freedombone-tests 37KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Run tests on the system
  12. # License
  13. # =======
  14. #
  15. # Copyright (C) 2015-2016 Bob Mottram <bob@freedombone.net>
  16. #
  17. # This program is free software: you can redistribute it and/or modify
  18. # it under the terms of the GNU Affero General Public License as published by
  19. # the Free Software Foundation, either version 3 of the License, or
  20. # (at your option) any later version.
  21. #
  22. # This program is distributed in the hope that it will be useful,
  23. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  24. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  25. # GNU Affero General Public License for more details.
  26. #
  27. # You should have received a copy of the GNU Affero General Public License
  28. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  29. PROJECT_NAME='freedombone'
  30. export TEXTDOMAIN=${PROJECT_NAME}-tests
  31. export TEXTDOMAINDIR="/usr/share/locale"
  32. RUN_STIG=
  33. function show_help {
  34. echo ''
  35. echo $"${PROJECT_NAME}-tests"
  36. echo ''
  37. echo $'Runs tests on the system'
  38. echo ''
  39. echo $' --help Show help'
  40. echo ''
  41. exit 0
  42. }
  43. function test_app_function_type {
  44. filename=$1
  45. fn_type=$2
  46. app_name=$(echo "${filename}" | awk -F '-app-' '{print $2}')
  47. app_function=$(cat "${filename}" | grep "function ${fn_type}_${app_name} {" | awk -F "${fn_type}_" '{print $2}' | awk -F ' ' '{print $1}')
  48. if [ ! ${app_function} ]; then
  49. echo $"Application ${app_name} does not contain a function called '${fn_type}_${app_name}'"
  50. echo ''
  51. echo "See ${filename}"
  52. exit 72852
  53. fi
  54. }
  55. function test_app_functions {
  56. FILES=/usr/share/${PROJECT_NAME}/apps/${PROJECT_NAME}-app-*
  57. # check that these functions exist
  58. interface_functions=( install remove backup_local backup_remote restore_local restore_remote upgrade reconfigure )
  59. # for all the app scripts
  60. for filename in $FILES
  61. do
  62. # for each expected interface function
  63. for f in "${interface_functions[@]}"
  64. do
  65. test_app_function_type ${filename} $f
  66. done
  67. done
  68. }
  69. function test_unique_onion_ports {
  70. # test that some services are not assigned the same onion port
  71. FILES=src/${PROJECT_NAME}-app-*
  72. ports=$(grep -r "_ONION_PORT=" $FILES | awk -F ':' '{print $2}' | uniq | awk -F '=' '{print $2}')
  73. unique_ports=$(grep -r "_ONION_PORT=" $FILES | awk -F ':' '{print $2}' | uniq | awk -F '=' '{print $2}' | uniq)
  74. if [[ "$ports" != "$unique_ports" ]]; then
  75. echo $'Some onion ports are clashing'
  76. grep -r "_ONION_PORT=" $FILES | awk -F ':' '{print $2}' | uniq
  77. exit 637252
  78. fi
  79. }
  80. function stig_log_msg {
  81. ESTATUS=$1
  82. RED=$(tput setaf 1)
  83. BOLD=$(tput bold)
  84. GREEN=$(tput setaf 2)
  85. NORMAL=$(tput sgr0)
  86. MSG="$2"
  87. if [ $ESTATUS -eq 0 ];then
  88. printf "%s %s" "$GREEN$BOLD[ PASS ]$NORMAL" "$MSG"
  89. echo
  90. else
  91. printf "%s %s" "$RED$BOLD[ FAIL ]$NORMAL" "$MSG"
  92. echo
  93. fi
  94. }
  95. function stig_spinner {
  96. local pid=$1
  97. local delay=0.1
  98. while [ "$(ps -a | awk '{print $1}' | grep "$pid")" ];
  99. do
  100. sleep $delay
  101. done
  102. printf " \b"
  103. wait $1
  104. }
  105. function test_stig {
  106. if [ ! $RUN_STIG ]; then
  107. return
  108. fi
  109. STIG_TESTS_DIR=tests
  110. if [ ! -d $STIG_TESTS_DIR ]; then
  111. STIG_TESTS_DIR=~/${PROJECT_NAME}/tests
  112. if [ ! -d $STIG_TESTS_DIR ]; then
  113. echo $'No tests were found'
  114. exit 62725
  115. fi
  116. fi
  117. CATCOLOR=1
  118. SETLANG="en"
  119. source $STIG_TESTS_DIR/output.sh
  120. ##RHEL-06-000001
  121. ##The system must use a separate file system for /tmp.
  122. mount | grep "on /tmp " >/dev/null 2>&1 &
  123. stig_spinner $!
  124. output "V-38455" $? ${SETLANG}
  125. ################
  126. ##RHEL-06-000008
  127. ##Vendor-provided cryptographic certificates must be installed to verify the integrity of system software.
  128. bash $STIG_TESTS_DIR/check-apt-key.sh >/dev/null 2>&1 &
  129. stig_spinner $!
  130. output "V-38476" $? ${SETLANG}
  131. ################
  132. ##RHEL-06-000011
  133. ##System security patches and updates must be installed and up-to-date.
  134. bash $STIG_TESTS_DIR/check-package-up2date.sh >/dev/null 2>&1 &
  135. stig_spinner $!
  136. output "V-38481" $? ${SETLANG}
  137. ################
  138. ##RHEL-06-000013
  139. ##The system package management tool must cryptographically verify the authenticity of system software packages during installation.
  140. stig_spinner $!
  141. output "V-38483" $? ${SETLANG}
  142. ################
  143. ##RHEL-06-000015
  144. ##The system package management tool must cryptographically verify the authenticity of all software packages during installation.
  145. stig_spinner $!
  146. output "V-38487" $? ${SETLANG}
  147. ################
  148. ##RHEL-06-000016
  149. ##A file integrity tool must be installed.
  150. dpkg -s aide >/dev/null 2>&1 &
  151. stig_spinner $!
  152. output "V-38489" $? ${SETLANG}
  153. ################
  154. ##RHEL-06-000019
  155. ##There must be no .rhosts or hosts.equiv files on the system.
  156. bash $STIG_TESTS_DIR/check-rhosts.sh > /dev/null 2>&1 &
  157. stig_spinner $!
  158. output "V-38491" $? ${SETLANG}
  159. ################
  160. ##RHEL-06-000027
  161. ##The system must prevent the root account from logging in from virtual consoles.
  162. bash $STIG_TESTS_DIR/check-consoles.sh virtual > /dev/null 2>&1 &
  163. stig_spinner $!
  164. output "V-38492" $? ${SETLANG}
  165. ################
  166. ##RHEL-06-000028
  167. ##The system must prevent the root account from logging in from serial consoles.
  168. bash $STIG_TESTS_DIR/check-consoles.sh serial > /dev/null 2>&1 &
  169. stig_spinner $!
  170. output "V-38494" $? ${SETLANG}
  171. ################
  172. ##RHEL-06-000029
  173. ##Default operating system accounts, other than root, must be locked.
  174. bash $STIG_TESTS_DIR/check-default-account.sh > /dev/null 2>&1 &
  175. stig_spinner $!
  176. output "V-38496" $? ${SETLANG}
  177. ################
  178. ##RHEL-06-000030
  179. ##The system must not have accounts configured with blank or null passwords.
  180. ##For more Detial http://www.cyberciti.biz/tips/how-to-linux-prevent-the-reuse-of-old-passwords.html
  181. ##For more Detial http://www.cyberciti.biz/tips/linux-or-unix-disable-null-passwords.html
  182. grep nullok /etc/pam.d/common-password > /dev/null 2>&1 &
  183. stig_spinner $!
  184. output "V-38497" $? ${SETLANG}
  185. ################
  186. ##RHEL-06-000031
  187. ##The /etc/passwd file must not contain password hashes.
  188. awk -F: '($2 != "x") {print; err=1} END {exit err}' /etc/passwd > /dev/null 2>&1 &
  189. stig_spinner $!
  190. output "V-38499" $? ${SETLANG}
  191. ################
  192. ##RHEL-06-000032
  193. ##The root account must be the only account having a UID of 0.
  194. bash $STIG_TESTS_DIR/check-root-uid.sh > /dev/null 2>&1 &
  195. stig_spinner $!
  196. output "V-38500" $? ${SETLANG}
  197. ################
  198. ##RHEL-06-000033
  199. ##The /etc/shadow file must be owned by root.
  200. ls -l /etc/shadow | awk '{print $3}' | grep "^root$" > /dev/null 2>&1 &
  201. stig_spinner $!
  202. output "V-38502" $? ${SETLANG}
  203. ################
  204. ##RHEL-06-000034
  205. ##The /etc/shadow file must be group-owned by root.
  206. ls -l /etc/shadow | awk '{print $4}' | grep "^root$" > /dev/null 2>&1 &
  207. stig_spinner $!
  208. output "V-38503" $? ${SETLANG}
  209. ################
  210. ##RHEL-06-000035
  211. ##The /etc/shadow file must have mode 0000.
  212. ls -l /etc/shadow | awk '{print $1}' | grep "^----------$" > /dev/null 2>&1 &
  213. stig_spinner $!
  214. output "V-38504" $? ${SETLANG}
  215. ################
  216. ##RHEL-06-000036
  217. ##The /etc/gshadow file must be owned by root.
  218. ls -l /etc/gshadow | awk '{print $3}' | grep "^root$" > /dev/null 2>&1 &
  219. stig_spinner $!
  220. output "V-38443" $? ${SETLANG}
  221. ################
  222. ##RHEL-06-000037
  223. ##The /etc/gshadow file must be group-owned by root.
  224. ls -l /etc/gshadow | awk '{print $4}' | grep "^root$" > /dev/null 2>&1 &
  225. stig_spinner $!
  226. output "V-38448" $? ${SETLANG}
  227. ################
  228. ##RHEL-06-000038
  229. ##The /etc/gshadow file must have mode 0000.
  230. ls -l /etc/gshadow | awk '{print $1}' | grep "^----------$" > /dev/null 2>&1 &
  231. stig_spinner $!
  232. output "V-38449" $? ${SETLANG}
  233. ################
  234. ##RHEL-06-000039
  235. ##The /etc/passwd file must be owned by root.
  236. ls -l /etc/passwd | awk '{print $3}' | grep "^root$" > /dev/null 2>&1 &
  237. stig_spinner $!
  238. output "V-38450" $? ${SETLANG}
  239. ################
  240. ##RHEL-06-000040
  241. ##The /etc/passwd file must be group-owned by root.
  242. ls -l /etc/passwd | awk '{print $4}' | grep "^root$" > /dev/null 2>&1 &
  243. stig_spinner $!
  244. output "V-38451" $? ${SETLANG}
  245. ################
  246. ##RHEL-06-000041
  247. ##The /etc/passwd file must have mode 0644 or less permissive.
  248. bash $STIG_TESTS_DIR/check-mode.sh /etc/passwd 644 > /dev/null 2>&1 &
  249. stig_spinner $!
  250. output "V-38457" $? ${SETLANG}
  251. ################
  252. ##RHEL-06-000042
  253. ##The /etc/group file must be owned by root.
  254. ls -l /etc/group | awk '{print $3}' | grep "^root$" > /dev/null 2>&1 &
  255. stig_spinner $!
  256. output "V-38458" $? ${SETLANG}
  257. ################
  258. ##RHEL-06-000043
  259. ##The /etc/group file must be group-owned by root.
  260. ls -l /etc/group | awk '{print $4}' | grep "^root$" > /dev/null 2>&1 &
  261. stig_spinner $!
  262. output "V-38459" $? ${SETLANG}
  263. ################
  264. ##RHEL-06-000044
  265. ##The /etc/group file must have mode 0644 or less permissive.
  266. bash $STIG_TESTS_DIR/check-mode.sh "/etc/group" 644 > /dev/null 2>&1 &
  267. stig_spinner $!
  268. output "V-38461" $? ${SETLANG}
  269. ################
  270. ##RHEL-06-000045
  271. ##Library files must have mode 0755 or less permissive.
  272. bash $STIG_TESTS_DIR/check-libs-mode.sh > /dev/null 2>&1 &
  273. stig_spinner $!
  274. output "V-38465" $? ${SETLANG}
  275. ################
  276. ##RHEL-06-000046
  277. ##Library files must be owned by root.
  278. bash $STIG_TESTS_DIR/check-libs-owner.sh > /dev/null 2>&1 &
  279. stig_spinner $!
  280. output "V-38466" $? ${SETLANG}
  281. ################
  282. ##RHEL-06-000047
  283. ##All system command files must have mode 755 or less permissive.
  284. bash $STIG_TESTS_DIR/check-cmd-mode.sh > /dev/null 2>&1 &
  285. stig_spinner $!
  286. output "V-38469" $? ${SETLANG}
  287. ################
  288. ##RHEL-06-000048
  289. ##All system command files must be owned by root.
  290. bash $STIG_TESTS_DIR/check-cmd-owner.sh > /dev/null 2>&1 &
  291. stig_spinner $!
  292. output "V-38472" $? ${SETLANG}
  293. ################
  294. ##RHEL-06-000061
  295. ##The system must disable accounts after ten consecutive unsuccessful logon attempts.
  296. bash $STIG_TESTS_DIR/check-password.sh /etc/pam.d/common-auth pam_tally deny gt 10 > /dev/null 2>&1 &
  297. stig_spinner $!
  298. output "V-38573" $? ${SETLANG}
  299. ################
  300. ##RHEL-06-000062
  301. ##The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (system-auth).
  302. sed -e '/^#/d' -e '/^[ \t][ \t]*#/d' -e 's/#.*$//' -e '/^$/d' /etc/pam.d/* | grep password | grep pam_unix.so | grep sha512 > /dev/null 2>&1 &
  303. stig_spinner $!
  304. output "V-38574" $? ${SETLANG}
  305. ################
  306. ##RHEL-06-000063
  307. ##The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (login.defs).
  308. sed -e '/^#/d' -e '/^[ \t][ \t]*#/d' -e 's/#.*$//' -e '/^$/d' /etc/login.defs | grep "ENCRYPT_METHOD.*SHA512" > /dev/null 2>&1 &
  309. stig_spinner $!
  310. output "V-38576" $? ${SETLANG}
  311. ################
  312. ##RHEL-06-000064
  313. ##The system must use a FIPS 140-2 approved cryptographic hashing algorithm for generating account password hashes (libuser.conf).
  314. bash $STIG_TESTS_DIR/check-depends.sh > /dev/null 2>&1 &
  315. stig_spinner $!
  316. output "V-38577" $? ${SETLANG}
  317. ################
  318. ##RHEL-06-000065
  319. ##The system boot loader configuration file(s) must be owned by root.
  320. ls -l /boot/grub/grub.cfg | awk '{print $3}' | grep "^root$" > /dev/null 2>&1 &
  321. stig_spinner $!
  322. output "V-38579" $? ${SETLANG}
  323. ################
  324. ##RHEL-06-000066
  325. ##The system boot loader configuration file(s) must be group-owned by root.
  326. ls -l /boot/grub/grub.cfg | awk '{print $4}' | grep "^root$" > /dev/null 2>&1 &
  327. stig_spinner $!
  328. output "V-38581" $? ${SETLANG}
  329. ################
  330. ##RHEL-06-000067
  331. ##The system boot loader configuration file(s) must have mode 0600 or less permissive.
  332. bash $STIG_TESTS_DIR/check-grub-mode.sh > /dev/null 2>&1 &
  333. stig_spinner $!
  334. output "V-38583" $? ${SETLANG}
  335. ################
  336. ##RHEL-06-000071
  337. ##The system must allow locking of the console screen in text mode.
  338. dpkg -s screen >/dev/null 2>&1 &
  339. stig_spinner $!
  340. output "V-38590" $? ${SETLANG}
  341. ################
  342. ##RHEL-06-000078
  343. ##The system must implement virtual address space randomization.
  344. bash $STIG_TESTS_DIR/check-sysctl.sh kernel.randomize_va_space ne 2 >/dev/null 2>&1 &
  345. stig_spinner $!
  346. output "V-38596" $? ${SETLANG}
  347. ################
  348. ##RHEL-06-000080
  349. ##The system must not send ICMPv4 redirects by default.
  350. bash $STIG_TESTS_DIR/check-sysctl.sh net.ipv4.conf.default.send_redirects ne 0 >/dev/null 2>&1 &
  351. stig_spinner $!
  352. output "V-38600" $? ${SETLANG}
  353. ################
  354. ##RHEL-06-000081
  355. ##The system must not send ICMPv4 redirects from any interface.
  356. bash $STIG_TESTS_DIR/check-sysctl.sh net.ipv4.conf.all.send_redirects ne 0 >/dev/null 2>&1 &
  357. stig_spinner $!
  358. output "V-38601" $? ${SETLANG}
  359. ################
  360. ##RHEL-06-000082
  361. ##IP forwarding for IPv4 must not be enabled, unless the system is a router.
  362. bash $STIG_TESTS_DIR/check-sysctl.sh net.ipv4.ip_forward ne 0 >/dev/null 2>&1 &
  363. stig_spinner $!
  364. output "V-38511" $? ${SETLANG}
  365. ################
  366. ##RHEL-06-000083
  367. ##The system must not accept IPv4 source-routed packets on any interface.
  368. bash $STIG_TESTS_DIR/check-sysctl.sh net.ipv4.conf.all.accept_source_route ne 0 >/dev/null 2>&1 &
  369. stig_spinner $!
  370. output "V-38523" $? ${SETLANG}
  371. ################
  372. ##RHEL-06-000084
  373. ##The system must not accept ICMPv4 redirect packets on any interface.
  374. bash $STIG_TESTS_DIR/check-sysctl.sh net.ipv4.conf.all.accept_redirects ne 0 >/dev/null 2>&1 &
  375. stig_spinner $!
  376. output "V-38524" $? ${SETLANG}
  377. ################
  378. ##RHEL-06-000086
  379. ##The system must not accept ICMPv4 secure redirect packets on any interface.
  380. bash $STIG_TESTS_DIR/check-sysctl.sh net.ipv4.conf.all.secure_redirects ne 0 >/dev/null 2>&1 &
  381. stig_spinner $!
  382. output "V-38526" $? ${SETLANG}
  383. ################
  384. ##RHEL-06-000089
  385. ##The system must not accept IPv4 source-routed packets by default.
  386. bash $STIG_TESTS_DIR/check-sysctl.sh net.ipv4.conf.default.accept_source_route ne 0 >/dev/null 2>&1 &
  387. stig_spinner $!
  388. output "V-38529" $? ${SETLANG}
  389. ################
  390. ##RHEL-06-000090
  391. ##The system must not accept ICMPv4 secure redirect packets by default.
  392. bash $STIG_TESTS_DIR/check-sysctl.sh net.ipv4.conf.default.secure_redirects ne 0 >/dev/null 2>&1 &
  393. stig_spinner $!
  394. output "V-38532" $? ${SETLANG}
  395. ################
  396. ##RHEL-06-000091
  397. ##The system must ignore ICMPv4 redirect messages by default.
  398. bash $STIG_TESTS_DIR/check-sysctl.sh net.ipv4.conf.default.accept_redirects ne 0 >/dev/null 2>&1 &
  399. stig_spinner $!
  400. output "V-38533" $? ${SETLANG}
  401. ################
  402. ##RHEL-06-000092
  403. ##The system must not respond to ICMPv4 sent to a broadcast address.
  404. bash $STIG_TESTS_DIR/check-sysctl.sh net.ipv4.icmp_echo_ignore_broadcasts ne 1 >/dev/null 2>&1 &
  405. stig_spinner $!
  406. output "V-38535" $? ${SETLANG}
  407. ################
  408. ##RHEL-06-000093
  409. ##The system must ignore ICMPv4 bogus error responses.
  410. bash $STIG_TESTS_DIR/check-sysctl.sh net.ipv4.icmp_ignore_bogus_error_responses ne 1 >/dev/null 2>&1 &
  411. stig_spinner $!
  412. output "V-38537" $? ${SETLANG}
  413. ################
  414. ##RHEL-06-000095
  415. ##The system must be configured to use TCP syncookies when experiencing a TCP SYN flood.
  416. bash $STIG_TESTS_DIR/check-sysctl.sh net.ipv4.tcp_syncookies ne 1 >/dev/null 2>&1 &
  417. stig_spinner $!
  418. output "V-38539" $? ${SETLANG}
  419. ################
  420. ##RHEL-06-000096
  421. ##The system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces.
  422. bash $STIG_TESTS_DIR/check-sysctl.sh net.ipv4.conf.all.rp_filter ne 1 >/dev/null 2>&1 &
  423. stig_spinner $!
  424. output "V-38542" $? ${SETLANG}
  425. ################
  426. ##RHEL-06-000097
  427. ##The system must use a reverse-path filter for IPv4 network traffic when possible by default.
  428. bash $STIG_TESTS_DIR/check-sysctl.sh net.ipv4.conf.default.rp_filter ne 1 >/dev/null 2>&1 &
  429. stig_spinner $!
  430. output "V-38544" $? ${SETLANG}
  431. ################
  432. ##RHEL-06-000098
  433. ##The IPv6 protocol handler must not be bound to the network stack unless needed.
  434. bash $STIG_TESTS_DIR/check-ipv6-enable.sh >/dev/null 2>&1 &
  435. stig_spinner $!
  436. output "V-38546" $? ${SETLANG}
  437. ################
  438. ##RHEL-06-000099
  439. ##The system must ignore ICMPv6 redirects by default.
  440. ##If IPv6 is disabled, this is not applicable.
  441. if [ -a /proc/net/if_inet6 ];then
  442. bash $STIG_TESTS_DIR/check-sysctl.sh net.ipv6.conf.default.accept_redirects ne 0 >/dev/null 2>&1 &
  443. stig_spinner $!
  444. output "V-38548" $? ${SETLANG}
  445. fi
  446. ################
  447. ##RHEL-06-000120
  448. ##The systems local IPv4 firewall must implement a deny-all, allow-by-exception policy for inbound
  449. iptables -L INPUT | head -n1 | grep "INPUT.*DROP" >/dev/null 2>&1 &
  450. stig_spinner $!
  451. output "V-38513" $? ${SETLANG}
  452. ################
  453. ##RHEL-06-000124
  454. ##The systems local IPv4 firewall must implement a deny-all, allow-by-exception policy for inbound
  455. grep -r dccp /etc/modprobe.conf /etc/modprobe.d >/dev/null 2>&1 &
  456. stig_spinner $!
  457. output "V-38514" $? ${SETLANG}
  458. ################
  459. ##RHEL-06-000125
  460. ##The Stream Control Transmission Protocol (SCTP) must be disabled unless required.
  461. grep -r sctp /etc/modprobe.conf /etc/modprobe.d >/dev/null 2>&1 &
  462. stig_spinner $!
  463. output "V-38515" $? ${SETLANG}
  464. ################
  465. ##RHEL-06-000126
  466. ##The Reliable Datagram Sockets (RDS) protocol must be disabled unless required.
  467. grep -r rds /etc/modprobe.conf /etc/modprobe.d >/dev/null 2>&1 &
  468. stig_spinner $!
  469. output "V-38516" $? ${SETLANG}
  470. ################
  471. ##RHEL-06-000127
  472. ##The Transparent Inter-Process Communication (TIPC) protocol must be disabled unless required.
  473. grep -r tipc /etc/modprobe.conf /etc/modprobe.d >/dev/null 2>&1 &
  474. stig_spinner $!
  475. output "V-38517" $? ${SETLANG}
  476. ################
  477. ##RHEL-06-000133
  478. ##All rsyslog-generated log files must be owned by root.
  479. bash $STIG_TESTS_DIR/check-rsyslog.sh owned >/dev/null 2>&1 &
  480. stig_spinner $!
  481. output "V-38518" $? ${SETLANG}
  482. ################
  483. ##RHEL-06-000134
  484. ##All rsyslog-generated log files must be group-owned by root.
  485. bash $STIG_TESTS_DIR/check-rsyslog.sh group-owned >/dev/null 2>&1 &
  486. stig_spinner $!
  487. output "V-38519" $? ${SETLANG}
  488. ################
  489. ##RHEL-06-000135
  490. ##All rsyslog-generated log files must have mode 0600 or less permissive.
  491. bash $STIG_TESTS_DIR/check-rsyslog.sh mode >/dev/null 2>&1 &
  492. stig_spinner $!
  493. output "V-38623" $? ${SETLANG}
  494. ################
  495. ##RHEL-06-000138
  496. ##System logs must be rotated daily.
  497. bash $STIG_TESTS_DIR/check-logrotate.sh >/dev/null 2>&1 &
  498. stig_spinner $!
  499. output "V-38624" $? ${SETLANG}
  500. ################
  501. ##RHEL-06-000203
  502. ##The xinetd service must be disabled if no network services utilizing it are enabled.
  503. bash $STIG_TESTS_DIR/check-services.sh xinetd >/dev/null 2>&1 &
  504. stig_spinner $!
  505. output "V-38582" $? ${SETLANG}
  506. ################
  507. ##RHEL-06-000204
  508. ##The xinetd service must be uninstalled if no network services utilizing it are enabled.
  509. bash $STIG_TESTS_DIR/check-packages.sh xinetd >/dev/null 2>&1 &
  510. stig_spinner $!
  511. output "V-38584" $? ${SETLANG}
  512. ################
  513. ##RHEL-06-000206
  514. ##The telnet-server package must not be installed.
  515. bash $STIG_TESTS_DIR/check-packages.sh telnetd >/dev/null 2>&1 &
  516. stig_spinner $!
  517. output "V-38587" $? ${SETLANG}
  518. ################
  519. ##RHEL-06-000211
  520. ##The telnet daemon must not be running.
  521. bash $STIG_TESTS_DIR/check-services.sh telnetd >/dev/null 2>&1 &
  522. stig_spinner $!
  523. output "V-38589" $? ${SETLANG}
  524. ################
  525. ##RHEL-06-000213
  526. ##The rsh-server package must not be installed.
  527. bash $STIG_TESTS_DIR/check-packages.sh rsh-server >/dev/null 2>&1 &
  528. stig_spinner $!
  529. output "V-38591" $? ${SETLANG}
  530. ################
  531. ##RHEL-06-000214
  532. ##The rshd service must not be running.
  533. bash $STIG_TESTS_DIR/check-services.sh rshd >/dev/null 2>&1 &
  534. stig_spinner $!
  535. output "V-38594" $? ${SETLANG}
  536. ################
  537. ##RHEL-06-000216
  538. ##The rexecd service must not be running.
  539. bash $STIG_TESTS_DIR/check-services.sh rexecd >/dev/null 2>&1 &
  540. stig_spinner $!
  541. output "V-38598" $? ${SETLANG}
  542. ################
  543. ##RHEL-06-000218
  544. ##The rlogind service must not be running.
  545. bash $STIG_TESTS_DIR/check-services.sh rlogind >/dev/null 2>&1 &
  546. stig_spinner $!
  547. output "V-38602" $? ${SETLANG}
  548. ################
  549. ##RHEL-06-000220
  550. ##The NIS(ypserv) package must not be installed.
  551. bash $STIG_TESTS_DIR/check-packages.sh nis >/dev/null 2>&1 &
  552. stig_spinner $!
  553. output "V-38603" $? ${SETLANG}
  554. ################
  555. ##RHEL-06-000221
  556. ##The nis(ypbind) service must not be running.
  557. bash $STIG_TESTS_DIR/check-services.sh nis >/dev/null 2>&1 &
  558. stig_spinner $!
  559. output "V-38604" $? ${SETLANG}
  560. ################
  561. ##RHEL-06-000224
  562. ##The cron service must be running.
  563. bash $STIG_TESTS_DIR/check-services.sh cron >/dev/null 2>&1 &
  564. stig_spinner $!
  565. output "V-38605" $? ${SETLANG}
  566. ################
  567. ##RHEL-06-000227
  568. ##The SSH daemon must be configured to use only the SSHv2 protocol.
  569. bash $STIG_TESTS_DIR/check-ssh.sh Protocol >/dev/null 2>&1 &
  570. stig_spinner $!
  571. output "V-38607" $? ${SETLANG}
  572. ################
  573. ##RHEL-06-000230
  574. ##The SSH daemon must set a timeout interval on idle sessions.
  575. sed -e '/^#/d' -e '/^[ \t][ \t]*#/d' -e 's/#.*$//' -e '/^$/d' /etc/ssh/sshd_config | grep "ClientAliveInterval" >/dev/null 2>&1 &
  576. stig_spinner $!
  577. output "V-38608" $? ${SETLANG}
  578. ################
  579. ##RHEL-06-000231
  580. ##The SSH daemon must set a timeout count on idle sessions.
  581. sed -e '/^#/d' -e '/^[ \t][ \t]*#/d' -e 's/#.*$//' -e '/^$/d' /etc/ssh/sshd_config | grep "ClientAliveCountMax" >/dev/null 2>&1 &
  582. stig_spinner $!
  583. output "V-38610" $? ${SETLANG}
  584. ################
  585. ##RHEL-06-000234
  586. ##The SSH daemon must ignore .rhosts files.
  587. bash $STIG_TESTS_DIR/check-ssh.sh rhosts >/dev/null 2>&1 &
  588. stig_spinner $!
  589. output "V-38611" $? ${SETLANG}
  590. ################
  591. ##RHEL-06-000236
  592. ##The SSH daemon must not allow host-based authentication.
  593. bash $STIG_TESTS_DIR/check-ssh.sh hostauth >/dev/null 2>&1 &
  594. stig_spinner $!
  595. output "V-38612" $? ${SETLANG}
  596. ################
  597. ##RHEL-06-000237
  598. ##The system must not permit root logins using remote access programs such as ssh.
  599. bash $STIG_TESTS_DIR/check-ssh.sh permitroot >/dev/null 2>&1 &
  600. stig_spinner $!
  601. output "V-38613" $? ${SETLANG}
  602. ################
  603. ##RHEL-06-000239
  604. ##The SSH daemon must not allow authentication using an empty password.
  605. bash $STIG_TESTS_DIR/check-ssh.sh emptypassword >/dev/null 2>&1 &
  606. stig_spinner $!
  607. output "V-38615" $? ${SETLANG}
  608. ################
  609. ##RHEL-06-000241
  610. ##The SSH daemon must not permit user environment settings.
  611. bash $STIG_TESTS_DIR/check-ssh.sh emptypasswordenvironment >/dev/null 2>&1 &
  612. stig_spinner $!
  613. output "V-38616" $? ${SETLANG}
  614. ################
  615. ##RHEL-06-000243
  616. ##The SSH daemon must be configured to use only FIPS 140-2 approved ciphers.
  617. bash $STIG_TESTS_DIR/check-ssh-ciphers.sh > /dev/null 2>&1 &
  618. stig_spinner $!
  619. output "V-38617" $? ${SETLANG}
  620. ################
  621. ##RHEL-06-000247
  622. ##The system clock must be synchronized continuously, or at least daily.
  623. bash $STIG_TESTS_DIR/check-services.sh ntp >/dev/null 2>&1 &
  624. stig_spinner $!
  625. output "V-38620" $? ${SETLANG}
  626. ################
  627. ##RHEL-06-000248
  628. ##The system clock must be synchronized to an authoritative time source.
  629. bash $STIG_TESTS_DIR/check-ntp-sources.sh >/dev/null 2>&1 &
  630. stig_spinner $!
  631. output "V-38621" $? ${SETLANG}
  632. ################
  633. ##RHEL-06-000252
  634. ##If the system is using LDAP for authentication or account information, the system must use a TLS connection using FIPS 140-2 approved cryptographic algorithms.
  635. #Waiting to figure out
  636. #stig_spinner $!
  637. #output "V-38625" $? ${SETLANG}
  638. ################
  639. ##RHEL-06-000253
  640. ##The LDAP client must use a TLS connection using trust certificates signed by the site CA.
  641. #Waiting to figure out
  642. #stig_spinner $!
  643. #output "V-38626" $? ${SETLANG}
  644. ################
  645. ##RHEL-06-000256
  646. ##The openldap-servers package must not be installed unless required.
  647. bash $STIG_TESTS_DIR/check-packages.sh sldap>/dev/null 2>&1 &
  648. stig_spinner $!
  649. output "V-38627" $? ${SETLANG}
  650. ################
  651. ##RHEL-06-000257
  652. ##The graphical desktop environment must set the idle timeout to no more than 15 minutes.
  653. #stig_spinner $!
  654. #output "V-38629" $? ${SETLANG}
  655. ################
  656. ##RHEL-06-000258
  657. ##The graphical desktop environment must automatically lock after 15 minutes of inactivity and the system must require user reauthentication to unlock the environment.
  658. #stig_spinner $!
  659. #output "V-38630" $? ${SETLANG}
  660. ################
  661. ##RHEL-06-000259
  662. ##The graphical desktop environment must have automatic lock enabled.
  663. #stig_spinner $!
  664. #output "V-38638" $? ${SETLANG}
  665. ################
  666. ##RHEL-06-000260
  667. ##The system must display a publicly-viewable pattern during a graphical desktop environment session lock.
  668. #stig_spinner $!
  669. #output "V-38639" $? ${SETLANG}
  670. ################
  671. ##RHEL-06-000262
  672. ##The atd service must be disabled.
  673. bash $STIG_TESTS_DIR/check-services.sh atd >/dev/null 2>&1 &
  674. stig_spinner $!
  675. output "V-38641" $? ${SETLANG}
  676. ################
  677. ##RHEL-06-000269
  678. ##Remote file systems must be mounted with the nodev option.
  679. if [ "$(mount | grep nfs | wc -l)" -gt 0 ];then
  680. bash $STIG_TESTS_DIR/check-nfs.sh nodev >/dev/null 2>&1 &
  681. stig_spinner $!
  682. output "V-38652" $? ${SETLANG}
  683. fi
  684. ################
  685. ##RHEL-06-000270
  686. ##Remote file systems must be mounted with the nosuid option.
  687. if [ "$(mount | grep nfs | wc -l)" -gt 0 ];then
  688. bash $STIG_TESTS_DIR/check-nfs.sh nosuid >/dev/null 2>&1 &
  689. stig_spinner $!
  690. output "V-38654" $? ${SETLANG}
  691. fi
  692. ################
  693. ##RHEL-06-000271
  694. ##The noexec option must be added to removable media partitions.
  695. if [ "$(grep -Hv ^0$ /sys/block/*/removable | sed s/removable:.*$/device\\/uevent/ | xargs grep -H ^DRIVER=sd | sed s/device.uevent.*$/size/ | xargs grep -Hv ^0$ | cut -d / -f 4 | wc -l)" -gt 0 ];then
  696. bash $STIG_TESTS_DIR/check-removable.sh >/dev/null 2>&1 &
  697. stig_spinner $!
  698. output "V-38655" $? ${SETLANG}
  699. fi
  700. ################
  701. ##RHEL-06-000272
  702. ##The system must use SMB client signing for connecting to samba servers using smbclient.
  703. bash $STIG_TESTS_DIR/check-depends.sh smb-signing >/dev/null 2>&1 &
  704. stig_spinner $!
  705. output "V-38656" $? ${SETLANG}
  706. ################
  707. ##RHEL-06-000273
  708. ##The system must use SMB client signing for connecting to samba servers using mount.cifs.
  709. bash $STIG_TESTS_DIR/check-depends.sh smb-sec >/dev/null 2>&1 &
  710. stig_spinner $!
  711. output "V-38657" $? ${SETLANG}
  712. ################
  713. ##RHEL-06-000274
  714. ##The system must prohibit the reuse of passwords within twenty-four iterations.
  715. grep remember /etc/pam.d/common-auth /etc/pam.d/common-password >/dev/null 2>&1 &
  716. stig_spinner $!
  717. output "V-38658" $? ${SETLANG}
  718. ################
  719. ##RHEL-06-000275
  720. ##The operating system must employ cryptographic mechanisms to protect information in storage.
  721. dmsetup status | grep -i "crypt" >/dev/null 2>&1 &
  722. stig_spinner $!
  723. output "V-38659" $? ${SETLANG}
  724. ################
  725. ##RHEL-06-000276
  726. ##The operating system must protect the confidentiality and integrity of data at rest.
  727. #dmsetup status | grep -i "crypt" >/dev/null 2>&1 &
  728. stig_spinner $!
  729. output "V-38661" $? ${SETLANG}
  730. ################
  731. ##RHEL-06-000277
  732. ##The operating system must employ cryptographic mechanisms to prevent unauthorized disclosure of data at rest unless otherwise protected by alternative physical measures.
  733. #dmsetup status | grep -i "crypt" >/dev/null 2>&1 &
  734. stig_spinner $!
  735. output "V-38662" $? ${SETLANG}
  736. ################
  737. ##RHEL-06-000282
  738. ##There must be no world-writable files on the system.
  739. bash $STIG_TESTS_DIR/check-world-writable.sh >/dev/null 2>&1 &
  740. stig_spinner $!
  741. output "V-38643" $? ${SETLANG}
  742. ################
  743. ##RHEL-06-000286
  744. ##The x86 Ctrl-Alt-Delete key sequence must be disabled.
  745. bash $STIG_TESTS_DIR/check-ctrl-alt-del.sh >/dev/null 2>&1 &
  746. stig_spinner $!
  747. output "V-38668" $? ${SETLANG}
  748. ################
  749. ##RHEL-06-000288
  750. ##The sendmail package must be removed.
  751. bash $STIG_TESTS_DIR/check-packages.sh sendmail >/dev/null 2>&1 &
  752. stig_spinner $!
  753. output "V-38671" $? ${SETLANG}
  754. ################
  755. ##RHEL-06-000290
  756. ##X Windows must not be enabled unless required.
  757. bash $STIG_TESTS_DIR/check-services.sh x11-common >/dev/null 2>&1 &
  758. stig_spinner $!
  759. output "V-38674" $? ${SETLANG}
  760. ################
  761. ##RHEL-06-000294
  762. ##All GIDs referenced in /etc/passwd must be defined in /etc/group
  763. check $STIG_TESTS_DIR/check-gids.sh >/dev/null 2>&1 &
  764. stig_spinner $!
  765. output "V-38681" $? ${SETLANG}
  766. ################
  767. ##RHEL-06-000296
  768. ##All accounts on the system must have unique user or account names
  769. check $STIG_TESTS_DIR/check-uniq-names.sh >/dev/null 2>&1 &
  770. stig_spinner $!
  771. output "V-38683" $? ${SETLANG}
  772. ################
  773. ##RHEL-06-000302
  774. ##A file integrity tool must be used at least weekly to check for unauthorized file changes, particularly the addition of unauthorized system libraries or binaries, or for unauthorized modification to authorized system libraries or binaries.
  775. bash $STIG_TESTS_DIR/check-aide-cron.sh > /dev/null 2>&1 &
  776. stig_spinner $!
  777. output "V-38695" $? ${SETLANG}
  778. ################
  779. ##RHEL-06-000308
  780. ##Process core dumps must be disabled unless needed.
  781. bash $STIG_TESTS_DIR/check-limits.sh core-dumps > /dev/null 2>&1 &
  782. stig_spinner $!
  783. output "V-38675" $? ${SETLANG}
  784. ################
  785. ##RHEL-06-000309
  786. ##The NFS server must not have the insecure file locking option enabled.
  787. bash $STIG_TESTS_DIR/check-nfs-insecure.sh > /dev/null 2>&1 &
  788. stig_spinner $!
  789. output "V-38677" $? ${SETLANG}
  790. ################
  791. ##RHEL-06-000315
  792. ##The Bluetooth kernel module must be disabled.
  793. bash $STIG_TESTS_DIR/check-bluetooth.sh > /dev/null 2>&1 &
  794. stig_spinner $!
  795. output "V-38682" $? ${SETLANG}
  796. ################
  797. ##RHEL-06-000319
  798. ##The system must limit users to 10 simultaneous system logins, or a site-defined number, in accordance with operational requirements.
  799. bash $STIG_TESTS_DIR/check-limits.sh maxlogins > /dev/null 2>&1 &
  800. stig_spinner $!
  801. output "V-38684" $? ${SETLANG}
  802. ################
  803. ##RHEL-06-000320
  804. ##The systems local firewall must implement a deny-all, allow-by-exception policy for forwarded packets.
  805. iptables -L FORWARD | head -n1 | grep "FORWARD.*DROP" >/dev/null 2>&1 &
  806. stig_spinner $!
  807. output "V-38686" $? ${SETLANG}
  808. ################
  809. ##RHEL-06-000331
  810. ##The Bluetooth service must be disabled.
  811. bash $STIG_TESTS_DIR/check-services.sh bluetooth >/dev/null 2>&1 &
  812. stig_spinner $!
  813. output "V-38691" $? ${SETLANG}
  814. ################
  815. ##RHEL-06-000335
  816. ##The operating system must manage information system identifiers for users and devices by disabling the user identifier after an organization defined time period of inactivity.
  817. bash $STIG_TESTS_DIR/check-inactive.sh >/dev/null 2>&1 &
  818. stig_spinner $!
  819. output "V-38694" $? ${SETLANG}
  820. ################
  821. ##RHEL-06-000336
  822. ##The sticky bit must be set on all public directories.
  823. bash $STIG_TESTS_DIR/check-sticky-bit.sh >/dev/null 2>&1 &
  824. stig_spinner $!
  825. output "V-38697" $? ${SETLANG}
  826. ################
  827. ##RHEL-06-000337
  828. ##All public directories must be owned by a system account.
  829. bash $STIG_TESTS_DIR/check-public-dir-owned.sh >/dev/null 2>&1 &
  830. stig_spinner $!
  831. output "V-38699" $? ${SETLANG}
  832. ################
  833. ##RHEL-06-000345
  834. ##The system default umask in /etc/login.defs must be 077.
  835. ##For more detial :http://stackoverflow.com/questions/10220531/how-to-set-system-wide-umask
  836. sed -e '/^#/d' -e '/^[ \t][ \t]*#/d' -e 's/#.*$//' -e '/^$/d' /etc/login.defs | grep -i "umask.*077" >/dev/null 2>&1 &
  837. stig_spinner $!
  838. output "V-38645" $? ${SETLANG}
  839. ################
  840. ##RHEL-06-000346
  841. ##The system default umask for daemons must be 027 or 022.
  842. ##For more detial :http://unix.stackexchange.com/questions/36220/how-to-set-umask-for-a-system-user
  843. sed -e '/^#/d' -e '/^[ \t][ \t]*#/d' -e 's/#.*$//' -e '/^$/d' /etc/init.d/rc | grep -i "umask.*027\|umask.*022" >/dev/null 2>&1 &
  844. stig_spinner $!
  845. output "V-38646" $? ${SETLANG}
  846. ################
  847. ##RHEL-06-000347
  848. ##There must be no .netrc files on the system.
  849. bash $STIG_TESTS_DIR/check-netrc.sh >/dev/null 2>&1 &
  850. stig_spinner $!
  851. output "V-38619" $? ${SETLANG}
  852. ################
  853. ##RHEL-06-000356
  854. ##The system must require administrator action to unlock an account locked by excessive failed login attempts.
  855. bash $STIG_TESTS_DIR/check-password.sh /etc/pam.d/common-auth pam_tally unlock_time lt 604800 > /dev/null 2>&1 &
  856. stig_spinner $!
  857. output "V-38592" $? ${SETLANG}
  858. ################
  859. ##RHEL-06-000372
  860. ##The operating system, upon successful logon/access, must display to the user the number of unsuccessful logon/access attempts since the last successful logon/access.
  861. sed -e '/^#/d' -e '/^[ \t][ \t]*#/d' -e 's/#.*$//' -e '/^$/d' /etc/pam.d/common-session | grep -i "pam_lastlog.so.*showfailed" > /dev/null 2>&1 &
  862. stig_spinner $!
  863. output "V-38501" $? ${SETLANG}
  864. ################
  865. ##RHEL-06-000507
  866. ##The operating system, upon successful logon, must display to the user the date and time of the last logon or access via ssh.
  867. sed -e '/^#/d' -e '/^[ \t][ \t]*#/d' -e 's/#.*$//' -e '/^$/d' /etc/ssh/sshd_config | grep -i "^PrintLastLog.*yes" > /dev/null 2>&1 &
  868. stig_spinner $!
  869. output "V-38484" $? ${SETLANG}
  870. ################
  871. ##RHEL-06-000514
  872. ##The package management tool must cryptographically verify the authenticity of all software packages during installation.
  873. bash $STIG_TESTS_DIR/check-apt-gpg.sh > /dev/null 2>&1 &
  874. stig_spinner $!
  875. output "V-38462" $? ${SETLANG}
  876. ################
  877. ##RHEL-06-000515
  878. ##The NFS server must not have the all_squash option enabled.
  879. bash $STIG_TESTS_DIR/check-nfs-all-squash.sh > /dev/null 2>&1 &
  880. stig_spinner $!
  881. output "V-38460" $? ${SETLANG}
  882. ################
  883. ##RHEL-06-000521
  884. ##The mail system must forward all mail for root to one or more system administrators.
  885. postmap -q root `postconf alias_maps | awk -F '=' '{print $2}'` > /dev/null 2>&1 &
  886. stig_spinner $!
  887. output "V-38446" $? ${SETLANG}
  888. ################
  889. ##RHEL-06-000523
  890. ##The systems local IPv6 firewall must implement a deny-all, allow-by-exception policy for inbound packets.
  891. ip6tables -L INPUT | head -n1 | grep "INPUT.*DROP" > /dev/null 2>&1 &
  892. stig_spinner $!
  893. output "V-38444" $? ${SETLANG}
  894. ################
  895. ##RHEL-06-000526
  896. ##Automated file system mounting tools must not be enabled unless needed.
  897. bash $STIG_TESTS_DIR/check-services.sh autofs >/dev/null 2>&1 &
  898. stig_spinner $!
  899. output "V-38437" $? ${SETLANG}
  900. ################
  901. ##RHEL-06-000528
  902. ##The noexec option must be added to the /tmp partition.
  903. sed -e '/^#/d' -e '/^[ \t][ \t]*#/d' -e 's/#.*$//' -e '/^$/d' /etc/fstab | grep "/tmp.*noexec" >/dev/null 2>&1 &
  904. stig_spinner $!
  905. output "V-57569" $? ${SETLANG}
  906. ################
  907. ##RHEL-06-000529
  908. ##The sudo command must require authentication.
  909. bash $STIG_TESTS_DIR/check-sudo.sh >/dev/null 2>&1 &
  910. stig_spinner $!
  911. output "V-58901" $? ${SETLANG}
  912. ################
  913. echo ''
  914. echo "Passes: $PASSES"
  915. echo "Fails: $FAILS"
  916. if [ $FAILS -gt 0 ]; then
  917. exit 792353
  918. fi
  919. }
  920. while [[ $# > 1 ]]
  921. do
  922. key="$1"
  923. case $key in
  924. -h|--help)
  925. show_help
  926. ;;
  927. -s|--stig)
  928. RUN_STIG=1
  929. ;;
  930. *)
  931. # unknown option
  932. ;;
  933. esac
  934. shift
  935. done
  936. echo $'Running tests'
  937. test_app_functions
  938. test_unique_onion_ports
  939. test_stig
  940. echo $'All tests passed'
  941. exit 0