diff options
| -rw-r--r-- | CHANGELOG.md | 6 | ||||
| -rw-r--r-- | db/languages/ru | 76 | ||||
| -rw-r--r-- | db/tests.db | 2 | ||||
| -rw-r--r-- | include/consts | 3 | ||||
| -rw-r--r-- | include/functions | 27 | ||||
| -rw-r--r-- | include/tests_authentication | 55 | ||||
| -rw-r--r-- | include/tests_crypto | 2 | ||||
| -rw-r--r-- | include/tests_insecure_services | 22 | ||||
| -rw-r--r-- | include/tests_kernel | 3 | ||||
| -rw-r--r-- | include/tests_memory_processes | 2 | ||||
| -rw-r--r-- | include/tests_networking | 87 | ||||
| -rwxr-xr-x | lynis | 11 |
12 files changed, 171 insertions, 125 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 3d6905a9..051088ca 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -60,6 +60,7 @@ Using the relevant options, the scan will change base on the intended goal. - New test: FINT-4341 - verify status of dm-verity (Linux) - New test: INSE-8314 - test for NIS client - New test: INSE-8316 - test for NIS server +- New test: NETW-2400 - test hostname for valid characters and length - New test: NETW-2706 - check DNSSEC (systemd) - New test: NETW-3200 - determine enabled network protocols - New test: PHP-2382 - detect listen option in PHP (FPM) @@ -77,6 +78,7 @@ Using the relevant options, the scan will change base on the intended goal. - Added end-of-life data for Arch Linux and Debian - Detection and end-of-life data added for Amazon Linux - Detection of linux-lts on Arch Linux +- Translations: Russian added ### Changed - Function: CheckItem() now returns only exit code (ITEM_FOUND is dropped) @@ -90,9 +92,10 @@ Using the relevant options, the scan will change base on the intended goal. - AUTH-9234 - NetBSD support - AUTH-9252 - corrected permission check - AUTH-9266 - skip .pam-old files in /etc/pam.d -- AUTH-9268 - Perform test also on FreeBSD and NetBSD +- AUTH-9268 - Perform test also on DragonFly, FreeBSD, and NetBSD - AUTH-9282 - fix: temporary variable was overwritten - AUTH-9408 - added support for pam_tally2 to log failed logins +- AUTH-9489 - test removedd as it is merged with AUTH-9218 - BANN-7126 - additional words for login banner are accepted - BOOT-5122 - check for defined password in all GRUB configuration files - CONT-8106 - support newer 'docker info' output @@ -157,6 +160,7 @@ Using the relevant options, the scan will change base on the intended goal. - Several code cleanups, simplification of commands, and code standardization - Tests using lsof may ignore individual threads (if supported) - Corrected end-of-life detection for CentOS 7 and CentOS 8 +- Tests can require detected package manager (--package-manager-required) - Do not show tool tips when quiet option is used - Improved screen output in several tests - Extended output of 'lynis update info' diff --git a/db/languages/ru b/db/languages/ru index e16f1062..5153a319 100644 --- a/db/languages/ru +++ b/db/languages/ru @@ -1,38 +1,38 @@ -GEN_CHECKING="Checking" -GEN_CURRENT_VERSION="Current version" -GEN_DEBUG_MODE="Debug mode" -GEN_INITIALIZE_PROGRAM="Initializing program" -GEN_PHASE="phase" -GEN_PLUGINS_ENABLED="Plugins enabled" -GEN_VERBOSE_MODE="Verbose mode" -GEN_UPDATE_AVAILABLE="update available" -GEN_WHAT_TO_DO="What to do" -NOTE_EXCEPTIONS_FOUND="Exceptions found" -NOTE_EXCEPTIONS_FOUND_DETAILED="Some exceptional events or information was found" -NOTE_PLUGINS_TAKE_TIME="Note: plugins have more extensive tests and may take several minutes to complete" -SECTION_CUSTOM_TESTS="Custom Tests" -SECTION_MALWARE="Malware" -SECTION_MEMORY_AND_PROCESSES="Memory and Processes" -STATUS_DONE="DONE" -STATUS_FOUND="FOUND" -STATUS_YES="YES" -STATUS_NO="NO" -STATUS_OFF="OFF" -STATUS_OK="OK" -STATUS_ON="ON" -STATUS_NONE="NONE" -STATUS_NOT_FOUND="NOT FOUND" -STATUS_NOT_RUNNING="NOT RUNNING" -STATUS_RUNNING="RUNNING" -STATUS_SKIPPED="SKIPPED" -STATUS_SUGGESTION="SUGGESTION" -STATUS_UNKNOWN="UNKNOWN" -STATUS_WARNING="WARNING" -TEXT_YOU_CAN_HELP_LOGFILE="You can help by providing your log file" -TEXT_UPDATE_AVAILABLE="update available" -NOTE_SKIPPED_TESTS_NON_PRIVILEGED="Skipped tests due to non-privileged mode" -STATUS_DISABLED="DISABLED" -STATUS_ENABLED="ENABLED" -STATUS_ERROR="ERROR" -ERROR_NO_LICENSE="No license key configured" -ERROR_NO_UPLOAD_SERVER="No upload server configured" +GEN_CHECKING="Проверка" +GEN_CURRENT_VERSION="Текущая версия" +GEN_DEBUG_MODE="Режим отладки" +GEN_INITIALIZE_PROGRAM="Инициализация программы" +GEN_PHASE="Стадия" +GEN_PLUGINS_ENABLED="Плагины включены" +GEN_VERBOSE_MODE="Подробный режим" +GEN_UPDATE_AVAILABLE="доступно обновление" +GEN_WHAT_TO_DO="Что сделать" +NOTE_EXCEPTIONS_FOUND="Найдены исключения" +NOTE_EXCEPTIONS_FOUND_DETAILED="Были найдены некоторые исключительные события или информация" +NOTE_PLUGINS_TAKE_TIME="Примечание: плагины имеют более обширные тесты и могут занять несколько минут до завершения" +SECTION_CUSTOM_TESTS="Пользовательские тесты" +SECTION_MALWARE="Вредоносное ПО" +SECTION_MEMORY_AND_PROCESSES="Память и процессы" +STATUS_DONE="Завершено" +STATUS_FOUND="Найдено" +STATUS_YES="ДА" +STATUS_NO="НЕТ" +STATUS_OFF="Выключено" +STATUS_OK="ОК" +STATUS_ON="Включено" +STATUS_NONE="Отсутствует" +STATUS_NOT_FOUND="НЕ НАЙДЕНО" +STATUS_NOT_RUNNING="НЕ ЗАПУЩЕНО" +STATUS_RUNNING="ЗАПУЩЕНО" +STATUS_SKIPPED="ПРОПУЩЕНО" +STATUS_SUGGESTION="ПРЕДЛОЖЕНИЕ" +STATUS_UNKNOWN="НЕИЗВЕСТНО" +STATUS_WARNING="ПРЕДУПРЕЖДЕНИЕ" +TEXT_YOU_CAN_HELP_LOGFILE="Вы можете помочь предоставив ваш лог-файл" +TEXT_UPDATE_AVAILABLE="доступно обновление" +NOTE_SKIPPED_TESTS_NON_PRIVILEGED="Тесты пропущены из-за использования непривилегированного режима" +STATUS_DISABLED="ОТКЛЮЧЕНО" +STATUS_ENABLED="ВКЛЮЧЕНО" +STATUS_ERROR="ОШИБКА" +ERROR_NO_LICENSE="Лицензионный ключ не настроен" +ERROR_NO_UPLOAD_SERVER="Загрузочный сервер не настроен" diff --git a/db/tests.db b/db/tests.db index ba9778d1..62857946 100644 --- a/db/tests.db +++ b/db/tests.db @@ -49,7 +49,6 @@ AUTH-9406:test:security:authentication::Query LDAP servers in client configurati AUTH-9408:test:security:authentication::Logging of failed login attempts via /etc/login.defs: AUTH-9409:test:security:authentication:OpenBSD:Check for doas file: AUTH-9410:test:security:authentication:OpenBSD:Check for doas file permissions: -AUTH-9489:test:security:authentication:DragonFly:Check login shells for passwordless accounts: BANN-7113:test:security:banners:FreeBSD:Check COPYRIGHT banner file: BANN-7124:test:security:banners::Check issue banner file: BANN-7126:test:security:banners::Check issue banner file contents: @@ -288,6 +287,7 @@ NAME-4402:test:security:nameservices::Check duplicate line in /etc/hosts: NAME-4404:test:security:nameservices::Check /etc/hosts contains an entry for this server name: NAME-4406:test:security:nameservices::Check server hostname mapping: NAME-4408:test:security:nameservices::Check localhost to IP mapping: +NETW-2400:test:basics:networking::Test hostname for valid characters and length: NETW-2600:test:security:networking:Linux:Checking IPv6 configuration: NETW-2704:test:security:networking::Basic nameserver configuration tests: NETW-2705:test:security:networking::Check availability two nameservers: diff --git a/include/consts b/include/consts index 3969aad5..c1f65ea2 100644 --- a/include/consts +++ b/include/consts @@ -125,6 +125,7 @@ unset LANG GRSEC_FOUND=0 GRUBCONFFILE="" GRUB2INSTALLBINARY="" + HAS_PACKAGE_MANAGER=0 HAS_SYSTEMD=0 HEADBINARY="" HELPER="" @@ -222,6 +223,7 @@ unset LANG PGREPBINARY="" PIDFILE="" PKG_BINARY="" + PKGINFOBINARY="" PKGADMINBINARY="" PLUGINDIR="" PLUGIN_PHASE=0 @@ -324,6 +326,7 @@ unset LANG VULNERABLE_PACKAGES_FOUND=0 WCBINARY="" XARGSBINARY="" + XBPSBINARY="" YUMBINARY="" ZYPPERBINARY="" diff --git a/include/functions b/include/functions index 492ade27..58ddabe9 100644 --- a/include/functions +++ b/include/functions @@ -2019,6 +2019,7 @@ PackageIsInstalled() { exit_code=255 + # First parameter is package name (or __dummy__ for initial test to see if package manager is available and works as expected) if [ $# -eq 1 ]; then package="$1" else @@ -2056,7 +2057,21 @@ output=$(${XBPSBINARY} ${package} 2> /dev/null | ${GREPBINARY} "^ii") exit_code=$? else - ReportException "PackageIsInstalled:01" + if [ "${package}" != "__dummy__" ]; then + ReportException "PackageIsInstalled:01 (test=${TEST_NO:-unknown})" + fi + fi + + # Give thumbs up if dummy package is used during initial test for package manager availability + if [ "${package}" = "__dummy__" ]; then + # There should be no positive match on this dummy package + if [ ${exit_code} -eq 0 ]; then + exit_code=1 + elif [ ${exit_code} -eq 255 ]; then + exit_code=1 + else + exit_code=0 + fi fi return ${exit_code} @@ -2499,8 +2514,8 @@ Register() { # Do not insert a log break, if previous test was not logged if [ ${SKIPLOGTEST} -eq 0 ]; then LogTextBreak; fi - ROOT_ONLY=0; SKIPTEST=0; SKIPLOGTEST=0; SKIPREASON=""; TEST_NEED_OS=""; PREQS_MET="" - TEST_CATEGORY=""; TEST_NEED_NETWORK=""; TEST_NEED_PLATFORM="" + ROOT_ONLY=0; SKIPTEST=0; SKIPLOGTEST=0; SKIPREASON=""; PREQS_MET="" + TEST_CATEGORY=""; TEST_NEED_NETWORK=""; TEST_NEED_OS=""; TEST_NEED_PKG_MGR=0; TEST_NEED_PLATFORM="" TOTAL_TESTS=$((TOTAL_TESTS + 1)) while [ $# -ge 1 ]; do case $1 in @@ -2524,6 +2539,9 @@ shift TEST_NEED_OS=$1 ;; + --package-manager-required) + TEST_NEED_PKG_MGR=1 + ;; --preqs-met) shift PREQS_MET=$1 @@ -2636,6 +2654,9 @@ # Check for correct hardware platform if [ ${SKIPTEST} -eq 0 -a -n "${TEST_NEED_PLATFORM}" -a ! "${HARDWARE}" = "${TEST_NEED_PLATFORM}" ]; then SKIPTEST=1; SKIPREASON="Incorrect hardware platform"; fi + # Check for required (and discovered) package manager + if [ ${SKIPTEST} -eq 0 -a ${TEST_NEED_PKG_MGR} -eq 1 -a ${HAS_PACKAGE_MANAGER} -eq 0 ]; then SKIPTEST=1; SKIPREASON="Requires a known package manager to test presence of a particular package"; fi + # Not all prerequisites met, like missing tool if [ ${SKIPTEST} -eq 0 -a "${PREQS_MET}" = "NO" ]; then SKIPTEST=1; if [ -z "${SKIPREASON}" ]; then SKIPREASON="Prerequisites not met (ie missing tool, other type of Linux distribution)"; fi; fi diff --git a/include/tests_authentication b/include/tests_authentication index d005882a..bf8cabe8 100644 --- a/include/tests_authentication +++ b/include/tests_authentication @@ -157,51 +157,7 @@ # Test : AUTH-9218 # Description : Check login shells for passwordless accounts # Notes : Results should be checked - Register --test-no AUTH-9218 --os FreeBSD --weight L --network NO --category security --description "Check login shells for passwordless accounts" - if [ ${SKIPTEST} -eq 0 ]; then - FOUND=0 - LogText "Test: Checking login shells" - if [ -f ${ROOTDIR}etc/master.passwd ]; then - # Check for all shells, except: (/usr)/sbin/nologin /nonexistent - FIND=$(${GREPBINARY} "[a-z]:\*:" /etc/master.passwd | ${EGREPBINARY} -v '^#|/sbin/nologin|/usr/sbin/nologin|/nonexistent' | ${SEDBINARY} 's/ /!space!/g') - if [ "${FIND}" = "" ]; then - Display --indent 2 --text "- Login shells" --result "${STATUS_OK}" --color GREEN - else - Display --indent 2 --text "- Login shells" --result "${STATUS_WARNING}" --color RED - for LINE in ${FIND}; do - LINE=$(echo ${LINE} | ${SEDBINARY} 's/!space!/ /g') - SHELL=$(echo ${LINE} | ${AWKBINARY} -F: '{ print $10 }') - LogText "Output: ${LINE}" - if [ -z "${SHELL}" ]; then - LogText "Result: found no shell on line" - else - LogText "Result: found possible harmful shell ${SHELL}" - if [ -f ${SHELL} ]; then - LogText "Result: shell ${SHELL} does exist" - FOUND=1 - else - LogText "Result: shell ${SHELL} does not exist" - ReportSuggestion "${TEST_NO}" "Determine if account is needed, as shell ${SHELL} does not exist" - fi - fi - done - if [ ${FOUND} -eq 1 ]; then - ReportWarning "${TEST_NO}" "Possible harmful shell found (for passwordless account!)" - fi - fi - else - Display --indent 2 --text "- Login shells" --result "${STATUS_SKIPPED}" --color WHITE - LogText "Result: No /etc/master.passwd file found" - fi - unset LINE SHELL - fi -# -################################################################################# -# - # Test : AUTH-9489 - # Description : Check login shells for passwordless accounts - # Notes : Results should be checked - Register --test-no AUTH-9489 --os DragonFly --weight L --network NO --category security --description "Check login shells for passwordless accounts" + Register --test-no AUTH-9218 --os "DragonFly FreeBSD NetBSD OpenBSD" --root-only YES --weight L --network NO --category security --description "Check login shells for passwordless accounts" if [ ${SKIPTEST} -eq 0 ]; then FOUND=0 LogText "Test: Checking login shells" @@ -817,13 +773,8 @@ # Test : AUTH-9268 # Description : Searching available PAM files # Notes : PAM is used on AIX, FreeBSD, Linux, HPUX, NetBSD, Solaris - case "${OS}" in - "AIX"|"FreeBSD"|"Linux"|"HPUX"|"NetBSD"|"Solaris") - PREQS_MET="YES" ;; - *) - PREQS_MET="NO" ;; - esac - Register --test-no AUTH-9268 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking presence pam.d files" + OS_USES_PAM="AIX DragonFly FreeBSD Linux HPUX NetBSD Solaris" + Register --test-no AUTH-9268 --os "${OS_USES_PAM}" --weight L --network NO --category security --description "Checking presence pam.d files" if [ ${SKIPTEST} -eq 0 ]; then FOUND=0 LogText "Test: Searching pam modules" diff --git a/include/tests_crypto b/include/tests_crypto index 466f6b52..1726735a 100644 --- a/include/tests_crypto +++ b/include/tests_crypto @@ -63,7 +63,7 @@ SKIP=0 # Now check if this path is on the to-be-ignored list for D in ${SSL_CERTIFICATE_PATHS_TO_IGNORE}; do - if Equals "${D}" "${SUBDIR}"; then + if ContainsString "${D}" "${SUBDIR}"; then SKIP=1 LogText "Result: skipping directory (${SUBDIR}) as it is on ignore list" fi diff --git a/include/tests_insecure_services b/include/tests_insecure_services index 3bc8dfdf..5c8af1fc 100644 --- a/include/tests_insecure_services +++ b/include/tests_insecure_services @@ -37,7 +37,7 @@ # # Test : INSE-8000 # Description : Check for installed inetd package - Register --test-no INSE-8000 --weight L --network NO --category security --description "Installed inetd package" + Register --test-no INSE-8000 --package-manager-required --weight L --network NO --category security --description "Installed inetd package" if [ ${SKIPTEST} -eq 0 ]; then # Check for installed inetd daemon LogText "Test: Checking if inetd is installed" @@ -134,7 +134,7 @@ # # Test : INSE-8100 # Description : Check for installed xinetd daemon - Register --test-no INSE-8100 --weight L --network NO --category security --description "Check for installed xinetd daemon" + Register --test-no INSE-8100 --package-manager-required --weight L --network NO --category security --description "Check for installed xinetd daemon" if [ ${SKIPTEST} -eq 0 ]; then # Check for installed xinetd daemon LogText "Test: Checking for installed xinetd daemon" @@ -250,7 +250,7 @@ # Test : INSE-8200 # Description : Check if tcp_wrappers is installed when inetd/xinetd is active if [ ${INETD_ACTIVE} -eq 1 -o ${XINETD_ACTIVE} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi - Register --test-no INSE-8200 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check if tcp_wrappers is installed when inetd/xinetd is active" + Register --test-no INSE-8200 --package-manager-required --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check if tcp_wrappers is installed when inetd/xinetd is active" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking if tcp_wrappers is installed" FOUND=0 @@ -272,7 +272,7 @@ # # Test : INSE-8300 # Description : Check if rsh client is installed - Register --test-no INSE-8300 --weight L --network NO --category security --description "Check if rsh client is installed" + Register --test-no INSE-8300 --package-manager-required --weight L --network NO --category security --description "Check if rsh client is installed" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking if rsh client is installed" FOUND=0 @@ -328,7 +328,7 @@ # # Test : INSE-8304 # Description : Check if rsh server is installed - Register --test-no INSE-8304 --weight L --network NO --category security --description "Check if rsh server is installed" + Register --test-no INSE-8304 --package-manager-required --weight L --network NO --category security --description "Check if rsh server is installed" if [ ${SKIPTEST} -eq 0 ]; then # Check if rsh server is installed LogText "Test: Checking if rsh server is installed" @@ -352,7 +352,7 @@ # # Test : INSE-8310 # Description : Check if telnet client is installed - Register --test-no INSE-8310 --weight L --network NO --category security --description "Check if telnet client is installed" + Register --test-no INSE-8310 --package-manager-required --weight L --network NO --category security --description "Check if telnet client is installed" if [ ${SKIPTEST} -eq 0 ]; then # Check if telnet client is installed LogText "Test: Checking if telnet client is installed" @@ -373,7 +373,7 @@ # # Test : INSE-8312 # Description : Check if telnet server is installed - Register --test-no INSE-8322 --weight L --network NO --category security --description "Check if telnet server is installed" + Register --test-no INSE-8322 --package-manager-required --weight L --network NO --category security --description "Check if telnet server is installed" if [ ${SKIPTEST} -eq 0 ]; then # Check if TFTP server is installed LogText "Test: Checking if telnet server is installed" @@ -398,7 +398,7 @@ # # Test : INSE-8314 # Description : Check if NIS client is installed - Register --test-no INSE-8314 --weight L --network NO --category security --description "Check if NIS client is installed" + Register --test-no INSE-8314 --package-manager-required --weight L --network NO --category security --description "Check if NIS client is installed" if [ ${SKIPTEST} -eq 0 ]; then FOUND="" LogText "Test: Checking if NIS client is installed" @@ -422,7 +422,7 @@ # # Test : INSE-8316 # Description : Check if NIS server is installed - Register --test-no INSE-8316 --weight L --network NO --category security --description "Check if NIS server is installed" + Register --test-no INSE-8316 --package-manager-required --weight L --network NO --category security --description "Check if NIS server is installed" if [ ${SKIPTEST} -eq 0 ]; then FOUND="" LogText "Test: Checking if NIS server is installed" @@ -446,7 +446,7 @@ # # Test : INSE-8318 # Description : Check if TFTP client is installed - Register --test-no INSE-8318 --weight L --network NO --category security --description "Check if TFTP client is installed" + Register --test-no INSE-8318 --package-manager-required --weight L --network NO --category security --description "Check if TFTP client is installed" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking if TFTP client is installed" FOUND="" @@ -470,7 +470,7 @@ # # Test : INSE-8320 # Description : Check if TFTP server is installed - Register --test-no INSE-8320 --weight L --network NO --category security --description "Check if TFTP server is installed" + Register --test-no INSE-8320 --package-manager-required --weight L --network NO --category security --description "Check if TFTP server is installed" if [ ${SKIPTEST} -eq 0 ]; then LogText "Test: Checking if TFTP server is installed" FOUND="" diff --git a/include/tests_kernel b/include/tests_kernel index 3a97ebde..72e5082b 100644 --- a/include/tests_kernel +++ b/include/tests_kernel @@ -103,8 +103,7 @@ # Description : Check CPU options and support (PAE, No eXecute, eXecute Disable) # More info : pae and nx bit are both visible on AMD and Intel CPU's if supported - if [ "${HARDWARE}" = "x86_64" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi - Register --test-no KRNL-5677 --preqs-met "${PREQS_MET}" --os Linux --weight L --network NO --category security --description "Check CPU options and support" + Register --test-no KRNL-5677 --platform x86_64 --os Linux --weight L --network NO --category security --description "Check CPU options and support" if [ ${SKIPTEST} -eq 0 ]; then Display --indent 2 --text "- Checking CPU support (NX/PAE)" LogText "Test: Checking /proc/cpuinfo" diff --git a/include/tests_memory_processes b/include/tests_memory_processes index 65473cf4..2454f320 100644 --- a/include/tests_memory_processes +++ b/include/tests_memory_processes @@ -118,7 +118,7 @@ # # Test : PROC-3802 # Description : Check presence of prelink tooling - Register --test-no PROC-3802 --os Linux --weight L --network NO --category security --description "Check presence of prelink tooling" + Register --test-no PROC-3802 --package-manager-required --os Linux --weight L --network NO --category security --description "Check presence of prelink tooling" if [ ${SKIPTEST} -eq 0 ]; then if PackageIsInstalled "prelink"; then LogText "Result: prelink packages is installed" diff --git a/include/tests_networking b/include/tests_networking index b182f605..83a7aae0 100644 --- a/include/tests_networking +++ b/include/tests_networking @@ -35,6 +35,55 @@ # ################################################################################# # + # Test : NETW-2400 + # Description : Test hostname for valid characters and length + # Notes : FQDN: max 253 characters + # : component: a-z, 0-9, hyphen, not start with hyphen, max 63 characters + # dots allowed as separator + Register --test-no NETW-2400 --weight L --network YES --category basics --description "Hostname length and value check" + if [ ${SKIPTEST} -eq 0 ]; then + # Test first the fully qualified domain name + if [ ${#FQDN} -gt 253 ]; then + # Too long + LogText "Result: FQDN is more than 253 characters" + Display --indent 2 --text "- Hostname (FQDN length)" --result "${STATUS_WARNING}" --color RED + ReportWarning "${TEST_NO}" "Hostname is too long (more than 253 characters)" + elif [ ${#FQDN} -eq 0 ]; then + # FQDN not defined + LogText "Result: FQDN is not defined" + if IsVerbose; then Display --indent 2 --text "- Hostname (FQDN length)" --result "${STATUS_UNKNOWN}" --color YELLOW; fi + else + # Fine + LogText "Result: FQDN is defined and not longer than 253 characters (${#FQDN} characters)" + if IsVerbose; then Display --indent 2 --text "- Hostname (FQDN length)" --result "${STATUS_OK}" --color GREEN; fi + fi + # Now test short hostname + if [ ${#HOSTNAME} -eq 0 ]; then + if IsVerbose; then Display --indent 2 --text "- Hostname (FQDN length)" --result "${STATUS_NONE}" --color RED; fi + LogText "Result: hostname is not defined" + else + # Test length + if [ ${#HOSTNAME} -gt 63 ]; then + LogText "Result: hostname is more than 63 characters" + Display --indent 2 --text "- Hostname (length)" --result "${STATUS_WARNING}" --color RED + else + LogText "Result: hostnamed is defined and not longer than 63 characters" + fi + # Test valid characters (normally a dot should not be in the name, but we can't be 100% sure we have short name) + FIND=$(echo "${HOSTNAME}" | ${TRBINARY} -d '[a-z0-9\.\-]') + if [ -z "${FIND}" ]; then + LogText "Result: good, no unexpected characters discovered in hostname" + if IsVerbose; then Display --indent 2 --text "- Hostname (allowed characters)" --result "${STATUS_OK}" --color GREEN; fi + else + LogText "Result: unexpected characters discovered in hostname (characters: ${FIND}), which may impact network connectivity" + Display --indent 2 --text "- Hostname (allowed characters)" --result "${STATUS_WARNING}" --color RED + ReportWarning "${TEST_NO}" "Hostname contains invalid characters" "hostname" "text:See log file for invalid characters" + fi + fi + fi +# +################################################################################# +# # Test : NETW-2600 # Description : Gather IPv6 configuration Register --test-no NETW-2600 --os "Linux" --weight L --network YES --category security --description "Checking IPv6 configuration" @@ -191,23 +240,32 @@ ################################################################################# # # Test : NETW-2706 - # Description : Check systemd-resolved and upstream DNSSEC status - if [ -n "${RESOLVECTLBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi - Register --test-no NETW-2706 --preqs-met ${PREQS_MET} --weight L --network YES --category security --description "Check systemd-resolved and upstream DNSSEC status" + # Description : Check systemd-resolve output and upstream DNSSEC status + # Notes : Ubuntu 16.04 uses systemd-resolve, newer ones most likely resolvectl + if [ -n "${RESOLVECTLBINARY}" ]; then + PREQS_MET="YES" + RESOLVE_CMD="${RESOLVECTLBINARY}" + RESOLVE_CMD_PARAM="statistics" + elif [ -n "$(command -v systemd-resolve 2> /dev/null)" ]; then + PREQS_MET="YES" + RESOLVE_CMD="$(command -v systemd-resolve 2> /dev/null)" + RESOLVE_CMD_PARAM="--statistics" + else + PREQS_MET="NO" + fi + Register --test-no NETW-2706 --preqs-met "${PREQS_MET}" --weight L --network YES --category security --description "Check systemd-resolved and upstream DNSSEC status" if [ ${SKIPTEST} -eq 0 ]; then SKIP=0 - if [ -n "${RESOLVECTLBINARY}" ]; then - DNSSEC_STATUS=$(${RESOLVECTLBINARY} statistics | ${AWKBINARY} -F ":" '/DNSSEC supported/ { print $2 }' | ${TRBINARY} -d ' ') - if [ "${DNSSEC_STATUS}" = "yes" ]; then - Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_OK}" --color GREEN - LogText "Result: DNSSEC supported by systemd-resolved and upstream DNS servers" - else - Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_WARNING}" --color RED - LogText "Result: DNSSEC not supported by systemd-resolved or upstream DNS servers" - fi + DNSSEC_STATUS=$(${RESOLVE_CMD} ${RESOLVE_CMD_PARAM} 2> /dev/null | ${AWKBINARY} -F ":" '/DNSSEC supported/ { print $2 }' | ${TRBINARY} -d ' ') + if [ "${DNSSEC_STATUS}" = "yes" ]; then + Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_YES}" --color GREEN + LogText "Result: DNSSEC supported by systemd-resolved and upstream DNS servers" + elif [ "${DNSSEC_STATUS}" = "no" ]; then + Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_NO}" --color YELLOW + LogText "Result: DNSSEC not supported by systemd-resolved or upstream DNS servers" else - Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_SKIPPED}" --color YELLOW - LogText "Result: resolvectl not installed, test can't be fully performed" + Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_UNKNOWN}" --color RED + LogText "Result: command '${RESOLVE_CMD} ${RESOLVE_CMD_PARAM}' returned an error. Please run command manually to check for details." fi else LogText "Result: Test most likely skipped due to not having resolvectl" @@ -727,7 +785,6 @@ ################################################################################# # - WaitForKeyPress # @@ -524,6 +524,7 @@ ${NORMAL} if [ "${OS}" = "Linux" -a "${HOSTNAME}" = "${FQDN}" ]; then FQDN=$(hostname -f 2> /dev/null) fi + # ################################################################################# # @@ -568,6 +569,7 @@ ${NORMAL} fi Report "test_category=${TEST_CATEGORY_TO_CHECK}" Report "test_group=${TEST_GROUP_TO_CHECK}" + # ################################################################################# # @@ -630,6 +632,7 @@ ${NORMAL} echo "Make sure to execute ${PROGRAM_NAME} from untarred directory or check your installation." exit 1 fi + # ################################################################################# # @@ -817,6 +820,14 @@ ${NORMAL} # ################################################################################# # + # Test if we have a package manager available by testing for a dummy package (should not exist) + if PackageIsInstalled "__dummy__"; then + HAS_PACKAGE_MANAGER=1 + LogText "Informational: package manager is used" + else + LogText "Informational: no known package manager for this system" + fi + # Use hardware detection capabilities IsVirtualMachine if IsContainer; then |