*** empty log message ***

1 files changed, 279 insertions, 0 deletions

diff --git a/cron-sh/security_check.sh b/cron-sh/security_check.sh
new file mode 100755
index 0000000..5dffc48
--- /dev/null
+++ b/cron-sh/security_check.sh
@@ -0,0 +1,279 @@
+#!/bin/bash
+
+#
+# Basic security checking for suid files.
+# Written by Vandoorselaere Yoann, <yoann@mandrakesoft.com>
+#
+
+if [ -f /etc/security/msec/security.conf ]; then
+    . /etc/security/msec/security.conf
+else
+    exit 1
+fi
+
+if [ SECURITY_CHECK == "no" ]; then
+    exit 0
+fi
+
+SECURITY_LOG="/tmp/secure.log"
+SECURITY="/var/log/security.log"
+TMP="/tmp/secure.tmp"
+
+if [ ! -d /var/log/security ]; then
+    mkdir /var/log/security
+fi
+
+chattr -a /var/log/security/ >& /dev/null
+chattr -a /var/log/security/* >& /dev/null
+rm -f ${SECURITY_LOG} ${TMP} >& /dev/null
+
+### Functions ###
+
+Syslog() {
+    if [ $SYS_LOG=="yes" ]; then
+	cat ${1} | while read line; do
+	    /sbin/initlog --string="${line}"
+	done
+    fi
+}
+
+Ttylog() {
+	if [ $TTY_LOG=="yes" ]; then
+		for i in `w | grep -v "load\|TTY" | awk '{print $2}'` ; do
+			echo -e "$1" > /dev/$i
+		done
+	fi
+}
+
+### Writeable file detection
+if [ ${CHECK_WRITEABLE}=="yes" ]; then
+    find ${DIR} -xdev -type f -perm -2 -ls -print | awk '{print $11}' | sort > ${TMP}
+
+    if [ -s ${TMP} ]; then
+	printf "\nSecurity Warning: World Writeable Files found :\n" >> ${SECURITY_LOG}
+	cat ${TMP} >> ${SECURITY_LOG}
+    fi
+fi
+
+### Search Un Owned file
+if [ ${CHECK_UNOWNED}=="yes" ]; then
+    find ${DIR} -xdev -nouser -print -ls | awk '{print $11}' | sort > ${TMP}
+    if [ -s ${TMP} ]; then
+	printf "\nSecurity Warning : the following file aren't owned by any user :\n" >> ${SECURITY_LOG}
+	printf "\ttheses files now have user \"nobody\" as their owner." >> ${SECURE_LOG}
+	cat ${TMP} >> ${SECURITY_LOG}
+        cat ${TMP} | while read line; do chown nobody ${line}; done	
+    fi
+
+    find $DIR -xdev -nogroup -print -ls | awk '{print $11}' | sort > ${TMP}
+    if [ -s ${TMP} ]; then
+	printf "\nSecurity Warning : the following file aren't owned by any group :\n" >> ${SECURITY_LOG}
+        printf "\ttheses files now have group \"nogroup\" as their group owner." >> ${SECURITY_LOG}
+	cat ${TMP} >> ${SECURITY_LOG}
+	cat ${TMP} | while read line; do chgrp nogroup ${line}; done
+    fi
+fi
+
+if [ ${CHECK_PERMISSIONS}=="yes" ]; then
+# Files that should not be owned by someone else or readable.
+list=".netrc .rhosts .shosts .Xauthority .pgp/secring.pgp .ssh/identity .ssh/random_seed"
+awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \
+while read uid homedir; do
+        for f in ${list} ; do
+                file="${homedir}/${f}"
+                if [ -f ${file} ] ; then
+                        printf "${uid} ${f} `ls -ldcg ${file}`\n"
+                fi
+        done
+done | awk '$1 != $5 && $5 != "root" \
+        { print "\t\tuser=" $1 ", file=" $2 " : file is owned by " $5 }
+     $3 ~ /^-...r/ \
+        { print "\t\tuser=" $1 ", file=" $2 " : file is group readable" }
+     $3 ~ /^-......r/ \
+        { print "\t\tuser=" $1 ", file=" $2 " : file is other readable" }
+     $3 ~ /^-....w/ \
+        { print "\t\tuser=" $1 ", file=" $2 " : file is group writeable" }
+     $3 ~ /^-.......w/ \
+        { print "\t\tuser=" $1 ", file=" $2 " : file is other writeable" }' > ${TMP}
+
+if [ -s ${TMP} ]; then
+    printf "\nSecurity Warning: these files shouldn't be owned by someone else or readable :\n" >> ${SECURITY_LOG}
+    cat ${TMP} >> ${SECURITY_LOG}
+fi
+
+
+### Files that should not be owned by someone else or writeable.
+list=".bashrc .bash_profile .bash_login .bash_logout .cshrc .emacs .exrc \
+.forward .klogin .login .logout .profile .tcshrc .fvwmrc .inputrc .kshrc \
+.nexrc .screenrc .ssh .ssh/config .ssh/authorized_keys .ssh/environment \
+.ssh/known_hosts .ssh/rc .twmrc .xsession .xinitrc .Xdefaults"
+awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \
+while read uid homedir; do
+        for f in ${list} ; do
+                file="${homedir}/${f}"
+                if [ -f $file ] ; then
+                        printf "$uid ${f} `ls -ldcg ${file}`\n"
+                fi
+        done
+done | awk '$1 != $5 && $5 != "root" \
+        { print "\t\t- user=" $1 ", file=" $2 " : file is owned by " $5 }
+     $3 ~ /^-....w/ \
+        { print "\t\t- user=" $1 ", file=" $2 " : file is group writeable" }
+     $3 ~ /^-.......w/ \
+        { print "\t\t- user=" $1 ", file=" $2 " : file is other writeable" }' > ${TMP}
+
+if [ -s ${TMP} ]; then
+    printf "\nSecurity Warning: theses files should not be owned by someone else or writeable :\n" >> ${SECURITY_LOG}
+    cat ${TMP} >> ${SECURITY_LOG}
+fi
+
+### Check home directories.  Directories should not be owned by someone else or writeable.
+awk -F: '/^[^+-]/ { print $1 " " $6 }' /etc/passwd | \
+while read uid homedir; do
+        if [ -d ${homedir}/ ] ; then
+                file=`ls -ldg ${homedir}`
+                printf "$uid $file\n"
+        fi
+done | awk '$1 != $4 && $4 != "root" \
+        { print "user=" $1 " : home directory is owned by " $4 }
+     $2 ~ /^-....w/ \
+        { print "user=" $1 " : home directory is group writeable" }
+     $2 ~ /^-.......w/ \
+        { print "user=" $1 " : home directory is other writeable" }' > ${TMP}
+
+if [ -s $TMP ] ; then
+        printf "\nSecurity Warning: these home directory should not be owned by someone else or writeable :\n" >> ${SECURITY_LOG}
+        cat ${TMP} >> ${SECURITY_LOG}
+fi
+fi
+
+if [ ${CHECK_SECURITY}=="yes" ]; then
+### Passwd file check
+if [ ${CHECK_PASSWD}=="yes" ]; then    
+    awk -F: '{
+        if ( $2 == "" )
+	    printf("\t\t- /etc/passwd:%d: User \"%s\" has no password !\n", FNR, $1);
+	else if ($2 !~ /^[x*!]+$/)
+	    printf("\t\t- /etc/passwd:%d: User \"%s\" has a real password (it is not shadowed).\n", FNR, $1);
+    }' < /etc/passwd > ${TMP}
+    
+    if [ -s ${TMP} ]; then
+	printf "\nSecurity Warning: /etc/passwd check :\n" >> ${SECURITY_LOG}
+	cat ${TMP} >> ${SECURITY_LOG}
+    fi
+fi
+
+### Shadow password file Check
+if [ ${CHECK_SHADOW}=="yes" ]; then
+    awk -F: '{
+	if ( $2 == "" )
+	    printf("\t\t- /etc/shadow:%d: User \"%s\" has no password !\n", FNR, $1);
+    }' < /etc/shadow > ${TMP}
+
+    if [ -s ${TMP} ]; then
+	printf "\nSecurity Warning: /etc/shadow check :\n" >> ${SECURITY_LOG}
+	cat ${TMP} >> ${SECURITY_LOG}
+    fi
+fi
+
+### File systems should not be globally exported.
+if [ -s /etc/exports ] ; then
+    awk '{
+        if (($1 ~ /^#/) || ($1 ~ /^$/)) next;
+	readonly = 0;
+                for (i = 2; i <= NF; ++i) {
+                        if ($i ~ /^-ro$/)
+                                readonly = 1;
+                        else if ($i !~ /^-/)
+                                next;
+                }
+                if (readonly) {
+		    print "\t\t- Nfs File system " $1 " globally exported, read-only.";
+		} else print "\t\t- Nfs File system " $1 " globally exported, read-write.";
+        }' < /etc/exports > ${TMP}
+        
+    if [ -s ${TMP} ] ; then
+	printf "\nSecurity Warning: Some NFS filesystem are exported to globally :\n" >> ${SECURITY_LOG}
+	cat ${TMP} >> ${SECURITY_LOG}
+    fi
+fi
+
+### nfs mounts with missing nosuid
+/bin/mount | /bin/grep -v nosuid | /bin/grep ' nfs ' > ${TMP}
+if [ -s ${TMP} ] ; then
+    printf "\nSecurity Warning: The following NFS mounts haven't got the nosuid option set :\n" >> ${SECURITY_LOG}
+    cat ${TMP} >> ${SECURITY_LOG}
+fi
+
+### Files that should not have + signs.
+list="/etc/hosts.equiv /etc/shosts.equiv /etc/hosts.lpd"
+for file in $list ; do
+        if [ -s ${file} ] ; then
+                awk '{
+                        if ($0 ~ /^\+@.*$/)
+				next;
+                        if ($0 ~ /^\+.*$/)
+			        printf("\t\t- %s: %s\n", FILENAME, $0);
+                }' ${file}
+        fi
+done > ${TMP}
+
+awk -F: '{print $1" "$6}' /etc/passwd |
+    while read username homedir; do
+	for file in .rhosts .shosts; do
+	    if [ -s ${homedir}/${file} ] ; then
+		awk '{
+			if ($0 ~ /^\+@.*$/)
+			    next;
+			if ($0 ~ /^\+.*$/)
+			    printf("\t\t- %s: %s\n", FILENAME, $0);
+		}' ${homedir}/${file}
+	    fi
+	done >> ${TMP}
+    done
+	
+if [ -s ${TMP} ]; then
+    printf "\nSecurity Warning: '+' character found in hosts trusting files,\n" >> ${SECURITY_LOG}
+    printf "\tthis probably mean that you trust certains users/domain\n" >> ${SECURITY_LOG}
+    printf "\tto connect on this host without proper authentication :\n" >> ${SECURITY_LOG}
+    cat ${TMP} >> ${SECURITY_LOG}
+fi
+
+### executables should not be in the aliases file.
+list="/etc/aliases /etc/postfix/aliases"
+for file in ${list}; do
+    if [ -s ${file} ]; then
+	grep -v '^#' /etc/aliases | grep '|' | while read line; do
+	    printf "\t\t- ${line}\n"
+	done > ${TMP}
+    fi
+
+    if [ -s ${TMP} ]; then
+	printf "\nSecurity Warning: The following programs are executed in your mail\n" >> ${SECURITY_LOG}
+	printf "\tvia ${file} files, this could lead to security problems :\n" >> ${SECURITY_LOG}
+        cat ${TMP} >> ${SECURITY_LOG}
+    fi
+done
+
+### Dump a list of open port.
+if [ ${CHECK_OPEN_PORT}=="yes" ]; then
+    netstat -pvlA inet > ${TMP};
+    
+    if [ -s ${TMP} ]; then
+	printf "\nThese are the ports listening on your machine :\n" >> ${SECURITY_LOG}
+	cat ${TMP} >> ${SECURITY_LOG}
+    fi
+fi
+fi # end of CHECK_SECURITY
+
+### Report
+if [ -s ${SECURITY_LOG} ]; then
+    Syslog ${SECURITY_LOG}
+    Ttylog ${SECURITY_LOG}
+    cat ${SECURITY_LOG} >> ${SECURITY}
+fi
+
+
+
+
+