File: //opt/BCLinux/bse/include/profiles
#!/bin/sh
#################################################################################
#
# BCLinux
# ------------------
#
# BCLinux comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Read profile/template
#
#################################################################################
#
Display --indent 2 --text "- Checking profile file (${PROFILE})..."
logtext "Reading profile/configuration ${PROFILE}"
#FIND=`grep '^config:' ${PROFILE} | sed 's/ /!space!/g'`
G_FIND=`egrep "^config:|^[a-z-].*=|^[A-Z-].*=" ${PROFILE} | sed 's/ /!space!/g'`
for CONFIGOPTION in ${G_FIND}
do
if ContainsString "config:" "${CONFIGOPTION}"; then
# Old style configuration
OPTION=$(echo ${CONFIGOPTION} | cut -d ':' -f2)
VALUE=$(echo ${CONFIGOPTION} | cut -d ':' -f3 | sed 's/!space!/ /g')
else
OPTION=`echo ${CONFIGOPTION} | cut -d '=' -f1`
VALUE=`echo ${CONFIGOPTION} | cut -d '=' -f2 | sed 's/!space!/ /g'`
fi
logtext "Checking Profile option set: ${OPTION} (with value: ${VALUE})"
case ${OPTION} in
# Define which compliance standards are enabled
compliance_standards)
COMPLIANCE_STANDARDS_ENABLED=`echo ${VALUE} | tr ',' ' '`
for I in ${COMPLIANCE_STANDARDS_ENABLED}; do
case $I in
cis) COMPLIANCE_ENABLE_CIS=1 ; Debug "Compliance scanning for CIS Benchmarks is enabled" ;;
hipaa) COMPLIANCE_ENABLE_HIPAA=1 ; Debug "Compliance scanning for HIPAA is enabled" ;;
iso27001) COMPLIANCE_ENABLE_ISO27001=1 ; Debug "Compliance scanning for ISO27001 is enabled" ;;
pci-dss) COMPLIANCE_ENABLE_PCI_DSS=1 ; Debug "Compliance scanning for PCI DSS is enabled" ;;
*) logtext "Result: Unknown compliance standard configured" ;;
esac
done
;;
# Maximum number of WAITing connections
connections_max_wait_state)
OPTIONS_CONN_MAX_WAIT_STATE="${VALUE}"
;;
# BCLinux Enterprise: group name
group)
GROUP_NAME="${VALUE}"
;;
# BCLinux Enterprise license key
license_key)
LICENSE_KEY="${VALUE}"
report "license_key=${LICENSE_KEY}"
;;
# Do (not) log tests if they have an different operating system
log_tests_incorrect_os)
logtext "Option set: No logging for incorrect OS"
if [ "${VALUE}" = "no" ]; then LOG_INCORRECT_OS=0; else LOG_INCORRECT_OS=1; fi
;;
# What type of machine we are scanning (eg. desktop, server, server with storage)
machine_role)
MACHINE_ROLE="${VALUE}"
;;
# Define if any found NTP daemon instance is configured as a server or client
ntpd_role)
NTPD_ROLE="${VALUE}"
;;
# How much seconds to wait between tests
pause_between_tests)
TEST_PAUSE_TIME="${VALUE}"
;;
# Profile name
profile_name)
PROFILE_NAME="${VALUE}"
;;
# Inline tips about tool
show_tool_tips)
SHOW_TOOL_TIPS="${VALUE}"
;;
# Tests to always skip (useful for false positives or problematic tests)
test_skip_always)
TEST_SKIP_ALWAYS="${VALUE}"
logtext "Tests to be skipped: ${VALUE}"
;;
# Do not check the latest version on the internet
skip_upgrade_test)
if [ "${VALUE}" = "yes" -o "${VALUE}" = "YES" ]; then SKIP_UPGRADE_TEST=1; else SKIP_UPGRADE_TEST=0; fi
;;
# Define what kind of scan we are performing
test_scan_mode)
if [ "${VALUE}" = "light" ]; then SCAN_TEST_LIGHT="YES"; SCAN_TEST_MEDIUM="NO"; SCAN_TEST_HEAVY="NO"; fi
if [ "${VALUE}" = "normal" ]; then SCAN_TEST_LIGHT="YES"; SCAN_TEST_MEDIUM="YES"; SCAN_TEST_HEAVY="NO"; fi
if [ "${VALUE}" = "full" ]; then SCAN_TEST_LIGHT="YES"; SCAN_TEST_MEDIUM="YES"; SCAN_TEST_HEAVY="YES"; fi
;;
# Server IP or hostname
update_server_address)
UPDATE_SERVER_ADDRESS="${VALUE}"
;;
# Protocol (http, https)
update_server_protocol)
UPDATE_SERVER_PROTOCOL="${VALUE}"
;;
# Plugin
plugin)
LogText "Plugin '${VALUE}' enabled according profile (${PROFILE})"
;;
# Plugin directory
plugindir | plugin-dir)
if IsEmpty "${PLUGINDIR}"; then
PLUGINDIR="${VALUE}"
else
logtext "Plugin directory was already set to ${PLUGINDIR} before (most likely as a program argument), not overwriting"
fi
;;
#-----------------------------------------------------------------------------#
# System login banner.
set_motd)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_MOTD=1 || SET_MOTD=0
if [ -z $FIND ]; then logtext "Don't set motd, use system's default value."; fi
;;
motd)
if [ $SET_MOTD -eq 1 ]; then MOTD=${VALUE}; fi
;;
# Pam mode, use to rem old 5s password.
set_password_rem)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_PASSWORD_REM=1 || SET_PASSWORD_REM=0
if [ -z $FIND ]; then logtext "Don't set password_rem, use system's default value."; fi
;;
password_rem)
if [ $SET_PASSWORD_REM -eq 1 ]; then PASSWORD_REM=${VALUE}; fi
;;
# set password complex.
set_passComplex)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_PASSCOMPLEX=1 || SET_PASSCOMPLEX=0
if [ -z $FIND ]; then logtext "Don't set password complex, use system's default value."; fi
;;
minclass)
if [ $SET_PASSCOMPLEX -eq 1 ]; then MINCLASS=${VALUE}; fi
;;
minlen)
if [ $SET_PASSCOMPLEX -eq 1 ]; then MINLEN=${VALUE}; fi
;;
ucredit)
if [ $SET_PASSCOMPLEX -eq 1 ]; then UCREDIT=${VALUE}; fi
;;
lcredit)
if [ $SET_PASSCOMPLEX -eq 1 ]; then LCREDIT=${VALUE}; fi
;;
dcredit)
if [ $SET_PASSCOMPLEX -eq 1 ]; then DCREDIT=${VALUE}; fi
;;
ocredit)
if [ $SET_PASSCOMPLEX -eq 1 ]; then OCREDIT=${VALUE}; fi
;;
# lock user who want to attacking to login.
lock_attacking_user)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && LOCK_ATTACKING_USER=1 || LOCK_ATTACKING_USER=0
if [ -z $FIND ]; then logtext "Don't lock user who want to attacking to login, use system's default value."; fi
;;
deny_times)
if [ $LOCK_ATTACKING_USER -eq 1 ]; then DENY_TIMES=${VALUE}; fi
;;
unlock_time)
if [ $LOCK_ATTACKING_USER -eq 1 ]; then UNLOCK_TIME=${VALUE}; fi
;;
root_unlock_time)
if [ $LOCK_ATTACKING_USER -eq 1 ]; then ROOT_UNLOCK_TIME=${VALUE}; fi
;;
# Disable the icmp redirect
disable_icmp_redirect)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && DISABLE_ICMP_REDIRECT=1 || DISABLE_ICMP_REDIRECT=0
if [ -z $FIND ]; then logtext "Don't disable the icmp redirect, use system's default value."; fi
;;
# set umask
set_umask)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_UMASK=1 || SET_UMASK=0
if [ -z $FIND ]; then logtext "Don't set umask, use system's default value."; fi
;;
umask_value)
if [ $SET_UMASK -eq 1 ]; then UMASK_VALUE=${VALUE}; fi
;;
# set TMOUT
set_tmout)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_TMOUT=1 || SET_TMOUT=0
if [ -z $FIND ]; then logtext "Don't set tmout, use system's default value."; fi
;;
tmout_value)
if [ $SET_TMOUT -eq 1 ]; then TMOUT_VALUE=${VALUE}; fi
;;
# set security file property
set_file_property)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_FILE_PROPERTY=1 || SET_FILE_PROPERTY=0
if [ -z $FIND ]; then logtext "Don't set security file property, use system's default value."; fi
;;
chmod_644_file)
if [ $SET_FILE_PROPERTY -eq 1 ]; then CHMOD_644_FILE=${VALUE}; fi
;;
chmod_750_file)
if [ $SET_FILE_PROPERTY -eq 1 ]; then CHMOD_750_FILE=${VALUE}; fi
;;
chmod_600_file)
if [ $SET_FILE_PROPERTY -eq 1 ]; then CHMOD_600_FILE=${VALUE}; fi
;;
chmod_400_file)
if [ $SET_FILE_PROPERTY -eq 1 ]; then CHMOD_400_FILE=${VALUE}; fi
;;
chmod_751_file)
if [ $SET_FILE_PROPERTY -eq 1 ]; then CHMOD_751_FILE=${VALUE}; fi
;;
# set PASS_MAX_DAYS
set_pass_max_days)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_PASS_MAX_DAYS=1 || SET_PASS_MAX_DAYS=0
if [ -z $FIND ]; then logtext "Don't set PASS_MAX_DAYS, use system's default value."; fi
;;
pass_max_days_value)
if [ $SET_PASS_MAX_DAYS -eq 1 ]; then PASS_MAX_DAYS_VALUE=${VALUE}; fi
;;
# set PASS_MIN_DAYS
set_pass_min_days)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_PASS_MIN_DAYS=1 || SET_PASS_MIN_DAYS=0
if [ -z $FIND ]; then logtext "Don't set PASS_MIN_DAYS, use system's default value."; fi
;;
pass_min_days_value)
if [ $SET_PASS_MIN_DAYS -eq 1 ]; then PASS_MIN_DAYS_VALUE=${VALUE}; fi
;;
# set PASS_MIN_LEN
set_pass_min_len)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_PASS_MIN_LEN=1 || SET_PASS_MIN_LEN=0
if [ -z $FIND ]; then logtext "Don't set PASS_MIN_LEN, use system's default value."; fi
;;
pass_min_len_value)
if [ $SET_PASS_MIN_LEN -eq 1 ]; then PASS_MIN_LEN_VALUE=${VALUE}; fi
;;
# set PASS_WARN_AGE
set_pass_warn_age)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_PASS_WARN_AGE=1 || SET_PASS_WARN_AGE=0
if [ -z $FIND ]; then logtext "Don't set PASS_WARN_AGE, use system's default value."; fi
;;
pass_warn_age_value)
if [ $SET_PASS_WARN_AGE -eq 1 ]; then PASS_WARN_AGE_VALUE=${VALUE}; fi
;;
# set ssh login banner
set_ssh_login_banner)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_SSH_LOGIN_BANNER=1 || SET_SSH_LOGIN_BANNER=0
if [ -z $FIND ]; then logtext "Don't set ssh login banner, use system's default value."; fi
;;
ssh_login_banner_value)
if [ $SET_SSH_LOGIN_BANNER -eq 1 ]; then SSH_LOGIN_BANNER_VALUE=${VALUE}; fi
;;
# set ssh cipher
set_ssh_cipher)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_SSH_CIPHER=1 || SET_SSH_CIPHER=0
if [ -z $FIND ]; then logtext "Don't set ssh cipher, use system's default value."; fi
;;
ssh_cipher_value)
if [ $SET_SSH_CIPHER -eq 1 ]; then SSH_CIPHER_VALUE=${VALUE}; fi
;;
ssh_macs_value)
if [ $SET_SSH_CIPHER -eq 1 ]; then SSH_MACS_VALUE=${VALUE}; fi
;;
# set ssh gssapi
set_ssh_gssapi)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_SSH_GSSAPI=1 || SET_SSH_GSSAPI=0
if [ -z $FIND ]; then logtext "Don't set ssh gssapi, use system's default value."; fi
;;
# set ssh Protocol
set_ssh_protocol)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_SSH_PROTOCOL=1 || SET_SSH_PROTOCOL=0
if [ -z $FIND ]; then logtext "Don't set ssh Protocol, use system's default value."; fi
;;
# disable unused software
disable_unused_software)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && DISABLE_UNUSED_SOFTWARE=1 || DISABLE_UNUSED_SOFTWARE=0
if [ -z $FIND ]; then logtext "Don't disable unused software, use system's default value."; fi
;;
unused_software_value)
if [ $DISABLE_UNUSED_SOFTWARE -eq 1 ]; then UNUSED_SOFTWARE_VALUE=${VALUE}; fi
;;
# disable unused user
disable_unused_user)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && DISABLE_UNUSED_USER=1 || DISABLE_UNUSED_USER=0
if [ -z $FIND ]; then logtext "Don't disable unused user, use system's default value."; fi
;;
unused_user_value)
if [ $DISABLE_UNUSED_USER -eq 1 ]; then UNUSED_USER_VALUE=${VALUE}; fi
;;
# Recording the login events
recording_login_events)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && RECORDING_LOGIN_EVENTS=1 || RECORDING_LOGIN_EVENTS=0
if [ -z $FIND ]; then logtext "Don't recording the login events, use system's default value."; fi
;;
login_events_file_name)
if [ $RECORDING_LOGIN_EVENTS -eq 1 ]; then LOGIN_EVENTS_FILE_NAME=${VALUE}; fi
;;
# Recording the kernel warn
recording_kernel_warn)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && RECORDING_KERNEL_WARN=1 || RECORDING_KERNEL_WARN=0
if [ -z $FIND ]; then logtext "Don't recording the kernel warn, use system's default value."; fi
;;
kernel_warn_file_name)
if [ $RECORDING_KERNEL_WARN -eq 1 ]; then KERNEL_WARN_FILE_NAME=${VALUE}; fi
;;
# Recording the error events
recording_error_events)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && RECORDING_ERROR_EVENTS=1 || RECORDING_ERROR_EVENTS=0
if [ -z $FIND ]; then logtext "Don't recording the error events, use system's default value."; fi
;;
error_file_name)
if [ $RECORDING_ERROR_EVENTS -eq 1 ]; then ERROR_FILE_NAME=${VALUE}; fi
;;
# Recording the auth events
recording_auth_events)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && RECORDING_AUTH_EVENTS=1 || RECORDING_AUTH_EVENTS=0
if [ -z $FIND ]; then logtext "Don't recording the auth events, use system's default value."; fi
;;
auth_events_file_name)
if [ $RECORDING_AUTH_EVENTS -eq 1 ]; then AUTH_EVENTS_FILE_NAME=${VALUE}; fi
;;
# set core dump
set_core_dump)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_CORE_DUMP=1 || SET_CORE_DUMP=0
if [ -z $FIND ]; then logtext "Don't set core dump, use system's default value."; fi
;;
# set vsftp security
set_vsftp_security)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_VSFTP_SECURITY=1 || SET_VSFTP_SECURITY=0
if [ -z $FIND ]; then logtext "Don't set vsftp security, use system's default value."; fi
;;
# set ssh SyslogFacility
set_ssh_syslogfacility)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_SSH_SYSLOGFACILITY=1 || SET_SSH_SYSLOGFACILITY=0
if [ -z $FIND ]; then logtext "Don't set ssh SyslogFacility, use system's default value."; fi
;;
# set ALWAYS_SET_PATH
set_always_set_path)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_ALWAYS_SET_PATH=1 || SET_ALWAYS_SET_PATH=0
if [ -z $FIND ]; then logtext "Don't set ALWAYS_SET_PATH, use system's default value."; fi
;;
# set ssh loglevel
set_ssh_loglevel)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_SSH_LOGLEVEL=1 || SET_SSH_LOGLEVEL=0
if [ -z $FIND ]; then logtext "Don't set ssh LogLevel, use system's default value."; fi
;;
#--------------------------adv options--------------------------
# deny root login
deny_root_login)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && DENY_ROOT_LOGIN=1 || DENY_ROOT_LOGIN=0
if [ -z $FIND ]; then logtext "Don't deny root login, use system's default value."; fi
;;
# hide issue file
hide_issue_info)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && HIDE_ISSUE_INFO=1 || HIDE_ISSUE_INFO=0
if [ -z $FIND ]; then logtext "Don't hide issue info, use system's default value."; fi
;;
# nobody can su to root
forbidden_to_su)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && FORBIDDEN_TO_SU=1 || FORBIDDEN_TO_SU=0
if [ -z $FIND ]; then logtext "Don't forbidden user su to root, use system's default value."; fi
;;
# add aditional user.
add_adtional_user)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && ADD_ADITIONAL_USER=1 || ADD_ADITIONAL_USER=0
if [ -z $FIND ]; then logtext "Don't add aditional user, use system's default value."; fi
;;
userName)
if [ $ADD_ADITIONAL_USER -eq 1 ]; then UserName=${VALUE}; fi
;;
userPass)
if [ $ADD_ADITIONAL_USER -eq 1 ]; then UserPass=${VALUE}; fi
;;
# set ip filter
set_ip_filter)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_IP_FILTER=1 || SET_IP_FILTER=0
if [ -z $FIND ]; then logtext "Don't set ip filter, use system's default value."; fi
;;
allowIP_Range)
if [ $SET_IP_FILTER -eq 1 ]; then ALLOWIP_RANGE=${VALUE}; fi
;;
# change log file property
set_log_file_property)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && SET_LOG_FILE_PROPERTY=1 || SET_LOG_FILE_PROPERTY=0
if [ -z $FIND ]; then logtext "Don't change log file property, use system's default value."; fi
;;
# disable unused aliases
disable_unused_aliases)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && DISABLE_UNUSED_ALIASES=1 || DISABLE_UNUSED_ALIASES=0
if [ -z $FIND ]; then logtext "Don't disable unused aliases, use system's default value."; fi
;;
unused_aliases_value)
if [ $DISABLE_UNUSED_ALIASES -eq 1 ]; then UNUSED_ALIASES_VALUE=${VALUE}; fi
;;
#--------------------------check CVE--------------------------
# change log file property
check_sofware_vulner)
FIND=$(echo "${VALUE}" | egrep "^(1|true|yes)$") && CHECK_SYS_VULNER=1 || CHECK_SYS_VULNER=0
if [ -z $FIND ]; then logtext "Don't check system vulnerablities."; fi
;;
rpm_assembly)
if [ $CHECK_SYS_VULNER -eq 1 ]; then RPM_ASSEMBLY=${VALUE}; fi
;;
cve_report_max_items)
if [ $CHECK_SYS_VULNER -eq 1 ]; then CVE_REPORT_MAX_ITEMS=${VALUE}; fi
;;
#-----------------------------------------------------------------------------
# Catch all bad options and bail out
*)
logtext "Unknown option ${OPTION} (with value: ${VALUE})"
echo "Fatal error: found errors in profile"
echo "Unknown option '${OPTION}' found (with value: ${VALUE})"
ExitFatal
;;
esac
done
#
#################################################################################
#
# Add group name to report
if [ ! "${GROUP_NAME}" = "" ]; then
report "group=${GROUP_NAME}"
fi
#
#################################################################################
#
# Set default values (only if not configured in profile)
if [ "${MACHINE_ROLE}" = "" ]; then
MACHINE_ROLE="server"
logtext "Set option to default value: MACHINE_ROLE --> ${MACHINE_ROLE}"
fi
if [ "${NTPD_ROLE}" = "" ]; then
NTPD_ROLE="client"
logtext "Set option to default value: NTPD_ROLE --> ${NTPD_ROLE}"
fi
#
#################################################################################
#
logtextbreak
#================================================================================
# BCLinux - Copyright 2007-2016, Michael Boelen - CISOfy, https://cisofy.com