prehistoric-systems/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2026-03-11 08:55:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
lynis/include/tests_printers_spools
hlein e054e9757c Lots of cleanups (#366) 
* Description fix: SafePerms works on files not dirs.

All uses of SafePerms are on files (and indeed, it would reject
directories which would have +x set).

* Lots of whitespace cleanups.

Enforce everywhere(?) the same indentations for if/fi blocks.
The standard for the Lynis codebase is 4 spaces.  But sometimes
it's 1, sometimes 3, sometimes 8.

These patches standardize all(?) if blocks but _not_ else's (which
are usually indented 2, but sometimes zero); I was too lazy to
identify those (see below).

This diff is giant, but should not change code behavior at all;
diff -w shows no changes apart from whitespace.

FWIW I identified instances to check by using:

  perl -ne 'if ($oldfile ne $ARGV) { $.=1; $oldfile=$ARGV; }; chomp; if ($spaces) { next unless /^( *)([^ ]+)/; $newspaces=length($1); $firsttok = $2; next unless defined($firsttok); $offset = ($firsttok eq "elif" ? 0 : 4); if ($newspaces != $spaces + $offset) { print "$ARGV:$ifline\n$ARGV:$.:$_\n\n" }; $ifline=""; $spaces="";  } if (/^( *)if (?!.*[; ]fi)/) { $ifline = "$.:$_"; $spaces = length($1); }' $(find . -type f -print0 | xargs -0 file | egrep shell | cut -d: -f1)

Which produced output like:

  ./extras/build-lynis.sh:217:            if [ ${VERSION_IN_SPECFILE} = "" -o ! "${VERSION_IN_SPECFILE}" = "${LYNIS_VERSION}" ]; then
  ./extras/build-lynis.sh:218:               echo "[X] Version in specfile is outdated"

  ./plugins/plugin_pam_phase1:69:        if [ -d ${PAM_DIRECTORY} ]; then
  ./plugins/plugin_pam_phase1:70:                LogText "Result: /etc/pam.d exists"

...There's probably formal shellscript-beautification tools that
I'm oblivious about.

* More whitespace standardization.

* Fix a syntax error.

This looks like an if [ foo -o bar ]; was converted to if .. elif,
but incompletely.

* Add whitespace before closing ].

Without it, the shell thinks the ] is part of the last string, and
emits warnings like:

  .../lynis/include/tests_authentication: line 1028: [: missing `]'
2017-03-07 19:23:08 +00:00

302 lines
14 KiB
Bash
Raw Blame History

#!/bin/sh
#################################################################################
#
# Lynis
# ------------------
#
# Copyright 2007-2013, Michael Boelen
# Copyright 2007-2017, CISOfy
#
# Website : https://cisofy.com
# Blog : http://linux-audit.com
# GitHub : https://github.com/CISOfy/lynis
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Printers and spools
#
#################################################################################
#
CUPSD_CONFIG_LOCS="/etc/cups /usr/local/etc/cups /private/etc/cups"
CUPSD_CONFIG_FILE=""
CUPSD_RUNNING=0
CUPSD_FOUND=0
LPD_RUNNING=0
PRINTING_DAEMON=""
QDAEMON_CONFIG_ENABLED=0
QDAEMON_CONFIG_FILE=""
QDAEMON_RUNNING=0
#
#################################################################################
#
InsertSection "Printers and Spools"
#
#################################################################################
#
# Test : PRNT-2302
# Description : Check printcap file consistency
Register --test-no PRNT-2302 --os FreeBSD --weight L --network NO --category security --description "Check for printcap consistency"
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Searching /usr/sbin/chkprintcap"
if [ ! -f /usr/sbin/chkprintcap ]; then
Display --indent 2 --text "- Checking chkprintcap" --result "${STATUS_NOT_FOUND}" --color WHITE
LogText "Result: /usr/sbin/chkprintcap NOT found, test skipped."
else
LogText "Result: /usr/sbin/chkprintcap found"
FIND=$(/usr/sbin/chkprintcap > /dev/null ; echo $?)
# Only an exit code of zero should come back. Use string instead of integer, due unexpected trash
if [ "${FIND}" = "0" ]; then
Display --indent 2 --text "- Integrity check of printcap file" --result "${STATUS_OK}" --color GREEN
LogText "Result: chkprintcap did NOT gave any warnings"
else
Display --indent 2 --text "- Integrity check of printcap file" --result "${STATUS_WARNING}" --color RED
ReportSuggestion ${TEST_NO} "Run chkprintcap manually to test printcap file"
LogText "Output from chkprintcap: ${FIND}"
LogText "Run chkprintcap and check the /etc/printcap file."
fi
fi
fi
#
#################################################################################
#
# Test : PRNT-2304
# Description : Check cupsd status
Register --test-no PRNT-2304 --weight L --network NO --category security --description "Check cupsd status"
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Checking cupsd status"
#FIND=$(${PSBINARY} ax | ${GREPBINARY} "cupsd" | ${GREPBINARY} -v "grep" | ${GREPBINARY} -v apcupsd)
IsRunning cupsd
if [ ${RUNNING} -eq 1 ]; then
Display --indent 2 --text "- Checking cups daemon" --result "${STATUS_RUNNING}" --color GREEN
LogText "Result: cups daemon running"
CUPSD_RUNNING=1; PRINTING_DAEMON="cups"
else
Display --indent 2 --text "- Checking cups daemon" --result "${STATUS_NOT_FOUND}" --color WHITE
LogText "Result: cups daemon not running, cups daemon tests skipped"
fi
fi
#
#################################################################################
#
# Test : PRNT-2306
# Description : Check CUPSd configuration file
if [ ${CUPSD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PRNT-2306 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check CUPSd configuration file"
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Searching cupsd configuration file"
for I in ${CUPSD_CONFIG_LOCS}; do
if [ -f ${I}/cupsd.conf ]; then
if FileIsReadable ${I}/cupsd.conf; then
CUPSD_CONFIG_FILE="${I}/cupsd.conf"
LogText "Result: found ${CUPSD_CONFIG_FILE}"
fi
fi
done
if [ ! "${CUPSD_CONFIG_FILE}" = "" ]; then
Display --indent 2 --text "- Checking CUPS configuration file" --result "${STATUS_OK}" --color GREEN
LogText "Result: configuration file found (${CUPSD_CONFIG_FILE})"
CUPSD_FOUND=1
else
Display --indent 2 --text "- Checking CUPS configuration file" --result "${STATUS_NOT_FOUND}" --color RED
LogText "Result: configuration file not found"
LogText "Development: no CUPS configuration file found"
fi
fi
#
#################################################################################
#
# Test : PRNT-2307
# Description : Check CUPSd configuration file permissions
# To Do : Add function
if [ ${CUPSD_FOUND} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PRNT-2307 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check CUPSd configuration file permissions"
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Checking CUPS configuration file permissions"
FIND=$(ls -l ${CUPSD_CONFIG_FILE} | ${CUTBINARY} -c 2-10)
LogText "Result: found ${FIND}"
if [ "${FIND}" = "r--------" -o "${FIND}" = "rw-------" -o "${FIND}" = "rw-r-----" -o "${FIND}" = "rw-rw----" ]; then
Display --indent 4 --text "- File permissions" --result "${STATUS_OK}" --color GREEN
AddHP 1 1
else
Display --indent 4 --text "- File permissions" --result "${STATUS_WARNING}" --color RED
ReportSuggestion ${TEST_NO} "Access to CUPS configuration could be more strict."
AddHP 1 2
fi
fi
#
#################################################################################
#
# Test : PRNT-2308
# Description : Check CUPS daemon network configuration
if [ ${CUPSD_FOUND} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no PRNT-2308 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check CUPSd network configuration"
if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0
# Checking network addresses
LogText "Test: Checking CUPS daemon listening network addresses"
FIND=$(${GREPBINARY} "^Listen" ${CUPSD_CONFIG_FILE} | ${GREPBINARY} -v "/" | ${AWKBINARY} '{ print $2 }')
N=0
for I in ${FIND}; do
LogText "Found network address: ${I}"
N=$((N + 1))
FOUND=1
done
if [ ${FOUND} -eq 0 ]; then
ReportException "${TEST_NO}:1" "No listen statement found in CUPS configuration file"
fi
# Check if daemon is only running on localhost
if [ ${N} -eq 1 ]; then
if [ "${FIND}" = "localhost:631" -o "${FIND}" = "127.0.0.1:631" ]; then
LogText "Result: CUPS daemon only running on localhost"
AddHP 2 2
else
LogText "Result: CUPS daemon running on one or more interfaces (not limited to localhost)"
ReportSuggestion ${TEST_NO} "Check CUPS configuration if it really needs to listen on the network"
AddHP 1 2
fi
else
LogText "Result: CUPS daemon is running on several network addresses"
ReportSuggestion ${TEST_NO} "Check CUPS configuration if it really needs to run on several network addresses"
AddHP 1 2
fi
# Checking sockets
LogText "Test: Checking cups daemon listening sockets"
FIND=$(${GREPBINARY} "^Listen" ${CUPSD_CONFIG_FILE} | ${GREPBINARY} "/" | ${AWKBINARY} '{ print $2 }')
for I in ${FIND}; do
LogText "Found socket address: ${I}"
N=$((N + 1))
done
if [ ${N} -eq 0 ]; then
Display --indent 2 --text "- Checking CUPS addresses/sockets" --result "${STATUS_NONE}" --color WHITE
LogText "Result: no addresses found on which CUPS daemon is listening"
else
Display --indent 2 --text "- Checking CUPS addresses/sockets" --result "${STATUS_FOUND}" --color GREEN
LogText "Result: CUPS daemon is listening on network/socket"
fi
fi
#
#################################################################################
#
# Test : PRNT-2314
# Description : Check lpd status
Register --test-no PRNT-2314 --weight L --network NO --category security --description "Check lpd status"
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Checking lpd status"
IsRunning lpd
if [ ${RUNNING} -eq 1 ]; then
Display --indent 2 --text "- Checking lp daemon" --result "${STATUS_RUNNING}" --color GREEN
LogText "Result: lp daemon running"
LPD_RUNNING=1; PRINTING_DAEMON="lp"
else
Display --indent 2 --text "- Checking lp daemon" --result "${STATUS_NOT_RUNNING}" --color WHITE
LogText "Result: lp daemon not running"
AddHP 4 4
fi
fi
#
#################################################################################
#
# Test : PRNT-23xx
# Description : Test Linux printcap file
#if [ ${CUPSD_RUNNING} -eq 1 -a ! "${CUPSD_CONFIG_FILE}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
#Register --test-no PRNT-23xx--preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check cupsd address configuration"
#if [ ${SKIPTEST} -eq 0 ]; then
#if [ "${OS}" = "Linux" ]; then
# echo " - Testing printcap file [Test not implemented yet]"
# # Check printcap with checkpc command
#fi
#
#################################################################################
#
# Test : PRNT-2416
# Description : Check /etc/qconfig file
Register --test-no PRNT-2316 --os AIX --weight L --network NO --category security --description "Checking /etc/qconfig file"
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Checking /etc/qconfig"
QDAEMON_CONFIG_FILE="/etc/qconfig"
FileIsReadable ${QDAEMON_CONFIG_FILE}
if [ ${CANREAD} -eq 1 ]; then
FIND=$(${GREPBINARY} -v "^\*" ${QDAEMON_CONFIG_FILE} | ${EGREPBINARY} "backend|device")
if [ ! "${FIND}" = "" ]; then
LogText "Result: printers are defined in ${QDAEMON_CONFIG_FILE}"
Display --indent 2 --text "- Checking /etc/qconfig file" --result "${STATUS_FOUND}" --color GREEN
QDAEMON_CONFIG_ENABLED=1
else
LogText "Result: ${QDAEMON_CONFIG_FILE} is empty. No printers are defined"
Display --indent 2 --text "- Checking /etc/qconfig file" --result EMPTY --color WHITE
fi
else
LogText "Result: Can not read ${QDAEMON_CONFIG_FILE} (no permission)"
fi
fi
#
#################################################################################
#
# Test : PRNT-2418
# Description : Check qdaemon printer spooler status
Register --test-no PRNT-2418 --os AIX --weight L --network NO --category security --description "Checking qdaemon printer spooler status"
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Checking qdaemon status"
IsRunning qdaemon
if [ ${RUNNING} -eq 1 ]; then
LogText "Result: qdaemon daemon running"
Display --indent 2 --text "- Checking qdaemon daemon" --result "${STATUS_RUNNING}" --color GREEN
QDAEMON_RUNNING=1; PRINTING_DAEMON="qdaemon"
else
if [ ${QDAEMON_CONFIG_ENABLED} -eq 1 ]; then
LogText "Result: qdaemon daemon not running"
Display --indent 2 --text "- Checking qdaemon daemon" --result "${STATUS_NOT_RUNNING}" --color RED
ReportSuggestion ${TEST_NO} "Activate print spooler daemon (qdaemon) in order to process print jobs"
else
LogText "Result: qdaemon daemon not running"
Display --indent 2 --text "- Checking qdaemon daemon" --result "${STATUS_NOT_RUNNING}" --color WHITE
fi
fi
fi
#
#################################################################################
#
# Test : PRNT-2420
# Description : Checking old print jobs
Register --test-no PRNT-2420 --os AIX --weight L --network NO --category security --description "Checking old print jobs"
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Checking old print jobs"
DirectoryExists /var/spool/lpd/qdir
if [ ${DIRECTORY_FOUND} -eq 1 ]; then
FIND=$(find /var/spool/lpd/qdir -type f -mtime +1 2> /dev/null | ${SEDBINARY} 's/ /!space!/g')
if [ ! "${FIND}" = "" ]; then
N=0
for I in ${FIND}; do
FILE=$(echo ${I} | ${SEDBINARY} 's/!space!/ /g')
LogText "Found old print job: ${FILE}"
N=$((N + 1))
done
LogText "Result: Found ${N} old print jobs in /var/spool/lpd/qdir"
Display --indent 4 --text "- Checking old print jobs" --result "${STATUS_FOUND}" --color YELLOW
ReportSuggestion ${TEST_NO} "Check old print jobs in /var/spool/lpd/qdir to prevent new jobs from being processed"
LogText "Risk: Failed or defunct print jobs can occupy a lot of space and in some cases, prevent new jobs from being processed"
else
LogText "Result: Old print jobs not found in /var/spool/lpd/qdir"
Display --indent 4 --text "- Checking old print jobs" --result "${STATUS_NONE}" --color GREEN
fi
fi
fi
#
#################################################################################
#
Report "printing_daemon=${PRINTING_DAEMON}"
WaitForKeyPress
#
#================================================================================
# Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com
Reference in a new issue View git blame Copy permalink