This file is indexed.

/usr/share/yasat/plugins/vsftpd.test is in yasat 526-1.

This file is owned by root:root, with mode 0o755.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
#!/bin/sh
################################################################################
#                                                                              #
#   Copyright (C) 2008-2012 LABBE Corentin <corentin.labbe@geomatys.fr>
#
#    YASAT is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation, either version 3 of the License, or
#    (at your option) any later version.
#
#    YASAT is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with YASAT.  If not, see <http://www.gnu.org/licenses/>.
#                                                                              #
################################################################################


VSFTPD_CONF="/etc/vsftpd/vsftpd.conf"
POSSIBLE_VSFTPD_CONF="/etc/vsftpd/vsftpd.conf /etc/vsftpd.conf /usr/local/etc/vsftpd/vsftpd.conf"
for LOCATION in ${POSSIBLE_VSFTPD_CONF}
do
	if [ -e "${LOCATION}/" ]
	then
		VSFTPD_CONF="${LOCATION}"
	fi
done

Title "Check vsftpd"

if [ ! -e "$VSFTPD_CONF" ]
then
	return 1;
fi

#YASAT_TEST_VSFTP1 Check if anonymous access is enabled
FindValueOfEqual $VSFTPD_CONF anonymous_enable JUSTTEST
if [ -z "$RESULTAT" ] ;then
	Display --indent 2 --text "anonymous access enabled by default" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_LOGIN
else
	echo $RESULTAT | grep -qi 'yes'
	if [ $? -eq 1 ] ;then
		Display --indent 2 --text "no anonymous access" --result OK --color GREEN
	else
		Display --indent 2 --text "Anonymous access" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_LOGIN
	fi
fi

#YASAT_TEST_VSFTP2 Check if anonymous can upload
FindValueOfEqual $VSFTPD_CONF anon_upload_enable JUSTTEST
if [ -z "$RESULTAT" ] ;then
	Display --indent 2 --text "no anon_upload_enable" --result OK --color GREEN
else
	echo $RESULTAT | grep -qi 'yes'
	if [ $? -eq 1 ] ;then
		Display --indent 2 --text "no anon_upload_enable" --result OK --color GREEN
	else
		Display --indent 2 --text "anon_upload_enable" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_UPLOAD
	fi
fi

#YASAT_TEST_VSFTP3 Check if ascii_upload_enable is enabled
FindValueOfEqual $VSFTPD_CONF ascii_upload_enable JUSTTEST
if [ -z "$RESULTAT" ] ;then
	Display --indent 2 --text "no ascii_upload_enable" --result OK --color GREEN
else
	echo $RESULTAT | grep -qi 'yes'
	if [ $? -eq 1 ] ;then
		Display --indent 2 --text "no ascii_upload_enable" --result OK --color GREEN
	else
		Display --indent 2 --text "ascii_upload_enable" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_ASCII
	fi
fi

#YASAT_TEST_VSFTP4 Check if ascii_download_enable is enabled
FindValueOfEqual $VSFTPD_CONF ascii_download_enable JUSTTEST
if [ -z "$RESULTAT" ] ;then
	Display --indent 2 --text "no ascii_download_enable" --result OK --color GREEN
else
	echo $RESULTAT | grep -qi 'yes'
	if [ $? -eq 1 ] ;then
		Display --indent 2 --text "no ascii_download_enable" --result OK --color GREEN
	else
		Display --indent 2 --text "ascii_download_enable" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_ASCII
	fi
fi


LOGENABLED='NO'
#YASAT_TEST_VSFTP5 Check if xferlog is enabled
FindValueOfEqual $VSFTPD_CONF xferlog_enable JUSTTEST
if [ -z "$RESULTAT" ] ;then
	Display --indent 2 --text "No xferlog_enable" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_NO_XFERLOG
else
	if [ "$RESULTAT" = "yes" -o "$RESULTAT" = "YES" ] ;then
		Display --indent 2 --text "xferlog_enable" --result OK --color GREEN
		LOGENABLED='YES'
#	else
#		Display --indent 2 --text "xferlog_enable not enabled" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_NO_XFERLOG
	fi
fi

#YASAT_TEST_VSFTP6 Check if syslog_enable is enabled
FindValueOfEqual $VSFTPD_CONF syslog_enable JUSTTEST
if [ ! -z "$RESULTAT" ] ;then
if [ "$RESULTAT" = "yes" -o "$RESULTAT" = "YES" ] ;then
		Display --indent 2 --text "syslog_enable" --result OK --color GREEN
		LOGENABLED='YES'
	fi
fi

#YASAT_TEST_VSFTP7 Check if any log system is enabled
if [ $LOGENABLED = 'NO' ] ;then
	Display --indent 2 --text "No log system" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_NO_XFERLOG
fi

#FindValueOfEqual $VSFTPD_CONF xferlog_file JUSTTEST
#if [ -z "$RESULTAT" ]
#then
#	Display --indent 2 --text "No xferlog_file" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_NO_XFERLOG
#else
#	Display --indent 2 --text "xferlog_file" --result "$RESULTAT" --color GREEN
#fi

#FindValueOfEqual $VSFTPD_CONF vsftpd_log_file JUSTTEST
#if [ -z "$RESULTAT" ]
#then
#	Display --indent 2 --text "No vsftpd_log_file" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_NO_XFERLOG
#else
#	Display --indent 2 --text "vsftpd_log_file" --result "$RESULTAT" --color GREEN
#fi

#YASAT_TEST_VSFTP8 Check if local user are chrooted
FindValueOfEqual $VSFTPD_CONF chroot_local_user JUSTTEST
if [ -z "$RESULTAT" ] ;then
	Display --indent 2 --text "no chroot_local_user" --result WARNING --color ORANGE --advice VSFTPD_ANONYMOUS_NOCHROOTLOCAL
else
	if [ "$RESULTAT" = "yes" -o "$RESULTAT" = "YES" ] ;then
		Display --indent 2 --text "chroot_local_user" --result OK --color GREEN
	else
		Display --indent 2 --text "No chroot_local_user" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_NOCHROOTLOCAL
	fi
fi

#YASAT_TEST_VSFTP9 Check if a banner_file is present
FindValueOfEqual $VSFTPD_CONF banner_file JUSTTEST
if [ ! -z "$RESULTAT" ] ;then
	Display --indent 2 --text "banner_file" --result FOUND	 --color GREEN
	check_file "$RESULTAT" 4 'NORMAL'
fi

#YASAT_TEST_VSFTP10 Check if a DSA certificate is used
FindValueOfEqual $VSFTPD_CONF dsa_cert_file JUSTTEST
if [ ! -z "$RESULTAT" ] ;then
	Display --indent 2 --text "SSL $RESULTAT" --result FOUND --color GREEN
	check_certificate $RESULTAT 4
fi

#YASAT_TEST_VSFTP11 Check if a DSA private key is used
FindValueOfEqual $VSFTPD_CONF dsa_private_key_file JUSTTEST
if [ ! -z "$RESULTAT" ] ;then
	Display --indent 2 --text "SSL $RESULTAT" --result FOUND --color GREEN
	check_file $RESULTAT 4 PRIVKEY
fi

#YASAT_TEST_VSFTP12 Check if a RSA certificate is used
FindValueOfEqual $VSFTPD_CONF rsa_cert_file JUSTTEST
if [ ! -z "$RESULTAT" ] ;then
	Display --indent 2 --text "SSL $RESULTAT" --result FOUND --color GREEN
	check_certificate $RESULTAT 4
fi

#YASAT_TEST_VSFTP13 Check if a RSA private key is used
FindValueOfEqual $VSFTPD_CONF rsa_private_key_file JUSTTEST
if [ ! -z "$RESULTAT" ] ;then
	Display --indent 2 --text "SSL $RESULTAT" --result FOUND --color GREEN
	check_file "$RESULTAT" 4 PRIVKEY
fi

#TODO check all files
#TODO ssl_sslv2 must be no or non present

#TODO enable_ssl
#TODO force_local_logins_ssl
#TODO force_local_data_ssl

#TODO ssl_ciphers default is good


return 0;