File: //opt/BCLinux/bse/bse
#!/bin/sh
#################################################################################
#
# BSE
# ------------------
#
# Copyright 2016-2025 Josephy Gu, (bclinux@cmss.chinamobile.com)
# Web site: http://www.bclinux.org
#
# BSE comes with ABSOLUTELY NO WARRANTY. This is free software,
# and you are welcome to redistribute it under the terms of the GNU General Public
# License. See LICENSE file for usage of this software.
#
# BSE is licensed under GPLv3, Plugins are licensed differently.
#
#################################################################################
#
# BSE is an automated auditing tool for Linux based operating systems.
#
#################################################################################
#
# Program information
PROGRAM_version="2.3.7"
PROGRAM_releasetype="v2.3.7"
PROGRAM_NAME="BSE"
PROGRAM_name=${PROGRAM_NAME}
PROGRAM_releasedate="2022-8-8"
PROGRAM_author="BC-Linux"
PROGRAM_author_contact="bclinux@cmss.chinamobile.com"
PROGRAM_website="https://github.com/BCLinux/"
PROGRAM_copyright="Copyright 2016-2025 - ${PROGRAM_author}, ${PROGRAM_website}"
PROGRAM_license="${PROGRAM_NAME} comes with ABSOLUTELY NO WARRANTY. It's free software,
and you are welcome to redistribute it under the terms of the GNU General Public
License. See the LICENSE file for details about using this software."
PROGRAM_extrainfo="Enterprise support and plugins available via BCLinux"
# Release version (beta or final)
#alias vi='vim'
PROGRAM_SOURCE="https://github.com/BCLinux/sys-scan-fix-tool"
# Version number of report files (when format changes in future)
REPORT_version_major="2.3"; REPORT_version_minor="7"
REPORT_version="${REPORT_version_major}.${REPORT_version_minor}"
# Script Info
VER_ID="SecurityHarden, by bc-linux, 2022-8-8"
[ ! -d /var/log/bclinux ] && mkdir -p /var/log/bclinux #log dir
LOGDIR="/var/log/bclinux/"
LOGFILE=${LOGDIR}/bclinux.log
TMP_DIR=""
RESULT_FILE="${LOGDIR}/check_result.relt"
PLANTFORM=""
MachineType="" #virtual or physical
bc_HPPOINTS="0"
bc_HPTOTAL="0"
OS_ID="" #like ID="centos" ID="sles" ID=debian
OS_DISTRO="" #like VERSION_ID="22.10"
CHECK_SYSTEM="0" #Falg value, 1:just do basicly check by secure_check dir.
CHECK_ADVANCE="0" #Flag value, 1:just do advance check by option_check dir.
CHECK_ROOTKIT="0" #Flag value, 1:just do advance rootkit by option_check dir.
AUTOFIX_SYSTEM="0" #Flag Value, 1: auto fix and check the system, 0: do nothing
FIX_SYSTEM="0" #Flag Value, 1: just fix the system basicly, 0: do nothing
FIX_ADVANCE="0" #Flag Value, 1: also do the root-deny user-add and remove_issue, etc.
AUTO_ADV_FIX="0"
FIX_SPECIFY_ITEMS="0" #Flag Value, 1: just fix the specify items. 0: do nothing
FIX_ITEMS="" #if user want to fix the specify items
RESTORE_SYSTEM=0 # basic restore
RESTORE_ADVANCE=0 # advance restore
AUTO_BASIC_RESTORE=0 #auto basic restore
AUTO_ADV_RESTORE=0 #auto advance restore
UPDATE_INFO="0" #if user want to see the update info.
UPDATE_CHANGELOG="0"
#
#################################################################################
#
# Configure Include/common/secure_set/secure_check path and files
#
#################################################################################
#
rundir=`dirname $0`
cd ${rundir}
rundir=$(pwd)
# Test from which directories we can use all functions and tests
INCLUDEDIR="" # Set default include directory to none
# Default paths to check (CWD as last option, in case we run from standalone)
tINCLUDE_TARGETS="${rundir} /opt/BCLinux/bse"
for I in ${tINCLUDE_TARGETS};
do
if [ -d ${I}/include -a -d ${I}/common -a -d ${I}/secure_check ]; then
rundir=${I};
cd ${rundir}
INCLUDEDIR=${rundir}/include
BCLinux_COMMON=${rundir}/common/bclinux_common.sh
COLOR_INDEX=${rundir}/common/color_index
CONSTS_INDEX=${INCLUDEDIR}/consts
break;
fi;
done
# Drop out if our include directory can't be found
if [ "${INCLUDEDIR}" = "" ]; then
echo "Fatal error: can't find include/common/secure_set/secure_check and etc. directory"
echo "Make sure to execute ${PROGRAM_NAME} from untarred directory or check your installation."
exit 1
fi
#
#################################################################################
#
MYID=""
# Check user to determine file permissions later on. If we encounter Solaris, use related id binary instead
if [ -x /usr/xpg4/bin/id ]; then
MYID=`/usr/xpg4/bin/id -u 2> /dev/null`
else
MYID=`id -u 2> /dev/null`
fi
if [ "${MYID}" = "" ]; then Display "Could not find user ID with id command. Want to help improving ${PROGRAM_NAME}? Raise a ticket at ${PROGRAM_SOURCE}"; ExitFatal; fi
#
#################################################################################
#
# Consts
# (bin paths, text strings, colors)
#
#################################################################################
#
# Perform a basic check for permissions. After including functions, using SafePerms()
# Optimization: remove ls -l for owner and only do UID check, reducing one getpwent
PERMS=`ls -l ${INCLUDEDIR}/consts | cut -c 2-10`
PERMS2=`ls -l ${INCLUDEDIR}/functions | cut -c 2-10`
OWNER=`ls -l ${INCLUDEDIR}/consts | awk -F" " '{ print $3 }'`
OWNER2=`ls -l ${INCLUDEDIR}/functions | awk -F" " '{ print $3 }'`
OWNERID=`ls -n ${INCLUDEDIR}/consts | awk -F" " '{ print $3 }'`
OWNER2ID=`ls -n ${INCLUDEDIR}/functions | awk -F" " '{ print $3 }'`
ISSUE=0
SHOWPERMERROR=0
# Check permissions of include/consts file (400, 600, 640, 644)
if [ ! "${PERMS}" = "r--------" -a ! "${PERMS}" = "rw-------" -a ! "${PERMS}" = "rw-r-----" -a ! "${PERMS}" = "rw-r--r--" ]; then
ISSUE=1; echo "[!] Change file permissions of ${INCLUDEDIR}/consts to 640."; echo " Command: chmod 640 ${INCLUDEDIR}/consts"
fi
# Check permissions of include/functions file
if [ ! "${PERMS2}" = "r--------" -a ! "${PERMS2}" = "rw-------" -a ! "${PERMS}" = "rw-r-----" -a ! "${PERMS}" = "rw-r--r--" ]; then
ISSUE=1; echo "[!] Change file permissions of ${INCLUDEDIR}/functions to 640."; echo " Command: chmod 640 ${INCLUDEDIR}/functions"
fi
# Check if owner of both files is root user, or the same user which is running ${PROGRAM_NAME} (for pentester mode)
# Consts
if [ ! "${OWNER}" = "root" -a ! "${OWNERID}" = "0" ]; then
if [ ! "${MYID}" = "${OWNER2ID}" ]; then
ISSUE=1; SHOWPERMERROR=1; FILE="consts"
fi
fi
# Functions
if [ ! "${OWNER2}" = "root" -a ! "${OWNER2ID}" = "0" ]; then
if [ ! "${MYID}" = "${OWNER2ID}" ]; then
ISSUE=1; SHOWPERMERROR=1; FILE="functions"
fi
fi
if [ ${SHOWPERMERROR} -eq 1 ]; then
echo ""
echo "[!] Change ownership of ${INCLUDEDIR}/${FILE} to 'root' or similar (found: ${OWNER} with UID ${OWNERID})."
echo ""
echo " Command:"
echo " # chown root:root ${INCLUDEDIR}/${FILE}"
echo ""
echo " Note: on some systems the default group might be 'wheel'. Use 'chown root:wheel' instead on the files."
echo ""
fi
if [ ${ISSUE} -eq 0 ]; then
. ${INCLUDEDIR}/consts
. ${INCLUDEDIR}/functions
. ${BCLinux_COMMON} #BCLinux common func.
else
echo ""; echo "";
echo "[X] Security check failed: See action above, to correct this issue."
echo ""
echo " Why do I see this error?"
echo " -------------------------------"
echo " This is a protection mechanism, to prevent the root user from executing user created files."
echo ""; echo ""
echo " What can I do?"
echo " ---------------------"
echo " 1) Check if a trusted user created the files (e.g. you, by using Git, Homebrew or similar)"
echo ""
echo " 2) Change ownership and permissions of the related files (or full directory)."
echo ""
echo " Commands (full directory):"
echo " # cd .."
echo " # chown -R root:<GROUP TO WHICH ROOT BELONGS> $0"
echo ""
echo " 3) Start ${PROGRAM_NAME} again "
echo ""; echo "";
exit 1
fi
#
#################################################################################
#
# Traps
#
#################################################################################
#
trap Maid INT
# Use safe umask for the files we create
umask 027
# Drop out on unintialised variables / fatal errors
#set -u
#
#
#################################################################################
#
# Parameter checks
#
#################################################################################
#
SafePerms ${INCLUDEDIR}/parameters
. ${INCLUDEDIR}/parameters
# Now determine if we are root (UID = 0)
if [ ${MYID} -eq 0 ]; then
PRIVILEGED=1
else
echo "Start ${PROGRAM_NAME} non-privileged"; echo "";
# Implied pentesting mode if not performed by root user
PENTESTINGMODE=1
fi
# Disable logging if no alternative was provided
if [ ${PRIVILEGED} -eq 0 ]; then
if [ "${LOGFILE}" = "" ]; then
LOGFILE="/dev/null"
fi
if [ "${REPORTFILE}" = "" ]; then REPORTFILE="/dev/null"; fi
fi
#
#################################################################################
#
# Program information
#
#################################################################################
#
# CV - Current Version
PROGRAM_AC=`echo ${PROGRAM_version} | awk '{ print $1 }' | sed 's/[.]//g'`
PROGRAM_LV=0
#
#################################################################################
#
# Initialize and default settings
#
#################################################################################
#
if [ ${QUIET} -eq 0 ]; then
echo ""
echo "${WHITE}[ ${PROGRAM_NAME} ${PROGRAM_version} ]${NORMAL}"
#echo "################################################################################"
#echo "${PROGRAM_license}"
#echo ""
#echo " ${PROGRAM_copyright}"
#echo " ${PROGRAM_extrainfo}"
#echo "################################################################################"
fi
if [ "${PROGRAM_releasetype}" = "beta" ]; then
echo "${WHITE}"
echo " #########################################################"
echo " # ${YELLOW}BETA VERSION${WHITE} #"
echo " #########################################################"
echo ""
echo " Thank you for testing a beta release. Make sure to read"
echo " all available documentation before proceeding and/or"
echo " requesting support. Due the nature of beta releases, it"
echo " is possible new features give unexpected warnings."
echo ""
echo ""
echo " #########################################################"
echo "${NORMAL}"; echo ""
fi
#
#################################################################################
#
# Try to find a default profile file, if none is specified
PROFILE=""
if [ "${PROFILE}" = "" ]; then
tPROFILE_TARGETS="/etc/bse.conf /opt/BCLinux/bse/default.prf ./default.prf"
for I in ${tPROFILE_TARGETS}; do
if [ -f ${I} ]; then
PROFILE=${I};
break;
fi
done
fi
if [ "${PROFILE}" = "" ]; then
echo "${RED}Fatal error: ${WHITE}No profile defined and could not find default profile${NORMAL}"
echo "Search paths used --> ${tPROFILE_TARGETS}"
ExitCustom 66
fi
if [ ${SHOW_SETTINGS_FILE} -eq 1 ]; then
echo "Settings file: ${PROFILE}"
echo ""; echo ""
ExitClean
fi
# Initialize and check profile file, auditor name, log file and report file
if [ ! -r ${PROFILE} ]; then echo "Fatal error: Can't open profile file (${PROFILE})"; exit 1; fi
if [ "${AUDITORNAME}" = "" ]; then AUDITORNAME="[Unknown]"; fi
if [ "${LOGFILE}" = "" ]; then LOGFILE=${LOGDIR}"bclinux.log"; fi
if [ "${REPORTFILE}" = "" ]; then REPORTFILE=${LOGDIR}"bclinux-report.dat"; fi
if [ "${DEFINEFILE}" = "" ]; then DEFINEFILE=${INCLUDEDIR}/Defines_Warning.xml; fi
if [ "${TEXTINFOFILE}" = "" ]; then TEXTINFOFILE=${INCLUDEDIR}/TextInfos.xml; fi
#
#################################################################################
#
# PID :: Check PID file, to avoid multiple instances running at the same time.
#
#################################################################################
#
# Decide where to write our PID file. For unprivileged users this will be in their home directory, or /tmp if their
# home directory isn't set. For root it will be /var/run, or the current workign directory if /var/run doesn't exist.
MYHOMEDIR=`echo ~ 2> /dev/null`
if [ "${MYHOMEDIR}" = "" ]; then MYHOMEDIR="/tmp"; fi
if [ ${PRIVILEGED} -eq 0 ]; then
PIDFILE="${MYHOMEDIR}/bclinux.pid"
elif [ -d /var/run ]; then
PIDFILE="/var/run/bclinux.pid"
else
PIDFILE="./bclinux.pid"
fi
# Check if there is already a PID file in any of the locations (incorrect termination of previous instance)
if [ -f "${MYHOMEDIR}/bclinux.pid" -o -f "./bclinux.pid" -o -f "/var/run/bclinux.pid" ]; then
echo ""
echo " ${WARNING}Warning${NORMAL}: ${WHITE}PID file exists, probably another bclinux process is running.${NORMAL}"
echo " ------------------------------------------------------------------------------"
echo " If you are unsure another bclinux process is running currently, you are advised "
echo " to stop current process and check the process list first. If you cancelled"
echo " (by using CTRL+C) a previous instance, you can ignore this message."
echo " "
echo " You are advised to check for temporary files after program completion."
echo " ------------------------------------------------------------------------------"
echo ""
echo " ${YELLOW}Note: ${WHITE}Cancelling the program can leave temporary files behind${NORMAL}"
echo ""
wait_for_keypress
# Deleting any stale PID files that might exist. Note: Display function does not work yet at this point
if [ -f "${MYHOMEDIR}/bclinux.pid" ]; then rm -f "${MYHOMEDIR}/bclinux.pid"; fi
if [ -f "./bclinux.pid" ]; then rm -f "./bclinux.pid"; fi
if [ -f "/var/run/bclinux.pid" ]; then rm -f "/var/run/bclinux.pid"; fi
fi
# Ensure symlink attack is not possible, by confirming there is no symlink of the file already
OURPID=`echo $$`
if [ -L ${PIDFILE} ]; then
echo "Found symlinked PID file (${PIDFILE}), quitting"
ExitFatal
else
# Create new PID file writable only by owner
echo "${OURPID}" > ${PIDFILE}
chmod 600 ${PIDFILE}
fi
#
#################################################################################
#
# Check program parameters
#
#################################################################################
#
# Bail out if we didn't get any parameter, or incorrect ones
if [ ${PARAMCOUNT} -eq 0 -o ${WRONGOPTION} -eq 1 -o ${VIEWHELP} -eq 1 ]; then
TMP=`find option_set -type f| cut -d '/' -f 2 |cut -d '_' -f 2 | head -2`
printf "%s" "
Usage: $0 ${CYAN}command ${WHITE}[options]${NORMAL}
${CYAN}Command:${NORMAL}
${GREEN}auto${NORMAL}
auto : Auto basicly check and fix the system
${GREEN}check${NORMAL}
check basic : Check the system basicly
check advance|adv : Check the system advancly
check rootkit : Check the system rootkit
${GREEN}fix${NORMAL}
fix basic : Basicly fix the system
fix advance|adv : Advancly fix system, using ${PROFILE}
fix ${BROWN}<items>${NORMAL} : Items can be: `echo ${TMP}`, etc.
${GREEN}restore${NORMAL}
restore basic : Restore all basic settings
restore advance|adv : Restore all advanced settings
${GREEN}update${NORMAL}
update info : Show system update details
update database : update security vulnerabilities database
${WHITE}Layout options:${NORMAL}
--no-colors : Don't use colors in output
--quiet (-q) : No output, except warnings
${WHITE}Misc options:${NORMAL}
--version (-V) : Display version number and quit
--help (-h) : Display usage menu and quit
"
if [ ${WRONGOPTION} -eq 1 ]; then
echo " ${RED}Error${NORMAL}: ${WHITE}Invalid option '${WRONGOPTION_value}'${NORMAL}"
echo " ${CYAN}Exiting..${NORMAL}"
#echo ""
else
if [ ${VIEWHELP} -eq 0 ]; then
echo " ${RED}No command provided.${NORMAL}: ${WHITE}Exiting...${NORMAL}"
fi
fi
#echo " More scan options are available. See man page and online documentation for details."
#echo "Exiting.."
# Cleanup PID file if we drop out earlier
RemovePIDFile
# Exit with exit code 1
exit 64
fi
#
#
#################################################################################
#
if [ ${PRIVILEGED} -eq 0 ]; then
echo "${WHITE}"
echo " ###################################################################"
echo " # #"
echo " # ${PURPLE}NON-PRIVILEGED SCAN MODE${WHITE} #"
echo " # #"
echo " ###################################################################"
echo "${NORMAL}"
echo " ${YELLOW}NOTES:${NORMAL}"
echo " --------------"
echo " ${WHITE}*${NORMAL} Some tests will be skipped (as they require root permissions)"
echo " ${WHITE}*${NORMAL} Some tests might fail silently or give different results"
echo ""
if [ "${LOGFILE}" = "" -o "${LOGFILE}" = "/dev/null" ]; then
echo " ${RED}WARNING:${NORMAL}"
echo " ${WHITE}*${NORMAL} No suggestions or warnings will be displayed in report (due to missing log file)"
echo ""
fi
echo ""
echo " ${WHITE}Press [ENTER] to continue or [CTRL] + C to break${NORMAL}"
echo ""
echo " ###################################################################"
echo "${NORMAL}"; echo ""
if [ ${QUICKMODE} -eq 0 ]; then read void; fi
fi
InsertSection "Initializing program"
#
#################################################################################
#
# OS Detection
#
#################################################################################
#
SafePerms ${INCLUDEDIR}/osdetection
. ${INCLUDEDIR}/osdetection
Display --indent 2 --text "- Detecting OS... " --result DONE --color GREEN
# Check hostname
case ${OS} in
HP-UX)
HOSTNAME=`hostname` ;;
Solaris)
HOSTNAME=`uname -n` ;;
*)
HOSTNAME=`hostname -s 2> /dev/null` ;;
esac
FQDN=`hostname 2> /dev/null`
#
#################################################################################
#
# OS_ID an OS_DISTRO Detection
# like OS_ID:BCLinux OS_DISTRO:22.10
#
#################################################################################
#
distro_detection
#over_write OS_NAME value , bclinux system special
[[ -f /etc/bclinux-release ]] && \
OS_VERSION=$(cat /etc/bclinux-release) && \
OS_NAME=${OS_ID}
#
#################################################################################
#
# Clear log and report files
#
#################################################################################
#
# Clear log file and test if it's writable
logtext "### Starting ${PROGRAM_NAME} ${PROGRAM_version} with PID ${OURPID}, build date ${PROGRAM_releasedate} ###" > ${LOGFILE}
if [ $? -gt 0 ]; then
Display --indent 2 --text "- Clearing log file (${LOGFILE})... " --result WARNING --color RED
echo "${WARNING}Fatal error${NORMAL}: problem while writing to log file. Check location and permissions."
RemovePIDFile
exit 1
fi
logtextbreak
logtext "### ${PROGRAM_copyright} ###"
# Clear report file (to avoid appending to an existing file)
echo "# ${PROGRAM_NAME} Report" > ${REPORTFILE}
report "report_version_major=${REPORT_version_major}"
report "report_version_minor=${REPORT_version_minor}"
CDATE=`date "+%F %H:%M:%S"`
report_datetime_start=${CDATE}
report "report_datetime_start=${CDATE}"
report "auditor=${AUDITORNAME}"
report "${PROGRAM_NAME}_version=${PROGRAM_version}"
report "os=${OS}"
report "os_name=${OS_NAME}"
report "os_fullname=${OS_FULLNAME}"
report "os_version=${OS_VERSION}"
if [ "${OS}" = "Linux" ]; then report "linux_version=${LINUX_VERSION}"; fi
report "hostname=${HOSTNAME}"
#
#################################################################################
#
# Show program information to display
#
#################################################################################
#
if [ ${QUIET} -eq 0 -a ${SHOW_PROGRAM_DETAILS} -eq 1 ]; then
echo ""
echo " ---------------------------------------------------"
echo " Program version: ${PROGRAM_version}"
echo " Operating system: ${OS}"
echo " Operating system name: ${OS_NAME}"
echo " Operating system version: ${OS_VERSION}"
if [ ! "${OS_MODE}" = "" ]; then echo " Operating system mode: ${OS_MODE}"; fi
echo " Kernel version: ${OS_KERNELVERSION}"
echo " Hardware platform: ${HARDWARE}"
echo " Hostname: ${HOSTNAME}"
echo " Auditor: ${AUDITORNAME}"
echo " Profile: ${PROFILE}"
echo " Log file: ${LOGFILE}"
echo " Report file: ${REPORTFILE}"
echo " Report version: ${REPORT_version}"
echo " Plugin directory: ${PLUGINDIR}"
echo " ---------------------------------------------------"
fi
logtext "Program version: ${PROGRAM_version}"
logtext "Operating system: ${OS}"
logtext "Operating system name: ${OS_NAME}"
logtext "Operating system version: ${OS_VERSION}"
if [ ! "${OS_MODE}" = "" ]; then logtext "Operating system mode: ${OS_MODE}"; fi
logtext "Kernel version: ${OS_KERNELVERSION}"
if [ ! "${OS_KERNELVERSION_FULL}" = "" ]; then
logtext "Kernel version (full): ${OS_KERNELVERSION_FULL}"
fi
logtext "Hardware platform: ${HARDWARE}"
logtext "-----------------------------------------------------"
logtext "Hostname: ${HOSTNAME}"
logtext "Auditor: ${AUDITORNAME}"
logtext "Profile: ${PROFILE}"
logtext "Include directory: ${INCLUDEDIR}"
logtext "Plugin directory: ${PLUGINDIR}"
logtext "-----------------------------------------------------"
logtext "Log file: ${LOGFILE}"
logtext "Report file: ${REPORTFILE}"
logtext "Report version: ${REPORT_version}"
logtext "-----------------------------------------------------"
logtext "BusyBox used: ${SHELL_IS_BUSYBOX}"
logtextbreak
#
#################################################################################
#
# Read profile/template/plugins
#
#################################################################################
#
SafePerms ${INCLUDEDIR}/profiles
. ${INCLUDEDIR}/profiles
#
#################################################################################
#
# Check for program update (people tend to be lazy and don't perform updates =))
#
#################################################################################
#
logtext "Test: Checking for program update..."
UPDATE_AVAILABLE=0
if [ ${SKIP_UPGRADE_TEST} -eq 1 ]; then
logtext "Upgrade test skipped due profile option set (skip_upgrade_test)"
Display --indent 2 --text "- Check bse update by profile option set..." --result "SKIPPING" --color YELLOW
PROGRAM_LV="${PROGRAM_AC}"
else
CheckUpdates
fi
if [ "${PROGRAM_AC}" = "" -o "${PROGRAM_LV}" = "" ]; then
Display --indent 2 --text "- Program update status... " --result UNKNOWN --color YELLOW
logtext "Result: Update check failed. No network connection?"
logtext "Info: to perform an automatic update check, outbound DNS connections should be allowed (TXT record)."
# Set both to safe values
PROGRAM_AC=0; PROGRAM_LV=0
else
logtext "Current installed version : ${PROGRAM_AC}"
logtext "Latest stable version : ${PROGRAM_LV}"
if [ ${PROGRAM_LV} -gt ${PROGRAM_AC} ]; then
# Check if current version is REALLY outdated (10 versions ago)
PROGRAM_MINVERSION=`expr ${PROGRAM_LV} - 10`
logtext "Minimum required version : ${PROGRAM_MINVERSION}"
if [ ${PROGRAM_MINVERSION} -gt ${PROGRAM_AC} ]; then
Display --indent 2 --text "- Program update status... " --result "WARNING" --color RED
logtext "Result: This version is VERY outdated. Newer ${PROGRAM_NAME} release available!"
ReportWarning "NONE" "Version of ${PROGRAM_NAME} is very old and should be updated"
report "${PROGRAM_NAME}_update_available=1"
UPDATE_AVAILABLE=1
else
Display --indent 2 --text "- Program update status... " --result "UPDATE AVAILABLE" --color YELLOW
logtext "Result: newer ${PROGRAM_NAME} release available!"
ReportSuggestion "NONE" "Version of ${PROGRAM_NAME} outdated, consider upgrading to the latest version"
report "${PROGRAM_NAME}_update_available=1"
UPDATE_AVAILABLE=1
fi
echo ""
echo " ==============================================================================="
echo " ${NOTICE}${PROGRAM_NAME} update available${NORMAL}"
echo " ==============================================================================="
echo ""
echo " Current version : ${YELLOW}${PROGRAM_AC}${NORMAL} Latest version : ${GREEN}${PROGRAM_LV}${NORMAL}"
echo ""
echo " ${WHITE}Please update to the latest version for new features, bug fixes, tests"
echo " and baselines.${NORMAL}"
echo ""
echo " https://www.bclinux.org"
echo ""
echo " ==============================================================================="
echo ""
sleep $TEST_PAUSE_TIME
wait_for_keypress
else
if [ ${UPDATE_CHECK_SKIPPED} -eq 0 ]; then
Display --indent 2 --text "- Program update status... " --result "NO UPDATE" --color GREEN
logtext "No ${PROGRAM_NAME} update available."
report "${PROGRAM_NAME}_update_available=0"
else
Display --indent 2 --text "- Program update status... " --result "SKIPPED" --color YELLOW
logtext "Update check skipped due to constraints (e.g. missing dig binary)"
report "${PROGRAM_NAME}_update_available=-1"
fi
fi
fi
logtextbreak
#
#################################################################################
#
# Check which binaries are available to the scanning process
if [ -f ${INCLUDEDIR}/binaries ]; then
SafePerms ${INCLUDEDIR}/binaries
#. ${INCLUDEDIR}/binaries
fi
logtextbreak
#
#################################################################################
#
# Check if this is a virtual machine (after the appropriate binaries are found)
IsVirtualMachine
if [ ${ISVIRTUALMACHINE} -eq 1 ]; then
LogText "Result: found virtual machine (type: ${VMTYPE}, ${VMFULLTYPE})"
Report "vm=1"
Report "vmtype=${VMTYPE}"
Display --indent 2 --text "- Found virtual machine (type: ${VMTYPE}, ${VMFULLTYPE}) " --result "DONE" --color GREEN
elif [ ${ISVIRTUALMACHINE} -eq 2 ]; then
LogText "Result: unknown if this system is a virtual machine"
Report "vm=2"
Display --indent 2 --text "- Unknown if this system is a virtual machine " --result "Warning" --color YELLOW
else
LogText "Result: system seems to be non-virtual"
Display --indent 2 --text "- System seems to be non-virtual" --result "DONE" --color GREEN
fi
#
#################################################################################
#
#if [ ${RUN_PLUGINS} -eq 1 ]; then
if [ 0 ]; then
N_PLUGIN=0
N_PLUGIN_ENABLED=0
# Plugins function
RunPlugins()
{
if [ $# -eq 0 ]; then echo "RunPlugins should be started with phase number"; ExitFatal; fi
PLUGIN_PHASE=$1
if [ ${PLUGIN_PHASE} -eq 0 -o ${PLUGIN_PHASE} -gt 2 ]; then echo "Incorrect phase number when calling RunPlugins"; ExitFatal; fi
logtextbreak
#InsertPluginSection "Plugins (phase ${PLUGIN_PHASE})"
InsertSection "Plugins (phase ${PLUGIN_PHASE})"
if [ ${PLUGIN_PHASE} -eq 1 ]; then
Display --text "Note: plugins have more extensive tests, which may take a few minutes to complete"
Display --text " "
logtext "Searching plugins..."
fi
# Search plugins
FIND_PLUGINS=`find ${PLUGINDIR} -type f -name "plugin_[a-z]*" -exec echo \{\} \; | sort`
for PLUGIN_FILE in ${FIND_PLUGINS}; do
logtext "Found plugin file: ${PLUGIN_FILE}"
# Double check if output is a valid file name
if [ -f ${PLUGIN_FILE} ]; then
FIND2=`grep "^# PLUGIN_NAME=" ${PLUGIN_FILE} | awk -F= '{ print $2 }'`
if [ ! "${FIND2}" = "" -a ! "${FIND2}" = "[plugin_name]" ]; then
if [ ${PLUGIN_PHASE} -eq 1 ]; then N_PLUGIN=`expr ${N_PLUGIN} + 1`; fi
FIND3=`grep "^plugin=${FIND2}" ${PROFILE}`
if [ ! "${FIND3}" = "" ]; then
logtext "Plugin ${FIND2} is enabled"
# Plugins should have at least a _phase1 part, _phase2 is optional at this moment
PLUGINFILE="${PLUGINDIR}/plugin_${FIND2}_phase${PLUGIN_PHASE}"
if [ -f ${PLUGINFILE} ]; then
PLUGIN_VERSION=`grep "^# PLUGIN_VERSION=" ${PLUGIN_FILE} | awk -F= '{ print $2 }'`
PLUGIN_VERSION_NODOTS=`echo ${PLUGIN_VERSION} | sed 's/.//g'`
FIND4=`ls -l ${PLUGINFILE} | cut -c 2-10`
if [ "${FIND4}" = "rw-r--r--" -o "${FIND4}" = "rw-r-----" -o "${FIND4}" = "rw-------" -o "${FIND4}" = "r--------" ]; then
logtext "Including plugin file: ${PLUGINFILE} (version: ${PLUGIN_VERSION})"
report "plugin_enabled_phase${PLUGIN_PHASE}[]=${FIND2}|${PLUGIN_VERSION}|"
if [ ${PLUGIN_PHASE} -eq 1 ]; then N_PLUGIN_ENABLED=`expr ${N_PLUGIN_ENABLED} + 1`; fi
Display --indent 2 --text "- ${CYAN}Plugin${NORMAL}: ${WHITE}${FIND2}${NORMAL}"
if [ ${PLUGIN_PHASE} -eq 1 ]; then Progress " ["; fi
. ${PLUGINFILE}
if [ ${PLUGIN_PHASE} -eq 1 ]; then Progress "]"; Progress --finish; fi
logtextbreak
logtext "Result: ${FIND2} plugin (phase ${PLUGIN_PHASE}) finished"
else
logtext "Plugin ${FIND2}: Skipped (bad file permissions, should be 640, 600 or 400)"
fi
else
logtext "Plugin ${FIND2}: Skipped (can't find file ${PLUGINFILE})"
fi
else
logtext "Plugin ${FIND2}: Skipped (not enabled)"
fi
else
logtext "Skipping plugin file ${PLUGIN_FILE} (no valid plugin name found)"
fi
fi
logtext "--"
done
logtext "Result: Found ${N_PLUGIN} plugins of which ${N_PLUGIN_ENABLED} are enabled"
logtext "Result: Plugins ${PLUGIN_PHASE} finished"
}
RunPlugins 1
if [ ${N_PLUGIN_ENABLED} -eq 0 ]; then
Display --indent 2 --text "- Plugins enabled " --result "NONE" --color WHITE
report "plugins_enabled=0"
else
report "plugins_enabled=1"
fi
fi
#
#################################################################################
#
# auto check and fix the system security weekness.
#
#################################################################################
#
if [ ${AUTOFIX_SYSTEM} -eq 1 ];then
#do fix first
bc_fix_sys
#check the system later
bc_check_sys
fi
#
#################################################################################
#
# check the system basicly
#
#################################################################################
#
if [ ${CHECK_SYSTEM} -eq 1 ];then
#log "Starting check the ${OS_NAME} system..."
bc_check_sys
fi
#
#################################################################################
#
# check the system advancly
#
#################################################################################
#
if [ ${CHECK_ADVANCE} -eq 1 ];then
#log "Starting check the ${OS_NAME} system..."
bc_check_adv
fi
#
#################################################################################
#
# check the system rootkit
#
#################################################################################
#
if [ ${CHECK_ROOTKIT} -eq 1 ];then
bc_check_rootkit
fi
#
#################################################################################
#
# do basic fix
#
#################################################################################
#
if [ ${FIX_SYSTEM} -eq 1 ];then
bc_fix_sys
fi
#
#################################################################################
#
# do advance fix, include basic fix;
# also include advance option, also deny ssh, move issue, etc.
#
#################################################################################
#
if [ ${FIX_ADVANCE} -eq 1 ];then
bc_fix_sys_avd
fi
#
#################################################################################
#
# fix the specify items( just fix the error items )
#
#################################################################################
#
if [ ${FIX_SPECIFY_ITEMS} -eq 1 ];then
if [ ! -z ${FIX_ITEMS} ];then
#fix the specify items..."
bc_fix_sys_by_items ${FIX_ITEMS}
fi
fi
#
#################################################################################
#
# restore the basicly settings or advancly settings by this tool.
#
#################################################################################
#
if [ ${RESTORE_SYSTEM} -eq 1 ];then
bc_restore_basic_settings
fi
if [ ${RESTORE_ADVANCE} -eq 1 ];then
bc_restore_adv_settings
fi
#
#################################################################################
#
# see the update info
#
#################################################################################
#
if [ ${UPDATE_INFO} -eq 1 ];then
InsertSection "check the update info"
UPDATES_COUNT=$(yum check-update --quiet | grep -v "^$" | wc -l)
if [[ $UPDATES_COUNT -gt 0 ]]; then
Display --indent 2 --text "- ${UPDATES_COUNT} packages can be updated... " --result OK --color GREEN
printf "Note: type 'yum check-update' to see update information.\n"
fi
fi
#
#################################################################################
#
# update some software changes from mirrors.bclinux.org.
#
#################################################################################
#
if [ ${UPDATE_CHANGELOG} -eq 1 ];then
# bc_update_changelog
bc_update_cve_db #update cve database.
fi
#
#################################################################################
#
# end the shell
#
#################################################################################
#
logtext "${PROGRAM_name} ${PROGRAM_version}"
logtext "${PROGRAM_copyright}"
logtext "${PROGRAM_extrainfo}"
logtext "Program ended successfully"
logtext "================================================================================"
cleanup #clean the /tmp file
# Clean exit (Delete PID file)
if [ ${TOTAL_WARNINGS} -gt 0 ]; then
ExitCustom 78
else
ExitClean
fi
# The End
###########################################################################
##%HASH-SHA1%----------------------------%
###########################################################################