mirrors/meta-security
1
0
Fork 0
mirror of https://git.yoctoproject.org/meta-security synced 2026-01-11 15:00:34 +00:00
Code Issues Projects Releases Wiki Activity
Files
60d90b25631471e8193b3069c6a520ccf7c82008
meta-security/recipes-security/bastille/files/HPSpecific.pm
Andrei Dinu 60d90b2563 meta-security : initial commit 
Signed-off-by: Andrei Dinu <andrei.adrianx.dinu@intel.com>
2013-06-17 17:24:38 +03:00

1984 lines
72 KiB
Perl
Raw Blame History

package Bastille::API::HPSpecific;
use strict;
use Bastille::API;
use Bastille::API::FileContent;
require Exporter;
our @ISA = qw(Exporter);
our @EXPORT_OK = qw(
getIPFLocation
getGlobalSwlist
B_check_system
B_swmodify
B_load_ipf_rules
B_Schedule
B_ch_rc
B_set_value
B_chperm
B_install_jail
B_list_processes
B_list_full_processes
B_deactivate_inetd_service
B_get_rc
B_set_rc
B_chrootHPapache
isSystemTrusted
isTrustedMigrationAvailable
checkServiceOnHPUX
B_get_path
convertToTrusted
isOKtoConvert
convertToShadow
getSupportedSettings
B_get_sec_value
secureIfNoNameService
isUsingRemoteNameService
remoteServiceCheck
remoteNISPlusServiceCheck
B_create_nsswitch_file
B_combine_service_results
%priorBastilleNDD
%newNDD
);
our @EXPORT = @EXPORT_OK;
# "Constants" for use both in testing and in lock-down
our %priorBastilleNDD = (
"ip_forward_directed_broadcasts" =>["ip", "0"],
"ip_forward_src_routed" =>["ip", "0"],
"ip_forwarding" =>["ip", "0"],
"ip_ire_gw_probe" =>["ip", "0"],
"ip_pmtu_strategy" =>["ip", "1"],
"ip_respond_to_echo_broadcast" =>["ip", "0"],
"ip_send_redirects" =>["ip", "0"],
"ip_send_source_quench" =>["ip", "0"],
"tcp_syn_rcvd_max" =>["tcp","1000"],
"tcp_conn_request_max" =>["tcp","4096"] );
our %newNDD = (
"ip_forward_directed_broadcasts" =>["ip", "0"],
"ip_forward_src_routed" =>["ip", "0"],
"ip_forwarding" =>["ip", "0"],
"ip_ire_gw_probe" =>["ip", "0"],
"ip_pmtu_strategy" =>["ip", "1"],
"ip_respond_to_echo_broadcast" =>["ip", "0"],
"ip_send_redirects" =>["ip", "0"],
"ip_send_source_quench" =>["ip", "0"],
"tcp_syn_rcvd_max" =>["tcp","4096"],
"tcp_conn_request_max" =>["tcp","4096"],
"arp_cleanup_interval" =>["arp","60000"],
"ip_respond_to_timestamp" =>["ip", "0"],
"ip_respond_to_timestamp_broadcast" => ["ip","0"] );
####################################################################
#
# This module makes up the HP-UX specific API routines.
#
####################################################################
#
# Subroutine Listing:
# &HP_ConfigureForDistro: adds all used file names to global
# hashes and generates a global IPD
# hash for SD modification lookup.
#
# &getGlobalSwlist($): Takes a fully qualified file name
# and returns product:filset info
# for that file. returns undef if
# the file is not present in the IPD
#
# &B_check_system: Runs a series of system queries to
# determine if Bastille can be safely
# ran on the current system.
#
# &B_swmodify($): Takes a file name and runs the
# swmodify command on it so that the
# IPD is updated after changes
#
# &B_System($$): Takes a system command and the system
# command that should be used to revert
# whatever was done. Returns 1 on
# success and 0 on failure
#
# &B_Backtick($) Takes a command to run and returns its stdout
# to be used in place of the prior prevelent use
# of un-error-handled backticks
#
# &B_load_ipf_rules($): Loads a set of ipfrules into ipf, storing
# current rules for later reversion.
#
# &B_Schedule($$): Takes a pattern and a crontab line.
# Adds or replaces the crontab line to
# the crontab file, depending on if a
# line matches the pattern
#
# &B_ch_rc($$): Takes a the rc.config.d flag name and
# new value as well as the init script
# location. This will stop a services
# and set the service so that it will
# not be restarted.
#
# &B_set_value($$$): Takes a param, value, and a filename
# and sets the given value in the file.
# Uses ch_rc, but could be rewritten using
# Bastille API calls to make it work on Linux
#
# &B_TODO($): Appends the give string to the TODO.txt
# file.
#
# &B_chperm($$$$): Takes new perm owner and group of given
# file. TO BE DEPRECATED!!!
#
# &B_install_jail($$): Takes the jail name and the jail config
# script location for a give jail...
# These scripts can be found in the main
# directory e.g. jail.bind.hpux
#
#####################################################################
##############################################################################
#
# HP-UX Bastille directory structure
#
##############################################################################
#
# /opt/sec_mgmt/bastille/bin/ -- location of Bastille binaries
# /opt/sec_mgmt/bastille/lib/ -- location of Bastille modules
# /opt/sec_mgmt/bastille/doc/ -- location of Bastille doc files
#
# /etc/opt/sec_mgmt/bastille/ -- location of Bastille config files
#
# /var/opt/sec_mgmt/bastille/log -- location of Bastille log files
# /var/opt/sec_mgmt/bastille/revert -- directory holding all Bastille-
# created revert scripts
# /var/opt/sec_mgmt/bastille/revert/backup -- directory holding the original
# files that Bastille modifies,
# with permissions intact
#
##############################################################################
sub getIPFLocation () { # Temporary until we get defined search space support
my $ipf=&getGlobal('BIN','ipf_new');
my $ipfstat=&getGlobal('BIN','ipfstat_new');
if (not(-e $ipf)) { # Detect if the binaries moved
$ipf = &getGlobal('BIN','ipf');
$ipfstat=&getGlobal('BIN','ipfstat');
}
return ($ipf, $ipfstat);
}
##############################################
# Given a combination of service results, provided
# in an array, this function combines the result into
# a reasonable aggregate result
##############################################
sub B_combine_service_results(@){
my @results = @_;
#TODO: Consider greater sophistication wrt inconsistent, or not installed.
foreach my $result (@results) {
if (not(($result == SECURE_CAN_CHANGE) or
($result == SECURE_CANT_CHANGE) or
($result == NOT_INSTALLED()))) {
return NOTSECURE_CAN_CHANGE();
}
}
return SECURE_CANT_CHANGE();
}
####################################################################
# &getGlobalSwlist ($file);
# This function returns the product and fileset information for
# a given file or directory if it exists in the IPD otherwise
# it returns undefined "undef"
#
# uses $GLOBAL_SWLIST{"$FILE"}
####################################################################
sub getGlobalSwlist($){
no strict;
my $file = $_[0];
if(! %GLOBAL_SWLIST) {
# Generating swlist database for swmodify changes that will be required
# The database will be a hash of fully qualified file names that reference
# the files product name and fileset. These values are required to use
# swmodify...
# Files tagged 'is_volatile' in the IPD are not entered in the swlist database
# in order to avoid invoking swmodify if the file is changed later. Attempting to
# swmodify 'volatile' files is both unneccessary and complicated since swverify will
# not evaluate volatile files anyway, and adding another value to the swlist database
# would require complex code changes.
# temp variable to keep swlist command /usr/sbin/swlist
my $swlist = &getGlobal('BIN',"swlist");
# listing of each directory and file that was installed by SD on the target machine
my @fileList = `$swlist -a is_volatile -l file`;
# listing of each patch and the patches that supersede each.
# hash which is indexed by patch.fileset on the system
my %patchSuperseded;
my @patchList = `${swlist} -l fileset -a superseded_by *.*,c=patch 2>&1`;
# check to see if any patches are present on the system
if(($? >> 8) == 0) {
# determining patch suppression for swmodify.
foreach my $patchState (@patchList) {
# removing empty lines and commented lines.
if($patchState !~ /^\s*\#/ && $patchState !~ /^\s*$/) {
# removing leading white space
$patchState =~ s/^\s+//;
my @patches = split /\s+/, $patchState;
if($#patches == 0){
# patch is not superseded
$patchSuperseded{$patches[0]} = 0;
}
else {
# patch is superseded
$patchSuperseded{$patches[0]} = 1;
}
}
}
}
else {
&B_log("DEBUG","No patches found on the system.\n");
}
if($#fileList >= 0){
# foreach line of swlist output
foreach my $fileEntry ( @fileList ){
#filter out commented portions
if( $fileEntry !~ /^\s*\#/ ){
chomp $fileEntry;
# split the output into three fields: product.fileset, filename, flag_isvolatile
my( $productInfo, $file, $is_volatile ) = $fileEntry =~ /^\s*(\S+): (\S+)\t(\S+)/ ;
# do not register volatile files
next if ($is_volatile =~ /true/); # skip to next file entry
$productInfo =~ s/\s+//;
$file =~ s/\s+//;
# if the product is a patch
if($productInfo =~ /PH(CO|KL|NE|SS)/){
# if the patch is not superseded by another patch
if($patchSuperseded{$productInfo} == 0){
# add the patch to the list of owner for this file
push @{$GLOBAL_SWLIST{"$file"}}, $productInfo;
}
}
# not a patch.
else {
# add the product to the list of owners for this file
push @{$GLOBAL_SWLIST{"$file"}}, $productInfo;
}
}
}
}
else{
# defining GLOBAL_SWLIST in error state.
$GLOBAL_SWLIST{"ERROR"} = "ERROR";
&B_log("ERROR","Could not execute swlist. Swmodifys will not be attempted");
}
}
if(exists $GLOBAL_SWLIST{"$file"}){
return $GLOBAL_SWLIST{"$file"};
}
else {
return undef;
}
}
###################################################################
# &B_check_system;
# This subroutine is called to validate that bastille may be
# safely run on the current system. It will check to insure
# that there is enough file system space, mounts are rw, nfs
# mounts are not mounted noroot, and swinstall, swremove and
# swmodify are not running
#
# uses ErrorLog
#
##################################################################
sub B_check_system {
# exitFlag is one if a conflict with the successful execution
# of bastille is found.
my $exitFlag = 0;
my $ignoreCheck = &getGlobal("BDIR","config") . "/.no_system_check";
if( -e $ignoreCheck ) {
return $exitFlag;
}
# first check for swinstall, swmodify, or swremove processes
my $ps = &getGlobal('BIN',"ps") . " -el";
my @processTable = `$ps`;
foreach my $process (@processTable) {
if($process =~ /swinstall/ ) {
&B_log("ERROR","Bastille cannot run while a swinstall is in progress.\n" .
"Complete the swinstall operation and then run Bastille.\n\n");
$exitFlag = 1;
}
if($process =~ /swremove/ ) {
&B_log("ERROR","Bastille cannot run while a swremove is in progress.\n" .
"Complete the swremove operation and then run Bastille.\n\n");
$exitFlag = 1;
}
if($process =~ /swmodify/ ) {
&B_log("ERROR","Bastille cannot run while a swmodify is in progress.\n" .
"Complete the swmodify operation and then run Bastille.\n\n");
$exitFlag = 1;
}
}
# check for root read only mounts for /var /etc /stand /
# Bastille is required to make changes to these file systems.
my $mount = &getGlobal('BIN',"mount");
my $rm = &getGlobal('BIN',"rm");
my $touch = &getGlobal('BIN',"touch");
my @mnttab = `$mount`;
if(($? >> 8) != 0) {
&B_log("WARNING","Unable to use $mount to determine if needed partitions\n" .
"are root writable, based on disk mount options.\n" .
"Bastille will continue but note that disk\n" .
"mount checks were skipped.\n\n");
}
else {
foreach my $record (@mnttab) {
my @fields = split /\s+/, $record;
if ((defined $fields[0]) && (defined $fields[2]) && (defined $fields[3])) {
my $mountPoint = $fields[0];
my $mountType = $fields[2];
my $mountOptions = $fields[3];
# checks for /stand and /var/* removed
if($mountPoint =~ /^\/$|^\/etc|^\/var$/) {
if($mountOptions =~ /^ro,|,ro,|,ro$/) {
&B_log("ERROR","$mountPoint is mounted read-only. Bastille needs to make\n" .
"modifications to this file system. Please remount\n" .
"$mountPoint read-write and then run Bastille again.\n\n");
$exitFlag = 1;
}
# looking for an nfs mounted file system
if($mountType =~/.+:\//){
my $fileExisted=0;
if(-e "$mountPoint/.bastille") {
$fileExisted=1;
}
`$touch $mountPoint/.bastille 1>/dev/null 2>&1`;
if( (! -e "$mountPoint/.bastille") || (($? >> 8) != 0) ) {
&B_log("ERROR","$mountPoint is an nfs mounted file system that does\n" .
"not allow root to write to. Bastille needs to make\n" .
"modifications to this file system. Please remount\n" .
"$mountPoint giving root access and then run Bastille\n" .
"again.\n\n");
$exitFlag = 1;
}
# if the file did not exist befor the touch then remove the generated file
if(! $fileExisted) {
`$rm -f $mountPoint/.bastille 1>/dev/null 2>&1`;
}
}
}
}
else {
&B_log("WARNING","Unable to use $mount to determine if needed partitions\n" .
"are root writable, based on disk mount options.\n" .
"Bastille will continue but note that disk\n" .
"mount checks were skipped.\n\n");
}
}
}
# checks for enough disk space in directories that Bastille writes to.
my $bdf = &getGlobal('BIN',"bdf");
#directories that Bastille writes to => required space in kilobytes.
my %bastilleDirs = ( "/etc/opt/sec_mgmt/bastille" => "4", "/var/opt/sec_mgmt/bastille"=> "1000");
for my $directory (sort keys %bastilleDirs) {
my @diskUsage = `$bdf $directory`;
if(($? >> 8) != 0) {
&B_log("WARNING","Unable to use $bdf to determine disk usage for\n" .
"$directory\n" .
"Bastille will continue but note that disk\n" .
"usage checks were skipped.\n\n");
}
else {
# removing bdf header line from usage information.
shift @diskUsage;
my $usageString= "";
foreach my $usageRecord (@diskUsage) {
chomp $usageRecord;
$usageString .= $usageRecord;
}
$usageString =~ s/^\s+//;
my @fields = split /\s+/, $usageString;
if($#fields != 5) {
&B_log("WARNING","Unable to use $bdf to determine disk usage for\n" .
"$directory\n" .
"Bastille will continue but note that disk\n" .
"usage checks were skipped.\n\n");
}
else {
my $mountPoint = $fields[5];
my $diskAvail = $fields[3];
if($diskAvail <= $bastilleDirs{"$directory"}) {
&B_log("ERROR","$mountPoint does not contain enough available space\n" .
"for Bastille to run properly. $directory needs\n" .
"at least $bastilleDirs{$directory} kilobytes of space.\n" .
"Please clear at least that amount of space from\n" .
"$mountPoint and run Bastille again.\n" .
"Current Free Space available = ${diskAvail} k\n\n");
$exitFlag = 1;
}
}
}
}
# check to make sure that we are in at least run level 2 before we attempt to run
my $who = &getGlobal('BIN', "who") . " -r";
my $levelInfo = `$who`;
if(($? >> 8) != 0 ) {
&B_log("WARNING","Unable to use \"$who\" to determine system run.\n" .
"level Bastille will continue but note that the run\n" .
"level check was skipped.\n\n");
}
else {
chomp $levelInfo;
my @runlevel = split /\s+/, $levelInfo;
if ((! defined $runlevel[3]) or ($runlevel[3] < 2)) {
&B_log("WARNING","Bastille requires a run-level of 2 or more to run properly.\n" .
"Please move your system to a higher run level and then\n" .
"run 'bastille -b'.\n\n");
if(defined $runlevel[3]) {
&B_log("ERROR","Current run-level is '$runlevel[3]'.\n\n");
$exitFlag=1;
}
else {
&B_log("WARNING","Unable to use \"$who\" to determine system run.\n" .
"level Bastille will continue but note that the run\n" .
"level check was skipped.\n\n");
}
}
else {
&B_log("DEBUG","System run-level is $runlevel[3]\n");
}
}
if($exitFlag) {
exit(1);
}
}
###################################################################
# &B_swmodify($file);
# This subroutine is called after a file is modified. It will
# redefine the file in the IPD with it's new properties. If
# the file is not in the IPD it does nothing.
#
# uses B_System to make the swmodifications.
##################################################################
sub B_swmodify($){
my $file = $_[0];
if(defined &getGlobalSwlist($file)){
my $swmodify = &getGlobal('BIN',"swmodify");
my @productsInfo = @{&getGlobalSwlist($file)};
# running swmodify on files that were altered by this function but
# were created and maintained by SD
foreach my $productInfo (@productsInfo) {
&B_System("$swmodify -x files='$file' $productInfo",
"$swmodify -x files='$file' $productInfo");
}
}
}
####################################################################
# &B_load_ipf_rules($ipfruleset);
# This function enables an ipfruleset. It's a little more
# specific than most API functions, but necessary because
# ipf doesn't return correct exit codes (syntax error results
# in a 0 exit code)
#
# uses ActionLog and ErrorLog to log
# calls crontab directly (to list and to read in new jobs)
###################################################################
sub B_load_ipf_rules ($) {
my $ipfruleset=$_[0];
&B_log("DEBUG","# sub B_load_ipf_rules");
# TODO: grab ipf.conf dynamically from the rc.config.d files
my $ipfconf = &getGlobal('FILE','ipf.conf');
# file system changes - these are straightforward, and the API
# will take care of the revert
&B_create_file($ipfconf);
&B_blank_file($ipfconf, 'a$b');
&B_append_line($ipfconf, 'a$b', $ipfruleset);
# runtime changes
# define binaries
my $grep = &getGlobal('BIN', 'grep');
my ($ipf, $ipfstat) = &getIPFLocation;
# create backup rules
# This will exit with a non-zero exit code because of the grep
my @oldrules = `$ipfstat -io 2>&1 | $grep -v empty`;
my @errors=`$ipf -I -Fa -f $ipfconf 2>&1`;
if(($? >> 8) == 0) {
&B_set_rc("IPF_START","1");
&B_set_rc("IPF_CONF","$ipfconf");
# swap the rules in
&B_System("$ipf -s","$ipf -s");
# now create a "here" document with the previous version of
# the rules and put it into the revert-actions script
&B_revert_log("$ipf -I -Fa -f - <<EOF\n@{oldrules}EOF");
if (@errors) {
&B_log("ERROR","ipfilter produced the following errors when\n" .
" loading $ipfconf. You probably had an invalid\n" .
" rule in ". &getGlobal('FILE','customipfrules') ."\n".
"@errors\n");
}
} else {
&B_log("ERROR","Unable to run $ipf\n");
}
}
####################################################################
# &B_Schedule($pattern,$cronjob);
# This function schedules a cronjob. If $pattern exists in the
# crontab file, that job will be replaced. Otherwise, the job
# will be appended.
#
# uses ActionLog and ErrorLog to log
# calls crontab directly (to list and to read in new jobs)
###################################################################
sub B_Schedule ($$) {
my ($pattern,$cronjob)=@_;
$cronjob .= "\n";
&B_log("DEBUG","# sub B_Schedule");
my $crontab = &getGlobal('BIN','crontab');
my @oldjobs = `$crontab -l 2>/dev/null`;
my @newjobs;
my $patternfound=0;
foreach my $oldjob (@oldjobs) {
if (($oldjob =~ m/$pattern/ ) and (not($patternfound))) {
push @newjobs, $cronjob;
$patternfound=1;
&B_log("ACTION","changing existing cron job which matches $pattern with\n" .
"$cronjob");
} elsif ($oldjob !~ m/$pattern/ ) {
&B_log("ACTION","keeping existing cron job $oldjob");
push @newjobs, $oldjob;
} #implied: else if pattern matches, but we've
#already replaced one, then toss the others.
}
unless ($patternfound) {
&B_log("ACTION","adding cron job\n$cronjob\n");
push @newjobs, $cronjob;
}
if(open(CRONTAB, "|$crontab - 2> /dev/null")) {
print CRONTAB @newjobs;
# now create a "here" document with the previous version of
# the crontab file and put it into the revert-actions script
&B_revert_log("$crontab <<EOF\n" . "@oldjobs" . "EOF");
close CRONTAB;
}
# Now check to make sure it happened, since cron will exit happily
# (retval 0) with no changes if there are any syntax errors
my @editedjobs = `$crontab -l 2>/dev/null`;
if (@editedjobs ne @newjobs) {
&B_log("ERROR","failed to add cron job:\n$cronjob\n" .
" You probably had an invalid crontab file to start with.");
}
}
#This function turns off a service, given a service name defined in HP-UX.service
sub B_ch_rc($) {
my ($service_name)=@_;
if (&GetDistro != "^HP-UX") {
&B_log("ERROR","Tried to call ch_rc $service_name on a non-HP-UX\n".
" system! Internal Bastille error.");
return undef;
}
my $configfile="";
my $command = &getGlobal('BIN', 'ch_rc');
my $startup_script=&getGlobal('DIR','initd') . "/". $service_name;
my @rc_parameters= @{ &getGlobal('SERVICE',$service_name) };
my @rcFiles=@{ &getGlobal('RCCONFIG',$service_name) };
my $rcFile='';
if (@rcFiles == 1){
$rcFile=$rcFiles[0];
} else {
&B_log("FATAL","Multiple RC Files not yet supported... internal error.");
}
# if the service-related process is not run, and the control variable is stilll 1
# there is a inconsistency. in this case we only need to change the control variable
my @psnames=@{ &getGlobal('PROCESS',$service_name)};
my @processes;
foreach my $psname (@psnames) {
$psname .= '\b'; # avoid embedded match; anchor search pattern to trailing word boundry
my @procList = &isProcessRunning($psname);
if(@procList >= 0){
splice @processes,$#processes+1,0,@procList;
}
}
#Actually set the rc variable
foreach my $rcVariable (@rc_parameters){
my $orig_value = &B_get_rc($rcVariable);
if ($orig_value eq "" ) { #If variable not set, used the defined file
$configfile=&getGlobal("DIR","rc.config.d") . "/" . $rcFile;
if (not( -f $configfile )) {
&B_create_file($configfile);
}
}
&B_log("DEBUG","In B_ch_rc (no procs), setting $rcVariable to 0 in $configfile" .
", with an original value of $orig_value with rcfile: $rcFile");
if ( ! @processes) { # IF there are no processes we don't neet to perform a "stop"
&B_set_rc($rcVariable, "0", $configfile);
} else {
if ( $orig_value !~ "1" ) { #If param is not already 1, the "stop" script won't work
&B_set_rc($rcVariable, "1",$configfile);
}
&B_System ($startup_script . " stop", #stop service, then restart if the user runs bastille -r
$startup_script . " start");
# set parameter, so that service will stay off after reboots
&B_set_rc($rcVariable, "0", $configfile);
}
}
}
# This routine sets a value in a given file
sub B_set_value($$$) {
my ($param, $value, $file)=@_;
&B_log("DEBUG","B_set_value: $param, $value, $file");
if (! -e $file ) {
&B_create_file("$file");
}
# If a value is already set to something other than $value then reset it.
#Note that though this tests for "$value ="the whole line gets replaced, so
#any pre-existing values are also replaced.
&B_replace_line($file,"^$param\\s*=\\s*","$param=$value\n");
# If the value is not already set to something then set it.
&B_append_line($file,"^$param\\s*=\\s*$value","$param=$value\n");
}
##################################################################################
# &B_chperm($owner,$group,$mode,$filename(s))
# This function changes ownership and mode of a list of files. Takes four
# arguments first the owner next the group and third the new mode in oct and
# last a list of files that the permissions changes should take affect on.
#
# uses: &swmodify and &B_revert_log
##################################################################################
sub B_chperm($$$$) {
my ($newown, $newgrp, $newmode, $file_expr) = @_;
my @files = glob($file_expr);
my $return = 1;
foreach my $file (@files){
my @filestat = stat $file;
my $oldmode = (($filestat[2]/512) % 8) .
(($filestat[2]/64) % 8) .
(($filestat[2]/8) % 8) .
(($filestat[2]) % 8);
if((chown $newown, $newgrp, $file) != 1 ){
&B_log("ERROR","Could not change ownership of $file to $newown:$newgrp\n");
$return = 0;
}
else{
&B_log("ACTION","Changed ownership of $file to $newown:$newgrp\n");
# swmodifying file if possible...
&B_swmodify($file);
&B_revert_log(&getGlobal('BIN',"chown") . " $filestat[4]:$filestat[5] $file\n");
}
my $newmode_formatted=sprintf "%5lo",$newmode;
if((chmod $newmode, $file) != 1){
&B_log("ERROR","Could not change mode of $file to $newmode_formatted\n");
$return = 0;
}
else{
&B_log("ACTION","Changed mode of $file to $newmode_formatted\n");
&B_revert_log(&getGlobal('BIN',"chmod") . " $oldmode $file\n");
}
}
return $return;
}
############################################################################
# &B_install_jail($jailname, $jailconfigfile);
# This function takes two arguments ( jail_name, jail_config )
# It's purpose is to take read in config files that define a
# chroot jail and then generate it bases on that specification
############################################################################
sub B_install_jail($$) {
my $jailName = $_[0]; # Name of the jail e.g bind
my $jailConfig = $_[1]; # Name of the jails configuration file
# create the root directory of the jail if it does not exist
&B_create_dir( &getGlobal('BDIR','jail'));
&B_chperm(0,0,0555,&getGlobal('BDIR','jail'));
# create the Jail dir if it does not exist
&B_create_dir( &getGlobal('BDIR','jail') . "/" . $jailName);
&B_chperm(0,0,0555,&getGlobal('BDIR','jail') . "/". $jailName);
my $jailPath = &getGlobal('BDIR','jail') . "/" . $jailName;
my @lines; # used to store no commented no empty config file lines
# open configuration file for desired jail and parse in commands
if(open(JAILCONFIG,"< $jailConfig")) {
while(my $line=<JAILCONFIG>){
if($line !~ /^\s*\#|^\s*$/){
chomp $line;
push(@lines,$line);
}
}
close JAILCONFIG;
}
else{
&B_log("ERROR","Open Failed on filename: $jailConfig\n");
return 0;
}
# read through commands and execute
foreach my $line (@lines){
&B_log("ACTION","Install jail: $line\n");
my @confCmd = split /\s+/,$line;
if($confCmd[0] =~ /dir/){ # if the command say to add a directory
if($#confCmd == 4) { # checking dir Cmd form
if(! (-d $jailPath . "/" . $confCmd[1])){
#add a directory and change its permissions according
#to the conf file
&B_create_dir( $jailPath . "/" . $confCmd[1]);
&B_chperm((getpwnam($confCmd[3]))[2],
(getgrnam($confCmd[4]))[2],
oct($confCmd[2]),
$jailPath . "/" . $confCmd[1]);
}
}
else {
&B_log("ERROR","Badly Formed Configuration Line:\n$line\n\n");
}
}
elsif($confCmd[0] =~ /file/) {
if($#confCmd == 5) { # checking file cmd form
if(&B_cp($confCmd[1],$jailPath . "/" . $confCmd[2])){
# for copy command cp file and change perms
&B_chperm($confCmd[4],$confCmd[5],oct($confCmd[3]),$jailPath . "/" . $confCmd[2]);
}
else {
&B_log("ERROR","Could not complete copy on specified files:\n" .
"$line\n");
}
}
else {
&B_log("ERROR","Badly Formed Configuration Line:\n" .
"$line\n\n");
}
}
elsif($confCmd[0] =~ /slink/) {
if($#confCmd == 2) { # checking file cmd form
if(!(-e $jailPath . "/" . $confCmd[2])){
#for symlink command create the symlink
&B_symlink($jailPath . "/" . $confCmd[1], $confCmd[2]);
}
}
else {
&B_log("ERROR","Badly Formed Configuration Line:\n" .
"$line\n\n");
}
}
else {
&B_log("ERROR","Unrecognized Configuration Line:\n" .
"$line\n\n");
}
}
return 1;
}
###########################################################################
# &B_list_processes($service) #
# #
# This subroutine uses the GLOBAL_PROCESS hash to determine if a #
# service's corresponding processes are running on the system. #
# If any of the processes are found to be running then the process #
# name(s) is/are returned by this subroutine in the form of an list #
# If none of the processes that correspond to the service are running #
# then an empty list is returned. #
###########################################################################
sub B_list_processes($) {
# service name
my $service = $_[0];
# list of processes related to the service
my @processes=@{ &getGlobal('PROCESS',$service)};
# current systems process information
my $ps = &getGlobal('BIN',"ps");
my $psTable = `$ps -elf`;
# the list to be returned from the function
my @running_processes;
# for every process associated with the service
foreach my $process (@processes) {
# if the process is in the process table then
if($psTable =~ m/$process/) {
# add the process to the list, which will be returned
push @running_processes, $process;
}
}
# return the list of running processes
return @running_processes;
}
#############################################################################
# &B_list_full_processes($service) #
# #
# This subroutine simply grep through the process table for those matching #
# the input argument TODO: Allow B_list process to levereage this code #
# ... Not done this cycle to avoid release risk (late in cycle) #
#############################################################################
sub B_list_full_processes($) {
# service name
my $procName = $_[0];
my $ps = &getGlobal('BIN',"ps");
my @psTable = split(/\n/,`$ps -elf`);
# for every process associated with the service
my @runningProcessLines = grep(/$procName/ , @psTable);
# return the list of running processes
return @runningProcessLines;
}
################################################################################
# &B_deactivate_inetd_service($service); #
# #
# This subroutine will disable all inetd services associated with the input #
# service name. Service name must be a reference to the following hashes #
# GLOBAL_SERVICE GLOBAL_SERVTYPE and GLOBAL_PROCESSES. If processes are left #
# running it will note these services in the TODO list as well as instruct the#
# user in how they remaining processes can be disabled. #
################################################################################
sub B_deactivate_inetd_service($) {
my $service = $_[0];
my $servtype = &getGlobal('SERVTYPE',"$service");
my $inetd_conf = &getGlobal('FILE',"inetd.conf");
# check the service type to ensure that it can be configured by this subroutine.
if($servtype ne 'inet') {
&B_log("ACTION","The service \"$service\" is not an inet service so it cannot be\n" .
"configured by this subroutine\n");
return 0;
}
# check for the inetd configuration files existence so it may be configured by
# this subroutine.
if(! -e $inetd_conf ) {
&B_log("ACTION","The file \"$inetd_conf\" cannot be located.\n" .
"Unable to configure inetd\n");
return 0;
}
# list of service identifiers present in inetd.conf file.
my @inetd_entries = @{ &getGlobal('SERVICE',"$service") };
foreach my $inetd_entry (@inetd_entries) {
&B_hash_comment_line($inetd_conf, "^\\s*$inetd_entry");
}
# list of processes associated with this service which are still running
# on the system
my @running_processes = &B_list_processes($service);
if($#running_processes >= 0) {
my $todoString = "\n" .
"---------------------------------------\n" .
"Deactivating Inetd Service: $service\n" .
"---------------------------------------\n" .
"The following process(es) are associated with the inetd service \"$service\".\n" .
"They are most likely associated with a session which was initiated prior to\n" .
"running Bastille. To disable a process see \"kill(1)\" man pages or reboot\n" .
"the system\n" .
"Active Processes:\n" .
"###################################\n";
foreach my $running_process (@running_processes) {
$todoString .= "\t$running_process\n";
}
$todoString .= "###################################\n";
&B_TODO($todoString);
}
}
################################################################################
# B_get_rc($key); #
# #
# This subroutine will use the ch_rc binary to get rc.config.d variables #
# values properly escaped and quoted. #
################################################################################
sub B_get_rc($) {
my $key=$_[0];
my $ch_rc = &getGlobal('BIN',"ch_rc");
# get the current value of the given parameter.
my $currentValue=`$ch_rc -l -p $key`;
chomp $currentValue;
if(($? >> 8) == 0 ) {
# escape all meta characters.
# $currentValue =~ s/([\"\`\$\\])/\\$1/g;
# $currentValue = '"' . $currentValue . '"';
}
else {
return undef;
}
return $currentValue;
}
################################################################################
# B_set_rc($key,$value); #
# #
# This subroutine will use the ch_rc binary to set rc.config.d variables. As #
# well as setting the variable this subroutine will set revert strings. #
# #
################################################################################
sub B_set_rc($$;$) {
my ($key,$value,$configfile)=@_;
my $ch_rc = &getGlobal('BIN',"ch_rc");
# get the current value of the given parameter.
my $currentValue=&B_get_rc($key);
if(defined $currentValue ) {
if ($currentValue =~ /^\"(.*)\"$/ ) {
$currentValue = '"\"' . $1 . '\""';
}
if ($value =~ /^\"(.*)\"$/ ) {
$value = '"\"' . $1 . '\""';
}
if ( &B_System("$ch_rc -a -p $key=$value $configfile",
"$ch_rc -a -p $key=$currentValue $configfile") ) {
#ch_rc success
return 1;
}
else {
#ch_rc failure.
return 0;
}
}
else {
&B_log("ERROR","ch_rc was unable to lookup $key\n");
return 0;
}
}
################################################################################
# &ChrootHPApache($chrootScript,$httpd_conf,$httpd_bin,
# $apachectl,$apacheJailDir,$serverString);
#
# This subroutine given an chroot script, supplied by the vendor, a
# httpd.conf file, the binary location of httpd, the control script,
# the jail directory, and the servers identification string, descriptive
# string for TODO etc. It makes modifications to httpd.conf so that when
# Apache starts it will chroot itself into the jail that the above
# mentions script creates.
#
# uses B_replace_line B_create_dir B_System B_TODO
#
###############################################################################
sub B_chrootHPapache($$$$$$) {
my ($chrootScript,$httpd_conf,$httpd_bin,$apachectl,$apacheJailDir,$serverString)= @_;
my $exportpath = "export PATH=/usr/bin;";
my $ps = &getGlobal('BIN',"ps");
my $isRunning = 0;
my $todo_header = 0;
# checking for a 2.0 version of the apache chroot script.
if(-e $chrootScript ) {
if(open HTTPD, $httpd_conf) {
while (my $line = <HTTPD>){
if($line =~ /^\s*Chroot/) {
&B_log("DEBUG","Apache is already running in a chroot as specified by the following line:\n$line\n" .
"which appears in the httpd.conf file. No Apache Chroot action was taken.\n");
return;
}
}
close(HTTPD);
}
if(`$ps -ef` =~ $httpd_bin ) {
$isRunning=1;
&B_System("$exportpath " . $apachectl . " stop","$exportpath " . $apachectl . " start");
}
&B_replace_line($httpd_conf, '^\s*#\s*Chroot' ,
"Chroot " . $apacheJailDir);
if(-d &getGlobal('BDIR',"jail")){
&B_log("DEBUG","Jail directory already exists. No action taken.\n");
}
else{
&B_log("ACTION","Jail directory was created.\n");
&B_create_dir( &getGlobal('BDIR','jail'));
}
if(-d $apacheJailDir){
&B_log("DEBUG","$serverString jail already exists. No action taken.\n");
}
else{
&B_System(&getGlobal('BIN',"umask") . " 022; $exportpath " . $chrootScript,
&getGlobal('BIN',"echo") . " \"Your $serverString is now running outside of it's\\n" .
"chroot jail. You must manually migrate your web applications\\n" .
"back to your Apache server's httpd.conf defined location(s).\\n".
"After you have completed this, feel free to remove the jail directories\\n" .
"from your machine. Your apache jail directory is located in\\n" .
&getGlobal('BDIR',"jail") . "\\n\" >> " . &getGlobal('BFILE',"TOREVERT"));
}
if($isRunning){
&B_System("$exportpath " . $apachectl . " start","$exportpath " . $apachectl . " stop");
&B_log("ACTION","$serverString is now running in an chroot jail.\n");
}
&B_log("ACTION","The jail is located in " . $apacheJailDir . "\n");
if ($todo_header !=1){
&B_TODO("\n---------------------------------\nApache Chroot:\n" .
"---------------------------------\n");
}
&B_TODO("$serverString Chroot Jail:\n" .
"httpd.conf contains the Apache dependencies. You should\n" .
"review this file to ensure that the dependencies made it\n" .
"into the jail. Otherwise, you run a risk of your Apache server\n" .
"not having access to all its modules and functionality.\n");
}
}
sub isSystemTrusted {
my $getprdef = &getGlobal('BIN',"getprdef");
my $definition = &B_Backtick("$getprdef -t 2>&1");
if($definition =~ "System is not trusted.") {
return 0;
} else {
return 1;
}
}
sub isTrustedMigrationAvailable {
my $distroVersion='';
if (&GetDistro =~ '^HP-UX11.(\d*)') {
$distroVersion=$1;
if ($distroVersion < 23) { # Not available before 11.23
return 0; #FALSE
} elsif ($distroVersion >= 31) { #Bundled with 11.31 and after
&B_log('DEBUG','isTrustedMigrationAvailable: HP-UX 11.31 always has trusted mode extensions');
return 1;
} elsif ($distroVersion == 23) { # Optional on 11.23 if filesets installed
if ( -x &getGlobal('BIN',"userdbget") ) {
&B_log('DEBUG','isTrustedMigrationAvailable: Trusted Extensions Installed');
return 1;
} else {
&B_log('DEBUG','isTrustedMigrationAvailable: Trusted Extensions Not Installed');
return 0; #FALSE
}
} else {
&B_log('DEBUG','isTrustedMigrationAvailable: ' . &GetDistro .
' not currently supported for trusted extentions.');
return 0; #FALSE
}
} else {
&B_log('WARNING','isTrustedMigrationAvailable: HP-UX routine called on Linux system');
return 0; #FALSE
}
}
###########################################################################
# &checkServiceOnHPUX($service);
#
# Checks if the given service is running on an HP/UX system. This is
# called by B_is_Service_Off(), which is the function that Bastille
# modules should call.
#
# Return values:
# NOTSECURE_CAN_CHANGE() if the service is on
# SECURE_CANT_CHANGE() if the service is off
# INCONSISTENT() if the state of the service cannot be determined
# NOT_INSTALLED() if the s/w isn't insalled
#
###########################################################################
sub checkServiceOnHPUX($) {
my $service=$_[0];
# get the list of parameters which could be used to initiate the service
# (could be in /etc/rc.config.d, /etc/inetd.conf, or /etc/inittab, so we
# check all of them)
my @params= @{ &getGlobal('SERVICE',$service) };
my $grep =&getGlobal('BIN', 'grep');
my $inetd=&getGlobal('FILE', 'inetd.conf');
my $inittab=&getGlobal('FILE', 'inittab');
my $retVals;
my $startup=&getGlobal('DIR','initd') ;
my @inet_bins= @{ &getGlobal('PROCESS',$service) };
my $entry_found = 0;
&B_log("DEBUG","CheckHPUXservice: $service");
my $full_initd_path = $startup . "/" . $service;
if ($GLOBAL_SERVTYPE{$service} eq "rc") { # look for the init script in /sbin/init.d
if (not(-e $full_initd_path )) {
return NOT_INSTALLED();
}
} else { #inet-based service, so look for inetd.conf entries.
&B_log("DEBUG","Checking inet service $service");
my @inet_entries= @{ &getGlobal('SERVICE',$service) };
foreach my $service (@inet_entries) {
&B_log('DEBUG',"Checking for inetd.conf entry of $service in checkService on HPUX");
my $service_regex = '^[#\s]*' . $service . '\s+';
if ( &B_match_line($inetd, $service_regex) ) { # inet entry search
&B_log('DEBUG',"$service present, entry exists");
$entry_found = 1 ;
}
}
if ($entry_found == 0 ) {
return NOT_INSTALLED();
}
}
foreach my $param (@params) {
&B_log("DEBUG","Checking to see if service $service is off.\n");
if (&getGlobal('SERVTYPE', $service) =~ /rc/) {
my $ch_rc=&getGlobal('BIN', 'ch_rc');
my $on=&B_Backtick("$ch_rc -l -p $param");
$on =~ s/\s*\#.*$//; # remove end-of-line comments
$on =~ s/^\s*\"(.+)\"\s*$/$1/; # remove surrounding double quotes
$on =~ s/^\s*\'(.+)\'\s*$/$1/; # remove surrounding single quotes
$on =~ s/^\s*\"(.+)\"\s*$/$1/; # just in case someone did '"blah blah"'
chomp $on;
&B_log("DEBUG","ch_rc returned: $param=$on in checkServiceOnHPUX");
if ($on =~ /^\d+$/ && $on != 0) {
# service is on
&B_log("DEBUG","CheckService found $param service is set to \'on\' in scripts.");
return NOTSECURE_CAN_CHANGE();
}
elsif($on =~ /^\s*$/) {
# if the value returned is an empty string return
# INCONSISTENT(), since we don't know what the hard-coded default is.
return INCONSISTENT();
}
} else {
# those files which rely on comments to determine what gets
# turned on, such as inetd.conf and inittab
my $inettabs=&B_Backtick("$grep -e '^[[:space:]]*$param' $inetd $inittab");
if ($inettabs =~ /.+/) { # . matches anything except newlines
# service is not off
&B_log("DEBUG","Checking inetd.conf and inittab; found $inettabs");
########################### BREAK out, don't skip question
return NOTSECURE_CAN_CHANGE();
}
}
} # foreach $param
# boot-time parameters are not set; check processes
# checkprocs for services returns INCONSISTENT() if a service is found
# since a found-service is inconsistent with the above checks.
B_log("DEBUG","Boot-Parameters not set, checking processes.");
if (&runlevel < 2) { # Below runlevel 2, it is unlikely that
#services will be running, so just check "on-disk" state
&B_log("NOTE","Running during boot sequence, so skipping process checks");
return SECURE_CANT_CHANGE();
} else {
return &checkProcsForService($service);
}
}
sub runlevel {
my $who = &getGlobal("BIN", "who");
my $runlevel = &B_Backtick("$who -r");
if ($runlevel =~ s/.* run-level (\S).*/$1/) {
&B_log("DEBUG","Runlevel is: $runlevel");
return $runlevel;
} else {
&B_log("WARNING","Can not determine runlevel, assuming runlevel 3");
&B_log("DEBUG","Runlevel command output: $runlevel");
return "3"; #safer since the who command didn't work, we'll assume
# runlevel 3 since that provides more checks.
}
}
#
# given a profile file, it will return a PATH array set by the file.
#
sub B_get_path($) {
my $file = $_[0];
my $sh = &getGlobal("BIN", "sh");
# use (``)[0] is becuase, signal 0 maybe trapped which will produce some stdout
my $path = (`$sh -c '. $file 1>/dev/null 2>&1 < /dev/null ; echo \$PATH'`)[0];
my @path_arr = split(":", $path);
my %tmp_path;
my %path;
for my $tmpdir (@path_arr) {
chomp $tmpdir;
if ($tmpdir ne "" && ! $tmp_path{$tmpdir}) {
$tmp_path{$tmpdir}++;
}
}
return keys %tmp_path;
}
# Convert to trusted mode if it's not already
sub convertToTrusted {
&B_log("DEBUG","# sub convertToTrusted \n");
if( ! &isSystemTrusted) {
my ($ok, $message) = &isOKtoConvert;
my $ts_header="\n---------------------------------\nTrusted Systems:\n" .
"---------------------------------\n";
if ($ok) {
# actually do the conversion
if(&B_System(&getGlobal('BIN','tsconvert'), &getGlobal('BIN','tsconvert') . " -r")){
# adjust change times for user passwords to keep them valid
# default is to expire them when converting to a trusted system,
# which can be problematic, especially since some older versions of
# SecureShell do not allow the user to change the password
&B_System(&getGlobal('BIN','modprpw') . " -V", "");
my $getprdef = &getGlobal('BIN','getprdef');
my $oldsettings = &B_Backtick("$getprdef -m lftm,exptm,mintm,expwarn,umaxlntr");
$oldsettings =~ s/ //g;
# remove password lifetime and increasing login tries so they
# don't lock themselves out of the system entirely.
# set default expiration time and the like.
my $newsettings="lftm=0,exptm=0,mintm=0,expwarn=0,umaxlntr=10";
&B_System(&getGlobal('BIN','modprdef') . " -m $newsettings",
&getGlobal('BIN','modprdef') . " -m $oldsettings");
&B_TODO($ts_header .
"Your system has been converted to a trusted system.\n" .
"You should review the security settings available on a trusted system.\n".
"$message");
# to get rid of "Cron: Your job did not contain a valid audit ID."
# error, we re-read the crontab file after converting to trusted mode
# Nothing is necessary in "revert" since we won't be in trusted mode
# at that time.
# crontab's errors can be spurious, and this will report an 'error'
# of the crontab file is missing, so we send stderr to the bit bucket
my $crontab = &getGlobal('BIN',"crontab");
&B_System("$crontab -l 2>/dev/null | $crontab","");
}
} else {
&B_TODO($ts_header . $message);
return 0; # not ok to convert, so we didn't
}
}
else {
&B_log("DEBUG","System is already in trusted mode, no action taken.\n");
return 1;
}
# just to make sure
if( &isSystemTrusted ) {
return 1;
} else {
&B_log("ERROR","Trusted system conversion was unsuccessful for an unknown reason.\n" .
" You may try using SAM/SMH to do the conversion instead of Bastille.\n");
return 0;
}
}
# isOKtoConvert - check for conflicts between current system state and trusted
# mode
#
# Return values
# 0 - conflict found, see message for details
# 1 - no conflicts, see message for further instructions
#
sub isOKtoConvert {
&B_log("DEBUG","# sub isOKtoConvert \n");
# initialize text for TODO instructions
my $specialinstructions=" - convert to trusted mode\n";
# These are somewhat out-of-place, but only affect the text of the message.
# Each of these messages is repeated in a separate TODO item in the
# appropriate subroutine.
if (&getGlobalConfig("AccountSecurity","single_user_password") eq "Y") {
if (&GetDistro =~ "^HP-UX11.(.*)" and $1<23 ) {
$specialinstructions .= " - set a single user password\n";
}
}
if (&getGlobalConfig("AccountSecurity","passwordpolicies") eq "Y") {
$specialinstructions .= " - set trusted mode password policies\n";
}
if (&getGlobalConfig("AccountSecurity", "PASSWORD_HISTORY_DEPTHyn") eq "Y") {
$specialinstructions .= " - set a password history depth\n";
}
if (&getGlobalConfig("AccountSecurity","system_auditing") eq "Y") {
$specialinstructions .= " - enable auditing\n";
}
my $saminstructions=
"The security settings can be modified by running SAM as follows:\n" .
"# sam\n" .
"Next, go to the \"Auditing and Security Area\" and review\n" .
"each sub-section. Make sure that you review all of your\n" .
"settings, as some policies may seem restrictive.\n\n" .
"On systems using the System Management Homepage, you can\n".
"change your settings via the Tools:Security Attributes Configuration\n".
"section. On some systems, you may also have the option of using SMH.\n\n";
# First, check for possible conflicts and corner cases
# check nsswitch for possible conflicts
my $nsswitch = &getGlobal('FILE', 'nsswitch.conf');
if ( -e $nsswitch) {
open(FILE, $nsswitch);
while (<FILE>) {
if (/nis/ or /compat/ or /ldap/) {
my $message = "Bastille found a possible conflict between trusted mode and\n" .
"$nsswitch. Please remove all references to\n" .
"\"compat\", \"nis\" and \"ldap\" in $nsswitch\n" .
"and rerun Bastille, or use SAM/SMH to\n" .
"$specialinstructions\n".
"$saminstructions";
close(FILE);
return (0,$message);
}
}
close(FILE);
}
# check the namesvrs config file for possible NIS conflicts
#Changed to unless "Y AND Y" since question can be skipped when nis is off
# but corner cases can still exist, so check then too.
unless ( &getGlobalConfig('MiscellaneousDaemons','nis_client') eq "Y" and
&getGlobalConfig('MiscellaneousDaemons','nis_server') eq "Y" ) {
my $namesvrs = &getGlobal('FILE', 'namesvrs');
if (open(FILE, $namesvrs)) {
while (<FILE>) {
if (/^NIS.*=["]?1["]?$/) {
my $message= "Possible conflict between trusted mode and NIS found.\n".
"Please use SAM/SMH to\n" .
" - turn off NIS\n" .
"$specialinstructions\n".
"$saminstructions";
close(FILE);
return (0,$message);
}
}
close(FILE);
} else {
&B_log("ERROR","Unable to open $namesvrs for reading.");
my $message= "Possible conflict between trusted mode and NIS found.\n".
"Please use SAM/SMH to\n" .
" - turn off NIS\n" .
"$specialinstructions\n".
"$saminstructions";
return (0,$message);
}
if ( &B_match_line (&getGlobal("FILE","passwd"),"^\+:.*")) {
my $message= '"+" entry found in passwd file. These are not\n' .
"compatible with Trusted Mode. Either remove the entries\n" .
"and re-run Bastille, or re-run Bastille, and direct it to\n" .
"disable NIS client and server.\n";
return (0,$message);
}
}
# check for conflicts with DCE integrated login
my $authcmd = &getGlobal('BIN','auth.adm');
if ( -e $authcmd ) {
my $retval = system("PATH=/usr/bin $authcmd -q 1>/dev/null 2>&1");
if ($retval != 0 and $retval != 1) {
my $message="It appears that DCE integrated login is configured on this system.\n" .
"DCE integrated login is incompatible with trusted systems and\n" .
"auditing. Bastille is unable to\n" .
"$specialinstructions" .
"You will need to configure auditing and password policies using DCE.\n\n";
return (0,$message);
}
}
if ( -e &getGlobal('FILE','shadow') ) {
my $message="This system has already been converted to shadow passwords.\n" .
"Shadow passwords are incompatible with trusted mode.\n" .
"Bastille is unable to\n" .
"$specialinstructions" .
"If you desire these features, you should use\n".
"\'pwunconv\' to change back to standard passwords,\n".
"and then rerun Bastille.\n\n";
return (0,$message);
}
return (1,$saminstructions);
}
# This routine allows Bastille to determine trusted-mode extension availability
sub convertToShadow {
if (&isSystemTrusted) {
# This is an internal error...Bastille should not call this routine
# in this case. Error is here for robustness against future changes.
&B_log("ERROR","This system is already converted to trusted mode.\n" .
" Converting to shadow passwords will not be attempted.\n");
return 0;
}
# configuration files on which shadowed passwords depend
my $nsswitch_conf = &getGlobal('FILE',"nsswitch.conf");
# binaries used to convert to a shadowed password
my $pwconv = &getGlobal('BIN',"pwconv");
my $echo = &getGlobal('BIN','echo'); # the echo is used to pipe a yes into the pwconv program as
# pwconv requires user interaction.
# the binary used in a system revert.
my $pwunconv = &getGlobal('BIN',"pwunconv");
#check the password file for nis usage and if the nis client
#or server is running.
if(-e $nsswitch_conf) {
# check the file for nis, nis+, compat, or dce usage.
if(&B_match_line($nsswitch_conf, '^\s*passwd:.+(nis|nisplus|dce|compat)')) {
my $shadowTODO = "\n---------------------------------\nHide encrypted passwords:\n" .
"---------------------------------\n" .
"This version of password shadowing does not support any repository other\n" .
"than files. In order to convert your password database to shadowed passwords\n" .
"there can be no mention of nis, nisplus, compat, or dce in the passwd\n" .
"field of the \"$nsswitch_conf\" file. Please make the necessary edits to\n" .
"the $nsswitch_conf file and run Bastille again using the command:\n" .
"\"bastille -b\"\n";
# Adding the shadowTODO comment to the TODO list.
&B_TODO("$shadowTODO");
# Notifing the user that the shadowed password coversion has failed.
&B_log("ERROR","Password Shadowing Conversion Failed\n" .
"$shadowTODO");
# exiting the subroutine.
return 0;
}
}
# convert the password file to a shadowed repository.
if (( -e $pwconv ) and ( -e $pwunconv ) and
( &B_System("$echo \"yes\" | $pwconv","$pwunconv") ) ){
&B_TODO( "\n---------------------------------\nShadowing Password File:\n" .
"---------------------------------\n" .
"Your password file has been converted to use password shadowing.\n" .
"This version of password shadowing does not support any repository other\n" .
"than files. There can be no mention of nis, nisplus, compat, or dce\n" .
"in the passwd field of the \"$nsswitch_conf\" file.\n\n" );
} else {
&B_log("ERROR","Conversion to shadow mode failed. The system may require ".
"a patch to be capable of switching to shadow mode, or the ".
"system my be in a state where conversion is not possible.");
}
}
##########################################################################
# &getSupportedSettings();
# Manipulates %trustedParameter and %isSupportedSetting, file-scoped variables
#
# Reads the password policy support matrix, which in-turn gives Bastille the
# places it should look for a given password policy setting.
# Note the file was created like this so if could be maintained in an Excel(tm)
# spreadsheet, to optimize reviewability. TODO: consider other formats
# File Format:
# HEADERS:<comment>,[<OS Version> <Mode> <Extensions>,]...
# [
# :<label>:<trusted equivalent>,,,,,,,,,,,,<comment>
# <action> (comment), [<test value>,]...
# ] ...
# Example;
# HEADERS:Information Source (trusted equiv),11.11 Standard no-SMSE,11.11 Trusted no-SMSE,11.11 Shadow no-SMSE,11.23 Standard no-SMSE,11.23 Trusted no-SMSE,11.23 Shadow no-SMSE,11.23 Standard SMSE,11.23 Shadow SMSE,11.23 Trusted SMSE,11.31 Trusted SMSE,11.31 Shadow SMSE,11.31 Standard SMSE,Other Exceptions
#:ABORT_LOGIN_ON_MISSING_HOMEDIR,,,,,,,,,,,,,root
#/etc/security.dsc (search),x,,xx,x,x,x,!,!,!,!,!,!,
#/etc/default/security(search),y,y,y,y,y,y,y,y,y,y,y,y,
#getprdef (execute with <Trusted Equiv> argument),x,x,x,x,x,x,x,x,x,x,x,x,
###########################################################################
our %trustedParameter = ();
our %isSupportedSetting = ();
sub getSupportedSettings() {
my $line; # For a config file line
my $linecount = 0;
my $currentsetting = "";
my @fields; # Fields in a given line
my @columns; #Column Definitions
&B_open(*SETTINGSFILE,&getGlobal('BFILE','AccountSecSupport'));
my @settingLines=<SETTINGSFILE>;
&B_close(*SETTINGSFILE);
#Remove blank-lines and comments
@settingLines = grep(!/^#/,@settingLines);
@settingLines = grep(!/^(\s*,+)*$/,@settingLines);
foreach $line (@settingLines) {
++$linecount;
@fields = split(/,/,$line);
if ($line =~ /^Information Source:/) { #Sets up colums
my $fieldcount = 1; #Skipping first field
while ((defined($fields[$fieldcount])) and
($fields[$fieldcount] =~ /\d+\.\d+/)){
my @subfields = split(/ /,$fields[$fieldcount]);
my $fieldsCount = @subfields;
if ($fieldsCount != 3){
&B_log("ERROR","Invalid subfield count: $fieldsCount in:".
&getGlobal('BFILE','AccountSecSupport') .
" line: $linecount and field: $fieldcount");
}
$columns[$fieldcount] = {OSVersion => $subfields[0],
Mode => $subfields[1],
Extension => $subfields[2] };
&B_log("DEBUG","Found Header Column, $columns[$fieldcount]{'OSVersion'}, ".
$columns[$fieldcount]{'Mode'} ." , " .
$columns[$fieldcount]{'Extension'});
++$fieldcount;
} # New Account Seting ex:
} elsif ($line =~ /^:([^,:]+)(?::([^,]+))?/) { # :PASSWORD_WARNDAYS:expwarn,,,,,,,,,,,,
$currentsetting = $1;
if (defined($2)) {
$trustedParameter{"$currentsetting"}=$2;
}
&B_log("DEBUG","Found Current Setting: ". $currentsetting .
"/" . $trustedParameter{"$currentsetting"});
} elsif (($line =~ /(^[^, :\)\(]+)[^,]*,((?:(?:[!y?nx]|!!),)+)/) and #normal line w/ in setting ex:
($currentsetting ne "")){ # security.dsc (search),x,x,x,x,x,!,!!,!,!,!,!,
my $placeToLook = $1;
my $fieldcount = 1; #Skip the first one, which we used in last line
while (defined($fields[$fieldcount])) {
&B_log("DEBUG","Setting $currentsetting : $columns[$fieldcount]{OSVersion} , ".
"$columns[$fieldcount]{Mode} , ".
"$columns[$fieldcount]{Extension} , ".
"$placeToLook, to $fields[$fieldcount]");
$isSupportedSetting{"$currentsetting"}
{"$columns[$fieldcount]{OSVersion}"}
{"$columns[$fieldcount]{Mode}"}
{"$columns[$fieldcount]{Extension}"}
{"$placeToLook"} =
$fields[$fieldcount];
++$fieldcount;
}
} else {
if ($line !~ /^,*/) {
&B_log("ERROR","Incorrectly Formatted Line at ".
&getGlobal('BFILE','AccountSecSupport') . ": $linecount");
}
}
}
}
##########################################################################
# &B_get_sec_value($param);
# This subroutine finds the value for a given user policy parameter.
# Specifically, it supports the parameters listed in the internal data structure
# Return values:
# 'Not Defined' if the value is not present or not uniquely defined.
# $value if the value is present and unique
#
###########################################################################
sub B_get_sec_value($) {
my $param=$_[0];
my $os_version;
if (&GetDistro =~ /^HP-UX\D*(\d+\.\d+)/ ){
$os_version=$1;
} else {
&B_log("ERROR","B_get_sec_value only supported on HP-UX");
return undef;
}
# my $sec_dsc = &getGlobal('FILE', 'security.dsc');
my $sec_file = &getGlobal('FILE', 'security');
my $getprdef = &getGlobal('BIN','getprdef');
my $getprpw = &getGlobal('BIN','getprpw');
my $userdbget = &getGlobal('BIN','userdbget');
my $passwd = &getGlobal('BIN','passwd');
my $sec_flags = "";
my @sec_settings=();
my $user_sec_setting="";
my $security_mode="Standard";
my $security_extension="no-SMSE";
&B_log("DEBUG","Entering get_sec_value for: $param");
sub isok ($) { # Locally-scoped subroutine, takes supported-matrix entry as argument
my $supportedMatrixEntry = $_[0];
if ($supportedMatrixEntry =~ /!/) { #Matrix Entry for "Documented and/or tested"
&B_log("DEBUG","isOk TRUE: $supportedMatrixEntry");
return 1;
} else {
&B_log("DEBUG","isOk FALSE: $supportedMatrixEntry");
return 0; #FALSE
}
} #end local subroutine
#Get Top Array item non-destructively
sub getTop (@) {
my @incomingArray = @_;
my $topval = pop(@incomingArray);
push(@incomingArray,$topval); #Probably redundant, but left in just in case.
return $topval;
}
sub ifExistsPushOnSecSettings($$) {
my $sec_settings = $_[0];
my $pushval = $_[1];
if ($pushval ne ""){
push (@$sec_settings, $pushval);
}
}
#prpw and prdef both use "YES" instead of "1" like the other settings.
sub normalizePolicy($){
my $setting = $_[0];
$setting =~ s/YES/1/;
$setting =~ s/NO/1/;
return $setting;
}
if ((%trustedParameter == ()) or (%isSupportedSetting == ())) {
# Manipulates %trustedParameter and %isSupportedSetting
&getSupportedSettings;
}
#First determine the security mode
my $shadowFile = &getGlobal("FILE","shadow");
my $passwdFile = &getGlobal("FILE","passwd");
if (&isSystemTrusted) {
$security_mode = 'Trusted';
} elsif ((-e $shadowFile) and #check file exist, and that passwd has no non-"locked" accounts
(not(&B_match_line($passwdFile,'^[^\:]+:[^:]*[^:*x]')))) {
$security_mode = 'Shadow';
} else {
$security_mode = 'Standard';
}
if (&isTrustedMigrationAvailable) {
$security_extension = 'SMSE';
} else {
$security_extension = 'no-SMSE';
}
&B_log("DEBUG","Security mode: $security_mode extension: $security_extension");
# Now look up the value from each applicable database, from highest precedence
# to lowest:
&B_log("DEBUG","Checking $param in userdbget");
if (&isok($isSupportedSetting{$param}{$os_version}{$security_mode}
{$security_extension}{"userdbget_-a"})) {
&ifExistsPushOnSecSettings(\@sec_settings,
&B_getValueFromString('\w+\s+\w+=(\S+)',
&B_Backtick("$userdbget -a $param")));
&B_log("DEBUG", $param . ":userdbget setting: ". &getTop(@sec_settings));
}
&B_log("DEBUG","Checking $param in passwd");
if (&isok($isSupportedSetting{$param}{$os_version}{$security_mode}
{$security_extension}{"passwd_-sa"})) {
if ($param eq "PASSWORD_MINDAYS") {
&ifExistsPushOnSecSettings(\@sec_settings,
&B_getValueFromString('(?:\w+\s+){2}[\d\/]+\s+(\d+)\s+\d+',
&B_Backtick("$passwd -s -a")));
} elsif ($param eq "PASSWORD_MAXDAYS") {
&ifExistsPushOnSecSettings(\@sec_settings,
&B_getValueFromString('(?:\w+\s+){2}[\d\/]+\s+\d+\s+(\d+)',
&B_Backtick("$passwd -s -a")));
} elsif ($param eq "PASSWORD_WARNDAYS") {
&ifExistsPushOnSecSettings(\@sec_settings,
&B_getValueFromString('(?:\w+\s+){2}[\d\/]+(?:\s+\d+){2}\s+(\d+)',
&B_Backtick("$passwd -s -a")));
}
&B_log("DEBUG", $param . ":passwd -sa setting: ". &getTop(@sec_settings));
}
&B_log("DEBUG","Checking $param in get prpw");
if (&isok($isSupportedSetting{$param}{$os_version}{$security_mode}
{$security_extension}{"getprpw"})) {
my $logins = &getGlobal("BIN","logins");
my @userArray = split(/\n/,`$logins`);
my $userParamVals = '';
foreach my $rawuser (@userArray) {
$rawuser =~ /^(\S+)/;
my $user = $1;
my $nextParamVal=&B_Backtick("$getprpw -l -m $trustedParameter{$param} $user");
$nextParamVal =~ s/\w*=(-*[\w\d]*)/$1/;
if ($nextParamVal != -1) { #Don't count users for which the local DB is undefined
$userParamVals .= $user . "::::" . $nextParamVal ."\n";
}
} #Note getValueFromStrings deals with duplicates, returning "Not Unigue"
my $policySetting = &B_getValueFromString('::::(\S+)',"$userParamVals");
&ifExistsPushOnSecSettings (\@sec_settings, &normalizePolicy($policySetting));
&B_log("DEBUG", $param . ":prpw setting: ". &getTop(@sec_settings));
}
&B_log("DEBUG","Checking $param in get prdef");
if (&isok($isSupportedSetting{$param}{$os_version}{$security_mode}
{$security_extension}{"getprdef"})) {
$_ = &B_Backtick ("$getprdef -m " . $trustedParameter{$param});
/\S+=(\S+)/;
my $policySetting = $1;
&ifExistsPushOnSecSettings(\@sec_settings, &normalizePolicy($policySetting));
&B_log("DEBUG", $param . ":prdef setting: ". &getTop(@sec_settings));
}
&B_log("DEBUG","Checking $param in default security");
if (&isok($isSupportedSetting{$param}{$os_version}{$security_mode}
{$security_extension}{"/etc/default/security"})) {
&ifExistsPushOnSecSettings(\@sec_settings,&B_getValueFromFile('^\s*'. $param .
'\s*=\s*([^\s#]+)\s*$', $sec_file));
&B_log("DEBUG", $param . ":default setting: ". &getTop(@sec_settings));
}
#Commented below code in 3.0 release to avoid implication that bastille
#had ever set these values explicitly, and the implications to runnable
#config files where Bastille would then apply the defaults as actual policy
#with possible conversion to shadow or similar side-effect.
# &B_log("DEBUG","Checking $param in security.dsc");
#security.dsc, only added in if valid for OS/mode/Extension, and nothing else
#is defined (ie: @sec_settings=0)
# if ((&isok($isSupportedSetting{$param}{$os_version}{$security_mode}
# {$security_extension}{"/etc/security.dsc"})) and (@sec_settings == 0)) {
# &ifExistsPushOnSecSettings(\@sec_settings, &B_getValueFromFile('^' . $param .
# ';(?:[-\w/]*;){2}([-\w/]+);', $sec_dsc));
# &B_log("DEBUG", $param . ":security.dsc: ". &getTop(@sec_settings));
# }
# Return what we found
my $last_setting=undef;
my $current_setting=undef;
while (@sec_settings > 0) {
$current_setting = pop(@sec_settings);
&B_log("DEBUG","Comparing $param configuration for identity: " .
$current_setting);
if ((defined($current_setting)) and ($current_setting ne '')) {
if (not(defined($last_setting))){
$last_setting=$current_setting;
} elsif (($last_setting ne $current_setting) or
($current_setting eq 'Not Unique')){
&B_log("DEBUG","$param setting not unique.");
return 'Not Unique'; # Inconsistent state found, return 'Not Unique'
}
}
}
if ((not(defined($last_setting))) or ($last_setting eq '')) {
return undef;
} else {
return $last_setting;
}
} #End B_get_sec_value
sub secureIfNoNameService($){
my $retval = $_[0];
if (&isUsingRemoteNameService) {
return MANUAL();
} else {
return $retval;
}
}
#Specifically for cleartext protocols like NIS, which are not "secure"
sub isUsingRemoteNameService(){
if (&remoteServiceCheck('nis|nisplus|dce') == SECURE_CAN_CHANGE()){
return 0; #false
} else {
return 1;
}
}
###########################################
## This is a wrapper for two functions that
## test the existence of nis-like configurations
## It is used by both the front end test and the back-end run
##############################################
sub remoteServiceCheck($){
my $regex = $_[0];
my $nsswitch_conf = &getGlobal('FILE',"nsswitch.conf");
my $passwd = &getGlobal('FILE',"passwd");
# check the file for nis usage.
if (-e $nsswitch_conf) {
if (&B_match_line($nsswitch_conf, '^\s*passwd:.*('. $regex . ')')) {
return NOTSECURE_CAN_CHANGE();
} elsif ((&B_match_line($nsswitch_conf, '^\s*passwd:.*(compat)')) and
(&B_match_line($passwd, '^\s*\+'))) {
return NOTSECURE_CAN_CHANGE(); # true
}
} elsif ((&B_match_line($passwd, '^\s*\+'))) {
return NOTSECURE_CAN_CHANGE();
}
my $oldnisdomain=&B_get_rc("NIS_DOMAIN");
if ((($oldnisdomain eq "") or ($oldnisdomain eq '""')) and (&checkServiceOnHPUX('nis.client'))){
return SECURE_CAN_CHANGE();
}
return NOTSECURE_CAN_CHANGE();
}
#############################################
# remoteNISPlusServiceCheck
# test the existence of nis+ configuration
#############################################
sub remoteNISPlusServiceCheck () {
my $nsswitch_conf = &getGlobal('FILE',"nsswitch.conf");
# check the file for nis+ usage.
if (-e $nsswitch_conf) {
if (&B_match_line($nsswitch_conf, 'nisplus')) {
return NOTSECURE_CAN_CHANGE();
}
}
return &checkServiceOnHPUX('nisp.client');
}
##########################################################################
# This subroutine creates nsswitch.conf file if the file not exists,
# and then append serveral services into the file if the service not
# exists in the file.
##########################################################################
sub B_create_nsswitch_file ($) {
my $regex = $_[0];
my $nsswitch = &getGlobal('FILE',"nsswitch.conf");
if( ! -f $nsswitch ) {
&B_create_file($nsswitch);
# we don't need to revert the permissions change because we just
# created the file
chmod(0444, $nsswitch);
&B_append_line($nsswitch,'\s*passwd:', "passwd: $regex\n");
&B_append_line($nsswitch,'\s*group:', "group: $regex\n");
&B_append_line($nsswitch,'\s*hosts:', "hosts: $regex\n");
&B_append_line($nsswitch,'\s*networks:', "networks: $regex\n");
&B_append_line($nsswitch,'\s*protocols:', "protocols: $regex\n");
&B_append_line($nsswitch,'\s*rpc:', "rpc: $regex\n");
&B_append_line($nsswitch,'\s*publickey:', "publickey: $regex\n");
&B_append_line($nsswitch,'\s*netgroup:', "netgroup: $regex\n");
&B_append_line($nsswitch,'\s*automount:', "automount: $regex\n");
&B_append_line($nsswitch,'\s*aliases:', "aliases: $regex\n");
&B_append_line($nsswitch,'\s*services:', "services: $regex\n");
}
}
1;
Reference in New Issue View Git Blame Copy Permalink