security.d/chk_passwd

Fri, 26 Dec 2014 11:43:45 +0100

author
Michiel Broek <mbroek@mbse.eu>
date
Fri, 26 Dec 2014 11:43:45 +0100
changeset 22
32af3eef438b
parent 17
65656789da08
child 23
b66522a5726e
permissions
-rw-r--r--

Added a Makefile, version 0.22

5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
1 #!/bin/bash
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
2 #
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
3 #############################################################################
17
65656789da08 Removed uptime script, changed passwd test, minimized sensors output, bumped to version 0.18
Michiel Broek <mbroek@mbse.eu>
parents: 14
diff changeset
4 # Copyright (C) 2005-2013
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
5 #
17
65656789da08 Removed uptime script, changed passwd test, minimized sensors output, bumped to version 0.18
Michiel Broek <mbroek@mbse.eu>
parents: 14
diff changeset
6 # Michiel Broek <mbse at mbse.eu>
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
7 #
14
59e07bba67cc Fixed spelling error, updated address
Michiel Broek <mbse@mbse.eu>
parents: 13
diff changeset
8 # This file is part of SlackSecCheckScripts.
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
9 #
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
10 # This package is free software; you can redistribute it and/or modify it
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
11 # under the terms of the GNU General Public License as published by the
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
12 # Free Software Foundation; either version 2, or (at your option) any
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
13 # later version.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
14 #
14
59e07bba67cc Fixed spelling error, updated address
Michiel Broek <mbse@mbse.eu>
parents: 13
diff changeset
15 # SlackSecCheckScripts is distributed in the hope that it will be useful, but
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
16 # WITHOUT ANY WARRANTY; without even the implied warranty of
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
17 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
18 # General Public License for more details.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
19 #
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
20 # You should have received a copy of the GNU General Public License
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
21 # along with MBSE BBS; see the file COPYING. If not, write to the Free
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
22 # Software Foundation, 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
23 #############################################################################
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
24
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
25
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
26 PATH=/sbin:/usr/sbin:/bin:/usr/bin
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
27
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
28 umask 077
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
29 TZ=UTC; export TZ
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
30 LANG=C; export LANG
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
31
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
32 max_loginlen=${max_loginlen:-32}
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
33
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
34 MP=/etc/passwd
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
35 SP=/etc/shadow
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
36
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
37
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
38 SECUREDIR=`mktemp -d /tmp/_securedir.XXXXXX` || exit 1
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
39
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
40 trap "/bin/rm -rf $SECUREDIR ; exit 0" EXIT INT QUIT PIPE
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
41
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
42 if ! cd "$SECUREDIR"; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
43 echo "Can not cd to $SECUREDIR".
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
44 exit 1
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
45 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
46
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
47 TMP2=secure1.$$
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
48 MPBYUID=secure2.$$
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
49 COMBINED=secure3.$$
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
50 OUTPUT=secure4.$$
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
51
9
3b982acb3d07 Options check for join
Michiel Broek <mbroek@mbse.eu>
parents: 7
diff changeset
52
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
53 # Combine passwd and shadow files.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
54 #
9
3b982acb3d07 Options check for join
Michiel Broek <mbroek@mbse.eu>
parents: 7
diff changeset
55 JOPT=$( join --help | grep "\--nocheck-order")
3b982acb3d07 Options check for join
Michiel Broek <mbroek@mbse.eu>
parents: 7
diff changeset
56 if [ -z "$JOPT" ]; then
3b982acb3d07 Options check for join
Michiel Broek <mbroek@mbse.eu>
parents: 7
diff changeset
57 join -t : -j 1 $MP $SP > $COMBINED
3b982acb3d07 Options check for join
Michiel Broek <mbroek@mbse.eu>
parents: 7
diff changeset
58 else
3b982acb3d07 Options check for join
Michiel Broek <mbroek@mbse.eu>
parents: 7
diff changeset
59 join --nocheck-order -t : -j 1 $MP $SP > $COMBINED
3b982acb3d07 Options check for join
Michiel Broek <mbroek@mbse.eu>
parents: 7
diff changeset
60 fi
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
61
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
62
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
63 # These are used several times.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
64 #
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
65 awk -F: '!/^+/ { print $1 " " $3 }' $MP | sort -k2n > $MPBYUID
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
66
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
67
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
68 # Check the master password file syntax.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
69 # Usernames may have a $ character at the end for Samba
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
70 # machine and trust accounts.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
71 #
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
72 awk -v "len=$max_loginlen" '
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
73 BEGIN {
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
74 while ( getline < "/etc/shells" > 0 ) {
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
75 if ($0 ~ /^\#/ || $0 ~ /^$/ )
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
76 continue;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
77 shells[$1]++;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
78 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
79 FS=":";
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
80 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
81
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
82 {
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
83 if ($0 ~ /^[ ]*$/) {
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
84 printf "\tLine %d is a blank line.\n", NR;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
85 next;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
86 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
87 if (NF != 15 && ($1 != "+" || NF != 1))
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
88 printf "\tLine %d has the wrong number of fields.\n", NR;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
89 if ($1 == "+" ) {
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
90 if (NF != 1 && $3 == 0)
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
91 printf "\tLine %d includes entries with uid 0.\n", NR;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
92 next;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
93 }
13
cc078ac2fddd Allow underscore in account names
root@seaport.mbse.ym
parents: 9
diff changeset
94 if ($1 !~ /^[A-Za-z0-9]([-A-Za-z0-9_]*[A-Za-z0-9\$])*$/)
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
95 printf "\tLogin %s has non-alphanumeric characters.\n", $1;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
96 if (length($1) > len)
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
97 printf "\tLogin %s has more than "len" characters.\n", $1;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
98 if ($7 == "" && $8 !~ /!/ && $8 != "*")
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
99 printf "\tLogin %s does not have a shell\n", $1;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
100 if ($7 != "" && ! shells[$7] && $8 !~ /!/ && $8 != "*")
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
101 printf "\tLogin %s does not have a valid shell (%s)\n", $1, $7;
17
65656789da08 Removed uptime script, changed passwd test, minimized sensors output, bumped to version 0.18
Michiel Broek <mbroek@mbse.eu>
parents: 14
diff changeset
102 if ($7 != "" && shells[$7] && ($8 ~ /!/ && $8 = "*") && ($4 == 100))
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
103 printf "\tLogin %s account is locked.\n", $1;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
104 if ($8 == "")
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
105 printf "\tLogin %s has no password.\n", $1;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
106 if ($9 == "0")
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
107 printf "\tLogin %s password is expired.\n", $1;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
108 if ($3 == 0 && $1 != "root" && $1 != "toor")
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
109 printf "\tLogin %s has a user id of 0.\n", $1;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
110 if ($3 < 0)
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
111 printf "\tLogin %s has a negative user id.\n", $1;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
112 if ($4 < 0)
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
113 printf "\tLogin %s has a negative group id.\n", $1;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
114 }' < $COMBINED > $OUTPUT
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
115 if [ -s $OUTPUT ] ; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
116 printf "\nChecking the $MP and $SP files:\n"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
117 cat $OUTPUT
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
118 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
119
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
120 awk -F: '{ print $1 }' $MP | sort | uniq -d > $OUTPUT
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
121 if [ -s $OUTPUT ] ; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
122 printf "\n$MP has duplicate user names.\n"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
123 column $OUTPUT
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
124 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
125
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
126 # To not exclude 'toor', a standard duplicate root account, from the duplicate
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
127 # account test, uncomment the line below (without egrep in it)and comment
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
128 # out the line (with egrep in it) below it.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
129 #
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
130 #< $MPBYUID uniq -d -f 1 | awk '{ print $2 }' > $TMP2
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
131 < $MPBYUID egrep -v '^toor ' | uniq -d -f 1 | awk '{ print $2 }' > $TMP2
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
132 if [ -s $TMP2 ] ; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
133 printf "\n$MP has duplicate user id's.\n"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
134 while read uid; do
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
135 grep -w $uid $MPBYUID
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
136 done < $TMP2 | column
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
137 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
138
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
139

mercurial