audit-labs/audit-tools
A collection of scripts, queries, and other goodies you can use in an audit.
clone: git clone https://gitbay.org/audit-labs/audit-tools.git
06b9975acbfa43b11375e3742545127534a61a6d
signed_unknown_key
author: Christian Cleberg <hello@cleberg.net> · 2025-05-07T16:43:30Z
committer: <noreply@github.com>
os/linux/README.org | 461 ++++----------------------------------------- os/linux/passwords.sh | 0 os/linux/report/linux.sh | 135 +++++++++++++ os/linux/ssh_root_login.sh | 0 4 files changed, 174 insertions(+), 422 deletions(-) @@ -1,5 +1,44 @@ #+title: Linux +* =report/linux.sh= + +#+begin_src shell +./report/linux.sh +#+end_src + +#+begin_src +_ ___ _ _ _ ___ __ ___ ____ ____ _____ ____ ___ ____ _____ +| | |_ _| \ | | | | \ \/ / / _ \/ ___| | _ \| ____| _ \ / _ \| _ \_ _| +| | | || \| | | | |\ / | | | \___ \ | |_) | _| | |_) | | | | |_) || | +| |___ | || |\ | |_| |/ \ | |_| |___) | | _ <| |___| __/| |_| | _ < | | +|_____|___|_| \_|\___//_/\_\ \___/|____/ |_| \_\_____|_| \___/|_| \_\|_| + + + +========================================== +# SECTION 00: Script Info +========================================== +Execution Date and Time: Wed May 7 11:35:52 AM CDT 2025 +Script Name: ./linux.sh +User Running the Script: root (called by: cmc) + + + +========================================== +# SECTION 01: System Info +========================================== +## Hostname +hera +## Kernel Version +6.14.4-400.asahi.fc42.aarch64+16k +## os-release +NAME="Fedora Linux Asahi Remix" +VERSION="42 (Forty Two [Adams])" +RELEASE_TYPE=stable +ID=fedora-asahi-remix +ID_LIKE=fedora +#+end_src + * =ssh_root_login.sh= #+begin_src shell @@ -22,426 +61,4 @@ Checking /etc/pam.d/system-auth for password parameters... /etc/pam.d/system-auth file not found. Analyzing /etc/login.defs... Contents of /etc/login.defs: -# -# /etc/login.defs - Configuration control definitions for the login package. -# -# Three items must be defined: MAIL_DIR, ENV_SUPATH, and ENV_PATH. -# If unspecified, some arbitrary (and possibly incorrect) value will -# be assumed. All other items are optional - if not specified then -# the described action or option will be inhibited. -# -# Comment lines (lines beginning with "#") and blank lines are ignored. -# -# Modified for Linux. --marekm - -# REQUIRED for useradd/userdel/usermod -# Directory where mailboxes reside, _or_ name of file, relative to the -# home directory. If you _do_ define MAIL_DIR and MAIL_FILE, -# MAIL_DIR takes precedence. -# -# Essentially: -# - MAIL_DIR defines the location of users mail spool files -# (for mbox use) by appending the username to MAIL_DIR as defined -# below. -# - MAIL_FILE defines the location of the users mail spool files as the -# fully-qualified filename obtained by prepending the user home -# directory before $MAIL_FILE -# -# NOTE: This is no more used for setting up users MAIL environment variable -# which is, starting from shadow 4.0.12-1 in Debian, entirely the -# job of the pam_mail PAM modules -# See default PAM configuration files provided for -# login, su, etc. -# -# This is a temporary situation: setting these variables will soon -# move to /etc/default/useradd and the variables will then be -# no more supported -MAIL_DIR /var/mail -#MAIL_FILE .mail - -# -# Enable logging and display of /var/log/faillog login failure info. -# This option conflicts with the pam_tally PAM module. -# -FAILLOG_ENAB yes - -# -# Enable display of unknown usernames when login failures are recorded. -# -# WARNING: Unknown usernames may become world readable. -# See #290803 and #298773 for details about how this could become a security -# concern -LOG_UNKFAIL_ENAB no - -# -# Enable logging of successful logins -# -LOG_OK_LOGINS no - -# -# Enable "syslog" logging of su activity - in addition to sulog file logging. -# SYSLOG_SG_ENAB does the same for newgrp and sg. -# -SYSLOG_SU_ENAB yes -SYSLOG_SG_ENAB yes - -# -# If defined, all su activity is logged to this file. -# -#SULOG_FILE /var/log/sulog - -# -# If defined, file which maps tty line to TERM environment parameter. -# Each line of the file is in a format something like "vt100 tty01". -# -#TTYTYPE_FILE /etc/ttytype - -# -# If defined, login failures will be logged here in a utmp format -# last, when invoked as lastb, will read /var/log/btmp, so... -# -FTMP_FILE /var/log/btmp - -# -# If defined, the command name to display when running "su -". For -# example, if this is defined as "su" then a "ps" will display the -# command is "-su". If not defined, then "ps" would display the -# name of the shell actually being run, e.g. something like "-sh". -# -SU_NAME su - -# -# If defined, file which inhibits all the usual chatter during the login -# sequence. If a full pathname, then hushed mode will be enabled if the -# user's name or shell are found in the file. If not a full pathname, then -# hushed mode will be enabled if the file exists in the user's home directory. -# -HUSHLOGIN_FILE .hushlogin -#HUSHLOGIN_FILE /etc/hushlogins - -# -# *REQUIRED* The default PATH settings, for superuser and normal users. -# -# (they are minimal, add the rest in the shell startup files) -ENV_SUPATH PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin -ENV_PATH PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games - -# -# Terminal permissions -# -# TTYGROUP Login tty will be assigned this group ownership. -# TTYPERM Login tty will be set to this permission. -# -# If you have a "write" program which is "setgid" to a special group -# which owns the terminals, define TTYGROUP to the group number and -# TTYPERM to 0620. Otherwise leave TTYGROUP commented out and assign -# TTYPERM to either 622 or 600. -# -# In Debian /usr/bin/bsd-write or similar programs are setgid tty -# However, the default and recommended value for TTYPERM is still 0600 -# to not allow anyone to write to anyone else console or terminal - -# Users can still allow other people to write them by issuing -# the "mesg y" command. - -TTYGROUP tty -TTYPERM 0600 - -# -# Login configuration initializations: -# -# ERASECHAR Terminal ERASE character ('\010' = backspace). -# KILLCHAR Terminal KILL character ('\025' = CTRL/U). -# UMASK Default "umask" value. -# -# The ERASECHAR and KILLCHAR are used only on System V machines. -# -# UMASK is the default umask value for pam_umask and is used by -# useradd and newusers to set the mode of the new home directories. -# 022 is the "historical" value in Debian for UMASK -# 027, or even 077, could be considered better for privacy -# There is no One True Answer here : each sysadmin must make up his/her -# mind. -# -# If USERGROUPS_ENAB is set to "yes", that will modify this UMASK default value -# for private user groups, i. e. the uid is the same as gid, and username is -# the same as the primary group name: for these, the user permissions will be -# used as group permissions, e. g. 022 will become 002. -# -# Prefix these values with "0" to get octal, "0x" to get hexadecimal. -# -ERASECHAR 0177 -KILLCHAR 025 -UMASK 022 - -# HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new -# home directories. -# If HOME_MODE is not set, the value of UMASK is used to create the mode. -HOME_MODE 0750 - -# -# Password aging controls: -# -# PASS_MAX_DAYS Maximum number of days a password may be used. -# PASS_MIN_DAYS Minimum number of days allowed between password changes. -# PASS_WARN_AGE Number of days warning given before a password expires. -# -PASS_MAX_DAYS 99999 -PASS_MIN_DAYS 0 -PASS_WARN_AGE 7 - -# -# Min/max values for automatic uid selection in useradd -# -UID_MIN 1000 -UID_MAX 60000 -# System accounts -#SYS_UID_MIN 100 -#SYS_UID_MAX 999 -# Extra per user uids -SUB_UID_MIN 100000 -SUB_UID_MAX 600100000 -SUB_UID_COUNT 65536 - -# -# Min/max values for automatic gid selection in groupadd -# -GID_MIN 1000 -GID_MAX 60000 -# System accounts -#SYS_GID_MIN 100 -#SYS_GID_MAX 999 -# Extra per user group ids -SUB_GID_MIN 100000 -SUB_GID_MAX 600100000 -SUB_GID_COUNT 65536 - -# -# Max number of login retries if password is bad. This will most likely be -# overriden by PAM, since the default pam_unix module has it's own built -# in of 3 retries. However, this is a safe fallback in case you are using -# an authentication module that does not enforce PAM_MAXTRIES. -# -LOGIN_RETRIES 5 - -# -# Max time in seconds for login -# -LOGIN_TIMEOUT 60 - -# -# Which fields may be changed by regular users using chfn - use -# any combination of letters "frwh" (full name, room number, work -# phone, home phone). If not defined, no changes are allowed. -# For backward compatibility, "yes" = "rwh" and "no" = "frwh". -# -CHFN_RESTRICT rwh - -# -# Should login be allowed if we can't cd to the home directory? -# Default is no. -# -DEFAULT_HOME yes - -# -# If defined, this command is run when removing a user. -# It should remove any at/cron/print jobs etc. owned by -# the user to be removed (passed as the first argument). -# -#USERDEL_CMD /usr/sbin/userdel_local - -# -# Enable setting of the umask group bits to be the same as owner bits -# (examples: 022 -> 002, 077 -> 007) for non-root users, if the uid is -# the same as gid, and username is the same as the primary group name. -# -# If set to yes, userdel will remove the user's group if it contains no -# more members, and useradd will create by default a group with the name -# of the user. -# -USERGROUPS_ENAB yes - -# -# Instead of the real user shell, the program specified by this parameter -# will be launched, although its visible name (argv[0]) will be the shell's. -# The program may do whatever it wants (logging, additional authentification, -# banner, ...) before running the actual shell. -# -# FAKE_SHELL /bin/fakeshell - -# -# If defined, either full pathname of a file containing device names or -# a ":" delimited list of device names. Root logins will be allowed only -# upon these devices. -# -# This variable is used by login and su. -# -#CONSOLE /etc/consoles -#CONSOLE console:tty01:tty02:tty03:tty04 - -# -# List of groups to add to the user's supplementary group set -# when logging in on the console (as determined by the CONSOLE -# setting). Default is none. -# -# Use with caution - it is possible for users to gain permanent -# access to these groups, even when not logged in on the console. -# How to do it is left as an exercise for the reader... -# -# This variable is used by login and su. -# -#CONSOLE_GROUPS floppy:audio:cdrom - -# -# If set to "yes", new passwords will be encrypted using the MD5-based -# algorithm compatible with the one used by recent releases of FreeBSD. -# It supports passwords of unlimited length and longer salt strings. -# Set to "no" if you need to copy encrypted passwords to other systems -# which don't understand the new algorithm. Default is "no". -# -# This variable is deprecated. You should use ENCRYPT_METHOD. -# -#MD5_CRYPT_ENAB no - -# -# If set to MD5, MD5-based algorithm will be used for encrypting password -# If set to SHA256, SHA256-based algorithm will be used for encrypting password -# If set to SHA512, SHA512-based algorithm will be used for encrypting password -# If set to BCRYPT, BCRYPT-based algorithm will be used for encrypting password -# If set to YESCRYPT, YESCRYPT-based algorithm will be used for encrypting password -# If set to DES, DES-based algorithm will be used for encrypting password (default) -# MD5 and DES should not be used for new hashes, see crypt(5) for recommendations. -# Overrides the MD5_CRYPT_ENAB option -# -# Note: It is recommended to use a value consistent with -# the PAM modules configuration. -# -ENCRYPT_METHOD SHA512 - -# -# Only works if ENCRYPT_METHOD is set to SHA256 or SHA512. -# -# Define the number of SHA rounds. -# With a lot of rounds, it is more difficult to brute-force the password. -# However, more CPU resources will be needed to authenticate users if -# this value is increased. -# -# If not specified, the libc will choose the default number of rounds (5000), -# which is orders of magnitude too low for modern hardware. -# The values must be within the 1000-999999999 range. -# If only one of the MIN or MAX values is set, then this value will be used. -# If MIN > MAX, the highest value will be used. -# -#SHA_CRYPT_MIN_ROUNDS 5000 -#SHA_CRYPT_MAX_ROUNDS 5000 - -# -# Only works if ENCRYPT_METHOD is set to YESCRYPT. -# -# Define the YESCRYPT cost factor. -# With a higher cost factor, it is more difficult to brute-force the password. -# However, more CPU time and more memory will be needed to authenticate users -# if this value is increased. -# -# If not specified, a cost factor of 5 will be used. -# The value must be within the 1-11 range. -# -#YESCRYPT_COST_FACTOR 5 - -# -# The pwck(8) utility emits a warning for any system account with a home -# directory that does not exist. Some system accounts intentionally do -# not have a home directory. Such accounts may have this string as -# their home directory in /etc/passwd to avoid a spurious warning. -# -NONEXISTENT /nonexistent - -# -# Allow newuidmap and newgidmap when running under an alternative -# primary group. -# -#GRANT_AUX_GROUP_SUBIDS yes - -# -# Select the HMAC cryptography algorithm. -# Used in pam_timestamp module to calculate the keyed-hash message -# authentication code. -# -# Note: It is recommended to check hmac(3) to see the possible algorithms -# that are available in your system. -# -#HMAC_CRYPTO_ALGO SHA512 - -################# OBSOLETED BY PAM ############## -# # -# These options are now handled by PAM. Please # -# edit the appropriate file in /etc/pam.d/ to # -# enable the equivelants of them. -# -############### - -#MOTD_FILE -#DIALUPS_CHECK_ENAB -#LASTLOG_ENAB -#MAIL_CHECK_ENAB -#OBSCURE_CHECKS_ENAB -#PORTTIME_CHECKS_ENAB -#SU_WHEEL_ONLY -#CRACKLIB_DICTPATH -#PASS_CHANGE_TRIES -#PASS_ALWAYS_WARN -#ENVIRON_FILE -#NOLOGINS_FILE -#ISSUE_FILE -#PASS_MIN_LEN -#PASS_MAX_LEN -#ULIMIT -#ENV_HZ -#CHFN_AUTH -#CHSH_AUTH -#FAIL_DELAY - -################# OBSOLETED ####################### -# # -# These options are no more handled by shadow. # -# # -# Shadow utilities will display a warning if they # -# still appear. # -# # -################################################### - -# CLOSE_SESSIONS -# LOGIN_STRING -# NO_PASSWORD_CONSOLE -# QMAIL_DIR - - - - -Login restrictions and parameters in /etc/login.defs: -# PASS_MAX_DAYS Maximum number of days a password may be used. -# PASS_MIN_DAYS Minimum number of days allowed between password changes. -# PASS_WARN_AGE Number of days warning given before a password expires. -PASS_MAX_DAYS 99999 -PASS_MIN_DAYS 0 -PASS_WARN_AGE 7 -UID_MIN 1000 -UID_MAX 60000 -#SYS_UID_MIN 100 -#SYS_UID_MAX 999 -SUB_UID_MIN 100000 -SUB_UID_MAX 600100000 -SUB_UID_COUNT 65536 -GID_MIN 1000 -GID_MAX 60000 -#SYS_GID_MIN 100 -#SYS_GID_MAX 999 -SUB_GID_MIN 100000 -SUB_GID_MAX 600100000 -SUB_GID_COUNT 65536 -LOGIN_RETRIES 5 -LOGIN_TIMEOUT 60 -#PASS_MIN_LEN - -Analysis complete. #+end_src old mode 100644 new mode 100755 new file mode 100755 @@ -0,0 +1,135 @@ +#!/bin/bash + +# Default report file +REPORT_FILE="report.txt" +TRIM_COMMENTS=false + +# Function to log section header +log_section() { + echo -e "\n\n" >> "$REPORT_FILE" + echo "==========================================" >> "$REPORT_FILE" + echo "# SECTION $1: $2" >> "$REPORT_FILE" + echo "==========================================" >> "$REPORT_FILE" +} + +# Function to log file content +log_file_content() { + FILE_PATH="$1" + FILE_NAME=$(basename "$FILE_PATH") + echo "## $FILE_NAME" >> "$REPORT_FILE" + if [[ -f $FILE_PATH ]]; then + if $TRIM_COMMENTS; then + # Trim comments (lines starting with # or empty lines) + grep -vE '^\s*#|^\s*$' "$FILE_PATH" >> "$REPORT_FILE" + else + cat "$FILE_PATH" >> "$REPORT_FILE" + fi + else + echo "File $FILE_PATH not found!" >> "$REPORT_FILE" + fi +} + +# Function to log command output +log_command_output() { + echo "## $1" >> "$REPORT_FILE" + $2 >> "$REPORT_FILE" 2>&1 +} + +# Check for sudo privileges +if [[ $EUID -ne 0 ]]; then + echo "This script requires sudo privileges. Please enter your password." + exec sudo "$0" "$@" +fi + +# Parse command-line arguments +while getopts "t" opt; do + case $opt in + t) + TRIM_COMMENTS=true + REPORT_FILE="report_trimmed.txt" + ;; + *) + echo "Usage: $0 [-t] # Use -t to trim comments from files" + exit 1 + ;; + esac +done + +# Initialize report file +> "$REPORT_FILE" # Clear the file if it exists + +# ASCII Header +cat << "EOF" >> "$REPORT_FILE" + _ ___ _ _ _ ___ __ ___ ____ ____ _____ ____ ___ ____ _____ + | | |_ _| \ | | | | \ \/ / / _ \/ ___| | _ \| ____| _ \ / _ \| _ \_ _| + | | | || \| | | | |\ / | | | \___ \ | |_) | _| | |_) | | | | |_) || | + | |___ | || |\ | |_| |/ \ | |_| |___) | | _ <| |___| __/| |_| | _ < | | + |_____|___|_| \_|\___//_/\_\ \___/|____/ |_| \_\_____|_| \___/|_| \_\|_| +EOF + +# Log Script Info +log_section "00" "Script Info" +echo "Execution Date and Time: $(date)" >> "$REPORT_FILE" +echo "Script Name: $0" >> "$REPORT_FILE" + +if [[ $(whoami) == "root" ]]; then + echo "User Running the Script: root (called by: $SUDO_USER)" >> "$REPORT_FILE" +else + echo "User Running the Script: $(whoami)" >> "$REPORT_FILE" +fi + +# Log System Info +log_section "01" "System Info" +log_command_output "Hostname" "hostname" +log_command_output "Kernel Version" "uname -r" +log_file_content "/etc/os-release" +log_command_output "IP Address" "hostname -I" + +# Log Password Parameters +log_section "02" "Password Parameters" +log_file_content "/etc/pam.d/system-auth" +log_file_content "/etc/login.defs" + +# Log Users +log_section "03" "Users" +log_file_content "/etc/passwd" +log_file_content "/etc/group" + +# Log Admins +log_section "04" "Admins" +log_file_content "/etc/sudoers" +log_command_output "Sudo Group" "getent group sudo" +log_command_output "Wheel Group" "getent group wheel" +log_command_output "Root User" "getent passwd 0" + +# Log SSH Configuration +log_section "05" "SSH Configuration" +log_file_content "/etc/ssh/sshd_config" + +# Log Logging Configuration +log_section "06" "Logging Configuration" +log_file_content "/etc/syslog.conf" +log_file_content "/etc/logrotate.conf" + +# Log Jobs +log_section "07" "Jobs" +log_command_output "Sudo Crontab" "sudo crontab -l" +log_file_content "/etc/cron.allow" + +# Log Security Status +log_section "08" "Security Status" +log_command_output "SELinux Status" "sestatus" +log_command_output "AppArmor Status" "aa-status" + +# Log Firewall Rules +log_section "09" "Firewall Rules" +log_command_output "Iptables Rules" "sudo iptables -L" + +# Log Open Ports +log_section "10" "Open Ports" +log_command_output "Netstat" "netstat -tuln" + +# Set report ownership +if [[ $(whoami) == "root" ]]; then + chown "$SUDO_USER" "$REPORT_FILE" +fi old mode 100644 new mode 100755