PageRenderTime 36ms CodeModel.GetById 13ms RepoModel.GetById 0ms app.codeStats 0ms

/lynis-1.2.9/include/tests_php

#
Shell | 215 lines | 124 code | 6 blank | 85 comment | 37 complexity | 2ffcd465aebe529f8c279513edb690e2 MD5 | raw file
Possible License(s): GPL-3.0 
    

  1. #!/bin/sh
    2. 

  2. 

  3. #################################################################################
    4. 

  4. #
    5. 

  5. #   Lynis
    6. 

  6. # ------------------
    7. 

  7. #
    8. 

  8. # Copyright 2007-2009, Michael Boelen (michael@rootkit.nl), The Netherlands
    9. 

  9. # Web site: http://www.rootkit.nl
    10. 

  10. #
    11. 

  11. # Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
    12. 

  12. # welcome to redistribute it under the terms of the GNU General Public License.
    13. 

  13. # See LICENSE file for usage of this software.
    14. 

  14. #
    15. 

  15. #################################################################################
    16. 

  16. #
    17. 

  17. # Software: PHP
    18. 

  18. #
    19. 

  19. #################################################################################
    20. 

  20. #
    21. 

  21.     InsertSection "Software: PHP"
    22. 

  22. 

  23.     # Possible locations of php.ini
    24. 

  24.     PHPINILOCS="/etc/php.ini \
    25. 

  25. 		/etc/php/cgi-php5/php.ini /etc/php/cli-php5/php.ini /etc/php/apache2-php5/php.ini \
    26. 

  26. 		/etc/php5/cgi/php.ini /etc/php5/cli/php.ini /etc/php5/apache2/php.ini \
    27. 

  27. 	        /private/etc/php.ini \
    28. 

  28. 	        /var/www/conf/php.ini \
    29. 

  29.                 /usr/local/etc/php.ini /usr/local/lib/php.ini"
    30. 

    31. 

  31.     #Display --indent 2 --text "- Checking PHP..." --result FOUND --color WHITE
    32. 

  32. #
    33. 

  33. #################################################################################
    34. 

  34. #
    35. 

  35.     # Test        : PHP-2211
    36. 

  36.     # Description : Check php.ini presence
    37. 

  37.     Register --test-no PHP-2211 --weight L --network NO --description "Check php.ini presence"
    38. 

  38.     if [ ${SKIPTEST} -eq 0 ]; then
    39. 

  39.         logtext "Test: Checking for presence php.ini"
    40. 

  40. 	PHPINIFILE=""
    41. 

  41. 	for I in ${PHPINILOCS}; do
    42. 

  42. 	    if [ -f ${I} ]; then
    43. 

  43. 	        PHPINIFILE=${I}
    44. 

  44. 	        logtext "Found php.ini file (${PHPINIFILE})"
    45. 

  45. 	    fi
    46. 

  46. 	done
    47. 

  47. 	if [ ! "${PHPINIFILE}" = "" ]; then
    48. 

  48. 	    Display --indent 2 --text "- Checking PHP..." --result "FOUND" --color GREEN
    49. 

  49. 	  else
    50. 

  50.     	    Display --indent 2 --text "- Checking PHP..." --result "NOT FOUND" --color WHITE
    51. 

  51. 	    logtext "Result: no php.ini file found"
    52. 

  52. 	fi
    53. 

  53.     fi
    54. 

  54. #
    55. 

  55. #################################################################################
    56. 

  56. #
    57. 

  57.     # Test        : PHP-2320
    58. 

  58.     # Description : Check php disable functions option
    59. 

  59.     if [ ! "${PHPINIFILE}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    60. 

  60.     Register --test-no PHP-2320 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check PHP disabled functions"
    61. 

  61.     if [ ${SKIPTEST} -eq 0 ]; then
    62. 

  62. 	logtext "Test: Checking for PHP function hardening options"
    63. 

  63. 	FIND1=`grep "^disabled_functions=" ${PHPINIFILE}`
    64. 

  64. 	FIND2=`grep "^suhosin.executor.func.blacklist" ${PHPINIFILE}`
    65. 

  65. 	if [ "${FIND1}" = "" -a "${FIND2}" = "" ]; then
    66. 

  66. 	    logtext "Result: one or more PHP functions are disabled/blacklisted"
    67. 

  67. 	    Display --indent 2 --text "- Checking PHP disabled functions..." --result "FOUND" --color GREEN
    68. 

  68. 	    AddHP 3 3
    69. 

  69. 	  else
    70. 

  70. 	    logtext "Result: all PHP functions can be executed"
    71. 

  71. 	    Display --indent 2 --text "- Checking PHP disabled functions..." --result "NONE" --color YELLOW
    72. 

  72. 	    ReportSuggestion ${TEST_NO} "Harden PHP by disabling riskful functions (functions of interest: chown, diskfreespace, disk_free_space, disk_total_space, dl, exec, escapeshellarg, escapeshellcmd, fileinode, highlight_file(), max_execution_time, passthru, pclose, phpinfo, popen, proc_close, proc_open, proc_get_status, proc_nice, proc_open, proc_terminate, set_time_limit(), shell_exec, show_source(), system)"
    73. 

  73. 	    AddHP 0 1
    74. 

  74. 	fi
    75. 

  75.     fi
    76. 

  76. #
    77. 

  77. #################################################################################
    78. 

  78. #
    79. 

  79.     # Test        : PHP-2368
    80. 

  80.     # Description : Check php register_globals option
    81. 

  81.     if [ ! "${PHPINIFILE}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    82. 

  82.     Register --test-no PHP-2368 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check PHP register_globals option"
    83. 

  83.     if [ ${SKIPTEST} -eq 0 ]; then
    84. 

  84.         logtext "Test: Checking register_globals option.."
    85. 

  85.         FIND=`cat ${PHPINIFILE} | egrep -i 'register_globals.*(off|no|0)' | grep -v '^;'`
    86. 

  86.         if [ "${FIND}" = "" ]; then
    87. 

  87.             Display --indent 4 --text "- Checking register_globals option..." --result WARNING --color RED
    88. 

  88. 	    ReportWarning ${TEST_NO} "M" "PHP option register_globals option is turned on, which can be a risk for variable value overwriting"
    89. 

  89. 	    ReportSuggestion ${TEST_NO} "Change the register_globals line to: register_globals = Off"
    90. 

  90. 	    logtext "Result: register_globals option is turned on, which can be a risk for variable value overwriting."
    91. 

  91. 	    AddHP 1 2
    92. 

  92. 	  else
    93. 

  93.     	    Display --indent 4 --text "- Checking register_globals option..." --result OK --color GREEN
    94. 

  94. 	    logtext "Result: Found 'register_globals' in disabled state (0, no, or off), which is good."
    95. 

  95. 	    AddHP 2 2
    96. 

  96. 	fi	
    97. 

  97.     fi
    98. 

  98. #
    99. 

  99. #################################################################################
    100. 

  100. #
    101. 

  101.     # Test        : PHP-2372
    102. 

  102.     # Description : Check php expose_php option
    103. 

  103.     if [ ! "${PHPINIFILE}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    104. 

  104.     Register --test-no PHP-2372 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check PHP expose_php option"
    105. 

  105.     if [ ${SKIPTEST} -eq 0 ]; then
    106. 

  106.         logtext "Test: Checking expose_php option.."
    107. 

  107.         FIND=`cat ${PHPINIFILE} | egrep -i 'expose_php.*(off|no|0)' | grep -v '^;'`
    108. 

  108.         if [ "${FIND}" = "" ]; then
    109. 

  109.             Display --indent 4 --text "- Checking expose_php option..." --result ON --color RED
    110. 

  110. 	    ReportWarning ${TEST_NO} "M" "PHP option expose_php is possibly turned on, which can reveal useful information for attackers."
    111. 

  111. 	    ReportSuggestion ${TEST_NO} "Change the expose_php line to: expose_php = Off"
    112. 

  112. 	    report "Result: expose_php option is turned on, which can expose useful information for an attacker"
    113. 

  113. 	    AddHP 1 2
    114. 

  114. 	  else
    115. 

  115.     	    Display --indent 4 --text "- Checking expose_php option..." --result OFF --color GREEN
    116. 

  116. 	    logtext "Result: Found 'expose_php' in disabled state (0, no, or off)"
    117. 

  117. 	    AddHP 2 2
    118. 

  118. 	fi	
    119. 

  119.     fi
    120. 

  120. #
    121. 

  121. #################################################################################
    122. 

  122. #
    123. 

  123.     # Test        : PHP-2374
    124. 

  124.     # Description : Check PHP enable_dl option
    125. 

  125.     if [ ! "${PHPINIFILE}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    126. 

  126.     Register --test-no PHP-2374 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check PHP enable_dl option"
    127. 

  127.     if [ ${SKIPTEST} -eq 0 ]; then
    128. 

  128.         logtext "Test: Checking PHP enable_dl option.."
    129. 

  129.         FIND=`cat ${PHPINIFILE} | egrep -i 'enable_dl.*(off|no|0)' | grep -v '^;'`
    130. 

  130.         if [ "${FIND}" = "" ]; then
    131. 

  131.             Display --indent 4 --text "- Checking enable_dl option..." --result ON --color YELLOW
    132. 

  132. 	    report "Result: enable_dl option is turned on, which can be used for riskful downloads via PHP"
    133. 

  133. 	    ReportSuggestion ${TEST_NO} "Change the enable_dl line to: enable_dl = Off, to disable downloads via PHP"
    134. 

  134. 	    AddHP 0 1
    135. 

  135. 	  else
    136. 

  136.     	    Display --indent 4 --text "- Checking enable_dl option..." --result OFF --color GREEN
    137. 

  137. 	    logtext "Result: Found 'enable_dl' in disabled state (0, no, or off)"
    138. 

  138. 	    AddHP 2 2
    139. 

  139. 	fi	
    140. 

  140.     fi
    141. 

  141. #
    142. 

  142. #################################################################################
    143. 

  143. #
    144. 

  144.     # Test        : PHP-2376
    145. 

  145.     # Description : Check PHP allow_url_fopen option
    146. 

  146.     if [ ! "${PHPINIFILE}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    147. 

  147.     Register --test-no PHP-2376 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check PHP allow_url_fopen option"
    148. 

  148.     if [ ${SKIPTEST} -eq 0 ]; then
    149. 

  149.         logtext "Test: Checking PHP allow_url_fopen option.."
    150. 

  150.         FIND=`cat ${PHPINIFILE} | egrep -i 'allow_url_fopen.*(off|no|0)' | grep -v '^;'`
    151. 

  151.         if [ "${FIND}" = "" ]; then
    152. 

  152.             Display --indent 4 --text "- Checking allow_url_fopen option..." --result ON --color YELLOW
    153. 

  153. 	    report "Result: allow_url_fopen option is turned on, which can be used for riskful downloads via PHP"
    154. 

  154. 	    ReportSuggestion ${TEST_NO} "Change the allow_url_fopen line to: allow_url_fopen = Off, to disable downloads via PHP"
    155. 

  155. 	    AddHP 0 1
    156. 

  156. 	  else
    157. 

  157.     	    Display --indent 4 --text "- Checking allow_url_fopen option..." --result OFF --color GREEN
    158. 

  158. 	    logtext "Result: Found 'allow_url_fopen' in disabled state (0, no, or off)"
    159. 

  159. 	    AddHP 2 2
    160. 

  160. 	fi	
    161. 

  161.     fi
    162. 

  162. #
    163. 

  163. #################################################################################
    164. 

  164. #
    165. 

  165.     # Test        : PHP-2378
    166. 

  166.     # Description : Check PHP allow_url_include option
    167. 

  167.     if [ ! "${PHPINIFILE}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    168. 

  168.     Register --test-no PHP-2378 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check PHP allow_url_include option"
    169. 

  169.     if [ ${SKIPTEST} -eq 0 ]; then
    170. 

  170.         logtext "Test: Checking PHP allow_url_include option.."
    171. 

  171.         FIND=`cat ${PHPINIFILE} | egrep -i 'allow_url_include.*(off|no|0)' | grep -v '^;'`
    172. 

  172.         if [ "${FIND}" = "" ]; then
    173. 

  173.             Display --indent 4 --text "- Checking allow_url_include option..." --result ON --color YELLOW
    174. 

  174. 	    report "Result: allow_url_include option is turned on, which can be used for riskful downloads via PHP"
    175. 

  175. 	    ReportSuggestion ${TEST_NO} "Change the allow_url_include line to: allow_url_include = Off, to disable downloads via PHP"
    176. 

  176. 	    AddHP 0 1
    177. 

  177. 	  else
    178. 

  178.     	    Display --indent 4 --text "- Checking allow_url_include option..." --result OFF --color GREEN
    179. 

  179. 	    logtext "Result: Found 'allow_url_include' in disabled state (0, no, or off)"
    180. 

  180. 	    AddHP 2 2
    181. 

  181. 	fi
    182. 

  182.     fi
    183. 

  183. #
    184. 

  184. #################################################################################
    185. 

  185. #
    186. 

  186. # Disable/use functions:
    187. 

  187. # safe_mode (only for PHP5?)
    188. 

  188. # open_basedir (limits access to defined directory, comparable with chrooting)
    189. 

  189. # disable_classes
    190. 

  190. # session.save_path
    191. 

  191. # session.referer_check
    192. 

  192. # upload_tmp_dir
    193. 

  193. # file_uploads Off, if possible
    194. 

  194. # Set display_errors to Off
    195. 

  195. # Set log_errors to On and define error_log (with value Syslog or a filename)
    196. 

  196. #
    197. 

  197. #################################################################################
    198. 

  198. #
    199. 

  199.     # mod_suexec
    200. 

  200.     # suPHP (/etc/suphp.conf)
    201. 

  201. #
    202. 

  202. #################################################################################
    203. 

  203. #
    204. 

  204. 

  205.     # Test        : PHP-2388
    206. 

  206.     # Description : Check php version number
    207. 

  207. #
    208. 

  208. #################################################################################
    209. 

  209. #
    210. 

  210. 

  211. wait_for_keypress
    212. 

  212. 

  213. #
    214. 

  214. #================================================================================
    215. 

  215. # Lynis - Copyright 2007-2009, Michael Boelen - www.rootkit.nl - The Netherlands
    216. 

  216.