aboutsummaryrefslogtreecommitdiffstats
path: root/cron-sh/file_check.sh
diff options
context:
space:
mode:
authorYoann Vandoorselaere <yoann@mandriva.com>1999-11-25 19:44:10 +0000
committerYoann Vandoorselaere <yoann@mandriva.com>1999-11-25 19:44:10 +0000
commit78b13ca5f0677f9e6e5a07a18473a2d7724b51d0 (patch)
tree1aa278480009928f545f8668bc87c4eaafbc7e7b /cron-sh/file_check.sh
parent7f3bfad3df657529ee81b741c6fb10d847315c85 (diff)
downloadmsec-78b13ca5f0677f9e6e5a07a18473a2d7724b51d0.tar
msec-78b13ca5f0677f9e6e5a07a18473a2d7724b51d0.tar.gz
msec-78b13ca5f0677f9e6e5a07a18473a2d7724b51d0.tar.bz2
msec-78b13ca5f0677f9e6e5a07a18473a2d7724b51d0.tar.xz
msec-78b13ca5f0677f9e6e5a07a18473a2d7724b51d0.zip
Initial revision
Diffstat (limited to 'cron-sh/file_check.sh')
-rwxr-xr-xcron-sh/file_check.sh191
1 files changed, 191 insertions, 0 deletions
diff --git a/cron-sh/file_check.sh b/cron-sh/file_check.sh
new file mode 100755
index 0000000..5118ebc
--- /dev/null
+++ b/cron-sh/file_check.sh
@@ -0,0 +1,191 @@
+#!/bin/bash
+
+#
+# Basic security checking for suid files.
+# Written by Vandoorselaere Yoann, <yoann@mandrakesoft.com>
+#
+
+if [ -f /etc/security/msec/security.conf ]; then
+ . /etc/security/msec/security.conf
+else
+ exit 1
+fi
+
+if [ SECURITY_CHECK == "no" ]; then
+ exit 0
+fi
+
+# Modified filters coming from debian security scripts.
+CS_NFSAFS='(nfs|afs|xfs|coda)'
+CS_TYPES=' type (devpts|auto|proc|msdos|fat|vfat|iso9660|ncpfs|smbfs|'$CS_NFSAFS')'
+CS_DEVS='^/dev/fd'
+CS_DIRS='on /mnt'
+FILTERS="$CS_TYPES|$CS_DEVS|$CS_DIRS"
+DIR=`mount | grep -vE "$FILTERS" | cut -d ' ' -f3`
+###
+
+SUID_ROOT_TODAY="/var/log/security/suid_root.today"
+SUID_ROOT_YESTERDAY="/var/log/security/suid_root.yesterday"
+SUID_ROOT_DIFF="/var/log/security/suid_root.diff"
+SUID_GROUP_TODAY="/var/log/security/suid_group.today"
+SUID_GROUP_YESTERDAY="/var/log/security/suid_group.yesterday"
+SUID_GROUP_DIFF="/var/log/security/suid_group.diff"
+WRITABLE_TODAY=/var/log/security/writable.today
+WRITABLE_YESTERDAY=/var/log/security/writable.yesterday
+WRITABLE_DIFF=/var/log/security/writable.diff
+UNOWNED_TODAY=/var/log/security/unowned.today
+UNOWNED_YESTERDAY=/var/log/security/unowned.yesterday
+UNOWNED_DIFF=/var/log/security/unowned.diff
+
+
+if [ ! -d /var/log/security ]; then
+ mkdir /var/log/security
+fi
+
+chattr -a /var/log/security
+
+### Functions ###
+
+Syslog() {
+ if [ $SYS_LOG=="yes" ]; then
+ /sbin/initlog --string=$1
+ fi
+}
+
+Ttylog() {
+ if [ $TTY_LOG=="yes" ]; then
+ for i in `w | grep -v "load\|TTY" | awk '{print $2}'` ; do
+ echo -e $1 > /dev/$i
+ done
+ fi
+}
+
+##################
+
+
+### New Suid root file detection ###
+if [ $CHECK_SUID_ROOT=="yes" ]; then
+ if [ -f $SUID_ROOT_TODAY ]; then
+ mv $SUID_ROOT_TODAY $SUID_ROOT_YESTERDAY
+ fi
+
+ find $DIR -xdev -type f -perm +04000 -user root \
+ -printf "%8i %5m %3n %-10u %-10g %9s %t %h/%f\n" | sort > $SUID_ROOT_TODAY
+
+ if [ -f $SUID_ROOT_YESTERDAY ]; then
+ if ! diff $SUID_ROOT_YESTERDAY $SUID_ROOT_TODAY > $SUID_ROOT_DIFF; then
+ Syslog "Change in Suid Root file found, please consult $SUID_ROOT_DIFF"
+ Ttylog "\\033[1;31mChange in Suid Root file found !\\033[0;39m"
+ Ttylog "\\033[1;31mPlease consult $SUID_ROOT_DIFF\\033[0;39m"
+ fi
+ fi
+fi
+#############################
+
+
+### New Suid group file detection ###
+if [ $CHECK_SUID_GROUP ]; then
+ if [ -f $SUID_GROUP_TODAY ]; then
+ mv $SUID_GROUP_TODAY $SUID_GROUP_YESTERDAY
+ fi
+
+ find $DIR -xdev -type f -perm +02000 \
+ -printf "%8i %5m %3n %-10u %-10g %9s %t %h/%f\n" | sort > $SUID_GROUP_TODAY
+
+ if [ -f $SUID_GROUP_YESTERDAY ]; then
+ if ! diff $SUID_GROUP_YESTERDAY $SUID_GROUP_TODAY > $SUID_GROUP_DIFF; then
+ Syslog "Change in Suid Group file found, please consult $SUID_GROUP_DIFF"
+ Ttylog "\\033[1;31mChange in Suid Group file found !\\033[0;39m"
+ Ttylog "\\033[1;31mPlease consult $SUID_GROUP_DIFF\\033[0;39m"
+ fi
+ fi
+fi
+#############################
+
+### Writable file detection ###
+
+if [ $CHECK_WRITABLE=="yes" ]; then
+ if [ -f $WRITABLE_TODAY ]; then
+ mv $WRITABLE_TODAY $WRITABLE_YESTERDAY
+ fi
+
+ find $DIR -xdev -type f -perm -2 \
+ -ls -print | sort > $WRITABLE_TODAY
+
+ if [ -f $WRITABLE_YESTERDAY ]; then
+ if ! diff $WRITABLE_YESTERDAY $WRITABLE_TODAY > $WRITABLE_DIFF; then
+ Syslog "Change in World Writable File found, please consult $WRITABLE_DIFF"
+ Ttylog "\\033[1;31mChange in World Writable File found !\\033[0;39m"
+ Ttylog "\\033[1;31mPlease consult $WRITABLE_DIFF\\033[0;39m"
+ fi
+ fi
+fi
+#################################
+
+### Search Un Owned file ###
+if [ $CHECK_UNOWNED=="yes" ]; then
+ if [ -f $UNOWNED_TODAY ]; then
+ mv $UNOWNED_TODAY $UNOWNED_YESTERDAY
+ fi
+
+ find $DIR -xdev -nouser -o -nogroup -print \
+ -ls | sort > $UNOWNED_TODAY
+
+ if [ -f $UNOWNED_YESTERDAY ]; then
+ if ! diff $UNOWNED_YESTERDAY $UNOWNED_TODAY; then
+ Syslog "Change in Un-Owned file user/group, please consult $UNOWNED_DIFF"
+ Ttylog "\\033[1;31mChange in Un-Owned file user/group found !\\033[0;39m"
+ Ttylog "\\033[1;31mPlease consult $UNOWNED_DIFF\\033[0;39m"
+ fi
+ fi
+fi
+
+
+chattr +a /var/log/security
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+