security.d/chk_plussigns

#!/bin/bash
#
#############################################################################
# Copyright (C) 2005-2013
#   
# Michiel Broek               <mbse at mbse.eu>
#
# This file is part of SlackSecCheckScripts.
#
# This package is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2, or (at your option) any
# later version.
#
# SlackSecCheckScripts is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
# General Public License for more details.
# 
# You should have received a copy of the GNU General Public License
# along with MBSE BBS; see the file COPYING.  If not, write to the Free
# Software Foundation, 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
#############################################################################


PATH=/sbin:/usr/sbin:/bin:/usr/bin

umask 077
TZ=UTC; export TZ
LANG=C; export LANG

MP=/etc/passwd
SP=/etc/shadow

SECUREDIR=`mktemp -d /tmp/_securedir.XXXXXX` || exit 1

trap "/bin/rm -rf $SECUREDIR ; exit 0" EXIT INT QUIT PIPE

if ! cd "$SECUREDIR"; then
        echo "Can not cd to $SECUREDIR".
        exit 1
fi

MPBYPATH=secure1.$$
OUTPUT=secure2.$$

# These are used several times.
#
awk -F: '{ print $1 " " $6 }' $MP | sort -k2 > $MPBYPATH


# Files that should not have + signs.
#
list="/etc/hosts.equiv /etc/hosts.lpd"
for f in $list ; do
    if [ -f $f ] && egrep '\+' $f > /dev/null ; then
	printf "\nPlus sign in $f file.\n"
    fi
done

# Check for special users with .rhosts files.  Only root and toor should
# have .rhosts files.  Also, .rhosts files should not have plus signs.
awk -F: '$1 != "root" && $1 != "toor" && ($3 < 100 || $1 == "ftp" || $1 == "uucp") \
    { print $1 " " $6 }' $MP |
    sort -k2 |
    while read uid homedir; do
	if [ -f ${homedir}/.rhosts ] ; then
	    rhost=`/bin/ls -ldg ${homedir}/.rhosts`
	    printf -- "$uid: $rhost\n"
	fi
    done > $OUTPUT
if [ -s $OUTPUT ] ; then
    printf "\nChecking for special users with .rhosts files.\n"
    cat $OUTPUT
fi
while read uid homedir; do
    if [ -f ${homedir}/.rhosts -a -r ${homedir}/.rhosts ] && \
	cat ${homedir}/.rhosts | egrep '\+' > /dev/null ; then
	printf -- "$uid: + in .rhosts file.\n"
    fi
done < $MPBYPATH > $OUTPUT
if [ -s $OUTPUT ] ; then
    printf "\nChecking .rhosts files syntax.\n"
    cat $OUTPUT
fi