security.d/chk_rootdotfiles

Sat, 31 Mar 2007 13:32:06 +0200

author
mbse
date
Sat, 31 Mar 2007 13:32:06 +0200
changeset 0
8ba6a0e2d2ca
child 14
59e07bba67cc
permissions
-rw-r--r--

Initial revision

0
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
1 #!/bin/bash
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
2 #
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
3 # $Id$
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
4 #
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
5 #############################################################################
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
6 # Copyright (C) 2005
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
7 #
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
8 # Michiel Broek <mbse@mbse.dds.nl>
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
9 # Beekmansbos 10
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
10 # 1971 BV IJmuiden
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
11 # the Netherlands
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
12 #
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
13 # This file is part of SlackSecCheckSripts.
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
14 #
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
15 # This package is free software; you can redistribute it and/or modify it
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
16 # under the terms of the GNU General Public License as published by the
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
17 # Free Software Foundation; either version 2, or (at your option) any
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
18 # later version.
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
19 #
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
20 # SlackSecCheckSripts is distributed in the hope that it will be useful, but
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
21 # WITHOUT ANY WARRANTY; without even the implied warranty of
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
22 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
23 # General Public License for more details.
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
24 #
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
25 # You should have received a copy of the GNU General Public License
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
26 # along with MBSE BBS; see the file COPYING. If not, write to the Free
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
27 # Software Foundation, 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
28 #############################################################################
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
29
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
30
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
31 PATH=/sbin:/usr/sbin:/bin:/usr/bin
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
32
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
33 umask 077
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
34 TZ=UTC; export TZ
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
35 LANG=C; export LANG
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
36
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
37 SECUREDIR=`mktemp -d /tmp/_securedir.XXXXXX` || exit 1
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
38
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
39 trap "/bin/rm -rf $SECUREDIR ; exit 0" EXIT INT QUIT PIPE
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
40
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
41 if ! cd "$SECUREDIR"; then
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
42 echo "Can not cd to $SECUREDIR".
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
43 exit 1
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
44 fi
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
45
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
46 TMP1=secure1.$$
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
47 OUTPUT=secure2.$$
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
48
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
49
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
50 # Check for root paths, umask values in startup files.
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
51 # The check for the root paths is problematical -- it's likely to fail
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
52 # in other environments. Once the shells have been modified to warn
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
53 # of '.' in the path, the path tests should go away.
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
54 #
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
55 rhome=~root
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
56 umaskset=no
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
57
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
58 if [ -x /bin/tcsh ]; then
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
59 list="/etc/csh.cshrc /etc/csh.login ${rhome}/.cshrc ${rhome}/.login `/bin/ls /etc/profile.d/*.csh`"
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
60
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
61 for i in $list ; do
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
62 if [ -f $i ] ; then
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
63 if egrep '^[^#]*(umask)' $i > /dev/null ;
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
64 then
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
65 umaskset=yes
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
66 fi
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
67 # Double check the umask value itself; ensure that
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
68 # both the group and other write bits are set.
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
69 #
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
70 egrep '^[^#]*(umask)' $i |
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
71 awk '{
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
72 if ($2 ~ /^.$/ || $2 ~! /[^2367].$/) {
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
73 print "\tRoot umask is group writeable"
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
74 }
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
75 if ($2 ~ /[^2367]$/) {
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
76 print "\tRoot umask is other writeable"
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
77 }
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
78 }' | sort -u
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
79 SAVE_PATH=$PATH
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
80 unset PATH
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
81 /bin/csh -f -s << end-of-csh > /dev/null 2>&1
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
82 source $i
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
83 /bin/ls -ldgT \$path > $TMP1
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
84 end-of-csh
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
85 export PATH=$SAVE_PATH
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
86 if [ -f $TMP1 ]; then
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
87 awk '{
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
88 if ($10 ~ /^\.$/) {
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
89 print "\tThe root path includes .";
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
90 next;
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
91 }
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
92 }
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
93 $1 ~ /^d....w/ \
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
94 { print "\tRoot path directory " $10 " is group writeable." } \
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
95 $1 ~ /^d.......w/ \
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
96 { print "\tRoot path directory " $10 " is other writeable." }' \
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
97 < $TMP1
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
98 fi
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
99 fi
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
100 done > $OUTPUT
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
101
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
102 if [ $umaskset = "no" -o -s $OUTPUT ] ; then
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
103 printf "\nChecking root csh paths, umask values:\n$list\n\n"
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
104 if [ -s $OUTPUT ]; then
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
105 cat $OUTPUT
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
106 fi
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
107 if [ $umaskset = "no" ] ; then
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
108 printf "\tRoot csh startup files do not set the umask.\n"
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
109 fi
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
110 fi
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
111 fi
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
112
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
113 umaskset=no
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
114 list="/etc/profile ${rhome}/.profile `/bin/ls /etc/profile.d/*.sh`"
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
115 for i in $list; do
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
116 if [ -f $i ] ; then
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
117 if egrep '^[^#]*(umask)' $i > /dev/null ; then
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
118 umaskset=yes
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
119 fi
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
120 egrep '^[^#]*(umask)' $i |
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
121 awk '$2 ~ /^.$/ || $2 ~ /[^2367].$/ \
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
122 { print "\tRoot umask is group writeable" } \
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
123 $2 ~ /[^2367]$/ \
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
124 { print "\tRoot umask is other writeable" }'
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
125 SAVE_PATH=$PATH
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
126 unset PATH
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
127 /bin/sh << end-of-sh > /dev/null 2>&1
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
128 . $i
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
129 list=\`echo \$PATH | /usr/bin/sed -e \
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
130 's/^:/.:/;s/:$/:./;s/::/:.:/g;s/:/ /g'\`
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
131 /bin/ls -ldgT \$list > $TMP1
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
132 end-of-sh
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
133 export PATH=$SAVE_PATH
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
134 awk '{
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
135 if ($10 ~ /^\.$/) {
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
136 print "\tThe root path includes .";
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
137 next;
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
138 }
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
139 }
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
140 $1 ~ /^d....w/ \
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
141 { print "\tRoot path directory " $10 " is group writeable." } \
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
142 $1 ~ /^d.......w/ \
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
143 { print "\tRoot path directory " $10 " is other writeable." }' \
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
144 < $TMP1
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
145 fi
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
146 done > $OUTPUT
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
147
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
148 if [ $umaskset = "no" -o -s $OUTPUT ] ; then
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
149 printf "\nChecking root sh paths, umask values:\n$list\n"
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
150 if [ -s $OUTPUT ]; then
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
151 cat $OUTPUT
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
152 fi
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
153 if [ $umaskset = "no" ] ; then
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
154 printf "\tRoot sh startup files do not set the umask.\n"
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
155 fi
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
156 fi
8ba6a0e2d2ca Initial revision
mbse
parents:
diff changeset
157

mercurial