blob: 11cea42e529449214a9d8a83fd69e05a734e5193 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
|
#!/bin/sh
#################################################################################
#
# Lynis
# ------------------
#
# Copyright 2007-2013, Michael Boelen
# Copyright 2007-2017, CISOfy
#
# Website : https://cisofy.com
# Blog : http://linux-audit.com
# GitHub : https://github.com/CISOfy/lynis
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
InsertSection "Hardening"
# COMPILER_INSTALLED is initialised before
HARDEN_COMPILERS_NEEDED=0
#
#################################################################################
#
# Test : HRDN-7220
# Description : Check for installed compilers
# Notes : No suggestion for hardening compilers, as HRDN-7222 will take care of that
Register --test-no HRDN-7220 --weight L --network NO --category security --description "Check if one or more compilers are installed"
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Check if one or more compilers can be found on the system"
if [ ${COMPILER_INSTALLED} -eq 0 ]; then
LogText "Result: no compilers found"
Display --indent 4 --text "- Installed compiler(s)" --result "${STATUS_NOT_FOUND}" --color GREEN
AddHP 3 3
else
LogText "Result: found installed compiler. See top of logfile which compilers have been found or use ${GREPBINARY} to filter on 'compiler'"
Display --indent 4 --text "- Installed compiler(s)" --result "${STATUS_FOUND}" --color RED
AddHP 1 3
fi
fi
#
#################################################################################
#
# Test : HRDN-7222
# Description : Check for permissions of installed compilers
Register --test-no HRDN-7222 --weight L --network NO --category security --description "Check compiler permissions"
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Check if one or more compilers can be found on the system"
HARDEN_COMPILERS_NEEDED=0
if [ ${COMPILER_INSTALLED} -eq 0 ]; then
LogText "Result: no compilers found"
else
# as
if [ ! -z "${ASBINARY}" ]; then
LogText "Test: Check file permissions for as (Assembler)"
if IsWorldExecutable ${ASBINARY}; then
LogText "Binary: found ${ASBINARY} (world executable)"
Report "compiler[]=${ASBINARY}"
AddHP 2 3
HARDEN_COMPILERS_NEEDED=1
else
AddHP 3 3
fi
fi
# gcc
if [ ! -z "${GCCBINARY}" ]; then
LogText "Test: Check file permissions for GCC compiler"
if IsWorldExecutable ${GCCBINARY}; then
LogText "Binary: found ${GCCBINARY} (world executable)"
Report "compiler[]=${GCCBINARY}"
AddHP 2 3
HARDEN_COMPILERS_NEEDED=1
else
AddHP 3 3
fi
fi
# Report suggestion is one or more compilers can be better hardened
if [ ${HARDEN_COMPILERS_NEEDED} -eq 1 ]; then
LogText "Result: at least one compiler could be better hardened by restricting executable access to root or group only"
ReportSuggestion ${TEST_NO} "Harden compilers like restricting access to root user only"
fi
# TODO check if compilers have a specific group (like compiler, or NOT root/wheel)
# Display --indent 4 --text "- Installed compiler(s)" --result "${STATUS_FOUND}" --color RED
# /usr/bin/*cc*
# /usr/bin/*++*
# /usr/bin/ld
# (and 700 or 750 permissions)
fi
fi
#
#################################################################################
#
# Test : HRDN-7230
# Description : Check for installed malware scanners
Register --test-no HRDN-7230 --weight L --network NO --category security --description "Check for malware scanner"
if [ ${SKIPTEST} -eq 0 ]; then
LogText "Test: Check if a malware scanner is installed"
if [ ${MALWARE_SCANNER_INSTALLED} -eq 1 ]; then
LogText "Result: found at least one malware scanner"
Display --indent 4 --text "- Installed malware scanner" --result "${STATUS_FOUND}" --color GREEN
AddHP 3 3
else
LogText "Result: no malware scanner found"
if [ "${MACHINE_ROLE}" = "personal" ]; then
Display --indent 4 --text "- Installed malware scanner" --result "${STATUS_NOT_FOUND}" --color YELLOW
else
Display --indent 4 --text "- Installed malware scanner" --result "${STATUS_NOT_FOUND}" --color RED
fi
Display --indent 4 --text "- Installed malware scanner" --result "${STATUS_NOT_FOUND}" --color RED
ReportSuggestion ${TEST_NO} "Harden the system by installing at least one malware scanner, to perform periodic file system scans" "-" "Install a tool like rkhunter, chkrootkit, OSSEC"
AddHP 1 3
LogText "Result: no malware scanner found"
fi
fi
#
#################################################################################
#
# LogText "--------------------------------------------------------------------"
# LogText "| System part | Preferred value | Actual value | Points |"
# LogText "| [!] Compiler installed | 0 | [${COMPILER_INSTALLED}] | x |"
# LogText "| [V] Malware scanner installed | 1 | [x] | x |"
# LogText "| [V] Packet filter enabled | 1 | [x] | x |"
# LogText "--------------------------------------------------------------------"
# LogText "| [!]: Hardening possible, [V]: Hardening performed, [ ]: Unknown "
# LogText "--------------------------------------------------------------------"
#
#################################################################################
#
Report "compiler_installed=${COMPILER_INSTALLED}"
WaitForKeyPress
#
#================================================================================
# Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com
|
