audit-labs/audit-tools

 1#!/bin/bash
 2
 3# Check if the script is being run as root
 4if [[ "$EUID" -ne 0 ]]; then
 5  echo "Error: This script must be run as root or with sudo." >&2
 6  exit 1
 7fi
 8
 9# Check if the sshd_config file exists
10if [[ ! -f /etc/ssh/sshd_config ]]; then
11    echo "Error: /etc/ssh/sshd_config not found." >&2
12    exit 1
13fi
14
15echo "--- SSH Root Login Audit ---"
16
17# Find the PermitRootLogin setting, ignoring commented-out lines
18permit_root_login=$(grep -E "^[[:space:]]*PermitRootLogin" /etc/ssh/sshd_config)
19echo "Found setting: $permit_root_login"
20
21
22# Check if PermitRootLogin is set to something other than 'no'
23if ! echo "$permit_root_login" | grep -q "no"; then
24    echo "[WARNING] Root login is permitted."
25    echo ""
26    echo "Checking for root's authorized_keys file..."
27
28    # Look for an explicitly set AuthorizedKeysFile path
29    auth_keys_path_line=$(grep -E "^[[:space:]]*AuthorizedKeysFile" /etc/ssh/sshd_config)
30
31    if [[ -n "$auth_keys_path_line" ]]; then
32        # An explicit path is set. Extract the path.
33        # This removes the 'AuthorizedKeysFile' keyword and leading/trailing whitespace.
34        auth_keys_path=$(echo "$auth_keys_path_line" | awk '{print $2}')
35        echo "sshd_config specifies: $auth_keys_path_line"
36        
37        # The path might contain '%h', which means the user's home directory.
38        # For root, this is /root.
39        actual_path=${auth_keys_path/\%h/\/root}
40        
41    else
42        # No explicit path is set, so we check the default location.
43        echo "AuthorizedKeysFile not set in sshd_config. Checking default location."
44        actual_path="/root/.ssh/authorized_keys"
45    fi
46
47    echo "Checking for file at: $actual_path"
48    if [[ -f "$actual_path" ]]; then
49        echo "[CRITICAL] Found authorized keys file for root at $actual_path"
50        echo "Contents:"
51        echo "----------------------------------------"
52        cat "$actual_path"
53        echo "----------------------------------------"
54    else
55        echo "[INFO] No authorized keys file found at the specified or default location."
56    fi
57
58else
59    echo "[OK] PermitRootLogin is set to 'no'. No further checks needed."
60fi