Server : Apache/2.4.62 (Unix) OpenSSL/1.0.2k-fips System : Linux server1.richineiserver.com 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64 User : fdshops ( 1003) PHP Version : 8.2.21 Disable Function : NONE Directory : /usr/share/lynis/include/ |
#!/bin/sh
#################################################################################
#
# Lynis
# ------------------
#
# Copyright 2007-2013, Michael Boelen
# Copyright 2007-2021, CISOfy
#
# Website : https://cisofy.com
# Blog : http://linux-audit.com
# GitHub : https://github.com/CISOfy/lynis
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Parameter checks
#
#################################################################################
#
PARAMCOUNT=$#
# Input validation on provided parameters and their arguments
COUNT=0
for I in "$@"; do
COUNT=$((COUNT + 1))
if ! SafeInput "${I}"; then
echo "Execution of ${PROGRAM_NAME} stopped as we found unexpected input or invalid characters in argument ${COUNT}"
echo "Do you believe this is in error? Let us know: ${PROGRAM_AUTHOR_CONTACT}"
ExitFatal "Program execution stopped due to security measure"
fi
done
# Parse arguments
while [ $# -ge 1 ]; do
case $1 in
# Helpers first
audit)
CHECK_BINARIES=0
RUN_HELPERS=1
HELPER="audit"
SKIP_PLUGINS=1
RUN_TESTS=0
if [ $# -gt 1 ]; then
case $2 in
"dockerfile")
if [ $# = 2 ]; then
echo "${RED}Error: ${WHITE}Missing file name or URL${NORMAL}"
echo "Example: $0 audit dockerfile /path/to/Dockerfile"
ExitFatal
else
shift; shift
CHECK_BINARIES=1
HELPER_PARAMS="$1"
HELPER="audit_dockerfile"
break
fi
;;
"system")
if [ $# -gt 2 ]; then
if [ "$3" = "remote" ]; then
#shift
if [ $# -eq 3 ]; then
echo "${RED}Error: ${WHITE}Missing remote location${NORMAL}"
echo "Example: $0 audit system remote 192.168.1.100"
ExitFatal
else
REMOTE_TARGET="$4"
shift; shift; shift # shift out first three arguments
EXTRA_PARAMS=""
if [ ! "$1" = "" ]; then EXTRA_PARAMS=" $@"; fi
REMOTE_COMMAND="./lynis audit system"
echo ""
echo " How to perform a remote scan:"
echo " ============================="
echo " Target : ${REMOTE_TARGET}"
echo " Command : ${REMOTE_COMMAND}"
HELPER="system_remote_scan"
HELPER_PARAMS="$@"
CHECK_BINARIES=0
QUIET=1
RUN_HELPERS=1
SKIP_PLUGINS=1
RUN_TESTS=0
SHOW_PROGRAM_DETAILS=0
break
fi
fi
fi
CHECK=1
CHECK_BINARIES=1
HELPER=""
SKIP_PLUGINS=0
RUN_TESTS=1
shift
;;
*)
echo "${RED}Error: ${WHITE}Need a target to audit${NORMAL}"
echo " "
echo "Examples:"
echo "lynis audit dockerfile"
echo "lynis audit system"
ExitFatal
;;
esac
else
echo "${RED}Error: ${WHITE}Need a target to audit${NORMAL}"
echo " "
echo "Examples:"
echo "lynis audit dockerfile"
echo "lynis audit system"
ExitFatal
fi
;;
# Configure Lynis
configure)
CHECK_BINARIES=0
RUN_HELPERS=1
QUIET=1
SKIP_PLUGINS=1
RUN_TESTS=0
SHOW_PROGRAM_DETAILS=0
if [ $# -gt 0 ]; then shift; fi
HELPER="configure"
HELPER_PARAMS="$@"
break
;;
# Generate data
generate)
CHECK_BINARIES=0
HELPER="generate"
LOGTEXT=0
QUIET=1
RUN_HELPERS=1
RUN_TESTS=0
RUN_UPDATE_CHECK=0
SKIP_GETHOSTID=1
SKIP_PLUGINS=1
SKIP_VM_DETECTION=1
SHOW_PROGRAM_DETAILS=0
SHOW_TOOL_TIPS=0
shift; HELPER_PARAMS="$@"
break
;;
# Show Lynis details
show)
CHECK_BINARIES=0
HELPER="show"
LOGTEXT=0
QUIET=1
RUN_HELPERS=1
RUN_TESTS=0
RUN_UPDATE_CHECK=0
SKIP_PLUGINS=1
SHOW_PROGRAM_DETAILS=0
SHOW_TOOL_TIPS=0
shift; HELPER_PARAMS="$@"
break
;;
update)
CHECK_BINARIES=0
RUN_HELPERS=1
HELPER="update"
QUIET=1
SKIP_PLUGINS=1
RUN_TESTS=0
RUN_UPDATE_CHECK=0
SHOW_PROGRAM_DETAILS=0
SHOW_TOOL_TIPS=0
if [ $# -gt 1 ]; then
shift
HELPER_PARAMS="$1"
break
else
echo "${RED}Error: ${WHITE}Need a target for update${NORMAL}"
echo " "
echo "Examples:"
echo "lynis update check"
echo "lynis update info"
ExitFatal
fi
;;
# Perform just the upload
"upload-only" | "only-upload")
CHECK_BINARIES=1
CREATE_REPORT_FILE=0
#QUIET=1
LOGTEXT=0
RUN_HELPERS=0
RUN_TESTS=0
RUN_UPDATE_CHECK=0
SKIP_PLUGINS=1
SHOW_REPORT=0
SHOW_TOOL_TIPS=0
SHOW_PROGRAM_DETAILS=0
UPLOAD_DATA=1
if [ $# -gt 1 ]; then echo "No other parameters or options are allowed when using 'upload-only' command"; ExitFatal; fi
;;
# Assign auditor to report
--auditor)
shift
AUDITORNAME=$1
;;
# Binary directories (useful for incident response)
--bindirs | --bin-dirs)
if [ $# -gt 1 ]; then
shift
DIRS="$1"
for DIR in $1; do
if [ ! -d ${DIR} ]; then
echo "Invalid bindir '${DIR}' provided (does not exist)"
exit 1
fi
done
BIN_PATHS="${DIRS}"
else
echo "Need one or more directories (e.g. \"/mnt/cert/bin /mnt/cert/sbin\")"
exit 1
fi
;;
# Cronjob support
--cron-job | --cronjob | --cron)
CRONJOB=1
CHECK=1; COLORS=0; NEVERBREAK=1 # Use some defaults ('audit system', -Q, no colors)
RemoveColors
;;
# Perform tests with additional debugging information on screen
--debug)
DEBUG=1
;;
# Developer mode (more details when creating tests)
--developer)
DEVELOPER_MODE=1
;;
# DevOps mode (continuous integration)
--devops)
DEVOPS_MODE=1
;;
# Enable forensics mode (gather information from a mounted directory)
--forensics)
FORENSICS=1
;;
# View help
--help | -h | "-?")
VIEWHELP=1
;;
# Adjust default logfile location
--logfile | --log-file)
shift
LOGFILE=$1
;;
# Don't use colors
--no-colors | --nocolors | --no-colour | --nocolour)
COLORS=0
RemoveColors
;;
# Disable logging
--no-log | --nolog)
LOGFILE="/dev/null"
;;
# Skip execution of plugins
--no-plugins | --noplugins | --skip-plugins)
SKIP_PLUGINS=1
;;
--pen-test | --pentest)
PENTESTINGMODE=1
;;
# Define a custom profile file
--profile)
if [ $# -gt 1 ]; then
shift
SEARCH_PROFILES="$1"
else
echo "Specify the profile (lynis audit system --profile /home/michael/myprofile.prf)"
exit 1
fi
;;
# Define a custom plugin directory
--plugindir | --plugin-dir | --plugins-dir)
if [ $# -gt 1 ]; then
shift
PLUGINDIR=$1
LASTCHAR=$(echo $1 | awk '{ print substr($0, length($0))}')
if [ "${LASTCHAR}" = "/" ]; then
echo "${RED}Error:${WHITE} plugin directory path should not end with a slash${NORMAL}"
ExitCustom 65
fi
if [ ! -d ${PLUGINDIR} ]; then
echo "${RED}Error:${WHITE} invalid plugin directory ${PLUGINDIR}${NORMAL}"
ExitCustom 66
fi
else
echo "Specify the plugin directory (lynis audit system --plugindir /home/michael/plugins)"
exit 1
fi
;;
# Quiet mode
--quiet | -q | --silent)
QUIET=1
;;
# Non-interactive mode
--quick | -Q)
QUICKMODE=1
;;
# Define alternative report file
--report-file)
shift
REPORTFILE=$1
;;
# Strip the colors which aren't clearly visible on light backgrounds
--reverse-colors | --reverse-colour)
BLUE="${NORMAL}";
SECTION="${NORMAL}";
NOTICE="${NORMAL}";
CYAN="${NORMAL}";
GREEN="${NORMAL}";
YELLOW="${NORMAL}";
WHITE="${NORMAL}";
PURPLE="${NORMAL}";
;;
# Root directory (useful for forensics)
--rootdir | --root-dir)
if [ $# -gt 1 ]; then
shift
if [ -d $1 ]; then
ROOTDIR="$1"
else
echo "Invalid rootdir provided (does not exist)"
exit 1
fi
else
echo "Need a root directory (e.g. /mnt/forensics)"
exit 1
fi
;;
# Only scan these tests
--tests)
shift
TESTS_TO_PERFORM=$1
;;
# Scan one or more tests from just one category (e.g. security)
--tests-from-category)
shift
TEST_CATEGORY_TO_CHECK=$1
;;
# Scan one or more tests from just on group
--tests-from-group | --tests-from-groups | --test-from-group | --test-from-groups)
shift
TEST_GROUP_TO_CHECK=$1
;;
# Lynis Enterprise: upload data to central node
--upload)
UPLOAD_DATA=1
;;
--usecwd | --use-cwd)
USE_CWD=1
;;
--verbose)
VERBOSE=1
;;
# Version number
--version | -V)
echo "${PROGRAM_VERSION}"
exit 0
;;
# View man page
--view-manpage | --man-page | --manpage | --man)
if [ -f lynis.8 ]; then
nroff -man lynis.8
exit 0
else
echo "Error: man page file not found (lynis.8)"
echo "If you are running an installed version of Lynis, use 'man lynis'"
exit 1
fi
;;
--wait)
QUICKMODE=0
;;
# Warnings
--warnings-only | --show-warnings-only)
SHOW_WARNINGS_ONLY=1
QUIET=1
;;
# Warning when test is slow
--slow-warning)
if [ $# -gt 1 ]; then
shift
if [ "$1" -gt 0 ] 2>/dev/null; then
SLOW_TEST_THRESHOLD="$1"
else
echo "Argument has to be number."
exit 1
fi
else
echo "Specify threshold as number of seconds above which should Lynis warn about long test."
exit 1
fi
;;
--tests-category | --tests-categories | --view-categories | --list-categories | --show-categories)
echo "Error: Deprecated option ($1)"
exit 1
;;
# Soon to be deprecated options
# Perform tests (deprecated, use audit system)
--check-all | --checkall | -c)
echo "This option (-c) is deprecated."
echo "Use: lynis audit system [options]"
ExitFatal
;;
# View program/database information
--check-update | --check-updates | --info)
echo "This option (--info) is deprecated"
echo "Use: lynis update info"
ExitFatal
;;
# Display all available options with short alias
--dump-options | --dumpoptions)
echo "This option (--dump-options) is deprecated"
echo "Use: lynis show options"
ExitFatal
;;
# License key for Lynis Enterprise
--license-key)
echo "This option is deprecated"
echo "Define a license key in /etc/lynis/custom.prf"
ExitFatal
;;
# Drop out when using wrong option(s)
*)
# Wrong option used, we bail out later
WRONGOPTION=1
WRONGOPTION_value=$1
;;
esac
shift
done
# Ensure non-interactive mode when running quietly or as cronjob
if [ ${CRONJOB} -eq 1 -o ${QUIET} -eq 1 ]; then
if [ ${QUICKMODE} -eq 0 ]; then
if [ ${QUIET} -eq 0 ]; then
echo "Switched back to quick mode (cron/non-interactive/quiet)"
fi
QUICKMODE=1
fi
fi
#================================================================================
# Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com