audit-labs/audit-tools

 1#!/bin/bash
 2
 3# Function to extract and format password complexity parameters from /etc/pam.d/system-auth
 4extract_password_params() {
 5    echo "Checking /etc/pam.d/system-auth for password parameters..."
 6    
 7    if [[ -f /etc/pam.d/system-auth ]]; then
 8        # Extract the line containing the password complexity parameters
 9        param_line=$(grep -E 'difok=.* minlen=.* dcredit=.* ocredit=.* ucredit=.* lcredit=.* minclass=.* maxsequence=.*' /etc/pam.d/system-auth)
10        
11        if [[ -n "$param_line" ]]; then
12            echo "Password complexity parameters found:"
13            echo "$param_line"
14            echo ""
15            
16            # Extract individual parameters using regex
17            minlen=$(echo "$param_line" | grep -oP 'minlen=\K\d+')
18            lcredit=$(echo "$param_line" | grep -oP 'lcredit=\K\d+')
19            ucredit=$(echo "$param_line" | grep -oP 'ucredit=\K\d+')
20            dcredit=$(echo "$param_line" | grep -oP 'dcredit=\K\d+')
21            ocredit=$(echo "$param_line" | grep -oP 'ocredit=\K\d+')
22            minclass=$(echo "$param_line" | grep -oP 'minclass=\K\d+')
23            
24            # Note: These parameters might not be present in the same line, so we set default values if not found
25            remember=$(grep -oP 'remember=\K\d+' /etc/pam.d/system-auth || echo "N/A")
26            retry=$(grep -oP 'retry=\K\d+' /etc/pam.d/system-auth || echo "N/A")
27            unlock_time=$(grep -oP 'unlock_time=\K\d+' /etc/pam.d/system-auth || echo "N/A")
28            
29            # Format the extracted parameters into a table
30            echo "Formatted Password Complexity Parameters:"
31            echo "---------------------------------------------------"
32            echo -e "Minlen     : $minlen characters"
33            echo -e "Lcredit    : $lcredit lowercase"
34            echo -e "Ucredit    : $ucredit uppercase"
35            echo -e "Dcredit    : $dcredit numbers"
36            echo -e "Ocredit    : $ocredit special"
37            echo -e "Remember   : $remember password history"
38            echo -e "Minclass   : $minclass character types"
39            echo -e "Retry      : $retry incorrect passwords"
40            echo -e "Unlock_time: $unlock_time seconds until unlocked"
41        else
42            echo "No password complexity parameters found in /etc/pam.d/system-auth."
43        fi
44    else
45        echo "/etc/pam.d/system-auth file not found."
46    fi
47    return 0
48}
49
50# Function to analyze /etc/login.defs
51analyze_login_defs() {
52    echo "Analyzing /etc/login.defs..."
53    if [[ -f /etc/login.defs ]]; then
54        echo "Contents of /etc/login.defs:"
55        cat /etc/login.defs
56        echo ""
57        
58        # Analysis
59        echo "Login restrictions and parameters in /etc/login.defs:"
60        grep -E 'PASS_MAX_DAYS|PASS_MIN_DAYS|PASS_MIN_LEN|PASS_WARN_AGE|UID_MIN|UID_MAX|GID_MIN|GID_MAX|LOGIN_RETRIES|LOGIN_TIMEOUT|UID|GID' /etc/login.defs
61        echo ""
62    else
63        echo "/etc/login.defs file not found."
64    fi
65    return 0
66}
67
68# Main script execution
69echo "Starting analysis of authentication and login parameters..."
70extract_password_params
71analyze_login_defs
72echo "Analysis complete."