prehistoric-systems/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2026-03-11 08:55:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
lynis/include/tests_ssh
Kamil Boratyński f28fd77583 Modified [SSH-7408] -- made it widely usable. 
Modified [SSH-7408] in such a way that every option for SSH server might
be added in SSHOPS with expected (and wrong) values
(like it was described in comment).
2015-12-03 02:29:54 +01:00

276 lines
13 KiB
Bash
Raw Blame History

#!/bin/sh
#################################################################################
#
# Lynis
# ------------------
#
# Copyright 2007-2015, Michael Boelen (michael.boelen@cisofy.com)
# Web site: https://cisofy.com
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# SSH
#
#################################################################################
#
SSH_DAEMON_CONFIG_LOCS="/etc /etc/ssh /usr/local/etc/ssh /opt/csw/etc/ssh"
SSH_DAEMON_CONFIG=""
SSH_DAEMON_PORT=""
SSH_DAEMON_RUNNING=0
#
#################################################################################
#
InsertSection "SSH Support"
#
#################################################################################
#
# Test : SSH-7402
# Description : Check for a running SSH daemon
Register --test-no SSH-7402 --weight L --network NO --description "Check for running SSH daemon"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: Searching for a SSH daemon"
IsRunning sshd
if [ ${RUNNING} -eq 1 ]; then
SSH_DAEMON_RUNNING=1
Display --indent 2 --text "- Checking running SSH daemon" --result FOUND --color GREEN
else
Display --indent 2 --text "- Checking running SSH daemon" --result "NOT FOUND" --color WHITE
fi
fi
#
#################################################################################
#
# Test : SSH-7404
# Description : Determine SSH daemon configuration file location
if [ ${SSH_DAEMON_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no SSH-7404 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH daemon file location"
if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0
logtext "Test: searching for sshd_config file"
for I in ${SSH_DAEMON_CONFIG_LOCS}; do
if [ -f "${I}/sshd_config" ]; then
logtext "Result: ${I}/sshd_config exists"
if [ ${FOUND} -eq 1 ]; then
ReportException "${TEST_NO}:01"
logtext "Result: we already had found another sshd_config file. Using this new file then."
fi
FileIsReadable ${I}/sshd_config
if [ ${CANREAD} -eq 1 ]; then
FOUND=1
SSH_DAEMON_CONFIG="${I}/sshd_config"
else
logtext "Result: can not read ${I}/sshd_config file (no permission)"
fi
fi
done
if [ "${SSH_DAEMON_CONFIG}" = "" ]; then
logtext "Result: No sshd configuration found"
Display --indent 4 --text "- Searching SSH configuration" --result "NOT FOUND" --color YELLOW
ReportException "${TEST_NO}:1" "SSH daemon is running, but no readable configuration file found"
else
logtext "Result: using last found configuration file: ${SSH_DAEMON_CONFIG}"
Display --indent 4 --text "- Searching SSH configuration" --result FOUND --color GREEN
fi
fi
#
#################################################################################
#
# Test : SSH-7408
# Description : Check SSH specific defined options
if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no SSH-7408 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH specific defined options"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: Checking specific defined options in ${SSH_DAEMON_CONFIG}"
## SSHOPTIONS scheme:
## <OptionName>:<ExpectedValue>,<MediumScoreValue>,<WrongValue>
## Example:
## PermitRootLogin:NO,WITHOUT-PASSWORD,YES
SSHOPS="Protocol:2,,1"
for I in ${SSHOPS};
do
OPTIONNAME=`echo ${I} | cut -d ':' -f1`
EXPECTEDVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f1`
MEDIUMSCOREDVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f2`
WRONGVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f3`
FOUNDVALUE=`awk -v OPT="${OPTIONNAME}" 'index($0, OPT) == 1 { print toupper($2) }' ${SSH_DAEMON_CONFIG}`
logtext "Test: Checking ${OPTIONNAME} in ${SSH_DAEMON_CONFIG}"
if [ ! "${FOUNDVALUE}" = "" ]; then
logtext "Result: Option ${OPTIONNAME} found in ${SSH_DAEMON_CONFIG}"
logtext "Result: Option ${OPTIONNAME} value is ${FOUNDVALUE}"
if [ "${FOUNDVALUE}" = "${EXPECTEDVALUE}" ]; then
logtext "Result: SSH option ${OPTIONNAME} is configured very well"
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result OK --color GREEN
AddHP 3 3
elif [ "${FOUNDVALUE}" = "${MEDIUMSCOREDVALUE}" ]; then
logtext "Result: SSH option ${OPTIONNAME} is configured totally wrong"
ReportSuggestion ${TEST_NO} "Harder SSH option: ${OPTIONNAME}"
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "MEDIUM" --color YELLOW
AddHP 1 3
elif [ "${FOUNDVALUE}" = "${WRONGVALUE}" ]; then
logtext "Result: SSH option ${OPTIONNAME} is configured totally wrong"
ReportWarning ${TEST_NO} "M" "Unsafe configured SSH option: ${OPTIONNAME}"
ReportSuggestion ${TEST_NO} "Reconfigure ${OPTIONNAME}"
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result WARNING --color RED
AddHP 0 3
else
logtext "Result: Value of SSH option ${OPTIONNAME} is unknown (not defined)"
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result DEFAULT --color WHITE
fi
else
logtext "Result: Option ${OPTIONNAME} not found in ${SSH_DAEMON_CONFIG}"
Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "NOT FOUND" --color WHITE
fi
done
fi
#
#################################################################################
#
# Test : SSH-7412
# Description : Check SSH PermitRootLogin option
if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no SSH-7412 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH option: PermitRootLogin"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: check PermitRootLogin option"
FIND=`awk '/^PermitRootLogin/ { print $2 }' ${SSH_DAEMON_CONFIG}`
if [ "${FIND}" = "yes" -o "${FIND}" = "YES" -o "${FIND}" = "Yes" ]; then
logtext "Result: PermitRootLogin is enabled, root can login directly"
Display --indent 4 --text "- SSH option: PermitRootLogin" --result WARNING --color RED
ReportWarning ${TEST_NO} "M" "Root can directly login via SSH"
AddHP 0 3
else
# YYY add test for DenyUsers root
if [ "${FIND}" = "no" -o "${FIND}" = "No" ]; then
logtext "Result: PermitRootLogin is disabled. Root can't login directly"
Display --indent 4 --text "- SSH option: PermitRootLogin" --result DISABLED --color GREEN
AddHP 3 3
elif [ "${FIND}" = "without-password" ]; then
# Check if password authentication is disabled for root user, so this option is used properly
logtext "Result: PermitRootLogin is disabled. Root can't login directly"
Display --indent 4 --text "- SSH option: PermitRootLogin (without-password)" --result OK --color GREEN
AddHP 3 3
else
logtext "Result: Value of PermitRootLogin is unknown (not defined)"
Display --indent 4 --text "- SSH option: PermitRootLogin" --result DEFAULT --color WHITE
fi
fi
fi
#
#################################################################################
#
# Test : SSH-7414
# Description : Check SSH Protocol option
if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no SSH-7414 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH option: Protocol"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: check allowed SSH protocol versions"
FIND=`awk '/^Protocol/ { print $2 }' ${SSH_DAEMON_CONFIG}`
if [ "${FIND}" = "1" -o "${FIND}" = "2,1" -o "${FIND}" = "1,2" ]; then
logtext "Result: Protocol option is set to allow SSH protocol version 1"
Display --indent 4 --text "- SSH option: Protocol" --result WARNING --color RED
ReportWarning ${TEST_NO} "M" "SSH protocol version 1 is allowed"
AddHP 0 3
else
if [ "${FIND}" = "2" ]; then
logtext "Result: only protocol 2 is allowed"
Display --indent 4 --text "- SSH option: Protocol" --result OK --color GREEN
AddHP 3 3
else
logtext "Result: value of Protocol is unknown (not defined)"
Display --indent 4 --text "- SSH option: Protocol" --result DEFAULT --color WHITE
fi
fi
fi
#
#################################################################################
#
# Test : SSH-7416
# Description : Check SSH StrictModes option
if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no SSH-7416 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH option: StrictModes"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: Check configured StrictModes option"
FIND=`awk '/^StrictModes/ { print $2 }' ${SSH_DAEMON_CONFIG}`
if [ "${FIND}" = "no" -o "${FIND}" = "NO" -o "${FIND}" = "No" ]; then
logtext "Result: StrictModes option is set to 'no', which means file permissions are NOT checked"
Display --indent 4 --text "- SSH option: StrictModes" --result WARNING --color RED
ReportWarning ${TEST_NO} "M" "StrictModes is turned off"
ReportSuggestion ${TEST_NO} "Check StrictModes option in sshd_config"
AddHP 0 3
else
if [ "${FIND}" = "yes" -o "${FIND}" = "YES" -o "${FIND}" = "Yes" ]; then
logtext "Result: StrictModes active, file permissions are checked"
Display --indent 4 --text "- SSH option: StrictModes" --result OK --color GREEN
AddHP 3 3
else
logtext "Result: value of StrictModes is unknown (not defined)"
Display --indent 4 --text "- SSH option: StrictModes" --result DEFAULT --color WHITE
fi
fi
fi
#
#################################################################################
#
# Test : SSH-7440
# Description : AllowUsers / AllowGroups
# Goal : Check if only a specific amount of users/groups can log in to the system
if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
Register --test-no SSH-7440 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH option: AllowUsers and AllowGroups"
if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0
# AllowUsers
FIND=`egrep "^AllowUsers" ${SSH_DAEMON_CONFIG} | awk '{ print $2 }'`
if [ ! "${FIND}" = "" ]; then
logtext "Result: AllowUsers set, with value ${FIND}"
Display --indent 4 --text "- SSH option: AllowUsers" --result FOUND --color GREEN
FOUND=1
else
logtext "Result: AllowUsers is not set"
Display --indent 4 --text "- SSH option: AllowUsers" --result "NOT FOUND" --color WHITE
fi
# AllowGroups
FIND=`egrep "^AllowGroups" ${SSH_DAEMON_CONFIG} | awk '{ print $2 }'`
if [ ! "${FIND}" = "" ]; then
logtext "Result: AllowUsers set ${FIND}"
Display --indent 4 --text "- SSH option: AllowGroups" --result FOUND --color GREEN
FOUND=1
else
logtext "Result: AllowGroups is not set"
Display --indent 4 --text "- SSH option: AllowGroups" --result "NOT FOUND" --color WHITE
fi
if [ ${FOUND} -eq 1 ]; then
logtext "Result: SSH is limited to a specific set of users, which is good"
AddHP 2 2
else
logtext "Result: SSH has no specific user or group limitation. Most likely all valid users can SSH to this machine."
AddHP 0 1
fi
fi
#
#################################################################################
#
report "ssh_daemon_running=${SSH_DAEMON_RUNNING}"
#report "ssh_daemon_port=${SSH_DAEMON_PORT}"
wait_for_keypress
#
#================================================================================
# Lynis - Copyright 2007-2015, Michael Boelen, CISOfy - https://cisofy.com
Reference in a new issue View git blame Copy permalink