#!/bin/sh

#=======================================================
InsertSection "check the vsftp configuration"


if [ -f /etc/vsftpd/vsftpd.conf ];then
    cp -np /etc/vsftpd/vsftpd.conf /etc/vsftpd/vsftpd.conf_bak

    #-----------------check anonymous_enable=NO------------------
    #sed -i 's/anonymous_enable=YES/anonymous_enable=NO/' /etc/vsftpd/vsftpd.conf

    IS_EXIST=`grep -i '^anonymous_enable=NO' /etc/vsftpd/vsftpd.conf | wc -l`
    if [ $IS_EXIST -gt 0 ];then
        logtext  "The vsftpd's anonymous_enable is NO, check OK"
        Display --indent 2 --text "- Check vsftpd anonymous_enable setting... " --result OK --color GREEN
        AddHP 1 1
    else
        echo "c23 anonymous_enable" >> $RESULT_FILE
        echo "" >> $RESULT_FILE
        logtext "WRN_C23_01: $(loadtext TXT_WRN_C23_01)"
        logtext "Suggestion: $(loadtext TXT_SUG_C23_01)"
        Display --indent 2 --text "- Check vsftpd anonymous_enable setting... " --result WARNING --color RED
        Display --indent 2 --text "anonymous_enable is not set to 'NO', check warning"
        AddHP 0 1

    fi

    #-----------------check vsftp banner------------------
    IS_EXIST=`grep -Ev '^$|^#' /etc/vsftpd/vsftpd.conf | grep ftpd_banner | wc -l`
    if [ ${IS_EXIST} -gt 0 ];then
        logtext "has ftpd_banner set, passing..."
        Display --indent 2 --text "- Check vsftpd ftp_banner setting... " --result OK --color GREEN
        AddHP 1 1
    else
        echo "c23 ftp_banner" >> $RESULT_FILE
        echo "" >> $RESULT_FILE
        logtext "WRN_C23_02: $(loadtext TXT_WRN_C23_02)"
        logtext "Suggestion: $(loadtext TXT_SUG_C23_02)"
        Display --indent 2 --text "- Check vsftpd ftp_banner setting... " --result WARNING --color RED
        Display --indent 2 --text "ftp_banner is not set , check warning"
        AddHP 0 1
        #echo  "" >> /etc/vsftpd/vsftpd.conf
        #echo -e "ftpd_banner=\"ATTENTION:You have logged onto a secured server..All accesses logged.\"" >> /etc/vsftpd/vsftpd.conf
    fi

    #-----------------check user ftp login------------------
    #sed -i 's/^userlist_enable=.*/userlist_enable=YES/' /etc/vsftpd/vsftpd.conf

    IS_EXIST=`grep -i '^userlist_enable=YES' /etc/vsftpd/vsftpd.conf | wc -l`
    if [ $IS_EXIST -gt 0 ];then
        logtext  "The vsftpd's userlist_enable is YES, check OK"
        Display --indent 2 --text "- Check vsftpd userlist_enable setting... " --result OK --color GREEN
        AddHP 1 1
    else
        echo "c23 anonymous_enable" >> $RESULT_FILE
        echo "" >> $RESULT_FILE
        logtext "WRN_C23_03: $(loadtext TXT_WRN_C23_03)"
        logtext "Suggestion: $(loadtext TXT_SUG_C23_03)"
        Display --indent 2 --text "- Check vsftpd userlist_enable setting... " --result WARNING --color RED
        Display --indent 2 --text "userlist_enable is not set to 'YES', check warning"
        AddHP 0 1

    fi

    #-----------------restrict user ftp login------------------
    IS_EXIST=`grep -Ev '^$|^#' /etc/vsftpd/ftpusers | grep root | wc -l`
    if [ ${IS_EXIST} -gt 0 ];then
        logtext "The ftpusers config file contains user:root set, check ok..."
        Display --indent 2 --text "- Check vsftpd ftpusers setting... " --result OK --color GREEN
        AddHP 1 1
    else
        echo "c23 ftpusers" >> $RESULT_FILE
        echo "" >> $RESULT_FILE
        logtext "WRN_C23_04: $(loadtext TXT_WRN_C23_04)"
        logtext "Suggestion: $(loadtext TXT_SUG_C23_04)"
        Display --indent 2 --text "- Check vsftpd ftpusers setting... " --result WARNING --color RED
        Display --indent 2 --text "userlist_enable is not set to 'YES', check warning"
        AddHP 0 1
        #echo  "" >> /etc/vsftpd/ftpusers
        #echo -e "root" >> /etc/vsftpd/ftpusers
        #此文件用于保存不允许进行FTP登录的本地用户帐号。就是vsftp用户的黑名单,此文件可在/etc/pam.d/vsftpd中指定
    fi

else
    logtext  "/etc/vsftpd/vsftpd.conf not found, or it does not installed"
    Display --indent 2 --text "- No vsftpd.conf found, maybe vsftp not installed, ... " --result SKIPPED --color YELLOW
    AddHP 1 1
fi