#!/bin/sh

#################################################################################
#
#   Lynis
# ------------------
#
# Copyright 2007-2008, Michael Boelen (michael@rootkit.nl), The Netherlands
# Web site: http://www.rootkit.nl
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Category: Boot and services
#
#################################################################################
#
    InsertSection "Boot and services"

    # Test: grub presence

    counttests
    logtext "Test: Checking for presence grub conf file (/boot/grub/grub.conf or /boot/grub/menu.lst)..."
    if [ -f /boot/grub/grub.conf -o -f /boot/grub/menu.lst ]; then
	Display --indent 2 --text "- Checking presence GRUB... " --result "OK" --color GREEN
	if [ -f /boot/grub/grub.conf ]; then GRUBCONFFILE="/boot/grub/grub.conf"; else GRUBCONFFILE="/boot/grub/menu.lst"; fi
	logtext "Found file ${GRUBCONFFILE}, proceeding with tests."
        FIND=`cat ${GRUBCONFFILE} | grep 'password --md5' | grep -v '^#'`
	if [ "${FIND}" = "" ]; then
	    Display --indent 4 --text "- Checking for password protection..." --result WARNING --color RED
	    logtext "Warning: didn't find MD5 hashed password line in GRUB boot file!"
	    logtext "Risk: switching to single user mode due editing current menu items or bypassing them."
	    logtext "Suggestion: run grub-md5-crypt and create a hashed password. After"
	    logtext "that, add a line below the line saying timeout=<value>:"
	    logtext "password --md5 <password hash>"
	    logtext "Do NOT use a plaintext password, since the grub.conf or menu.lst"
	    logtext "file is most likely to be world readable!"
	    logtext "Suggestion: If an unsecured OS like DOS is used, add 'lock' below that entry and"
	    logtext "setup a password with the password option, to prevent direct system"
	    logtext "access."
	  else
	    Display --indent 4 --text "- Checking for password protection..." --result OK --color GREEN
	    logtext "GRUB has password protection."
	fi
      else
	Display --indent 2 --text "- Checking presence GRUB... " --result "NOT FOUND" --color WHITE
	logtext "Result: no GRUB configuration file found."
    fi

    logtextbreak

#
#################################################################################
#

    # Test: lilo presence

    counttests
    logtext "Test: checking for presence LILO configuration file..."
    if [ -f /etc/lilo.conf ]; then
	Display --indent 2 --text "- Checking presence LILO... " --result "OK" --color GREEN
	logtext "Checking password option LILO..."
        FIND=`cat /etc/lilo.conf | grep 'password='`
	if [ "${FIND}" = "" ]; then
	    Display --indent 4 --text "- Password option present " --result "WARNING" --color RED
	    echo "[ ${WARNING}WARNING${NORMAL} ]"
	    logtext "Warning: no password set for LILO. Bootloader is unprotected to"
	    logtext "dropping to single user mode or unauthorized access to devices/data."
	    logtext "Suggestion: Add a password to LILO, by adding a line to the lilo.conf file,"
	    logtext "above the first line saying 'image=<name>': password=<password>"
	  else
	    Display --indent 4 --text "- Password option present " --result "OK" --color GREEN
	    logtext "Result: LILO password option set"
	fi
	#YYY (making /etc/lilo.conf immutable is a good idea, chattr +i /etc/lilo.conf)
      else
        Display --indent 2 --text "- Checking presence LILO... " --result "NOT FOUND" --color WHITE
	logtext "Result: LILO configuration file not found."
    fi
    logtextbreak

#
#################################################################################
#

    # Test: boot loader check (only i386)
    if [ "${OS}" = "OpenBSD" -a "${HARDWARE}" = "i386" ]; then
        counttests
        if [ -f /etc/boot.conf ]; then
    	    Display --indent 2 --text "- Checking /etc/boot.conf..." --result "FOUND" --color GREEN
            FIND=`grep '^boot' /etc/boot.conf`
	    if [ "${FIND}" = "" ]; then
		Display --indent 4 --text "- Checking boot option..." --result WARNING --color RED
		logtext "Suggestion: add 'boot' to the /etc/boot.conf file to disable the default 5 seconds"
    	        logtext "waiting time, to disallow booting into single user mode."
	      else
		Display --indent 4 --text "- Checking boot option..." --result OK --color GREEN
		logtext "Ok, boot option is enabled."	
	    fi
	  else
    	    Display --indent 2 --text "- Checking /etc/boot.conf..." --result "NOT FOUND" --color YELLOW
	    logtext "Result: no /etc/boot.conf found. When using the default boot loader, physical"
	    logtext "access to the server can be used to possibly enter single user mode."
	    logtext "Suggestion: add 'boot' to the /etc/boot.conf file to disable the default 5 seconds"
	    logtext "waiting time."
	fi
	logtextbreak
    fi

#
#################################################################################
#

    # FreeBSD (Read /etc/rc.conf file for enabled services)

    if [ "${OS}" = "FreeBSD" ]; then
        counttests
        logtext "Searching for services at startup (rc.conf)..."
        FIND=`cat /etc/rc.conf | grep '_enable="YES"' | grep -v '^#' | sort | awk -F= '{ print $1 }' | sed 's/_enable//'`
        N=0	
	for I in ${FIND}; do	
          logtext "Found service (at boot): ${I}"
	  report "boottask[]=${I}"
          N=$(( $N + 1 ))
        done
        Display --indent 2 --text "- [FreeBSD] Checking services at startup (rc.conf)... " --result "DONE" --color WHITE
        Display --indent 8 --text "Result: found $N services/options set"
        logtext "Found $N services/options set"
        logtextbreak
    fi

#
#################################################################################
#

    # Linux (use only chkconfig for now)
    
    if [ "${OS}" = "Linux" ]; then
	counttests
        if [ ! "${CHKCONFIGBINARY}" = "" ]; then
            logtext "Searching for services at startup (chkconfig, runlevel 3 and 5)... "
            FIND=`${CHKCONFIGBINARY} --list | egrep '3:on|5:on' | awk '{ print $1 }'`
            N=0
            for I in ${FIND}; do
              logtext "Found service (at boot, runlevel 3 or 5): ${I}"
              N=$(( $N + 1 ))
            done
            logtext "Run chkconfig --list to see all services and disable unneeded services"
            Display --indent 2 --text "- Check services at startup (chkconfig)... " --result "DONE" --color WHITE
            Display --indent 8 --text "Result: found $N services"
    	    logtext "Found $N services"
          else
	    logtext "Result: No chkconfig binary available, so skipping test"
        fi
        logtextbreak
    fi

#
#================================================================================
# Lynis - Copyright 2007-2008, Michael Boelen - www.rootkit.nl - The Netherlands
