API tools faq
paste
Advertisement
gen2monk

Untitled

gen2monk
Aug 5th, 2014
1,179
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 70.97 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/sh
  2.  
  3. ######################################################################
  4. # PWC unix interrogation script nextgen
  5. # Written by: anindya, rcrum
  6. #
  7. #
  8. # $Id: secng.sh,v 2.1 2006-05-08 15:23:40 jbausch Exp $
  9. # $Author: jbausch $
  10. # $Date: 2006-05-08 15:23:40 $
  11. ######################################################################
  12. # Complete list of functions:
  13. ######################################################################
  14. #
  15. # usage () {
  16. # print_version () {
  17. # dump_global_opts () {
  18. # print_separator () {
  19. # print_flag_header () {
  20. # get_file () {
  21. # check_os () {
  22. # do_intro () {
  23. # do_outro () {
  24. # do_setup_output_files () {
  25. # do_chmod () {
  26. # do_file_cleanup () {
  27. # do_tar () {
  28. # do_xchecks () {
  29. # do_ftpchecks () {
  30. # do_sendmailchecks () {
  31. # do_nfschecks () {
  32. # do_bindchecks () {
  33. # do_sshchecks () {
  34. # do_net_checks () {
  35. # do_uname () {
  36. # do_accts_no_pass () {
  37. # do_uid_zero () {
  38. # do_fs_checks () {
  39. # do_cron_checks () {
  40. # do_log_checks () {
  41. # do_users_files_check () {
  42. # do_dmesg () {
  43. # do_general_checks () {
  44. # do_nis_check () {
  45. # do_nisplus_check () {
  46. # do_key_dirs_listing () {
  47. # do_finds () {
  48. # do_os_modules () {
  49. # do_custom_dir () {
  50. #
  51. ######################################################################
  52. #
  53. # function definitions
  54. #
  55. ######################################################################
  56. # function to print usage
  57. ######################################################################
  58. usage () {
  59. ${ECHO} ""
  60. ${ECHO} "Usage: $0 [options]"
  61. ${ECHO} ""
  62. ${ECHO} "[-debug|-nodebug] Toggle DEBUG [default=off]"
  63. ${ECHO} "[-conftar|-noconftar] Toggle DO_CONFIGTAR [default=off]"
  64. ${ECHO} "[-tar|-notar] Toggle DO_TAR [default=on]"
  65. ${ECHO} "[-users|-nousers] Toggle DO_SEARCH_USERS [default=on]"
  66. ${ECHO} "[-nis|-nonis] Toggle DO_NIS [default=on]"
  67. ${ECHO} "[-nisusers] Toggle DO_NIS_SEARCH_USERS [default=off]"
  68. ${ECHO} "[-nisplus|-nonisplus] Toggle DO_NISPLUS [default=on]"
  69. ${ECHO} "[-nisplususers] Toggle DO_NISPLUS_SEARCH_USERS [default=off]"
  70. ${ECHO} "[-finds|-nofinds] Toggle DO_ALLFINDS [default=on]"
  71. ${ECHO} "[-keydirs|-nokeydirs] Toggle DO_KEY_DIRS_LISTING [default=on]"
  72. ${ECHO} "[-osmods|-noosmods] Toggle DO_OS_MODULES [default=on]"
  73. ${ECHO} "[-noshadow] Turn OFF DO_GET_SHADOWFILE [default=on]"
  74. ${ECHO} "[-bind] Turn ON DO_BIND [default=off]"
  75. ${ECHO} "[-custom] Turn ON Custom Dir Checks [default=off]"
  76. ${ECHO} "[-v|-version] Print $0 version and exit"
  77. ${ECHO} "[-h|-help] Print this usage message"
  78. ${ECHO} ""
  79. ${ECHO} "Example: $0 -debug -tar -nonis -nonisplus -nofinds"
  80. ${ECHO} ""
  81. ${ECHO} "This command turns on debugging, creates an output tarball"
  82. ${ECHO} "turns off the nis and nis+ checks"
  83. ${ECHO} "and turns off the setuid/setgid/ww find comands"
  84. ${ECHO} ""
  85. ${ECHO} "Also see etc/global.rc for detailed info on flags"
  86. }
  87. ######################################################################
  88. # function to print version
  89. ######################################################################
  90. print_version () {
  91. VERSION=`${GREP} Id $0 |${GREP} "^#"|${AWK} '{print $4}'`
  92. ${ECHO} "$0 version ${VERSION}"
  93. }
  94.  
  95. ######################################################################
  96. # function to dump all global variables called from main
  97. ######################################################################
  98. dump_global_opts () {
  99.  
  100. ${ECHO} "Dumping global variables to output file" >>${OUTFILE}
  101. ${ECHO} "<DEBUGGLOBALOPTS>" >>${TAGS_OUT}
  102. print_separator outfile
  103. # export all variables
  104. for i in ${GLOBALOPTS}
  105. do
  106. export $i
  107. done
  108.  
  109. case "${OS}" in
  110.  
  111. 'Linux'|'AIX'|'FreeBSD'|'OpenBSD'|'NetBSD'|'OSF1'|'HP-UX'|'SCO_SV')
  112. ${AWK} ' BEGIN { for (env in ENVIRON) print env "=" ENVIRON[env] }'|${SORT} |${TEE} ${TAGS_OUT} >>${OUTFILE}
  113. ;;
  114. 'Solaris')
  115. ${NAWK} ' BEGIN { for (env in ENVIRON) print env "=" ENVIRON[env] }'|${SORT} |${TEE} ${TAGS_OUT} >>${OUTFILE}
  116. ;;
  117. 'Sol9')
  118. ${NAWK} ' BEGIN { for (env in ENVIRON) print env "=" ENVIRON[env] }'|${SORT} |${TEE} ${TAGS_OUT} >>${OUTFILE}
  119. ;;
  120. 'Sol10')
  121. ${NAWK} ' BEGIN { for (env in ENVIRON) print env "=" ENVIRON[env] }'|${SORT} |${TEE} ${TAGS_OUT} >>${OUTFILE}
  122. ;;
  123. *)
  124. ${AWK} ' BEGIN { for (env in ENVIRON) print env "=" ENVIRON[env] }' |${SORT} |${TEE} ${TAGS_OUT} >>${OUTFILE}
  125. ${NAWK} ' BEGIN { for (env in ENVIRON) print env "=" ENVIRON[env] }' |${SORT} |${TEE} ${TAGS_OUT} >>${OUTFILE}
  126. ;;
  127. esac
  128. print_separator outfile
  129. ${ECHO} "Script VERSION is:" |${TEE} ${TAGS_OUT} >>${OUTFILE}
  130. print_version |${TEE} ${TAGS_OUT} >>${OUTFILE}
  131. print_separator outfile
  132. ${ECHO} "</DEBUG-GLOBALOPTS>" >>${TAGS_OUT}
  133. }
  134. ######################################################################
  135. # function to print out a nice line to separate output, called from many func
  136. ######################################################################
  137. print_separator () {
  138. case "$1" in
  139. 'stdout')
  140. ${ECHO} '===================================================='
  141. ;;
  142. 'outfile')
  143. case "$2" in
  144.  
  145. 'userfiles')
  146. ${ECHO} '====================================================' >>${USER_FILE_OUT}
  147. ;;
  148. 'logs')
  149. ${ECHO} '====================================================' >>${LOG_FILE_OUT}
  150. ;;
  151. 'keydirs')
  152. ${ECHO} '====================================================' >>${KEYDIRS_OUT}
  153. ;;
  154. 'mods')
  155. ${ECHO} '====================================================' >>${MODS_OUT}
  156. ;;
  157. 'custdirs')
  158. ${ECHO} '====================================================' >>${CUSTDIRS_OUT}
  159. ;;
  160. 'tagsout')
  161. ${ECHO} '**************************' >>${TAGS_OUT}
  162. ;;
  163. *)
  164. ${ECHO} '====================================================' >>${OUTFILE}
  165. ;;
  166. esac
  167. ;;
  168. *)
  169. ${ECHO} "Argument must be stdout or outfile."
  170. ;;
  171. esac
  172. }
  173. ####################################################################
  174. # print_flag_header
  175. # $1 must be stdout or outfile
  176. # $2 must be userfiles/logs/keydirs/mods/custdir or main
  177. # $3 is either BEGIN or END
  178. # $4 is the text to be printed, a flag such
  179. # as DO_ACCTNOPASS or module name
  180. ####################################################################
  181. print_flag_header () {
  182.  
  183. case "$1" in
  184. 'stdout')
  185. print_separator stdout
  186. ${ECHO} "DEBUG: $2 $3 $4 $5"
  187. print_separator stdout
  188. ;;
  189. 'outfile')
  190. case "$2" in
  191.  
  192. 'userfiles')
  193. print_separator outfile userfiles
  194. ${ECHO} "USERFILES_$3: $4">>${USER_FILE_OUT}
  195. print_separator outfile userfiles
  196. ;;
  197. 'logs')
  198. print_separator outfile logs
  199. ${ECHO} "LOGS_$3: $4">>${LOG_FILE_OUT}
  200. print_separator outfile logs
  201. ;;
  202. 'keydirs')
  203. print_separator outfile keydirs
  204. ${ECHO} "KEYDIRS_$3: $4">>${KEYDIRS_OUT}
  205. print_separator outfile keydirs
  206. ;;
  207. 'mods')
  208. print_separator outfile mods
  209. ${ECHO} "MODULE_$3: $4">>${MODS_OUT}
  210. print_separator outfile mods
  211. ;;
  212. 'main')
  213. print_separator outfile
  214. ${ECHO} "CHECK_$3: $4">>${OUTFILE}
  215. print_separator outfile
  216. #added for TAG support, not used yet
  217. #${ECHO} "<CHECK_$3: $4" >>${TAGS_OUT}
  218. ;;
  219. 'custdirs')
  220. print_separator outfile custdirs
  221. ${ECHO} "CUSTDIRS_$3: $4">>${CUSTDIRS_OUT}
  222. print_separator outfile custdirs
  223. ;;
  224. *)
  225. ${ECHO} "Arguments: [userfiles|logs|keydirs|mods|main|custdirs]"
  226. ;;
  227. esac
  228. ;;
  229. *)
  230. ${ECHO} "Argument must be stdout or outfile."
  231. ;;
  232. esac
  233. }
  234. ####################################################################
  235. ####################################################################
  236. # function to check for existence of a file , then cat it to outfile
  237. # takes filename as an argument, called from many diff functions
  238. ####################################################################
  239. get_file () {
  240.  
  241. # check to make sure we were passed some args
  242. if [ $# = 0 ]; then
  243. ${ECHO} "get_file(): no file specified."
  244. ${ECHO} "get_file(): no file specified." >>${ERRFILE}
  245. return
  246. fi
  247.  
  248. target=$1;
  249. name="";
  250.  
  251. case "$2" in
  252. 'userfiles')
  253. OUT=${USER_FILE_OUT}
  254. ;;
  255. 'mods')
  256. OUT=${MODS_OUT}
  257. ;;
  258. *)
  259. OUT=${OUTFILE}
  260. ;;
  261. esac
  262.  
  263. if ( ${TEST} -f ${target} ) then
  264.  
  265. print_separator outfile $2
  266. name=`${BASENAME} ${target}|${TR} '[a-z]' '[A-Z]'`
  267. ${ECHO} "[FILE]: ${name}" >>${OUT}
  268.  
  269. ${ECHO} "<FILE TAG=\"${name}\"" >>${TAGS_OUT}
  270.  
  271. #only perform ls -l once
  272. DO_LS_ONCE=`${LS} -l ${target}`
  273.  
  274. ${ECHO} "${DO_LS_ONCE}" >>${OUT} 2>>${ERRFILE}
  275.  
  276. ${ECHO} "LS=\"${DO_LS_ONCE}\">" >>${TAGS_OUT}
  277.  
  278. # if the file is a symlink to another file,
  279. # dereference the link also.
  280. if ( ${TEST} -L ${target} ) then
  281. ${LS} -lL ${target} >>${OUT} 2>>${ERRFILE} >>${TAGS_OUT}
  282. fi
  283. print_separator outfile $2
  284.  
  285. if [ "${DO_CONFIGTAR}" = "0" ]; then
  286.  
  287. [ "${DEBUG}" != "0" ] && {
  288. ${ECHO} "DEBUG: Grabbing ${target}"
  289. }
  290. ${CAT} ${target} >> ${OUT} 2>>${ERRFILE}
  291.  
  292. # Added line to capture in TAGS file
  293. ${CAT} ${target} >>${TAGS_OUT} 2>>${ERRFILE}
  294.  
  295. print_separator outfile $2
  296. ${ECHO} "</FILE>" >>${TAGS_OUT}
  297. ${ECHO} '' >> ${OUT}
  298.  
  299. elif ( [ "${DO_CONFIGTAR}" = "1" ] && [ -d "${SYSDIR}" ] ); then
  300.  
  301. # get path to duplicate under SYSDIR
  302. pathtotarget=`${DIRNAME} ${target}`
  303.  
  304. [ "${DEBUG}" != "0" ] && {
  305. ${ECHO} "DEBUG: Copying ${target}"
  306. }
  307.  
  308. # if file is /etc/rc2.d/S99sendmail it creates SYSDIR/etc/rc2.d
  309. ${MKDIR} -p ${SYSDIR}/${pathtotarget} 2>>${ERRFILE}
  310. # copy the file over
  311. ${CP} -p ${target} ${SYSDIR}/${pathtotarget} 2>>${ERRFILE}
  312.  
  313. else
  314.  
  315. ${MKDIR} -p ${SYSDIR} 2>${ERRFILE}
  316. # get path to duplicate under SYSDIR
  317. pathtotarget=`${DIRNAME} ${target}`
  318.  
  319. [ "${DEBUG}" != "0" ] && {
  320. ${ECHO} "DEBUG: Copying ${target}"
  321. }
  322.  
  323. # if file is /etc/rc2.d/S99sendmail it creates SYSDIR/etc/rc2.d
  324. ${MKDIR} -p ${SYSDIR}/${pathtotarget} 2>>${ERRFILE}
  325. # copy the file over
  326. ${CP} -p ${target} ${SYSDIR}/${pathtotarget} 2>>${ERRFILE}
  327.  
  328. fi
  329. else
  330. name=`${BASENAME} ${target}|${TR} '[a-z]' '[A-Z]'`
  331. print_separator outfile $2
  332. ${ECHO} "[FILE]: ${name} <NOT FOUND>" >> ${OUT}
  333. ${ECHO} "<FILE TAG=\"${name}\"> NOT FOUND </FILE>" >>${TAGS_OUT}
  334. print_separator outfile $2
  335. fi
  336. }
  337. ######################################################################
  338. # function check_os, called from main
  339. # Determine OS first to get binary paths
  340. # Ignore errors here
  341. #
  342. ######################################################################
  343. check_os () {
  344. # get operating system name
  345. OS=`/usr/bin/uname -s 2>>/dev/null`
  346. [ "x${OS}" = "x" ] && {
  347. OS=`/bin/uname -s 2>>/dev/null`
  348. }
  349. # get operating system release version
  350. OS_RELEASE=`/usr/bin/uname -r 2>>/dev/null`
  351. [ "x${OS_RELEASE}" = "x" ] && {
  352. OS_RELEASE=`/bin/uname -r 2>>/dev/null`
  353. }
  354.  
  355. # export these values for use elsewhere
  356. export OS OS_RELEASE
  357.  
  358. case "${OS}" in
  359. 'Linux')
  360. OS_CONF=${LINUX_CONF}
  361. MODULES=${LINUX_MODS}
  362. ;;
  363. 'SunOS')
  364. RELEASE=`/bin/uname -r | /usr/bin/cut -c1`
  365. if ( /usr/bin/test "${RELEASE}" = "5" ) then
  366. # added for sol9
  367. SUBRELEASE=`/bin/uname -r | /usr/bin/cut -c3-4 `
  368. if ( /usr/bin/test "${SUBRELEASE}" = "9" ) then
  369. OS="Sol9"
  370. #echo "System type is Solaris9"
  371. OS_CONF=${SOL9_CONF}
  372. MODULES=${SOL9_MODS}
  373. # added for sol10
  374. elif ( /usr/bin/test "${SUBRELEASE}" = "10" ) then
  375. OS="Sol10"
  376. #echo "System type is Solaris10"
  377. OS_CONF=${SOL10_CONF}
  378. MODULES=${SOL10_MODS}
  379. else
  380. OS="Solaris"
  381. #echo "System type is Solaris6-8"
  382. OS_CONF=${SOLARIS_CONF}
  383. MODULES=${SOLARIS_MODS}
  384. fi
  385. else
  386. #echo "System type is SunOS"
  387. OS_CONF=${SUNOS_CONF}
  388. MODULES=${SUNOS_MODS}
  389. fi
  390. ;;
  391. 'BSD/OS')
  392. #echo "System type is BSD"
  393. # im afraid this will not work for now
  394. OS_CONF=${BSD_CONF}
  395. MODULES=${BSD_MODS}
  396. ;;
  397. 'FreeBSD'|'OpenBSD'|'NetBSD')
  398. #echo "System type is BSD"
  399. OS_CONF=${BSD_CONF}
  400. MODULES=${BSD_MODS}
  401. ;;
  402. 'AIX')
  403. #echo "System type is AIX"
  404. OS_CONF=${AIX_CONF}
  405. MODULES=${AIX_MODS}
  406. ;;
  407. 'HP-UX')
  408. echo "System type is HP-UX"
  409. OS_CONF=${HPUX_CONF}
  410. MODULES=${HPUX_MODS}
  411. ;;
  412. 'SCO_SV')
  413. #echo "System type is SCO"
  414. OS_CONF=${SCO_CONF}
  415. MODULES=${SCO_MODS}
  416. ;;
  417. 'OSF1'|'osf1')
  418. #echo "System type is DEC OSF1"
  419. OS_CONF=${OSF1_CONF}
  420. MODULES=${OSF1_MODS}
  421. ;;
  422. *)
  423. echo "WARNING!!! Unknown OS. Absolute pathnames will NOT be used."
  424. echo "Press Ctrl-C to exit or wait 15 seconds to continue."
  425. echo ""
  426. sleep 15
  427. OS_CONF=${GENERIC_CONF}
  428. ;;
  429. esac
  430.  
  431. # source the appropriate config file
  432. if [ "${DEBUG}" != 0 ]; then
  433. echo "DEBUG: Using OS configuration file: ${OS_CONF}"
  434. fi
  435.  
  436. if [ -f ${OS_CONF} ]; then
  437. . ${OS_CONF}
  438. else
  439. echo "${OS_CONF} not found! Quitting."
  440. exit 1;
  441. fi
  442. return;
  443.  
  444. } # end check_os
  445. ####################################################################
  446. # function to print out start banner and copyright, called from main
  447. ####################################################################
  448. do_intro () {
  449. print_separator stdout
  450. ${ECHO} "${COPYRIGHT}"
  451. print_separator stdout
  452. print_version
  453. print_separator stdout
  454. ${ECHO} "Beginning Security Profile on ${HOSTNAME}"
  455. ${ECHO} " Start time - `date`"
  456. print_separator stdout
  457.  
  458. # write the start to the logfile
  459. print_separator outfile
  460. # print the script version at the top
  461. print_version >>${OUTFILE}
  462. print_separator outfile
  463. ${ECHO} "Beginning Security Profile on ${HOSTNAME}" >>${OUTFILE}
  464. ${ECHO} " Start time - `date`" >>${OUTFILE}
  465. print_separator outfile
  466.  
  467. # write the start of the logfile in fancy support
  468. ${ECHO} "<SECNG_VERSION>" >>${TAGS_OUT}
  469. ${ECHO} "${VERSION}" >>${TAGS_OUT}
  470. ${ECHO} "</SECNG_VERSION>" >>${TAGS_OUT}
  471.  
  472. ${ECHO} "<HOSTNAME>" >>${TAGS_OUT}
  473. ${ECHO} "${HOSTNAME}" >>${TAGS_OUT}
  474. ${ECHO} "</HOSTNAME>" >>${TAGS_OUT}
  475.  
  476. ${ECHO} "<STARTTIME>" >>${TAGS_OUT}
  477. ${ECHO} "`date`" >>${TAGS_OUT}
  478. ${ECHO} "</STARTTIME>" >>${TAGS_OUT}
  479.  
  480. }
  481.  
  482. ####################################################################
  483. # function to print out end banner, called from main
  484. ####################################################################
  485. do_outro () {
  486. print_separator stdout
  487. ${ECHO} "Finished Security Profile on ${HOSTNAME}"
  488. ${ECHO} "End time - `date`"
  489. print_separator stdout
  490.  
  491. print_separator outfile
  492. ${ECHO} "<ENDTIME>" >> ${TAGS_OUT}
  493. ${ECHO} "Finished Security Profile on ${HOSTNAME}" >>${OUTFILE}
  494. ${ECHO} "End time - `date`" |${TEE} ${TAGS_OUT} >> ${OUTFILE}
  495. ${ECHO} "</ENDTIME>" >> ${TAGS_OUT}
  496. print_separator outfile
  497. ${ECHO} '' >> ${OUTFILE}
  498.  
  499.  
  500. }
  501. ######################################################################
  502. # function to name output files, called from main
  503. ######################################################################
  504. do_setup_output_files () {
  505.  
  506. HOSTNAME=`${HOST_CMD}`
  507. if (${TEST} x${HOSTNAME} = x) then
  508. HOSTNAME="unknown"
  509. fi
  510.  
  511. # filename definitions
  512. OUTFILE="${OUTDIR}/${HOSTNAME}.`date +%Y%m%d`"
  513. TARFILE="${OUTFILE}.tar"
  514. ERRFILE="${OUTFILE}.errors"
  515. SETUID_OUT=${OUTFILE}.setUID
  516. SETGID_OUT=${OUTFILE}.setGID
  517. WW_OUT=${OUTFILE}.ww
  518. USER_FILE_OUT=${OUTFILE}.userfiles
  519. LOG_FILE_OUT=${OUTFILE}.logs
  520. KEYDIRS_OUT=${OUTFILE}.keydirs
  521. MODS_OUT=${OUTFILE}.osmodules
  522. SYSDIR=${OUTFILE}.configs
  523. CUSTDIRS_OUT=${OUTFILE}.custom
  524. TAGS_OUT=${OUTFILE}.tags
  525.  
  526. if [ "${DEBUG}" != 0 ]; then
  527. ${ECHO} ''
  528. ${ECHO} "DEBUG: OUTFILE is ${OUTFILE}"
  529. ${ECHO} "DEBUG: TARFILE is ${TARFILE}"
  530. ${ECHO} "DEBUG: ERRFILE is ${ERRFILE}"
  531. ${ECHO} "DEBUG: SETUID_OUT is ${SETUID_OUT}"
  532. ${ECHO} "DEBUG: SETGID_OUT is ${SETGID_OUT}"
  533. ${ECHO} "DEBUG: WW_OUT is ${WW_OUT}"
  534. ${ECHO} "DEBUG: USER_FILE_OUT is ${USER_FILE_OUT}"
  535. ${ECHO} "DEBUG: LOG_FILE_OUT is ${LOG_FILE_OUT}"
  536. ${ECHO} "DEBUG: KEYDIRS_OUT is ${KEYDIRS_OUT}"
  537. ${ECHO} "DEBUG: MODS_OUT is ${MODS_OUT}"
  538. ${ECHO} "DEBUG: SYSDIR is ${SYSDIR}"
  539. ${ECHO} "DEBUG: CUSTDIRS_OUT is ${CUSTDIRS_OUT}"
  540. ${ECHO} "DEBUG: TAGS_OUT is ${TAGS_OUT}"
  541. ${ECHO} ''
  542. fi
  543.  
  544. return;
  545. }
  546. ####################################################################
  547. # function to do housekeeping, remove old output files
  548. # if they exist. Give operator an opportunity to abort., called from main
  549. ####################################################################
  550. do_file_cleanup () {
  551.  
  552. if ([ -f ${OUTFILE} ] || [ -f ${TARFILE} ] || [ -f ${TARFILE}.gz ]) then
  553. ${ECHO} ""
  554. print_separator stdout
  555. ${ECHO} ""
  556. ${ECHO} "WARNING!!! WARNING!!! WARNING!!! WARNING!!! WARNING!!!"
  557. ${ECHO} ""
  558. ${ECHO} "${OUTFILE} (or a tarred version) already exists."
  559. ${ECHO} "Press Ctrl-C to exit or wait to delete the existing files."
  560. ${ECHO} ""
  561. ${ECHO} "WARNING!!! WARNING!!! WARNING!!! WARNING!!! WARNING!!!"
  562. ${ECHO} ""
  563. print_separator stdout
  564. sleep 5
  565. for i in ${OUTFILE} ${TARFILE} ${TARFILE}.gz ${ERRFILE} ${SETUID_OUT} ${SETGID_OUT} ${WW_OUT} ${USER_FILE_OUT} ${LOG_FILE_OUT} ${KEYDIRS_OUT} ${MODS_OUT} $CUSTDIRS_OUT} ${TAGS_OUT}
  566. do
  567. if [ "${DEBUG}" != "0" ] ; then
  568. echo "DEBUG: Removing $i"
  569. fi
  570. /bin/rm -f $i
  571. done
  572. if [ "${DEBUG}" != "0" ] ; then
  573. echo "DEBUG: Removing ${SYSDIR}"
  574. fi
  575. rm -rf ${SYSDIR}
  576. fi
  577.  
  578. # create output files make sure its writable
  579. [ \! -d ${OUTDIR} ] && {
  580. [ "${DEBUG}" != "0" ] && {
  581. ${ECHO} "DEBUG: ${OUTDIR} doesn't exist. Creating."
  582. }
  583. ${MKDIR} ${OUTDIR}
  584. }
  585. ${TOUCH} ${OUTFILE}
  586. ${TOUCH} ${ERRFILE}
  587. [ \! -w ${OUTFILE} ] && {
  588. ${ECHO} "Error creating output file."
  589. ${ECHO} "Program is terminating."
  590. exit
  591. }
  592.  
  593. }
  594. ####################################################################
  595. # function to change output file permissions, just in
  596. # case the default UMASK is set insecure, called from main
  597. # This check does a chmod 700 output/servname.*
  598. # Added 8/2005
  599. ####################################################################
  600. do_chmod () {
  601. if [ -f "${CHMOD}" ]; then
  602. # Change Permission on Output files, just in case
  603. [ "${DEBUG}" != "0" ] && {
  604. ${ECHO} "DEBUG: Changing secng output files to 700"
  605. }
  606. for i in ${OUTFILE} ${ERRFILE} ${SETUID_OUT} ${SETGID_OUT} ${WW_OUT} ${USER_FILE_OUT} ${LOG_FILE_OUT} ${KEYDIRS_OUT} ${MODS_OUT} ${CUSTDIRS_OUT} ${TAGS_OUT}
  607. do
  608. [ "${DEBUG}" != "0" ] && {
  609. ${ECHO} "DEBUG: Changing permissions on file $i"
  610. }
  611. chmod -f 600 $i
  612. done
  613. else
  614. ${ECHO} "${CHMOD} not found. Please correct path to tar in .rc file."
  615. exit 1
  616. fi
  617. }
  618.  
  619. ####################################################################
  620. # function to tar up output files, called from main
  621. ####################################################################
  622. do_tar () {
  623. if [ -f "${TAR}" ]; then
  624. # add all the output files to the tarball
  625. [ "${DEBUG}" != "0" ] && {
  626. ${ECHO} "DEBUG: Adding all output files to ${TARFILE}"
  627. }
  628. if [ -f "${TARFILE}" ]; then
  629. # tarfile exists, so use TAROPT1
  630. ${TAR} ${TAROPT1} ${TARFILE} ${OUTDIR}/* 2>>${ERRFILE}
  631. # secure tar file from bad UMASK perms
  632. ${CHMOD} -f 600 ${TARFILE} 2>>${ERRFILE}
  633. else
  634. # tarfile doesnt exist, create using TAROPT
  635. ${TAR} ${TAROPT} ${TARFILE} ${OUTDIR}/* 2>>${ERRFILE}
  636. # secure tar file from bad UMASK perms
  637. ${CHMOD} -f 600 ${TARFILE} 2>>${ERRFILE}
  638. fi
  639.  
  640. [ "${DEBUG}" != "0" ] && {
  641. ${ECHO} "DEBUG: Removing original output files."
  642. }
  643.  
  644. for i in ${OUTFILE} ${ERRFILE} ${SETUID_OUT} ${SETGID_OUT} ${WW_OUT} ${USER_FILE_OUT} ${LOG_FILE_OUT} ${KEYDIRS_OUT} ${MODS_OUT} ${CUSTDIRS_OUT} ${TAGS_OUT}
  645. do
  646. [ "${DEBUG}" != "0" ] && {
  647. ${ECHO} "DEBUG: Removing file $i"
  648. }
  649. rm -f $i
  650. done
  651. [ "${DEBUG}" != "0" ] && {
  652. ${ECHO} "DEBUG: Removing dir ${SYSDIR}"
  653. }
  654. rm -rf ${SYSDIR}
  655. if [ "${HAVE_GZIP}" != "0" ]; then
  656. [ "${DEBUG}" != "0" ] && {
  657. ${ECHO} "DEBUG: Compressing ${TARFILE} with ${GZIPBIN}"
  658. }
  659. ${GZIPBIN} ${TARFILE}
  660. fi
  661. else
  662. ${ECHO} "${TAR} not found. Please correct path to tar in .rc file."
  663. exit 1
  664. fi
  665. }
  666. ###################################################################
  667. # function to do x windows check,
  668. # called from do_net_checks
  669. ###################################################################
  670. do_xchecks () {
  671. ${ECHO} "Checking X settings..."
  672. ${ECHO} "<XCHECK>" >>${TAGS_OUT}
  673. print_separator outfile
  674. ${ECHO} "Checking X settings..." >> ${OUTFILE}
  675. ${ECHO} "Command: ${XHOST}" >> ${OUTFILE}
  676. print_separator outfile
  677.  
  678. ${ECHO} '' >> ${OUTFILE}
  679. ${XHOST} |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  680. ${ECHO} "</XCHECK>" >>${TAGS_OUT}
  681. for i in ${X_FILES}
  682. do
  683. get_file $i
  684. done
  685. ${ECHO} '' >> ${OUTFILE}
  686. }
  687. ###################################################################
  688. # function to do ftp checks, called from do_net_checks
  689. ###################################################################
  690. do_ftpchecks () {
  691. # FTP Checks
  692. ${ECHO} "Checking ftp settings..."
  693. ${ECHO} '' >> ${OUTFILE}
  694. ${ECHO} "<FTP_SERVER>" >>${TAGS_OUT}
  695.  
  696. # Get the ~ftp directory
  697. DIRS="`${AWK} -F: '($1 == "ftp") {print $6}' /etc/passwd`"
  698. if (${TEST} x${DIRS} = x) then
  699. ${ECHO} "No ftp user found.\n" |${TEE} ${TAGS_OUT} >> ${OUTFILE}
  700. # ftp files to search
  701. LIST="${FTP_FILES}"
  702. else
  703. ${LS} -lLd ${DIRS} |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  704. ${ECHO} '' >> ${OUTFILE}
  705. ${ECHO} "${DIRS}:" >> ${OUTFILE}
  706. ${LS} -la ${DIRS} |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  707. ${ECHO} '' >> ${OUTFILE}
  708. ${LS} -lR ${DIRS}/bin ${DIRS}/usr/bin ${DIRS}/sbin |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  709. ${ECHO} '' >> ${OUTFILE}
  710. # ftp files to search
  711. LIST="${DIRS}/etc/passwd ${DIRS}/etc/group ${FTP_FILES}"
  712. fi
  713.  
  714. # grab FTP-related files regardless of whether ftp user
  715. # exists or not
  716. for FILE in ${LIST}
  717. do
  718. get_file ${FILE}
  719. done
  720. ${ECHO} "</FTP_SERVER>" >>${TAGS_OUT}
  721. }
  722.  
  723. ###################################################################
  724. # function to do sendmail checks, called from do_net_checks
  725. ###################################################################
  726. do_sendmailchecks () {
  727. # Sendmail Checks
  728. ${ECHO} "Checking sendmail settings..."
  729. ${ECHO} "<SENDMAIL>" >>${TAGS_OUT}
  730. ${ECHO} '' >> ${OUTFILE}
  731. ${ECHO} '' >> ${OUTFILE}
  732. # sendmail files to search
  733. LIST="${SENDMAIL_FILES}"
  734. # grab sendmail-related files
  735. for FILE in ${LIST}
  736. do
  737. get_file ${FILE}
  738. done
  739. ${ECHO} "</SENDMAIL>" >>${TAGS_OUT}
  740. }
  741.  
  742. ###################################################################
  743. # function to do nfs checks, pretty minimal for now,
  744. # called from do_net_checks
  745. ###################################################################
  746. do_nfschecks () {
  747.  
  748. ${ECHO} "Checking NFS exports..."
  749. ${ECHO} "Checking NFS exports..." >> ${OUTFILE}
  750. ${ECHO} "<NFS_EXPORTS>" >>${TAGS_OUT}
  751. ${ECHO} "Command: ${SHOWMOUNT} -e" >> ${OUTFILE}
  752. print_separator outfile
  753. ${ECHO} '' >> ${OUTFILE}
  754. ${SHOWMOUNT} -e |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  755. ${ECHO} >> ${OUTFILE}
  756.  
  757. #Now get some NFS files
  758.  
  759. ${ECHO} "Checking NFS files..."
  760. for i in ${NFS_FILES}
  761. do
  762. get_file $i
  763. done
  764. ${ECHO} "</NFS_EXPORTS>" >>${TAGS_OUT}
  765. }
  766. ###################################################################
  767. # function to do bind checks, called from do_net_checks
  768. ###################################################################
  769. do_bindchecks () {
  770. # named config checks
  771. ${ECHO} "Looking for bind configs..."
  772. ${ECHO} "Looking for bind configs..." >> ${OUTFILE}
  773. ${ECHO} "<BIND>" >>${TAGS_OUT}
  774. print_separator outfile
  775. [ -d ${BIND_CONF_DIR} ] && {
  776. case ${BIND_VERSION} in
  777. '4')
  778. BIND_CONF=${BIND_CONF_DIR}/named.boot
  779. ;;
  780. '8')
  781. BIND_CONF=${BIND_CONF_DIR}/named.conf
  782. ;;
  783. '9')
  784. BIND_CONF=${BIND_CONF_DIR}/named.conf
  785. ;;
  786. *)
  787. ${ECHO} "version must be 4, 8 or 9"
  788. ;;
  789. esac
  790.  
  791. # grab the conf file
  792. get_file ${BIND_CONF}
  793.  
  794. # grab named version header
  795. ${ECHO} "NAMED Version...." >> ${OUTFILE}
  796. ${ECHO} "<BIND_VER>" >>${TAGS_OUT}
  797. ${NAMED_LOCATION} -v |${TEE} ${TAGS_OUT} >> ${OUTFILE}
  798. print_separator outfile
  799. ${ECHO} "</BIND_VER>" >>${TAGS_OUT}
  800.  
  801. # now get zone files
  802. [ -d ${BIND_ZONEFILES_DIR} ] && {
  803. for zone in `ls ${BIND_ZONEFILES_DIR}`
  804. do
  805. get_file ${BIND_ZONEFILES_DIR}/${zone}
  806. done
  807. }
  808.  
  809. }
  810. ${ECHO} "</BIND>" >>${TAGS_OUT}
  811. }
  812. ###################################################################
  813. # function to do ssh checks, called from do_net_checks
  814. ###################################################################
  815. do_sshchecks () {
  816. # ssh config checks
  817. ${ECHO} "Looking for global ssh configs..."
  818. ${ECHO} "<SSHVERSION>" >>${TAGS_OUT}
  819. print_separator outfile
  820. ${ECHO} "Looking for global ssh configs..." >> ${OUTFILE}
  821. ${ECHO} "Checking ssh version..."
  822. ${SSHBIN} -V |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${OUTFILE}
  823. print_separator outfile
  824. ${ECHO} "</SSHVERSION>" >>${TAGS_OUT}
  825. ${ECHO} '' >> ${OUTFILE}
  826. if [ -d ${SSHDIR} ]; then
  827. case ${SSH_VERSION} in
  828. '1') LIST=${GLOBAL_SSH_FILES_V1}
  829. ;;
  830. '2') LIST=${GLOBAL_SSH_FILES_V2}
  831. ;;
  832. *)
  833. ${ECHO} 'No ssh version specified' >> ${ERRFILE}
  834. ;;
  835. esac
  836.  
  837. for conf in ${LIST}
  838. do
  839. if ( ${TEST} -f ${conf} ) then
  840. get_file ${conf}
  841. fi
  842. done
  843. else
  844. ${ECHO} "${SSHDIR} does not exist. Please edit ${GLOBALCONF}."
  845. ${ECHO} "${SSHDIR} does not exist. Please edit ${GLOBALCONF}." >> ${OUTFILE}
  846. fi
  847. }
  848. ###################################################################
  849. # function to do all networking checks, called from main script
  850. #
  851. # also checks several flags:
  852. # 1) DO_IFCONFIG
  853. # 2) DO_NETSTAT_NR
  854. # 3) DO_ARP
  855. # 4) DO_NETSTAT_A
  856. # 5) DO_RPCINFO
  857. # 6) DO_GET_NET_CONFIGS
  858. # 7) DO_XCHECKS
  859. # 8) DO_FTP
  860. # 9) DO_NFS
  861. # 10) DO_BIND
  862. # 11) DO_SSH
  863. # 12) DO_SENDMAIL
  864. ###################################################################
  865. do_net_checks () {
  866. # Network configuration
  867. ${ECHO} "Checking network configuration settings..."
  868. ${ECHO} "<NETCHECKS>" >>${TAGS_OUT}
  869. print_separator stdout
  870.  
  871. ### Ifconfig checks #####
  872. ${ECHO} "<IFCONFIG>" >>${TAGS_OUT}
  873. if [ "${DO_IFCONFIG}" != "0" ]; then
  874.  
  875. print_flag_header outfile main BEGIN DO_IFCONFIG
  876. case "${OS}" in
  877.  
  878. 'HP-UX')
  879. ${ECHO} '' >> ${OUTFILE}
  880. ${ECHO} "Running LANSCAN then IFCONFIG on each int" >> ${OUTFILE}
  881. for i in `${LANSCAN}|${GREP} lan|${AWK} '{print $5}'`
  882. do
  883. ${IFCONFIG} $i |${TEE} ${TAGS_OUT} >>${OUTFILE}
  884. done
  885. ;;
  886. *)
  887. ${ECHO} '' >> ${OUTFILE}
  888. ${ECHO} "Using ${IFCONFIG} -a" >> ${OUTFILE}
  889. ${ECHO} '' >> ${OUTFILE}
  890. ${IFCONFIG} -a |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  891. ;;
  892. esac
  893. print_flag_header outfile main END DO_IFCONFIG
  894.  
  895. elif [ "${DEBUG}" != "0" ]; then
  896. print_flag_header stdout SKIP DO_IFCONFIG
  897. ${ECHO} "skipped" >>${TAGS_OUT}
  898. fi
  899. ${ECHO} "</IFCONFIG>" >>${TAGS_OUT}
  900.  
  901. #### Routing Table and Interfaces #####
  902.  
  903. ${ECHO} "<NETSTAT_NR>" >>${TAGS_OUT}
  904. if [ "${DO_NETSTAT_NR}" != "0" ]; then
  905. print_flag_header outfile main BEGIN DO_NETSTAT_NR
  906. ${ECHO} '' >> ${OUTFILE}
  907. ${ECHO} "Command: ${NETSTAT} -rn" >> ${OUTFILE}
  908. ${ECHO} '' >> ${OUTFILE}
  909. ${NETSTAT} -rn |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  910. ${ECHO} '' >> ${OUTFILE}
  911. print_flag_header outfile main END DO_NETSTAT_NR
  912. elif [ "${DEBUG}" != "0" ]; then
  913. print_flag_header stdout SKIP DO_NETSTAT_NR
  914. ${ECHO} "skipped" >>${TAGS_OUT}
  915. fi
  916. ${ECHO} "</NETSTAT_NR>" >>${TAGS_OUT}
  917.  
  918. #ARP Table
  919. ${ECHO} "<ARP_TABLE>" >>${TAGS_OUT}
  920. if [ "${DO_ARP}" != "0" ]; then
  921. ${ECHO} "Listing arp Table..."
  922. print_flag_header outfile main BEGIN DO_ARP
  923. ${ECHO} '' >> ${OUTFILE}
  924. ${ECHO} "Command: ${ARP} -a" >> ${OUTFILE}
  925. ${ECHO} '' >> ${OUTFILE}
  926. ${ARP} -a |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  927. ${ECHO} '' >> ${OUTFILE}
  928. print_flag_header outfile main END DO_ARP
  929. elif [ "${DEBUG}" != "0" ]; then
  930. print_flag_header stdout SKIP DO_ARP
  931. ${ECHO} "skipped" >>${TAGS_OUT}
  932. fi
  933. ${ECHO} "</ARP_TABLE>" >>${TAGS_OUT}
  934.  
  935. # Active Services
  936. ${ECHO} "<NETSTAT_A>" >>${TAGS_OUT}
  937. if [ "${DO_NETSTAT_A}" != "0" ]; then
  938. ${ECHO} "Determining active services..."
  939. print_flag_header outfile main BEGIN DO_NETSTAT_A
  940. ${ECHO} '' >> ${OUTFILE}
  941. ${ECHO} "Command: ${NETSTAT} -a | ${GREP} LISTEN" >> ${OUTFILE}
  942. ${ECHO} '' >> ${OUTFILE}
  943. ${NETSTAT} -a | ${GREP} LISTEN |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  944. ${ECHO} '' >> ${OUTFILE}
  945. print_flag_header outfile main END DO_NETSTAT_A
  946. elif [ "${DEBUG}" != "0" ]; then
  947. print_flag_header stdout SKIP DO_NETSTAT_A
  948. ${ECHO} "skipped" >>${TAGS_OUT}
  949. fi
  950. ${ECHO} "</NETSTAT_A>" >>${TAGS_OUT}
  951.  
  952. #rpcinfo
  953. ${ECHO} "<RPCINFO>" >>${TAGS_OUT}
  954. if [ "${DO_RPCINFO}" != "0" ]; then
  955. ${ECHO} "Listing rpcinfo..."
  956. print_flag_header outfile main BEGIN DO_RPCINFO
  957. ${ECHO} '' >> ${OUTFILE}
  958. ${ECHO} "Command: ${RPCINFO} -p" >> ${OUTFILE}
  959. ${ECHO} '' >> ${OUTFILE}
  960. ${RPCINFO} -p |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  961. ${ECHO} '' >> ${OUTFILE}
  962. print_flag_header outfile main END DO_RPCINFO
  963. elif [ "${DEBUG}" != "0" ]; then
  964. print_flag_header stdout SKIP DO_RPCINFO
  965. ${ECHO} "skipped" >>${TAGS_OUT}
  966. fi
  967. ${ECHO} "</RPCINFO>" >>${TAGS_OUT}
  968.  
  969. # Get Basic Files
  970. if [ "${DO_GET_NET_CONFIGS}" != "0" ]; then
  971. print_flag_header outfile main BEGIN DO_GET_NET_CONFIGS
  972. ${ECHO} "Getting basic networking files.."
  973. ${ECHO} "Getting basic networking files.." >>${OUTFILE}
  974. print_separator outfile
  975. # get the rest
  976. for i in ${NET_CONFIGS}
  977. do
  978. get_file $i
  979. done
  980. print_flag_header outfile main END DO_GET_NET_CONFIGS
  981. elif [ "${DEBUG}" != "0" ]; then
  982. print_flag_header stdout SKIP DO_GET_NET_CONFIGS
  983. fi
  984.  
  985. # Do XCHECKS
  986. if [ "${DO_XCHECKS}" != "0" ]; then
  987. print_flag_header outfile main BEGIN DO_XCHECKS
  988. do_xchecks
  989. print_flag_header outfile main END DO_XCHECKS
  990. elif [ "${DEBUG}" != "0" ]; then
  991. print_flag_header stdout SKIP DO_XCHECKS
  992. fi
  993.  
  994. # DO FTP
  995. if [ "${DO_FTP}" != "0" ]; then
  996. print_flag_header outfile main BEGIN DO_FTP
  997. do_ftpchecks
  998. print_flag_header outfile main END DO_FTP
  999. elif [ "${DEBUG}" != "0" ]; then
  1000. print_flag_header stdout SKIP DO_FTP
  1001. ${ECHO} "skipped" >>${TAGS_OUT}
  1002. fi
  1003.  
  1004. # DO NFS CHECKS
  1005. if [ "${DO_NFS}" != "0" ]; then
  1006. print_flag_header outfile main BEGIN DO_NFS
  1007. do_nfschecks
  1008. print_flag_header outfile main END DO_NFS
  1009. elif [ "${DEBUG}" != "0" ]; then
  1010. print_flag_header stdout SKIP DO_NFS
  1011. ${ECHO} "skipped" >>${TAGS_OUT}
  1012. fi
  1013.  
  1014. # DO BIND CHECKS
  1015. if [ "${DO_BIND}" != "0" ]; then
  1016. print_flag_header outfile main BEGIN DO_BIND
  1017. do_bindchecks
  1018. print_flag_header outfile main END DO_BIND
  1019. elif [ "${DEBUG}" != "0" ]; then
  1020. print_flag_header stdout SKIP DO_BIND
  1021. ${ECHO} "skipped" >>${TAGS_OUT}
  1022. fi
  1023.  
  1024. # DO_SSH
  1025. if [ "${DO_SSH}" != "0" ]; then
  1026. print_flag_header outfile main BEGIN DO_SSH
  1027. do_sshchecks
  1028. print_flag_header outfile main END DO_SSH
  1029. elif [ "${DEBUG}" != "0" ]; then
  1030. print_flag_header stdout SKIP DO_SSH
  1031. ${ECHO} "skipped" >>${TAGS_OUT}
  1032. fi
  1033.  
  1034. # DO Sendmail Checks
  1035. if [ "${DO_SENDMAIL}" != "0" ]; then
  1036. print_flag_header outfile main BEGIN DO_SENDMAIL
  1037. do_sendmailchecks
  1038. print_flag_header outfile main END DO_SENDMAIL
  1039. elif [ "${DEBUG}" != "0" ]; then
  1040. print_flag_header stdout SKIP DO_SENDMAIL
  1041. ${ECHO} "skipped" >>${TAGS_OUT}
  1042. fi
  1043. print_separator stdout
  1044. ${ECHO} "</NETCHECKS>" >>${TAGS_OUT}
  1045. }
  1046. ###################################################################
  1047. # function to do uname -a, called from do_general_checks
  1048. ###################################################################
  1049. do_uname () {
  1050. # do generic ident of OS
  1051. ${ECHO} "Identify vendor and version of OS..."
  1052. print_separator stdout
  1053. ${UNAME} -a
  1054. print_separator stdout
  1055.  
  1056. print_separator outfile
  1057. ${ECHO} "Identify vendor and version of OS..." >> ${OUTFILE}
  1058. ${ECHO} "<UNAME>" >>${TAGS_OUT}
  1059. ${ECHO} "Command: ${UNAME} -a" >> ${OUTFILE}
  1060. print_separator outfile
  1061. ${UNAME} -a |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1062. print_separator outfile
  1063. ${ECHO} "</UNAME>" >>${TAGS_OUT}
  1064. }
  1065. ####################################################################
  1066. # function to check for accounts with no password, called from do_
  1067. # general_checks
  1068. ####################################################################
  1069. do_accts_no_pass () {
  1070.  
  1071.  
  1072. ${ECHO} "Checking for accounts with no password."
  1073.  
  1074. ${ECHO} "<ACCTS_NO_PASS>" >> ${TAGS_OUT}
  1075.  
  1076. if [ "${OS}" != "AIX" ]; then
  1077.  
  1078. if ( ${TEST} -f ${SHADOWFILE} ) then
  1079. ${AWK} -- 'BEGIN { FS = ":" } ($2 == "") {print}' ${SHADOWFILE} |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1080. else
  1081. ${AWK} -- 'BEGIN { FS = ":" } ($2 == "") {print}' /etc/passwd |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1082. fi
  1083. else
  1084. # Added ver 2.0 for AIX check, Troy Frost contributed
  1085. # TROY AIX
  1086. ${ECHO} "This is AIX, running custom AIX check looking for blank passwords"
  1087. ${AWK} -- '{
  1088. if (/:/) {
  1089. act=substr($1,0,(length $1) -1);
  1090. getline;
  1091. if((!/password/) || (!$3)) {
  1092. print act " has a blank password";
  1093. }
  1094. }
  1095. }' /etc/security/passwd |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1096.  
  1097. fi
  1098.  
  1099. ${ECHO} '' >> ${OUTFILE}
  1100. ${ECHO} "</ACCTS_NO_PASS>" >> ${TAGS_OUT}
  1101.  
  1102. }
  1103. ###################################################################
  1104. # function to check for UID 0 accounts, called from do_general_checks
  1105. ####################################################################
  1106. do_uid_zero () {
  1107. ${ECHO} "Checking for UID 0 accounts..."
  1108. ${ECHO} "<UID0>" >> ${TAGS_OUT}
  1109.  
  1110. if [ "${OS}" != "AIX" ]; then
  1111. #Use awk to find users with third field in password file equal to 0
  1112. ${AWK} -- 'BEGIN { FS = ":" } ($3 == 0) {print}' /etc/passwd |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1113. else
  1114. #Use awk on AIX to find users with third field in password file equal to 0
  1115. ${AWK} -- 'BEGIN { FS = ":" } ($3 == 0) {print}' /etc/passwd |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1116. fi
  1117. #${ECHO} '' >> ${OUTFILE}
  1118. ${ECHO} "</UID0>" >> ${TAGS_OUT}
  1119. }
  1120. ###################################################################
  1121. # function to do basic filesystem checks, called from do_general_checks
  1122. ####################################################################
  1123. do_fs_checks () {
  1124.  
  1125. ${ECHO} "Gathering information on the filesystem..."
  1126. #print_separator outfile
  1127. #${ECHO} "Gathering information on the filesystem..." >> ${OUTFILE}
  1128. #print_separator outfile
  1129. ${ECHO} '' >> ${OUTFILE}
  1130. ${ECHO} "Using '${DF}':" >> ${OUTFILE}
  1131. ${ECHO} "<DF>" >> ${TAGS_OUT}
  1132. ${DF} |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1133. ${ECHO} "</DF>" >> ${TAGS_OUT}
  1134. ${ECHO} '' >> ${OUTFILE}
  1135. ${ECHO} "Using '${SHOWMOUNT} -a':" >> ${OUTFILE}
  1136. ${ECHO} "<SHOWMOUNT>" >> ${TAGS_OUT}
  1137. ${SHOWMOUNT} -a |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1138. ${ECHO} '' >> ${OUTFILE}
  1139. ${ECHO} "</SHOWMOUNT>" >> ${TAGS_OUT}
  1140. ${ECHO} "Using '${MOUNT}':" >> ${OUTFILE}
  1141. ${ECHO} "<MOUNT>" >> ${TAGS_OUT}
  1142. ${MOUNT} |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1143. ${ECHO} '' >> ${OUTFILE}
  1144. ${ECHO} "</MOUNT>" >> ${TAGS_OUT}
  1145.  
  1146. }
  1147. ###################################################################
  1148. # function to check crontabs, called from do_general_checks
  1149. ###################################################################
  1150. do_cron_checks () {
  1151.  
  1152. #Check crontab files
  1153. ${ECHO} "Checking crontab files..."
  1154. ${ECHO} "<CRONTAB>" >> ${TAGS_OUT}
  1155.  
  1156. # get the cron files
  1157. for i in ${CRON_FILES}
  1158. do
  1159. get_file $i
  1160. done
  1161.  
  1162. ${ECHO} '' >> ${OUTFILE}
  1163. ${ECHO} "</CRONTAB>" >> ${TAGS_OUT}
  1164.  
  1165. ${ECHO} "Checking permissions on ${CRONDIR}" >>${OUTFILE}
  1166. ${ECHO} "<CRONPERMS>" >>${TAGS_OUT}
  1167. [ -d ${CRONDIR} ] && {
  1168. DIRS=${CRONDIR}
  1169. for dname in ${DIRS}
  1170. do
  1171. ${LS} -lLd ${dname} |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1172. ${ECHO} '' |${TEE} ${TAGS_OUT} >> ${OUTFILE}
  1173. for fname in `${LS} ${dname}`
  1174. do
  1175. if ( ${TEST} -f ${dname}/${fname} ) then
  1176. ${LS} -l ${dname}/${fname} |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1177. ${ECHO} '' |${TEE} ${TAGS_OUT} >> ${OUTFILE}
  1178. get_file ${dname}/${fname}
  1179. ${ECHO} '' |${TEE} ${TAGS_OUT} >> ${OUTFILE}
  1180. fi #End test
  1181. done #End for fname
  1182. done #End for dname
  1183. }
  1184. ${ECHO} '' |${TEE} ${TAGS_OUT} >> ${OUTFILE}
  1185. ${ECHO} "</CRONPERMS>" >>${TAGS_OUT}
  1186. }
  1187. ###################################################################
  1188. # function to get last 50 lines in logfile, called from do_general_checks
  1189. ###################################################################
  1190. do_log_checks () {
  1191.  
  1192. # Log information
  1193. ${ECHO} "Displaying log information..."
  1194. ${ECHO} '' >> ${LOG_FILE_OUT}
  1195. # grab log info
  1196. for log in ${LOG_FILES}
  1197. do
  1198. if ( ${TEST} -f ${log} ) then
  1199. [ "${DEBUG}" != "0" ] && {
  1200. ${ECHO} "DEBUG: Checking ${log}"
  1201. }
  1202. print_separator outfile logs
  1203. ${ECHO} "<LOG=\"${log}\" LS=\"" >> ${TAGS_OUT}
  1204. ${ECHO} "[FILE]: ${log}" >> ${LOG_FILE_OUT}
  1205. ${LS} -l ${log} |${TEE} ${TAGS_OUT} >> ${LOG_FILE_OUT} 2>>${ERRFILE}
  1206. ${ECHO} "\">" >> ${TAGS_OUT}
  1207. # if its a symlink, deref the symlink too
  1208. if ( ${TEST} -L ${log} ) then
  1209. ${LS} -lL ${log} |${TEE} ${TAGS_OUT} >> ${LOG_FILE_OUT} 2>>${ERRFILE}
  1210. fi
  1211. print_separator outfile logs
  1212. ${TAIL} -100 ${log} |${TEE} ${TAGS_OUT} >> ${LOG_FILE_OUT} 2>>${ERRFILE}
  1213. print_separator outfile logs
  1214. ${ECHO} "</LOG>" >> ${TAGS_OUT}
  1215. fi
  1216. done
  1217. ${ECHO} '' >> ${LOG_FILE_OUT}
  1218.  
  1219. # Review the last login time of each user
  1220. ${ECHO} "Checking the last login time of each user..."
  1221. print_separator outfile logs
  1222. ${ECHO} "Checking the last login time of each user..." >> ${LOG_FILE_OUT}
  1223. print_separator outfile logs
  1224. ${ECHO} '' >> ${LOG_FILE_OUT}
  1225. ${ECHO} "<LASTLOGIN>" >> ${TAGS_OUT}
  1226. ${ECHO} "Using: ${CUT} -d: -f1 /etc/passwd | ${XARGS} ${FINGER} -m" >> ${LOG_FILE_OUT}
  1227. print_flag_header outfile logs BEGIN DO_FINGER
  1228. ${CUT} -d: -f1 /etc/passwd | ${XARGS} ${FINGER} -m |${TEE} ${TAGS_OUT} >> ${LOG_FILE_OUT} 2>>${ERRFILE}
  1229. ${ECHO} "</LASTLOGIN>" >> ${TAGS_OUT}
  1230. print_flag_header outfile logs END DO_FINGER
  1231. ${ECHO} '' >> ${LOG_FILE_OUT}
  1232.  
  1233.  
  1234. ${ECHO} "Displaying last 100 logins..." >> ${LOG_FILE_OUT}
  1235. ${ECHO} '' >> ${LOG_FILE_OUT}
  1236. ${ECHO} "<LAST100-LOGINS>" >> ${TAGS_OUT}
  1237. ${ECHO} "Using: ${LAST} -100" >> ${LOG_FILE_OUT}
  1238. print_flag_header outfile logs BEGIN DO_LAST
  1239. if (${TEST} ${OS} = 'SCO_SV') then
  1240. ${LAST} -n 100 |${TEE} ${TAGS_OUT} >> ${LOG_FILE_OUT} 2>>${ERRFILE}
  1241. else
  1242. ${LAST} -100 |${TEE} ${TAGS_OUT} >> ${LOG_FILE_OUT} 2>>${ERRFILE}
  1243. fi
  1244. print_flag_header outfile logs END DO_LAST
  1245. ${ECHO} '' >> ${LOG_FILE_OUT}
  1246. ${ECHO} "</LAST100-LOGINS>" >> ${TAGS_OUT}
  1247.  
  1248. }
  1249. ###################################################################
  1250. # function to get files from user home directories
  1251. # such as .rhosts, .netrc, etc, called from do_general_checks
  1252. ###################################################################
  1253. do_users_files_check () {
  1254.  
  1255. #Find user's .netrc, .rhosts, .profile, and other configuration files
  1256. print_separator stdout
  1257. ${ECHO} "Finding user configuration files such as .rhosts, .netrc, etc..."
  1258. print_separator stdout
  1259. print_separator outfile userfiles
  1260. ${ECHO} "Finding user configuration files such as .rhosts, .netrc, etc..." >> ${USER_FILE_OUT}
  1261. ${ECHO} "Finding user configuration files such as .rhosts, .netrc, etc..." >> ${OUTFILE}
  1262. ${ECHO} "Please see ${USER_FILE_OUT} for detailed output." >> ${OUTFILE}
  1263. print_separator outfile userfiles
  1264. ${ECHO} '' >> ${USER_FILE_OUT}
  1265.  
  1266. # process ssh options, set up list of files to look at
  1267. if ( ${TEST} "${DO_SSH}" = "1" ) then
  1268. if ( ${TEST} "${SSH_VERSION}" = "1" ) then
  1269. LIST="${USER_FILES} ${USER_SSH_FILES_V1}"
  1270. elif ( ${TEST} "${SSH_VERSION}" = "2" ) then
  1271. LIST="${USER_FILES} ${USER_SSH_FILES_V2}"
  1272. fi
  1273. else
  1274. LIST="${USER_FILES}"
  1275. fi
  1276.  
  1277. # figure out whether to search user directories only
  1278. # or just root directories
  1279.  
  1280. if ( ${TEST} "${DO_SEARCH_ROOTONLY}" = "1" ) then
  1281. DIRS="/ /root"
  1282. else
  1283. DIRS="`${AWK} -F\: '{print $6}' /etc/passwd|${SORT}|${UNIQ}`"
  1284. # if NIS search users check is enabled, traverse all user directories
  1285. # in NIS passwd map as well.
  1286. if ( ( ${TEST} "${DO_NIS_SEARCH_USERS}" = "1" ) &&
  1287. ( ${TEST} "${DO_NIS}" = "1" ) ) then
  1288. NISDIRS="`${YPCAT} passwd|${AWK} -F\: '{print $6}' |${SORT}|${UNIQ}`"
  1289. DIRS="${DIRS} ${NISDIRS}"
  1290. # if NISPLUS search users check is enabled, traverse all user directories
  1291. # in NISPLUS passwd map as well. Not sure if this works.
  1292. elif ( ( ${TEST} "DO_NISPLUS_SEARCH_USERS" = "1" ) &&
  1293. ( ${TEST} "DO_NISPLUS" = "1" ) ) then
  1294. NISPLUSDIRS="`${NISCAT} passwd.org_dir|${AWK} -F\: '{print $6}' |${SORT}|${UNIQ}`"
  1295. DIRS="${DIRS} ${NISPLUSDIRS}"
  1296. fi
  1297. fi
  1298.  
  1299. [ "${DEBUG}" != "0" ] && {
  1300. ${ECHO} "DEBUG: Searching these dirs:"
  1301. ${ECHO} "DEBUG: ${DIRS}"
  1302. ${ECHO} "DEBUG: Searching for these files:"
  1303. ${ECHO} "DEBUG: ${LIST}"
  1304. }
  1305.  
  1306. for dname in ${DIRS}
  1307. do
  1308. ${ECHO} '' >> ${USER_FILE_OUT}
  1309. ${LS} -lLd ${dname} >> ${USER_FILE_OUT} 2>>${ERRFILE}
  1310. for fname in ${LIST}
  1311. do
  1312. if [ -f "${dname}/${fname}" ]; then
  1313. ${ECHO} '' >> ${USER_FILE_OUT}
  1314. get_file ${dname}/${fname} userfiles
  1315. ${ECHO} '' >> ${USER_FILE_OUT}
  1316. else
  1317. ${ECHO} "${dname}/${fname} <NOT FOUND>" >>${USER_FILE_OUT}
  1318. fi #End test
  1319. done #End for fname
  1320. done #End for dname
  1321.  
  1322. }
  1323. ###################################################################
  1324. # function to do dmesg, special check for DMESG_FILE
  1325. ###################################################################
  1326. do_dmesg () {
  1327. ${ECHO} "Displaying dmesg..."
  1328. ${ECHO} "<DMESG>" >>${TAGS_OUT}
  1329. #print_separator outfile
  1330. #${ECHO} "Displaying dmesg..." >> ${OUTFILE}
  1331. #${ECHO} "Command: ${DMESG}" >> ${OUTFILE}
  1332. #print_separator outfile
  1333. ${ECHO} '' >> ${OUTFILE}
  1334. ${DMESG} |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1335. ${ECHO} '' >> ${OUTFILE}
  1336.  
  1337. # now get DMESG_FILE if it exists, mostly bsd-ism
  1338. if [ "x${DMESG_FILE}" != "x" ]; then
  1339. get_file ${DMESG_FILE}
  1340. fi
  1341. ${ECHO} "</DMESG>" >>${TAGS_OUT}
  1342. }
  1343. ###################################################################
  1344. # function do_general_checks, called from main script
  1345. #
  1346. # This function does many generic checks, it checks the
  1347. # flags for each of the options, and run the
  1348. # appropriate routine , some have subflags
  1349. #
  1350. # 1) DO_GET_GEN_CONFIGS
  1351. # 2) DO_ACCTSNOPASS
  1352. # 3) DO_UIDZERO
  1353. # 4) DO_UMASK
  1354. # 5) DO_UPTIME
  1355. # 6) DO_PS
  1356. # 7) DO_WHO
  1357. # 8) DO_FS_CHECKS
  1358. # 9) DO_CRON
  1359. # 10) DO_LOG
  1360. # 11) DO_DMESG
  1361. ###################################################################
  1362. do_general_checks () {
  1363.  
  1364. ${ECHO} "Running through general checks."
  1365. print_separator stdout
  1366.  
  1367. if [ "${DO_GET_GEN_CONFIGS}" != "0" ]; then
  1368. ${ECHO} "Grabbing general configuration files..."
  1369.  
  1370. print_flag_header outfile main BEGIN DO_GET_GEN_CONFIGS
  1371.  
  1372. # if -noshadow on command line,
  1373. # don't grab the shadow file
  1374. if [ "${DO_GET_SHADOWFILE}" != "0" ]; then
  1375. # first get shadowfile
  1376. get_file ${SHADOWFILE}
  1377. elif [ "${DO_GET_SHADOWFILE}" = "0" ]; then
  1378. # Let us record if client disable shadow checks
  1379. ${ECHO} "<SHADOW>Check was manually disabled</SHADOW>" >>${TAGS_OUT}
  1380. elif [ "${DEBUG}" != "0" ]; then
  1381. ${ECHO} "DEBUG: Skipping shadow file: ${SHADOWFILE}"
  1382. ${ECHO} "<SHADOW>Check was manually disabled</SHADOW>" >>${TAGS_OUT}
  1383. fi
  1384.  
  1385. # get the rest
  1386. for i in ${GEN_CONFIGS}
  1387. do
  1388. get_file $i
  1389. done
  1390. elif [ "${DEBUG}" != "0" ]; then
  1391. print_flag_header stdout SKIP DO_GET_GEN_CONFIGS
  1392. fi # end do_get_gen_configs
  1393. print_flag_header outfile main END DO_GET_GEN_CONFIGS
  1394.  
  1395. # check for accounts with no password
  1396. if [ "${DO_ACCTSNOPASS}" != "0" ]; then
  1397. print_flag_header outfile main BEGIN DO_ACCTSNOPASS
  1398. do_accts_no_pass
  1399. print_flag_header outfile main END DO_ACCTSNOPASS
  1400. elif [ "${DEBUG}" != "0" ]; then
  1401. print_flag_header stdout SKIP DO_ACCTSNOPASS
  1402. fi
  1403.  
  1404. # check for uid zero accounts
  1405. if [ "${DO_UIDZERO}" != "0" ]; then
  1406. print_flag_header outfile main BEGIN DO_UIDZERO
  1407. do_uid_zero
  1408. print_flag_header outfile main END DO_UIDZERO
  1409. elif [ "${DEBUG}" != "0" ]; then
  1410. print_flag_header stdout SKIP DO_UIDZERO
  1411. fi
  1412.  
  1413. # umask information
  1414. #umask is a built-in shell command so no path is required
  1415. if [ "${DO_UMASK}" != "0" ]; then
  1416. ${ECHO} "Root's umask information..."
  1417. print_flag_header outfile main BEGIN DO_UMASK
  1418. ${ECHO} "<UMASK>" >>${TAGS_OUT}
  1419. umask |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1420. ${ECHO} "</UMASK>" >>${TAGS_OUT}
  1421. print_flag_header outfile main END DO_UMASK
  1422. elif [ "${DEBUG}" != "0" ]; then
  1423. print_flag_header stdout SKIP DO_UMASK
  1424. ${ECHO} "<UMASK>Manually Disabled</UMASK>" >>${TAGS_OUT}
  1425. fi
  1426.  
  1427. # uptime
  1428. if [ "${DO_UPTIME}" != "0" ]; then
  1429. ${ECHO} "Getting uptime..."
  1430. print_flag_header outfile main BEGIN DO_UPTIME
  1431. ${ECHO} "<UPTIME>" >>${TAGS_OUT}
  1432. ${UPTIME} |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1433. ${ECHO} "</UPTIME>" >>${TAGS_OUT}
  1434. print_flag_header outfile main END DO_UPTIME
  1435. elif [ "${DEBUG}" != "0" ]; then
  1436. print_flag_header stdout SKIP DO_UPTIME
  1437. ${ECHO} "<UPTIME>Manually Disabled</UPTIME>" >>${TAGS_OUT}
  1438. fi
  1439.  
  1440.  
  1441. # display running processes
  1442. if [ "${DO_PS}" != "0" ]; then
  1443. ${ECHO} "Listing currently running processes..."
  1444. print_flag_header outfile main BEGIN DO_PS
  1445. ${ECHO} "<PS>" >>${TAGS_OUT}
  1446. ${PS} |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1447. ${ECHO} "</PS>" >>${TAGS_OUT}
  1448. print_flag_header outfile main END DO_PS
  1449. elif [ "${DEBUG}" != "0" ]; then
  1450. print_flag_header stdout SKIP DO_PS
  1451. ${ECHO} "<PS>Manually Disabled</PS>" >>${TAGS_OUT}
  1452. fi
  1453.  
  1454. # List users who are currently online
  1455. if [ "${DO_WHO}" != "0" ]; then
  1456. ${ECHO} "Listing users who are currently online..."
  1457. print_flag_header outfile main BEGIN DO_WHO
  1458. ${ECHO} "<WHO>" >>${TAGS_OUT}
  1459. $W |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1460. ${ECHO} '' |${TEE} ${TAGS_OUT} >> ${OUTFILE}
  1461. ${WHO} |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1462. ${ECHO} "</WHO>" >>${TAGS_OUT}
  1463. print_flag_header outfile main END DO_WHO
  1464. elif [ "${DEBUG}" != "0" ]; then
  1465. print_flag_header stdout SKIP DO_WHO
  1466. ${ECHO} "<WHO>Manually Disabled</WHO>" >>${TAGS_OUT}
  1467. fi
  1468.  
  1469. # do fs checks
  1470. if [ "${DO_FS_CHECKS}" != "0" ]; then
  1471. print_flag_header outfile main BEGIN DO_FS_CHECKS
  1472. do_fs_checks
  1473. print_flag_header outfile main END DO_FS_CHECKS
  1474. elif [ "${DEBUG}" != "0" ]; then
  1475. print_flag_header stdout SKIP DO_FS_CHECKS
  1476. ${ECHO} "<FS_CHECKS>Manually Disabled</FS_CHECKS>" >>${TAGS_OUT}
  1477.  
  1478. fi
  1479.  
  1480. # do cron checks
  1481. if [ "${DO_CRON}" != "0" ]; then
  1482. print_flag_header outfile main BEGIN DO_CRON
  1483. do_cron_checks
  1484. print_flag_header outfile main END DO_CRON
  1485. elif [ "${DEBUG}" != "0" ]; then
  1486. print_flag_header stdout SKIP DO_CRON
  1487. ${ECHO} "<CRON_CHECKS>Manually Disabled</CRON_CHECKS>" >>${TAGS_OUT}
  1488. fi
  1489.  
  1490. # do log checks
  1491. if [ "${DO_LOG}" != "0" ]; then
  1492. print_flag_header outfile logs BEGIN DO_LOG
  1493. do_log_checks
  1494. print_flag_header outfile logs END DO_LOG
  1495. elif [ "${DEBUG}" != "0" ]; then
  1496. print_flag_header stdout SKIP DO_LOG
  1497. ${ECHO} "<DO_LOG>Manually Disabled</DO_LOG>" >>${TAGS_OUT}
  1498. fi
  1499.  
  1500. if [ "${DO_DMESG}" != "0" ]; then
  1501. print_flag_header outfile main BEGIN DO_DMESG
  1502. do_dmesg
  1503. print_flag_header outfile main END DO_DMESG
  1504. elif [ "${DEBUG}" != "0" ]; then
  1505. print_flag_header stdout SKIP DO_DMESG
  1506. ${ECHO} "<DMESG>Manually Disabled</DMESG>" >>${TAGS_OUT}
  1507. fi
  1508.  
  1509. print_separator stdout
  1510. }
  1511. ###################################################################
  1512. # function to do basic nis checks, called from main script
  1513. ###################################################################
  1514. do_nis_check () {
  1515.  
  1516. print_separator stdout
  1517. ${ECHO} "NIS Checks..."
  1518. ${ECHO} "<NIS_CHECK>" >>${TAGS_OUT}
  1519. print_separator stdout
  1520. #${ECHO} "Command: ${YPWHICH} and others" >> ${OUTFILE}
  1521.  
  1522. NISMASTER=`${YPWHICH} 2>>${ERRFILE}`
  1523. if (${TEST} x${NISMASTER} = x) then
  1524. # Not using NIS
  1525. ${ECHO} "This host does not appear to be running NIS."
  1526. print_separator stdout
  1527. ${ECHO} "This host does not appear to be running NIS" |${TEE} ${TAGS_OUT} >> ${OUTFILE}
  1528. else
  1529. # Perform NIS tests
  1530. print_separator outfile
  1531. ${ECHO} "<NIS_MASTER>" >>${TAGS_OUT}
  1532. ${ECHO} "NIS Master is ${NISMASTER}" |${TEE} ${TAGS_OUT} >> ${OUTFILE}
  1533. ${ECHO} "</NIS_MASTER>" >>${TAGS_OUT}
  1534. print_separator outfile
  1535. ${ECHO} "<NIS_DOMAIN>" >>${TAGS_OUT}
  1536. ${ECHO} "Checking NIS domainname" >> ${OUTFILE}
  1537. ${ECHO} '' >> ${OUTFILE}
  1538. ${DOMAINNAME} |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1539. print_separator outfile
  1540. ${ECHO} "</NIS_DOMAIN>" >>${TAGS_OUT}
  1541.  
  1542. ${ECHO} "Executing ${YPCAT} on NIS passwd file." >> ${OUTFILE}
  1543. ${ECHO} '' >> ${OUTFILE}
  1544. # We can't tar it out, so we have to put it in the output file
  1545. # Sort it so we can look for duplicate UIDs
  1546. ${ECHO} "<NIS_PASSWD>" >>${TAGS_OUT}
  1547. ${YPCAT} ${NIS_PASSWD} | ${SORT} -n -t: +2 - |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1548. ${ECHO} '' >> ${OUTFILE}
  1549. ${ECHO} "</NIS_PASSWD>" >>${TAGS_OUT}
  1550. ${ECHO} "Listing all NIS accounts with a possible empty password." >> ${OUTFILE}
  1551. print_separator outfile
  1552. ${ECHO} '' >> ${OUTFILE}
  1553. ${ECHO} "<NIS_PASSWD_NOPASS>" >>${TAGS_OUT}
  1554. ${YPCAT} ${NIS_PASSWD} | ${AWK} -- 'BEGIN { FS = ":" } ($2 == "") {print}' |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1555. ${ECHO} '' >> ${OUTFILE}
  1556. ${ECHO} "</NIS_PASSWD_NOPASS>" >>${TAGS_OUT}
  1557. ${ECHO} "Listing all NIS accounts with possible root access." >> ${OUTFILE}
  1558. print_separator outfile
  1559. ${ECHO} '' >> ${OUTFILE}
  1560. ${ECHO} "<NIS_PASSWD_UID0>" >>${TAGS_OUT}
  1561. ${YPCAT} ${NIS_PASSWD} | ${AWK} -- 'BEGIN { FS = ":" } ($3 == 0) {print}' |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1562. ${ECHO} '' >> ${OUTFILE}
  1563. ${ECHO} "</NIS_PASSWD_UID0>" >>${TAGS_OUT}
  1564.  
  1565. # get all possible map names
  1566. ${ECHO} "<NIS_MAPS_NUM>" >>${TAGS_OUT}
  1567. NIS_MAPS=`${YPWHICH} -m |${AWK} '{print $1}'|${SORT}|${UNIQ}`
  1568. TOTAL_NIS_MAPS=`${YPWHICH} -m |${AWK} '{print $1}'|${SORT}|${UNIQ}|${WC} -l`
  1569.  
  1570. print_separator outfile
  1571. echo "Number of NIS maps found: ${TOTAL_NIS_MAPS}" |${TEE} ${TAGS_OUT} >>${OUTFILE} 2>>${ERRFILE}
  1572. print_separator outfile
  1573. ${ECHO} "</NIS_MAPS_NUM>" >>${TAGS_OUT}
  1574. echo "Number of NIS maps found: ${TOTAL_NIS_MAPS}"
  1575. print_separator stdout
  1576.  
  1577. # grab all NIS maps
  1578. for map in ${NIS_MAPS}
  1579. do
  1580. ${ECHO} "<NIS_MAP_${map}>" >>${TAGS_OUT}
  1581. ${ECHO} "==> Executing ${YPCAT} on NIS map: ${map}" >> ${OUTFILE}
  1582. ${ECHO} "==> Grabbing NIS map: ${map}"
  1583. ${ECHO} '' >> ${OUTFILE}
  1584. ${YPCAT} ${map} |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1585. ${ECHO} '' >> ${OUTFILE}
  1586. ${ECHO} "</NIS_MAP_${map}>" >>${TAGS_OUT}
  1587. done
  1588. fi
  1589. ${ECHO} '' >> ${OUTFILE}
  1590. ${ECHO} "</NIS_CHECK>" >>${TAGS_OUT}
  1591. }
  1592. ###################################################################
  1593. # functions to do nis plus checks, called from main script
  1594. ###################################################################
  1595. do_nisplus_check () {
  1596.  
  1597. print_separator stdout
  1598. ${ECHO} "NIS+ Checks..."
  1599. ${ECHO} "<NIS_PLUS_CHECK>" >>${TAGS_OUT}
  1600. print_separator stdout
  1601.  
  1602. print_separator outfile
  1603. ${ECHO} "NIS+ Checks..." >> ${OUTFILE}
  1604. ${ECHO} "Command: ${NISDEFAULTS} and others" >> ${OUTFILE}
  1605. print_separator outfile
  1606. ${ECHO} '' >> ${OUTFILE}
  1607. #TODO: Find better check - There is probably a better NIS+ check.
  1608. NISDOMAIN=`${NISDEFAULTS} -d 2>>${ERRFILE}`
  1609. if (${TEST} x${NISDOMAIN} = x) then
  1610. # Not using NIS+
  1611. ${ECHO} "This host does not appear to be running NIS+"
  1612. print_separator stdout
  1613. ${ECHO} "This host does not appear to be running NIS+" |${TEE} ${TAGS_OUT} >> ${OUTFILE}
  1614. else
  1615. # Perform NIS+ tests
  1616. ${ECHO} "NIS+ Domain is ${NISDOMAIN}" |${TEE} ${TAGS_OUT} >> ${OUTFILE}
  1617. ${ECHO} '' >> ${OUTFILE}
  1618. ${ECHO} "Executing ${NISCAT} on NIS+ passwd file." >> ${OUTFILE}
  1619. ${ECHO} '' >> ${OUTFILE}
  1620.  
  1621. # We can't tar it out, so we have to put it in the output file
  1622. # Sort it so we can look for duplicate UIDs
  1623.  
  1624. ${NISCAT} passwd.org_dir | ${SORT} -n -t: +2 - |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1625. ${ECHO} '' >> ${OUTFILE}
  1626.  
  1627. #TODO: Put in password checks for NIS+
  1628.  
  1629. ${ECHO} "Executing ${NISCAT} on NIS+ hosts file." >> ${OUTFILE}
  1630. ${ECHO} '' >> ${OUTFILE}
  1631. ${NISCAT} hosts.org_dir |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1632. ${ECHO} '' >> ${OUTFILE}
  1633.  
  1634. #TODO: Verfity if it is group or groups
  1635. ${ECHO} "Executing ${NISCAT} on NIS+ group file." >> ${OUTFILE}
  1636. ${ECHO} '' >> ${OUTFILE}
  1637. ${NISCAT} group.org_dir |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1638. fi
  1639. ${ECHO} '' >> ${OUTFILE}
  1640. ${ECHO} "</NIS_PLUS_CHECK>" >>${TAGS_OUT}
  1641. }
  1642. ###################################################################
  1643. # function to do listing of permissions on key directories
  1644. ###################################################################
  1645. do_key_dirs_listing () {
  1646.  
  1647. #Find permissions on a bunch of directories
  1648. print_separator stdout
  1649. ${ECHO} "Listing permissions on key directories..."
  1650. print_separator stdout
  1651. ${ECHO} "Listing permissions on key directories..." >> ${OUTFILE}
  1652. ${ECHO} "Please see ${KEYDIRS_OUT} for detailed output." >> ${OUTFILE}
  1653. ${ECHO} '' >> ${KEYDIRS_OUT}
  1654. ${ECHO} "<KEYDIRS>" >>${TAGS_OUT}
  1655.  
  1656. if [ "${DO_KEY_DIRS_ETCONLY}" = "0" ]; then
  1657.  
  1658. [ "${DEBUG}" != "0" ] && {
  1659. ${ECHO} "DEBUG: Directories to be examined are:"
  1660. ${ECHO} "DEBUG: ${KEY_DIRS}"
  1661. }
  1662.  
  1663. for dname in ${KEY_DIRS}
  1664. do
  1665. [ -d ${dname} ] && {
  1666. print_separator outfile keydirs
  1667. ${ECHO} "<KEYDIRS-${dname}>" >>${TAGS_OUT}
  1668. ${ECHO} "${dname}:" |${TEE} ${TAGS_OUT} >> ${KEYDIRS_OUT}
  1669. if (${TEST} ${dname} = "/etc") then
  1670. ${LS} -alR /etc |${TEE} ${TAGS_OUT} >> ${KEYDIRS_OUT} 2>>${ERRFILE}
  1671. else
  1672. ${LS} -al ${dname} |${TEE} ${TAGS_OUT} >> ${KEYDIRS_OUT} 2>>${ERRFILE}
  1673. ${ECHO} '' >> ${KEYDIRS_OUT}
  1674. fi
  1675. ${ECHO} "</KEYDIRS-${dname}>" >>${TAGS_OUT}
  1676. }
  1677. done
  1678. else
  1679.  
  1680. [ "${DEBUG}" != "0" ] && {
  1681. ${ECHO} "DEBUG: Directories to be examined are:"
  1682. ${ECHO} "DEBUG: /etc"
  1683. }
  1684.  
  1685. print_separator outfile keydirs
  1686. ${ECHO} "/etc:" >> ${KEYDIRS_OUT}
  1687. ${LS} -alR /etc >> ${KEYDIRS_OUT} 2>>${ERRFILE}
  1688. ${ECHO} '' >> ${KEYDIRS_OUT}
  1689. ${ECHO} "</KEYDIRS>" >>${TAGS_OUT}
  1690. fi
  1691.  
  1692. }
  1693. ####################################################################
  1694. # function to do finds for setuid, setgid, and ww
  1695. ####################################################################
  1696. do_finds () {
  1697.  
  1698. case "$1" in
  1699.  
  1700. 'setuid')
  1701. FINDOUTFILE=${SETUID_OUT}
  1702. FINDOPTS=${FINDOPTSUID}
  1703. ;;
  1704. 'setgid')
  1705. FINDOUTFILE=${SETGID_OUT}
  1706. FINDOPTS=${FINDOPTSGID}
  1707. ;;
  1708. 'ww')
  1709. FINDOUTFILE=${WW_OUT}
  1710. FINDOPTS=${FINDOPTSWW}
  1711. ;;
  1712. *)
  1713. ${ECHO} "supply an argument of setuid, setgid or www."
  1714. exit 1;
  1715. ;;
  1716. esac
  1717.  
  1718. # touch output file
  1719. ${TOUCH} ${FINDOUTFILE}
  1720. if [ "x${FINDOPTS}" = "x" ]; then
  1721. ${ECHO} "Critical Error. FINDOPTS is not defined for this OS."
  1722. ${ECHO} "Please define FINDOPTSUID, FINDOPTSGID, and FINDOPTSWW"
  1723. ${ECHO} "in ${OS_CONF} and re-run the script."
  1724. exit 1;
  1725. fi
  1726.  
  1727. ${ECHO} "Looking for $1 files... (Please be patient)"
  1728. ${ECHO} "<FIND_$1>" >> ${TAGS_OUT}
  1729. print_separator stdout
  1730. ${ECHO} "Looking for $1 files..." >> ${OUTFILE}
  1731. print_separator outfile
  1732.  
  1733. # if FSTAB is defined, then lets parse it and loop
  1734. # through the filesystems, makes our file easier.
  1735. if [ "x${FSTAB}" != "x" ]; then
  1736. [ "${DEBUG}" != "0" ] && {
  1737. ${ECHO} "FSTAB is defined: ${FSTAB}"
  1738. }
  1739.  
  1740. # unfortunately for us, a few OS put the mount
  1741. # point someplace other than $2, notably solaris.
  1742.  
  1743. case "${OS}" in
  1744.  
  1745. 'Solaris')
  1746. for fs in `${AWK} '! /(nfs|proc|swap)/ && ! /^#/ {print $3}' ${FSTAB}`
  1747. do
  1748. [ "${DEBUG}" != "0" ] && {
  1749. ${ECHO} "DEBUG: Running find command on ${fs}"
  1750. ${ECHO} "DEBUG: ${FINDOPTS} \\;"
  1751. }
  1752. ${FIND} ${fs} ${FINDOPTS} \; |${TEE} ${TAGS_OUT} >>${FINDOUTFILE} 2>>${ERRFILE}
  1753. done
  1754. ;;
  1755.  
  1756. 'Sol10')
  1757. for fs in `${AWK} '! /(nfs|proc|swap)/ && ! /^#/ {print $3}' ${FSTAB}`
  1758. do
  1759. [ "${DEBUG}" != "0" ] && {
  1760. ${ECHO} "DEBUG: Running find command on ${fs}"
  1761. ${ECHO} "DEBUG: ${FINDOPTS} \\;"
  1762. }
  1763. ${FIND} ${fs} ${FINDOPTS} \; |${TEE} ${TAGS_OUT} >>${FINDOUTFILE} 2>>${ERRFILE}
  1764. done
  1765. ;;
  1766.  
  1767. 'Sol9')
  1768. for fs in `${AWK} '! /(nfs|proc|swap)/ && ! /^#/ {print $3}' ${FSTAB}`
  1769. do
  1770. [ "${DEBUG}" != "0" ] && {
  1771. ${ECHO} "DEBUG: Running find command on ${fs}"
  1772. ${ECHO} "DEBUG: ${FINDOPTS} \\;"
  1773. }
  1774. ${FIND} ${fs} ${FINDOPTS} \; |${TEE} ${TAGS_OUT} >>${FINDOUTFILE} 2>>${ERRFILE}
  1775. done
  1776. ;;
  1777.  
  1778. *)
  1779. for fs in `${AWK} '! /(nfs|proc|swap)/ && ! /^#/ {print $2}' ${FSTAB}`
  1780. do
  1781. [ "${DEBUG}" != "0" ] && {
  1782. ${ECHO} "DEBUG: Running find command on ${fs}"
  1783. ${ECHO} "DEBUG: ${FINDOPTS} \\;"
  1784. }
  1785. ${FIND} ${fs} ${FINDOPTS} \; |${TEE} ${TAGS_OUT} >>${FINDOUTFILE} 2>>${ERRFILE}
  1786. done
  1787. ;;
  1788. esac
  1789.  
  1790. else
  1791.  
  1792. # fstab is not defined, for AIX/SCO_SV we parse output
  1793. # of df -k command to find the filesystems to do our finds
  1794. # on. Otherwise we just do a brute force find on /.
  1795.  
  1796. [ "${DEBUG}" != "0" ] && {
  1797. ${ECHO} "DEBUG: FSTAB is NOT DEFINED for this OS."
  1798. ${ECHO} "DEBUG: FSTAB is NOT DEFINED for this OS." >>${OUTFILE}
  1799. }
  1800.  
  1801. case "${OS}" in
  1802.  
  1803. 'AIX')
  1804. for fs in `${DF} -k |${AWK} '! /(nfs|proc|swap)/ {print $7}'|${GREP} -v Mounted`
  1805. do
  1806. [ "${DEBUG}" != "0" ] && {
  1807. ${ECHO} "DEBUG: Running find command on ${fs}"
  1808. ${ECHO} "DEBUG: ${FINDOPTS} \\;"
  1809. }
  1810. ${FIND} ${fs} ${FINDOPTS} \; |${TEE} ${TAGS_OUT} >>${FINDOUTFILE} 2>>${ERRFILE}
  1811. done
  1812. ;;
  1813.  
  1814. 'SCO_SV')
  1815. for fs in `${DF} -k |${AWK} '! /(nfs|proc|swap)/ {print $1}'`
  1816. do
  1817. [ "${DEBUG}" != "0" ] && {
  1818. ${ECHO} "DEBUG: Running find command on ${fs}"
  1819. ${ECHO} "DEBUG: ${FINDOPTS} \\;"
  1820. }
  1821. ${FIND} ${fs} ${FINDOPTS} \; |${TEE} ${TAGS_OUT} >>${FINDOUTFILE} 2>>${ERRFILE}
  1822. done
  1823. ;;
  1824.  
  1825. *)
  1826. # run the brute force find
  1827. [ "${DEBUG}" != "0" ] && {
  1828. ${ECHO} "DEBUG: FSTAB is NOT DEFINED for this OS."
  1829. ${ECHO} "DEBUG: Output file: ${FINDOUTFILE}"
  1830. ${ECHO} "DEBUG: Running find command with these arguments:"
  1831. ${ECHO} "DEBUG: ${FINDOPTS} \\;"
  1832. }
  1833. ${FIND} / ${FINDOPTS} \; |${TEE} ${TAGS_OUT} >>${FINDOUTFILE} 2>>${ERRFILE}
  1834. esac
  1835. fi
  1836. ${ECHO} "</FIND_$1>" >> ${TAGS_OUT}
  1837. # get number of setuid/setgid/ww files, send to logfile
  1838. ${ECHO} "<FIND_$1_NUM>" >> ${TAGS_OUT}
  1839. ${ECHO} "`${WC} -l ${FINDOUTFILE} | ${AWK} '{print $1}'` $1 files found." |${TEE} ${TAGS_OUT} >> ${OUTFILE} 2>>${ERRFILE}
  1840. ${ECHO} "</FIND_$1_NUM>" >> ${TAGS_OUT}
  1841. ${ECHO} "Please see ${FINDOUTFILE} for detailed output." >> ${OUTFILE}
  1842. print_separator outfile
  1843.  
  1844. return;
  1845. }
  1846. ###################################################################
  1847. # function to do listing of permissions on custom defined directories
  1848. # really only used for those special occasions.
  1849. # Dirs are defined in /etc/global.rc (Look for CUSTOM_DIRS"
  1850. # Also, you will need to turn this on with the -custom switch
  1851. ###################################################################
  1852. do_custom_dir () {
  1853.  
  1854. #Find permissions on a bunch of directories
  1855. print_separator stdout
  1856. ${ECHO} "Listing permissions on custom directories..."
  1857. ${ECHO} "<CUSTOM_DIRS>" >> ${TAGS_OUT}
  1858. print_separator stdout
  1859. ${ECHO} "Listing permissions on custom directories..." >> ${OUTFILE}
  1860. ${ECHO} "Please see ${CUSTDIRS_OUT} for detailed output." >> ${OUTFILE}
  1861. ${ECHO} '' >> ${CUSTDIRS_OUT}
  1862.  
  1863.  
  1864. [ "${DEBUG}" != "0" ] && {
  1865. ${ECHO} "DEBUG: Directories to be examined are:"
  1866. ${ECHO} "DEBUG: ${CUSTOM_DIRS}"
  1867. }
  1868.  
  1869. print_separator outfile custdirs
  1870. ${LS} -alR ${CUSTOM_DIRS} |${TEE} ${TAGS_OUT} >> ${CUSTDIRS_OUT} 2>>${ERRFILE}
  1871. ${ECHO} '' >> ${CUSTDIRS_OUT}
  1872. ${ECHO} "</CUSTOM_DIRS>" >> ${TAGS_OUT}
  1873. }
  1874.  
  1875.  
  1876. ###################################################################
  1877. # function to do OS specific stuff, called from main script
  1878. ###################################################################
  1879. do_os_modules () {
  1880.  
  1881. # get all the MODULES
  1882. print_separator stdout
  1883. ${ECHO} "Running OS-specific checks for ${OS}"
  1884. ${ECHO} "<OS_MODULES>" >> ${TAGS_OUT}
  1885. print_separator stdout
  1886.  
  1887. # find number of modules
  1888. NUMMODS=`${LS} ${MODULES} |${GREP} -v CVS|${WC} -l`
  1889.  
  1890. print_separator outfile
  1891. ${ECHO} "${NUMMODS} registered modules for ${OS}" >>${OUTFILE}
  1892. print_separator outfile
  1893. ${ECHO} "Please see ${MODS_OUT} for detailed output." >>${OUTFILE}
  1894.  
  1895. if [ -d ${MODULES} ]; then
  1896. if [ "${NUMMODS}" != "0" ]; then
  1897. for mod in `${LS} ${MODULES} |${GREP} -v CVS`
  1898. do
  1899. print_flag_header outfile mods BEGIN ${mod}
  1900. . ${MODULES}/${mod}
  1901. print_flag_header outfile mods END ${mod}
  1902. done
  1903. else
  1904. ${ECHO} "No modules registered for this OS! Skipping OS-specific checks."
  1905. ${ECHO} "No modules registered for this OS! Skipping OS-specific checks." >>${MODS_OUT}
  1906. fi
  1907. else
  1908. ${ECHO} "${MODULES} directory not found. Skipping OS-specific checks."
  1909. ${ECHO} "${MODULES} directory not found. Skipping OS-specific checks." >>${MODS_OUT}
  1910. fi
  1911. ${ECHO} "</OS_MODULES>" >> ${TAGS_OUT}
  1912. }
  1913. ###################################################################
  1914. #
  1915. # main script
  1916. #
  1917. ####################################################################
  1918.  
  1919. # location of conf directory
  1920. CONFDIR=etc
  1921. GLOBALCONF=${CONFDIR}/global.rc
  1922.  
  1923. # read global configuration file
  1924. if [ -f ${GLOBALCONF} ]; then
  1925. . ${GLOBALCONF}
  1926. else
  1927. echo "Cannot find global config file ${GLOBALCONF}. Quitting."
  1928. exit 1
  1929. fi
  1930.  
  1931. # first get the OS version and source the appropriate config file
  1932. check_os
  1933.  
  1934. # process command line arguments
  1935. while ${TEST} $# != 0
  1936. do
  1937. case "$1" in
  1938.  
  1939. -debug) DEBUG=1 ;;
  1940. -nodebug) DEBUG=0 ;;
  1941. -tar) DO_TAR=1 ;;
  1942. -notar) DO_TAR=0 ;;
  1943. -bind) DO_BIND=1 ;;
  1944. -conftar) DO_CONFIGTAR=1 ;;
  1945. -noconftar) DO_CONFIGTAR=0 ;;
  1946. -noshadow) DO_GET_SHADOWFILE=0 ;;
  1947. -users) DO_SEARCH_USERS=1 ;;
  1948. -nousers) DO_SEARCH_USERS=0
  1949. DO_NIS_SEARCH_USERS=0
  1950. DO_NISPLUS_SEARCH_USERS=0
  1951. ;;
  1952. -nis) DO_NIS=1 ;;
  1953. -nisusers) DO_NIS_SEARCH_USERS=1 ;;
  1954. -nonis) DO_NIS=0
  1955. DO_NIS_SEARCH_USERS=0
  1956. ;;
  1957. -nisplus) DO_NISPLUS=1 ;;
  1958. -nisplususers) DO_NISPLUS_SEARCH_USERS=1 ;;
  1959. -nonisplus) DO_NISPLUS=0
  1960. DO_NISPLUS_SEARCH_USERS=0
  1961. ;;
  1962. -finds) DO_ALLFINDS=1 ;;
  1963. -nofinds) DO_ALLFINDS=0 ;;
  1964. -keydirs) DO_KEY_DIRS_LISTING=1 ;;
  1965. -nokeydirs) DO_KEY_DIRS_LISTING=0 ;;
  1966. -osmods) DO_OS_MODULES=1 ;;
  1967. -noosmods) DO_OS_MODULES=0 ;;
  1968. -custom) DO_CUSTOM_DIRS=1 ;;
  1969. -v|-version) print_version ; exit 1 ;;
  1970. -h|-help) usage ; exit 1 ;;
  1971. *) usage ; exit 1 ;;
  1972.  
  1973. esac
  1974. shift
  1975. done
  1976.  
  1977. # setup the output filenames
  1978. do_setup_output_files
  1979. # do file cleanup if script has been run before on this host
  1980. do_file_cleanup
  1981. # begin
  1982. do_intro
  1983.  
  1984. # moved uname check here from do_gen_checks because it is
  1985. # mandatory
  1986. do_uname
  1987.  
  1988. if [ "${DEBUG}" != "0" ]; then
  1989. dump_global_opts
  1990. fi
  1991.  
  1992. ################################
  1993. # This is the generic section for all OSes
  1994. # More flags are tested in do_general_checks
  1995. # and do_net_checks
  1996. ################################
  1997. if [ "${DO_GEN_CHECKS}" != "0" ]; then
  1998. print_flag_header outfile main BEGIN DO_GEN_CHECKS
  1999. do_general_checks
  2000. print_flag_header outfile main END DO_GEN_CHECKS
  2001. elif [ "${DEBUG}" != "0" ]; then
  2002. print_flag_header stdout SKIP DO_GEN_CHECKS
  2003. fi
  2004.  
  2005. # do user files check, can be time consuming if you have a lot
  2006. # of users, esp automounted ones
  2007. if [ "${DO_SEARCH_USERS}" != "0" ]; then
  2008. print_flag_header outfile main BEGIN DO_SEARCH_USERS
  2009. print_flag_header outfile userfiles BEGIN DO_SEARCH_USERS
  2010. do_users_files_check
  2011. print_flag_header outfile userfiles END DO_SEARCH_USERS
  2012. print_flag_header outfile main END DO_SEARCH_USERS
  2013. elif [ "${DEBUG}" != "0" ]; then
  2014. print_flag_header stdout SKIP DO_SEARCH_USERS
  2015. fi
  2016.  
  2017. # listing on key dirs
  2018. if [ "${DO_KEY_DIRS_LISTING}" != "0" ]; then
  2019. print_flag_header outfile main BEGIN DO_KEY_DIRS_LISTING
  2020. print_flag_header outfile keydirs BEGIN DO_KEY_DIRS_LISTING
  2021. do_key_dirs_listing
  2022. print_flag_header outfile keydirs END DO_KEY_DIRS_LISTING
  2023. print_flag_header outfile main END DO_KEY_DIRS_LISTING
  2024. elif [ "${DEBUG}" != "0" ]; then
  2025. print_flag_header stdout SKIP DO_KEY_DIRS_LISTING
  2026. fi
  2027.  
  2028. # do net checks
  2029. if [ "${DO_NET_CHECKS}" != "0" ]; then
  2030. print_flag_header outfile main BEGIN DO_NET_CHECKS
  2031. do_net_checks
  2032. print_flag_header outfile main END DO_NET_CHECKS
  2033. elif [ "${DEBUG}" != "0" ]; then
  2034. print_flag_header stdout SKIP DO_NET_CHECKS
  2035. fi
  2036.  
  2037. # do nis check
  2038. if [ "${DO_NIS}" != "0" ]; then
  2039. print_flag_header outfile main BEGIN DO_NIS
  2040. do_nis_check
  2041. print_flag_header outfile main END DO_NIS
  2042. elif [ "${DEBUG}" != "0" ]; then
  2043. print_flag_header stdout SKIP DO_NIS
  2044. fi
  2045.  
  2046. # do nis+ check
  2047. if [ "${DO_NISPLUS}" != "0" ]; then
  2048. print_flag_header outfile main BEGIN DO_NISPLUS
  2049. do_nisplus_check
  2050. print_flag_header outfile main END DO_NISPLUS
  2051. elif [ "${DEBUG}" != "0" ]; then
  2052. print_flag_header stdout SKIP DO_NISPLUS
  2053. fi
  2054.  
  2055. # do finds, check flags
  2056. if [ "${DO_ALLFINDS}" != "0" ]; then
  2057. if [ "${DO_SETUID}" != "0" ]; then
  2058. do_finds setuid
  2059. fi
  2060. if [ "${DO_SETGID}" != "0" ]; then
  2061. do_finds setgid
  2062. fi
  2063. if [ "${DO_WW}" != "0" ]; then
  2064. do_finds ww
  2065. fi
  2066. elif [ "${DEBUG}" != "0" ]; then
  2067. print_flag_header stdout SKIP DO_ALLFINDS
  2068. fi
  2069.  
  2070. # do custom dirs listings - not for the faint of heart
  2071. if [ "${DO_CUSTOM_DIRS}" != "0" ]; then
  2072. print_flag_header outfile main BEGIN DO_CUSTOM_DIRS_LISTING
  2073. print_flag_header outfile custdirs BEGIN DO_CUSTOM_DIRS
  2074. do_custom_dir
  2075. print_flag_header outfile custdirs END DO_CUST_DIRS
  2076. print_flag_header outfile main END DO_CUSTOM_DIRS
  2077. elif [ "${DEBUG}" != "0" ]; then
  2078. print_flag_header stdout SKIP DO_CUSTOM_DIRS
  2079. fi
  2080.  
  2081. # do os-specific checks
  2082. if [ "${DO_OS_MODULES}" != "0" ]; then
  2083. print_flag_header outfile main BEGIN DO_OS_MODULES
  2084. do_os_modules
  2085. print_flag_header outfile main END DO_OS_MODULES
  2086. elif [ "${DEBUG}" != "0" ]; then
  2087. print_flag_header stdout SKIP DO_OS_MODULES
  2088. fi
  2089.  
  2090. # secure output files, just in case UMASK permissions are insecure
  2091. do_chmod
  2092.  
  2093. # wrap up
  2094. do_outro
  2095.  
  2096. # tar up all output files if they want
  2097. if [ "${DO_TAR}" != "0" ]; then
  2098. do_tar
  2099. fi
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!