audit-labs/audit-tools

  1#!/bin/bash
  2
  3# Default report file
  4REPORT_FILE="report.txt"
  5TRIM_COMMENTS=false
  6
  7# Function to log section header
  8log_section() {
  9    local section_num="$1"
 10    local section_title="$2"
 11    echo -e "\n\n" >> "$REPORT_FILE"
 12    echo "==========================================" >> "$REPORT_FILE"
 13    echo "# SECTION $section_num: $section_title" >> "$REPORT_FILE"
 14    echo "==========================================" >> "$REPORT_FILE"
 15    return 0
 16}
 17
 18# Function to log file content
 19log_file_content() {
 20    FILE_PATH="$1"
 21    FILE_NAME=$(basename "$FILE_PATH")
 22    echo "## $FILE_NAME" >> "$REPORT_FILE"
 23    if [[ -f $FILE_PATH ]]; then
 24        if $TRIM_COMMENTS; then
 25            # Trim comments (lines starting with # or empty lines)
 26            grep -vE '^\s*#|^\s*$' "$FILE_PATH" >> "$REPORT_FILE"
 27        else
 28            cat "$FILE_PATH" >> "$REPORT_FILE"
 29        fi
 30    else
 31        echo "File $FILE_PATH not found!" >> "$REPORT_FILE"
 32    fi
 33    return 0
 34}
 35
 36# Function to log command output
 37log_command_output() {
 38    local label="$1"
 39    local command="$2"
 40    echo "## $label" >> "$REPORT_FILE"
 41    $command >> "$REPORT_FILE" 2>&1
 42    return 0
 43}
 44
 45# Check for sudo privileges
 46if [[ $EUID -ne 0 ]]; then
 47    echo "This script requires sudo privileges. Please enter your password."
 48    exec sudo "$0" "$@"
 49fi
 50
 51# Parse command-line arguments
 52while getopts "t" opt; do
 53    case $opt in
 54        t)
 55            TRIM_COMMENTS=true
 56            REPORT_FILE="report_trimmed.txt"
 57            ;;
 58        *)
 59            echo "Usage: $0 [-t]  # Use -t to trim comments from files"
 60            exit 1
 61            ;;
 62    esac
 63done
 64
 65# Initialize report file
 66> "$REPORT_FILE"  # Clear the file if it exists
 67
 68# ASCII Header
 69cat << "EOF" >> "$REPORT_FILE"
 70  _     ___ _   _ _   ___  __   ___  ____    ____  _____ ____   ___  ____ _____ 
 71 | |   |_ _| \ | | | | \ \/ /  / _ \/ ___|  |  _ \| ____|  _ \ / _ \|  _ \_   _|
 72 | |    | ||  \| | | | |\  /  | | | \___ \  | |_) |  _| | |_) | | | | |_) || |  
 73 | |___ | || |\  | |_| |/  \  | |_| |___) | |  _ <| |___|  __/| |_| |  _ < | |  
 74 |_____|___|_| \_|\___//_/\_\  \___/|____/  |_| \_\_____|_|    \___/|_| \_\|_|  
 75EOF
 76
 77# Log Script Info
 78log_section "00" "Script Info"
 79echo "Execution Date and Time: $(date)" >> "$REPORT_FILE"
 80echo "Script Name: $0" >> "$REPORT_FILE"
 81
 82if [[ $(whoami) == "root" ]]; then
 83    echo "User Running the Script: root (called by: $SUDO_USER)" >> "$REPORT_FILE"
 84else
 85    echo "User Running the Script: $(whoami)" >> "$REPORT_FILE"
 86fi
 87
 88# Log System Info
 89log_section "01" "System Info"
 90log_command_output "Hostname" "hostname"
 91log_command_output "Kernel Version" "uname -r"
 92log_file_content "/etc/os-release"
 93log_command_output "IP Address" "hostname -I"
 94
 95# Log Password Parameters
 96log_section "02" "Password Parameters"
 97log_file_content "/etc/pam.d/system-auth"
 98log_file_content "/etc/login.defs"
 99
100# Log Users
101log_section "03" "Users"
102log_file_content "/etc/passwd"
103log_file_content "/etc/group"
104
105# Log Admins
106log_section "04" "Admins"
107log_file_content "/etc/sudoers"
108log_command_output "Sudo Group" "getent group sudo"
109log_command_output "Wheel Group" "getent group wheel"
110log_command_output "Root User" "getent passwd 0"
111
112# Log SSH Configuration
113log_section "05" "SSH Configuration"
114log_file_content "/etc/ssh/sshd_config"
115
116# Log Logging Configuration
117log_section "06" "Logging Configuration"
118log_file_content "/etc/syslog.conf"
119log_file_content "/etc/logrotate.conf"
120
121# Log Jobs
122log_section "07" "Jobs"
123log_command_output "Sudo Crontab" "sudo crontab -l"
124log_file_content "/etc/cron.allow"
125
126# Log Security Status
127log_section "08" "Security Status"
128log_command_output "SELinux Status" "sestatus"
129log_command_output "AppArmor Status" "aa-status"
130
131# Log Firewall Rules
132log_section "09" "Firewall Rules"
133log_command_output "Iptables Rules" "sudo iptables -L"
134
135# Log Open Ports
136log_section "10" "Open Ports"
137log_command_output "Netstat" "netstat -tuln"
138
139# Set report ownership
140if [[ $(whoami) == "root" ]]; then
141    chown "$SUDO_USER" "$REPORT_FILE"
142fi