diff options
| author | kisst <github@kisst.net> | 2018-05-02 14:19:01 +0300 |
|---|---|---|
| committer | Michael Boelen <michael.boelen@cisofy.com> | 2018-05-02 14:19:01 +0300 |
| commit | 039945bde641835ead8562e3aebac0a43910412e (patch) | |
| tree | aa9ebade6f68de31cc7c8820b90742fb0b8dd74c /include/tests_dns | |
| parent | 7fd81899078b3fc6b12e322ff1cf9001432242ab (diff) | |
DNS-1600 Check for DNSSEC validation (#535)
Diffstat (limited to 'include/tests_dns')
| -rw-r--r-- | include/tests_dns | 73 |
1 files changed, 73 insertions, 0 deletions
diff --git a/include/tests_dns b/include/tests_dns new file mode 100644 index 00000000..4fbc7caa --- /dev/null +++ b/include/tests_dns @@ -0,0 +1,73 @@ +#!/bin/sh + +################################################################################# +# +# Lynis +# ------------------ +# +# Copyright 2007-2013, Michael Boelen +# Copyright 2007-2018, CISOfy +# +# Website : https://cisofy.com +# Blog : http://linux-audit.com +# GitHub : https://github.com/CISOfy/lynis +# +# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are +# welcome to redistribute it under the terms of the GNU General Public License. +# See LICENSE file for usage of this software. +# +################################################################################# +# +# DNS +# +################################################################################# +# + SIGOKDNS="sigok.verteiltesysteme.net" # adress with good DESSEC signiture + SIGFAILDNS="sigfail.verteiltesysteme.net" # adress with bad DESSEC signiture + # TODO update it once cisofy.com records are created + # TODO after update even IP match can be checked to detect highjacking + TIMEOUT=";; connection timed out; no servers could be reached" +# +################################################################################# +# + InsertSection "DNS" +# +################################################################################# +# + # Test : DNS-1600 + # Description : Validate DNSSEC signiture is checked + Register --test-no DNS-1600 --weight L --network YES --category security --description "Validate DNSSEC igniture is checked" + if [ "${SKIPTEST}" -eq 0 ]; then + if [ ! -z "${DIGBINARY}" ]; then + + GOOD=$("${DIGBINARY}" +short +time=1 $SIGOKDNS) + BAD=$("${DIGBINARY}" +short +time=1 $SIGFAILDNS) + + if [ "$GOOD" = "$TIMEOUT" ] && [ "$BAD" = "$TIMEOUT" ]; then + LogText "Result: Exception found, can't determine DNSSEC validation" + Display --indent 4 --text "- Checking DNSSEC validation" --result "${STATUS_UNKOWN}" --color YELLOW + ReportException "${TEST_NO}" "Exception found, both query failed, due to connection timeout" + elif [ -z "$GOOD" ] && ! [ -z "$BAD" ]; then + LogText "Result: Exception found, can't determine DNSSEC validation" + Display --indent 4 --text "- Checking DNSSEC validation" --result "${STATUS_UNKOWN}" --color YELLOW + ReportException "${TEST_NO}" "Exception found, OK failed, Bad signiture was accepted" + elif ! [ -z "$GOOD" ] && ! [ -z "$BAD" ]; then + Display --indent 4 --text "- Checking DNSSEC validation" --result "${STATUS_SUGGESTION}" --color YELLOW + LogText "Note: Useing DNSsec validation can protect from DNS highjacking" + ReportSuggestion "${TEST_NO}" "Malformated DNS querys are accepted, Configure DNSSEC valdating name servers" + AddHP 2 2 + elif ! [ -z "$GOOD" ] && [ -z "$BAD" ]; then + Display --indent 4 --text "- Checking DNSSEC validation" --result "${STATUS_OK}" --color GREEN + LogText "Result: Malformated DNS responses were ignored" + AddHP 0 2 + fi + else + Display --indent 4 --text "- DESSEC validation" --result "${STATUS_SKIPPED}" --color YELLOW + LogText "Result: dig not installed, test can't be fully performed" + fi + else + LogText "Result: Test was skipped" + fi +# +################################################################################# +# |