#!/bin/sh

#################################################################################
#
#   Lynis
# ------------------
#
# Copyright 2007-2016, Michael Boelen (michael.boelen@cisofy.com)
# Web site: https://cisofy.com
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# SSH
#
#################################################################################
#
    SSH_DAEMON_CONFIG_LOCS="/etc /etc/ssh /usr/local/etc/ssh /opt/csw/etc/ssh"
    SSH_DAEMON_CONFIG=""
    SSH_DAEMON_PORT=""
    SSH_DAEMON_RUNNING=0
#
#################################################################################
#
    InsertSection "SSH Support"
#
#################################################################################
#
    # Test        : SSH-7402
    # Description : Check for a running SSH daemon
    Register --test-no SSH-7402 --weight L --network NO --description "Check for running SSH daemon"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Searching for a SSH daemon"
        IsRunning sshd
        if [ ${RUNNING} -eq 1 ]; then
            SSH_DAEMON_RUNNING=1
            Display --indent 2 --text "- Checking running SSH daemon" --result FOUND --color GREEN
          else
            Display --indent 2 --text "- Checking running SSH daemon" --result "NOT FOUND" --color WHITE
        fi
    fi
#
#################################################################################
#
    # Test        : SSH-7404
    # Description : Determine SSH daemon configuration file location
    if [ ${SSH_DAEMON_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no SSH-7404 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH daemon file location"
    if [ ${SKIPTEST} -eq 0 ]; then
        FOUND=0
        LogText "Test: searching for sshd_config file"
        for I in ${SSH_DAEMON_CONFIG_LOCS}; do
            if [ -f "${I}/sshd_config" ]; then
              LogText "Result: ${I}/sshd_config exists"
              if [ ${FOUND} -eq 1 ]; then
                  ReportException "${TEST_NO}:01"
                  LogText "Result: we already had found another sshd_config file. Using this new file then."
              fi
              FileIsReadable ${I}/sshd_config
              if [ ${CANREAD} -eq 1 ]; then
                  FOUND=1
                  SSH_DAEMON_CONFIG="${I}/sshd_config"
                else
                  LogText "Result: can not read ${I}/sshd_config file (no permission)"
              fi
            fi
        done
        if [ "${SSH_DAEMON_CONFIG}" = "" ]; then
            LogText "Result: No sshd configuration found"
            Display --indent 4 --text "- Searching SSH configuration" --result "NOT FOUND" --color YELLOW
            ReportException "${TEST_NO}:1" "SSH daemon is running, but no readable configuration file found"
          else
            LogText "Result: using last found configuration file: ${SSH_DAEMON_CONFIG}"
            Display --indent 4 --text "- Searching SSH configuration" --result FOUND --color GREEN
        fi
    fi
#
#################################################################################
#
    # Test        : SSH-7408
    # Description : Check SSH specific defined options
    if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no SSH-7408 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH specific defined options"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking specific defined options in ${SSH_DAEMON_CONFIG}"
        ## SSHOPTIONS scheme:
        ##      <OptionName>:<ExpectedValue>,<MediumScoreValue>,<WeakValue>:<TestType>
        ##
        ##      Test types:
        ##      (a) '='         -- equal to is better,
        ##      (b) '<'         -- less or equal is better,
        ##      (c) '>'         -- more or equal is better,
        ##      (d) '!'         -- not equal is better.
        ##
        ##      Example:
        ##      PermitRootLogin:NO,WITHOUT-PASSWORD,YES,:=
        SSHOPS="AllowTcpForwarding:NO,LOCAL,YES:=\
                ClientAliveCountMax:2,4,16:<\
                ClientAliveInterval:300,600,900:<\
                Compression:NO,DELAYED,YES:=\
                FingerprintHash:SHA256,MD5,:=\
                GatewayPorts:NO,,YES:=\
                IgnoreRhosts:YES,,NO:=\
                LoginGraceTime:120,240,480:<\
                LogLevel:VERBOSE,INFO,:=\
                MaxAuthTries:1,3,6:<\
                MaxStartups:4,8,16:<\
                MaxSessions:2,4,8:<\
                PermitRootLogin:NO,WITHOUT-PASSWORD,YES:=\
                PermitUserEnvironment:NO,,YES:=\
                PermitTunnel:NO,,YES:=\
                Port:,,22:!\
                PrintLastLog:YES,,NO:=\
                Protocol:2,,1:=\
                StrictModes:YES,,NO:=\
                TCPKeepAlive:NO,,YES:=\
                UseDNS:YES,,NO:=\
                UsePrivilegeSeparation:SANDBOX,YES,NO:=\
                VerifyReverseMapping:YES,,NO:=\
                X11Forwarding:NO,,YES:="

        for I in ${SSHOPS}; do
            OPTIONNAME=`echo ${I} | cut -d ':' -f1`
            EXPECTEDVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f1`
            MEDIUMSCOREDVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f2`
            WEAKVALUE=`echo ${I} | cut -d ':' -f2 | cut -d',' -f3`
            TESTTYPE=`echo ${I} | cut -d ':' -f3`
            RESULT="NONE"
            FOUNDVALUE=`awk -v OPT="${OPTIONNAME}" 'index($0, OPT) == 1 { print toupper($2) }' ${SSH_DAEMON_CONFIG}`
            LogText "Test: Checking ${OPTIONNAME} in ${SSH_DAEMON_CONFIG}"

            if [ ! "${FOUNDVALUE}" = "" ]; then
                LogText "Result: Option ${OPTIONNAME} found in ${SSH_DAEMON_CONFIG}"
                LogText "Result: Option ${OPTIONNAME} value is  ${FOUNDVALUE}"

                if [ "${TESTTYPE}" = "=" ]; then
                    if [ "${FOUNDVALUE}" = "${EXPECTEDVALUE}" ]; then
                        RESULT="GOOD"
                    elif [ "${FOUNDVALUE}" = "${MEDIUMSCOREDVALUE}" ]; then
                        RESULT="MIDSCORED"
                    elif [ "${FOUNDVALUE}" = "${WEAKVALUE}" ]; then
                        RESULT="WEAK"
                    else
                        RESULT="UNKNOWN"
                    fi

                elif [ "${TESTTYPE}" = "<" ]; then
                    if [ "${FOUNDVALUE}" -ge "${WEAKVALUE}" -o "${FOUNDVALUE}" -gt "${MEDIUMSCOREDVALUE}" ]; then
                        RESULT="WEAK"
                    elif [ "${FOUNDVALUE}" -le "${MEDIUMSCOREDVALUE}" -a "${FOUNDVALUE}" -gt "${EXPECTEDVALUE}" ]; then
                        RESULT="MIDSCORED"
                    elif [ "${FOUNDVALUE}" -le "${EXPECTEDVALUE}" ]; then
                        RESULT="GOOD"
                    else
                        RESULT="UNKNOWN"
                    fi

                elif [ "${TESTTYPE}" = ">" ]; then
                    if [ "${FOUNDVALUE}" -le "${WEAKVALUE}" ]; then
                        RESULT="WEAK"
                    elif [ "${FOUNDVALUE}" -le "${WEAKVALUE}" -a "${FOUNDVALUE}" -ge "${MEDIUMSCOREDVALUE}" ]; then
                        RESULT="MIDSCORED"
                    elif [ "${FOUNDVALUE}" -ge "${EXPECTEDVALUE}" ]; then
                        RESULT="GOOD"
                    else
                        RESULT="UNKNOWN"
                    fi

                elif [ "${TESTTYPE}" = "!" ]; then
                    if [ "${FOUNDVALUE}" = "${WEAKVALUE}" ]; then
                        RESULT="WEAK"
                    elif [ ! "${FOUNDVALUE}" = "${WEAKVALUE}" ]; then
                        RESULT="GOOD"
                    else
                        RESULT="UNKNOWN"
                    fi

                else
                    RESULT="NONE"
                fi
            fi


            if [ "${RESULT}" = "GOOD" ]; then
                LogText "Result: SSH option ${OPTIONNAME} is configured very well"
                Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result OK --color GREEN
                AddHP 3 3
            elif [ "${RESULT}" = "MIDSCORED" ]; then
                LogText "Result: SSH option ${OPTIONNAME} is configured reasonably"
                ReportSuggestion ${TEST_NO} "Consider hardening of SSH configuration" "${OPTIONNAME} (${FOUNDVALUE} --> ${EXPECTEDVALUE})" "-"
                Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "MEDIUM" --color YELLOW
                AddHP 1 3
            elif [ "${RESULT}" = "WEAK" ]; then
                LogText "Result: SSH option ${OPTIONNAME} is in a weak configuration state and should be fixed"
                #ReportWarning ${TEST_NO} "M" "Unsafe configured SSH option: ${OPTIONNAME}"
                ReportSuggestion ${TEST_NO} "Consider hardening SSH configuration" "${OPTIONNAME} (${FOUNDVALUE} --> ${EXPECTEDVALUE})" "-"
                Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result WARNING --color RED
                AddHP 0 3
            elif [ "${RESULT}" = "UNKNOWN" ]; then
                LogText "Result: Value of SSH option ${OPTIONNAME} is unknown (not defined)"
                Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result DEFAULT --color WHITE
                #ReportException "SSH-7408:01" "Unknown SSH option"
                Report "unknown_config_option[]=ssh|$SSH_DAEMON_CONFIG}|${OPTIONNAME}|"
            else
                LogText "Result: Option ${OPTIONNAME} not found in ${SSH_DAEMON_CONFIG}"
                Display --indent 4 --text "- SSH option: ${OPTIONNAME}" --result "NOT FOUND" --color WHITE
            fi

        done
    fi
#
#################################################################################
#
    # Test        : SSH-7440
    # Description : AllowUsers / AllowGroups
    # Goal        : Check if only a specific amount of users/groups can log in to the system
    if [ ${SSH_DAEMON_RUNNING} -eq 1 -a ! "${SSH_DAEMON_CONFIG}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no SSH-7440 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check SSH option: AllowUsers and AllowGroups"
    if [ ${SKIPTEST} -eq 0 ]; then
        FOUND=0
        # AllowUsers
        FIND=`egrep "^AllowUsers" ${SSH_DAEMON_CONFIG} | awk '{ print $2 }'`
        if [ ! "${FIND}" = "" ]; then
            LogText "Result: AllowUsers set, with value ${FIND}"
            Display --indent 4 --text "- SSH option: AllowUsers" --result FOUND --color GREEN
            FOUND=1
          else
            LogText "Result: AllowUsers is not set"
            Display --indent 4 --text "- SSH option: AllowUsers" --result "NOT FOUND" --color WHITE
        fi

        # AllowGroups
        FIND=`egrep "^AllowGroups" ${SSH_DAEMON_CONFIG} | awk '{ print $2 }'`
        if [ ! "${FIND}" = "" ]; then
            LogText "Result: AllowUsers set ${FIND}"
            Display --indent 4 --text "- SSH option: AllowGroups" --result FOUND --color GREEN
            FOUND=1
          else
            LogText "Result: AllowGroups is not set"
            Display --indent 4 --text "- SSH option: AllowGroups" --result "NOT FOUND" --color WHITE
        fi

        if [ ${FOUND} -eq 1 ]; then
            LogText "Result: SSH is limited to a specific set of users, which is good"
            AddHP 2 2
          else
            LogText "Result: SSH has no specific user or group limitation. Most likely all valid users can SSH to this machine."
            AddHP 0 1
        fi
    fi
#
#################################################################################
#

Report "ssh_daemon_running=${SSH_DAEMON_RUNNING}"
#Report "ssh_daemon_port=${SSH_DAEMON_PORT}"

wait_for_keypress

#
#================================================================================
# Lynis - Copyright 2007-2016, Michael Boelen, CISOfy - https://cisofy.com