mirror of
https://github.com/CISOfy/lynis.git
synced 2026-03-11 08:55:28 +00:00
84dd024887
There are several challenges with the existing method of using /etc/crypttab: 1)encrypted rootfs partitions are not typically listed in this file (users are prompted for password in early boot instead) 2)the 'luks' option is the default option so it is possible for /etc/crypttab entries to never have this set explicitly and any block device configured as such will be missed currently 3)any device mounted manually, or using any other mechanism aside from /etc/crypttab will be missed This commit executes 'cryptsetup isLuks' on every block device in the system to determine whether it is a LUKS device. This handles all 3 cases mentioned above. Test case wording was also updated to reflect the fact that it only checks for LUKS entrypted block devices. So, plain dm-crypt and TrueCrypt/VeraCrypt block device encryption is not detected. Nor is any file system level encryption such as eCryptfs, EncFs, gocryptfs.
155 lines
8.3 KiB
Bash
155 lines
8.3 KiB
Bash
#!/bin/sh
|
|
|
|
#################################################################################
|
|
#
|
|
# Lynis
|
|
# ------------------
|
|
#
|
|
# Copyright 2007-2013, Michael Boelen
|
|
# Copyright 2007-2019, CISOfy
|
|
#
|
|
# Website : https://cisofy.com
|
|
# Blog : http://linux-audit.com
|
|
# GitHub : https://github.com/CISOfy/lynis
|
|
#
|
|
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
|
|
# welcome to redistribute it under the terms of the GNU General Public License.
|
|
# See LICENSE file for usage of this software.
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Cryptography
|
|
#
|
|
#################################################################################
|
|
#
|
|
InsertSection "Cryptography"
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : CRYP-7902
|
|
# Description : check for expired SSL certificates
|
|
if [ -n "${OPENSSLBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no CRYP-7902 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check expire date of SSL certificates"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
COUNT_EXPIRED=0
|
|
COUNT_TOTAL=0
|
|
FOUNDPROBLEM=0
|
|
SKIP=0
|
|
sSSL_PATHS=$(echo ${SSL_CERTIFICATE_PATHS} | ${SEDBINARY} 's/:space:/__space__/g' | ${SEDBINARY} 's/:/ /g')
|
|
sSSL_PATHS=$(echo ${sSSL_PATHS} | ${SEDBINARY} 's/^ //' | ${SORTBINARY} | ${UNIQBINARY})
|
|
LogText "Paths to scan: ${sSSL_PATHS}"
|
|
|
|
IGNORE_PATHS_PRINT=$(echo ${SSL_CERTIFICATE_PATHS_TO_IGNORE} | ${SEDBINARY} 's/:/, /g' | ${SEDBINARY} 's/__space__/ /g' | ${SEDBINARY} 's/^ //' | ${SORTBINARY} | ${UNIQBINARY})
|
|
LogText "Paths to ignore: ${IGNORE_PATHS_PRINT}"
|
|
|
|
for DIR in ${sSSL_PATHS}; do
|
|
COUNT_DIR=0
|
|
if [ -d ${DIR} ]; then
|
|
FileIsReadable ${DIR}
|
|
if [ ${CANREAD} -eq 1 ]; then
|
|
LASTSUBDIR=""
|
|
LogText "Result: found directory ${DIR}"
|
|
# Search for certificate files
|
|
FILES=$(${FINDBINARY} ${DIR} -type f 2> /dev/null | ${EGREPBINARY} ".crt$|.pem$|^cert" | ${SORTBINARY} | ${SEDBINARY} 's/ /__space__/g')
|
|
for FILE in ${FILES}; do
|
|
FILE=$(echo ${FILE} | ${SEDBINARY} 's/__space__/ /g')
|
|
# See if we need to skip this path
|
|
SUBDIR=$(echo ${FILE} | ${AWKBINARY} -F/ 'sub(FS $NF,x)' | ${SEDBINARY} 's/__space__/ /g')
|
|
# If we discover a new directory, do evaluation
|
|
#Debug "File : ${FILE}"
|
|
#Debug "Lastdir: ${LASTSUBDIR}"
|
|
#Debug "Curdir : ${SUBDIR}"
|
|
if [ ! "${SUBDIR}" = "${LASTSUBDIR}" ]; then
|
|
SKIP=0
|
|
# Now check if this path is on the to-be-ignored list
|
|
for D in ${SSL_CERTIFICATE_PATHS_TO_IGNORE}; do
|
|
if Equals "${D}" "${SUBDIR}"; then
|
|
SKIP=1
|
|
LogText "Result: skipping directory (${SUBDIR}) as it is on ignore list"
|
|
fi
|
|
done
|
|
fi
|
|
if [ ${SKIP} -eq 0 ]; then
|
|
#Debug "Testing ${FILE} in path: $SUBDIR"
|
|
COUNT_DIR=$((COUNT_DIR + 1))
|
|
FileIsReadable "${FILE}"
|
|
if [ ${CANREAD} -eq 1 ]; then
|
|
# Only check the files that are not installed by a package
|
|
if ! FileInstalledByPackage "${FILE}"; then
|
|
OUTPUT=$(${GREPBINARY} -q 'BEGIN CERT' "${FILE}")
|
|
if [ $? -eq 0 ]; then
|
|
LogText "Result: file is a certificate file"
|
|
FIND=$(${OPENSSLBINARY} x509 -noout -in "${FILE}" -enddate 2> /dev/null | ${GREPBINARY} "^notAfter")
|
|
if [ $? -eq 0 ]; then
|
|
# Check certificate where 'end date' has been expired
|
|
FIND=$(${OPENSSLBINARY} x509 -noout -checkend 0 -in "${FILE}" -enddate 2> /dev/null)
|
|
EXIT_CODE=$?
|
|
CERT_CN=$(${OPENSSLBINARY} x509 -noout -subject -in "${FILE}" 2> /dev/null | ${SEDBINARY} -e 's/^subject.*CN=\([a-zA-Z0-9\.\-\*]*\).*$/\1/')
|
|
CERT_NOTAFTER=$(${OPENSSLBINARY} x509 -noout -enddate -in "${FILE}" 2> /dev/null | ${AWKBINARY} -F= '{if ($1=="notAfter") { print $2 }}')
|
|
Report "certificate[]=${FILE}|${EXIT_CODE}|cn:${CERT_CN};notafter:${CERT_NOTAFTER};|"
|
|
if [ ${EXIT_CODE} -eq 0 ]; then
|
|
LogText "Result: certificate ${FILE} seems to be correct and still valid"
|
|
else
|
|
FOUNDPROBLEM=1
|
|
COUNT_EXPIRED=$((COUNT_EXPIRED + 1))
|
|
LogText "Result: certificate ${FILE} has been expired"
|
|
fi
|
|
else
|
|
LogText "Result: skipping tests for this file (${FILE}) as it is most likely not a certificate (is it a key file?)"
|
|
fi
|
|
else
|
|
LogText "Result: skipping test for this file (${FILE}) as we could not find 'BEGIN CERT'"
|
|
fi
|
|
fi
|
|
else
|
|
LogText "Result: can not read file ${FILE} (no permission)"
|
|
fi
|
|
fi
|
|
LASTSUBDIR="${SUBDIR}"
|
|
done
|
|
COUNT_TOTAL=$((COUNT_TOTAL + COUNT_DIR))
|
|
LogText "Result: found ${COUNT_DIR} certificates in ${DIR}"
|
|
else
|
|
LogText "Result: can not read path ${DIR} (no permission)"
|
|
fi
|
|
else
|
|
LogText "Result: SSL path ${DIR} does not exist"
|
|
fi
|
|
done
|
|
Report "certificates=${COUNT_TOTAL}"
|
|
LogText "Result: found a total of ${COUNT_TOTAL} certificates"
|
|
|
|
if [ ${FOUNDPROBLEM} -eq 0 ]; then
|
|
Display --indent 2 --text "- Checking for expired SSL certificates [${COUNT_EXPIRED}/${COUNT_TOTAL}]" --result "${STATUS_NONE}" --color GREEN
|
|
else
|
|
Display --indent 2 --text "- Checking for expired SSL certificates [${COUNT_EXPIRED}/${COUNT_TOTAL}]" --result "${STATUS_FOUND}" --color RED
|
|
ReportSuggestion ${TEST_NO} "Check available certificates for expiration"
|
|
fi
|
|
fi
|
|
|
|
#
|
|
#################################################################################
|
|
#
|
|
# Test : CRYP-7930
|
|
# Description : Determine if system uses LUKS block device encryption
|
|
if [ ! "${LSBLKBINARY}" = "" -a ! "${CRYPTSETUPBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
|
|
Register --test-no CRYP-7930 --preqs-met ${PREQS_MET} --weight L --network NO --root-only YES --category security --description "Determine if system uses LUKS block device encryption"
|
|
if [ ${SKIPTEST} -eq 0 ]; then
|
|
FOUND=0
|
|
for BLOCK_DEV in $(${LSBLKBINARY} --noheadings -o PATH); do
|
|
if ${CRYPTSETUPBINARY} isLuks ${BLOCK_DEV}; then
|
|
LogText "Result: Found LUKS encrypted block device: ${BLOCK_DEV}"
|
|
Report "encryption[]=luks,block_device,${BLOCK_DEV}"
|
|
((FOUND++))
|
|
fi
|
|
done
|
|
Display --indent 2 --text "- Found ${FOUND} LUKS encrypted block devices." --result OK --color WHITE
|
|
unset BLOCK_DEV
|
|
fi
|
|
#
|
|
#################################################################################
|
|
WaitForKeyPress
|
|
|
|
#
|
|
#================================================================================
|
|
# Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com
|