prehistoric-systems/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2026-03-11 08:55:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
2213 commits 2 branches 65 tags 12 MiB
Commit graph

1474 commits

Author SHA1 Message Date
Michael Boelen
4ba9882335
Added notes 2018-01-23 17:37:27 +01:00
mslifcak
84ea9530d7 restore UsePrivilegeSeparation to list of ssh daemon checks (#509) 2018-01-23 17:35:34 +01:00
Michael Boelen
2bf6a5e038
Overhaul of default profile settings and parsing 2018-01-23 15:01:02 +01:00
Michael Boelen
6192cbd8fa
Update tests to reflect new style profile configuration 2018-01-23 15:00:34 +01:00
Michael Boelen
18bd61ebec
Deprecate internal updater options 2018-01-23 14:37:02 +01:00
Michael Boelen
85c83102df
Add 'compliance-standards' as profile option, compliance_standards will be deprecated 2018-01-23 14:36:04 +01:00
Michael Boelen
3ba399c4c3
Mark deprecated options as a warning 2018-01-23 14:29:37 +01:00
melak
0b2cd02f0d Fix/amend DHCP client detection (#513) 
- dhcpd is a server; the client is dhcpcd

- While here, add udhcpc to the list of recognised DHCP clients
 2018-01-21 12:29:49 +01:00
mslifcak
e0e76c97df also find exim4 in MAIL-8802 (#512) 2018-01-20 17:32:26 +01:00
Michael Boelen
3da779f62c
Added 'system-groups' option for Enterprise users 2018-01-19 20:01:06 +01:00
Michael Boelen
1bf789861d
Add possibility to define an array of allowed operating systems for a test 2018-01-18 20:26:19 +01:00
Michael Boelen
18feb2356b
[TIME-3170] Chrony NetBSD support 2018-01-18 20:14:38 +01:00
Michael Boelen
c6269941b3
Added lsmod binary 2018-01-18 16:54:45 +01:00
Michael Boelen
fcb421e458
Added vgdisplay binary 2018-01-18 16:53:39 +01:00
Michael Boelen
cb8ab96308
Added GRUB conf file 2018-01-18 16:52:30 +01:00
Michael Boelen
503b2662c6
Implemented NetBSD patch: use correct syntax to compare values 2018-01-18 16:50:23 +01:00
mslifcak
6c257d6224 touchup BOOT_LOADER_SEARCHED setting for BOOT-5106 and BOOT-5108 (#511) 2018-01-18 16:36:43 +01:00
Michael Boelen
6e549eb545
Set ip binary 2018-01-18 16:23:55 +01:00
Michael Boelen
3957ca32cd
Minor code enhancements 2018-01-18 16:23:23 +01:00
Michael Boelen
173068b402
Added getcap and grpck back 2018-01-18 11:10:11 +01:00
Michael Boelen
4f751c9037
Remove service manager reference from systemctl, minor cleanup 2018-01-18 10:23:39 +01:00
Michael Boelen
182ce09bc1
Additional code enhancements 2018-01-18 09:19:06 +01:00
Michael Boelen
8934042473
Code enhancements 2018-01-17 17:26:30 +01:00
mslifcak
25b3c4f1eb VBoxService running is another VirtualBox clue (#505) 2018-01-17 17:19:51 +01:00
BlessJah
d7d42d9103 remove non printable characters from code (#470) 
Non printable ESC character is required to obtain terminal escape
sequence i.e. for changing output color.

Such sequences (especially ESC character) were replaced by command
substitution producing exactly same result (variable value), but using
only "safe" characters.

Use of printf and especialy '\033' or '\0ddd' sequences is described
here:
http://pubs.opengroup.org/onlinepubs/9699919799/utilities/printf.html#tag_20_94_13

Use of $(command) or command substitution is described here:
http://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_06_03

Verbatim TAB characters were replaced with \t escape sequence as
described to avoid problems with editors silently replacing them or
developer accidentialy messing up the regex.
 2018-01-17 17:12:36 +01:00
mslifcak
173843bdfd Pin svc mgr (#506) 
* systemctl does not mean systemd is used

* Check for systemd active

* determine service manager if not already set
 2018-01-17 15:56:19 +01:00
Michael Boelen
9ba5d200ad
Enhancements to reduce file access and removing unneeded variables 2018-01-17 14:46:29 +01:00
mslifcak
2c774b8795 sort BIN_PATHS before process (#510) 2018-01-17 13:49:07 +01:00
Jason Soto
73e0e7b5e4 Changed Process name search for Bitdefender test. (#503) 
* Added php.ini locations for Ubuntu 16.04LTS

* Switched Process name Search Bitdefender

* Switched Process name Search Bitdefender
 2018-01-13 12:55:16 +01:00
Michael Boelen
b236e7d95d
[PHP-2379] added quotes 2018-01-13 12:53:50 +01:00
Michael Boelen
b4758e0b23
Use PATH variable as first method to scan directories 2018-01-11 12:05:21 +01:00
Michael Boelen
541996f672
Rename variable 2018-01-11 10:38:11 +01:00
Michael Boelen
00ad535c6b
Use different variable in for loop 2018-01-11 10:37:56 +01:00
Michael Boelen
35a1524d07
Added alias for skipping plugins 2018-01-11 10:19:29 +01:00
Michael Boelen
1504370e41
Added solution, extended timestamps key values, allow multiple values 2018-01-11 10:19:16 +01:00
Michael Boelen
66f8cb2441
Changed year 2018-01-11 09:50:26 +01:00
n[oO]ne
aebb0c8ed4 lynis should not suggest suhosin for PHP 7 (#498) 2018-01-11 09:47:47 +01:00
Michael Boelen
c487bcb277
\-C flag of ps is different on BSD 2017-12-24 14:05:55 +01:00
Michael Boelen
4042c45954
Changes for new plugin class 'hardware' 2017-12-08 09:37:55 +01:00
Shaleen Jain
21b129f947 Fix detecting systemd timedate deamon (#494) 
Fix detecting systemd timedate daemon
 2017-11-29 15:59:07 +01:00
Michael Boelen
e4cb190237
Support for allow-auto-purge option in profiles 2017-11-25 16:11:04 +01:00
wschaft
c453331265 fixing "Repository listed more than once" issue (#449) (#490) 2017-11-08 19:20:20 +01:00
Katarina Durechova
09de901d11 Check zero size of files correctly (#487) 
from man test:
-s FILE
    FILE exists and has a size greater than zero

-z STRING
    the length of STRING is zero
 2017-10-31 09:05:29 +01:00
Michael Boelen
e5c11991ef
Code enhancements and textual change 2017-10-29 11:26:25 +01:00
Michael Boelen
ebf16462a8
Improve IsRunning function to match full process names 2017-10-29 10:54:40 +01:00
Michael Boelen
011e6248c2
Use full match for Little Snitch 2017-10-29 10:54:16 +01:00
Michael Boelen
764c18c218
Code enhancements, improve detection for Puppet 2017-10-29 10:52:42 +01:00
Michael Boelen
331422384a
Added --silent as parameter for --quiet 2017-10-29 10:26:18 +01:00
Michael Boelen
d13cdda1e3
Filter only relevant messages for report 2017-10-26 08:23:15 +02:00
Michael Boelen
b29732bf5f
Spacing and readability 2017-10-24 14:15:59 +02:00
Michael Boelen
c5e014eaf4
Corrected description 2017-10-24 13:39:41 +02:00
James White
45748184a8 Add additional DirectAdmin paths for php.ini (#479) 2017-10-24 13:16:59 +02:00
Michael Boelen
539fe2242a
Merge branch 'master' of https://github.com/CISOfy/lynis 2017-10-19 19:38:36 +02:00
Michael Boelen
9d238f6e78
Added HP-UX routine for GetHostID 2017-10-19 19:37:25 +02:00
dataking
099c3b4468 fix for issue #453; simply add RPi/Raspian path to PAM_FILE_LOCATIONS (#475) 2017-10-19 11:33:09 +02:00
vins1993
6a74a8727f Fix displayed result for signing keys check (#466) 
The result of the signing keys check is saved under KEYS_USED variable,
but SSL_USED was used to present the result to the end user.
 2017-09-21 15:09:57 +02:00
Michael Boelen
19bbc4272f
[SHLL-6220] Improved detection of shell settings like TMOUT 2017-09-18 19:50:41 +02:00
Michael Boelen
76b4afb14d
[SSH-7408] set default 'delayed' compression as a sane value 2017-09-18 19:18:11 +02:00
Michael Boelen
94f656bf65
Add 127.0.1.1 to NETW-2704 test 2017-09-17 20:01:07 +02:00
Michael Boelen
3670e0c5c9
Minor changes to using local resolvers 2017-09-16 14:25:01 +02:00
Michael Boelen
83ce145f1b
Merge branch 'master' of https://github.com/CISOfy/lynis 2017-09-16 14:10:20 +02:00
Ben Abrams
192cc494ed [NETW-2705] This is related to #437 and resolvconf but is split up. (#459) 
This specifically makes it so that when `/etc/resolv.conf` has one or more nameservers matching `127.0.[0-1].1` it should not warn as it is using local resolvers.

We are simply using `grep -c "127.0.[0-1].1" /etc/resolv.conf` to determine this.
 2017-09-16 14:09:32 +02:00
Michael Boelen
11f81345ee
Code enhancement 2017-09-16 14:08:38 +02:00
Michael Boelen
499f7d5015
Improve process detection 2017-09-16 14:08:26 +02:00
FlorentCoppint
ccf9db18f8 Improved IsRunning() process matching (#463) 2017-09-16 13:58:04 +02:00
Michael Boelen
79278c32ef
Added extra legal words for banners 2017-09-12 15:23:37 +02:00
Michael Boelen
c248ab6a16
[CRYP-7902] fix for bourne shell and rewrite 2017-09-06 12:56:32 +02:00
Michael Boelen
2451029a6e
Allow for files with spaces 2017-09-06 12:55:56 +02:00
Michael Boelen
77400d3952
Improve logging 2017-09-05 13:29:21 +02:00
Brian Ginsbach
30c58dd1ed Don't assume sshd version is in first line (#452) 
There are some versions of OpenSSH where the version information
isn't in the first line (like NetBSD's with the HPN patches).
 2017-09-04 15:33:28 +02:00
Tom Reynolds
41174afda6 Do not limit debsums to Debian systems (#457) 
Debsums is supported on Debian and other systems as per GitHub issue #446. 
Undo commit d1969001c6.
 2017-09-04 15:30:25 +02:00
Michael Boelen
0fc8adb3c5
When providing suggestion related to hostid, append to file instead of overwriting 2017-08-31 17:11:15 +02:00
Michael Boelen
769b1f49e2
Detection of Linux Mint missed right field 2017-08-31 17:04:17 +02:00
Bruno Vernay
6cf1c324f8 Support spaces in file names (#445) 
* Support spaces in file names

File names may contain spaces

* Fixed 2more cases
 2017-08-29 14:33:18 +02:00
Bruno Vernay
4107d8a461 Support spaces in file names (#444) 
File names may contain spaces
 2017-08-29 14:32:42 +02:00
Brian Ginsbach
3512068a49 [PKGS-7380] Fix NetBSD packages vulnerabilities file name (#443) 
* [PKGS-7380] Fix NetBSD packages vulnerabilities file name

* OS Detection: Add early Mac OS X releases
 2017-08-19 10:53:25 +02:00
Michael Boelen
d682673c63
Preparations for APT 2017-08-19 10:51:06 +02:00
Michael Boelen
06491a5b4f
Linux Mint detection 2017-08-19 10:50:53 +02:00
Michael Boelen
1190efac2b
[CRYP-7902] add a test to filter out non-certificate files 2017-08-18 19:19:15 +02:00
Michael Boelen
4a673aebc7
[CRYP-7902] certificate validation changed 2017-08-18 14:14:28 +02:00
Michael Boelen
00648a636c
Improve systemd detection 2017-08-17 20:28:32 +02:00
Michael Boelen
c0a6aaf855
[TOOL-5002] performance enhancement to reduce number of dirs/files to check 2017-08-17 20:10:51 +02:00
Michael Boelen
5be81289ee
[TOOL-5002] rewrite of Ansible detection 2017-08-17 20:06:41 +02:00
Michael Boelen
43228c2ca7
[TOOL-5002] Ansible detection added 2017-08-17 14:20:54 +02:00
Michael Boelen
358dc46b81
Ignore file access errors when trying to access them 2017-08-17 14:18:29 +02:00
Michael Boelen
77ebb23320
[HRDN-7230] Show single line when no malware scanner was detected 2017-08-17 14:17:57 +02:00
Lukas Pirl
b3dffbf750 remove test for deprecated sshd option UsePrivilegeSeparation (#432) 
see also https://www.openssh.com/txt/release-7.5
 2017-08-16 20:33:33 +02:00
Tom H
3adeac922e Do not unset PHPVERSION after detect it (#438) 2017-08-16 20:33:11 +02:00
Jason Soto
5b81f625a6 Added php.ini locations for Ubuntu 16.04LTS (#439) 2017-08-16 20:32:55 +02:00
Michael Boelen
a547953d99
Set default log directory, or allow it be set per OS 2017-08-08 14:52:59 +02:00
Michael Boelen
4660362e74
Redirect errors like file permissions 2017-08-08 14:52:11 +02:00
Michael Boelen
49c1bf8d55
[NETW-3006] Updated detection of MAC addresses on Linux 2017-08-03 20:28:38 +02:00
Michael Boelen
4781b1c170
Added /opt/apache 2017-08-02 13:01:23 +02:00
Stéphane BARBARAY
9ca2d640b8 Enhanced detection for LXC and LXC over VM (#426) 
* Update functions

* Update functions

* Update tests_shells

* Update tests_shells

* Update IsVirtualMachine

extra check on /proc/1/environ existence + Log result
 2017-07-31 12:51:19 +02:00
Michael Boelen
dbec83566b
[FILE-6310] match mount points by exact name 2017-07-28 10:42:17 +02:00
Michael Boelen
ebc706aa64
Merge branch 'master' of https://github.com/CISOfy/lynis 2017-07-28 10:26:34 +02:00
alobodzinski
6147ebd47b Suhosin is hard linked into PHP on OpenBSD (#423) 2017-07-28 10:14:04 +02:00
Michael Boelen
60f94fef47
[CRYP-7902] prevent test from showing error on screen related to wrong certificate file 2017-07-18 11:51:45 +02:00
James White
d7b0c28699 Add /usr/lib/apache module search path for DirectAdmin (#417) 2017-07-11 09:26:00 +02:00
Michael Boelen
d1969001c6
[PKGS-7370] only use debsums test for Debian systems 2017-07-10 16:08:32 +02:00
Michael Boelen
df32cb29b0
Include instructions if hostid2 is empty 2017-07-10 16:07:39 +02:00
superpoussin22
29f5dc7e53 Update tests_containers (#412) 
last docker version no more use docker -d  sounds better to check dockerd
 2017-07-10 15:24:09 +02:00
(╯°□°）╯︵ uᴉǝssnH ɐɟɐʇsoW
3b66a22f39 Firewall check updates (#414) 
* Check if CSF is running

* Check for APF presence
 2017-07-10 15:23:32 +02:00
(╯°□°）╯︵ uᴉǝssnH ɐɟɐʇsoW
3a6fa0bb6b Suhosin simulation mode status (#411) 
* fix suhsoin check text

* use PHPINI_ALLFILES variable

* Check suhosin simulation mode status

* Small style improvement
 2017-07-10 14:38:42 +02:00
Jeremy Daer
f33cdd3a17 OS detection: macOS 10.13, High Sierra (#409) 2017-07-01 10:29:05 +02:00
Michael Boelen
f903b6f079
Allow tags and system-customer-name to be specified 2017-06-22 10:15:39 +02:00
Michael Boelen
f4b6d8d401
Show full command for remote usage 2017-06-21 14:28:12 +02:00
Daniel Romell
5b12f17e3f Minor fixes for embedded Linux. (#406) 
* Check if the "locale" binary is available before using it.

This is no functional change as it will still fall back to english
when the locale can't be determined. This fix gets rid of the
following error when running on systems without the locale binary:

./lynis: line 112: locale: command not found

Signed-off-by: Daniel Romell <daro@hms.se>

* tests_kernel: KRNL-5677: Fix invalid use of shell test.

This fixes an issue (syntax error) triggered on systems with no PAE or
NX extensions:

- Checking CPU support (NX/PAE)
/usr/libexec/lynis/include/tests_kernel: line 126: [: too many arguments
/usr/libexec/lynis/include/tests_kernel: line 132: [: too many arguments

No need to use [] when only looking at function return values.

Signed-off-by: Daniel Romell <daro@hms.se>
 2017-06-21 14:17:49 +02:00
Athmane Madjoudj
ac2c83870b Add lowercase path for changelog search (eg: Fedora/EPEL pkg) (#408) 2017-06-21 14:08:57 +02:00
(╯°□°）╯︵ uᴉǝssnH ɐɟɐʇsoW
98b80f7c49 add ini paths for cloudlinux (#400) 2017-06-14 14:07:37 +02:00
(╯°□°）╯︵ uᴉǝssnH ɐɟɐʇsoW
4cbe8f32c6 add suhosin status test (#401) 
* add suhosin status test

* get matched line only
 2017-06-14 14:06:51 +02:00
Jose Luis Duran
9dc4efefd6 Fix pkg audit option (#403) 
-F, --fetch
       Fetch the database before checking.

[ci skip]
 2017-06-14 14:06:18 +02:00
Michael Boelen
0e535c851a
Small style improvement 2017-05-31 15:47:21 +02:00
mslifcak
8d2b3a202f A250 2 (#398) 
* fix missing ROOTDIR prefix

* sort list of services before processing

* sort list of certificates before processing

* sort list of startup scripts before processing

* spell check

* remove possessive pronoun
 2017-05-31 15:40:39 +02:00
(╯°□°）╯︵ uᴉǝssnH ɐɟɐʇsoW
360be2a700 Add a check for csf testing mode (#399) 2017-05-31 15:37:22 +02:00
mslifcak
af60a2463a 250 fixes (#393) 
* restore use of lshw

* add ROOTDIR to restore lost PHP file ref

* refactor certificate search to benefit older "find" command
 2017-05-23 14:56:25 +02:00
Michael Boelen
aec9b57c29
Changes to BOOT-5104 and HTTP-6716 2017-05-08 14:56:39 +02:00
Michael Boelen
918b962ae5
Code enhancements 2017-05-03 10:42:34 +02:00
Michael Boelen
a9b67dc675
Reinitialize temporary files to prevent possible symlink attack - CVE-2017-8108 2017-05-03 09:47:35 +02:00
Michael Boelen
67333bb09a
[SHLL-6290] Removed ShellShock test as it is no longer needed - CVE-2017-8108 2017-05-03 09:33:40 +02:00
Michael Boelen
4ecb9d4d05
[bulk change] cleaning up, code enhancements, initialization of variables, and new tests 2017-04-30 17:59:35 +02:00
Michael Boelen
5ccd0912cf
[MALW-3280] Added detection of Symantic components 2017-04-29 14:22:40 +02:00
Michael Boelen
f39e72dbd5
Remove unused file 2017-04-23 20:19:30 +02:00
Michael Boelen
2340e7bbbc
Added HasData and IsEmpty function 2017-04-23 20:19:18 +02:00
Michael Boelen
a04b2da851
Initialize variables 2017-04-23 20:19:02 +02:00
Michael Boelen
70ea29483a
Code enhancements 2017-04-23 20:06:54 +02:00
Michael Boelen
9e9b95e1da
Apply substite for TIME-3148 and first batch of code enhancements 2017-04-23 20:06:24 +02:00
0ri0n
b433cf0bac Add Additional php.ini Paths (#377) 2017-04-17 15:38:48 +02:00
Michael Boelen
b0b0fd0256 Add atomic tests to report 2017-03-27 17:15:02 +02:00
Michael Boelen
e498e6ae64 Remove unused test parts 2017-03-27 17:14:34 +02:00
Michael Boelen
7f06a2c34f Added MAIL-8820 test for Postfix 2017-03-27 17:14:11 +02:00
Michael Boelen
e14376cdab Minor cleanups 2017-03-27 12:23:27 +02:00
Michael Boelen
b306ab891f Add additional check for Puppet tool 2017-03-27 12:21:42 +02:00
Athmane Madjoudj
5f0b24d2c8 Add support for cPanel PHP (Scl-based pacakging) GHT #340 (#373) 
* Add support for cPanel PHP (Scl-based pacakging) GHT #340

* Add myself to contributors as requested
 2017-03-27 09:21:37 +02:00
pyllyukko
88f39b9540 Fix regex to disregard locked accounts (#371) 
This way, accounts that have ":!!:" in shadow and have an entry in
"Password expires" field don't get flagged with "Result: password of
user XYZ has been expired" by AUTH-9288.

Fixes #362
 2017-03-27 09:19:55 +02:00
guyav
a0849ac053 Added quote marks on SSH commands (#372) 
Added quote marks for the SSH commands in steps and 6.
 2017-03-27 09:19:01 +02:00
Michael Boelen
57770fe332 [HTTP-6641] support Apache mod_reqtimeout module 2017-03-20 13:40:00 +01:00
Michael Boelen
90e240cfb5 [CUPS-2308] removed exception handler, improved logging 2017-03-20 13:12:55 +01:00
Yaisel Hurtado
4368013b43 Fixed detection of security repositories (#370) 2017-03-17 17:59:21 +00:00
Michael Boelen
9ff31074a1 Added more banner words 2017-03-17 10:37:14 +01:00
Michael Boelen
d8e41ca118 [CRYP-7902] Support for Plesk file names 2017-03-14 16:42:39 +01:00
Michael Boelen
352ea8c21c Added missing pipe 2017-03-13 19:55:00 +01:00
Michael Boelen
b67d9233eb Added more logging 2017-03-13 19:53:56 +01:00
Michael Boelen
e4474320ee [PKGS-7387] check all repositories for usage of gpg signing 2017-03-13 19:47:06 +01:00
Michael Boelen
cd63e2389e [FILE-7524] Do not show missing files or paths by default 2017-03-13 16:26:26 +01:00
Michael Boelen
4be6b958e4 [MALW-3280] added Avira detection 2017-03-13 15:51:13 +01:00
Michael Boelen
6083f6d9ff [SCHD-7704] permission checks and minor code cleanups 2017-03-13 12:00:27 +01:00
Michael Boelen
320a397772 [TIME-3104] Test permissions before opening files 2017-03-13 11:59:05 +01:00
Michael Boelen
7d17bfbbd7 Escape file when needed to test if it is readable 2017-03-13 11:57:23 +01:00
noci2012
ad779f29eb Added new php paths (#369) 
removed php5.4,  added 7.0 and 7.1 and the flavours that are known on gentoo
(apache2, cgi, cli, embed,  fpm)
 2017-03-13 09:50:09 +00:00