/usr/share/lynis/include/tests_hardening is in lynis 2.1.1-1.
This file is owned by root:root, with mode 0o600.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 | #!/bin/sh
#################################################################################
#
# Lynis
# ------------------
#
# Copyright 2007-2015, Michael Boelen, CISOfy (michael.boelen@cisofy.com)
# Web site: https://cisofy.com
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
InsertSection "Hardening"
# COMPILER_INSTALLED is initialised before
HARDEN_COMPILERS_NEEDED=0
#
#################################################################################
#
# Test : HRDN-7220
# Description : Check for installed compilers
# Notes : No suggestion for hardening compilers, as HRDN-7222 will take care of that
Register --test-no HRDN-7220 --weight L --network NO --description "Check if one or more compilers are installed"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: Check if one or more compilers can be found on the system"
if [ ${COMPILER_INSTALLED} -eq 0 ]; then
logtext "Result: no compilers found"
Display --indent 4 --text "- Installed compiler(s)" --result "NOT FOUND" --color GREEN
AddHP 3 3
else
logtext "Result: found installed compiler. See top of logfile which compilers have been found or use grep to filter on 'compiler'"
Display --indent 4 --text "- Installed compiler(s)" --result "FOUND" --color RED
AddHP 1 3
fi
fi
#
#################################################################################
#
# Test : HRDN-7222
# Description : Check for permissions of installed compilers
Register --test-no HRDN-7222 --weight L --network NO --description "Check compiler permissions"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: Check if one or more compilers can be found on the system"
HARDEN_COMPILERS_NEEDED=0
if [ ${COMPILER_INSTALLED} -eq 0 ]; then
logtext "Result: no compilers found"
else
# as
if [ ! "${ASBINARY}" = "" ]; then
logtext "Test: Check file permissions for as (Assembler)"
IsWorldExecutable ${ASBINARY}
if [ $? -eq 1 ]; then
logtext "Binary: found ${ASBINARY} (world executable)"
report "compiler[]=${ASBINARY}"
AddHP 2 3
HARDEN_COMPILERS_NEEDED=1
else
AddHP 3 3
fi
fi
# gcc
if [ ! "${GCCBINARY}" = "" ]; then
logtext "Test: Check file permissions for GCC compiler"
IsWorldExecutable ${GCCBINARY}
if [ $? -eq 1 ]; then
logtext "Binary: found ${GCCBINARY} (world executable)"
report "compiler[]=${GCCBINARY}"
AddHP 2 3
HARDEN_COMPILERS_NEEDED=1
else
AddHP 3 3
fi
fi
# Report suggestion is one or more compilers can be better hardened
if [ ${HARDEN_COMPILERS_NEEDED} -eq 1 ]; then
logtext "Result: at least one compiler could be better hardened by restricting executable access to root or group only"
ReportSuggestion ${TEST_NO} "Harden compilers like restricting access to root user only"
fi
#YYY check if compilers have a specific group (like compiler, or NOT root/wheel)
# Display --indent 4 --text "- Installed compiler(s)" --result "FOUND" --color RED
# /usr/bin/*cc*
# /usr/bin/*++*
# /usr/bin/ld
# (and 700 or 750 permissions)
fi
fi
#
#################################################################################
#
# Test : HRDN-7230
# Description : Check for installed malware scanners
Register --test-no HRDN-7230 --weight L --network NO --description "Check for malware scanner"
if [ ${SKIPTEST} -eq 0 ]; then
logtext "Test: Check if one or more compilers can be found on the system"
if [ ${MALWARE_SCANNER_INSTALLED} -eq 1 ]; then
logtext "Result: found at least one malware scanner"
Display --indent 4 --text "- Installed malware scanner" --result "FOUND" --color GREEN
AddHP 3 3
else
logtext "Result: no malware scanner found"
Display --indent 4 --text "- Installed malware scanner" --result "NOT FOUND" --color RED
ReportSuggestion ${TEST_NO} "Harden the system by installing at least one malware scanner, to perform periodic file system scans"
AddHP 1 3
fi
fi
#
#################################################################################
#
# logtext "--------------------------------------------------------------------"
# logtext "| System part | Preferred value | Actual value | Points |"
# logtext "| [!] Compiler installed | 0 | [${COMPILER_INSTALLED}] | x |"
# logtext "| [V] Malware scanner installed | 1 | [x] | x |"
# logtext "| [V] Packet filter enabled | 1 | [x] | x |"
# logtext "--------------------------------------------------------------------"
# logtext "| [!]: Hardening possible, [V]: Hardening performed, [ ]: Unknown "
# logtext "--------------------------------------------------------------------"
#
#################################################################################
#
report "compiler_installed=${COMPILER_INSTALLED}"
wait_for_keypress
#
#================================================================================
# Lynis - Copyright 2007-2015, Michael Boelen, CISOfy - https://cisofy.com
|