Sat, 18 Jul 2020 15:55:11 +0200
Version 0.23 some fixes for newer awk versions.
5 | 1 | #!/bin/bash |
2 | # | |
3 | ############################################################################# | |
17
65656789da08
Removed uptime script, changed passwd test, minimized sensors output, bumped to version 0.18
Michiel Broek <mbroek@mbse.eu>
parents:
14
diff
changeset
|
4 | # Copyright (C) 2005-2013 |
5 | 5 | # |
17
65656789da08
Removed uptime script, changed passwd test, minimized sensors output, bumped to version 0.18
Michiel Broek <mbroek@mbse.eu>
parents:
14
diff
changeset
|
6 | # Michiel Broek <mbse at mbse.eu> |
5 | 7 | # |
14
59e07bba67cc
Fixed spelling error, updated address
Michiel Broek <mbse@mbse.eu>
parents:
5
diff
changeset
|
8 | # This file is part of SlackSecCheckScripts. |
5 | 9 | # |
10 | # This package is free software; you can redistribute it and/or modify it | |
11 | # under the terms of the GNU General Public License as published by the | |
12 | # Free Software Foundation; either version 2, or (at your option) any | |
13 | # later version. | |
14 | # | |
14
59e07bba67cc
Fixed spelling error, updated address
Michiel Broek <mbse@mbse.eu>
parents:
5
diff
changeset
|
15 | # SlackSecCheckScripts is distributed in the hope that it will be useful, but |
5 | 16 | # WITHOUT ANY WARRANTY; without even the implied warranty of |
17 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
18 | # General Public License for more details. | |
19 | # | |
20 | # You should have received a copy of the GNU General Public License | |
21 | # along with MBSE BBS; see the file COPYING. If not, write to the Free | |
22 | # Software Foundation, 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA. | |
23 | ############################################################################# | |
24 | ||
25 | ||
26 | PATH=/sbin:/usr/sbin:/bin:/usr/bin | |
27 | ||
28 | umask 077 | |
29 | TZ=UTC; export TZ | |
30 | LANG=C; export LANG | |
31 | ||
32 | SECUREDIR=`mktemp -d /tmp/_securedir.XXXXXX` || exit 1 | |
33 | ||
34 | trap "/bin/rm -rf $SECUREDIR ; exit 0" EXIT INT QUIT PIPE | |
35 | ||
36 | if ! cd "$SECUREDIR"; then | |
37 | echo "Can not cd to $SECUREDIR". | |
38 | exit 1 | |
39 | fi | |
40 | ||
41 | TMP1=secure1.$$ | |
42 | OUTPUT=secure2.$$ | |
43 | ||
44 | ||
45 | # Check for root paths, umask values in startup files. | |
46 | # The check for the root paths is problematical -- it's likely to fail | |
47 | # in other environments. Once the shells have been modified to warn | |
48 | # of '.' in the path, the path tests should go away. | |
49 | # | |
50 | rhome=~root | |
51 | umaskset=no | |
52 | ||
53 | if [ -x /bin/tcsh ]; then | |
54 | list="/etc/csh.cshrc /etc/csh.login ${rhome}/.cshrc ${rhome}/.login `/bin/ls /etc/profile.d/*.csh`" | |
55 | ||
56 | for i in $list ; do | |
57 | if [ -f $i ] ; then | |
58 | if egrep '^[^#]*(umask)' $i > /dev/null ; | |
59 | then | |
60 | umaskset=yes | |
61 | fi | |
62 | # Double check the umask value itself; ensure that | |
63 | # both the group and other write bits are set. | |
64 | # | |
65 | egrep '^[^#]*(umask)' $i | | |
66 | awk '{ | |
67 | if ($2 ~ /^.$/ || $2 ~! /[^2367].$/) { | |
68 | print "\tRoot umask is group writeable" | |
69 | } | |
70 | if ($2 ~ /[^2367]$/) { | |
71 | print "\tRoot umask is other writeable" | |
72 | } | |
73 | }' | sort -u | |
74 | SAVE_PATH=$PATH | |
75 | unset PATH | |
76 | /bin/csh -f -s << end-of-csh > /dev/null 2>&1 | |
77 | source $i | |
78 | /bin/ls -ldgT \$path > $TMP1 | |
79 | end-of-csh | |
80 | export PATH=$SAVE_PATH | |
81 | if [ -f $TMP1 ]; then | |
82 | awk '{ | |
83 | if ($10 ~ /^\.$/) { | |
84 | print "\tThe root path includes ."; | |
85 | next; | |
86 | } | |
87 | } | |
88 | $1 ~ /^d....w/ \ | |
89 | { print "\tRoot path directory " $10 " is group writeable." } \ | |
90 | $1 ~ /^d.......w/ \ | |
91 | { print "\tRoot path directory " $10 " is other writeable." }' \ | |
92 | < $TMP1 | |
93 | fi | |
94 | fi | |
95 | done > $OUTPUT | |
96 | ||
97 | if [ $umaskset = "no" -o -s $OUTPUT ] ; then | |
98 | printf "\nChecking root csh paths, umask values:\n$list\n\n" | |
99 | if [ -s $OUTPUT ]; then | |
100 | cat $OUTPUT | |
101 | fi | |
102 | if [ $umaskset = "no" ] ; then | |
103 | printf "\tRoot csh startup files do not set the umask.\n" | |
104 | fi | |
105 | fi | |
106 | fi | |
107 | ||
108 | umaskset=no | |
109 | list="/etc/profile ${rhome}/.profile `/bin/ls /etc/profile.d/*.sh`" | |
110 | for i in $list; do | |
111 | if [ -f $i ] ; then | |
112 | if egrep '^[^#]*(umask)' $i > /dev/null ; then | |
113 | umaskset=yes | |
114 | fi | |
115 | egrep '^[^#]*(umask)' $i | | |
116 | awk '$2 ~ /^.$/ || $2 ~ /[^2367].$/ \ | |
117 | { print "\tRoot umask is group writeable" } \ | |
118 | $2 ~ /[^2367]$/ \ | |
119 | { print "\tRoot umask is other writeable" }' | |
120 | SAVE_PATH=$PATH | |
121 | unset PATH | |
122 | /bin/sh << end-of-sh > /dev/null 2>&1 | |
123 | . $i | |
124 | list=\`echo \$PATH | /usr/bin/sed -e \ | |
125 | 's/^:/.:/;s/:$/:./;s/::/:.:/g;s/:/ /g'\` | |
126 | /bin/ls -ldgT \$list > $TMP1 | |
127 | end-of-sh | |
128 | export PATH=$SAVE_PATH | |
129 | awk '{ | |
130 | if ($10 ~ /^\.$/) { | |
131 | print "\tThe root path includes ."; | |
132 | next; | |
133 | } | |
134 | } | |
135 | $1 ~ /^d....w/ \ | |
136 | { print "\tRoot path directory " $10 " is group writeable." } \ | |
137 | $1 ~ /^d.......w/ \ | |
138 | { print "\tRoot path directory " $10 " is other writeable." }' \ | |
139 | < $TMP1 | |
140 | fi | |
141 | done > $OUTPUT | |
142 | ||
143 | if [ $umaskset = "no" -o -s $OUTPUT ] ; then | |
144 | printf "\nChecking root sh paths, umask values:\n$list\n" | |
145 | if [ -s $OUTPUT ]; then | |
146 | cat $OUTPUT | |
147 | fi | |
148 | if [ $umaskset = "no" ] ; then | |
149 | printf "\tRoot sh startup files do not set the umask.\n" | |
150 | fi | |
151 | fi | |
152 |