-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathaudit.sh
155 lines (138 loc) · 3.78 KB
/
audit.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
#!/bin/bash
echo
echo -e "\e[1;95m-------------------------[users and groups audit in progress]-------------------------"
signature=$(grep -cP '^PASS_MAX_DAYS\s+90$' /etc/login.defs)
if [ $signature -eq 0 ];
then
status="\e[91m[ BAD ]"
#exit
else
status="\e[92m[ GOOD ]"
fi
echo -e "\e[39m[*] Checking Maximum number of days of password usage\t\t\t\t\t$status"
signature=$(grep -cP '^PASS_MIN_DAYS\s+5$' /etc/login.defs)
if [ $signature -eq 0 ];
then
status="\e[91m[ BAD ]"
#exit
else
status="\e[92m[ GOOD ]"
fi
echo -e "\e[39m[*] Checking Minimum number of days between password changes\t\t\t\t$status"
signature=$(grep -cP '^PASS_WARN_AGE\s+10$' /etc/login.defs)
if [ $signature -eq 0 ];
then
status="\e[91m[ BAD ]"
#exit
else
status="\e[92m[ GOOD ]"
fi
echo -e "\e[39m[*] Checking Number of days warning before password expiration\t\t\t\t$status"
signature=$(useradd -D | grep -cP '^INACTIVE=30$')
if [ $signature -eq 0 ];
then
status="\e[91m[ BAD ]"
#exit
else
status="\e[92m[ GOOD ]"
fi
echo -e "\e[39m[*] Checking users locking after inactivity\t\t\t\t\t\t$status"
signature=$(id -gn root| grep -cP '^root$')
if [ $signature -eq 0 ];
then
status="\e[91m[ BAD ]"
#exit
else
status="\e[92m[ GOOD ]"
fi
echo -e "\e[39m[*] Checking root primary group\t\t\t\t\t\t\t\t$status"
installed=$(dpkg-query -W -f='${Status}' libpam-cracklib 2>/dev/null | grep -c "ok installed")
if [ $installed -eq 0 ];
then
status="\e[91m[ BAD ]"
#exit
else
status="\e[92m[ GOOD ]"
fi
echo -e "\e[39m[*] Checking libpam-cracklib installation\t\t\t\t\t\t$status"
signature=$(grep -cP '.*minlen=14.*' /etc/pam.d/common-password)
if [ $signature -eq 0 ];
then
status="\e[91m[ BAD ]"
#exit
else
status="\e[92m[ GOOD ]"
fi
echo -e "\e[39m[*] Checking minimum password length\t\t\t\t\t\t\t$status"
signature=$(grep -cP '.*reject_username.*' /etc/pam.d/common-password)
if [ $signature -eq 0 ];
then
status="\e[91m[ BAD ]"
#exit
else
status="\e[92m[ GOOD ]"
fi
echo -e "\e[39m[*] Checking if username in password is allowed\t\t\t\t\t\t$status"
signature=$(grep -cP '.*minclass=4.*' /etc/pam.d/common-password)
if [ $signature -eq 0 ];
then
status="\e[91m[ BAD ]"
#exit
else
status="\e[92m[ GOOD ]"
fi
signature=$(grep -cP '.*dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1.*' /etc/pam.d/common-password)
if [ $signature -eq 0 ];
then
status="\e[91m[ BAD ]"
#exit
else
status="\e[92m[ GOOD ]"
fi
echo -e "\e[39m[*] Checking if Password complexity class\t\t\t\t\t\t$status"
signature=$(grep -cP '.*maxrepeat=2.*' /etc/pam.d/common-password)
if [ $signature -eq 0 ];
then
status="\e[91m[ BAD ]"
#exit
else
status="\e[92m[ GOOD ]"
fi
echo -e "\e[39m[*] Checking if passwords with 2 same consecutive characters are rejected\t\t$status"
signature=$(grep -cP '.*remember=24.*' /etc/pam.d/common-password)
if [ $signature -eq 0 ];
then
status="\e[91m[ BAD ]"
#exit
else
status="\e[92m[ GOOD ]"
fi
echo -e "\e[39m[*] Checking last 24 passwords is enabled\t\t\t\t\t\t$status"
signature=$(grep -cP '.*auth required pam_tally2\.so onerr=fail audit silent deny=5 unlock_time=1200.*' /etc/pam.d/login)
if [ $signature -eq 0 ];
then
status="\e[91m[ BAD ]"
#exit
else
status="\e[92m[ GOOD ]"
fi
echo -e "\e[39m[*] Checking if accounts locked out after unsuccessful login attempts\t\t\t$status"
signature=$(grep -cP '^-:wheel:ALL EXCEPT LOCAL.*' /etc/security/access.conf)
if [ $signature -eq 0 ];
then
status="\e[91m[ BAD ]"
#exit
else
status="\e[92m[ GOOD ]"
fi
echo -e "\e[39m[*] Checking if non-local logins to privileged accounts are not allowed\t\t\t$status"
signature=$(grep -cP '.*delay=10000000.*' /etc/pam.d/login)
if [ $signature -eq 0 ];
then
status="\e[91m[ BAD ]"
#exit
else
status="\e[92m[ GOOD ]"
fi
echo -e "\e[39m[*] Checking delay time between login prompts\t\t\t\t\t\t$status"
echo -e "\033[0m"