security.d/chk_rootdotfiles

Fri, 26 Dec 2014 10:56:38 +0100

author
Michiel Broek <mbroek@mbse.eu>
date
Fri, 26 Dec 2014 10:56:38 +0100
changeset 21
735fe1b89e5a
parent 17
65656789da08
permissions
-rw-r--r--

Fixed wrong changes display when no real files were different

5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
1 #!/bin/bash
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
2 #
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
3 #############################################################################
17
65656789da08 Removed uptime script, changed passwd test, minimized sensors output, bumped to version 0.18
Michiel Broek <mbroek@mbse.eu>
parents: 14
diff changeset
4 # Copyright (C) 2005-2013
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
5 #
17
65656789da08 Removed uptime script, changed passwd test, minimized sensors output, bumped to version 0.18
Michiel Broek <mbroek@mbse.eu>
parents: 14
diff changeset
6 # Michiel Broek <mbse at mbse.eu>
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
7 #
14
59e07bba67cc Fixed spelling error, updated address
Michiel Broek <mbse@mbse.eu>
parents: 5
diff changeset
8 # This file is part of SlackSecCheckScripts.
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
9 #
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
10 # This package is free software; you can redistribute it and/or modify it
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
11 # under the terms of the GNU General Public License as published by the
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
12 # Free Software Foundation; either version 2, or (at your option) any
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
13 # later version.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
14 #
14
59e07bba67cc Fixed spelling error, updated address
Michiel Broek <mbse@mbse.eu>
parents: 5
diff changeset
15 # SlackSecCheckScripts is distributed in the hope that it will be useful, but
5
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
16 # WITHOUT ANY WARRANTY; without even the implied warranty of
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
17 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
18 # General Public License for more details.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
19 #
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
20 # You should have received a copy of the GNU General Public License
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
21 # along with MBSE BBS; see the file COPYING. If not, write to the Free
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
22 # Software Foundation, 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
23 #############################################################################
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
24
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
25
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
26 PATH=/sbin:/usr/sbin:/bin:/usr/bin
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
27
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
28 umask 077
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
29 TZ=UTC; export TZ
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
30 LANG=C; export LANG
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
31
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
32 SECUREDIR=`mktemp -d /tmp/_securedir.XXXXXX` || exit 1
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
33
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
34 trap "/bin/rm -rf $SECUREDIR ; exit 0" EXIT INT QUIT PIPE
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
35
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
36 if ! cd "$SECUREDIR"; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
37 echo "Can not cd to $SECUREDIR".
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
38 exit 1
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
39 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
40
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
41 TMP1=secure1.$$
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
42 OUTPUT=secure2.$$
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
43
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
44
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
45 # Check for root paths, umask values in startup files.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
46 # The check for the root paths is problematical -- it's likely to fail
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
47 # in other environments. Once the shells have been modified to warn
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
48 # of '.' in the path, the path tests should go away.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
49 #
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
50 rhome=~root
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
51 umaskset=no
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
52
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
53 if [ -x /bin/tcsh ]; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
54 list="/etc/csh.cshrc /etc/csh.login ${rhome}/.cshrc ${rhome}/.login `/bin/ls /etc/profile.d/*.csh`"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
55
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
56 for i in $list ; do
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
57 if [ -f $i ] ; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
58 if egrep '^[^#]*(umask)' $i > /dev/null ;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
59 then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
60 umaskset=yes
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
61 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
62 # Double check the umask value itself; ensure that
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
63 # both the group and other write bits are set.
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
64 #
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
65 egrep '^[^#]*(umask)' $i |
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
66 awk '{
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
67 if ($2 ~ /^.$/ || $2 ~! /[^2367].$/) {
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
68 print "\tRoot umask is group writeable"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
69 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
70 if ($2 ~ /[^2367]$/) {
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
71 print "\tRoot umask is other writeable"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
72 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
73 }' | sort -u
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
74 SAVE_PATH=$PATH
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
75 unset PATH
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
76 /bin/csh -f -s << end-of-csh > /dev/null 2>&1
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
77 source $i
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
78 /bin/ls -ldgT \$path > $TMP1
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
79 end-of-csh
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
80 export PATH=$SAVE_PATH
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
81 if [ -f $TMP1 ]; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
82 awk '{
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
83 if ($10 ~ /^\.$/) {
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
84 print "\tThe root path includes .";
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
85 next;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
86 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
87 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
88 $1 ~ /^d....w/ \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
89 { print "\tRoot path directory " $10 " is group writeable." } \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
90 $1 ~ /^d.......w/ \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
91 { print "\tRoot path directory " $10 " is other writeable." }' \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
92 < $TMP1
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
93 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
94 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
95 done > $OUTPUT
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
96
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
97 if [ $umaskset = "no" -o -s $OUTPUT ] ; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
98 printf "\nChecking root csh paths, umask values:\n$list\n\n"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
99 if [ -s $OUTPUT ]; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
100 cat $OUTPUT
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
101 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
102 if [ $umaskset = "no" ] ; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
103 printf "\tRoot csh startup files do not set the umask.\n"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
104 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
105 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
106 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
107
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
108 umaskset=no
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
109 list="/etc/profile ${rhome}/.profile `/bin/ls /etc/profile.d/*.sh`"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
110 for i in $list; do
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
111 if [ -f $i ] ; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
112 if egrep '^[^#]*(umask)' $i > /dev/null ; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
113 umaskset=yes
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
114 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
115 egrep '^[^#]*(umask)' $i |
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
116 awk '$2 ~ /^.$/ || $2 ~ /[^2367].$/ \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
117 { print "\tRoot umask is group writeable" } \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
118 $2 ~ /[^2367]$/ \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
119 { print "\tRoot umask is other writeable" }'
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
120 SAVE_PATH=$PATH
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
121 unset PATH
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
122 /bin/sh << end-of-sh > /dev/null 2>&1
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
123 . $i
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
124 list=\`echo \$PATH | /usr/bin/sed -e \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
125 's/^:/.:/;s/:$/:./;s/::/:.:/g;s/:/ /g'\`
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
126 /bin/ls -ldgT \$list > $TMP1
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
127 end-of-sh
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
128 export PATH=$SAVE_PATH
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
129 awk '{
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
130 if ($10 ~ /^\.$/) {
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
131 print "\tThe root path includes .";
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
132 next;
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
133 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
134 }
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
135 $1 ~ /^d....w/ \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
136 { print "\tRoot path directory " $10 " is group writeable." } \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
137 $1 ~ /^d.......w/ \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
138 { print "\tRoot path directory " $10 " is other writeable." }' \
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
139 < $TMP1
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
140 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
141 done > $OUTPUT
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
142
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
143 if [ $umaskset = "no" -o -s $OUTPUT ] ; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
144 printf "\nChecking root sh paths, umask values:\n$list\n"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
145 if [ -s $OUTPUT ]; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
146 cat $OUTPUT
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
147 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
148 if [ $umaskset = "no" ] ; then
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
149 printf "\tRoot sh startup files do not set the umask.\n"
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
150 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
151 fi
fe3130d22800 Conversion from CVS
Mercurial Repos
parents:
diff changeset
152

mercurial