diff options
Diffstat (limited to 'cron-sh/file_check.sh')
| -rwxr-xr-x | cron-sh/file_check.sh | 191 |
1 files changed, 191 insertions, 0 deletions
diff --git a/cron-sh/file_check.sh b/cron-sh/file_check.sh new file mode 100755 index 0000000..5118ebc --- /dev/null +++ b/cron-sh/file_check.sh @@ -0,0 +1,191 @@ +#!/bin/bash + +# +# Basic security checking for suid files. +# Written by Vandoorselaere Yoann, <yoann@mandrakesoft.com> +# + +if [ -f /etc/security/msec/security.conf ]; then + . /etc/security/msec/security.conf +else + exit 1 +fi + +if [ SECURITY_CHECK == "no" ]; then + exit 0 +fi + +# Modified filters coming from debian security scripts. +CS_NFSAFS='(nfs|afs|xfs|coda)' +CS_TYPES=' type (devpts|auto|proc|msdos|fat|vfat|iso9660|ncpfs|smbfs|'$CS_NFSAFS')' +CS_DEVS='^/dev/fd' +CS_DIRS='on /mnt' +FILTERS="$CS_TYPES|$CS_DEVS|$CS_DIRS" +DIR=`mount | grep -vE "$FILTERS" | cut -d ' ' -f3` +### + +SUID_ROOT_TODAY="/var/log/security/suid_root.today" +SUID_ROOT_YESTERDAY="/var/log/security/suid_root.yesterday" +SUID_ROOT_DIFF="/var/log/security/suid_root.diff" +SUID_GROUP_TODAY="/var/log/security/suid_group.today" +SUID_GROUP_YESTERDAY="/var/log/security/suid_group.yesterday" +SUID_GROUP_DIFF="/var/log/security/suid_group.diff" +WRITABLE_TODAY=/var/log/security/writable.today +WRITABLE_YESTERDAY=/var/log/security/writable.yesterday +WRITABLE_DIFF=/var/log/security/writable.diff +UNOWNED_TODAY=/var/log/security/unowned.today +UNOWNED_YESTERDAY=/var/log/security/unowned.yesterday +UNOWNED_DIFF=/var/log/security/unowned.diff + + +if [ ! -d /var/log/security ]; then + mkdir /var/log/security +fi + +chattr -a /var/log/security + +### Functions ### + +Syslog() { + if [ $SYS_LOG=="yes" ]; then + /sbin/initlog --string=$1 + fi +} + +Ttylog() { + if [ $TTY_LOG=="yes" ]; then + for i in `w | grep -v "load\|TTY" | awk '{print $2}'` ; do + echo -e $1 > /dev/$i + done + fi +} + +################## + + +### New Suid root file detection ### +if [ $CHECK_SUID_ROOT=="yes" ]; then + if [ -f $SUID_ROOT_TODAY ]; then + mv $SUID_ROOT_TODAY $SUID_ROOT_YESTERDAY + fi + + find $DIR -xdev -type f -perm +04000 -user root \ + -printf "%8i %5m %3n %-10u %-10g %9s %t %h/%f\n" | sort > $SUID_ROOT_TODAY + + if [ -f $SUID_ROOT_YESTERDAY ]; then + if ! diff $SUID_ROOT_YESTERDAY $SUID_ROOT_TODAY > $SUID_ROOT_DIFF; then + Syslog "Change in Suid Root file found, please consult $SUID_ROOT_DIFF" + Ttylog "\\033[1;31mChange in Suid Root file found !\\033[0;39m" + Ttylog "\\033[1;31mPlease consult $SUID_ROOT_DIFF\\033[0;39m" + fi + fi +fi +############################# + + +### New Suid group file detection ### +if [ $CHECK_SUID_GROUP ]; then + if [ -f $SUID_GROUP_TODAY ]; then + mv $SUID_GROUP_TODAY $SUID_GROUP_YESTERDAY + fi + + find $DIR -xdev -type f -perm +02000 \ + -printf "%8i %5m %3n %-10u %-10g %9s %t %h/%f\n" | sort > $SUID_GROUP_TODAY + + if [ -f $SUID_GROUP_YESTERDAY ]; then + if ! diff $SUID_GROUP_YESTERDAY $SUID_GROUP_TODAY > $SUID_GROUP_DIFF; then + Syslog "Change in Suid Group file found, please consult $SUID_GROUP_DIFF" + Ttylog "\\033[1;31mChange in Suid Group file found !\\033[0;39m" + Ttylog "\\033[1;31mPlease consult $SUID_GROUP_DIFF\\033[0;39m" + fi + fi +fi +############################# + +### Writable file detection ### + +if [ $CHECK_WRITABLE=="yes" ]; then + if [ -f $WRITABLE_TODAY ]; then + mv $WRITABLE_TODAY $WRITABLE_YESTERDAY + fi + + find $DIR -xdev -type f -perm -2 \ + -ls -print | sort > $WRITABLE_TODAY + + if [ -f $WRITABLE_YESTERDAY ]; then + if ! diff $WRITABLE_YESTERDAY $WRITABLE_TODAY > $WRITABLE_DIFF; then + Syslog "Change in World Writable File found, please consult $WRITABLE_DIFF" + Ttylog "\\033[1;31mChange in World Writable File found !\\033[0;39m" + Ttylog "\\033[1;31mPlease consult $WRITABLE_DIFF\\033[0;39m" + fi + fi +fi +################################# + +### Search Un Owned file ### +if [ $CHECK_UNOWNED=="yes" ]; then + if [ -f $UNOWNED_TODAY ]; then + mv $UNOWNED_TODAY $UNOWNED_YESTERDAY + fi + + find $DIR -xdev -nouser -o -nogroup -print \ + -ls | sort > $UNOWNED_TODAY + + if [ -f $UNOWNED_YESTERDAY ]; then + if ! diff $UNOWNED_YESTERDAY $UNOWNED_TODAY; then + Syslog "Change in Un-Owned file user/group, please consult $UNOWNED_DIFF" + Ttylog "\\033[1;31mChange in Un-Owned file user/group found !\\033[0;39m" + Ttylog "\\033[1;31mPlease consult $UNOWNED_DIFF\\033[0;39m" + fi + fi +fi + + +chattr +a /var/log/security + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + |