mcss

#!/bin/bash

# MCSS Fedora Version 1.1

#####
#
# This script checks for MCSS compliance on Fedora systems.  This was created
# by CSE staff and running it unmodified is required in order to access the
# CSE network.
#
#####

# Set ROOT to the MCSS software installation path.
ROOT=/root/mcss

# Set SERVER to 1 if this is running on a server.  If running on a server,
# the following actions are not executed automatically:
#
# - The notify() function does not run.
# - The system won't be shutdown for a failure for any reason.
#
# It is expected that servers will be monitored more closely or they will
# not be in a position where non-staff administrators can configure them
# in a way that will result in an MCSS compliance failure.
SERVER=0

# Set DAYS to the number of days a failure can exist.  If a failure exists
# for more than DAYS days in a row, the system will shutdown on each
# invocation of this script.
DAYS=7

# The location of the log file.
LOG=/var/log/mcss.log

#####
#
# Shell functions.
#
# For check functions returning 0 means a check passed, returning 1 means a
# check failed, and returning 2 means a recovery action was taken for a check
# and the check should be called again for status.  Recovery action functions
# use their own check to see if they've been called once already.  If they
# have, they return 1, otherwise they return 0.  This keeps the code from
# looping over and over in the event a recovery action function doesn't
# actually work.  In addition, a recovery action can return 1 if the action
# they try actually fails, which should logically result in the same thing
# as the recovery action being run more than once.  In general, the check
# functions should do the recoverable checks first, then the checks that
# could simply result in returning 1 last.
#
#####

firewall_default() {
    # These are default firewall rules to load in the event the firewall
    # rules are missing when the check is done.  This way we can avoid
    # depending on a specific firewall package init.d script being loaded
    # or a totally open firewall rules definition for such a package.  There
    # needs to be some firewall rules enabled.  These are fallback defaults.
    if [ -z "$FIREWALL_DEFAULT" ]; then
        if [ -f /etc/pf.conf ]; then
            mv /etc/pf.conf /etc/pf.conf.bak
        fi
        cp $ROOT/pf/pf.conf /etc/pf.conf
        pfctl -nf /etc/pf.conf
        /usr/sbin/service pf restart
        return 0
    else
        echo "Firewall: firewall_default was already tried." >>$LOG
        return 1
    fi
}

check_firewall() {
    # Check for rules, not comments!
    local count=`pfctl -s rules | grep -v "^#" | wc -l | xargs`

    if [ $count -eq 0 ]; then
        echo "Firewall: There are no pf rules defined." >>$LOG
        echo "Firewall: Running firewall_default fix." >>$LOG
        firewall_default

        if [ $? -eq 0 ]; then
            return 2
        else
            return 1
        fi
    fi

    return 0
}

check_software() {
    # https://www.freebsd.org/doc/handbook/updating-upgrading-freebsdupdate.html
    # The default configuration file for freebsd-update works as-is.
    if command -v freebsd-update &>/dev/null; then
        freebsd-update fetch > /tmp/check-update.$$
        local raw_num=`sed -n -e '/following files will be updated/,$p' /tmp/check-update.$$ | wc -l`
    elif command -v pfSense-upgrade &>/dev/null; then
        pfSense-upgrade -n > /tmp/check-update.$$
        local raw_num=`grep 'Number of packages to be upgraded:' /tmp/check-update.$$ | cut -d ':' -f 2 | xargs`
    fi
    local num=`echo " $raw_num - 1" | bc`
    rm -f /tmp/check-update.$$

    if [ $num -gt 0 ]; then
        echo "Software: Software is not up-to-date:" >>$LOG
        echo "Software: Number of update packages: $num" >>$LOG
        return 1
    fi

    return 0
}

malware_schedule() {
    # Add the anti-malware script into root's crontab.
    if [ -z "$MALWARE_SCHEDULE" ]; then
        MALWARE_SCHEDULE=1
        crontab -u root -l >/tmp/malware-cron.$$
        echo "30 04 * * *               $ROOT/anti-malware" >>/tmp/malware-cron.$$
        crontab -u root /tmp/malware-cron.$$
        rm -f /tmp/malware-cron.$$
        return 0
    else
        echo "Malware: malware_schedule was already tried." >>$LOG
        return 1
    fi
}

malware_updates() {
    # Make sure freshclam updates are enabled.
    if [ -z "$MALWARE_UPDATES" ]; then
        MALWARE_UPDATES=1
        cat <<EOF >/etc/cron.d/clamav-update
## Adjust this line...
MAILTO=root,localhost

## It is ok to execute it as root; freshclam drops privileges and becomes
## user 'clamav' as soon as possible
0  */3 * * * root /usr/local/bin/freshclam
EOF

        chmod 600 /etc/cron.d/clamav-update
        return 0
    else
        echo "Malware: malware_updates was already tried." >>$LOG
        return 1
    fi
}

check_malware() {
    # Check to make sure the anti-malware script is in root's crontab.
    if ! crontab -u root -l 2>/dev/null |grep -v '#' |grep anti-malware &>/dev/null; then
        echo "Malware: The anti-malware cron job is not scheduled." >>$LOG
        echo "Malware: Running malware_schedule fix." >>$LOG
        malware_schedule

        if [ $? -eq 0 ]; then
            return 2
        else
            return 1
        fi
    fi

    # Check that automatic updates are enabled.
    if [ ! -f /etc/cron.d/clamav-update ] || ! grep '^0  \*/3 \* \* \* root /usr/local/bin/freshclam$' /etc/cron.d/clamav-update &>/dev/null; then
        echo "Malware: Freshclam updates not enabled or misconfigured." >>$LOG
        echo "Malware: Running malware_updates fix." >>$LOG
        malware_updates

        if [ $? -eq 0 ]; then
            return 2
        else
            return 1
        fi
    fi

    pkg info clamav &>/dev/null

    if [ $? -ne 0 ]; then
        echo "Malware: ClamAV package not installed." >>$LOG
        return 1
    fi

    return 0
}

authentication_pam_conf() {
    # There should be no /etc/pam.conf file on BSD systems.
    if [ -z "$AUTHENTICATION_PAM_CONF" ];then
        AUTHENTICATION_PAM_CONF=1
        rm -f /etc/pam.conf
        return 0
    else
        echo "Authentication: authentication_pam_conf was already tried." >>$LOG
        return 1
    fi
}

authentication_pam_d_passwd() {
    # Set /etc/pam.d/passwd to its default secure settings.
    if [ -z "$AUTHENTICATION_PAM_D_PASSWD" ]; then
        AUTHENTICATION_PAM_D_PASSWD=1
        cp $ROOT/pam.d/passwd /etc/pam.d/passwd
        chmod 644 /etc/pam.d/passwd
        return 0
    else
        echo "Authentication: authentication_pam_d_passwd was already tried." >>$LOG
        return 1
    fi
}

authentication_pam_d_system() {
    # Set /etc/pam.d/system-auth-ac to its default secure settings.
    if [ -z "$AUTHENTICATION_PAM_D_SYSTEM_AUTH_AC" ]; then
        AUTHENTICATION_PAM_D_SYSTEM_AUTH_AC=1
        cp $ROOT/pam.d/system /etc/pam.d/system
        chmod 644 /etc/pam.d/system
        return 0
    else
        echo "Authentication: authentication_pam_d_system_auth_ac was already tried." >>$LOG
        return 1
    fi
}

authentication_passwd() {
    # Fix any unencrypted /etc/passwd account settings.  This handles NIS
    # compat settings.
    if [ -z "$AUTHENTICATION_PASSWD" ]; then
        AUTHENTICATION_PASSWD=1
        sed -i.bak 's/^\([a-zA-Z0-9\_]\{1,\}[-a-zA-Z0-9\_]\{1,\}\):\*:/\1:x:/' /etc/passwd 2>/dev/null

        if [ $? -eq 0 ]; then
            return 0
        else
            echo "Authentication: authentication_passwd failed." >>$LOG
            return 1
        fi
    else
        echo "Authentication: authentication_passwd was already tried." >>$LOG
        return 1
    fi
}

authentication_master() {
    # Fix any unencrypted /etc/master.passwd account settings.  Here I am choosing
    # the '!!' value.  If this breaks something, then don't mess with
    # /etc/master.passwd by hand (using `vipw`.  This handles NIS compat settings.
    #
    # Keep in mind that any account without a password will have '*' specified, and
    # any encrypted password would start with a `$`.
    if [ -z "$AUTHENTICATION_MASTER" ]; then
	AUTHENTICATION_MASTER=1
	sed -i 's/^\([a-zA-Z0-9]\{1,\}[-a-zA-Z0-9]\{1,\}\)::/\1:!!:/' /etc/master.passwd 2>/dev/null

	if [ $? -eq 0 ]; then
	    return 0
	else
	    echo "Authentication: authentication_master failed." >>$LOG
	    return 1
	fi
    else
	echo "Authentication: authentication_master was already tried." >>$LOG
	return 1
    fi
}

check_authentication() {

    # Make sure /etc/pam.conf does not exist.
    if [ -f /etc/pam.conf ]; then
        echo "Authentication: Found a pam.conf file." >>$LOG
        echo "Authentication: Running authentication_pam_conf fix." >>$LOG
        authentication_pam_conf

        if [ $? -eq 0 ]; then
            return 2
        else
            return 1
        fi
    fi

    # Make sure /etc/pam.d/passwd is configured correctly. We check here for at least one password facility.
    count=`grep -v '^#\|^$' /etc/pam.d/passwd | grep '^password' | wc -l`

    if [ "${count}" -eq 0 ]; then
        echo "Authentication: Found a misconfigured or missing pam.d/passwd file." >>$LOG
        echo "Authentication: Running authentication_pam_d_passwd fix." >>$LOG
        authentication_pam_d_passwd

        if [ $? -eq 0 ]; then
            return 2
        else
            return 1
        fi
    fi

    # Make sure /etc/pam.d/system-auth-ac is configured correctly. Make sure it has at least one of each facility.
    #   - auth
    #   - password
    #   - account
    #   - session
    local auth_count=`grep -v '^#\|^$' /etc/pam.d/system 2>/dev/null | grep '^auth' 2>/dev/null | wc -l`
    local password_count=`grep -v '^#\|^$' /etc/pam.d/system 2>/dev/null | grep '^password' 2>/dev/null | wc -l`
    local account_count=`grep -v '^#\|^$' /etc/pam.d/system 2>/dev/null | grep '^account' 2>/dev/null | wc -l`
    local session_count=`grep -v '^#\|^$' /etc/pam.d/system 2>/dev/null | grep '^session' 2>/dev/null | wc -l`

    if [ "${auth_count}" -eq 0 ] || [ "${password_count}" -eq 0 ] || [ "${account_count}" -eq 0 ] || [ "${session_count}" -eq 0 ]; then
        echo "Authentication: Found a misconfigured or missing pam.d/system-auth-ac file." >>$LOG
        echo "Authentication: Running authentication_pam_d_system_auth_ac fix." >>$LOG
        authentication_pam_d_system

        if [ $? -eq 0 ]; then
            return 2
        else
            return 1
        fi
    fi

    #
    # These two need a test to trigger the functions, because this script loops
    # if they are always called, since a '0' retval turns into a return 2 which
    # loops back to execute that again. Interesting that the script is written
    # to require that the functions _not_ be called in order to succeed.
    #

    # Make sure none of the /etc/passwd entries have '::' for the encrypted
    # password field.  This handles NIS compat settings.
        # Make sure none of the /etc/passwd entries have '::' for the encrypted
    # password field.  This handles NIS compat settings.
    if grep '^[a-zA-Z0-9]{1,}[-a-zA-Z0-9]{1,}::' /etc/passwd &>/dev/null; then
        echo "Authentication: Found unencrypted /etc/passwd entry." >>$LOG
        echo "Authentication: Running authentication_passwd fix." >>$LOG
        authentication_passwd

        if [ $? -eq 0 ]; then
            return 2
        else
            return 1
        fi
    fi

    # Make sure none of the /etc/master.passwd entries have '::' for the encrypted
    # password field.  This handles NIS compat settings.
        # Make sure none of the /etc/shadow entries have '::' for the encrypted
    # password field.  This handles NIS compat settings.
    if grep '^[a-zA-Z0-9]{1,}[-a-zA-Z0-9]{1,}::' /etc/shadow &>/dev/null; then
        echo "Authentication: Found unencrypted /etc/shadow entry." >>$LOG
        echo "Authentication: Running authentication_shadow fix." >>$LOG
        authentication_master

        if [ $? -eq 0 ]; then
            return 2
        else
            return 1
        fi
    fi

    return 0
}

days_left() {
    if [ $SERVER -eq 0 ]; then
        local now=`date +%s`
        local time=`head -1 $ROOT/critical-time`
        echo $(((time - now) / 60 / 60 / 24))
    else
        echo
    fi
}

set_critical() {
    if [ $SERVER -eq 0 ]; then
        if [ ! -f $ROOT/critical-time ]; then
            date -v+7d +%s >$ROOT/critical-time
        fi
    fi
}

remove_critical() {
    if [ $SERVER -eq 0 ]; then
        rm -f $ROOT/critical-time
    fi
}

notify() {
    local days
    local crit_mesg

    if [ $SERVER -eq 0 ]; then
        days=`days_left`
        crit_mesg="The system will be shutdown in $days days if this is not fixed."
        cat >>/etc/bashrc <<EOF
echo -e "MCSS:  The MCSS script check failed.\n\nCheck $LOG.\n\nOnce investigated, remove this message by deleting the this echo line from\n/etc/bashrc (should be near the end).\n\n$crit_mesg\n"
EOF

        cat <<EOF >/tmp/notify-message.$$
The MCSS script check failed.

Check $LOG.

Once investigated, remove this message by deleting the this echo line from
/etc/bashrc (should be near the end).

$crit_mesg

EOF

        wall </tmp/notify-message.$$
        rm -f /tmp/notify-message.$$
    fi
}

remove_notify() {
    if [ $SERVER -eq 0 ]; then
        egrep -v '^echo -e "MCSS:' /etc/bashrc >/tmp/bashrc.$$ 2>/dev/null
        mv /tmp/bashrc.$$ /etc/bashrc
        chmod 644 /etc/bashrc
    fi
}

attempt_shutdown() {
    if [ $SERVER -eq 0 ]; then
        local now=`date +%s`
        local time=`head -1 $ROOT/critical-time`

        if [ $now -ge $time ]; then
            /sbin/shutdown -h +15 "MCSS failure timeout shutdown."
        fi
    fi
}

usage() {
    cat <<EOF

mcss [OPTION]

    Options:

        -i          Run in interactive mode (display output to terminal).
        -h          Display this help message.

EOF
}


#####
#
# Main section.  The basic process here is:
#
# - perform MCSS check
#     - MCSS check function handles error cases on its own if possible:
#         - return 0 if pass
#         - return 1 if fail and could not recover
#         - return 2 if fail and main body should recheck after recovery
#
#####

interactive=0
status=0

if [ $# -gt 1 ]; then
    usage
    exit 0
elif [ "$1" = "-i" ]; then
    LOG=/dev/fd/1
    interactive=1
elif [ -n "$1" ]; then
    usage
    exit 0
fi

DATE=`date`
echo "MCSS Check: $DATE" >>$LOG

# Firewall
check_firewall
ret=$?

while [ $ret -eq 2 ]; do
    check_firewall
    ret=$?
done

if [ $ret -eq 0 ]; then
    echo "Firewall: pass" >>$LOG
elif [ $ret -eq 1 ]; then
    echo "Firewall: fail" >>$LOG
    status=1
else
    echo "Firewall: unknown" >>$LOG
    status=1
fi

# Current OS/Software
check_software
ret=$?

while [ $ret -eq 2 ]; do
    check_software
    ret=$?
done

if [ $ret -eq 0 ]; then
    echo "Software: pass" >>$LOG
elif [ $ret -eq 1 ]; then
    echo "Software: fail" >>$LOG
    status=1
else
    echo "Software: unknown" >>$LOG
    status=1
fi

# Anti-malware
check_malware
ret=$?

while [ $ret -eq 2 ]; do
    check_malware
    ret=$?
done

if [ $ret -eq 0 ]; then
    echo "Malware: pass" >>$LOG
elif [ $ret -eq 1 ]; then
    echo "Malware: fail" >>$LOG
    status=1
else
    echo "Malware: unknown" >>$LOG
    status=1
fi

# Authentication Controls
check_authentication
ret=$?

while [ $ret -eq 2 ]; do
    check_authentication
    ret=$?
done

if [ $ret -eq 0 ]; then
    echo "Authentication: pass" >>$LOG
elif [ $ret -eq 1 ]; then
    echo "Authentication: fail" >>$LOG
    status=1
else
    echo "Authentication: unknown" >>$LOG
    status=1
fi

echo >>$LOG

if [ $interactive -eq 0 ]; then
    if [ $status -eq 1 ]; then
        set_critical
        remove_notify
        notify
        attempt_shutdown
    elif [ $status -eq 0 ]; then
        remove_critical
        remove_notify
    fi
fi

exit $status