Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/CISOfy/lynis.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--CHANGELOG.md21
-rw-r--r--README.md2
-rw-r--r--db/software-eol.db2
-rw-r--r--db/tests.db1
-rw-r--r--include/functions11
-rw-r--r--include/osdetection2
-rw-r--r--include/tests_authentication2
-rw-r--r--include/tests_kernel120
-rw-r--r--include/tests_malware18
-rw-r--r--include/tests_ssh2
-rwxr-xr-xlynis6
11 files changed, 124 insertions, 63 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ac435bd5..87dcb228 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,16 +1,33 @@
# Lynis Changelog
-## Lynis 3.0.7 (Not released yet)
+## Lynis 3.0.8 (not released yet)
+
+### Added
+- MALW-3274 - Detect McAfee VirusScan Command Line Scanner
+- EOL for Alpine Linux 3.14 and 3.15
+
+### Changed
+- KRNL-5788 - Only run relevant tests and improved logging
+- KRNL-5830 - Check for /var/run/needs_restarting (Slackware)
+- KRNL-5830 - Add a presence check for /boot/vmlinuz
+
+---------------------------------------------------------------------------------
+
+## Lynis 3.0.7 (2022-01-18)
### Added
- MALW-3290 - Show status of malware components
-- OS detection for RHEL 6
+- OS detection for RHEL 6 and Funtoo Linux
+- Added service manager openrc
### Changed
- DBS-1804 - Added alias for MariaDB
- FINT-4316 - Support for newer Ubuntu versions
- MALW-3280 - Added Trend Micro malware agent
+- NETW-3200 - Allow unknown number of spaces in modprobe blacklists
+- PKGS-7320 - Support for Garuda Linux and arch-audit
- Several improvements for busybox shell
+- Russian translation of Lynis extended
---------------------------------------------------------------------------------
diff --git a/README.md b/README.md
index 197e59c9..4fa3900e 100644
--- a/README.md
+++ b/README.md
@@ -48,7 +48,7 @@ There are multiple options available to install Lynis.
### Software Package
-For sytems running Linux, BSD, and macOS, there is typically a package available. This is the preferred method of obtaining Lynis, as it is quick to install and easy to update. The Lynis project itself also provides [packages](https://packages.cisofy.com/) in RPM or DEB format suitable for systems systems running:
+For systems running Linux, BSD, and macOS, there is typically a package available. This is the preferred method of obtaining Lynis, as it is quick to install and easy to update. The Lynis project itself also provides [packages](https://packages.cisofy.com/) in RPM or DEB format suitable for systems systems running:
`CentOS`, `Debian`, `Fedora`, `OEL`, `openSUSE`, `RHEL`, `Ubuntu`, and others.
Some distributions may also have Lynis in their software repository: [![Repology](https://repology.org/badge/tiny-repos/lynis.svg)](https://repology.org/project/lynis/versions)
diff --git a/db/software-eol.db b/db/software-eol.db
index bebd4de8..f8242d35 100644
--- a/db/software-eol.db
+++ b/db/software-eol.db
@@ -16,6 +16,8 @@
#
# Alpine - https://alpinelinux.org/releases/
#
+os:Alpine 3.15:2023-11-01:1698793200
+os:Alpine 3.14:2023-05-01:1682899200
os:Alpine 3.13:2022-11-01:1667275200
os:Alpine 3.12:2022-05-01:1651377600
os:Alpine 3.11:2021-11-01:1635739200
diff --git a/db/tests.db b/db/tests.db
index c9c4797f..522441f4 100644
--- a/db/tests.db
+++ b/db/tests.db
@@ -265,6 +265,7 @@ MAIL-8838:test:security:mail_messaging::Check dovecot process:
MAIL-8860:test:security:mail_messaging::Check Qmail status:
MAIL-8880:test:security:mail_messaging::Check Sendmail status:
MAIL-8920:test:security:mail_messaging::Check OpenSMTPD status:
+MALW-3274:test:security:malware::Check for McAfee VirusScan Command Line Scanner:
MALW-3275:test:security:malware::Check for chkrootkit:
MALW-3276:test:security:malware::Check for Rootkit Hunter:
MALW-3278:test:security:malware::Check for LMD:
diff --git a/include/functions b/include/functions
index 6c4d76c7..271faf19 100644
--- a/include/functions
+++ b/include/functions
@@ -1306,6 +1306,11 @@
if [ $# -ne 2 ]; then Fatal "Incorrect usage of HasCorrectFilePermissions"; fi
CHECKFILE="$1"
CHECKPERMISSION_FULL="$2"
+ # Check for symlink
+ if [ -L ${CHECKFILE} ]; then
+ ShowSymlinkPath ${CHECKFILE}
+ if [ ! "${SYMLINK}" = "" ]; then CHECKFILE="${SYMLINK}"; fi
+ fi
if [ ! -d ${CHECKFILE} -a ! -f ${CHECKFILE} ]; then
return 2
else
@@ -2002,7 +2007,11 @@
if [ $# -eq 0 ]; then ExitFatal "Missing parameter when calling IsWorldWritable function"; fi
sFILE=$1
FileIsWorldWritable=""
-
+ # Check for symlink
+ if [ -L ${sFILE} ]; then
+ ShowSymlinkPath ${sFILE}
+ if [ ! "${SYMLINK}" = "" ]; then sFILE="${SYMLINK}"; fi
+ fi
# Only check if target is a file or directory
if [ -f ${sFILE} -o -d ${sFILE} ]; then
FINDVAL=$(ls -ld ${sFILE} | cut -c 9)
diff --git a/include/osdetection b/include/osdetection
index c91c69ec..d9b8a41c 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -678,7 +678,7 @@
ReportException "OS Detection" "Unknown OS found in /etc/os-release - Please create issue on GitHub project page: ${PROGRAM_SOURCE}"
;;
esac
- elif [ "$(uname -o 2> /dev/null)" == "illumos" ]; then
+ elif [ "$(uname -o 2> /dev/null)" = "illumos" ]; then
OPENSOLARIS=1
# Solaris has a free form text file with release information
diff --git a/include/tests_authentication b/include/tests_authentication
index ab9ac4c4..504e76cc 100644
--- a/include/tests_authentication
+++ b/include/tests_authentication
@@ -916,7 +916,7 @@
LogText "Result: found one or more accounts without password"
for I in ${FIND2}; do
LogText "Account without password: ${I}"
- Report "account_without_password=${I}"
+ Report "account_without_password[]=${I}"
done
Display --indent 2 --text "- Accounts without password" --result "${STATUS_WARNING}" --color RED
ReportWarning "${TEST_NO}" "Found accounts without password"
diff --git a/include/tests_kernel b/include/tests_kernel
index 610fd325..c1977985 100644
--- a/include/tests_kernel
+++ b/include/tests_kernel
@@ -368,14 +368,14 @@
#
# Test : KRNL-5788
# Description : Checking availability new kernel
- if [ "${LINUX_VERSION}" = "Debian" ] || [ "${LINUX_VERSION}" = "Ubuntu" ] ||
- [ "${LINUX_VERSION_LIKE}" = "Debian" ] || [ "${LINUX_VERSION_LIKE}" = "Ubuntu" ]; then
+ if [ "${LINUX_VERSION}" = "Debian" ] || [ "${LINUX_VERSION}" = "Ubuntu" ] || [ "${LINUX_VERSION_LIKE}" = "Debian" ] || [ "${LINUX_VERSION_LIKE}" = "Ubuntu" ]; then
PREQS_MET="YES"
else
PREQS_MET="NO"
fi
Register --test-no KRNL-5788 --os Linux --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking availability new Linux kernel"
if [ ${SKIPTEST} -eq 0 ]; then
+ FINDKERNEL=""
HAS_VMLINUZ=0
LogText "Test: Searching apt-cache, to determine if a newer kernel is available"
if [ -x ${ROOTDIR}usr/bin/apt-cache ]; then
@@ -384,62 +384,69 @@
if [ -f ${ROOTDIR}vmlinuz -o -f ${ROOTDIR}boot/vmlinuz ]; then
HAS_VMLINUZ=1
if [ -f ${ROOTDIR}vmlinuz ]; then
- FINDVMLINUZ=${ROOTDIR}vmlinuz
+ FINDVMLINUZ="${ROOTDIR}vmlinuz"
else
- FINDVMLINUZ=${ROOTDIR}boot/vmlinuz
+ FINDVMLINUZ="${ROOTDIR}boot/vmlinuz"
fi
LogText "Result: found ${FINDVMLINUZ}"
LogText "Test: checking readlink location of ${FINDVMLINUZ}"
FINDKERNFILE=$(readlink -f ${FINDVMLINUZ})
LogText "Output: readlink reported file ${FINDKERNFILE}"
- LogText "Test: checking package from dpkg -S"
+ LogText "Test: checking relevant package using output from dpkg -S"
FINDKERNEL=$(dpkg -S ${FINDKERNFILE} 2> /dev/null | ${AWKBINARY} -F : '{print $1}')
LogText "Output: dpkg -S reported package ${FINDKERNEL}"
elif [ -e ${ROOTDIR}dev/grsec ]; then
- FINDKERNEL=linux-image-$(uname -r)
+ FINDKERNEL="linux-image-$(uname -r)"
LogText "Result: ${ROOTDIR}vmlinuz missing due to grsecurity; assuming ${FINDKERNEL}"
elif [ -e ${ROOTDIR}etc/rpi-issue ]; then
- FINDKERNEL=raspberrypi-kernel
+ FINDKERNEL="raspberrypi-kernel"
LogText "Result: ${ROOTDIR}vmlinuz missing due to Raspbian"
- elif `${EGREPBINARY} -q 'do_symlinks.*=.*No' ${ROOTDIR}etc/kernel-img.conf`; then
- FINDKERNEL=linux-image-$(uname -r)
+ elif $(${EGREPBINARY} -q 'do_symlinks.*=.*No' ${ROOTDIR}etc/kernel-img.conf); then
+ FINDKERNEL="linux-image-$(uname -r)"
LogText "Result: ${ROOTDIR}vmlinuz missing due to /etc/kernel-img.conf item do_symlinks = No"
else
- LogText "This system is missing ${ROOTDIR}vmlinuz or ${ROOTDIR}boot/vmlinuz. Unable to check whether kernel is up-to-date."
+ LogText "This system is missing ${ROOTDIR}vmlinuz or ${ROOTDIR}boot/vmlinuz. Unable to check whether kernel is up-to-date."
ReportSuggestion "${TEST_NO}" "Determine why ${ROOTDIR}vmlinuz or ${ROOTDIR}boot/vmlinuz is missing on this Debian/Ubuntu system." "/vmlinuz or /boot/vmlinuz"
fi
- LogText "Test: Using apt-cache policy to determine if there is an update available"
- FINDINST=$(apt-cache policy ${FINDKERNEL} | ${EGREPBINARY} 'Installed' | ${CUTBINARY} -d ':' -f2 | ${TRBINARY} -d ' ')
- FINDCAND=$(apt-cache policy ${FINDKERNEL} | ${EGREPBINARY} 'Candidate' | ${CUTBINARY} -d ':' -f2 | ${TRBINARY} -d ' ')
- LogText "Kernel installed: ${FINDINST}"
- LogText "Kernel candidate: ${FINDCAND}"
- if IsEmpty "${FINDINST}"; then
- Display --indent 2 --text "- Checking for available kernel update" --result "${STATUS_UNKNOWN}" --color YELLOW
- LogText "Result: Exception occurred, no output from apt-cache policy"
- if [ ${HAS_VMLINUZ} -eq 1 ]; then
- ReportException "${TEST_NO}:01"
- ReportSuggestion "${TEST_NO}" "Check the output of apt-cache policy to determine why its output is empty"
- fi
- LogText "Result: apt-cache policy did not return an installed kernel version"
+
+ if IsEmpty "${FINDKERNEL}"; then
+ LogText "Result: could not check kernel update status as kernel is unknown"
else
- if [ "${FINDINST}" = "${FINDCAND}" ]; then
- if [ -e /dev/grsec ]; then
- Display --indent 2 --text "- Checking for available kernel update" --result GRSEC --color GREEN
- LogText "Result: Grsecurity is installed; unable to determine if there's a newer kernel available"
- ReportManual "Manually check to confirm you're using a recent kernel and grsecurity patch"
- else
- Display --indent 2 --text "- Checking for available kernel update" --result "${STATUS_OK}" --color GREEN
- LogText "Result: no kernel update available"
+ LogText "Result: found kernel '${FINDKERNEL}' which will be used for further testing"
+ LogText "Test: Using apt-cache policy to determine if there is an update available"
+ FINDINSTALLED=$(apt-cache policy ${FINDKERNEL} | ${EGREPBINARY} 'Installed' | ${CUTBINARY} -d ':' -f2 | ${TRBINARY} -d ' ')
+ FINDCANDIDATE=$(apt-cache policy ${FINDKERNEL} | ${EGREPBINARY} 'Candidate' | ${CUTBINARY} -d ':' -f2 | ${TRBINARY} -d ' ')
+ LogText "Kernel installed: ${FINDINSTALLED}"
+ LogText "Kernel candidate: ${FINDCANDIDATE}"
+ if IsEmpty "${FINDINSTALLED}"; then
+ Display --indent 2 --text "- Checking for available kernel update" --result "${STATUS_UNKNOWN}" --color YELLOW
+ LogText "Result: Exception occurred, no output from apt-cache policy"
+ if [ ${HAS_VMLINUZ} -eq 1 ]; then
+ ReportException "${TEST_NO}:01" "Found vmlinuz (${FINDVMLINUZ}) but could not determine the installed kernel using apt-cache policy"
+ ReportSuggestion "${TEST_NO}" "Check the output of apt-cache policy to determine why its output is empty"
fi
+ LogText "Result: apt-cache policy did not return an installed kernel version"
else
- Display --indent 2 --text "- Checking for available kernel update" --result "UPDATE AVAILABLE" --color YELLOW
- LogText "Result: kernel update available according 'apt-cache policy'."
- ReportSuggestion "${TEST_NO}" "Determine priority for available kernel update"
+ if [ "${FINDINSTALLED}" = "${FINDCANDIDATE}" ]; then
+ if [ -e /dev/grsec ]; then
+ Display --indent 2 --text "- Checking for available kernel update" --result GRSEC --color GREEN
+ LogText "Result: Grsecurity is installed; unable to determine if there's a newer kernel available"
+ ReportManual "Manually check to confirm you're using a recent kernel and grsecurity patch"
+ else
+ Display --indent 2 --text "- Checking for available kernel update" --result "${STATUS_OK}" --color GREEN
+ LogText "Result: no kernel update available"
+ fi
+ else
+ Display --indent 2 --text "- Checking for available kernel update" --result "UPDATE AVAILABLE" --color YELLOW
+ LogText "Result: kernel update available according 'apt-cache policy'."
+ ReportSuggestion "${TEST_NO}" "Determine priority for available kernel update"
+ fi
fi
fi
else
- LogText "Result: could NOT find /usr/bin/apt-cache, skipped other tests."
+ LogText "Result: could NOT find ${ROOTDIR}usr/bin/apt-cache, skipped other tests."
fi
+ unset FINDCANDIDATE FINDINSTALLED FINDKERNEL HAS_VMLINUZ
fi
#
#################################################################################
@@ -615,25 +622,29 @@
Register --test-no KRNL-5830 --os Linux --weight L --network NO --category security --description "Checking if system is running on the latest installed kernel"
if [ ${SKIPTEST} -eq 0 ]; then
REBOOT_NEEDED=2
- FILE="${ROOTDIR}var/run/reboot-required.pkgs"
- LogText "Test: Checking presence ${FILE}"
- if [ -f ${FILE} ]; then
- LogText "Result: file ${FILE} exists"
- FIND=$(${WCBINARY} -l < ${FILE})
- if [ "${FIND}" = "0" ]; then
- LogText "Result: No reboot needed (file empty)"
- REBOOT_NEEDED=0
+ for FILE in "${ROOTDIR}var/run/reboot-required.pkgs" "${ROOTDIR}var/run/needs_restarting"
+ do
+ LogText "Test: Checking presence ${FILE}"
+ if [ -f ${FILE} ]; then
+ LogText "Result: file ${FILE} exists"
+ FIND=$(${WCBINARY} -l < ${FILE})
+ if [ "${FIND}" = "0" ]; then
+ LogText "Result: No reboot needed (file empty)"
+ REBOOT_NEEDED=0
+ break
+ else
+ PKGSCOUNT=$(${WCBINARY} -l < ${FILE})
+ LogText "Result: reboot is needed, related to ${PKGSCOUNT} packages"
+ for I in ${FIND}; do
+ LogText "Package: ${I}"
+ done
+ REBOOT_NEEDED=1
+ break
+ fi
else
- PKGSCOUNT=$(${WCBINARY} -l < ${FILE})
- LogText "Result: reboot is needed, related to ${PKGSCOUNT} packages"
- for I in ${FIND}; do
- LogText "Package: ${I}"
- done
- REBOOT_NEEDED=1
+ LogText "Result: file ${FILE} not found"
fi
- else
- LogText "Result: file ${FILE} not found"
- fi
+ done
# Check if /boot exists
if [ -d "${ROOTDIR}boot" ]; then
@@ -663,7 +674,10 @@
ReportException "${TEST_NO}:1" "Can't determine kernel version on disk, need debug data"
fi
elif [ -f ${ROOTDIR}boot/vmlinuz-linux ] || [ -f ${ROOTDIR}boot/vmlinuz-linux-lts ] || [ -f "$(${LSBINARY} -t ${ROOTDIR}boot/vm[l0-9]* 2> /dev/null | ${HEADBINARY} -1)" ]; then
- if [ -f ${ROOTDIR}boot/vmlinuz-linux ]; then
+ if [ -f ${ROOTDIR}boot/vmlinuz ]; then
+ LogText "Result: found ${ROOTDIR}boot/vmlinuz"
+ FOUND_VMLINUZ=${ROOTDIR}boot/vmlinuz
+ elif [ -f ${ROOTDIR}boot/vmlinuz-linux ]; then
LogText "Result: found ${ROOTDIR}boot/vmlinuz-linux"
FOUND_VMLINUZ=${ROOTDIR}boot/vmlinuz-linux
elif [ -f ${ROOTDIR}boot/vmlinuz-linux-lts ]; then
diff --git a/include/tests_malware b/include/tests_malware
index cb13ca96..40336fa5 100644
--- a/include/tests_malware
+++ b/include/tests_malware
@@ -46,6 +46,24 @@
#
#################################################################################
#
+ # Test : MALW-3274
+ # Description : Check for installed tool (McAfee VirusScan for Command Line)
+ Register --test-no MALW-3274 --weight L --network NO --category security --description "Check for McAfee VirusScan Command Line"
+ if [ ${SKIPTEST} -eq 0 ]; then
+ LogText "Test: checking presence McAfee VirusScan for Command Line"
+ if [ -x /usr/local/uvscan/uvscan ]; then
+ Display --indent 2 --text "- ${GEN_CHECKING} McAfee VirusScan for Command Line" --result "${STATUS_FOUND}" --color GREEN
+ LogText "Result: Found ${MCAFEECLBINARY}"
+ MALWARE_SCANNER_INSTALLED=1
+ AddHP 2 2
+ Report "malware_scanner[]=mcafeecl"
+ else
+ LogText "Result: McAfee VirusScan for Command Line not found"
+ fi
+ fi
+#
+#################################################################################
+#
# Test : MALW-3275
# Description : Check for installed tool (chkrootkit)
Register --test-no MALW-3275 --weight L --network NO --category security --description "Check for chkrootkit"
diff --git a/include/tests_ssh b/include/tests_ssh
index 7f31c348..de3209ee 100644
--- a/include/tests_ssh
+++ b/include/tests_ssh
@@ -74,7 +74,7 @@
LogText "Result: ${I}/sshd_config exists"
if [ ${FOUND} -eq 1 ]; then
ReportException "${TEST_NO}:01"
- LogText "Result: we already had found another sshd_config file. Using this new file then."
+ LogText "Result: we already found another sshd_config file. Using this new file instead of the previous one."
fi
FileIsReadable ${I}/sshd_config
if [ ${CANREAD} -eq 1 ]; then
diff --git a/lynis b/lynis
index 4a1a3979..c15a78c7 100755
--- a/lynis
+++ b/lynis
@@ -43,10 +43,10 @@
PROGRAM_WEBSITE="https://cisofy.com/lynis/"
# Version details
- PROGRAM_RELEASE_DATE="2021-07-27"
- PROGRAM_RELEASE_TIMESTAMP=1627375518
+ PROGRAM_RELEASE_DATE="2022-01-31"
+ PROGRAM_RELEASE_TIMESTAMP=1643632222
PROGRAM_RELEASE_TYPE="pre-release" # pre-release or release
- PROGRAM_VERSION="3.0.7"
+ PROGRAM_VERSION="3.0.8"
# Source, documentation and license
PROGRAM_SOURCE="https://github.com/CISOfy/lynis"
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-17 10:44:51 +0300