File: //opt/BCLinux/bse/include/report
#!/bin/sh
#################################################################################
#
# BCLinux
# ------------------
#
# BCLinux comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Report
#
#################################################################################
#
HTML_REPORT_DIRNAME="html_report"
#
#################################################################################
#
# Hardening Index
# Define approximately how strong a machine has been hardened
#
#################################################################################
#
# If no hardening has been found, set value to 1
if [ ${HPPOINTS} -eq 0 ]; then HPPOINTS=1; HPTOTAL=100; fi
HPINDEX=`expr $HPPOINTS \* 100 / $HPTOTAL`
HPAOBLOCKS=`expr $HPPOINTS \* 20 / $HPTOTAL`
# Set color related to rating
if [ ${HPINDEX} -lt 50 ]; then
HPCOLOR="${RED}"
HIDESCRIPTION="System has not or a low amount been hardened"
SECURE_LEVEL="非常危险"
SECURE_IMG="b_high.gif"
fi
if [ ${HPINDEX} -gt 49 -a ${HPINDEX} -lt 80 ]; then
HPCOLOR="${YELLOW}"
HIDESCRIPTION="System has been hardened, but could use additional hardening"
SECURE_LEVEL="中等危险"
SECURE_IMG="b_middle.gif"
fi
if [ ${HPINDEX} -gt 79 -a ${HPINDEX} -lt 90 ]; then
HPCOLOR="${GREEN}"
HIDESCRIPTION="System seem to be decent hardened"
SECURE_LEVEL="较为良好"
SECURE_IMG="b_low.gif"
fi
if [ ${HPINDEX} -gt 89 ]; then
HPCOLOR="${GREEN}"
HIDESCRIPTION="System seem to be well hardened"
SECURE_LEVEL="非常安全"
SECURE_IMG="b_safe.gif"
fi
case ${HPAOBLOCKS} in
0) HPBLOCKS="#"; HPEMPTY=" " ;;
1) HPBLOCKS="#"; HPEMPTY=" " ;;
2) HPBLOCKS="##"; HPEMPTY=" " ;;
3) HPBLOCKS="###"; HPEMPTY=" " ;;
4) HPBLOCKS="####"; HPEMPTY=" " ;;
5) HPBLOCKS="#####"; HPEMPTY=" " ;;
6) HPBLOCKS="######"; HPEMPTY=" " ;;
7) HPBLOCKS="#######"; HPEMPTY=" " ;;
8) HPBLOCKS="########"; HPEMPTY=" " ;;
9) HPBLOCKS="#########"; HPEMPTY=" " ;;
10) HPBLOCKS="##########"; HPEMPTY=" " ;;
11) HPBLOCKS="###########"; HPEMPTY=" " ;;
12) HPBLOCKS="############"; HPEMPTY=" " ;;
13) HPBLOCKS="#############"; HPEMPTY=" " ;;
14) HPBLOCKS="##############"; HPEMPTY=" " ;;
15) HPBLOCKS="###############"; HPEMPTY=" " ;;
16) HPBLOCKS="################"; HPEMPTY=" " ;;
17) HPBLOCKS="#################"; HPEMPTY=" " ;;
18) HPBLOCKS="##################"; HPEMPTY=" " ;;
19) HPBLOCKS="###################"; HPEMPTY=" " ;;
20) HPBLOCKS="####################"; HPEMPTY="" ;;
esac
HPGRAPH="[${HPCOLOR}${HPBLOCKS}${NORMAL}${HPEMPTY}]"
LogText "Hardening index : [${HPINDEX}] [${HPBLOCKS}${HPEMPTY}]"
LogText "Hardening strength: ${HIDESCRIPTION}"
# Only show overview if not running in quiet mode
if [ ${QUIET} -eq 0 ]; then
echo ""; echo "================================================================================"
echo ""; echo " -[ ${WHITE}${PROGRAM_name} ${PROGRAM_version} Results${NORMAL} ]-"
echo "";
if [ ${SHOW_REPORT} -eq 1 ]; then
logtextbreak
#
#################################################################################
#
# Show test results overview
#
#################################################################################
#
#if [ "${CONTROL_URL_PROTOCOL}" = "" ]; then CONTROL_URL_PROTOCOL="https"; fi
#if [ "${CONTROL_URL_PREPEND}" = "" ]; then CONTROL_URL_PREPEND="cisofy.com/controls/"; fi
#if [ "${CONTROL_URL_APPEND}" = "" ]; then CONTROL_URL_APPEND="/"; fi
#if [ "${CUSTOM_URL_PROTOCOL}" = "" ]; then CUSTOM_URL_PROTOCOL="https"; fi
#if [ "${CUSTOM_URL_PREPEND}" = "" ]; then CUSTOM_URL_PREPEND="your-domain.example.org/controls/"; fi
#if [ "${CUSTOM_URL_APPEND}" = "" ]; then CUSTOM_URL_APPEND="/"; fi
if [ "${CONTROL_URL_PROTOCOL}" = "" ]; then CONTROL_URL_PROTOCOL="http"; fi
if [ "${CONTROL_URL_PREPEND}" = "" ]; then CONTROL_URL_PREPEND="bclinux.org/controls/"; fi
if [ "${CONTROL_URL_APPEND}" = "" ]; then CONTROL_URL_APPEND="/"; fi
if [ "${CUSTOM_URL_PROTOCOL}" = "" ]; then CUSTOM_URL_PROTOCOL="http"; fi
if [ "${CUSTOM_URL_PREPEND}" = "" ]; then CUSTOM_URL_PREPEND="your-domain.example.org/controls/"; fi
if [ "${CUSTOM_URL_APPEND}" = "" ]; then CUSTOM_URL_APPEND="/"; fi
#----------------------------------------------------------------------------------
# Show warnings from logfile
TMP_COUNT=1
SWARNINGS=$(grep "WRN" ${LOGFILE})
TOTAL_WARNINGS=$(echo "$SWARNINGS" | sed 's/ /!space!/g' | wc -l)
if [ "${SWARNINGS}" = "" ]; then
echo " ${OK}No warnings${NORMAL}"; echo ""
else
echo " ${RED}BaseLine Warnings${NORMAL} (${TOTAL_WARNINGS}):"
echo " ${WHITE}----------------------------${NORMAL}"
baselineInfo_file="/tmp/baselineInfo"
touch ${baselineInfo_file}
> ${baselineInfo_file}
grep "WRN" ${LOGFILE} | while read WARN; do
#[2017/07/12 11:26:32] WRN_C03_01: No Password dcredit set
INDEX=$(echo $WARN | sed -r 's/.*(WRN[a-zA-Z0-9_]+):.*/\1/g') #WRN_C01
WVAR="TXT_"$INDEX #TXT_WRN_C01
WARNTXT=$(loadtext $WVAR)
if [ "$WARNTXT" = "" ];then
WARNTXT=$(echo $WARN | sed -r 's/.*WRN[A-Za-z0-9_]+: ([^"]*)/\1/g')
fi
TMP=$(grep -A 1 "$WVAR" ${DEFINEFILE} | tail -1 | grep "Suggestion")
if [ "$TMP" = "" ];then
SUGTXT=""
else
SVAR=$(echo $TMP | sed -r 's/.*description="([_a-zA-Z0-9]+)".*/\1/g') #TXT_SUG_C01
SUGTXT=$(loadtext $SVAR)
fi
#echo " ${RED}- ${INDEX}: ${WARNTXT}${NORMAL}"
echo " ${RED}- ${WARNTXT} ${NORMAL}"
cat <<- _EOF_ >> ${baselineInfo_file}
<tr style="cursor:pointer; border:solid 1px #ddd;">
<td>${TMP_COUNT}</td>
<!-- <td>用户权限</td> -->
<td>${WARNTXT}</span>
</td>
<td>${SUGTXT}</td>
</tr>
_EOF_
TMP_COUNT=$(expr ${TMP_COUNT} + 1)
done
baseline_info=$(cat ${baselineInfo_file})
rm -rf ${baselineInfo_file}
echo ""
fi
#----------------------------------------------------------------------------------
#eWVAR="TXT_"$INDEX #TXT_WRN_C01how cve info form log file
TMP_CVE_COUNT=1
SCVES=$(grep -i 'cve-[0-9]\{3,4\}-[0-9]\{4,9\}|' ${LOGFILE} | sort | sed 's/ /!space!/g' )
TOTAL_CVES=$(echo "$SCVES" | wc -l)
CVE_OUTPUT_ACTION=0
if [ "${SCVES}" = "" ]; then
echo " ${OK}No vulnerabilities${NORMAL}"; echo ""
else
echo " ${RED}Vulnerabilities Details${NORMAL} (${TOTAL_CVES}):"
echo " ${WHITE}----------------------------${NORMAL}"
vulneInfo_file="/tmp/vulneInfo"
touch ${vulneInfo_file}
> ${vulneInfo_file}
for WARN in $SCVES # CVE-2016-2106| CVE-xxx-xx|
do
#[2016/11/30 17:45:28] ID|SCORE|VECTOR|ACCESS_COMP|RHSA|PRODUCT|VERSION|SUMMARY
#[2016/11/30 18:45:28] CVE-2016-6515|5.3|Network|Low|RHSA-2017:2029|openssh|7.4p1-11.el7|It was found...
CVE_ALL_INFO=$(echo "$WARN" |sed 's/!space!/ /g' | cut -b 23-)
CVE_NUM=$(echo $CVE_ALL_INFO | cut -d "|" -f1)
CVE_SCORE=$( echo $CVE_ALL_INFO | cut -d "|" -f2 )
CVE_VECTOR=$( echo $CVE_ALL_INFO | cut -d "|" -f3 )
CVE_ACCESS_COMP=$( echo $CVE_ALL_INFO | cut -d "|" -f4 )
CVE_RHSA=$( echo $CVE_ALL_INFO| cut -d "|" -f5 )
CVE_AFFECT_PAK=$( echo $CVE_ALL_INFO | cut -d "|" -f6)
CVE_FIX_VERSION=$( echo $CVE_ALL_INFO | cut -d "|" -f7)
CVE_SUMMARY=$( echo $CVE_ALL_INFO | cut -d "|" -f8 )
cat <<- _EOF_ >> ${vulneInfo_file}
<tr style="cursor:pointer; border:solid 1px #ddd;">
<td>${TMP_CVE_COUNT}</td>
<td>$CVE_NUM</td>
<td>${CVE_AFFECT_PAK}</td>
<td>$CVE_FIX_VERSION</td>
<td>$CVE_SCORE</td>
<td>$CVE_VECTOR</td>
<td>$CVE_ACCESS_COMP</td>
<td>$CVE_RHSA</td>
<td>${CVE_SUMMARY}</td>
</tr>
_EOF_
# skip output to much cve info.
if [ ${TMP_CVE_COUNT} -le $CVE_REPORT_MAX_ITEMS ];then
echo -e " ${RED}- $CVE_NUM: ${CVE_SUMMARY}\n Fixed in: ${CVE_AFFECT_PAK}-${CVE_FIX_VERSION} ${NORMAL}"
echo ""
else #skip output to much cve info.
if [ ${CVE_OUTPUT_ACTION} -eq 0 ];then
echo "This system has more than $CVE_REPORT_MAX_ITEMS CVEs, skip output too much info on shell console. You can see html report for details."
echo "Also you can change the max cve output count:cve_report_max_items=${TOTAL_CVES} in ${PROFILE}, and rerun bse to see all cves info."
CVE_OUTPUT_ACTION=1
fi
fi
TMP_CVE_COUNT=$(expr ${TMP_CVE_COUNT} + 1)
done
cve_info=$(cat ${vulneInfo_file})
rm -rf ${vulneInfo_file}
echo ""
fi
#----------------------------------------------------------------------------------
# Show infected from logfile
TMP_rootkit_COUNT=1
SROOTKIT=$(egrep "^Checking|^Searching" ${LOGFILE} | sed 's/ /!space!/g')
ROOTKIT_INFECTED=$(grep "INFECTED" ${LOGFILE} | sed 's/ /!space!/g')
TOTAL_INFECTED=$(echo "$ROOTKIT_INFECTED" | wc -l)
rootkitInfo_file="/tmp/rootkitInfo"
touch ${rootkitInfo_file}
> ${rootkitInfo_file}
if [ "${ROOTKIT_INFECTED}" = "" ]; then #not infected
echo " ${OK}No INFECTED ${NORMAL}";
local TOTAL_INFECTED=0
else
echo " ${RED}INFECTED ${NORMAL} (${TOTAL_INFECTED}):"
echo " ${WHITE}----------------------------${NORMAL}"
fi
for tmp_ROOTKIT in $SROOTKIT
do
ROOTKIT_CHECK_INFO=$(echo $tmp_ROOTKIT | sed 's/!space!/ /g') #Checking `asp'... not infected
tmp_count=$(echo $ROOTKIT_CHECK_INFO | grep "INFECTED" | wc -l)
if [[ $tmp_count -gt 0 ]]; then #infected
rootkit_info1=$(cat ${LOGFILE} | grep -A 1 "${ROOTKIT_CHECK_INFO}" )
count1=$(echo $rootkit_info | egrep -o "Checking|Searching" | wc -l)
if [[ $count1 -gt 1 ]]; then
infected_info=$ROOTKIT_CHECK_INFO
else
rootkit_info2=$(cat ${LOGFILE} | grep -A 2 "${ROOTKIT_CHECK_INFO}")
count2=$(echo $rootkit_info2 | egrep -o "Checking|Searching" | wc -l)
if [[ $count2 -gt 1 ]]; then
infected_info=${rootkit_info1}
else
infected_info=${rootkit_info2}
fi
fi
echo " ${RED}- ${infected_info} ${NORMAL}"
SUGTXT="请重新检查问题文件，或删除病毒文件， 或重装系统"
cat <<- _EOF_ >> ${rootkitInfo_file}
<tr style="cursor:pointer; border:solid 1px #ddd;">
<td>${TMP_rootkit_COUNT}</td>
<!--
<td> <font color="red"> ${ROOTKIT_CHECK_INFO} </font> </td>
-->
<td> <font color="red"> ${infected_info} </font> </td>
<td>${SUGTXT}</td>
</tr>
_EOF_
else #ok
ok_tempinfo=$(cat ${LOGFILE} | grep -A 1 "${ROOTKIT_CHECK_INFO}")
count3=$(echo $ok_tempinfo | egrep -o "Checking|Searching" | wc -l)
if [[ $count3 -gt 1 ]]; then
ok_info=${ROOTKIT_CHECK_INFO}
else
ok_info=${ok_tempinfo}
fi
SUGTXT="ok"
cat <<- _EOF_ >> ${rootkitInfo_file}
<tr style="cursor:pointer; border:solid 1px #ddd;">
<td>${TMP_rootkit_COUNT}</td>
<!--
<td>${ROOTKIT_CHECK_INFO}</td>
-->
<td>${ok_info}</td>
<td>${SUGTXT}</td>
</tr>
_EOF_
fi
TMP_rootkit_COUNT=$(expr ${TMP_rootkit_COUNT} + 1)
done
rootkit_info=$(cat ${rootkitInfo_file}) #rootkit_info 对应c41脚本
rm -rf ${rootkitInfo_file}
echo ""
#----------------------------------------------------------------------------------
# show suggestions
SSUGGESTIONS=`grep -i 'Suggestion' ${LOGFILE} | sed 's/ /!space!/g'`
TOTAL_SUGGESTIONS=`grep -i 'Suggestion' ${LOGFILE} | sed 's/ /!space!/g' | wc -l`
if [ "${SSUGGESTIONS}" = "" ]; then
echo " ${OK}No suggestions${NORMAL}"; echo ""
else
echo " ${GREEN}Suggestions${NORMAL} (${TOTAL_SUGGESTIONS}):"
echo " ${GREEN}----------------------------${NORMAL}"
echo " ${WHITE}-${NORMAL} There are ${TOTAL_SUGGESTIONS} suggestions, you can see html report for details"
#for SUGGESTION in ${SSUGGESTIONS}; do
# SHOWSUGGESTION=`echo ${SUGGESTION} | sed 's/!space!/ /g' | sed 's/^\[\(.*\)\] Suggestion: //' | sed 's/\[details:\(.*\)\] \[solution:\(.*\)\]//' | sed 's/test://'`
# echo " - ${SHOWSUGGESTION}"
#done
echo ""
fi
if [ ! "${SWARNINGS}" = "" -o ! "${SSUGGESTIONS}" = "" ]; then
echo " ${CYAN}Follow-up${NORMAL}:"
echo " ${WHITE}----------------------------${NORMAL}"
echo " ${WHITE}-${NORMAL} Check the logfile for more details (less $LOGFILE)"
echo " ${WHITE}-${NORMAL} Read security controls texts (http://bclinux.org)"
echo " ${WHITE}-${NORMAL} Use --upload to upload data (BCLinux Enterprise users)"
echo ""
fi
echo "================================================================================"
echo ""
echo " ${WHITE}BCLinux security scan details${NORMAL}:"
echo ""
#echo " ${CYAN}Hardening index${NORMAL} : ${WHITE}${HPINDEX}${NORMAL} ${HPGRAPH}"
# echo " ${CYAN}Tests performed${NORMAL} : ${WHITE}${CTESTS_PERFORMED}${NORMAL}"
# echo " ${CYAN}Plugins enabled${NORMAL} : ${WHITE}${N_PLUGIN_ENABLED}${NORMAL}"
echo " ${CYAN}Total check index${NORMAL} : ${WHITE}${HPTOTAL}${NORMAL}"
echo " ${CYAN}Checking OK index${NORMAL} : ${WHITE}${HPPOINTS}${NORMAL}"
echo " ${CYAN}Harden percentage${NORMAL} : ${WHITE}${HPINDEX}%${NORMAL} ${HPGRAPH}"
echo ""
# echo " ${WHITE}Quick overview${NORMAL}:"
# if [ ${FIREWALL_ACTIVE} -eq 1 ]; then FIREWALL="${GREEN}V"; else FIREWALL="${RED}X"; fi
# if [ ${MALWARE_SCANNER_INSTALLED} -eq 1 ]; then MALWARE="${GREEN}V"; else MALWARE="${RED}X"; fi
#
# echo " - Firewall [${FIREWALL}${NORMAL}] - Malware scanner [${MALWARE}${NORMAL}]"
#
# echo ""
# echo " ${SECTION}BCLinux Modules${NORMAL}:"
# if [ ${COMPLIANCE_TESTS_PERFORMED} -eq 1 ]; then
# if [ ${COMPLIANCE_FINDINGS_FOUND} -eq 0 ]; then COMPLIANCE="${GREEN}V"; else COMPLIANCE="${RED}X"; fi
# else COMPLIANCE="${YELLOW}NA";
# fi
# echo " - Compliance Status [${COMPLIANCE}${NORMAL}]"
# echo " - Security Audit [${GREEN}V${NORMAL}]"
# echo " - Vulnerability Scan [${GREEN}V${NORMAL}]"
# echo ""
echo " ${SECTION}Files${NORMAL}:"
echo " - Test and debug information : ${WHITE}${LOGFILE}${NORMAL}"
echo " - Report data : ${WHITE}${REPORTFILE}${NORMAL}"
echo " - HTML Format Result : ${WHITE}${LOGDIR}${HTML_REPORT_DIRNAME}${NORMAL}"
echo ""
echo "================================================================================"
if [ ${PROGRAM_LV} -gt ${PROGRAM_AC} ]; then
echo " ${NOTICE}Notice: ${WHITE}${PROGRAM_name} update available${NORMAL}"
echo " Current version : ${WHITE}${PROGRAM_AC}${NORMAL} Latest version : ${WHITE}${PROGRAM_LV}${NORMAL}"
echo "================================================================================"
else
###########################################################################################
#
# Software quality program
# Only provide this hint when the tool is at the latest version
#
###########################################################################################
if [ ! "${PROGRAM_LV}" = "0" -a ! "${REPORTFILE}" = "" -a ! "${REPORTFILE}" = "/dev/null" ]; then
# Determine if the quality of the program can be increased by filtering out the exceptions
FIND=`${GREPBINARY} "^exception" ${REPORTFILE}`
if [ ! "${FIND}" = "" ]; then
echo ""
echo " ${RED}Exceptions found${NORMAL}"
echo " ${WHITE}Some exceptional events or information was found!${NORMAL}"
echo ""
echo " ${CYAN}What to do:${NORMAL}"
echo " You can help improving BCLinux by providing your ${LOGDIR}bclinux.log file."
echo " Go to https://bclinux.org/contact/ and send your file to the e-mail address listed"
echo ""
echo "================================================================================"
fi
fi
fi
# Display what tests are skipped in non-privileged scan for awareness
if [ ${PENTESTINGMODE} -eq 1 -a ! "${SKIPPED_TESTS_ROOTONLY}" = "" ]; then
echo ""
echo " ${PURPLE}Skipped tests due to non-privileged scan${NORMAL}"
FIND=`echo ${SKIPPED_TESTS_ROOTONLY} | sed 's/ /:space:/g'`
# Split entries
FIND=`echo ${FIND} | sed 's/====/ /g'`
# Display found entries
for I in ${FIND}; do
J=`echo ${I} | sed 's/:space:/ /g'`
echo " ${J}"
done
echo ""
echo "================================================================================"
fi
echo ""; echo ""
fi
fi
# Report data, even if it is not displayed on screen
Report "hardening_index=${HPINDEX}"
if [ ${QUIET} -eq 0 ]; then
echo " ${PROGRAM_name} ${PROGRAM_version}"
echo " Auditing, hardening and compliance for Linux, Mac OS and Unix systems"
echo ""
echo " ${PROGRAM_copyright}"
echo " ${WHITE}${PROGRAM_extrainfo}${NORMAL}"
echo ""
echo "================================================================================"
fi
######################################################################
#
# Generate html report file
#
#
######################################################################
#echo "Generate HTML report"
[ ! -d ${LOGDIR}/${HTML_REPORT_DIRNAME} ] && mkdir ${LOGDIR}/${HTML_REPORT_DIRNAME}
cp -a ${INCLUDEDIR}/check_result_template/* ${LOGDIR}/${HTML_REPORT_DIRNAME}
. ${INCLUDEDIR}/generate_html_report.sh
#
#================================================================================
# BCLinux - Copyright 2007-2016, Michael Boelen, CISOfy - https://cisofy.com