/usr/share/yasat/plugins/vsftpd.test is in yasat 526-1.
This file is owned by root:root, with mode 0o755.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 | #!/bin/sh
################################################################################
# #
# Copyright (C) 2008-2012 LABBE Corentin <corentin.labbe@geomatys.fr>
#
# YASAT is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# YASAT is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with YASAT. If not, see <http://www.gnu.org/licenses/>.
# #
################################################################################
VSFTPD_CONF="/etc/vsftpd/vsftpd.conf"
POSSIBLE_VSFTPD_CONF="/etc/vsftpd/vsftpd.conf /etc/vsftpd.conf /usr/local/etc/vsftpd/vsftpd.conf"
for LOCATION in ${POSSIBLE_VSFTPD_CONF}
do
if [ -e "${LOCATION}/" ]
then
VSFTPD_CONF="${LOCATION}"
fi
done
Title "Check vsftpd"
if [ ! -e "$VSFTPD_CONF" ]
then
return 1;
fi
#YASAT_TEST_VSFTP1 Check if anonymous access is enabled
FindValueOfEqual $VSFTPD_CONF anonymous_enable JUSTTEST
if [ -z "$RESULTAT" ] ;then
Display --indent 2 --text "anonymous access enabled by default" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_LOGIN
else
echo $RESULTAT | grep -qi 'yes'
if [ $? -eq 1 ] ;then
Display --indent 2 --text "no anonymous access" --result OK --color GREEN
else
Display --indent 2 --text "Anonymous access" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_LOGIN
fi
fi
#YASAT_TEST_VSFTP2 Check if anonymous can upload
FindValueOfEqual $VSFTPD_CONF anon_upload_enable JUSTTEST
if [ -z "$RESULTAT" ] ;then
Display --indent 2 --text "no anon_upload_enable" --result OK --color GREEN
else
echo $RESULTAT | grep -qi 'yes'
if [ $? -eq 1 ] ;then
Display --indent 2 --text "no anon_upload_enable" --result OK --color GREEN
else
Display --indent 2 --text "anon_upload_enable" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_UPLOAD
fi
fi
#YASAT_TEST_VSFTP3 Check if ascii_upload_enable is enabled
FindValueOfEqual $VSFTPD_CONF ascii_upload_enable JUSTTEST
if [ -z "$RESULTAT" ] ;then
Display --indent 2 --text "no ascii_upload_enable" --result OK --color GREEN
else
echo $RESULTAT | grep -qi 'yes'
if [ $? -eq 1 ] ;then
Display --indent 2 --text "no ascii_upload_enable" --result OK --color GREEN
else
Display --indent 2 --text "ascii_upload_enable" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_ASCII
fi
fi
#YASAT_TEST_VSFTP4 Check if ascii_download_enable is enabled
FindValueOfEqual $VSFTPD_CONF ascii_download_enable JUSTTEST
if [ -z "$RESULTAT" ] ;then
Display --indent 2 --text "no ascii_download_enable" --result OK --color GREEN
else
echo $RESULTAT | grep -qi 'yes'
if [ $? -eq 1 ] ;then
Display --indent 2 --text "no ascii_download_enable" --result OK --color GREEN
else
Display --indent 2 --text "ascii_download_enable" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_ASCII
fi
fi
LOGENABLED='NO'
#YASAT_TEST_VSFTP5 Check if xferlog is enabled
FindValueOfEqual $VSFTPD_CONF xferlog_enable JUSTTEST
if [ -z "$RESULTAT" ] ;then
Display --indent 2 --text "No xferlog_enable" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_NO_XFERLOG
else
if [ "$RESULTAT" = "yes" -o "$RESULTAT" = "YES" ] ;then
Display --indent 2 --text "xferlog_enable" --result OK --color GREEN
LOGENABLED='YES'
# else
# Display --indent 2 --text "xferlog_enable not enabled" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_NO_XFERLOG
fi
fi
#YASAT_TEST_VSFTP6 Check if syslog_enable is enabled
FindValueOfEqual $VSFTPD_CONF syslog_enable JUSTTEST
if [ ! -z "$RESULTAT" ] ;then
if [ "$RESULTAT" = "yes" -o "$RESULTAT" = "YES" ] ;then
Display --indent 2 --text "syslog_enable" --result OK --color GREEN
LOGENABLED='YES'
fi
fi
#YASAT_TEST_VSFTP7 Check if any log system is enabled
if [ $LOGENABLED = 'NO' ] ;then
Display --indent 2 --text "No log system" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_NO_XFERLOG
fi
#FindValueOfEqual $VSFTPD_CONF xferlog_file JUSTTEST
#if [ -z "$RESULTAT" ]
#then
# Display --indent 2 --text "No xferlog_file" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_NO_XFERLOG
#else
# Display --indent 2 --text "xferlog_file" --result "$RESULTAT" --color GREEN
#fi
#FindValueOfEqual $VSFTPD_CONF vsftpd_log_file JUSTTEST
#if [ -z "$RESULTAT" ]
#then
# Display --indent 2 --text "No vsftpd_log_file" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_NO_XFERLOG
#else
# Display --indent 2 --text "vsftpd_log_file" --result "$RESULTAT" --color GREEN
#fi
#YASAT_TEST_VSFTP8 Check if local user are chrooted
FindValueOfEqual $VSFTPD_CONF chroot_local_user JUSTTEST
if [ -z "$RESULTAT" ] ;then
Display --indent 2 --text "no chroot_local_user" --result WARNING --color ORANGE --advice VSFTPD_ANONYMOUS_NOCHROOTLOCAL
else
if [ "$RESULTAT" = "yes" -o "$RESULTAT" = "YES" ] ;then
Display --indent 2 --text "chroot_local_user" --result OK --color GREEN
else
Display --indent 2 --text "No chroot_local_user" --result WARNING --color RED --advice VSFTPD_ANONYMOUS_NOCHROOTLOCAL
fi
fi
#YASAT_TEST_VSFTP9 Check if a banner_file is present
FindValueOfEqual $VSFTPD_CONF banner_file JUSTTEST
if [ ! -z "$RESULTAT" ] ;then
Display --indent 2 --text "banner_file" --result FOUND --color GREEN
check_file "$RESULTAT" 4 'NORMAL'
fi
#YASAT_TEST_VSFTP10 Check if a DSA certificate is used
FindValueOfEqual $VSFTPD_CONF dsa_cert_file JUSTTEST
if [ ! -z "$RESULTAT" ] ;then
Display --indent 2 --text "SSL $RESULTAT" --result FOUND --color GREEN
check_certificate $RESULTAT 4
fi
#YASAT_TEST_VSFTP11 Check if a DSA private key is used
FindValueOfEqual $VSFTPD_CONF dsa_private_key_file JUSTTEST
if [ ! -z "$RESULTAT" ] ;then
Display --indent 2 --text "SSL $RESULTAT" --result FOUND --color GREEN
check_file $RESULTAT 4 PRIVKEY
fi
#YASAT_TEST_VSFTP12 Check if a RSA certificate is used
FindValueOfEqual $VSFTPD_CONF rsa_cert_file JUSTTEST
if [ ! -z "$RESULTAT" ] ;then
Display --indent 2 --text "SSL $RESULTAT" --result FOUND --color GREEN
check_certificate $RESULTAT 4
fi
#YASAT_TEST_VSFTP13 Check if a RSA private key is used
FindValueOfEqual $VSFTPD_CONF rsa_private_key_file JUSTTEST
if [ ! -z "$RESULTAT" ] ;then
Display --indent 2 --text "SSL $RESULTAT" --result FOUND --color GREEN
check_file "$RESULTAT" 4 PRIVKEY
fi
#TODO check all files
#TODO ssl_sslv2 must be no or non present
#TODO enable_ssl
#TODO force_local_logins_ssl
#TODO force_local_data_ssl
#TODO ssl_ciphers default is good
return 0;
|