|
1 #!/bin/bash |
|
2 # |
|
3 # $Id$ |
|
4 # |
|
5 ############################################################################# |
|
6 # Copyright (C) 2005 |
|
7 # |
|
8 # Michiel Broek <mbse@mbse.dds.nl> |
|
9 # Beekmansbos 10 |
|
10 # 1971 BV IJmuiden |
|
11 # the Netherlands |
|
12 # |
|
13 # This file is part of SlackSecCheckSripts. |
|
14 # |
|
15 # This package is free software; you can redistribute it and/or modify it |
|
16 # under the terms of the GNU General Public License as published by the |
|
17 # Free Software Foundation; either version 2, or (at your option) any |
|
18 # later version. |
|
19 # |
|
20 # SlackSecCheckSripts is distributed in the hope that it will be useful, but |
|
21 # WITHOUT ANY WARRANTY; without even the implied warranty of |
|
22 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
|
23 # General Public License for more details. |
|
24 # |
|
25 # You should have received a copy of the GNU General Public License |
|
26 # along with MBSE BBS; see the file COPYING. If not, write to the Free |
|
27 # Software Foundation, 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA. |
|
28 ############################################################################# |
|
29 |
|
30 |
|
31 PATH=/sbin:/usr/sbin:/bin:/usr/bin |
|
32 |
|
33 umask 077 |
|
34 TZ=UTC; export TZ |
|
35 LANG=C; export LANG |
|
36 |
|
37 MP=/etc/passwd |
|
38 SP=/etc/shadow |
|
39 |
|
40 SECUREDIR=`mktemp -d /tmp/_securedir.XXXXXX` || exit 1 |
|
41 |
|
42 trap "/bin/rm -rf $SECUREDIR ; exit 0" EXIT INT QUIT PIPE |
|
43 |
|
44 if ! cd "$SECUREDIR"; then |
|
45 echo "Can not cd to $SECUREDIR". |
|
46 exit 1 |
|
47 fi |
|
48 |
|
49 MPBYPATH=secure1.$$ |
|
50 OUTPUT=secure2.$$ |
|
51 |
|
52 # These are used several times. |
|
53 # |
|
54 awk -F: '{ print $1 " " $6 }' $MP | sort -k2 > $MPBYPATH |
|
55 |
|
56 |
|
57 # Files that should not have + signs. |
|
58 # |
|
59 list="/etc/hosts.equiv /etc/hosts.lpd" |
|
60 for f in $list ; do |
|
61 if [ -f $f ] && egrep '\+' $f > /dev/null ; then |
|
62 printf "\nPlus sign in $f file.\n" |
|
63 fi |
|
64 done |
|
65 |
|
66 # Check for special users with .rhosts files. Only root and toor should |
|
67 # have .rhosts files. Also, .rhosts files should not have plus signs. |
|
68 awk -F: '$1 != "root" && $1 != "toor" && ($3 < 100 || $1 == "ftp" || $1 == "uucp") \ |
|
69 { print $1 " " $6 }' $MP | |
|
70 sort -k2 | |
|
71 while read uid homedir; do |
|
72 if [ -f ${homedir}/.rhosts ] ; then |
|
73 rhost=`/bin/ls -ldg ${homedir}/.rhosts` |
|
74 printf -- "$uid: $rhost\n" |
|
75 fi |
|
76 done > $OUTPUT |
|
77 if [ -s $OUTPUT ] ; then |
|
78 printf "\nChecking for special users with .rhosts files.\n" |
|
79 cat $OUTPUT |
|
80 fi |
|
81 while read uid homedir; do |
|
82 if [ -f ${homedir}/.rhosts -a -r ${homedir}/.rhosts ] && \ |
|
83 cat ${homedir}/.rhosts | egrep '\+' > /dev/null ; then |
|
84 printf -- "$uid: + in .rhosts file.\n" |
|
85 fi |
|
86 done < $MPBYPATH > $OUTPUT |
|
87 if [ -s $OUTPUT ] ; then |
|
88 printf "\nChecking .rhosts files syntax.\n" |
|
89 cat $OUTPUT |
|
90 fi |
|
91 |
|
92 |