prelude-lml-rules 4.1.0-1 / etc / prelude-lml / ruleset / shadow-utils.rules

#FULLNAME: shadow-utils
#VERSION: 1.0
#DESCRIPTION: The shadow-utils includes programs for converting UNIX password files to the shadow password format, as well as tools for managing user and group accounts. The rules included here were developed using shadow-utils 4.0.3-12.

#####
#
# Copyright (C) 2004 G Ramon Gomez <gene at gomezbrothers dot com>
# All Rights Reserved
#
# This file is part of the Prelude-LML program.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
#####

#DESCRIPTION:Group created
#CATEGORY:Account Management
#LOG:Oct 30 10:18:37 localhost groupadd[3491]: new group: name=test, GID=1003
#LOG:May 10 16:37:57 somehost groupadd[618]: new group: name=clamav, gid=46
regex=new group: name=(\S+), [gG][iI][dD]=(?!0)(\d+); \
 classification.text=Group Created; \
 id=3300; \
 revision=1; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 assessment.impact.description=The group $1 was created with gid $2; \
 target(0).user.user_id(0).type=current-group; \
 target(0).user.user_id(0).name=$1; \
 target(0).user.user_id(0).number=$2; \
 last

#DESCRIPTION:Group created with GID 0 (wheel)
#CATEGORY:Account Management
#LOG:Oct 30 10:19:22 localhost groupadd[3491]: new group: name=wheel, GID=0
#LOG:May 10 16:37:57 somehost groupadd[618]: new group: name=wheel, gid=0
regex=new group: name=(\S+), [gG][iI][dD]=0; \
 classification.text=Group Created with GID 0; \
 id=3301; \
 revision=1; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=high; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=admin; \
 assessment.impact.description=The group $1 was created with gid 0; \
 target(0).user.user_id(0).type=current-group; \
 target(0).user.user_id(0).name=$1; \
 target(0).user.user_id(0).number=0; \
 last

#DESCRIPTION:User created
#CATEGORY:Account Management
#LOG:Oct 30 10:18:37 localhost useradd[3495]: new user: name=test, UID=1005, GID=1003, home=/home/test, shell=/bin/bash
#LOG:May 10 16:37:57 somehost useradd[621]: new user: name=clamav, uid=46, gid=46, home=/tmp, shell=/sbin/nologin
regex=new user: name=(\S+), [uU][iI][dD]=(?!0)(\d+), [gG][iI][dD]=(?!0)(\d+), home=(\S+), shell=(\S+); \
 classification.text=User Created; \
 id=3302; \
 revision=2; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 assessment.impact.description=The user $1 was created with uid $2 and gid $3; \
 target(0).user.user_id(0).type=current-user; \
 target(0).user.user_id(0).name=$1; \
 target(0).user.user_id(0).number=$2; \
 target(0).user.user_id(1).type=current-group; \
 target(0).user.user_id(1).number=$3; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Home directory; \
 additional_data(0).data=$4; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Shell; \
 additional_data(1).data=$5; \
 last

#DESCRIPTION:User created with UID 0
#CATEGORY:Account Management
#LOG:Oct 30 10:18:37 localhost useradd[3495]: new user: name=test, UID=0, GID=45, home=/home/test, shell=/bin/bash
#LOG:May 10 16:37:57 somehost useradd[621]: new user: name=someuser, uid=0, gid=46, home=/tmp, shell=/sbin/nologin
regex=new user: name=(\S+), [uU][iI][dD]=0, [gG][iI][dD]=(?!0)(\d+), home=(\S+), shell=(\S+); \
 classification.text=User Created with UID 0; \
 id=3303; \
 revision=2; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=high; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=admin; \
 assessment.impact.description=The user $1 was created with uid 0 and gid $2; \
 target(0).user.user_id(0).type=current-user; \
 target(0).user.user_id(0).name=$1; \
 target(0).user.user_id(0).number=0; \
 target(0).user.user_id(1).type=current-group; \
 target(0).user.user_id(1).number=$2; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Home directory; \
 additional_data(0).data=$3; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Shell; \
 additional_data(1).data=$4; \
 last

#DESCRIPTION:User created with GID 0
#CATEGORY:Account Management
#LOG:Oct 30 10:18:37 localhost useradd[3495]: new user: name=test, UID=55, GID=0, home=/home/test, shell=/bin/bash
#LOG:May 10 16:37:57 somehost useradd[621]: new user: name=someuser, uid=46, gid=0, home=/tmp, shell=/sbin/nologin
regex=new user: name=(\S+), [uU][iI][dD]=(?!0)(\d+), [gG][iI][dD]=0, home=(\S+), shell=(\S+); \
 classification.text=User Created with GID 0; \
 id=3304; \
 revision=2; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=high; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=admin; \
 assessment.impact.description=The user $1 was created with uid $2 and gid 0; \
 target(0).user.user_id(0).type=current-user; \
 target(0).user.user_id(0).name=$1; \
 target(0).user.user_id(0).number=$2; \
 target(0).user.user_id(1).type=current-group; \
 target(0).user.user_id(1).number=0; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Home directory; \
 additional_data(0).data=$3; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Shell; \
 additional_data(1).data=$4; \
 last

#DESCRIPTION:User created with UID/GID 0
#CATEGORY:Account Management
#LOG:Oct 30 10:18:37 localhost useradd[3495]: new user: name=test, UID=0, GID=0, home=/home/test, shell=/bin/bash
#LOG:May 10 16:37:57 somehost useradd[621]: new user: name=someuser, uid=0, gid=0, home=/tmp, shell=/sbin/nologin
regex=new user: name=(\S+), [uU][iI][dD]=0, [gG][iI][dD]=0, home=(\S+), shell=(\S+); \
 classification.text=User Created with UID/GID 0; \
 id=3305; \
 revision=2; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=high; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=admin; \
 assessment.impact.description=The user $1 was created with uid and gid 0; \
 target(0).user.user_id(0).type=current-user; \
 target(0).user.user_id(0).name=$1; \
 target(0).user.user_id(0).number=0; \
 target(0).user.user_id(1).type=current-group; \
 target(0).user.user_id(1).number=0; \
 additional_data(0).type=string; \
 additional_data(0).meaning=Home directory; \
 additional_data(0).data=$2; \
 additional_data(1).type=string; \
 additional_data(1).meaning=Shell; \
 additional_data(1).data=$3; \
 last

#DESCRIPTION:User name changed
#CATEGORY:Account Management
#LOG:May 12 16:16:34 metatron usermod[14432]: change user name `bogususer' to `nonbogususer'
#LOG:Dec  4 10:23:20 maximus usermod[2939]: change user name 'tartempion' to 'tartuf'
regex=change user name ['`](\S+)' to ['`](\S+)'; \
 classification.text=User Name Changed; \
 id=3306; \
 revision=1; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 assessment.impact.description=The user $1 was renamed $2; \
 target(0).user.user_id(0).type=original-user; \
 target(0).user.user_id(0).name=$1; \
 target(0).user.user_id(1).type=current-user; \
 target(0).user.user_id(1).name=$2; \
 last

#DESCRIPTION:User UID changed
#CATEGORY:Account Management
#LOG:May 12 16:16:34 metatron usermod[14432]: change user `nonbogususer' UID from `555' to `503'
#LOG:Dec  4 10:28:51 maximus usermod[3081]: change user 'tartuf' UID from '502' to '888'
regex=change user ['`](\S+)' UID from ['`](\d+)' to ['`](?!0)(\d+)'; \
 classification.text=User UID Changed; \
 id=3307; \
 revision=1; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 assessment.impact.description=The user $1 had its UID changed from $2 to $3; \
 target(0).user.user_id(0).type=original-user; \
 target(0).user.user_id(0).name=$1; \
 target(0).user.user_id(0).number=$2; \
 target(0).user.user_id(1).type=current-user; \
 target(0).user.user_id(1).name=$1; \
 target(0).user.user_id(1).number=$3; \
 last

#DESCRIPTION:User UID changed to 0
#CATEGORY:Account Management
#LOG:May 12 16:16:34 metatron usermod[14432]: change user `nonbogususer' UID from `555' to `0'
#LOG:Dec  4 10:28:51 maximus usermod[3081]: change user 'tartuf' UID from '502' to '0'
regex=change user ['`](\S+)' UID from ['`](\d+)' to ['`]0'; \
 classification.text=User UID Changed to 0; \
 id=3308; \
 revision=1; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=high; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=admin; \
 assessment.impact.description=The user $1 had its UID changed from $2 to 0; \
 target(0).user.user_id(0).type=original-user; \
 target(0).user.user_id(0).name=$1; \
 target(0).user.user_id(0).number=$2; \
 target(0).user.user_id(1).type=current-user; \
 target(0).user.user_id(1).name=$1; \
 target(0).user.user_id(1).number=0; \
 last

#DESCRIPTION:User primary GID changed
#CATEGORY:Account Management
#LOG:May 12 16:16:34 metatron usermod[14432]: change user `nonbogususer' GID from `503' to `503'
#LOG:Dec  4 10:32:33 maximus usermod[3368]: change user 'tartuf' GID from '503' to '500'
regex=change user ['`](\S+)' GID from ['`](\d+)' to ['`](?!0)(\d+)'; \
 classification.text=User Primary GID Changed; \
 id=3309; \
 revision=1; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 assessment.impact.description=The user $1 had its GID changed from $2 to $3; \
 target(0).user.user_id(0).type=current-user; \
 target(0).user.user_id(0).name=$1; \
 target(0).user.user_id(1).type=current-group; \
 target(0).user.user_id(1).number=$3; \
 last

#DESCRIPTION:User primary GID changed to 0
#CATEGORY:Account Management
#LOG:May 12 16:16:34 metatron usermod[14432]: change user `nonbogususer' GID from `503' to `0'
#LOG:Dec  4 10:32:33 maximus usermod[3368]: change user 'tartuf' GID from '503' to '0'
regex=change user ['`](\S+)' GID from ['`](\d+)' to ['`]0'; \
 classification.text=User Primary GID Changed to 0; \
 id=3310; \
 revision=1; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=high; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=admin; \
 assessment.impact.description=The user $1 had its GID changed from $2 to 0; \
 target(0).user.user_id(0).type=current-user; \
 target(0).user.user_id(0).name=$1; \
 target(0).user.user_id(1).type=current-group; \
 target(0).user.user_id(1).number=0; \
 last

#DESCRIPTION:Group GID changed
#CATEGORY:Account Management
#LOG:May 12 16:11:01 metatron groupmod[9873]: change gid for `nonbogusgroup' to 504
regex=change gid for `(\S+)' to (?!0)(\d+); \
 classification.text=Group GID Changed; \
 id=3311; \
 revision=1; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 assessment.impact.description=The group $1 had its GID changed to $2; \
 target(0).user.user_id(0).type=current-group; \
 target(0).user.user_id(0).name=$1; \
 target(0).user.user_id(0).number=$2; \
 last

#DESCRIPTION:Group GID changed to 0
#CATEGORY:Account Management
#LOG:May 12 16:11:01 metatron groupmod[9873]: change gid for `nonbogusgroup' to 0
regex=change gid for `(\S+)' to 0; \
 classification.text=Group GID Changed to 0; \
 id=3312; \
 revision=1; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=high; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=admin; \
 assessment.impact.description=The group $1 had its GID changed to 0; \
 target(0).user.user_id(0).type=current-group; \
 target(0).user.user_id(0).name=$1; \
 target(0).user.user_id(0).number=0; \
 last

#DESCRIPTION:User added to group
#CATEGORY:Account Management
#LOG:May 13 15:55:12 metatron usermod[20587]: add `bogususer' to group `slocate'
#LOG:Dec  4 11:03:18 maximus usermod[5438]: add 'tartuf' to group 'tonton'
regex=add ['`](\S+)' to group ['`](?!wheel|root|sudo)(\S+)'; \
 classification.text=User Added to Group; \
 id=3313; \
 revision=1; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 assessment.impact.description=The user $1 was added to group $2; \
 target(0).user.user_id(0).type=current-user; \
 target(0).user.user_id(0).name=$1; \
 target(0).user.user_id(1).type=current-group; \
 target(0).user.user_id(1).name=$2; \
 last

#DESCRIPTION:User added to group
#CATEGORY:Account Management
#LOG:May 13 15:55:12 metatron usermod[20587]: add `test' to group `sudo'
#LOG:May 13 15:55:12 metatron usermod[20587]: add `bogususer' to group `wheel'
#LOG:Dec  4 11:03:18 maximus usermod[5438]: add 'tartuf' to group 'wheel'
regex=add ['`](\S+)' to group ['`](wheel|root|sudo)'; \
 classification.text=User Added to Group $2; \
 id=3314; \
 revision=1; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=high; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=admin; \
 assessment.impact.description=The user $1 was added to group $2; \
 target(0).user.user_id(0).type=current-user; \
 target(0).user.user_id(0).name=$1; \
 target(0).user.user_id(1).type=current-group; \
 target(0).user.user_id(1).name=$2; \
 last

#DESCRIPTION:Group GID changed
#CATEGORY:Account Management
#LOG:Dec  4 10:43:35 maximus groupmod[5097]: group changed in /etc/passwd (group tonton/504, new gid: 888)
#LOG:Dec  4 10:43:35 maximus groupmod[5097]: group changed in /etc/group (group tonton/504, new gid: 888)
regex=group changed in (/etc/passwd|/etc/group) \(group ([^/]+)\/(\d+), new gid: (?!0)(\d+)\); \
 classification.text=Group GID Changed; \
 id=3315; \
 revision=1; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=low; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=user; \
 assessment.impact.description=The group $2 had its GID changed from $3 to $4; \
 target(0).file(0).path=$1; \
 target(0).user.user_id(0).type=current-group; \
 target(0).user.user_id(0).name=$2; \
 target(0).user.user_id(0).number=$4; \
 last

#DESCRIPTION:Group GID changed to 0
#CATEGORY:Account Management
#LOG:Dec  4 10:43:35 maximus groupmod[5097]: group changed in /etc/passwd (group tonton/504, new gid: 0)
#LOG:Dec  4 10:43:35 maximus groupmod[5097]: group changed in /etc/group (group tonton/504, new gid: 0)
regex=group changed in (/etc/passwd|/etc/group) \(group ([^/]+)\/(\d+), new gid: 0\); \
 classification.text=Group GID Changed to 0; \
 id=3316; \
 revision=1; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=high; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=admin; \
 assessment.impact.description=The group $2 had its GID changed from $3 to 0; \
 target(0).file(0).path=$1; \
 target(0).user.user_id(0).type=current-group; \
 target(0).user.user_id(0).name=$2; \
 target(0).user.user_id(0).number=0; \
 last

#DESCRIPTION:User deleted
#CATEGORY:Account Management
#LOG:Nov  4 15:18:16 exatest1 userdel[10259]: delete user `testuser'
#LOG:Dec  4 11:14:44 maximus userdel[5627]: delete user 'tartuf'
regex=userdel\[\d+\]: delete user ['`]([^']+)'; \
 classification.text=User deleted; \
 id=3317; \
 revision=1; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=medium; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=admin; \
 assessment.impact.description=User account $1 was deleted; \
 target(0).user.user_id(0).type=current-user; \
 target(0).user.user_id(0).name=$1; \
 last

#DESCRIPTION:Group deleted
#CATEGORY:Account Management
#LOG:Dec  4 11:15:55 maximus groupdel[5648]: group 'tonton' removed
regex=groupdel\[\d+\]: group ['`]([^']+)' removed; \
 classification.text=Group deleted; \
 id=3318; \
 revision=1; \
 analyzer(0).name=shadow-utils; \
 analyzer(0).class=Administration; \
 assessment.impact.severity=medium; \
 assessment.impact.completion=succeeded; \
 assessment.impact.type=admin; \
 assessment.impact.description=Group $1 was deleted; \
 target(0).user.user_id(0).type=current-group; \
 target(0).user.user_id(0).name=$1; \
 last