text "- Checking wazuh-agent status" --result "${STATUS_FOUND}" --color GREEN
+ WAZUH_AGENT_RUNNING=1
+ else
+ LogText "Result: wazuh-agent NOT found in process list"
+ Display --indent 4 --text "- Checking wazuh-agent daemon status" --result "${STATUS_NOT_FOUND}" --color WHITE
+ fi
+ fi
+#
+#################################################################################
#
# Test : LOGG-2146
# Description : Check for logrotate (/etc/logrotate.conf and logrotate.d)
@@ -446,6 +464,21 @@
fi
fi
+ # Test wazuh-agent configuration for syslog configuration
+ if [ ${WAZUH_AGENT_RUNNING} ]; then
+ WAZUH_AGENT_CONF="/var/ossec/etc/ossec.conf"
+ fi
+
+ if [ -f ${WAZUH_AGENT_CONF} ]; then
+ LogText "Test: Checking Wazuh agent configuration for remote syslog forwarding"
+ FIND=$(${EGREPBINARY} '/var/log/syslog' ${WAZUH_AGENT_CONF})
+ if [ "${FIND}" ]; then
+ DESTINATION=$(${EGREPBINARY} -o '([A-Za-z0-9\.\-\_]*)' ${WAZUH_AGENT_CONF} | sed 's///' | sed 's/<\/address>//')
+ LogText "Result: found destination ${DESTINATION} configured for remote logging with wazuh"
+ REMOTE_LOGGING_ENABLED=1
+ fi
+ fi
+
# Show result
if [ ${REMOTE_LOGGING_ENABLED} -eq 0 ]; then
Report "remote_syslog_configured=0"
diff --git a/include/tests_mac_frameworks b/include/tests_mac_frameworks
index cda343ad..207a98f5 100644
--- a/include/tests_mac_frameworks
+++ b/include/tests_mac_frameworks
@@ -158,10 +158,14 @@
Display --indent 6 --text "- Checking current mode and config file" --result "${STATUS_WARNING}" --color RED
fi
Display --indent 8 --text "Current SELinux mode: ${FIND}"
- PERMISSIVE=$(${SEMANAGEBINARY} permissive --list --noheading | ${TRBINARY} '\n' ' ')
- NPERMISSIVE=$(${SEMANAGEBINARY} permissive --list --noheading | ${WCBINARY} -l)
- Display --indent 8 --text "Found ${NPERMISSIVE} permissive SELinux object types"
- LogText "Permissive SELinux object types: ${PERMISSIVE}"
+ if [ -n "${SEMANAGEBINARY}" ]; then
+ PERMISSIVE=$(${SEMANAGEBINARY} permissive --list --noheading | ${TRBINARY} '\n' ' ')
+ NPERMISSIVE=$(${SEMANAGEBINARY} permissive --list --noheading | ${WCBINARY} -l)
+ Display --indent 8 --text "Found ${NPERMISSIVE} permissive SELinux object types"
+ LogText "Permissive SELinux object types: ${PERMISSIVE}"
+ else
+ LogText "Result: semanage binary NOT found, can't analyse permissive domains"
+ fi
UNCONFINED=$(${PSBINARY} -eo label,pid,command | ${GREPBINARY} '[u]nconfined_t' | ${TRBINARY} '\n' ' ')
INITRC=$(${PSBINARY} -eo label,pid,command | ${GREPBINARY} '[i]nitrc_t' | ${TRBINARY} '\n' ' ')
NUNCONFINED=$(${PSBINARY} -eo label | ${GREPBINARY} '[u]nconfined_t' | ${WCBINARY} -l)
diff --git a/include/tests_malware b/include/tests_malware
index 87a721bc..70c1ff59 100644
--- a/include/tests_malware
+++ b/include/tests_malware
@@ -44,6 +44,7 @@
SYMANTEC_SCANNER_RUNNING=0
SYNOLOGY_DAEMON_RUNNING=0
TRENDMICRO_DSA_DAEMON_RUNNING=0
+ WAZUH_DAEMON_RUNNING=0
#
#################################################################################
#
@@ -53,16 +54,12 @@
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: checking presence McAfee VirusScan for Command Line"
if [ -x /usr/local/uvscan/uvscan ]; then
- Display --indent 2 --text "- ${GEN_CHECKING} McAfee VirusScan for Command Line" --result "${STATUS_FOUND}" --color GREEN
+ Display --indent 2 --text "- ${GEN_CHECKING} McAfee VirusScan for Command Line (deprecated)" --result "${STATUS_FOUND}" --color RED
LogText "Result: Found ${MCAFEECLBINARY}"
- MALWARE_SCANNER_INSTALLED=1
- AddHP 2 2
- Report "malware_scanner[]=mcafeecl"
- else
- LogText "Result: McAfee VirusScan for Command Line not found"
- fi
+ AddHP 0 2
+ LogText "Result: McAfee Antivirus for Linux has been deprecated as of 1 Oct 2023 and will not receive updates. Please use another antivirus instead."
+ fi
fi
-#
#################################################################################
#
# Test : MALW-3275
@@ -187,8 +184,8 @@
fi
# ESET security products
- LogText "Test: checking process esets_daemon"
- if IsRunning "esets_daemon"; then
+ LogText "Test: checking process esets_daemon or oaeventd (ESET)"
+ if IsRunning "esets_daemon" || IsRunning "oaeventd"; then
FOUND=1
ESET_DAEMON_RUNNING=1
MALWARE_DAEMON_RUNNING=1
@@ -323,6 +320,19 @@
Report "malware_scanner[]=trend-micro-av"
fi
+ # Wazuh agent
+ LogText "Test: checking process wazuh-agent to test for Wazuh agent"
+ if IsRunning "wazuh-agent"; then
+ if IsVerbose; then Display --indent 2 --text "- ${GEN_CHECKING} Wazuh agent" --result "${STATUS_FOUND}" --color GREEN; fi
+ LogText "Result: found Wazuh component"
+ FOUND=1
+ WAZUH_DAEMON_RUNNING=1
+ MALWARE_DAEMON_RUNNING=1
+ MALWARE_SCANNER_INSTALLED=1
+ ROOTKIT_SCANNER_FOUND=1
+ Report "malware_scanner[]=wazuh"
+ fi
+
if [ ${FOUND} -eq 0 ]; then
LogText "Result: no commercial anti-virus tools found"
AddHP 0 3
@@ -369,6 +379,24 @@
fi
#
#################################################################################
+#
+ # Test : MALW-3291
+ # Description : Check if Microsoft Defender Antivirus is installed
+ Register --test-no MALW-3291 --weight L --network NO --category security --description "Check for mdatp"
+ if [ ${SKIPTEST} -eq 0 ]; then
+ LogText "Test: checking presence mdatp"
+ if [ ! "${MDATPBINARY}" = "" ]; then
+ Display --indent 2 --text "- Checking Microsoft Defender Antivirus" --result "${STATUS_FOUND}" --color GREEN
+ LogText "Result: Found ${MDATPBINARY}"
+ MALWARE_SCANNER_INSTALLED=1
+ AddHP 2 2
+ Report "malware_scanner[]=mdatp"
+ else
+ LogText "Result: mdatp couldn't be found"
+ fi
+ fi
+#
+#################################################################################
#
# Test : MALW-3286
# Description : Check running freshclam if clamd process is running
diff --git a/include/tests_nameservices b/include/tests_nameservices
index c35b4171..e6cc0489 100644
--- a/include/tests_nameservices
+++ b/include/tests_nameservices
@@ -485,7 +485,7 @@
LogText "Result: ypldap is running"
Display --indent 2 --text "- Checking ypldap status" --result "${STATUS_FOUND}" --color GREEN
else
- ReportSuggestion "Disable the usage of NIS/NIS+ and use an alternative like LDAP or Kerberos instead"
+ ReportSuggestion "${TEST_NO}" "Disable the usage of NIS/NIS+ and use an alternative like LDAP or Kerberos instead"
fi
else
LogText "Result: ypbind is not active"
diff --git a/include/tests_networking b/include/tests_networking
index 116f3760..44a65708 100644
--- a/include/tests_networking
+++ b/include/tests_networking
@@ -750,7 +750,7 @@
UNCOMMON_PROTOCOL_DISABLED=0
# First check modprobe.conf
if [ -f ${ROOTDIR}etc/modprobe.conf ]; then
- DATA=$(${GREPBINARY} "^install \+${P} \+/bin/true$" ${ROOTDIR}etc/modprobe.conf)
+ DATA=$(${GREPBINARY} "^install \+${P} \+/bin/(true|false)$" ${ROOTDIR}etc/modprobe.conf)
if [ -n "${DATA}" ]; then
LogText "Result: found ${P} module disabled via modprobe.conf"
UNCOMMON_PROTOCOL_DISABLED=1
@@ -759,7 +759,7 @@
# Then additional modprobe configuration files
if [ -d ${ROOTDIR}etc/modprobe.d ]; then
# Return file names (-l) and suppress errors (-s)
- DATA=$(${GREPBINARY} -l -s "^install \+${P} \+/bin/true$" ${ROOTDIR}etc/modprobe.d/*)
+ DATA=$(${GREPBINARY} -l -s "^install \+${P} \+/bin/(true|false)$" ${ROOTDIR}etc/modprobe.d/*)
if [ -n "${DATA}" ]; then
UNCOMMON_PROTOCOL_DISABLED=1
for F in ${DATA}; do
diff --git a/include/tests_php b/include/tests_php
index bbda37b8..e2dabf35 100644
--- a/include/tests_php
+++ b/include/tests_php
@@ -30,8 +30,6 @@
# Possible locations of php.ini
PHPINILOCS="${ROOTDIR}etc/php.ini ${ROOTDIR}etc/php.ini.default \
${ROOTDIR}etc/php/php.ini \
- ${ROOTDIR}etc/php5.5/php.ini \
- ${ROOTDIR}etc/php5.6/php.ini \
${ROOTDIR}etc/php7.0/php.ini \
${ROOTDIR}etc/php7.1/php.ini \
${ROOTDIR}etc/php7.2/php.ini \
@@ -42,11 +40,6 @@
${ROOTDIR}etc/php8.2/php.ini \
${ROOTDIR}etc/php8.3/php.ini \
${ROOTDIR}etc/php8.4/php.ini \
- ${ROOTDIR}etc/php/cgi-php5/php.ini \
- ${ROOTDIR}etc/php/cli-php5/php.ini \
- ${ROOTDIR}etc/php/apache2-php5/php.ini \
- ${ROOTDIR}etc/php/apache2-php5.5/php.ini \
- ${ROOTDIR}etc/php/apache2-php5.6/php.ini \
${ROOTDIR}etc/php/apache2-php7.0/php.ini \
${ROOTDIR}etc/php/apache2-php7.1/php.ini \
${ROOTDIR}etc/php/apache2-php7.2/php.ini \
@@ -57,16 +50,11 @@
${ROOTDIR}etc/php/apache2-php8.2/php.ini \
${ROOTDIR}etc/php/apache2-php8.3/php.ini \
${ROOTDIR}etc/php/apache2-php8.4/php.ini \
- ${ROOTDIR}etc/php/cgi-php5.5/php.ini \
- ${ROOTDIR}etc/php/cgi-php5.6/php.ini \
${ROOTDIR}etc/php/cgi-php7.0/php.ini \
${ROOTDIR}etc/php/cgi-php7.1/php.ini \
${ROOTDIR}etc/php/cgi-php7.2/php.ini \
${ROOTDIR}etc/php/cgi-php7.3/php.ini \
${ROOTDIR}etc/php/cgi-php7.4/php.ini \
- ${ROOTDIR}etc/php/cgi-php8.0/php.ini \
- ${ROOTDIR}etc/php/cgi-php8.1/php.ini \
- ${ROOTDIR}etc/php/cgi-php8.2/php.ini \
${ROOTDIR}etc/php/cli-php5.5/php.ini \
${ROOTDIR}etc/php/cli-php5.6/php.ini \
${ROOTDIR}etc/php/cli-php7.0/php.ini \
@@ -79,8 +67,6 @@
${ROOTDIR}etc/php/cli-php8.2/php.ini \
${ROOTDIR}etc/php/cli-php8.3/php.ini \
${ROOTDIR}etc/php/cli-php8.4/php.ini \
- ${ROOTDIR}etc/php/embed-php5.5/php.ini \
- ${ROOTDIR}etc/php/embed-php5.6/php.ini \
${ROOTDIR}etc/php/embed-php7.0/php.ini \
${ROOTDIR}etc/php/embed-php7.1/php.ini \
${ROOTDIR}etc/php/embed-php7.2/php.ini \
@@ -91,24 +77,14 @@
${ROOTDIR}etc/php/embed-php8.2/php.ini \
${ROOTDIR}etc/php/embed-php8.3/php.ini \
${ROOTDIR}etc/php/embed-php8.4/php.ini \
- ${ROOTDIR}etc/php/fpm-php8.2/php.ini \
- ${ROOTDIR}etc/php/fpm-php8.1/php.ini \
- ${ROOTDIR}etc/php/fpm-php8.0/php.ini \
- ${ROOTDIR}etc/php/fpm-php7.4/php.ini \
- ${ROOTDIR}etc/php/fpm-php7.3/php.ini \
- ${ROOTDIR}etc/php/fpm-php7.2/php.ini \
- ${ROOTDIR}etc/php/fpm-php7.1/php.ini \
${ROOTDIR}etc/php/fpm-php7.0/php.ini \
- ${ROOTDIR}etc/php/fpm-php5.5/php.ini \
- ${ROOTDIR}etc/php/fpm-php5.6/php.ini \
- ${ROOTDIR}etc/php5/cgi/php.ini \
- ${ROOTDIR}etc/php5/cli/php.ini \
- ${ROOTDIR}etc/php5/cli-php5.4/php.ini \
- ${ROOTDIR}etc/php5/cli-php5.5/php.ini \
- ${ROOTDIR}etc/php5/cli-php5.6/php.ini \
- ${ROOTDIR}etc/php5/apache2/php.ini \
- ${ROOTDIR}etc/php5/fpm/php.ini \
- ${ROOTDIR}private/etc/php.ini \
+ ${ROOTDIR}etc/php/fpm-php7.1/php.ini \
+ ${ROOTDIR}etc/php/fpm-php7.2/php.ini \
+ ${ROOTDIR}etc/php/fpm-php7.3/php.ini \
+ ${ROOTDIR}etc/php/fpm-php7.4/php.ini \
+ ${ROOTDIR}etc/php/fpm-php8.0/php.ini \
+ ${ROOTDIR}etc/php/fpm-php8.1/php.ini \
+ ${ROOTDIR}etc/php/fpm-php8.2/php.ini \
${ROOTDIR}etc/php/7.0/apache2/php.ini \
${ROOTDIR}etc/php/7.1/apache2/php.ini \
${ROOTDIR}etc/php/7.2/apache2/php.ini \
@@ -139,12 +115,30 @@
${ROOTDIR}etc/php/8.3/fpm/php.ini \
${ROOTDIR}etc/php/8.4/cli/php.ini \
${ROOTDIR}etc/php/8.4/fpm/php.ini \
+ ${ROOTDIR}opt/alt/php70/etc/php.ini \
+ ${ROOTDIR}opt/alt/php71/etc/php.ini \
+ ${ROOTDIR}opt/alt/php72/etc/php.ini \
+ ${ROOTDIR}opt/alt/php73/etc/php.ini \
+ ${ROOTDIR}opt/alt/php74/etc/php.ini \
+ ${ROOTDIR}opt/alt/php80/etc/php.ini \
+ ${ROOTDIR}opt/alt/php81/etc/php.ini \
+ ${ROOTDIR}opt/alt/php82/etc/php.ini \
+ ${ROOTDIR}opt/alt/php83/etc/php.ini \
+ ${ROOTDIR}opt/alt/php84/etc/php.ini \
+ ${ROOTDIR}opt/cpanel/ea-php70/root/etc/php.ini \
+ ${ROOTDIR}opt/cpanel/ea-php71/root/etc/php.ini \
+ ${ROOTDIR}opt/cpanel/ea-php72/root/etc/php.ini \
+ ${ROOTDIR}opt/cpanel/ea-php73/root/etc/php.ini \
+ ${ROOTDIR}opt/cpanel/ea-php74/root/etc/php.ini \
+ ${ROOTDIR}opt/cpanel/ea-php80/root/etc/php.ini \
+ ${ROOTDIR}opt/cpanel/ea-php81/root/etc/php.ini \
+ ${ROOTDIR}opt/cpanel/ea-php82/root/etc/php.ini \
+ ${ROOTDIR}opt/cpanel/ea-php83/root/etc/php.ini \
+ ${ROOTDIR}opt/cpanel/ea-php84/root/etc/php.ini \
+ ${ROOTDIR}private/etc/php.ini \
${ROOTDIR}var/www/conf/php.ini \
${ROOTDIR}usr/local/etc/php.ini \
${ROOTDIR}usr/local/lib/php.ini \
- ${ROOTDIR}usr/local/etc/php5/cgi/php.ini \
- ${ROOTDIR}usr/local/php54/lib/php.ini \
- ${ROOTDIR}usr/local/php56/lib/php.ini \
${ROOTDIR}usr/local/php70/lib/php.ini \
${ROOTDIR}usr/local/php71/lib/php.ini \
${ROOTDIR}usr/local/php72/lib/php.ini \
@@ -157,36 +151,6 @@
${ROOTDIR}usr/local/php84/lib/php.ini \
${ROOTDIR}usr/local/zend/etc/php.ini \
${ROOTDIR}usr/pkg/etc/php.ini \
- ${ROOTDIR}opt/cpanel/ea-php54/root/etc/php.ini \
- ${ROOTDIR}opt/cpanel/ea-php55/root/etc/php.ini \
- ${ROOTDIR}opt/cpanel/ea-php56/root/etc/php.ini \
- ${ROOTDIR}opt/cpanel/ea-php70/root/etc/php.ini \
- ${ROOTDIR}opt/cpanel/ea-php71/root/etc/php.ini \
- ${ROOTDIR}opt/cpanel/ea-php72/root/etc/php.ini \
- ${ROOTDIR}opt/cpanel/ea-php73/root/etc/php.ini \
- ${ROOTDIR}opt/cpanel/ea-php74/root/etc/php.ini \
- ${ROOTDIR}opt/cpanel/ea-php80/root/etc/php.ini \
- ${ROOTDIR}opt/cpanel/ea-php81/root/etc/php.ini \
- ${ROOTDIR}opt/cpanel/ea-php82/root/etc/php.ini \
- ${ROOTDIR}opt/cpanel/ea-php83/root/etc/php.ini \
- ${ROOTDIR}opt/cpanel/ea-php84/root/etc/php.ini \
- ${ROOTDIR}opt/alt/php44/etc/php.ini \
- ${ROOTDIR}opt/alt/php51/etc/php.ini \
- ${ROOTDIR}opt/alt/php52/etc/php.ini \
- ${ROOTDIR}opt/alt/php53/etc/php.ini \
- ${ROOTDIR}opt/alt/php54/etc/php.ini \
- ${ROOTDIR}opt/alt/php55/etc/php.ini \
- ${ROOTDIR}opt/alt/php56/etc/php.ini \
- ${ROOTDIR}opt/alt/php70/etc/php.ini \
- ${ROOTDIR}opt/alt/php71/etc/php.ini \
- ${ROOTDIR}opt/alt/php72/etc/php.ini \
- ${ROOTDIR}opt/alt/php73/etc/php.ini \
- ${ROOTDIR}opt/alt/php74/etc/php.ini \
- ${ROOTDIR}opt/alt/php80/etc/php.ini \
- ${ROOTDIR}opt/alt/php81/etc/php.ini \
- ${ROOTDIR}opt/alt/php82/etc/php.ini \
- ${ROOTDIR}opt/alt/php83/etc/php.ini \
- ${ROOTDIR}opt/alt/php84/etc/php.ini \
${ROOTDIR}etc/opt/remi/php56/php.ini \
${ROOTDIR}etc/opt/remi/php70/php.ini \
${ROOTDIR}etc/opt/remi/php71/php.ini \
@@ -198,28 +162,12 @@
${ROOTDIR}etc/opt/remi/php82/php.ini\
${ROOTDIR}etc/opt/remi/php83/php.ini \
${ROOTDIR}etc/opt/remi/php84/php.ini"
- # HEADS-UP: OpenBSD, last two releases are supported, and snapshots of -current
- PHPINILOCS="${PHPINILOCS} \
- ${ROOTDIR}etc/php-5.6.ini \
- ${ROOTDIR}etc/php-7.0.ini \
- ${ROOTDIR}etc/php-7.1.ini \
- ${ROOTDIR}etc/php-7.2.ini \
- ${ROOTDIR}etc/php-7.3.ini \
- ${ROOTDIR}etc/php-7.4.ini \
- ${ROOTDIR}etc/php-8.0.ini \
- ${ROOTDIR}etc/php-8.1.ini \
- ${ROOTDIR}etc/php-8.2.ini\
- ${ROOTDIR}etc/php-8.3.ini\
- ${ROOTDIR}etc/php-8.4.ini"
- PHPINIDIRS="${ROOTDIR}etc/php5/conf.d \
- ${ROOTDIR}etc/php/7.0/cli/conf.d \
+
+ PHPINIDIRS="${ROOTDIR}etc/php/7.0/cli/conf.d \
${ROOTDIR}etc/php/7.1/cli/conf.d \
${ROOTDIR}etc/php/7.2/cli/conf.d \
${ROOTDIR}etc/php/7.3/cli/conf.d \
${ROOTDIR}etc/php/7.4/cli/conf.d \
- ${ROOTDIR}etc/php/8.0/cli/conf.d \
- ${ROOTDIR}etc/php/8.1/cli/conf.d \
- ${ROOTDIR}etc/php/8.2/cli/conf.d \
${ROOTDIR}etc/php/7.0/fpm/conf.d \
${ROOTDIR}etc/php/7.1/fpm/conf.d \
${ROOTDIR}etc/php/7.2/fpm/conf.d \
@@ -231,9 +179,6 @@
${ROOTDIR}etc/php/8.3/fpm/conf.d \
${ROOTDIR}etc/php/8.4/fpm/conf.d \
${ROOTDIR}etc/php.d \
- ${ROOTDIR}opt/cpanel/ea-php54/root/etc/php.d \
- ${ROOTDIR}opt/cpanel/ea-php55/root/etc/php.d \
- ${ROOTDIR}opt/cpanel/ea-php56/root/etc/php.d \
${ROOTDIR}opt/cpanel/ea-php70/root/etc/php.d \
${ROOTDIR}opt/cpanel/ea-php71/root/etc/php.d \
${ROOTDIR}opt/cpanel/ea-php72/root/etc/php.d \
@@ -244,13 +189,6 @@
${ROOTDIR}opt/cpanel/ea-php82/root/etc/php.d \
${ROOTDIR}opt/cpanel/ea-php83/root/etc/php.d \
${ROOTDIR}opt/cpanel/ea-php84/root/etc/php.d \
- ${ROOTDIR}opt/alt/php44/etc/php.d.all \
- ${ROOTDIR}opt/alt/php51/etc/php.d.all \
- ${ROOTDIR}opt/alt/php52/etc/php.d.all \
- ${ROOTDIR}opt/alt/php53/etc/php.d.all \
- ${ROOTDIR}opt/alt/php54/etc/php.d.all \
- ${ROOTDIR}opt/alt/php55/etc/php.d.all \
- ${ROOTDIR}opt/alt/php56/etc/php.d.all \
${ROOTDIR}opt/alt/php70/etc/php.d.all \
${ROOTDIR}opt/alt/php71/etc/php.d.all \
${ROOTDIR}opt/alt/php72/etc/php.d.all \
@@ -272,9 +210,8 @@
${ROOTDIR}usr/local/php82/lib/php.conf.d \
${ROOTDIR}usr/local/php83/lib/php.conf.d \
${ROOTDIR}usr/local/php84/lib/php.conf.d"
- # HEADS-UP: OpenBSD, last two releases are supported, and snapshots of -current
+
PHPINIDIRS="${PHPINIDIRS} \
- ${ROOTDIR}etc/php-5.6 \
${ROOTDIR}etc/php-7.0 \
${ROOTDIR}etc/php-7.1 \
${ROOTDIR}etc/php-7.2 \
diff --git a/include/tests_ports_packages b/include/tests_ports_packages
index 81babdc3..42288a07 100644
--- a/include/tests_ports_packages
+++ b/include/tests_ports_packages
@@ -127,11 +127,15 @@
LogText "Test: Querying brew to get package list"
Display --indent 4 --text "- Querying brew for installed packages"
LogText "Output:"; LogText "-----"
- GPACKAGES=$(brew list)
- for J in ${GPACKAGES}; do
- LogText "Found package ${J}"
- INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${J}"
- done
+ GPACKAGES=$(brew list --versions)
+ while IFS= read -r PKG; do
+ PACKAGE_NAME=$(echo ${PKG} | ${CUTBINARY} -d ' ' -f1)
+ PACKAGE_VERSION=$(echo ${PKG} | ${CUTBINARY} -d ' ' -f2)
+ LogText "Found package: ${PACKAGE_NAME} (version: ${PACKAGE_VERSION})"
+ INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${PACKAGE_NAME},${PACKAGE_VERSION}"
+ done << EOF
+$GPACKAGES
+EOF
else
LogText "Result: brew can NOT be found on this system"
fi
@@ -158,6 +162,29 @@
LogText "Result: emerge can NOT be found on this system"
fi
#
+#################################################################################
+#
+ # Test : PKGS-7305
+ # Description : Query macOS Apps in /Applications and CoreServices
+ Register --test-no PKGS-7305 --os macOS --weight L --network NO --category security --description "Query macOS Apps in /Applications and CoreServices"
+ if [ ${SKIPTEST} -eq 0 ]; then
+ LogText "Test: Querying Apps in /Applications"
+ Display --indent 4 --text "- Querying macOS Apps in /Applications"
+ LogText "Output:"; LogText "-----"
+ for APP in /Applications/*.app; do
+ PACKAGE_NAME=$(basename "$APP" .app)
+ PACKAGE_VERSION=$(defaults read "$APP/Contents/Info" CFBundleShortVersionString 2>/dev/null || echo "N/A")
+ LogText "Found package: ${PACKAGE_NAME} (version: ${PACKAGE_VERSION})"
+ INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${PACKAGE_NAME},${PACKAGE_VERSION}"
+ done
+ Display --indent 4 --text "- Querying Apple CoreServices"
+ for CS in /Library/Apple/System/Library/CoreServices/*.app; do
+ PACKAGE_NAME=$(basename "$CS" .app)
+ PACKAGE_VERSION=$(defaults read "$CS/Contents/Info" CFBundleShortVersionString 2>/dev/null || echo "N/A")
+ LogText "Found CoreServices: ${PACKAGE_NAME} (version: ${PACKAGE_VERSION})"
+ INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${PACKAGE_NAME},${PACKAGE_VERSION}"
+ done
+ fi
#
#################################################################################
#
@@ -672,9 +699,20 @@
# Check in /etc/cron.hourly, daily, weekly, monthly etc
COUNT=$(find /etc/cron* -name debsums | wc -l)
if [ ${COUNT} -gt 0 ]; then
- LogText "Result: Cron job is configured for debsums utility."
- Display --indent 6 --text "- Cron job for debsums" --result "${STATUS_FOUND}" --color GREEN
- AddHP 3 3
+ CRON_CHECK=""
+ if [ -f ${ROOTDIR}etc/default/debsums ]; then
+ CRON_CHECK=$(${GREPBINARY} CRON_CHECK /etc/default/debsums|${AWKBINARY} -F "=" '{print $2}')
+ fi
+ if [ "${CRON_CHECK}" = "daily" ] || [ "${CRON_CHECK}" = "weekly" ] || [ "${CRON_CHECK}" = "monthly" ]; then
+ LogText "Result: Cron job is configured for debsums utility."
+ Display --indent 6 --text "- Cron job for debsums" --result "${STATUS_FOUND}" --color GREEN
+ AddHP 3 3
+ else
+ LogText "Result: Cron job is not configured for debsums utility."
+ Display --indent 6 --text "- Cron job for debsums" --result "${STATUS_NOT_FOUND}" --color YELLOW
+ AddHP 1 3
+ ReportSuggestion "${TEST_NO}" "Check debsums configuration and enable checking regularly via a cron job (CRON_CHECK in default file)."
+ fi
else
LogText "Result: Cron job is not configured for debsums utility."
Display --indent 6 --text "- Cron job for debsums" --result "${STATUS_NOT_FOUND}" --color YELLOW
diff --git a/include/tests_ssh b/include/tests_ssh
index 6ab6f193..43bf7145 100644
--- a/include/tests_ssh
+++ b/include/tests_ssh
@@ -312,7 +312,7 @@
# AllowGroups
FIND=$(${GREPBINARY} -E -i "^AllowGroups" ${SSH_DAEMON_OPTIONS_FILE} | ${AWKBINARY} '{ print $2 }')
if [ -n "${FIND}" ]; then
- LogText "Result: AllowUsers set ${FIND}"
+ LogText "Result: AllowGroups set ${FIND}"
Display --indent 4 --text "- OpenSSH option: AllowGroups" --result "${STATUS_FOUND}" --color GREEN
FOUND=1
else
diff --git a/include/tests_webservers b/include/tests_webservers
index 1dbde636..4d56e1a8 100644
--- a/include/tests_webservers
+++ b/include/tests_webservers
@@ -48,6 +48,8 @@
TMPFILE="${TEMP_FILE}"
CreateTempFile || ExitFatal
TMPFILE2="${TEMP_FILE}"
+ CreateTempFile || ExitFatal
+ TMPFILE3="${TEMP_FILE}"
#
#################################################################################
#
@@ -300,8 +302,42 @@
#
#################################################################################
#
- # Test : HTTP-6660 TODO
+ # Test : HTTP-6660
# Description : Search for "TraceEnable off" in configuration files
+ if [ ${APACHE_INSTALLED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
+ Register --test-no HTTP-6660 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking Apache security setting: TraceEnable"
+ if [ ${SKIPTEST} -eq 0 ]; then
+ for DIR in ${sTEST_APACHE_TARGETS}; do
+ if [ -d ${DIR} ]; then
+ find ${DIR} -name "*.conf" -print >> ${TMPFILE3}
+ fi
+ done
+
+ # Check all Apache conf-files for TraceEnable
+ if [ -f ${TMPFILE3} ]; then
+ Display --indent 2 --text '- Checking TraceEnable setting in:'
+ for APACHE_CONFFILE in $(cat ${TMPFILE3}); do
+ TRACEENABLE=$( ${GREPBINARY} -i -E '^TraceEnable' ${APACHE_CONFFILE} | ${AWKBINARY} '{print $2}' )
+ if [ ! ${TRACEENABLE} ]; then
+ LogText "Result: no TraceEnable setting found in ${APACHE_CONFFILE}"
+ Display --indent 4 --text " ${APACHE_CONFFILE}" --result "${STATUS_NOT_FOUND}" --color WHITE
+ else
+ TRACEENABLED_SETTING=$( echo ${TRACEENABLE} | tr 'A-Z' 'a-z' )
+ if [ x${TRACEENABLED_SETTING} == x'off' ]; then
+ LogText "Result: found TraceEnable setting set to 'off' in ${APACHE_CONFFILE}"
+ Report "Apache setting: 'TraceEnable Off' in ${APACHE_CONFFILE}"
+ Display --indent 4 --text " ${APACHE_CONFFILE}" --result "${STATUS_FOUND}" --color GREEN
+ else
+ LogText "Result: found TraceEnable setting set to '"${TRACEENABLE}"' in ${APACHE_CONFFILE}"
+ Report "Apache setting: 'TraceEnable "${TRACEENABLE}"' in ${APACHE_CONFFILE}"
+ Display --indent 4 --text " ${APACHE_CONFFILE}" --result "${STATUS_SUGGESTION}" --color YELLOW
+ ReportSuggestion "${TEST_NO}" "Consider setting 'TraceEnable Off' in ${APACHE_CONFFILE}" "Set TraceEnable to 'On' or 'extended' for testing and diagnostic purposes only."
+ fi
+ fi
+ done
+ rm -f ${TMPFILE3}
+ fi
+ fi
#
#################################################################################
#
@@ -608,6 +644,7 @@
# Remove temp file (double check)
if [ -n "${TMPFILE}" ]; then if [ -f ${TMPFILE} ]; then rm -f ${TMPFILE}; fi; fi
if [ -n "${TMPFILE2}" ]; then if [ -f ${TMPFILE2} ]; then rm -f ${TMPFILE2}; fi; fi
+ if [ -n "${TMPFILE3}" ]; then if [ -f ${TMPFILE3} ]; then rm -f ${TMPFILE3}; fi; fi
WaitForKeyPress
diff --git a/lynis b/lynis
index 9ae06b67..95135e92 100755
--- a/lynis
+++ b/lynis
@@ -52,7 +52,7 @@
PROGRAM_SOURCE="https://github.com/CISOfy/lynis"
PROGRAM_PACKAGE="https://packages.cisofy.com/"
PROGRAM_DOCUMENTATION="https://cisofy.com/docs/"
- PROGRAM_COPYRIGHT="2007-2021, ${PROGRAM_AUTHOR} - ${PROGRAM_WEBSITE}"
+ PROGRAM_COPYRIGHT="2007-2024, ${PROGRAM_AUTHOR} - ${PROGRAM_WEBSITE}"
PROGRAM_LICENSE="${PROGRAM_NAME} comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
welcome to redistribute it under the terms of the GNU General Public License.
See the LICENSE file for details about using this software."
@@ -1018,7 +1018,7 @@ ${NORMAL}
if [ "${TEST_GROUP_TO_CHECK}" = "all" ]; then
LogText "Info: perform tests from all categories"
- INCLUDE_TESTS="boot_services kernel memory_processes authentication shells \
+ INCLUDE_TESTS="boot_services kernel memory_processes authentication kerberos shells \
filesystems usb storage storage_nfs nameservices dns ports_packages networking printers_spoolers \
mail_messaging firewalls webservers ssh snmp databases ldap php squid logging \
insecure_services banners scheduling accounting time crypto virtualization containers \