Initial revision

3 files changed, 236 insertions, 0 deletions

diff --git a/cron-sh/Makefile b/cron-sh/Makefile
new file mode 100644
index 0000000..d2993db
--- /dev/null
+++ b/cron-sh/Makefile
@@ -0,0 +1,5 @@
+all:
+
+install:
+	mkdir -p /etc/security/msec/cron-sh
+	cp *.sh /etc/security/msec/cron-sh
diff --git a/cron-sh/file_check.sh b/cron-sh/file_check.sh
new file mode 100755
index 0000000..5118ebc
--- /dev/null
+++ b/cron-sh/file_check.sh
@@ -0,0 +1,191 @@
+#!/bin/bash
+
+#
+# Basic security checking for suid files.
+# Written by Vandoorselaere Yoann, <yoann@mandrakesoft.com>
+#
+
+if [ -f /etc/security/msec/security.conf ]; then
+    . /etc/security/msec/security.conf
+else
+    exit 1
+fi
+
+if [ SECURITY_CHECK == "no" ]; then
+    exit 0
+fi
+
+# Modified filters coming from debian security scripts.
+CS_NFSAFS='(nfs|afs|xfs|coda)'
+CS_TYPES=' type (devpts|auto|proc|msdos|fat|vfat|iso9660|ncpfs|smbfs|'$CS_NFSAFS')'
+CS_DEVS='^/dev/fd'
+CS_DIRS='on /mnt'
+FILTERS="$CS_TYPES|$CS_DEVS|$CS_DIRS"
+DIR=`mount | grep -vE "$FILTERS" | cut -d ' ' -f3`
+###
+
+SUID_ROOT_TODAY="/var/log/security/suid_root.today"
+SUID_ROOT_YESTERDAY="/var/log/security/suid_root.yesterday"
+SUID_ROOT_DIFF="/var/log/security/suid_root.diff"
+SUID_GROUP_TODAY="/var/log/security/suid_group.today"
+SUID_GROUP_YESTERDAY="/var/log/security/suid_group.yesterday"
+SUID_GROUP_DIFF="/var/log/security/suid_group.diff"
+WRITABLE_TODAY=/var/log/security/writable.today
+WRITABLE_YESTERDAY=/var/log/security/writable.yesterday
+WRITABLE_DIFF=/var/log/security/writable.diff
+UNOWNED_TODAY=/var/log/security/unowned.today
+UNOWNED_YESTERDAY=/var/log/security/unowned.yesterday
+UNOWNED_DIFF=/var/log/security/unowned.diff
+
+
+if [ ! -d /var/log/security ]; then
+    mkdir /var/log/security
+fi
+
+chattr -a /var/log/security
+
+### Functions ###
+
+Syslog() {
+	if [ $SYS_LOG=="yes" ]; then
+		/sbin/initlog --string=$1
+	fi
+}
+
+Ttylog() {
+	if [ $TTY_LOG=="yes" ]; then
+		for i in `w | grep -v "load\|TTY" | awk '{print $2}'` ; do
+			echo -e $1 > /dev/$i
+		done
+	fi
+}
+
+##################
+
+
+### New Suid root file detection ###
+if [ $CHECK_SUID_ROOT=="yes" ]; then
+	if [ -f $SUID_ROOT_TODAY ]; then
+	    mv $SUID_ROOT_TODAY $SUID_ROOT_YESTERDAY
+	fi
+
+	find $DIR -xdev -type f -perm +04000 -user root \
+   		-printf "%8i %5m %3n %-10u %-10g %9s %t %h/%f\n" | sort > $SUID_ROOT_TODAY
+
+	if [ -f $SUID_ROOT_YESTERDAY ]; then
+    	if ! diff $SUID_ROOT_YESTERDAY $SUID_ROOT_TODAY > $SUID_ROOT_DIFF; then
+			Syslog "Change in Suid Root file found, please consult $SUID_ROOT_DIFF"
+        	Ttylog "\\033[1;31mChange in Suid Root file found !\\033[0;39m"
+        	Ttylog "\\033[1;31mPlease consult $SUID_ROOT_DIFF\\033[0;39m"
+    	fi
+	fi
+fi
+#############################
+
+
+### New Suid group file detection ###
+if [ $CHECK_SUID_GROUP ]; then
+	if [ -f $SUID_GROUP_TODAY ]; then
+		mv $SUID_GROUP_TODAY $SUID_GROUP_YESTERDAY
+	fi
+
+	find $DIR -xdev -type f -perm +02000 \
+   		 -printf "%8i %5m %3n %-10u %-10g %9s %t %h/%f\n" | sort > $SUID_GROUP_TODAY
+
+	if [ -f $SUID_GROUP_YESTERDAY ]; then
+		if ! diff $SUID_GROUP_YESTERDAY $SUID_GROUP_TODAY > $SUID_GROUP_DIFF; then
+			Syslog "Change in Suid Group file found, please consult $SUID_GROUP_DIFF"
+			Ttylog "\\033[1;31mChange in Suid Group file found !\\033[0;39m"
+			Ttylog "\\033[1;31mPlease consult $SUID_GROUP_DIFF\\033[0;39m"
+		fi
+	fi
+fi
+#############################
+
+### Writable file detection ###
+
+if [ $CHECK_WRITABLE=="yes" ]; then
+	if [ -f $WRITABLE_TODAY ]; then
+		mv $WRITABLE_TODAY $WRITABLE_YESTERDAY
+	fi
+
+	find $DIR -xdev -type f -perm -2 \
+		-ls -print | sort > $WRITABLE_TODAY
+
+	if [ -f $WRITABLE_YESTERDAY ]; then
+		if ! diff $WRITABLE_YESTERDAY $WRITABLE_TODAY > $WRITABLE_DIFF; then
+			Syslog "Change in World Writable File found, please consult $WRITABLE_DIFF"
+			Ttylog "\\033[1;31mChange in World Writable File found !\\033[0;39m"
+			Ttylog "\\033[1;31mPlease consult $WRITABLE_DIFF\\033[0;39m"	
+		fi
+	fi
+fi
+#################################
+
+### Search Un Owned file ###
+if [ $CHECK_UNOWNED=="yes" ]; then
+	if [ -f $UNOWNED_TODAY ]; then
+			mv $UNOWNED_TODAY $UNOWNED_YESTERDAY
+	fi
+
+	find $DIR -xdev -nouser -o -nogroup -print \
+		-ls | sort > $UNOWNED_TODAY
+
+	if [ -f $UNOWNED_YESTERDAY ]; then
+		if ! diff $UNOWNED_YESTERDAY $UNOWNED_TODAY; then
+			Syslog "Change in Un-Owned file user/group, please consult $UNOWNED_DIFF"
+			Ttylog "\\033[1;31mChange in Un-Owned file user/group found !\\033[0;39m"
+			Ttylog "\\033[1;31mPlease consult $UNOWNED_DIFF\\033[0;39m"
+		fi
+	fi
+fi
+
+
+chattr +a /var/log/security
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/cron-sh/promisc_check.sh b/cron-sh/promisc_check.sh
new file mode 100755
index 0000000..fa5b538
--- /dev/null
+++ b/cron-sh/promisc_check.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+
+if [ -f /etc/security/msec/security.conf ]; then
+	. /etc/security/msec/security.conf
+else
+	exit 1
+fi
+
+PROMISC_CHECK="/usr/bin/promisc_check -q"
+#
+# Check if a network interface is in promisc check...
+# Written by Vandoorselaere Yoann, <yoann@mandrakesoft.com>
+#
+
+LogPromisc() {
+	Syslog "Security warning : $1 is in promiscuous mode. (sniffer running ?)"
+	Ttylog "\\033[1;31mSecurity warning : $1 is in promiscuous mode.\\033[0;39m"
+	Ttylog "\\033[1;31mA sniffer is probably running on your system.\\033[0;39m
+}
+
+if [ -f /etc/security/msec/security.conf ]; then
+    . /etc/security/msec/security.conf
+else 
+	exit 1
+fi
+
+if [ CHECK_PROMISC == "no" ]; then
+	exit 0;
+fi
+
+for INTERFACE in `$PROMISC_CHECK`; do
+	LogPromisc $INTERFACE
+done
+
+
+
+
+
+
+