#!/bin/sh

#################################################################################
#
#   Lynis
# ------------------
#
# Copyright 2007-2009, Michael Boelen (michael@rootkit.nl), The Netherlands
# Web site: http://www.rootkit.nl
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# File systems
#
#################################################################################
#
    # Number of days to mark a file as old
    TMP_OLD_DAYS=90
    LVM_VG_USED=0
#
#################################################################################
#
    InsertSection "File systems"
#
#################################################################################
#
    # Test        : FILE-6310
    # Description : Checking LVM Volume Groups
    if [ ! "${VGDISPLAYBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no FILE-6310 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking LVM volume groups"
    if [ ${SKIPTEST} -eq 0 ]; then
        logtext "Test: Checking for LVM volume groups"
        FIND=`${VGDISPLAYBINARY} | grep -v "No volume groups found" | grep "VG Name" | awk '{ print $3 }' | sort`
	if [ ! "${FIND}" = "" ]; then
	    logtext "Result: found one or more volume groups"
	    for I in ${FIND}; do
	        logtext "Found LVM volume group: ${I}"
		report "lvm_volume_group[]=${I}"
	    done
	    LVM_VG_USED=1
	    Display --indent 2 --text "- Checking LVM volume groups..." --result FOUND --color GREEN
	  else
	    logtext "Result: no LVM volume groups found"
	    Display --indent 2 --text "- Checking LVM volume groups..." --result NONE --color WHITE
	fi
    fi
#
#################################################################################
#
    # Test        : FILE-6312
    # Description : Checking LVM volumes
    if [ ! "${LVDISPLAYBINARY}" = "" -a ${LVM_VG_USED} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no FILE-6312 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking LVM volumes"
    if [ ${SKIPTEST} -eq 0 ]; then
        logtext "Test: Checking for LVM volumes"
        FIND=`${LVDISPLAYBINARY} | grep -v "No volume groups found" | grep "LV Name" | awk '{ print $3 }' | sort`
	if [ ! "${FIND}" = "" ]; then
	    logtext "Result: found one or more volumes"
	    for I in ${FIND}; do
	        logtext "Found LVM volume: ${I}"
		report "lvm_volume[]=${I}"
	    done
	    Display --indent 4 --text "- Checking LVM volumes..." --result FOUND --color GREEN
	  else
	    logtext "Result: no LVM volume groups found"
	    Display --indent 4 --text "- Checking LVM volumes..." --result NONE --color WHITE
	fi
    fi
#
#################################################################################
#
    # Test        : FILE-6316
    # Description : Checking /etc/fstab file permissions
    #Register --test-no FILE-6316 --os Linux --weight L --network NO --description "Checking /etc/fstab"
    #if [ ${SKIPTEST} -eq 0 ]; then
    # 644
#
#################################################################################
#
    # Test        : FILE-6323
    # Description : Checking Linux EXT2, EXT3, EXT4 file systems
    Register --test-no FILE-6323 --os Linux --weight L --network NO --description "Checking EXT file systems"
    if [ ${SKIPTEST} -eq 0 ]; then
        logtext "Test: Checking for Linux EXT file systems"
        FIND=`mount -t ext2,ext3,ext4 | awk '{ print $3","$5 }'`
	if [ ! "${FIND}" = "" ]; then
	    logtext "Result: found one or more EXT file systems"
	    for I in ${FIND}; do
	        FILESYSTEM=`echo ${I} | cut -d ',' -f1`
	        FILETYPE=`echo ${I} | cut -d ',' -f2`		
	        logtext "File system: ${FILESYSTEM} (type: ${FILETYPE})"
	    done
	fi
    fi
#
#################################################################################
#

    # Test        : FILE-6329
    # Description : Query all UFS mounts from /etc/fstab
    Register --test-no FILE-6329 --os FreeBSD --weight L --network NO --description "Checking UFS file systems"
    if [ ${SKIPTEST} -eq 0 ]; then
	logtext "Test: Query /etc/fstab for available UFS mount points"
        FIND=`awk '{ if ($3 == "ufs") { print $1":"$2":"$3":"$4":" }}' /etc/fstab`
	if [ "${FIND}" = "" ]; then
	    Display --indent 2 --text "- Querying UFS mount points (fstab)..." --result WARNING --color RED
	    logtext "Result: unable to find any single mount point (UFS)"
	    ReportWarning ${TEST_NO} "L" "No single UFS mount point found"
	  else
	    Display --indent 2 --text "- Querying UFS mount points (fstab)..." --result OK --color GREEN
	    for I in ${FIND}; do
	        logtext "UFS mount found: ${I}"
	        report "mountpoint[]=${I}"	
	    done
	fi
    fi
#
#################################################################################
#
    # Test        : FILE-6332
    # Description : Check FreeBSD swap partitions
    Register --test-no FILE-6332 --os FreeBSD --weight L --network NO --description "Checking swap partitions"
    if [ ${SKIPTEST} -eq 0 ]; then
    	FOUND=0
        logtext "Test: query swap partitions from /etc/fstab file"
	# Check if third field contains 'swap'
        FIND=`awk '{ if ($3=="swap") print $1 }' /etc/fstab`	
	for I in ${FIND}; do
	    FOUND=1
	    logtext "Swap partition found: ${I}"
	    #YYY add to report file
	done
	if [ ${FOUND} -eq 1 ]; then
	    Display --indent 2 --text "- Query swap partitions (fstab)..." --result OK --color GREEN
	  else
	    Display --indent 2 --text "- Query swap partitions (fstab)..." --result WARNING --color YELLOW
	    ReportWarning ${TEST_NO} "L" "No swap partion found in /etc/fstab"
	    logtext "Result: no swap partitions found in /etc/fstab"
	fi
    fi
#
#################################################################################
#
    # Test        : FILE-6336
    # Description : Check FreeBSD swap mount options
    Register --test-no FILE-6336 --os FreeBSD --weight L --network NO --description "Checking swap mount options"
    if [ ${SKIPTEST} -eq 0 ]; then
        # Swap partitions should be mounted with 'sw'
	logtext "Test: check swap partitions with incorrect mount options"
        FIND=`awk '{ if ($3=="swap" && $4 !~ "sw") print $1 }' /etc/fstab`
	if [ "${FIND}" = "" ]; then
	    Display --indent 2 --text "- Testing swap partitions..." --result OK --color GREEN
	    logtext "Result: all swap partitions have correct options (=sw)"
	  else
	    Display --indent 2 --text "- Testing swap partitions..." --result WARNING --color RED
	    logtext "Result: possible incorrect mount options used for mounting swap partition (${FIND})"
	    ReportWarning ${TEST_NO} "L" "Possible incorrect mount options used for swap parition (${FIND})"
	    ReportSuggestion ${TEST_NO} "Check your /etc/fstab file. Swap parition usually have 'sw' in the options field (4th)."
	fi
    fi
#
#################################################################################
#
    # Test        : FILE-6340
    # Description : Check automount process
#
#################################################################################
#
    # Test        : FILE-6342
    # Description : Check automount maps
#
#################################################################################
#
    # Test        : FILE-6344
    # Description : Check automount map files
#
#################################################################################
#
    # Test        : FILE-6354
    # Description : Search files within /tmp which are older than 3 months
    if [ -d /tmp  ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no FILE-6354 --preqs-met ${PREQS_MET} --weight L --network NO --description "Searching for old files in /tmp"
    if [ ${SKIPTEST} -eq 0 ]; then
        logtext "Test: Searching for old files in /tmp..."
	# Search for files only in /tmp, with an access time older than X days
        FIND=`find /tmp -type f -atime +${TMP_OLD_DAYS} | sed 's/ /!space!/g'`
        if [ "${FIND}" = "" ]; then
	    Display --indent 2 --text "- Checking for old files in /tmp..." --result OK --color GREEN
	    logtext "Result: no files found in /tmp which are older than 3 months"
          else
	    Display --indent 2 --text "- Checking for old files in /tmp..." --result WARNING --color RED
	    N=0
	    for I in ${FIND}; do
		FILE=`echo ${I} | sed 's/!space!/ /g'`
	        logtext "Old temporary file: ${FILE}"
		N=`expr ${N} + 1`
	    done
	    logtext "Result: found old files in /tmp, which were not modified in the last ${TMP_OLD_DAYS} days"
	    logtext "Advice: check and clean up unused files in /tmp. Old files can fill up a disk or contain"
	    logtext "private information and should be deleted it not being used actively. Use a tool like lsof to"
	    logtext "see which programs possibly are using a particular file. Some systems can cleanup temporary"
	    logtext "directories by setting a boot option."
	    ReportWarning ${TEST_NO} "L" "Found ${N} files in /tmp which are older than ${TMP_OLD_DAYS} days"
	    ReportSuggestion ${TEST_NO} "Clean up unused files in /tmp"
	fi
    fi
#
#################################################################################
#
    # Test: scan the skel directory for bad permissions
    # Reason: bad permissions on these files will give new created users the same permissions
    #YYY enable skel test
    # Several differences between operating systems are present
    #SKELDIRS="/etc/skel /usr/share/skel"

    #for I in ${SKELDIRS}; do
    #    
    #    logtext "Searching skel directory ${I}..."
    #
    #    if [ -d ${I} ]; then
    #        logtext "Result: Directory found, scanning for unsafe file permissions"
    #	FIND=`ls -A ${I} | wc -l | sed 's/ //g'`
    #	if [ ! "${FIND}" = "0" ]; then
    #     	    FIND=`find ${I} -type f -a \( -perm -004 -o -perm -002 -o -perm -001 \)`
    #	    if [ "${FIND}" = "" ]; then
    #	        Display --indent 2 --text "- Checking skel file permissions (${I})..." --result OK --color GREEN
    #		logtext "Result: Directory seems to be ok, no files found with read/write/execute bit set."
    #		logtext "Status: OK"
    #	      else	
    #	        Display --indent 2 --text "- Checking skel file permissions (${I})..." --result WARNING --color RED
    #	        logtext "Result: The following files do have non restrictive permissions: ${FIND}"
    #	        ReportSuggestion ${TEST_NO} "Remove the read, write or execute bit from these files (chmod o-rwx)"
    #	    fi    
    #	  else
    #	    Display --indent 2 --text "- Checking skel file permissions (${I})..." --result EMPTY --color WHITE
    #	    logtext "Directory ${I} is empty, no scan performed"    
    #	fi
    #      else
    #        Display --indent 2 --text "- Checking skel file permissions (${I})..." --result "NOT FOUND" --color WHITE
    #	logtext "Result: Skel directory (${I}) not found"
    #    fi
    #done
#
#################################################################################
#
    # Test        : FILE-6362
    # Description : Check for sticky bit on /tmp
    if [ -d /tmp -a ! -L /tmp ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no FILE-6362 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking /tmp sticky bit"
    if [ ${SKIPTEST} -eq 0 ]; then
        # Depending on OS, number of field with 'tmp' differs
        FIND=`ls -l / | tr -s ' ' | awk -F" " '{ if ( $8 == "tmp" || $9 == "tmp" ) { print $1 } }' | cut -c 10`
        if [ "${FIND}" = "t" -o "${FIND}" = "T" ]; then
    	    Display --indent 2 --text "- Checking /tmp sticky bit..." --result OK --color GREEN
            logtext "Result: Sticky bit (${FIND}) found on /tmp directory"
	  else
	    Display --indent 2 --text "- Checking /tmp sticky bit..." --result WARNING --color RED
    	    ReportWarning ${TEST_NO} "H" "No sticky bit found on /tmp directory, which can be dangerous!"
	    ReportSuggestion ${TEST_NO} "Consult documentation and place the sticky bit, to prevent users deleting (by other owned) files in the /tmp directory."
	fi
      else
        logtext "Result: Sticky bit test (on /tmp) skipped. Possible reason: missing or symlinked directory, or test skipped."
    fi
#
#################################################################################
#
    # Test        : FILE-6366
    # Description : Check for noatime option
    # More info   : especially useful for profile 'desktop' and 'server-storage'
#
#################################################################################
#
    # Test        : FILE-6368
    # Description : Checking Linux root file system ACL support
    Register --test-no FILE-6368 --os Linux --weight L --network NO --description "Checking ACL support on root file system"
    if [ ${SKIPTEST} -eq 0 ]; then
        FOUND=0
        logtext "Test: Checking acl option on root file system"
        FIND=`mount | ${AWKBINARY} '{ if ($3=="/") { print $6 } }' | grep acl`
	if [ ! "${FIND}" = "" ]; then
	    logtext "Result: found ACL option"
	    FOUND=1
	  else
	    logtext "Result: mount point probably mounted with defaults"
	    logtext "Test: Checking device which holds root file system"
	    # Get device on which root file system is mounted
	    FIND1=`mount | grep ' / ' | awk '{ print $1 }'`
	    if [ ! "${FIND1}" = "" ]; then
	        logtext "Result: found ${FIND1}"
	    	logtext "Test: Checking default options on ${FIND1}"
	        FIND2=`tune2fs -l ${FIND1} | grep "^Default mount options" | grep "acl"` 
		if [ ! "${FIND2}" = "" ]; then
		    logtext "Result: found ACL option in default mount options"
		    FOUND=1
		  else
		    logtext "Result: no ACL option found in default mount options list"
		fi
	      else
	        logtext "Result: No file system found with root file system"
	    fi
	fi

	if [ ${FOUND} -eq 0 ]; then
	    logtext "Result: ACL option NOT enabled on root file system"
	    logtext "Additional information: if file access need to be more restricted, ACLs could be used. Install the acl utilities and remount the file system with the acl option"
	    logtext "Activate acl support on and active file system with mount -o remount,acl / and add the acl option to the fstab file"
	    Display --indent 2 --text "- ACL support root file system..." --result DISABLED --color YELLOW
	    AddHP 0 1
	  else    
	    logtext "Result: ACL option enabled on root file system"
	    Display --indent 2 --text "- ACL support root file system..." --result ENABLED --color GREEN
	    AddHP 3 3
	fi
    fi
#
#################################################################################
#
    # Test        : FILE-6370
    # Description : Check for nodirtime option
#
#################################################################################
#
    # Test        : FILE-6374
    # Description : Check for relatime
#
#################################################################################
#
    # Test        : FILE-6378
    # Description : Check for nodev option for all NON / (root) mount points
    # More info   : on partitions where applications are chrooted, it should
    #               NOT be placed
#
#################################################################################
#
    # Test        : FILE-6382
    # Description : Check for nosuid option
#
#################################################################################
#
    # Test        : FILE-6386
    # Description : Check for noexec option
#
#################################################################################
#
    # Test        : FILE-6390
    # Description : Check writeback/journalling mode (ext3)
    # More info   : data=writeback | data=ordered | data=journal
#
#################################################################################
#
    # Test        : FILE-6394
    # Description : Check vm.swappiness (Linux)
#
#################################################################################
#
    # Test        : FILE-6398
    # Description : Check if JBD (Journal Block Device) driver is loaded
#
#################################################################################
#
    # Test        : FILE-6410
    # Description : Checking locate database (file index)
    # Notes       : Linux   /var/lib/mlocate/mlocate.db
    #               FreeBSD /var/db/locate.database
    #               YYY add support for all OSes
    if [ ! "${LOCATEBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no FILE-6410 --os Linux --weight L --network NO --description "Checking Locate database"
    if [ ${SKIPTEST} -eq 0 ]; then
        logtext "Test: Checking Locate database (/var/lib/mlocate/mlocate.db)"
        if [ -f /var/lib/mlocate/mlocate.db ]; then
	    logtext "Result: database exists"
	    Display --indent 2 --text "- Checking Locate database..." --result FOUND --color GREEN
	  else    
	    logtext "Result: database not found"
	    Display --indent 2 --text "- Checking Locate database..." --result "NOT FOUND" --color YELLOW
	    ReportSuggestion ${TEST_NO} "The database required for 'locate' could not be found. Run 'updatedb' to create this file."
	fi
    fi
#
#################################################################################
#


wait_for_keypress

#
#================================================================================
# Lynis - Copyright 2007-2009, Michael Boelen - www.rootkit.nl - The Netherlands
