CloudyScripts 1.6.1 → 1.7.27

data/lib/audit/checks/DIRECTORY_LISTING.check

@@ -0,0 +1,14 @@
+ID: DIRECTORY_LISTING
+Name: Create a directory listing of all files on the root filesystem
+Depends: [HAS_FIND, HAS_COMPRESSOR, MAYBE_HAS_SUPERUSER]
+Imports: [FIND, STREAM_COMPRESSOR, STREAM_COMPRESSOR_SUFFIX, RUN_AS_SUPERUSER]
+Description: >
+   Create a listing of all directories and files on the root filesystem.
+Script: |
+   ${RUN_AS_SUPERUSER} ${FIND} / -mount -ls | ${STREAM_COMPRESSOR} > ${AUDIT_DIRECTORY}/DIRECTORY_LISTING.txt.${STREAM_COMPRESSOR_SUFFIX}
+   TMP_EXITCODE=$?
+   if [ ${TMP_EXITCODE} -eq 0 ]
+   then
+      script_attach_file "${AUDIT_DIRECTORY}/DIRECTORY_LISTING.txt.${STREAM_COMPRESSOR_SUFFIX}" "A complete directory listing of the audited host"
+      script_set_exit_code ${TMP_EXITCODE}
+   fi

data/lib/audit/checks/DISTRIBUTION_FACTS.check

@@ -0,0 +1,60 @@
+ID: DISTRIBUTION_FACTS
+Name: Get linux distribution facts
+Depends: [MAYBE_HAS_LSB_RELEASE, HAS_CUT, HAS_BASE]
+Exports: [DISTRIBUTION_NAME]
+Imports: [HEAD, SED, CUT, LSB_RELEASE]
+Description: >
+   Get platform facts like processor, architecture, operating system ...
+Script: |
+   if [ ! "${LSB_RELEASE}" = "" ]; then
+      TMP_DIST_NAME=$(${LSB_RELEASE} -i 2>/dev/null)
+      TMP_DIST_RELEASE=$(${LSB_RELEASE} -r 2>/dev/null)
+      TMP_DIST_CODENAME=$(${LSB_RELEASE} -c 2>/dev/null)
+      TMP_DIST_DESCRIPTION=$(${LSB_RELEASE} -d 2>/dev/null)
+   elif [ -r "/etc/fedora-release" ]; then
+      TMP_DIST_NAME=$( ${CAT} /etc/fedora-release | ${CUT} -d' ' -f1 )
+      TMP_DIST_RELEASE=$( ${CAT} /etc/fedora-release | ${CUT} -d' ' -f2-3 )
+      TMP_DIST_CODENAME=$( ${CAT} /etc/fedora-release  | ${SED} -e 's/^.*(\(.*\)).*$/\1/' )
+   elif [ -r '/etc/release' ]; then
+      TMP_DIST_NAME=$( head -n1 /etc/release | sed 's/ *\([^0-9]*\) [0-9].*/\1/' )
+   elif [ -r '/etc/arch-release' ]; then
+      TMP_DIST_NAME="Arch Linux"
+   elif [ -r '/etc/debian_version' ]; then
+      TMP_DIST_NAME='Debian'
+      TMP_DIST_RELEASE=$( ${CAT} /etc/debian_version )
+   elif [ -r '/etc/gentoo-release' ]; then
+      TMP_DIST_NAME='Gentoo'
+   elif [ -r '/etc/knoppix-version' ]; then
+      TMP_DIST_NAME='Knoppix'
+   elif [ -r '/etc/mandrake-release' ]; then
+      TMP_DIST_NAME='Mandrake'
+   elif [ -r '/etc/pardus-release' ]; then
+      TMP_DIST_NAME='Pardus'
+   elif [ -r '/etc/puppyversion' ]; then
+      TMP_DIST_NAME='Puppy Linux'
+   elif [ -r '/etc/redhat-release' ]; then
+      TMP_DIST_NAME='Red Hat'
+   elif [ -r '/etc/sabayon-release' ]; then
+      TMP_DIST_NAME='Sabayon'
+   elif [ -r '/etc/slackware-version' ]; then
+      TMP_DIST_NAME='Slackware'
+   elif [ -r '/etc/SuSE-release' ]; then
+      TMP_DIST_NAME=$( ${CAT} /etc/SuSE-release | ${HEAD} -n1 | ${CUT} -d' ' -f1 )
+      TMP_DIST_VERSION=$( ${CAT} /etc/SuSE-release | ${HEAD} -n1 | ${CUT} -d' ' -f2 )
+   elif [ -r '/etc/xandros-desktop-version' ]; then
+      TMP_DIST_NAME='Xandros'
+   elif [ -r '/etc/zenwalk-version' ]; then
+      TMP_DIST_NAME="Zenwalk"
+   fi
+
+
+
+   script_data "machine_information.distribution.name" "${TMP_DIST_NAME}"
+   script_data "machine_information.distribution.release" "${TMP_DIST_RELEASE}"
+   if [ ! "${TMP_DIST_CODENAME}" = "" ]; then script_data "machine_information.distribution.codename" "${TMP_DIST_CODENAME}"; fi
+   if [ ! "${TMP_DIST_DESCRIPTION}" = "" ]; then script_data "machine_information.distribution.description" "${TMP_DIST_DESCRIPTION}"; fi
+   DISTRIBUTION_NAME="${TMP_DIST_NAME}"
+   ! false
+
+   
+         

data/lib/audit/checks/DMESG_OUTPUT.check

@@ -0,0 +1,14 @@
+ID: DMESG_OUTPUT
+Name: Save output of dmesg
+Depends: [HAS_FIND, HAS_COMPRESSOR]
+Imports: [FIND, STREAM_COMPRESSOR]
+Description: >
+   Save output of dmesg to a file.
+Script: |
+   dmesg | ${STREAM_COMPRESSOR} > ${AUDIT_DIRECTORY}/DMESG_OUTPUT.txt.${STREAM_COMPRESSOR_SUFFIX}
+   TMP_EXITCODE=$?
+   if [ ${TMP_EXITCODE} -eq 0 ]
+   then
+      script_attach_file "${AUDIT_DIRECTORY}/DMESG_OUTPUT.txt.${STREAM_COMPRESSOR_SUFFIX}" "output of the dmesg command"
+      script_set_exit_code ${TMP_EXITCODE}
+   fi 

data/lib/audit/checks/FIND_GROUP_FILE.check

@@ -0,0 +1,6 @@
+ID: FIND_GROUP_FILE
+Name: Find /etc/group file
+Description: Check that /etc/group file is present and export it in GROUP_FILE.
+Export: [GROUP_FILE]
+Severity: high
+Script: ls /etc/group 2>/dev/null 1>/dev/null && GROUP_FILE=/etc/group

data/lib/audit/checks/FIND_PASSWD_FILE.check

@@ -0,0 +1,8 @@
+ID: FIND_PASSWD_FILE
+Name: Find /etc/passwd file
+Description: Check that /etc/passwd file is present and export it in PASSWD_FILE.
+Fail-Message: >
+   File /etc/passwd not found. This file is essential for all checks on users and home directories. 
+   Please verify your installation, as this file should exist.
+Severity: high
+Script: ls /etc/passwd 2>/dev/null 1>/dev/null && PASSWD_FILE=/etc/passwd

data/lib/audit/checks/FIND_SHADOW_FILE.check

@@ -0,0 +1,5 @@
+ID: FIND_SHADOW_FILE
+Name: Find /etc/shadow file
+Description: Check that /etc/shadow file is present and export it in SHADOW_FILE.
+Export: [SHADOW_FILE]
+Script: ls /etc/shadow 2>/dev/null 1>/dev/null && SHADOW_FILE=/etc/shadow

data/lib/audit/checks/FIND_SUDOERS_FILE.check

@@ -0,0 +1,6 @@
+ID: FIND_SUDOERS_FILE
+Name: Find /etc/sudoers file
+Export: [SUDOERS_FILE]
+Description: Check that /etc/sudoers file is present and export it in SUDOERS_FILE.
+Severity: high
+Script: ls /etc/sudoers 2>/dev/null 1>/dev/null && SUDOERS_FILE=/etc/sudoers

data/lib/audit/checks/FREE_SPACE.check

@@ -0,0 +1,26 @@
+ID: FREE_SPACE
+Name: List free and used space for devices.
+Depends: [HAS_AWK, HAS_DF, HAS_BASE, HAS_TAIL]
+Imports: [AWK, DF, SED, TAIL]
+Description: List free and used spaces for devices mounted in the file system.
+Script: |
+   IFS=$( printf "\n+" ); IFS=${IFS%+}
+   TMP_OUTPUT=$( ${DF} | ${TAIL} -n +2 )
+
+   for TMP_LINE in ${TMP_OUTPUT}
+   do
+      TMP_DEVICE=$( echo ${TMP_LINE} | ${AWK} '{ print $1 }' )
+      TMP_SIZE=$( echo ${TMP_LINE} | ${AWK} '{ print $2 }' )
+      TMP_USED=$( echo ${TMP_LINE} | ${AWK} '{ print $3 }' )
+      TMP_AVAILABLE=$( echo ${TMP_LINE} | ${AWK} '{ print $4 }' )
+      TMP_USED_PERCENT=$( echo ${TMP_LINE} | ${AWK} '{ print $5 }' )
+      TMP_MOUNTPOINT=$( echo ${TMP_LINE} | ${AWK} '{ print $6 }' )
+
+      script_data "filesystem.mountpoints.{${TMP_MOUNTPOINT}}.device" "${TMP_DEVICE}"
+      script_data "filesystem.mountpoints.{${TMP_MOUNTPOINT}}.size" "${TMP_SIZE}"
+      script_data "filesystem.mountpoints.{${TMP_MOUNTPOINT}}.used" "${TMP_USED}"
+      script_data "filesystem.mountpoints.{${TMP_MOUNTPOINT}}.available" "${TMP_AVAILABLE}"
+      script_data "filesystem.mountpoints.{${TMP_MOUNTPOINT}}.used_percent" "${TMP_USED_PERCENT}"
+   done
+   ! false
+   

data/lib/audit/checks/HAS_AWK.check

@@ -0,0 +1,30 @@
+ID: HAS_AWK
+Name: Check for awk program
+Depends: [HAS_BASE]
+Exports: [AWK]
+Imports: [HEAD, SED]
+Description: Find the awk program and export it to AWK.
+Type: [check, export, info]
+Script: |
+   if echo "test" | awk '{ print $1 }' 2>/dev/null 1>/dev/null
+   then
+      AWK=awk
+      if ${AWK} --version 2>/dev/null 1>/dev/null
+      then 
+         TMP_AWK_NAME=$(${AWK} --version | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z() ]\+\)[[:blank:]]\([0-9.]\+\)/\1/')
+         TMP_AWK_VERSION=$(${AWK} --version | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z() ]\+\)[[:blank:]]\([0-9.]\+\)/\2/')
+      #mawk
+      elif ${AWK} -W version 2>/dev/null 1>/dev/null
+      then      
+         TMP_AWK_NAME=$(${AWK} -W version 2>/dev/null | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z]\+\)[[:blank:]]\+\([0-9. A-Za-z]\+\),.*$/\1/')
+         TMP_AWK_VERSION=$(${AWK} -W version 2>/dev/null | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z]\+\)[[:blank:]]\+\([0-9. A-Za-z]\+\),.*$/\2/')
+      else
+         TMP_AWK_NAME="awk"
+         TMP_AWK_VERSION="unknown"
+      fi
+      script_program_name "${TMP_AWK_NAME}" "${TMP_AWK_VERSION}"
+      ! false
+   else 
+      script_message "awk not found"
+      false
+   fi

data/lib/audit/checks/HAS_BASE.check

@@ -0,0 +1,21 @@
+ID: HAS_BASE
+Name: Check for base programs
+Description: Find the head and sed programs and export them to HEAD and SED.
+Type: [check, export, info]
+Script: |
+   if echo "" | head 2>/dev/null 1>/dev/null && echo "" | sed -e "" 2>/dev/null 1>/dev/null
+   then
+      HEAD=head
+      SED=sed
+      TMP_HEAD_NAME="$(${HEAD} --version | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z() ]\+\)[[:blank:]]\([0-9.]\+\)/\1/')"
+      TMP_HEAD_VERSION="$(${HEAD} --version | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z() ]\+\)[[:blank:]]\([0-9.]\+\)/\2/')"
+      TMP_SED_NAME="$(${SED} --version | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z() ]\+\)[[:blank:]]\([0-9.]\+\)/\1/')"
+      TMP_SED_VERSION="$(${SED} --version | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z() ]\+\)[[:blank:]]\([0-9.]\+\)/\2/')"
+      script_program_name "${TMP_HEAD_NAME}" "${TMP_HEAD_VERSION}"
+      script_program_name "${TMP_SED_NAME}" "${TMP_SED_VERSION}"
+      ! false
+   else
+      script_not_found "head"
+      script_not_found "sed"
+      false
+   fi

data/lib/audit/checks/HAS_CAT.check

@@ -0,0 +1,18 @@
+ID: HAS_CAT
+Name: Check for cat program
+Depends: [HAS_BASE]
+Imports: [HEAD, SED]
+Description: Find the cat program and export it to CAT.
+Type: [check, export, info]
+Script: |
+   if cat --version 2>/dev/null 1>/dev/null
+   then 
+      CAT=cat
+      TMP_CAT_NAME=$(${CAT} --version | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z() ]\+\)[[:blank:]]\([0-9.]\+\)/\1/')
+      TMP_CAT_VERSION=$(${CAT} --version | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z() ]\+\)[[:blank:]]\([0-9.]\+\)/\2/')
+      script_program_name "${TMP_CAT_NAME}" "${TMP_CAT_VERSION}"
+      ! false
+   else 
+      script_error_message "cat not found"
+      false
+   fi

data/lib/audit/checks/HAS_COMPRESSOR.check

@@ -0,0 +1,30 @@
+ID: HAS_COMPRESSOR
+Name: Find a compression program and export it to COMPRESSOR.
+Depends: [MAYBE_HAS_BZIP2, MAYBE_HAS_TAR]
+Exports: [COMPRESSOR, STREAM_COMPRESSOR, COMPRESSOR_SUFFIX, STREAM_COMPRESSOR_SUFFIX]
+Imports: [TAR, BZIP2]
+Description: >
+   Find a compression program. The program will be exported to COMPRESSOR
+   and can be used by calling it like that: 
+   ${COMPRESSOR} destination.${COMPRESSOR_SUFFIX} files
+   It is important to not put quotation marks around ${COMPRESSOR}, as the  command
+   includes parameters.
+   In the same manner STREAM_COMPRESSOR is exported and can be chained into a stream
+   to compress this stream, p.ex. 
+   cat data | ${STREAM_COMPRESSOR} > dest.${STREAM_COMPRESSOR_SUFFIX}  
+Script: |
+   #
+   if [ ! "${TAR}" = "" ]
+   then
+      COMPRESSOR="${TAR} cjf"
+      COMPRESSOR_SUFFIX="tar.bz2"
+   fi
+
+   if [ ! "${BZIP2}" = "" ]
+   then
+      STREAM_COMPRESSOR="${BZIP2} -9c"
+      STREAM_COMPRESSOR_SUFFIX="bz2"
+   fi
+
+   # script is fine if the compressor variables are defined in the end
+   [ ! "${COMPRESSOR}" = "" ] && [ ! "${STREAM_COMPRESSOR}" = "" ]

data/lib/audit/checks/HAS_CUT.check

@@ -0,0 +1,18 @@
+ID: HAS_CUT
+Name: Check for cut program
+Depends: [HAS_BASE]
+Imports: [HEAD, SED]
+Description: Find the cut program and export it to CUT.
+Type: [check, export, info]
+Script: |
+   if cut --version 2>/dev/null 1>/dev/null
+   then 
+      CUT=cut
+      TMP_CUT_NAME=$(${CUT} --version | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z() ]\+\)[[:blank:]]\([0-9.]\+\)/\1/')
+      TMP_CUT_VERSION=$(${CUT} --version | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z() ]\+\)[[:blank:]]\([0-9.]\+\)/\2/')
+      script_program_name "${TMP_CUT_NAME}" "${TMP_CUT_VERSION}"
+      ! false
+   else 
+      script_error_message "not found"
+      false
+   fi

data/lib/audit/checks/HAS_DF.check

@@ -0,0 +1,19 @@
+ID: HAS_DF
+Name: Check for df
+Depends: [HAS_BASE]
+Exports: [DF]
+Imports: [HEAD, SED]
+Description: Find the df program and export it to DF.
+Type: [check, export, info]
+Script: |
+   if df --version 2>/dev/null 1>/dev/null
+   then 
+      DF=df
+      TMP_DF_NAME=$(${DF} --version | ${HEAD} -1 | ${SED} -e 's/^\([A-Za-z() -]\+\)[[:blank:]]\([0-9.]\+\).*$/\1/')
+      TMP_DF_VERSION=$(${DF} --version | ${HEAD} -1 | ${SED} -e 's/^\([A-Za-z() -]\+\)[[:blank:]]\([0-9.]\+\).*$/\2/')
+      script_program_name "${TMP_DF_NAME}" "${TMP_DF_VERSION}"
+      ! false
+   else 
+      script_message "df not found"
+      false
+   fi

data/lib/audit/checks/HAS_DPKG.check

@@ -0,0 +1,18 @@
+ID: HAS_DPKG
+Name: Check for dpkg program
+Depends: [HAS_BASE]
+Exports: [DPKG]
+Imports: [HEAD, SED]
+Description: Find the dpkg program and export it to DPKG.
+Script: |
+   if dpkg --version 2>/dev/null 1>/dev/null
+   then 
+      DPKG=dpkg
+      TMP_DPKG_NAME=$(${DPKG} --version | ${HEAD} -1 | ${SED} -e 's/^\(.*\)[[:blank:]]\+version.*$/\1/' )
+      TMP_DPKG_VERSION=$(${DPKG} --version | ${HEAD} -1 | ${SED} -e 's/^.*version[[:blank:]]\+\(.*\)$/\1/')
+      script_program_name "${TMP_DPKG_NAME}" "${TMP_DPKG_VERSION}"
+      ! false
+   else 
+      script_message "dpkg not found"
+      false
+   fi

data/lib/audit/checks/HAS_FILE_DOWNLOADER.check

@@ -0,0 +1,32 @@
+ID:  HAS_FILE_DOWNLOADER
+Name: Provide a program that can download files from web servers
+Description: >
+   Extract all information from the /etc/passwd file
+   and export it as key/value pairs.
+Depends: [MAYBE_HAS_WGET, MAYBE_HAS_CURL]
+Imports: [WGET, CURL]
+Exports: [DOWNLOAD_FILE] #export is a function
+Script: |
+   if [ ! "${WGET}" = "" ]
+   then
+      DOWNLOAD_FILE() {
+         if [ "$3" = "" ]
+         then
+            ${WGET} -O "$1" "$2" 2>/dev/null 1>/dev/null
+         else
+            ${WGET} -O "$1" --user=$3 --password=$4 "$2" 2>/dev/null 1>/dev/null
+         fi
+      }
+   elif [ ! "${CURL}" = "" ]
+   then
+      DOWNLOAD_FILE() {
+         if [ "$3" = "" ]
+         then
+            ${CURL} -L -o "$1" "$2" 2>/dev/null 1>/dev/null
+         else
+            ${CURL} -L -o "$1" --user $3:$4 "$2" 2>/dev/null 1>/dev/null
+         fi
+      }
+   fi
+
+   type DOWNLOAD_FILE 2>/dev/null 1>/dev/null

data/lib/audit/checks/HAS_FIND.check

@@ -0,0 +1,18 @@
+ID: HAS_FIND
+Name: Check for find
+Depends: [HAS_BASE]
+Exports: [FIND]
+Imports: [HEAD, SED]
+Description: Find the find program and export it to FIND.
+Script: |
+   if find --version 2>/dev/null 1>/dev/null
+   then 
+      FIND=find
+      TMP_FIND_NAME=$(${FIND} --version | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z() ]\+\)[[:blank:]]\([0-9.]\+\)/\1/')
+      TMP_FIND_VERSION=$(${FIND} --version | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z() ]\+\)[[:blank:]]\([0-9.]\+\)/\2/')
+      script_program_name "${TMP_FIND_NAME}" "${TMP_FIND_VERSION}"
+      ! false
+   else 
+      script_message "find not found"
+      false
+   fi

data/lib/audit/checks/HAS_GREP.check

@@ -0,0 +1,19 @@
+ID: HAS_GREP
+Name: Check for grep
+Depends: [HAS_BASE]
+Exports: [GREP]
+Imports: [HEAD, SED]
+Description: Find the grep program and export it to GREP.
+Type: [check, export, info]
+Script: |
+   if grep --version 2>/dev/null 1>/dev/null
+   then 
+      GREP=grep
+      TMP_GREP_NAME=$(${GREP} --version | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z() ]\+\)[[:blank:]]\([0-9.]\+\)/\1/')
+      TMP_GREP_VERSION=$(${GREP} --version | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z() ]\+\)[[:blank:]]\([0-9.]\+\)/\2/')
+      script_program_name "${TMP_GREP_NAME}" "${TMP_GREP_VERSION}"
+      ! false
+   else 
+      script_message "grep not found"
+      false
+   fi

data/lib/audit/checks/HAS_GROUPCHECK.check

@@ -0,0 +1,23 @@
+ID: HAS_GROUPCHECK
+Name: Find the grpck program
+Depends: [HAS_BASE, PLATFORM_FACTS, DISTRIBUTION_FACTS]
+Imports: [HEAD, SED]
+Description: Find the grpck program and export it to GROUPCHECK.
+Type: [check, export, info]
+Script: |
+   grpck -r 2>/dev/null 1>/dev/null
+   if ! [ "$?" = 127 ]
+   then 
+      if [ "${OS_NAME}" = "Linux" ] && [ "${DISTRIBUTION_NAME}" = "SuSE" ]
+      then
+         #on SuSE, only print errors, not warnings (option not available on other systems)
+         GROUPCHECK="grpck -q -r"
+      else
+         GROUPCHECK="grpck -r"
+      fi
+      script_program_name "grpck" "unknown"
+      ! false
+   else 
+      script_message "grpck not found"
+      false
+   fi

data/lib/audit/checks/HAS_GROUPS.check

@@ -0,0 +1,19 @@
+ID: HAS_GROUPS
+Name: Check for groups command
+Depends: [HAS_BASE]
+Exports: [GROUPS]
+Imports: [HEAD, SED]
+Description: Find the groups program and export it to GROUPS.
+Type: [check, export, info]
+Script: |
+   if groups --version 2>/dev/null 1>/dev/null
+   then 
+      GROUPS=groups
+      TMP_GROUPS_NAME=$(${GROUPS} --version | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z() ]\+\)[[:blank:]]\([0-9.]\+\)/\1/')
+      TMP_GROUPS_VERSION=$(${GROUPS} --version | ${HEAD} -1 | ${SED} -e 's/\([A-Za-z() ]\+\)[[:blank:]]\([0-9.]\+\)/\2/')
+      script_program_name "${TMP_GROUPS_NAME}" "${TMP_GROUPS_VERSION}"
+      ! false
+   else 
+      script_error_message "not found"
+      false
+   fi

data/lib/audit/checks/HAS_HOSTNAME.check

@@ -0,0 +1,7 @@
+ID: HAS_HOSTNAME
+Name: Check for hostname program
+Depends: [MAYBE_HAS_HOSTNAME]
+Imports: [HOSTNAME]
+Description: Require the hostname program.
+Script: |
+   ! [ "${HOSTNAME}" = "" ]