diff options
| -rw-r--r-- | CHANGELOG.md | 8 | ||||
| -rw-r--r-- | db/tests.db | 2 | ||||
| -rw-r--r-- | include/binaries | 1 | ||||
| -rw-r--r-- | include/consts | 1 | ||||
| -rw-r--r-- | include/functions | 19 | ||||
| -rw-r--r-- | include/osdetection | 2 | ||||
| -rw-r--r-- | include/tests_authentication | 40 | ||||
| -rw-r--r-- | include/tests_ports_packages | 63 | ||||
| -rw-r--r-- | include/tests_printers_spoolers | 23 | ||||
| -rw-r--r-- | include/tests_webservers | 2 |
10 files changed, 134 insertions, 27 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 87dcb228..6ccbd452 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,12 +4,20 @@ ### Added - MALW-3274 - Detect McAfee VirusScan Command Line Scanner +- PKGS-7346 Check Alpine Package Keeper (apk) +- PKGS-7395 Check Alpine upgradeable packages - EOL for Alpine Linux 3.14 and 3.15 ### Changed +- AUTH-9408 - Check for pam_faillock as well (replacement for pam_tally2) +- FILE-7524 - Test enhanced to support symlinks +- HTTP-6643 - Support ModSecurity version 2 and 3 - KRNL-5788 - Only run relevant tests and improved logging - KRNL-5830 - Check for /var/run/needs_restarting (Slackware) - KRNL-5830 - Add a presence check for /boot/vmlinuz +- PRNT-2308 - Bugfix that prevented test from storing values correctly +- Extended location of PAM files for AARCH64 +- Some messages in log improved --------------------------------------------------------------------------------- diff --git a/db/tests.db b/db/tests.db index 522441f4..fe16ef9c 100644 --- a/db/tests.db +++ b/db/tests.db @@ -323,6 +323,7 @@ PHP-2376:test:security:php::Check PHP allow_url_fopen option: PHP-2378:test:security:php::Check PHP allow_url_include option: PHP-2379:test:security:php::Check PHP suhosin extension status: PHP-2382:test:security:php::Check PHP listen option: +PKGS-7200:test:security:ports_packages:Linux:Check Alpine Package Keeper (apk): PKGS-7301:test:security:ports_packages::Query NetBSD pkg: PKGS-7302:test:security:ports_packages::Query FreeBSD/NetBSD pkg_info: PKGS-7303:test:security:ports_packages::Query brew package manager: @@ -359,6 +360,7 @@ PKGS-7390:test:security:ports_packages:Linux:Check Ubuntu database consistency: PKGS-7392:test:security:ports_packages:Linux:Check for Debian/Ubuntu security updates: PKGS-7393:test:security:ports_packages::Check for Gentoo vulnerable packages: PKGS-7394:test:security:ports_packages:Linux:Check for Ubuntu updates: +PKGS-7395:test:security:ports_packages:Linux:Check Alpine upgradeable packages: PKGS-7398:test:security:ports_packages::Check for package audit tool: PKGS-7410:test:security:ports_packages::Count installed kernel packages: PKGS-7420:test:security:ports_packages::Detect toolkit to automatically download and apply upgrades: diff --git a/include/binaries b/include/binaries index fb8147ce..7aabba42 100644 --- a/include/binaries +++ b/include/binaries @@ -134,6 +134,7 @@ aide) AIDEBINARY=${BINARY}; LogText " Found known binary: aide (file integrity checker) - ${BINARY}" ;; apache2) HTTPDBINARY=${BINARY}; LogText " Found known binary: apache2 (web server) - ${BINARY}" ;; apt) APTBINARY=${BINARY}; LogText " Found known binary: apt (package manager) - ${BINARY}" ;; + apk) APKBINARY=${BINARY}; LogText " Found known binary: apk (package manager) - ${BINARY}" ;; arch-audit) ARCH_AUDIT_BINARY="${BINARY}"; LogText " Found known binary: arch-audit (auditing utility to test for vulnerable packages) - ${BINARY}" ;; auditd) AUDITDBINARY=${BINARY}; LogText " Found known binary: auditd (audit framework) - ${BINARY}" ;; awk) AWKBINARY=${BINARY}; LogText " Found known binary: awk (string tool) - ${BINARY}" ;; diff --git a/include/consts b/include/consts index 1dc3f893..5d618429 100644 --- a/include/consts +++ b/include/consts @@ -43,6 +43,7 @@ ETC_PATHS="/etc /usr/local/etc" # == Variable initializing == # APTBINARY="" + APKBINARY="" ARCH_AUDIT_BINARY="" AUDITORNAME="" AUDITCTLBINARY="" diff --git a/include/functions b/include/functions index 6c4d76c7..5b211707 100644 --- a/include/functions +++ b/include/functions @@ -1306,6 +1306,11 @@ if [ $# -ne 2 ]; then Fatal "Incorrect usage of HasCorrectFilePermissions"; fi CHECKFILE="$1" CHECKPERMISSION_FULL="$2" + # Check for symlink + if [ -L ${CHECKFILE} ]; then + ShowSymlinkPath ${CHECKFILE} + if [ ! "${SYMLINK}" = "" ]; then CHECKFILE="${SYMLINK}"; fi + fi if [ ! -d ${CHECKFILE} -a ! -f ${CHECKFILE} ]; then return 2 else @@ -1320,9 +1325,8 @@ CHECK_PERMISSION=$(echo "${CHECK_PERMISSION}" | ${AWKBINARY} '{printf "%03d",$1}') # First try stat command - LogText "Test: checking if file ${CHECKFILE} has the permissions set to ${CHECK_PERMISSION} or more restrictive" + LogText "Test: checking if file ${CHECKFILE} has the permissions set to ${CHECK_PERMISSION} (${CHECKPERMISSION_FULL}) or more restrictive" if [ -n "${STATBINARY}" ]; then - case ${OS} in *BSD | "macOS") # BSD and macOS have no --format, only short notation @@ -1388,7 +1392,7 @@ fi done - LogText "Outcome: permissions of file ${CHECKFILE} are not matching expected value (${DATA} != ${CHECKPERMISSION_FULL})" + LogText "Outcome: permissions of file ${CHECKFILE} are not matching expected value (${DATA} != ${CHECK_PERMISSION})" # No match, return exit code 1 return 1 fi @@ -2002,7 +2006,11 @@ if [ $# -eq 0 ]; then ExitFatal "Missing parameter when calling IsWorldWritable function"; fi sFILE=$1 FileIsWorldWritable="" - + # Check for symlink + if [ -L ${sFILE} ]; then + ShowSymlinkPath ${sFILE} + if [ ! "${SYMLINK}" = "" ]; then sFILE="${SYMLINK}"; fi + fi # Only check if target is a file or directory if [ -f ${sFILE} -o -d ${sFILE} ]; then FINDVAL=$(ls -ld ${sFILE} | cut -c 9) @@ -2090,6 +2098,9 @@ elif [ -n "${XBPSBINARY}" ]; then output=$(${XBPSBINARY} ${package} 2> /dev/null | ${GREPBINARY} "^ii") exit_code=$? + elif [ -n "${APKBINARY}" ]; then + output=$(${APKBINARY} search ${package} 2> /dev/null | ${GREPBINARY} ${package}) + exit_code=$? else if [ "${package}" != "__dummy__" ]; then ReportException "PackageIsInstalled:01 (test=${TEST_NO:-unknown})" diff --git a/include/osdetection b/include/osdetection index c91c69ec..d9b8a41c 100644 --- a/include/osdetection +++ b/include/osdetection @@ -678,7 +678,7 @@ ReportException "OS Detection" "Unknown OS found in /etc/os-release - Please create issue on GitHub project page: ${PROGRAM_SOURCE}" ;; esac - elif [ "$(uname -o 2> /dev/null)" == "illumos" ]; then + elif [ "$(uname -o 2> /dev/null)" = "illumos" ]; then OPENSOLARIS=1 # Solaris has a free form text file with release information diff --git a/include/tests_authentication b/include/tests_authentication index 1718f99a..46d1735b 100644 --- a/include/tests_authentication +++ b/include/tests_authentication @@ -25,7 +25,7 @@ LDAP_AUTH_ENABLED=0 LDAP_PAM_ENABLED=0 LDAP_CONF_LOCATIONS="${ROOTDIR}etc/ldap.conf ${ROOTDIR}etc/ldap/ldap.conf ${ROOTDIR}etc/openldap/ldap.conf ${ROOTDIR}usr/local/etc/ldap.conf ${ROOTDIR}usr/local/etc/openldap/ldap.conf" - PAM_FILE_LOCATIONS="${ROOTDIR}lib/arm-linux-gnueabihf/security ${ROOTDIR}lib/i386-linux-gnu/security ${ROOTDIR}lib/security ${ROOTDIR}lib/x86_64-linux-gnu/security ${ROOTDIR}lib64/security ${ROOTDIR}usr/lib /usr/lib/security" + PAM_FILE_LOCATIONS="${ROOTDIR}usr/lib/aarch64-linux-gnu/security ${ROOTDIR}lib/arm-linux-gnueabihf/security ${ROOTDIR}lib/i386-linux-gnu/security ${ROOTDIR}lib/security ${ROOTDIR}lib/x86_64-linux-gnu/security ${ROOTDIR}lib64/security ${ROOTDIR}usr/lib /usr/lib/security" SUDOERS_LOCATIONS="${ROOTDIR}etc/sudoers ${ROOTDIR}usr/local/etc/sudoers ${ROOTDIR}usr/pkg/etc/sudoers" SUDOERS_FILE="" # @@ -1533,31 +1533,49 @@ # Description : Logging of failed login attempts Register --test-no AUTH-9408 --weight L --network NO --category security --description "Logging of failed login attempts" if [ ${SKIPTEST} -eq 0 ]; then - if [ -f "${ROOTDIR}etc/pam.conf" ]; then + if [ -f "${ROOTDIR}etc/pam.conf" -o -d "${ROOTDIR}etc/pam.d" ]; then FOUND_PAM_TALLY2=0 FOUND_TALLYLOG=0 - if [ -s "${ROOTDIR}var/log/tallylog" ]; then + FOUND_PAM_FAILLOCK=0 + FOUND_FAILLOCKDIR=0 + if [ -d "${ROOTDIR}var/run/faillock" ]; then + FOUND_FAILLOCKDIR=1 + LogText "Result: found ${ROOTDIR}var/run/faillock directory" + elif [ -s "${ROOTDIR}var/log/tallylog" ]; then FOUND_TALLYLOG=1 LogText "Result: found ${ROOTDIR}var/log/tallylog with a size bigger than zero" else - LogText "Result: did not find ${ROOTDIR}var/log/tallylog on disk or its file size is zero bytes" + LogText "Result: did not find ${ROOTDIR}var/run/faillock directory or ${ROOTDIR}var/log/tallylog file on disk or its file size is zero bytes" fi - # Determine if pam_tally2 is available + # Determine if pam_faillock is available for D in $(GetReportData --key "pam_module\\\[\\\]"); do - if ContainsString "pam_tally2" "${D}"; then - LogText "Result: found pam_tally2 module on disk" - FOUND_PAM_TALLY2=1 + if ContainsString "pam_faillock" "${D}"; then + LogText "Result: found pam_faillock module on disk" + FOUND_PAM_FAILLOCK=1 fi done - if [ ${FOUND_PAM_TALLY2} -eq 1 -a ${FOUND_TALLYLOG} -eq 1 ]; then + if [ ${FOUND_PAM_FAILLOCK} -eq 0 ]; then + # Determine if pam_tally2 is available + for D in $(GetReportData --key "pam_module\\\[\\\]"); do + if ContainsString "pam_tally2" "${D}"; then + LogText "Result: found pam_tally2 module on disk" + FOUND_PAM_TALLY2=1 + fi + done + fi + if [ ${FOUND_PAM_FAILLOCK} -eq 1 -a ${FOUND_FAILLOCKDIR} -eq 1 ]; then + LogText "Outcome: authentication failures are logged using pam_faillock" + AUTH_FAILED_LOGINS_LOGGED=1 + Report "auth_failed_logins_tooling[]=pam_faillock" + elif [ ${FOUND_PAM_TALLY2} -eq 1 -a ${FOUND_TALLYLOG} -eq 1 ]; then LogText "Outcome: authentication failures are logged using pam_tally2" AUTH_FAILED_LOGINS_LOGGED=1 Report "auth_failed_logins_tooling[]=pam_tally2" else - LogText "Outcome: it looks like pam_tally2 is not configured to log failed login attempts" + LogText "Outcome: it looks like pam_faillock or pam_tally2 is not configured to log failed login attempts" fi - unset FOUND_PAM_TALLY2 FOUND_TALLYLOG + unset FOUND_PAM_TALLY2 FOUND_TALLYLOG FOUND_PAM_FAILLOCK FOUND_FAILLOCKDIR fi # Also check /etc/logins.defs, although its usage decreased over the years if [ -f ${ROOTDIR}etc/login.defs ]; then diff --git a/include/tests_ports_packages b/include/tests_ports_packages index e757bd0a..9ca1948d 100644 --- a/include/tests_ports_packages +++ b/include/tests_ports_packages @@ -35,6 +35,34 @@ # ################################################################################# # + # Test : PKGS-7200 + # Description : Check Alpine Package Keeper (apk) + if [ -x ${ROOTDIR}/sbin/apk ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi + Register --test-no PKGS-7200 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Querying apk" + if [ ${SKIPTEST} -eq 0 ]; then + COUNT=0 + Display --indent 4 --text "- Searching apk package manager" --result "${STATUS_FOUND}" --color GREEN + LogText "Result: Found apk binary" + Report "package_manager[]=apk" + PACKAGE_MGR_PKG=1 + LogText "Test: Querying apk info -v to get package list" + Display --indent 6 --text "- Querying package manager" + LogText "Output:" + SPACKAGES=$(apk info -v | ${SEDBINARY} -r -e 's/([a-z,A-Z,0-9,_,-,.]{1,250})-([a-z,A-Z,0-9,.]+-r[a-z,A-Z,0-9]+)/\1,\2/' | sort) + for J in ${SPACKAGES}; do + COUNT=$((COUNT + 1)) + PACKAGE_NAME=$(echo ${J} | ${CUTBINARY} -d ',' -f1) + PACKAGE_VERSION=$(echo ${J} | ${CUTBINARY} -d ',' -f2) + LogText "Found package: ${PACKAGE_NAME} (version: ${PACKAGE_VERSION})" + INSTALLED_PACKAGES="${INSTALLED_PACKAGES}|${PACKAGE_NAME},${PACKAGE_VERSION}" + done + Report "installed_packages=${COUNT}" + else + LogText "Result: apk "${STATUS_NOT_FOUND}", test skipped" + fi +# +################################################################################# +# # Test : PKGS-7301 # Description : Query FreeBSD pkg if [ -x ${ROOTDIR}usr/sbin/pkg ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi @@ -1236,6 +1264,41 @@ # ################################################################################# # + # Test : PKGS-7395 + # Description : Check Alpine upgradeable packages + if [ "${LINUX_VERSION}" = "Alpine Linux" ] && [ -x "${ROOTDIR}sbin/apk" ]; then + PREQS_MET="YES" + else + PREQS_MET="NO" + fi + + Register --test-no PKGS-7395 --os Linux --preqs-met ${PREQS_MET} --weight L --network YES --category security --description "Check for Alpine updates" + if [ ${SKIPTEST} -eq 0 ]; then + if [ ${REFRESH_REPOSITORIES} -eq 1 ]; then + LogText "Action: updating package repository with apk" + ${ROOTDIR}sbin/apk update + LogText "Result: apk finished" + else + LogText "Result: using a possibly outdated repository, as updating is disabled via configuration" + fi + LogText "Test: Checking packages which can be upgraded via apk version -l '<'" + FIND=$(${ROOTDIR}sbin/apk version -l '<' | ${GREPBINARY} '<' | ${SEDBINARY} 's/\s\+<\s/</g') + if [ -z "${FIND}" ]; then + LogText "Result: no packages found which can be upgraded" + Display --indent 2 --text "- Checking upgradeable packages" --result "${STATUS_NONE}" --color GREEN + AddHP 3 3 + else + LogText "Result: found one or more packages which can be upgraded" + Display --indent 2 --text "- Checking upgradeable packages" --result "${STATUS_FOUND}" --color YELLOW + for ITEM in ${FIND}; do + ITEM=$(echo ${ITEM} | ${SEDBINARY} -r -e 's/([a-z,A-Z,0-9,_,-,.]{1,250})-([a-z,A-Z,0-9,.]+-r[a-z,A-Z,0-9]+)<([a-z,A-Z,0-9,-,.]+)/\1 from \2 to \3/') + LogText "${ITEM}" + done + fi + fi +# +################################################################################# +# # Test : PKGS-7398 # Description : Check package audit tool Register --test-no PKGS-7398 --weight L --network YES --category security --description "Check for package audit tool" diff --git a/include/tests_printers_spoolers b/include/tests_printers_spoolers index 18b88c0c..851b0edd 100644 --- a/include/tests_printers_spoolers +++ b/include/tests_printers_spoolers @@ -139,8 +139,18 @@ Register --test-no PRNT-2308 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Check CUPSd network configuration" if [ ${SKIPTEST} -eq 0 ]; then FOUND=0 - # Checking network addresses + PORT_FOUND=0 + LogText "Test: Checking CUPS daemon listening network addresses" + + # Search for Port statement + FIND=$(${EGREPBINARY} "^Port 631" ${CUPSD_CONFIG_FILE}) + if [ -n "${FIND}" ]; then + LogText "Result: found CUPS listening on port 631 (most likely all interfaces)" + PORT_FOUND=1 + fi + + # Checking network addresses FIND=$(${EGREPBINARY} "^(SSL)?Listen" ${CUPSD_CONFIG_FILE} | ${GREPBINARY} -v "/" | ${AWKBINARY} '{ print $2 }') COUNT=0 for ITEM in ${FIND}; do @@ -149,17 +159,10 @@ FOUND=1 done - # Search for Port statement - FIND=$(${EGREPBINARY} "^Port 631" ${CUPSD_CONFIG_FILE}) - if [ -n "${FIND}" ]; then - LogText "Result: found CUPS listening on port 631 (most likely all interfaces)" - FOUND=1 - fi - # Check if daemon might be running on localhost - if [ ${FOUND} -eq 0 ]; then + if [ ${FOUND} -eq 0 -a ${PORT_FOUND} -eq 0 ]; then LogText "Result: CUPS does not look to be listening on a network port" - elif [ ${COUNT} -eq 1 ]; then + elif [ ${COUNT} -eq 1 -a ${PORT_FOUND} -eq 0 ]; then if [ "${FIND}" = "localhost:631" -o "${FIND}" = "127.0.0.1:631" ]; then LogText "Result: CUPS daemon only running on localhost" AddHP 2 2 diff --git a/include/tests_webservers b/include/tests_webservers index 6e0a3b3d..e0ca5737 100644 --- a/include/tests_webservers +++ b/include/tests_webservers @@ -288,7 +288,7 @@ Register --test-no HTTP-6643 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Determining existence of specific Apache modules" if [ ${SKIPTEST} -eq 0 ]; then # Check modules, module - if CheckItem "apache_module" "/mod_security2.so"; then + if CheckItem "apache_module" "/mod_security(2|3).so" ; then Display --indent 10 --text "ModSecurity: web application firewall" --result "${STATUS_FOUND}" --color GREEN AddHP 3 3 else |