API tools faq
paste
Advertisement
Guest User

LBSA - Linux Basic Security Audit

a guest
Jan 24th, 2015
972
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 43.06 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2.  
  3. #------------------------------------------------------------------------------------------------------------------------------
  4. # LBSA - Linux Basic Security Audit script
  5. #------------------------------------------------------------------------------------------------------------------------------
  6. # (c) Neale Rudd, 2008-2014, All rights reserved
  7. # Download latest version from http://wiki.metawerx.net/wiki/LBSA
  8. # Version 1.0.49
  9. # Last updated 31/03/2014 5:25AM
  10. #
  11. # License: GPL v3
  12. # Language: Shell script (bash)
  13. # Required permissions: root or equivalent
  14. # Script type: Check and report (no modifications are made to your system)
  15. # Expected output: System Checks Completed
  16. #
  17. #
  18. #------------------------------------------------------------------------------------------------------------------------------
  19. # GUIDE
  20. #------------------------------------------------------------------------------------------------------------------------------
  21. # This script runs a series of basic linux security checks for Continuous
  22. # Policy Enforcement (CPE).  It is, and will always be, a work in progress.
  23. # The script was originally designed for use on Ubuntu, but will most likely
  24. # work with other distros.
  25. #
  26. # The checks are far from exhaustive, but can highlight some basic setup
  27. # issues from default linux installs and continuously enforce policies that
  28. # you require in your specific environment.
  29. #
  30. # These checks include a subset of setup policies which I use for hardening
  31. # server configurations.  As such, not all checks may be suitable for your
  32. # environment.  For example, I don't allow root to login over SSH.  This may
  33. # cause issues in your environment, or may be too restrictive for home use in
  34. # some cases.
  35. #
  36. # If your own settings are more restrictive than these, or you have your own
  37. # opinions on the settings, then modify this script to suit your own purposes.
  38. # The main idea is to have a script that can enforce your own policies, and to
  39. # run it regularly.  It is not necessary to follow my policies line-by-line.
  40. #
  41. # That said, this script should be suitable for most servers and home users
  42. # "as-is", and for other admins it should give you some ideas for your own
  43. # script, or at very least should make for a good read :-)
  44. #
  45. # Usage notes
  46. # Ideally, this script would be called by a wrapper script of your own, which
  47. # implements other checks more specific to your environment.  For example,
  48. # if you run Apache, you may want to also check various folder permissions
  49. # for Apache, then call this script as the final step of your own script.
  50. # The script should be called regularly by cron or another scheduler and mail
  51. # results to the administrator for review if the output changes.
  52. #
  53. # Criticisms and Counter Arguments (Feb 2013)
  54. # In a comment on reddit, someones mentioned I ought to be dunked in honey
  55. # and given to a colony of ants for writing lines that are longer than 80
  56. # characters.  I agree and I now have a new fear on ants, thank you.
  57. # Many lines are still longer than 80 characters.  Sorry, they just are.
  58. # They also commented that passwd -l root will lock the root account from
  59. # accessing the console.  This may be correct but I still recommend it.
  60. # They also commented that if there is proper configuration management, then
  61. # checking folder and file permissions is unnecessary.  I respectully disagree.
  62. # If a system is breached, folder and file permissions may be changed and
  63. # continuous policy checking is one way to be alerted to such a change quickly.
  64. # Finally, they commented that "moving the SSH port from 22, which is asinine
  65. # and provides no actual protection, simply makes it more difficult for people
  66. # to manage those systems."  I also respectfully disagree with that - Port
  67. # scanning bots hit port 22 and changing the default port helps to reduce
  68. # automated threats.  Using a different port than 22 does not make it more
  69. # difficult to manage systems if you are using a configuration management
  70. # system or only have a single server to worry about.
  71. # Ref: http://wiki.centos.org/HowTos/Network/SecuringSSH
  72. #
  73. # Disclaimer
  74. # This is a free script provided to the community.  I am not responsible
  75. # for any changes you make to your own system.  All opinions expressed are my
  76. # own and are not necessarily the opinion of my employer, any company or
  77. # organisation, or anyone else.
  78. #
  79. # Recent changes:
  80. # 1.0.49 - Modified the hashing time suggestion for password-based logins
  81. # 1.0.48 - Added test to find SSH-key based logins in non-home folders
  82. # 1.0.47 - Switched to octal permissions
  83. # 1.0.47 - Added warnings for BlowFish and SHA256 (SHA512 is available)
  84. # 1.0.47 - Added recommendations for multiple hashing rounds in /etc/shadow
  85. # 1.0.47 - Fixed bug which caused script to wait when outputing MD5 warning
  86. # 1.0.46 - Added GPL v3 License
  87. # 1.0.46 - Switched to use of check_path function instead of all the loops
  88. # 1.0.45 - Changed use of ls to stat for 25% speed improvement
  89. # 1.0.45 - Removed UUOC (useless use of cat)
  90. # 1.0.45 - Commenting changes, reduced header comments width to <80 chars
  91. #
  92. # Other useful tools:
  93. # * Bastille - hardening toolkit which covers lots of things not covered here
  94. # * AIDE - monitor for file changes
  95. # * fail2ban - scan logs, ban IP addresses
  96. #
  97. #
  98. #------------------------------------------------------------------------------------------------------------------------------
  99. # HOW TO USE
  100. #------------------------------------------------------------------------------------------------------------------------------
  101. # First, change parameters in the SETTINGS section to suit your environment,
  102. # or call this script from a wrapper script that sets these variables.
  103. #
  104. # The script should be executed as root with bash.
  105. # eg:
  106. #   export LBSA_PERMITTED_LOGIN_ACCOUNTS="nrudd|sjackson"
  107. #   bash sec_lbsa.sh
  108. #
  109. # A series of checks are executed
  110. # No modifications are performed
  111. #
  112. # Running this script should produce no result except the phrase
  113. # "System Checks Completed", at position 0 of the output.
  114. # If there is any other output, then one or more warnings have been issued
  115. #
  116. # This can be used in cron or another scheduler to send a mail using a command
  117. # like the following:
  118. #   export LBSA_PERMITTED_LOGIN_ACCOUNTS="nrudd|sjackson";
  119. #   LBSA_RESULTS=`bash sec_lbsa.sh`;
  120. #   if [ "$LBSA_RESULTS" != "System Checks Completed" ]; then {your sendmail command here}; fi
  121. #
  122. #
  123. #------------------------------------------------------------------------------------------------------------------------------
  124. # SETTINGS
  125. #------------------------------------------------------------------------------------------------------------------------------
  126. # Settings are in if-blocks in case you want to call this script from a
  127. # wrapper-script to avoid modifying it.  This allows for easier upgrades.
  128.  
  129. # Permitted Login Accounts
  130. #    Specify the list of permitted logins in quotes, separated by |
  131. #    If there are none, just leave it blank.  root should not be listed here, as we don't want root logging in via SSH either.
  132. #    Valid examples:
  133. #    LBSA_PERMITTED_LOGIN_ACCOUNTS=""
  134. #    LBSA_PERMITTED_LOGIN_ACCOUNTS="user1"
  135. #    LBSA_PERMITTED_LOGIN_ACCOUNTS="user1|user2|user3"
  136. if [ ! -n "$LBSA_PERMITTED_LOGIN_ACCOUNTS" ]; then
  137.     LBSA_PERMITTED_LOGIN_ACCOUNTS=""
  138. fi
  139.  
  140. # If you aren't worried about allowing any/all SSH port forwarding, change this to yes
  141. if [ ! -n "$LBSA_ALLOW_ALL_SSH_PORT_FORWARDING" ]; then
  142.     LBSA_ALLOW_ALL_SSH_PORT_FORWARDING=no
  143. fi
  144.  
  145. # Set this to yes to provide additional SSH recommendations
  146. if [ ! -n "$LBSA_INCLUDE_EXTRA_SSH_RECOMMENDATIONS" ]; then
  147.     LBSA_INCLUDE_EXTRA_SSH_RECOMMENDATIONS=no
  148. fi
  149.  
  150.  
  151.  
  152. #------------------------------------------------------------------------------------------------------------------------------
  153. # FUNCTIONS
  154. #------------------------------------------------------------------------------------------------------------------------------
  155.  
  156. # Check permissions, owner and group, output warnings if they do not match
  157. check_path() {
  158.  
  159.     PERMS=$1            # recommended perms, eg: 755 (rwxr-xr-x)
  160.     OWNER=$2            # recommended owner
  161.     GROUP=$3            # recommended group
  162.     CHECKPATH=$4        # path to check
  163.    
  164.     if [ -e $CHECKPATH ]; then
  165.    
  166.         # Run commands
  167.         CPERMS=`stat -L -c %a $CHECKPATH`
  168.         COWNER=`stat -L -c %U $CHECKPATH`
  169.         CGROUP=`stat -L -c %G $CHECKPATH`
  170.  
  171.         # Compare
  172.         if [ "$CPERMS" != "$PERMS" ]; then
  173.             echo "Permission recommendation for [$CHECKPATH] is [$PERMS].  Current setting is [$CPERMS]"
  174.         fi
  175.         if [ "$COWNER" != "$OWNER" ]; then
  176.             echo "Owner recommendation for [$CHECKPATH] is [$OWNER].  Current setting is [$COWNER]"
  177.         fi
  178.         if [ "$CGROUP" != "$GROUP" ]; then
  179.             echo "Group recommendation for [$CHECKPATH] is [$GROUP].  Current setting is [$CGROUP]"
  180.         fi
  181.     fi
  182. }
  183.  
  184.  
  185. #------------------------------------------------------------------------------------------------------------------------------
  186. # PASSWORD-BASED LOGIN HASH CHECK
  187. #------------------------------------------------------------------------------------------------------------------------------
  188.  
  189. # ACCT_HASHING
  190. # Make sure no account is using MD5, they should be upgraded to use SHA-512
  191. # On older installs, when accounts were set up MD5 was the default, and this cannot be auto-upgraded during Linux updates
  192. # man crypt for details
  193. # 1 MD5, 2a BlowFish, 5 SHA-256, 6 SHA-512
  194. # Ref: http://linux.die.net/man/3/crypt
  195. # This is only really important if the /etc/shadow file is compromised after a breakin
  196.  
  197. if [ "`chpasswd --help | grep -e " \-s, "`" = "" -o "`chpasswd --help | grep -e " \-c, "`" = "" ]; then
  198.     echo "WARNING: Your version of chpasswd does not support crypt-method or sha-round. You cannot use the latest hashing algorithms."
  199.     HASH=":\$1\$"
  200.     if [ "`fgrep "$HASH" /etc/shadow`" != "" ]; then
  201.         echo "WARNING: Your passwords are stored as MD5 hashes.  Upgrade your kernel and your chpasswd command to enable SHA-256/SHA-512 hashes.  See: http://en.wikipedia.org/wiki/MD5, http://en.wikipedia.org/wiki/Rainbow_table"
  202.     fi
  203. else
  204.     # MD5 is trivial to dehash within seconds using a rainbow table website so your plaintext passwords will be immediately readable
  205.     HASH=":\$1\$"
  206.     if [ "`fgrep "$HASH" /etc/shadow`" != "" ]; then
  207.         echo "Warning: 1 or more account passwords use MD5 hashing.  When these accounts were set up, MD5 may have been the default but it is now easily decodable.  See: http://en.wikipedia.org/wiki/MD5, http://en.wikipedia.org/wiki/Rainbow_table";
  208.         echo "Update these accounts to SHA512*200000 or stronger with chpasswd or passwd: " `fgrep "$HASH" /etc/shadow | cut -d ":" -f 1`
  209.         echo "eg: chpasswd -c SHA512 -s 200000 <<<'user:newPassword'"
  210.     fi
  211.     HASH=":\$2a\$"
  212.     if [ "`fgrep "$HASH" /etc/shadow`" != "" ]; then
  213.         echo "Warning: 1 or more account passwords use BlowFish hashing.  This is a hashing algorithm designed in 1993 which the creator now recommends against using.  See: http://en.wikipedia.org/wiki/Blowfish_(cipher)";
  214.         echo "Update these accounts to SHA512*200000 or stronger with chpasswd or passwd: " `fgrep "$HASH" /etc/shadow | cut -d ":" -f 1`
  215.         echo "eg: chpasswd -c SHA512 -s 200000 <<<'user:newPassword'"
  216.     fi
  217.     HASH=":\$5\$"
  218.     if [ "`grep "$HASH" /etc/shadow`" != "" ]; then
  219.         echo "Warning: 1 or more account passwords use SHA-256 hashing.  SHA-512 is now available and uses more rounds to encrypt.  See: http://en.wikipedia.org/wiki/SHA-2";
  220.         echo "Update these accounts to SHA512*200000 or stronger with chpasswd or passwd: " `fgrep "$HASH" /etc/shadow | cut -d ":" -f 1`
  221.         echo "eg: chpasswd -c SHA512 -s 200000 <<<'user:newPassword'"
  222.     fi
  223.     HASH=":\$[0-9]"
  224.     if [ "`grep "$HASH" /etc/shadow | grep -v "\$rounds="`" != "" ]; then
  225.         echo "Warning: 1 or more account passwords are using a single round of hashing.  By increasing the number of hashing rounds, the computational time to verify a login password will increase and so will the computational time to reverse your hashes in case of a break-in.  See: http://en.wikipedia.org/wiki/Key_stretching";
  226.         echo "Update these accounts to SHA512*200000 or stronger with chpasswd or passwd: " `grep "$HASH" /etc/shadow | cut -d ":" -f 1`
  227.         echo "eg: chpasswd -c SHA512 -s 200000 <<<'user:newPassword'"
  228.         echo "To see the time overhead for 200000 rounds, use this command ..."
  229.         echo "time chpasswd -S -c SHA512 -s 200000 <<<'testuser:testpass'"
  230.         echo "... change the -s parameter until the time is acceptable (eg: 0.2-0.5s) then use the new value to change your password."
  231.     fi
  232. fi
  233.  
  234.  
  235. #------------------------------------------------------------------------------------------------------------------------------
  236. # LOGINS
  237. #------------------------------------------------------------------------------------------------------------------------------
  238.  
  239. # ROOT_NOT_LOCKED
  240. # Make sure root account is locked (no SSH login, no console logins)
  241. if [ "$LBSA_ALLOW_ROOT_LOGIN" != "true" ]; then passwd -S root | grep -v " L " | xargs -r -iLINE echo -e "Warning: root account is not locked and may allow login over SSH or other services.  Warning: When locked, root will not be able to log in at the console - make sure you have another user configured with sudo access.  Use [passwd -dl root] and [chage -E-1 root] to ensure the root account is locked but can still run cron jobs. [LINE]\n"; fi
  242. # Fix: passwd -dl root; chage -E-1 root;
  243.  
  244. # ROOT_PASS_TIMING
  245. # Make sure root password is set to 0 min 99999 max 7 warning -1 inactivity
  246. # This may occur with ROOT_PASS_EXPIRES
  247. passwd -S root | grep -v "0 99999 7 -1" | xargs -r -iLINE echo -e "Warning: root account has non-standard min/max/wait/expiry times set.  If the root password expires, cron jobs and other services may stop working until the password is changed. [LINE]\n"
  248. # Fix: chage -m 0 -M 99999 -W 7 -I -1 root
  249.  
  250. # ROOT_PASS_EXPIRES
  251. # Make sure root password is set to never expire
  252. # This will normally occur with ROOT_PASS_TIMING
  253. chage -l root | grep "Password expires" | grep -v never | xargs -r -iLINE echo -e "Warning: root password has an expiry date.  If the root password expires, cron jobs and other services may stop working until the password is changed. [LINE]\n"
  254. # Fix: chage -m 0 -M 99999 -W 7 -I -1 root
  255.  
  256. # ROOT_ACCT_EXPIRES
  257. # Make sure root account is set to never expire
  258. chage -l root | grep "Account expires" | grep -v never | xargs -r -iLINE echo -e "Warning: root account has an expiry date -- though Linux surely protects against it expiring automatically [recommend setting it to never expire]. [LINE]\n"
  259. # Fix: chage -E-1 root
  260.  
  261. # UNEXPECTED_USER_LOGINS_PRESENT
  262. # Make sure the users that can log in, are ones we know about
  263. # First, get user list, excluding any we already have stated should be able to log in
  264. if [ "$LBSA_PERMITTED_LOGIN_ACCOUNTS" = "" ]; then
  265.     USERLIST=`cat /etc/passwd | cut -f 1 -d ":"`
  266. else
  267.     USERLIST=`grep -v -w -E "$LBSA_PERMITTED_LOGIN_ACCOUNTS" /etc/passwd | cut -f 1 -d ":"`
  268. fi
  269. # Find out which ones have valid passwords
  270. LOGINLIST=""
  271. for USERNAME in $USERLIST
  272. do
  273.     if [ "`passwd -S $USERNAME | grep \" P \"`" != "" ]; then
  274.         if [ "$LOGINLIST" = "" ]; then
  275.             LOGINLIST="$USERNAME"
  276.         else
  277.             LOGINLIST="$LOGINLIST $USERNAME"
  278.         fi
  279.     fi
  280. done
  281. # Report
  282. if [ "$LOGINLIST" != "" ]; then
  283.     echo "Warning: the following user(s) are currently granted login rights to this machine: [$LOGINLIST]."
  284.     echo "If users in this list should be allowed to log in, please add their usernames to the LBSA_PERMITTED_LOGIN_ACCOUNTS setting in this script, or set the environment variable prior to calling this script."
  285.     echo "If an account is only used to run services, or used in cron, the account should not be permitted login rights, so lock the account with [passwd -dl <username>] to help prevent it being abused."
  286.     echo "Note: after locking the account, the account will also be marked as expired, so use [chage -E-1 <username>] to set the account to non-expired/never-expire, otherwise services or cron tasks that rely on the user account being active will fail."
  287.     echo ""
  288. fi
  289. # Fix: lock the specified accounts then set them non-expired, or specify the users that are listed are ok to log in by
  290. # adding them to LBSA_PERMITTED_LOGIN_ACCOUNTS
  291.  
  292.  
  293. #------------------------------------------------------------------------------------------------------------------------------
  294. # Key-based logins that are not in the /home folder
  295. # - Comment this section out if you have a valid need for these
  296. #------------------------------------------------------------------------------------------------------------------------------
  297.  
  298. # List anything that's not in the home folder (protected above)
  299. RESULT1=`grep -v ':/home/' /etc/passwd | cut -d : -f 6 | xargs -r -IFOLDER ls -al FOLDER/.ssh/authorized_keys 2>/dev/null`
  300. RESULT2=`grep -v ':/home/' /etc/passwd | cut -d : -f 6 | xargs -r -IFOLDER ls -al FOLDER/.ssh/authorized_keys2 2>/dev/null`
  301. if [ "$RESULT1" != "" -o "$RESULT2" != "" ]; then
  302.     echo "Warning: the following files allow key-based login to your system and are not inside your /home folder"
  303.     echo "Unless you created these logins intentionally, this could indicate a back-door into your system"
  304.     if [ "$RESULT1" != "" ]; then echo "$RESULT1"; fi
  305.     if [ "$RESULT2" != "" ]; then echo "$RESULT2"; fi
  306. fi
  307.  
  308.  
  309. #--------------------------------------------------------------------------------------------------------------
  310. # General
  311. #--------------------------------------------------------------------------------------------------------------
  312.  
  313. # Ensure /etc/hosts contains an entry for this server name
  314. export LBSA_HOSTNAME=`hostname`
  315. if [ "`grep -w "$LBSA_HOSTNAME$" /etc/hosts | grep -v "^#"`" = "" ]; then
  316.     echo "There is no entry for the server's name [`hostname`] in /etc/hosts.  This may cause unexpected performance problems for local connections and NFS issues.  Add the IP and name in /etc/hosts, eg: 192.168.0.1 `hostname`";
  317.     echo;
  318. fi
  319.  
  320.  
  321. #--------------------------------------------------------------------------------------------------------------
  322. # SSH Setup
  323. #--------------------------------------------------------------------------------------------------------------
  324.  
  325. # Ensure SSHD config is set securely (we do use TcpForwarding, so allow TcpForwarding)
  326. if [ "`grep -E ^Port /etc/ssh/sshd_config`"                     = "Port 22"                    ]; then echo "SSHD Config: Port is set to default (22).  Recommend change to a non-standard port to make your SSH server more difficult to find/notice.  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  327. if [ "`grep -E ^ListenAddress /etc/ssh/sshd_config`"            = ""                           -a "$LBSA_ALLOW_SSH_ALL_ADDRESSES" != "true" ]; then echo "SSHD Config: ListenAddress is set to default (all addresses).  SSH will listen on ALL available IP addresses.  Recommend change to a single IP to reduce the number of access points.  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  328. if [ "`grep -E ^PermitRootLogin /etc/ssh/sshd_config`"         != "PermitRootLogin no"         -a "$LBSA_ALLOW_ROOT_LOGIN" != "true" -a "$LBSA_ALLOW_ROOT_LOGIN_SSHCERT" != "true" ]; then echo "SSHD Config: PermitRootLogin should be set to no (prefer log in as a non-root user, then sudo/su to root).  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  329. if [ "`grep -E ^PermitEmptyPasswords /etc/ssh/sshd_config`"    != "PermitEmptyPasswords no"    ]; then echo "SSHD Config: PermitEmptyPasswords should be set to no (all users must use passwords/keys).  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  330. if [ "`grep -E ^UsePrivilegeSeparation /etc/ssh/sshd_config`"  != "UsePrivilegeSeparation yes" ]; then echo "SSHD Config: UsePrivilegeSeparation should be set to yes (to chroot most of the SSH code, unless on older RHEL).  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  331. if [ "`grep -E ^Protocol /etc/ssh/sshd_config`"                != "Protocol 2"                 ]; then echo "SSHD Config: Protocol should be set to 2 (unless older Protocol 1 is really needed).  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  332. if [ "`grep -E ^X11Forwarding /etc/ssh/sshd_config`"           != "X11Forwarding no"           ]; then echo "SSHD Config: X11Forwarding should be set to no (unless needed).  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  333. if [ "`grep -E ^StrictModes /etc/ssh/sshd_config`"             != "StrictModes yes"            ]; then echo "SSHD Config: StrictModes should be set to yes (to check file permissions of files such as ~/.ssh, ~/.ssh/authorized_keys etc).  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  334. if [ "`grep -E ^IgnoreRhosts /etc/ssh/sshd_config`"            != "IgnoreRhosts yes"           ]; then echo "SSHD Config: IgnoreRhosts should be set to yes (this method of Authentication should be avoided).  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  335. if [ "`grep -E ^HostbasedAuthentication /etc/ssh/sshd_config`" != "HostbasedAuthentication no" ]; then echo "SSHD Config: HostbasedAuthentication should be set to no (this method of Authentication should be avoided).  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  336. if [ "`grep -E ^RhostsRSAAuthentication /etc/ssh/sshd_config`" != "RhostsRSAAuthentication no" ]; then echo "SSHD Config: RhostsRSAAuthentication should be set to no (this method of Authentication should be avoided).  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  337. if [ "`grep -E ^GatewayPorts /etc/ssh/sshd_config`"            != ""                           ]; then echo "SSHD Config: GatewayPorts is configured.  These allow listening on non-localhost addresses on the server.  This is disabled by default, but has been added to the config file.  Recommend remove this setting unless needed.  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  338. if [ "`grep -E ^PermitTunnel /etc/ssh/sshd_config`"            != ""                           ]; then echo "SSHD Config: PermitTunnel is configured.  This allows point-to-point device forwarding and Virtual Tunnel software such as VTun to be used.  This is disabled by default, but has been added to the config file.  Recommend remove this setting unless needed.  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  339.  
  340. # Commenting out Subsystem sftp is fairly pointless, SCP can still be used and most tools fall back to SCP automatically.  Additionally, it's possible to copy files using just SSH and redirection.
  341. # if [ "`grep -E "^Subsystem sftp" /etc/ssh/sshd_config`"      != ""                           ]; then echo "SSHD Config: Comment out Subsystem SFTP (unless needed).  While enabled, any user with SSH shell access can browse the filesystem and transfer files using SFTP/SCP.  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  342.  
  343. if [ "$LBSA_ALLOW_ALL_SSH_PORT_FORWARDING" != "yes" ]; then
  344.     if [ "`grep -E ^AllowTcpForwarding /etc/ssh/sshd_config`" != "" ]; then
  345.         if [ "`grep -E ^AllowTcpForwarding /etc/ssh/sshd_config`" != "AllowTcpForwarding no" ]; then
  346.             if [ "`grep -E ^PermitOpen /etc/ssh/sshd_config`" = "" ]; then
  347.                 echo "SSHD Config: AllowTcpForwarding has been explicitly set to something other than no, but no PermitOpen setting has been specified.  This means any user that can connect to a shell or a forced-command based session that allows open port-forwarding, can port forward to any other accessible host on the network (authorized users can probe or launch attacks on remote servers via SSH port-forwarding and make it appear that connections are coming from this server).  Recommend disabling this feature by adding [AllowTcpForwarding no], or if port forwarding is required, providing a list of allowed host:ports entries with PermitOpen.  For example [PermitOpen sql.myhost.com:1433 mysql.myhost.com:3306].  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."
  348.                 echo "* Note: If this is ok for this machine, set LBSA_ALLOW_ALL_SSH_PORT_FORWARDING=yes in this script, or set the environment variable prior to calling this script."
  349.                 echo
  350.             fi
  351.         fi
  352.     fi
  353.     if [ "`grep -E ^AllowTcpForwarding /etc/ssh/sshd_config`" = "" ]; then
  354.         if [ "`grep -E ^PermitOpen /etc/ssh/sshd_config`" = "" ]; then
  355.             echo "SSHD Config: AllowTcpForwarding is not specified, so is currently set to the default (yes), but no PermitOpen setting has been specified.  This means any user that can connect to a shell or a forced-command based session that allows open port-forwarding, can port forward to any other accessible host on the network (authorized users can probe or launch attacks on remote servers via SSH port-forwarding and make it appear that connections are coming from this server).  Recommend disabling this feature by adding [AllowTcpForwarding no], or if port forwarding is required, providing a list of allowed host:ports entries with PermitOpen.  For example [PermitOpen sql.myhost.com:1433 mysql.myhost.com:3306].  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."
  356.             echo "* Note: If this is ok for this machine, set LBSA_ALLOW_ALL_SSH_PORT_FORWARDING=yes in this script, or set the environment variable prior to calling this script."
  357.             echo
  358.         fi
  359.     fi
  360. fi
  361.  
  362. # Additional recommendations (These are not critical, but helpful.  These are typically not specified so strictly by default
  363. # so will almost definitely require the user to change some of the settings manually.  They are in an additional section
  364. # because they are not as critical as the settings above.
  365. if [ "$LBSA_INCLUDE_EXTRA_SSH_RECOMMENDATIONS" = "yes" ]; then
  366.  
  367.     # Specify DenyUsers/DenyGroups for extra protection against root login over SSH
  368.     if [ "$LBSA_ALLOW_ROOT_LOGIN" != "true" ]; then
  369.         if [ "`grep -E ^DenyUsers /etc/ssh/sshd_config | grep root`"  = "" ]; then echo "SSHD Config: (Extra Recommendation) DenyUsers is not configured, or is configured but has not listed the root user.  Recommend adding [DenyUsers root] as an extra protection against root login (allow only su/sudo to obtain root access).  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  370.         if [ "`grep -E ^DenyGroups /etc/ssh/sshd_config | grep root`" = "" ]; then echo "SSHD Config: (Extra Recommendation) DenyGroup is not configured, or is configured but has not listed the root group.  This means that if a user is added to the root group and are able to log in over SSH, then that login is effectively the same as a root login anyway.  Recommend adding [DenyUsers root] as an extra protection against root login (allow only su/sudo to obtain root access).  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  371.     fi
  372.  
  373.     # Get rid of annoying RDNS lookups which can cause timeouts if RDNS fails
  374.     if [ "`grep -E "^UseDNS no" /etc/ssh/sshd_config`" = "" ]; then echo "SSHD Config: (Extra Recommendation) Set UseDNS no.  This will stop RDNS lookups during authentication.  Advantage 1: RDNS can be spoofed, which will place an incorrect entry in auth.log causing problems with automated log-based blocking of brute-force attack sources.  This change will eliminate the problem of RDNS spoofing.  Advantage 2: If RDNS fails, timeouts can occur during SSH login, preventing access to the server in worst cases.  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  375.  
  376.     # Reduce timeouts, max attempts and max number of concurrent logins
  377.     LoginGraceTime=`grep ^LoginGraceTime /etc/ssh/sshd_config | tr -s " " | cut -d " " -f 2`
  378.     if [ "$LoginGraceTime" = "" ]; then LoginGraceTime=120; fi
  379.     MaxAuthTries=`grep ^MaxAuthTries /etc/ssh/sshd_config | tr -s " " | cut -d " " -f 2`
  380.     if [ "$MaxAuthTries" = "" ]; then MaxAuthTries=6; fi
  381.     MaxStartups=`grep ^MaxStartups /etc/ssh/sshd_config | tr -s " " | cut -d " " -f 2`
  382.     if [ "$MaxStartups" = "" ]; then MaxStartups=10; fi
  383.     MaxConcurrent=`expr "$MaxStartups" "*" "$MaxAuthTries"`
  384.     if [ "$LoginGraceTime" -gt 30 ]; then echo "SSHD Config: (Extra Recommendation) LoginGraceTime is set to [$LoginGraceTime].  This setting can be used to reduce the amount of time a user is allowed to spend logging in.  A malicious user can use a large time window to more easily launch DoS attacks or consume your resources.  Recommend reducing this to 30 seconds (or lower) with the setting [LoginGraceTime 30].  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  385.     if [ "$MaxAuthTries" -gt 4 ]; then echo "SSHD Config: (Extra Recommendation) MaxAuthTries is set to [$MaxAuthTries].  This allows the user $MaxAuthTries attempts to log in per connection.  The total number of concurrent login attempts your machine provides are ($MaxAuthTries MaxAuthTries) * ($MaxStartups MaxStartups) = $MaxConcurrent.  Note that only half of these will be logged.  Recommend reducing this to 4 (or lower) with the setting [MaxAuthTries 4].  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  386.     if [ "$MaxStartups" -gt 3 ]; then echo "SSHD Config: (Extra Recommendation) MaxStartups is set to [$MaxStartups].  This allows the user to connect with $MaxStartups connections at the same time, before authenticating.  The total number of concurrent login attempts your machine provides are ($MaxAuthTries MaxAuthTries) * ($MaxStartups MaxStartups) = $MaxConcurrent.  Note that only half of these will be logged.  Recommend reducing this to 3 (or lower) with the setting [MaxStartups 3].  (Remember to restart SSHD with /etc/init.d/ssh restart after making changes)."; echo; fi
  387. fi
  388.  
  389.  
  390. #------------------------------------------------------------------------------------------------------------------------------
  391. # PERMISSIONS / OWNERS / GROUPS  -  LINUX TOP LEVEL FOLDER
  392. #------------------------------------------------------------------------------------------------------------------------------
  393.  
  394. check_path 755 root root /bin
  395. check_path 755 root root /boot
  396. check_path 755 root root /dev
  397. check_path 755 root root /etc
  398. check_path 755 root root /home
  399. check_path 755 root root /lib
  400. check_path 755 root root /lib64
  401. check_path 755 root root /media
  402. check_path 755 root root /mnt
  403. check_path 755 root root /opt
  404. check_path 555 root root /proc
  405. check_path 700 root root /root
  406. check_path 755 root root /run
  407. check_path 755 root root /sbin
  408. check_path 755 root root /srv
  409. if [ "`stat -L -c %a /sys | grep -v "555"`" = "" ]; then
  410.     # Allow sys to be 555 on newer distros like 12.10 onwards
  411.     check_path 555 root root /sys
  412. else
  413.     check_path 755 root root /sys
  414. fi
  415. check_path 1777 root root /tmp
  416. check_path 755 root root /usr
  417. check_path 755 root root /var
  418.  
  419.  
  420. #------------------------------------------------------------------------------------------------------------------------------
  421. # PERMISSIONS / OWNERS / GROUPS  -  /ETC/SSH FOLDER
  422. # Auto-fix all warnings in this area with: chmod 600 -R /etc/ssh; chown root:root -R /etc/ssh
  423. #------------------------------------------------------------------------------------------------------------------------------
  424.  
  425. # 600 seems ok for the entire /etc/ssh folder.  I can connect to SSH OK, and make outgoing SSH connections OK as various users.
  426. # This prevents non-root users from viewing or modifying SSH config details which could be used for attacks on other user
  427. # accounts or potential privelege elevation.
  428. check_path 600 root root /etc/ssh/moduli
  429. check_path 600 root root /etc/ssh/sshd_config
  430. check_path 600 root root /etc/ssh/sshd_host_dsa_key
  431. check_path 600 root root /etc/ssh/sshd_host_rsa_key
  432. check_path 600 root root /etc/ssh/sshd_host_ecdsa_key
  433. check_path 600 root root /etc/ssh/sshd_host_key
  434. check_path 600 root root /etc/ssh/blacklist.DSA-1024
  435. check_path 600 root root /etc/ssh/blacklist.RSA-2048
  436.  
  437. # Ubuntu defaults private keys to 600 all other files to 644
  438. # CentOS defaults public keys to 644 all other files to 600
  439. check_path 600 root root /etc/ssh/ssh_config
  440. check_path 600 root root /etc/ssh/ssh_host_dsa_key.pub
  441. check_path 600 root root /etc/ssh/ssh_host_rsa_key.pub
  442. check_path 600 root root /etc/ssh/ssh_host_ecdsa_key.pub
  443. check_path 600 root root /etc/ssh/ssh_host_key.pub
  444.  
  445. # Ubuntu defaults folder to 755
  446. # CentOS defaults folder to 755
  447. check_path 600 root root /etc/ssh
  448.  
  449.  
  450. #------------------------------------------------------------------------------------------------------------------------------
  451. # PERMISSIONS / OWNERS / GROUPS  -  /ETC FOLDER SPECIAL FILES
  452. #------------------------------------------------------------------------------------------------------------------------------
  453.  
  454. # These are just the Ubuntu defaults as per 12.04, ensure they haven't changed
  455. check_path 440 root root /etc/sudoers
  456. check_path 600 root root /etc/.pwd.lock
  457. check_path 600 root root /etc/gshadow-
  458. check_path 600 root root /etc/group-
  459. check_path 600 root root /etc/shadow-
  460. check_path 600 root root /etc/passwd-
  461. check_path 640 root daemon /etc/at.deny
  462. check_path 640 root fuse /etc/fuse.conf
  463. check_path 640 root shadow /etc/shadow
  464. check_path 640 root shadow /etc/gshadow
  465. check_path 755 root root /etc/rmt
  466. check_path 755 root root /etc/rc.local
  467.  
  468.  
  469. #--------------------------------------------------------------------------------------------------------------
  470. # CHECK FOR WORLD WRITABLE FOLDERS
  471. #--------------------------------------------------------------------------------------------------------------
  472.  
  473. # Search for world writables in /etc or other folders
  474. FOLDERS="/etc /bin /sbin /usr/bin"
  475. for FOLDER in $FOLDERS
  476. do
  477.     # Find any files/folders in /etc which are world-writable
  478.     # Future: also need to ensure files are owned by root.  If not, they may be able to be written to anyway.
  479.     if [ "`find $FOLDER -type f -perm -002`" != "" ]; then
  480.         echo "Warning: There are files under [$FOLDER] which are world writable.  It is a security risk to have world-writables in this folder, as they may be modified by other users and executed as root."
  481.         echo "A complete list of these files follows:"
  482.         find $FOLDER -type f -perm -002 | xargs -r ls -al
  483.         echo ""
  484.     fi
  485.     if [ "`find $FOLDER -type d -perm -002`" != "" ]; then
  486.         echo "Warning: There are folders in [$FOLDER] which are world writable.  It is a security risk to have world-writables in this folder, as they may be modified by other users and executed as root."
  487.         echo "A complete list of these folders follows:"
  488.         find $FOLDER -type d -perm -002
  489.         echo ""
  490.     fi
  491. done
  492.  
  493.  
  494. #--------------------------------------------------------------------------------------------------------------
  495. # CHECK FOR INSECURE TMP AND SHM FOLDERS /tmp, /usr/tmp, /var/tmp, /dev/shm
  496. #--------------------------------------------------------------------------------------------------------------
  497.  
  498. # TODO: this doesn't check /usr/tmp or /var/tmp yet
  499.  
  500. # /tmp
  501.  
  502. # First ensure that /tmp is a separate partition in mtab, otherwise the following tests are useless
  503. if [ "$LBSA_ALLOW_NON_SEPARATE_TMP_PARTITION" != "true" ]; then
  504.     if [ "`cat /etc/mtab | grep /tmp`" = "" ]; then
  505.         echo "Warning: /tmp is not a separate partition, so cannot be marked nodev/nosuid/noexec.  Override this warning with LBSA_ALLOW_NON_SEPARATE_TMP_PARTITION=true";
  506.     else
  507.  
  508.     # Ensure noexec
  509.     # Note: Even though most admins recommend /tmp is noexec, the aptitude (apt-get) tool in do-release-upgrade mode
  510.     # require exec permissions in /tmp and will stop with an error before installing the upgrade because /tmp has no exec permissions.
  511.     # Workaround: Either edit /etc/apt/apt.conf and change the TempDir for apt to something else (such as /var/cache/apt/tmp), or before using the do-release-upgrade command, use this command to temporarily assign exec rights on /tmp: [mount -oremount,exec /tmp]
  512.     if [ "`cat /etc/mtab | grep /tmp | grep noexec`" = "" ]; then
  513.         echo "Warning: /tmp has EXECUTE permissions.  Recommend adding noexec attribute to mount options for /tmp, in /etc/fstab."
  514.         echo "This change will help in preventing malicious users from installing and executing binary files from the folder."
  515.         echo "To test, run these commands.  The output should say Permission denied if your system is already protected: cp /bin/ls /tmp; /tmp/ls; rm /tmp/ls;"
  516.         echo "Tip: after adding the attribute, you can remount the partition with [mount -oremount /tmp] to avoid having to reboot."
  517.         echo "Note: Even though most admins recommend /tmp is noexec, Ubuntu release upgrades require exec permissions in /tmp for some reason and will stop with an error before installing the upgrade because /tmp has no exec permissions."
  518.         echo "Workaround: Either edit /etc/apt/apt.conf and change the TempDir for apt to something else (such as /var/cache/apt/tmp), or before using the do-release-upgrade command, use this command to temporarily assign exec rights on /tmp: [mount -oremount,exec /tmp]"
  519.         echo ""
  520.     fi
  521.    
  522.     # Ensure nosuid
  523.     if [ "`cat /etc/mtab | grep /tmp | grep nosuid`" = "" ]; then
  524.         echo "Warning: /tmp has SUID permissions.  Recommend adding nosuid attribute to mount options for /tmp, in /etc/fstab."
  525.         echo "This change will help in preventing malicious users from setting SUID on files on this folder.  SUID files will run as root if they are owned by root."
  526.         echo "Tip: after adding the attribute, you can remount the partition with [mount -oremount /tmp] to avoid having to reboot."
  527.         echo ""
  528.     fi
  529.    
  530.     # Ensure nodev
  531.     if [ "`cat /etc/mtab | grep /tmp | grep nodev`" = "" ]; then
  532.         echo "Warning: /tmp has DEVICE permissions.  Recommend adding nodev attribute to mount options for /tmp, in /etc/fstab."
  533.         echo "This change will help in preventing malicious users from creating device files in the folder.  Device files should be creatable in temporary folders."
  534.         echo "Tip: after adding the attribute, you can remount the partition with [mount -oremount /tmp] to avoid having to reboot."
  535.         echo ""
  536.         fi
  537.     fi
  538. fi
  539.  
  540. # /dev/shm
  541.  
  542. if [ "`cat /etc/mtab | grep /dev/shm`" != "" ]; then
  543.  
  544.     # Ensure noexec
  545.     if [ "`cat /etc/mtab | grep /dev/shm | grep noexec`" = "" ]; then
  546.         echo "Warning: /dev/shm has EXECUTE permissions.  Recommend adding noexec attribute to mount options for /dev/shm, in /etc/fstab."
  547.         echo "This change will help in preventing malicious users from installing and executing malicious files from the folder."
  548.         echo "To test, run these commands.  The output should say Permission denied if your system is already protected: cp /bin/ls /dev/shm; /dev/shm/ls; rm /dev/shm/ls;"
  549.         if [ "`cat /etc/fstab | grep /dev/shm`" = "" ]; then
  550.             echo "Note: you do not currently have /dev/shm listed in /etc/fstab, so it is being mounted with default options by Linux."
  551.             echo "To fix, add this line to /etc/fstab, then remount it with [mount -oremount /dev/shm] to avoid having to reboot."
  552.             echo "none /dev/shm tmpfs defaults,noexec,nosuid,nodev 0 0"
  553.             echo ""
  554.         else
  555.             echo "Tip: after adding the attribute, you can remount the partition with [mount -oremount /dev/shm] to avoid having to reboot."
  556.         fi
  557.         echo ""
  558.     fi
  559.    
  560.     # Ensure nosuid
  561.     if [ "`cat /etc/mtab | grep /dev/shm | grep nosuid`" = "" ]; then
  562.         echo "Warning: /dev/shm has SUID permissions.  Recommend adding nosuid attribute to mount options for /dev/shm, in /etc/fstab."
  563.         echo "This change will help in preventing malicious users from setting SUID on files on this folder.  SUID files will run as root if they are owned by root."
  564.         if [ "`cat /etc/fstab | grep /dev/shm`" = "" ]; then
  565.             echo "Note: you do not currently have /dev/shm listed in /etc/fstab, so it is being mounted with default options by Linux."
  566.             echo "To fix, add this line to /etc/fstab, then remount it with [mount -oremount /dev/shm] to avoid having to reboot."
  567.             echo "none /dev/shm tmpfs defaults,noexec,nosuid,nodev 0 0"
  568.             echo ""
  569.         else
  570.             echo "Tip: after adding the attribute, you can remount the partition with [mount -oremount /dev/shm] to avoid having to reboot."
  571.         fi
  572.         echo ""
  573.     fi
  574.    
  575.     # Ensure nodev
  576.     if [ "`cat /etc/mtab | grep /dev/shm | grep nodev`" = "" ]; then
  577.         echo "Warning: /dev/shm has DEVICE permissions.  Recommend adding nodev attribute to mount options for /dev/shm, in /etc/fstab."
  578.         echo "This change will help in preventing malicious users from creating device files in the folder.  Device files should be creatable in temporary folders."
  579.         if [ "`cat /etc/fstab | grep /dev/shm`" = "" ]; then
  580.             echo "Note: you do not currently have /dev/shm listed in /etc/fstab, so it is being mounted with default options by Linux."
  581.             echo "To fix, add this line to /etc/fstab, then remount it with [mount -oremount /dev/shm] to avoid having to reboot."
  582.             echo "none /dev/shm tmpfs defaults,noexec,nosuid,nodev 0 0"
  583.             echo ""
  584.         else
  585.             echo "Tip: after adding the attribute, you can remount the partition with [mount -oremount /dev/shm] to avoid having to reboot."
  586.         fi
  587.         echo ""
  588.     fi
  589. fi
  590.  
  591.  
  592. #--------------------------------------------------------------------------------------------------------------
  593. # CHECK HEARTBEAT CONFIG (if present)
  594. #--------------------------------------------------------------------------------------------------------------
  595.  
  596. if [ -e /etc/ha.d ]; then
  597.  
  598.     # Default is 755, but no reason for non-root users to have access to these details
  599.     check_path 755 root root /etc/ha.d
  600.  
  601.     # Default is 600, but make sure it doesn't change
  602.     # If details are known by user accounts, they can potentially send malicious heartbeat messages over UDP and cause havoc
  603.     # If heartbeat is not installed, this file will not be present
  604.     check_path 600 root root /etc/ha.d/authkeys
  605. fi
  606.  
  607.  
  608. #--------------------------------------------------------------------------------------------------------------
  609. # CHECK DRBD CONFIG (if present)
  610. #--------------------------------------------------------------------------------------------------------------
  611.  
  612. if [ -e /etc/drbd.conf ]; then
  613.  
  614.     # Default is 755, but if users have access to this file they can find out the shared-secret encryption key
  615.     check_path 600 root root /etc/drbd.conf
  616.  
  617.     # Check that drbd.conf contains shared-secret keys, otherwise there is no protection against malicious external DRBD packets
  618.     if [ "`grep shared-secret /etc/drbd.conf`" = "" ]; then
  619.         echo "Warning: No shared-secret configured in /etc/drbd.conf.  There is no protection against malicious external DRBD packets which may cause data corruption on your DRBD disks.  Ensure that every disk is configured with a shared-secret attribute."; echo;
  620.     fi
  621. fi
  622.  
  623.  
  624. #--------------------------------------------------------------------------------------------------------------
  625. # DONE
  626. #--------------------------------------------------------------------------------------------------------------
  627.  
  628. echo "System Checks Completed"
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!