security.d/chk_homedirs

Mon, 20 Jan 2014 12:48:38 +0100

author
Michiel Broek <mbroek@mbse.eu>
date
Mon, 20 Jan 2014 12:48:38 +0100
changeset 19
2c0dacb26b14
parent 17
65656789da08
permissions
-rw-r--r--

Fixed error message when there was nothing to report.

5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
1 #!/bin/bash
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
2 #
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
3 #############################################################################
17
65656789da08 Removed uptime script, changed passwd test, minimized sensors output, bumped to version 0.18
Michiel Broek <mbroek@mbse.eu>
parents: 14
diff changeset
4 # Copyright (C) 2005-2013
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
5 #
17
65656789da08 Removed uptime script, changed passwd test, minimized sensors output, bumped to version 0.18
Michiel Broek <mbroek@mbse.eu>
parents: 14
diff changeset
6 # Michiel Broek <mbse at mbse.eu>
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
7 #
14
59e07bba67cc Fixed spelling error, updated address
Michiel Broek <mbse@mbse.eu>
parents: 8
diff changeset
8 # This file is part of SlackSecCheckScripts.
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
9 #
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
10 # This package is free software; you can redistribute it and/or modify it
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
11 # under the terms of the GNU General Public License as published by the
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
12 # Free Software Foundation; either version 2, or (at your option) any
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
13 # later version.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
14 #
14
59e07bba67cc Fixed spelling error, updated address
Michiel Broek <mbse@mbse.eu>
parents: 8
diff changeset
15 # SlackSecCheckScripts is distributed in the hope that it will be useful, but
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
16 # WITHOUT ANY WARRANTY; without even the implied warranty of
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
17 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
18 # General Public License for more details.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
19 #
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
20 # You should have received a copy of the GNU General Public License
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
21 # along with MBSE BBS; see the file COPYING. If not, write to the Free
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
22 # Software Foundation, 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
23 #############################################################################
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
24
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
25
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
26 PATH=/sbin:/usr/sbin:/bin:/usr/bin
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
27
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
28 umask 077
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
29 TZ=UTC; export TZ
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
30 MP=/etc/passwd
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
31 LANG=C; export LANG
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
32
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
33 SECUREDIR=`mktemp -d /tmp/_securedir.XXXXXX` || exit 1
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
34
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
35 trap "/bin/rm -rf $SECUREDIR ; exit 0" EXIT INT QUIT PIPE
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
36
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
37 if ! cd "$SECUREDIR"; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
38 echo "Can not cd to $SECUREDIR".
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
39 exit 1
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
40 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
41
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
42 MPBYPATH=secure1.$$
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
43 OUTPUT=secure2.$$
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
44
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
45
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
46 # These are used several times.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
47 #
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
48 awk -F: '{ print $1 " " $6 }' $MP | sort -k2 > $MPBYPATH
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
49
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
50
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
51 # Check home directories. Directories should not be owned by someone else
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
52 # or writeable.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
53 #
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
54 while read uid homedir; do
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
55 if [ -d ${homedir}/ ] ; then
8
5209729bbbac Fix for symliked home directories
Michiel Broek <mbroek@mbse.eu>
parents: 5
diff changeset
56 file=`/bin/ls -ld ${homedir}/`
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
57 printf -- "$uid $file\n"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
58 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
59 done < $MPBYPATH |
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
60 awk '$1 != $4 && $4 != "root" { printf "\tuser %s home directory is owned by %s.\n", $1, $4 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
61 $2 ~ /^.....w/ { printf "\tuser %s home directory %s is group writeable.\n", $1, $10 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
62 $2 ~ /^........w/ { printf "\tuser %s home directory %s is other writeable.\n", $1, $10 }' \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
63 > $OUTPUT
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
64 if [ -s $OUTPUT ] ; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
65 printf "\nChecking home directories.\n"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
66 cat $OUTPUT
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
67 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
68
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
69 # Files that should not be owned by someone else or readable.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
70 list=".Xauthority .netrc .ssh/id_dsa .ssh/id_rsa .ssh/identity"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
71 while read uid homedir; do
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
72 for f in $list ; do
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
73 file=${homedir}/${f}
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
74 if [ -f $file ] ; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
75 printf -- "$uid $f `/bin/ls -ld $file`\n"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
76 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
77 done
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
78 done < $MPBYPATH |
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
79 awk '$1 != $5 && $5 != "root" { printf "\tuser %s %s file is owned by %s.\n", $1, $2, $5 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
80 $3 ~ /^....r/ { printf "\tuser %s %s file is group readable.\n", $1, $2 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
81 $3 ~ /^.......r/ { printf "\tuser %s %s file is other readable.\n", $1, $2 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
82 $3 ~ /^.....w/ { printf "\tuser %s %s file is group writeable.\n", $1, $2 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
83 $3 ~ /^........w/ { printf "\tuser %s %s file is other writeable.\n", $1, $2 }' \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
84 > $OUTPUT
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
85 # Files that should not be owned by someone else or writeable.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
86 list=".bash_history .bash_login .bash_logout .bash_profile .bashrc \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
87 .cshrc .emacs .exrc .forward .history .klogin .login .logout \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
88 .profile .qmail .rc_history .rhosts .shosts ssh .tcshrc .twmrc \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
89 .xinitrc .xsession .ssh/authorized_keys .ssh/authorized_keys2 \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
90 .ssh/config .ssh/id_dsa.pub .ssh/id_rsa.pub .ssh/identity.pub \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
91 .ssh/known_hosts .ssh/known_hosts2"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
92 while read uid homedir; do
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
93 for f in $list ; do
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
94 file=${homedir}/${f}
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
95 if [ -f $file ] ; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
96 printf -- "$uid $f `/bin/ls -ld $file`\n"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
97 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
98 done
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
99 done < $MPBYPATH |
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
100 awk '$1 != $5 && $5 != "root" { printf "\tuser %s %s file is owned by %s.\n", $1, $2, $5 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
101 $3 ~ /^.....w/ { printf "\tuser %s %s file is group writeable.\n", $1, $2 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
102 $3 ~ /^........w/ { printf "\tuser %s %s file is other writeable.\n", $1, $2 }' \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
103 >> $OUTPUT
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
104 if [ -s $OUTPUT ] ; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
105 printf "\nChecking dot files.\n"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
106 cat $OUTPUT
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
107 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
108
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
109

mercurial