mirror of
https://github.com/CISOfy/lynis.git
synced 2026-03-11 08:55:28 +00:00
b595cc0fb5
* Typo fix. * Style change: always use $(), never ``. The Lynis code already mostly used $(), but backticks were sprinkled around. Converted all of them. * Lots of minor spelling/typo fixes. FWIW these were found with: find . -type f -print0 | xargs -0 cat | aspell list | sort -u | egrep '^[a-z]+$' | less And then reviewing the list to pick out things that looked like misspelled words as opposed to variables, etc., and then manual inspection of context to determine the intention.
625 lines
31 KiB
Bash
625 lines
31 KiB
Bash
#!/bin/sh
|
|
|
|
#################################################################################
|
|
#
|
|
# Lynis
|
|
# ------------------
|
|
#
|
|
# Copyright 2007-2013, Michael Boelen
|
|
# Copyright 2007-2017, CISOfy
|
|
#
|
|
# Website : https://cisofy.com
|
|
# Blog : http://linux-audit.com
|
|
# GitHub : https://github.com/CISOfy/lynis
|
|
#
|
|
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
|
|
# welcome to redistribute it under the terms of the GNU General Public License.
|
|
# See LICENSE file for usage of this software.
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Networking
|
|
#
|
|
#################################################################################
|
|
#
|
|
FOUNDPROMISC=0 # Promiscuous interfaces
|
|
LOCAL_DNSRESOLVER_FOUND=0 # Local DNS resolver
|
|
NUMBERACTIVENS=0 # Number of active nameservers
|
|
DHCP_CLIENT_RUNNING=0 # DHCP client availability
|
|
ARPWATCH_RUNNING=0 # ARP-cache based attack monitoring software
|
|
ARPON_RUNNING=0 # ARP-cache based attack monitoring software
|
|
#
|
|
#################################################################################
|
|
#
|
|
InsertSection "Networking"
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : NETW-2600
|
|
# Description : Gather IPv6 configuration
|
|
Register --test-no NETW-2600 --os "Linux" --weight L --network YES --category security --description "Checking IPv6 configuration"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
IPV6_CONFIGURED=0
|
|
IPV6_ACCEPT_RA=255
|
|
IPV6_ACCEPT_REDIRECTS=255
|
|
IPV6_MANUAL_CONFIGURED=255
|
|
IPV6_ONLY=255
|
|
IPV6_MISCONFIGURED=0
|
|
IPV6_MISCONFIGURED_MTU=0
|
|
FIND=$(sysctl -a 2> /dev/null | ${GREPBINARY} "^net.ipv6" | ${SEDBINARY} "s/ = /=/")
|
|
if [ ! "${FIND}" = "" ]; then
|
|
IPV6_CONFIGURED=1
|
|
for I in ${FIND}; do
|
|
SYSCTL_KEY=$(echo ${I} | ${AWKBINARY} -F= '{ print $1 }')
|
|
SYSCTL_VALUE=$(echo ${I} | ${AWKBINARY} -F= '{ print $2 }')
|
|
case ${SYSCTL_KEY} in
|
|
"net.ipv6.conf.default.accept_ra")
|
|
if [ "${SYSCTL_VALUE}" = "1" ]; then IPV6_ACCEPT_RA=1; else IPV6_ACCEPT_RA=0; fi
|
|
;;
|
|
"net.ipv6.conf.default.accept_redirects")
|
|
if [ "${SYSCTL_VALUE}" = "1" ]; then IPV6_ACCEPT_REDIRECTS=1; else IPV6_ACCEPT_REDIRECTS=0; fi
|
|
;;
|
|
"net.ipv6.bindv6only")
|
|
if [ "${SYSCTL_VALUE}" = "1" ]; then IPV6_ONLY=1; else IPV6_ONLY=0; fi
|
|
;;
|
|
"net.ipv6.conf.all.mtu" | "net.ipv6.conf.default.mtu")
|
|
if [ ${SYSCTL_VALUE} -lt 1280 ]; then IPV6_MISCONFIGURED_MTU=1; fi
|
|
;;
|
|
|
|
#if TestValue --function equals --value "${SYSCTL_VALUE}" --search "1"; then
|
|
# echo "Found ${SYSCTL_VALUE}"
|
|
#else
|
|
# echo "Not found"
|
|
#fi
|
|
esac
|
|
done
|
|
else
|
|
IPV6_MODE="disabled"
|
|
fi
|
|
# Check if we are manually configured (not accepting automatic configuration)
|
|
if [ ${IPV6_ACCEPT_RA} -eq 0 -a ${IPV6_ACCEPT_REDIRECTS} -eq 0 ]; then
|
|
IPV6_MANUAL_CONFIGURED=1
|
|
IPV6_MODE="manual"
|
|
elif [ ${IPV6_ACCEPT_RA} -eq 1 -o ${IPV6_ACCEPT_REDIRECTS} -eq 1 ]; then
|
|
IPV6_MODE="auto"
|
|
else
|
|
IPV6_MODE="disabled"
|
|
fi
|
|
|
|
LogText "Result: IPV6 mode is ${IPV6_MODE}"
|
|
if [ ${IPV6_CONFIGURED} -eq 1 ]; then
|
|
Display --indent 2 --text "- Checking IPv6 configuration" --result "${STATUS_ENABLED}" --color WHITE
|
|
STATUS=$(echo ${IPV6_MODE} | ${TRBINARY} '[:lower:]' '[:upper:]')
|
|
Display --indent 6 --text "Configuration method" --result "${STATUS}" --color WHITE
|
|
if [ ${IPV6_ONLY} -eq 1 ]; then STATUS="YES"; else STATUS="NO"; fi
|
|
LogText "Result: IPv6 only configuration: ${STATUS}"
|
|
Display --indent 6 --text "IPv6 only" --result "${STATUS}" --color WHITE
|
|
else
|
|
Display --indent 2 --text "- Checking IPv6 configuration" --result "${STATUS_DISABLED}" --color WHITE
|
|
fi
|
|
# Configuration errors
|
|
if [ ${IPV6_MISCONFIGURED_MTU} -eq 1 ]; then
|
|
IPV6_MISCONFIGURED=1
|
|
LogText "Result: MTU of IPv6 interfaces should be 1280 or higher"
|
|
Display --indent 6 --text "Error: MTU is too low" --result "${STATUS_WARNING}" --color RED
|
|
ReportSuggestion "${TEST_NO}" "Check your MTU configuration of IPv6 interfaces"
|
|
fi
|
|
|
|
# Possible improvements:
|
|
# - Check if we found IPv6 enabled nameservers
|
|
|
|
# Report
|
|
Report "ipv6_mode=${IPV6_MODE}"
|
|
Report "ipv6_only=${IPV6_ONLY}"
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : NETW-2704
|
|
# Description : Basic nameserver configuration tests (connectivity)
|
|
Register --test-no NETW-2704 --weight L --network YES --category security --description "Basic nameserver configuration tests"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
Display --indent 2 --text "- Checking configured nameservers"
|
|
LogText "Test: Checking /etc/resolv.conf file"
|
|
if [ -f /etc/resolv.conf ]; then
|
|
LogText "Result: Found /etc/resolv.conf file"
|
|
FIND=$(${GREPBINARY} '^nameserver' /etc/resolv.conf | ${TRBINARY} -d '\t' | ${SEDBINARY} 's/nameserver*//g' | uniq)
|
|
if [ ! "${FIND}" = "" ]; then
|
|
Display --indent 4 --text "- Testing nameservers"
|
|
LogText "Test: Querying nameservers"
|
|
for I in ${FIND}; do
|
|
LogText "Found nameserver: ${I}"
|
|
Report "nameserver[]=${I}"
|
|
# Check if a local resolver is available (like DNSMasq)
|
|
if [ "${I}" = "::1" -o "${I}" = "127.0.0.1" -o "${I}" = "0.0.0.0" ]; then
|
|
LOCAL_DNSRESOLVER_FOUND=1
|
|
fi
|
|
if [ ! "${DIGBINARY}" = "" ]; then
|
|
# See if we can query something at the nameserver
|
|
# 0=good, other=bad
|
|
DNSRESPONSE=$(${DIGBINARY} +noall +time=3 +retry=0 @${I} ${I} > /dev/null ; echo $?)
|
|
if [ "${DNSRESPONSE}" = "0" ]; then
|
|
Display --indent 8 --text "Nameserver: ${I}" --result "${STATUS_OK}" --color GREEN
|
|
LogText "Nameserver ${I} seems to respond to queries from this host."
|
|
# Count responsive nameservers
|
|
NUMBERACTIVENS=$((NUMBERACTIVENS + 1))
|
|
else
|
|
Display --indent 8 --text "Nameserver: ${I}" --result "NO RESPONSE" --color RED
|
|
LogText "Result: nameserver ${I} does NOT respond"
|
|
LogText "Exit-code from dig: ${DNSRESPONSE}"
|
|
ReportSuggestion ${TEST_NO} "Check connection to this nameserver and make sure no outbound DNS queries are blocked (port 53 UDP and TCP)."
|
|
ReportWarning ${TEST_NO} "Nameserver ${I} does not respond"
|
|
fi
|
|
else
|
|
LogText "Result: Nameserver test for ${I} skipped, 'dig' not installed"
|
|
Display --indent 6 --text "Nameserver: ${I}" --result "${STATUS_SKIPPED}" --color YELLOW
|
|
fi
|
|
done
|
|
fi
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : NETW-2705
|
|
# Description : Basic nameserver configuration tests (connectivity)
|
|
if [ ${LOCAL_DNSRESOLVER_FOUND} -eq 0 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no NETW-2705 --preqs-met ${PREQS_MET} --weight L --network YES --category security --description "Check availability two nameservers"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
if [ ! "${DIGBINARY}" = "" ]; then
|
|
if [ ${NUMBERACTIVENS} -lt 2 ]; then
|
|
Display --indent 4 --text "- Minimal of 2 responsive nameservers" --result "${STATUS_WARNING}" --color RED
|
|
LogText "Result: less than 2 responsive nameservers found"
|
|
ReportWarning ${TEST_NO} "Couldn't find 2 responsive nameservers"
|
|
LogText "Note: Non responsive nameservers can give problems for your system(s). Like the lack of recursive lookups, bad connectivity to update servers etc."
|
|
ReportSuggestion ${TEST_NO} "Check your resolv.conf file and fill in a backup nameserver if possible"
|
|
AddHP 1 2
|
|
else
|
|
Display --indent 4 --text "- Minimal of 2 responsive nameservers" --result "${STATUS_OK}" --color GREEN
|
|
LogText "Result: found at least 2 responsive nameservers"
|
|
AddHP 3 3
|
|
fi
|
|
else
|
|
Display --indent 4 --text "- Minimal of 2 responsive nameservers" --result "${STATUS_SKIPPED}" --color YELLOW
|
|
LogText "Result: dig not installed, test can't be fully performed"
|
|
fi
|
|
else
|
|
LogText "Result: Test most likely skipped due having local resolver in /etc/resolv.conf"
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : NETW-3001
|
|
# Description : Find default gateway (route)
|
|
# More info : BSD: ^default Linux: 0.0.0.0
|
|
if [ ! "${NETSTATBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no NETW-3001 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Find default gateway (route)"
|
|
if [ $SKIPTEST -eq 0 ]; then
|
|
LogText "Test: Searching default gateway(s)"
|
|
FIND=$(${NETSTATBINARY} -rn | ${EGREPBINARY} "^0.0.0.0|default" | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f2)
|
|
if [ ! "${FIND}" = "" ]; then
|
|
for I in ${FIND}; do
|
|
LogText "Result: Found default gateway ${I}"
|
|
Report "default_gateway[]=${I}"
|
|
done
|
|
Display --indent 2 --text "- Checking default gateway" --result "${STATUS_DONE}" --color GREEN
|
|
else
|
|
LogText "Result: No default gateway found"
|
|
Display --indent 2 --text "- Checking default gateway" --result "NONE FOUND" --color WHITE
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : NETW-3004
|
|
# Description : Find available network interfaces
|
|
Register --test-no NETW-3004 --weight L --network NO --category security --description "Search for available network interfaces"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
FIND=""
|
|
N=0
|
|
case ${OS} in
|
|
AIX)
|
|
FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${GREPBINARY} "flags=" | ${AWKBINARY} -F ":" '{ print $1 }')
|
|
;;
|
|
Linux)
|
|
if [ ! "${IPBINARY}" = "" ]; then
|
|
FIND=$(${IPBINARY} link show 2> /dev/null | ${GREPBINARY} "^[0-9]" | ${AWKBINARY} '{ print $2 }' | ${SEDBINARY} 's/://g')
|
|
elif [ ! "${IFCONFIGBINARY}" = "" ]; then
|
|
FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ( $2 == "Link" ) { print $1 }}')
|
|
fi
|
|
;;
|
|
DragonFly|FreeBSD|macOS|NetBSD)
|
|
FIND=$(${IFCONFIGBINARY} -l 2> /dev/null)
|
|
;;
|
|
OpenBSD|Solaris)
|
|
FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${GREPBINARY} "flags=" | ${AWKBINARY} -F ": " '{ print $1 }')
|
|
;;
|
|
*)
|
|
# Having a system currently unsupported? Share your details to determine network interfaces
|
|
ReportException "${TEST_NO}:1" "No support for this OS (${OS}) to find available network interfaces"
|
|
;;
|
|
esac
|
|
if [ ! "${FIND}" = "" ]; then
|
|
for I in ${FIND}; do
|
|
NETWORK_INTERFACES="${NETWORK_INTERFACES}|${I}"
|
|
LogText "Found network interface: ${I}"
|
|
N=$((N + 1))
|
|
Report "network_interface[]=${I}"
|
|
done
|
|
else
|
|
ReportException "${TEST_NO}:1" "No interfaces found on this system (OS=${OS})"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : NETW-3006
|
|
# Description : Get network MAC addresses
|
|
Register --test-no NETW-3006 --weight L --network NO --category security --description "Get network MAC addresses"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
FIND=""
|
|
case ${OS} in
|
|
AIX)
|
|
FIND=$(lscfg -vl ent* | ${GREPBINARY} "Network Address" | ${CUTBINARY} -d"." -f14 | ${AWKBINARY} '{ ctr=1; i=1; while (ctr <= 6) { d[ctr++]=substr($0,i,2);i=i+2 } printf("%s:%s:%s:%s:%s:%s\n",d[1],d[2],d[3],d[4],d[5],d[6]) }')
|
|
;;
|
|
DragonFly|FreeBSD)
|
|
FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="ether") print $2 }' | ${SORTBINARY} -u)
|
|
;;
|
|
Linux)
|
|
if [ ! "${IFCONFIGBINARY}" = "" ]; then
|
|
FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${GREPBINARY} "HWaddr" | ${AWKBINARY} '{ if ($4=="HWaddr") print $5 }' | ${SORTBINARY} -u)
|
|
else
|
|
if [ ! "${IPBINARY}" = "" ]; then
|
|
LogText "Test: Using ip binary to gather hardware addresses"
|
|
FIND=$(${IPBINARY} link 2> /dev/null | ${GREPBINARY} "link/ether" | ${AWKBINARY} '{ print $2 }')
|
|
else
|
|
ReportException "${TEST_NO}:2" "Missing ifconfig or ip command to collect hardware address (MAC)"
|
|
fi
|
|
fi
|
|
;;
|
|
macOS)
|
|
FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="lladdr" || $1=="ether") print $2 }' | ${SORTBINARY} -u)
|
|
;;
|
|
NetBSD)
|
|
FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="address:") print $2 }' | ${SORTBINARY} -u)
|
|
;;
|
|
OpenBSD)
|
|
FIND=$(${IFCONFIGBINARY} -A 2> /dev/null | ${AWKBINARY} '{ if ($1=="lladdr") print $2 }' | ${SORTBINARY} -u)
|
|
;;
|
|
Solaris)
|
|
FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="ether") print $2 }' | ${SORTBINARY} -u)
|
|
;;
|
|
*)
|
|
# Having a system currently unsupported? Share your details to determine MAC information
|
|
ReportException "${TEST_NO}:1" "No support for this OS (${OS}) to find MAC information"
|
|
;;
|
|
esac
|
|
N=0
|
|
for I in ${FIND}; do
|
|
LogText "Found MAC address: ${I}"
|
|
N=$((N + 1))
|
|
Report "network_mac_address[]=${I}"
|
|
done
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : NETW-3008
|
|
# Description : Get network IPv4/6 addresses
|
|
Register --test-no NETW-3008 --weight L --network NO --category security --description "Get network IP addresses"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
FIND=""; FIND2=""
|
|
case ${OS} in
|
|
AIX)
|
|
FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet") print $2 }')
|
|
FIND2=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6") print $2 }')
|
|
;;
|
|
DragonFly|FreeBSD|NetBSD)
|
|
FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet") print $2 }')
|
|
FIND2=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6") print $2 }')
|
|
;;
|
|
Linux)
|
|
if [ ! "${IFCONFIGBINARY}" = "" ]; then
|
|
FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet") print $2 }' | ${CUTBINARY} -d ':' -f2)
|
|
# Version which works for multiple types of ifconfig (e.g. Slackware)
|
|
FIND2=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6" && $2=="addr:") { print $3 } else { if ($1=="inet6" && $3=="prefixlen") { print $2 } } }')
|
|
else
|
|
if [ ! "${IPBINARY}" = "" ]; then
|
|
LogText "Test: Using ip binary to gather IP addresses"
|
|
FIND=$(${IPBINARY} addr 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet") { print $2 }}' | ${SEDBINARY} 's/\/.*//')
|
|
FIND2=$(${IPBINARY} addr 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6") { print $2 }}' | ${SEDBINARY} 's/\/.*//')
|
|
else
|
|
ReportException "${TEST_NO}:2" "Missing ifconfig or ip command to collect hardware address (MAC)"
|
|
fi
|
|
fi
|
|
;;
|
|
macOS)
|
|
FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet") print $2 }')
|
|
FIND2=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6") print $2 }')
|
|
;;
|
|
OpenBSD)
|
|
FIND=$(${IFCONFIGBINARY} -A 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet") print $2 }')
|
|
FIND2=$(${IFCONFIGBINARY} -A 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6") print $2 }')
|
|
;;
|
|
Solaris)
|
|
FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet") print $2 }')
|
|
FIND2=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6") print $2 }')
|
|
;;
|
|
*)
|
|
LogText "Result: no support yet for this OS (${OS}) to find IP address information. You can help improving this test by submitting your details."
|
|
ReportException "${TEST_NO}:1" "IP address information test not implemented for this operating system"
|
|
;;
|
|
esac
|
|
N=0
|
|
# IPv4
|
|
for I in ${FIND}; do
|
|
LogText "Found IPv4 address: ${I}"
|
|
N=$((N + 1))
|
|
Report "network_ipv4_address[]=${I}"
|
|
done
|
|
# IPv6
|
|
for I in ${FIND2}; do
|
|
LogText "Found IPv6 address: ${I}"
|
|
N=$((N + 1))
|
|
Report "network_ipv6_address[]=${I}"
|
|
done
|
|
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : NETW-3012
|
|
# Description : Check listening ports
|
|
Register --test-no NETW-3012 --weight L --network NO --category security --description "Check listening ports"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
FIND=""; FIND2=""
|
|
N=0
|
|
case ${OS} in
|
|
DragonFly|FreeBSD)
|
|
if [ ! "${SOCKSTATBINARY}" = "" ]; then
|
|
FIND=$(${SOCKSTATBINARY} | ${AWKBINARY} '{ if ($7 ~ /\*:\*/) print $5"|"$6"|"$2"|" }' | ${SORTBINARY} -u)
|
|
# To strip off IP's: ${SEDBINARY} 's/|.*:/|/'
|
|
else
|
|
FIND=""
|
|
fi
|
|
FIND2=""
|
|
;;
|
|
Linux)
|
|
if [ ! "${NETSTATBINARY}" = "" ]; then
|
|
# UDP
|
|
FIND=$(${NETSTATBINARY} -nlp 2> /dev/null | ${GREPBINARY} "^udp" | ${AWKBINARY} '{ print $4"|"$1"|"$6"|" }' | ${SEDBINARY} 's:|[0-9]*/:|:')
|
|
# TCP
|
|
FIND2=$(${NETSTATBINARY} -nlp 2> /dev/null | ${GREPBINARY} "^tcp" | ${AWKBINARY} '{ if($6=="LISTEN") { print $4"|"$1"|"$7"|" }}' | ${SEDBINARY} 's:|[0-9]*/:|:')
|
|
else
|
|
if [ ! "${SSBINARY}" = "" ]; then
|
|
# UDP
|
|
FIND=$(${SSBINARY} -u -a -n 2> /dev/null | ${AWKBINARY} '{ print $4 }' | ${GREPBINARY} -v Local)
|
|
# TCP
|
|
FIND2=$(${SSBINARY} -t -a -n 2> /dev/null | ${AWKBINARY} '{ print $4 }' | ${GREPBINARY} -v Local)
|
|
else
|
|
ReportException "${TEST_NO}:1" "netstat and ss binary missing to gather listening ports"
|
|
fi
|
|
fi
|
|
;;
|
|
|
|
macOS)
|
|
if [ ! "${LSOFBINARY}" = "" ]; then
|
|
# UDP and TCP combined
|
|
FIND=$(${LSOFBINARY} -i -P | ${AWKBINARY} '{ print $9"|"$8"|"$1"|" }' | ${SEDBINARY} 's/\(.*\)\-\>.*\(\|.*\)/\1\2/' | ${SEDBINARY} 's/\*/'$IP'/' | ${SORTBINARY} -u | ${GREPBINARY} -v "NAME")
|
|
else
|
|
FIND=""
|
|
fi
|
|
# Not needed as we have a combined test
|
|
FIND2=""
|
|
;;
|
|
|
|
|
|
NetBSD)
|
|
if [ ! "${SOCKSTATBINARY}" = "" ]; then
|
|
FIND=$(${SOCKSTATBINARY} 2> /dev/null | ${AWKBINARY} '{ if ($7 ~ /\*.\*/) print $5"|"$6"|"$2"|" }' | ${SORTBINARY} -u)
|
|
else
|
|
FIND=""
|
|
fi
|
|
FIND2=""
|
|
;;
|
|
OpenBSD)
|
|
if [ ! "${NETSTATBINARY}" = "" ]; then
|
|
# UDP
|
|
FIND=$(${NETSTATBINARY} -an 2> /dev/null | ${GREPBINARY} "^udp" | ${AWKBINARY} '{ print $4"|"$1"||" }')
|
|
# TCP
|
|
FIND2=$(${NETSTATBINARY} -an 2> /dev/null | ${GREPBINARY} "^tcp" | ${AWKBINARY} '{ if($6=="LISTEN") { print $4"|"$1"||" }}')
|
|
else
|
|
ReportException "${TEST_NO}:3" "netstat missing to gather listening ports"
|
|
fi
|
|
;;
|
|
*)
|
|
# Got this exception? Provide your details and output of netstat or any other tool to determine this information.
|
|
ReportException "${TEST_NO}:2" "Unclear what method to use, to determine listening port information"
|
|
;;
|
|
esac
|
|
|
|
# Retrieve information from sockstat, when available
|
|
LogText "Test: Retrieving sockstat information to find listening ports"
|
|
if [ ! "${FIND}" = "" ]; then
|
|
for I in ${FIND}; do
|
|
N=$((N + 1))
|
|
LogText "Found listening info: ${I}"
|
|
Report "network_listen_port[]=${I}"
|
|
done
|
|
fi
|
|
|
|
if [ ! "${FIND2}" = "" ]; then
|
|
for I in ${FIND2}; do
|
|
N=$((N + 1))
|
|
LogText "Found listening info: ${I}"
|
|
Report "network_listen_port[]=${I}"
|
|
done
|
|
fi
|
|
if [ "${FIND}" = "" -a "${FIND2}" = "" ]; then
|
|
Display --indent 2 --text "- Getting listening ports (TCP/UDP)" --result "${STATUS_SKIPPED}" --color YELLOW
|
|
else
|
|
Display --indent 2 --text "- Getting listening ports (TCP/UDP)" --result "${STATUS_DONE}" --color GREEN
|
|
Display --indent 6 --text "* Found ${N} ports"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : NETW-3014
|
|
# Description : Checking promiscuous interfaces (BSD)
|
|
# Note : FreeBSD and others
|
|
if [ "${OS}" = "DragonFly" -o "${OS}" = "FreeBSD" -o "${OS}" = "NetBSD" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no NETW-3014 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking promiscuous interfaces (BSD)"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
LogText "Test: Checking promiscuous interfaces (FreeBSD)"
|
|
FIND=$(${IFCONFIGBINARY} 2> /dev/null | ${GREPBINARY} PROMISC | ${CUTBINARY} -d ':' -f1)
|
|
if [ ! "${FIND}" = "" ]; then
|
|
LogText "Result: Promiscuous interfaces: ${FIND}"
|
|
for I in ${FIND}; do
|
|
WHITELISTED=0
|
|
for PROFILE in ${PROFILES}; do
|
|
Debug "Checking if interface ${I} is whitelisted in profile ${PROFILE}"
|
|
ISWHITELISTED=$(${GREPBINARY} "^if_promisc:${I}:" ${PROFILE})
|
|
if [ ! "${ISWHITELISTED}" = "" ]; then
|
|
WHITELISTED=1
|
|
LogText "Result: this interface was whitelisted in profile (${PROFILE})"
|
|
fi
|
|
done
|
|
# Check if this interface was whitelisted
|
|
if [ ${WHITELISTED} -eq 0 ]; then
|
|
FOUNDPROMISC=1
|
|
ReportWarning ${TEST_NO} "Found promiscuous interface (${I})"
|
|
LogText "Note: some tools put an interface into promiscuous mode, to capture/log network traffic"
|
|
else
|
|
LogText "Result: Found promiscuous interface ${I} (*whitelisted via profile*)"
|
|
fi
|
|
done
|
|
fi
|
|
|
|
# Show result
|
|
if [ ${FOUNDPROMISC} -eq 0 ]; then
|
|
Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_OK}" --color GREEN
|
|
LogText "Result: No promiscuous interfaces found"
|
|
else
|
|
Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_WARNING}" --color RED
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : NETW-3015
|
|
# Description : Checking promiscuous interfaces (Linux)
|
|
# Note : Need ifconfig binary at this moment (does not work on Arch Linux)
|
|
if [ ! "${IFCONFIGBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no NETW-3015 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking promiscuous interfaces (Linux)"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
LogText "Test: Checking promiscuous interfaces (Linux)"
|
|
NETWORK=$(${IFCONFIGBINARY} 2> /dev/null | ${GREPBINARY} Link | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f1)
|
|
if [ ! "${NETWORK}" = "" ]; then
|
|
for I in ${NETWORK}; do
|
|
FIND=$(${IFCONFIGBINARY} ${I} 2> /dev/null | ${GREPBINARY} PROMISC)
|
|
if [ ! "${FIND}" = "" ]; then
|
|
LogText "Result: Promiscuous interface: ${I}"
|
|
ISWHITELISTED=$(${GREPBINARY} "^if_promisc:${I}:" ${PROFILE})
|
|
if [ "${ISWHITELISTED}" = "" ]; then
|
|
FOUNDPROMISC=1
|
|
ReportWarning ${TEST_NO} "Found promiscuous interface (${I})"
|
|
LogText "Note: some tools put an interface into promiscuous mode, to capture/log network traffic"
|
|
else
|
|
LogText "Result: Found promiscuous interface ${I} (*whitelisted via profile*)"
|
|
fi
|
|
fi
|
|
done
|
|
fi
|
|
|
|
# Show result
|
|
if [ ${FOUNDPROMISC} -eq 0 ]; then
|
|
Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_OK}" --color GREEN
|
|
LogText "Result: No promiscuous interfaces found"
|
|
else
|
|
Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_WARNING}" --color RED
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : NETW-3020
|
|
# Description : Checking multipath configuration (Solaris)
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : NETW-3028
|
|
# Description : Checking for many waiting connections
|
|
# Type : Performance
|
|
# Notes : It is common to see a healthy web server seeing to have several thousands of TCP connections in WAIT state
|
|
if [ ! "${NETSTATBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no NETW-3028 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking connections in WAIT state"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
LogText "Test: Using netstat for check for connections in WAIT state"
|
|
FIND=$(${NETSTATBINARY} -an | ${GREPBINARY} WAIT | ${WCBINARY} -l | ${AWKBINARY} '{ print $1 }')
|
|
if [ -z "${OPTIONS_CONN_MAX_WAIT_STATE}" ]; then OPTIONS_CONN_MAX_WAIT_STATE="5000"; fi
|
|
LogText "Result: currently ${FIND} connections are in a waiting state (max configured: ${OPTIONS_CONN_MAX_WAIT_STATE})."
|
|
if [ ${FIND} -gt ${OPTIONS_CONN_MAX_WAIT_STATE} ]; then
|
|
Display --indent 2 --text "- Checking waiting connections" --result "${STATUS_WARNING}" --color YELLOW
|
|
ReportSuggestion "${TEST_NO}" "Determine why system has many connections in WAIT state (${FIND})"
|
|
else
|
|
Display --indent 2 --text "- Checking waiting connections" --result "${STATUS_OK}" --color GREEN
|
|
LogText "Result: ${FIND} connections are in WAIT state"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : NETW-3030
|
|
# Description : Checking for DHCP client
|
|
Register --test-no NETW-3030 --weight L --network NO --category security --description "Checking DHCP client status"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
IsRunning dhclient || IsRunning dhcpd
|
|
if [ ${RUNNING} -eq 1 ]; then
|
|
Display --indent 2 --text "- Checking status DHCP client" --result "${STATUS_RUNNING}" --color WHITE
|
|
DHCP_CLIENT_RUNNING=1
|
|
else
|
|
Display --indent 2 --text "- Checking status DHCP client" --result "NOT ACTIVE" --color WHITE
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : NETW-3032
|
|
# Description : Checking for ARP spoofing and related monitoring software
|
|
Register --test-no NETW-3032 --os Linux --weight L --network NO --category security --description "Checking for ARP monitoring software"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
FOUND=0
|
|
|
|
# arpwatch
|
|
IsRunning arpwatch
|
|
if [ ${RUNNING} -eq 1 ]; then
|
|
FOUND=1
|
|
ARPWATCH_RUNNING=1
|
|
Display --indent 2 --text "- Checking for ARP monitoring software" --result "${STATUS_RUNNING}" --color GREEN
|
|
fi
|
|
|
|
# arpon
|
|
IsRunning arpon
|
|
if [ ${RUNNING} -eq 1 ]; then
|
|
FOUND=1
|
|
ARPON_RUNNING=1
|
|
Display --indent 2 --text "- Checking for ARP monitoring software" --result "${STATUS_RUNNING}" --color GREEN
|
|
fi
|
|
if [ ${FOUND} -eq 0 ]; then
|
|
Display --indent 2 --text "- Checking for ARP monitoring software" --result "${STATUS_NOT_FOUND}" --color YELLOW
|
|
ReportSuggestion ${TEST_NO} "Consider running ARP monitoring software (arpwatch,arpon)"
|
|
fi
|
|
fi
|
|
#
|
|
#################################################################################
|
|
#
|
|
|
|
Report "dhcp_client_running=${DHCP_CLIENT_RUNNING}"
|
|
Report "arpwatch_running=${ARPWATCH_RUNNING}"
|
|
|
|
WaitForKeyPress
|
|
|
|
#
|
|
#================================================================================
|
|
# Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com
|