From 76575e9fb1a29873d8ebe9817c0cab17fcf020d9 Mon Sep 17 00:00:00 2001 From: Romain Dessort Date: Fri, 23 Mar 2018 15:14:33 -0400 Subject: [PATCH 1/7] evoqa #4994: check presence of evolix user --- evocheck.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/evocheck.sh b/evocheck.sh index fd170ed..bd45a25 100755 --- a/evocheck.sh +++ b/evocheck.sh @@ -101,6 +101,7 @@ IS_NETWORK_INTERFACES=1 IS_EVOBACKUP=1 IS_DUPLICATE_FS_LABEL=1 IS_EVOMAINTENANCE_FW=1 +IS_EVOLIX_USER=1 #Proper to OpenBSD IS_SOFTDEP=1 @@ -753,6 +754,9 @@ if [ -e /etc/debian_version ]; then fi rm $tmpFile fi + + if [ "$IS_EVOLIX_USER" = 1 ]; then + getent passwd evolix >/dev/null && echo 'IS_EVOLIX_USER FAILED!' fi fi From 92b18e201c7a190b145c260d09af126701af6b17 Mon Sep 17 00:00:00 2001 From: Romain Dessort Date: Fri, 23 Mar 2018 15:36:45 -0400 Subject: [PATCH 2/7] Fix evoqa #3623: custom limit for IS_NOTUPGRADED Set higher time limit for servers not being part of the regular upgrade process: - if mails are sent to listupgrade-todo@ - or if listupgrade.sh is not executed on a weekly basis. --- evocheck.sh | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/evocheck.sh b/evocheck.sh index bd45a25..e171585 100755 --- a/evocheck.sh +++ b/evocheck.sh @@ -519,7 +519,14 @@ if [ -e /etc/debian_version ]; then # Check if no package has been upgraded since $limit. if [ "$IS_NOTUPGRADED" = 1 ]; then last_upgrade=$(date +%s -d $(zgrep -h upgrade /var/log/dpkg.log* |sort -n |tail -1 |cut -f1 -d ' ')) - limit=$(date +%s -d "now - 90 days") + if grep -q '^mailto="listupgrade-todo@' /etc/evolinux/listupgrade.cnf \ + || grep -q -E '^[[:digit:]]+[[:space:]]+[[:digit:]]+[[:space:]]+[^\*]' /etc/cron.d/listupgrade; then + # Manual upgrade process + limit=$(date +%s -d "now - 180 days") + else + # Regular process + limit=$(date +%s -d "now - 90 days") + fi if [ -f /var/log/evolinux/00_prepare_system.log ]; then install_date=$(stat -c %Z /var/log/evolinux/00_prepare_system.log) else From c1866836aa92c25b01e8117260b7d58fbf4bfa09 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Lecour?= Date: Thu, 29 Mar 2018 22:29:50 +0200 Subject: [PATCH 3/7] whitespaces --- evocheck.sh | 110 ++++++++++++++++++++++++++-------------------------- 1 file changed, 55 insertions(+), 55 deletions(-) diff --git a/evocheck.sh b/evocheck.sh index e171585..57aa9d3 100755 --- a/evocheck.sh +++ b/evocheck.sh @@ -194,23 +194,23 @@ if [ -e /etc/debian_version ]; then if [ "$IS_VARTMPFS" = 1 ]; then df /var/tmp | grep -q tmpfs || echo 'IS_VARTMPFS FAILED!' fi - + if [ "$IS_SERVEURBASE" = 1 ]; then is_installed serveur-base || echo 'IS_SERVEURBASE FAILED!' fi - + if [ "$IS_LOGROTATECONF" = 1 ]; then test -e /etc/logrotate.d/zsyslog || echo 'IS_LOGROTATECONF FAILED!' fi - + if [ "$IS_SYSLOGCONF" = 1 ]; then grep -q "^# Syslog for Pack Evolix serveur" /etc/*syslog.conf || echo 'IS_SYSLOGCONF FAILED!' fi - + if [ "$IS_DEBIANSECURITY" = 1 ]; then grep -q "^deb.*security" /etc/apt/sources.list || echo 'IS_DEBIANSECURITY FAILED!' fi - + if [ "$IS_APTITUDEONLY" = 1 ]; then is_debianversion squeeze && test -e /usr/bin/apt-get && echo 'IS_APTITUDEONLY FAILED!' is_debianversion wheezy && test -e /usr/bin/apt-get && echo 'IS_APTITUDEONLY FAILED!' @@ -233,15 +233,15 @@ if [ -e /etc/debian_version ]; then test "$status" = "fail" || test -e /usr/bin/apt-get.bak || status="fail" ( is_debianversion squeeze || is_debianversion wheezy ) && test "$status" = "fail" && echo 'IS_APTICRON FAILED!' fi - + if [ "$IS_USRRO" = 1 ]; then grep /usr /etc/fstab | grep -q ro || echo 'IS_USRRO FAILED!' fi - + if [ "$IS_TMPNOEXEC" = 1 ]; then mount | grep "on /tmp" | grep -q noexec || echo 'IS_TMPNOEXEC FAILED!' fi - + if [ "$IS_MOUNT_FSTAB" = 1 ]; then # Test if lsblk available, if not skip this test... if test -x "$(command -v lsblk)"; then @@ -258,27 +258,27 @@ if [ -e /etc/debian_version ]; then test -e /etc/apt/listchanges.conf && egrep "(which=both|confirm=1)" /etc/apt/listchanges.conf | wc -l | grep -q ^2$ || echo 'IS_LISTCHANGESCONF FAILED!' fi fi - + if [ "$IS_CUSTOMCRONTAB" = 1 ]; then egrep "^(17 \*|25 6|47 6|52 6)" /etc/crontab | wc -l | grep -q ^4$ && echo 'IS_CUSTOMCRONTAB FAILED!' fi - + if [ "$IS_SSHALLOWUSERS" = 1 ]; then egrep -qi "AllowUsers" /etc/ssh/sshd_config || echo 'IS_SSHALLOWUSERS FAILED!' fi - + if [ "$IS_DISKPERF" = 1 ]; then test -e /root/disk-perf.txt || echo 'IS_DISKPERF FAILED!' fi - + if [ "$IS_TMOUTPROFILE" = 1 ]; then grep -q TMOUT= /etc/profile /etc/profile.d/evolinux.sh || echo 'IS_TMOUTPROFILE FAILED!' fi - + if [ "$IS_ALERT5BOOT" = 1 ]; then grep -q ^date /etc/rc2.d/S*alert5 || echo 'IS_ALERT5BOOT FAILED!' fi - + if [ "$IS_ALERT5MINIFW" = 1 ]; then grep -q ^/etc/init.d/minifirewall /etc/rc2.d/S*alert5 || echo 'IS_ALERT5MINIFW FAILED!' fi @@ -286,15 +286,15 @@ if [ -e /etc/debian_version ]; then if [ "$IS_ALERT5MINIFW" = 1 ] && [ "$IS_MINIFW" = 1 ]; then /sbin/iptables -L -n | grep -q -E "^ACCEPT\s*all\s*--\s*31\.170\.8\.4\s*0\.0\.0\.0/0\s*$" || echo 'IS_MINIFW FAILED!' fi - + if [ "$IS_NRPEPERMS" = 1 ]; then test -d /etc/nagios && ls -ld /etc/nagios | grep -q drwxr-x--- || echo 'IS_NRPEPERMS FAILED!' fi - + if [ "$IS_MINIFWPERMS" = 1 ]; then ls -l "$MINIFW_FILE" | grep -q -- -rw------- || echo 'IS_MINIFWPERMS FAILED!' fi - + if [ "$IS_NRPEDISKS" = 1 ]; then NRPEDISKS=$(grep command.check_disk /etc/nagios/nrpe.cfg | grep ^command.check_disk[0-9] | sed -e "s/^command.check_disk\([0-9]\+\).*/\1/" | sort -n | tail -1) DFDISKS=$(df -Pl | egrep -v "(^Filesystem|/lib/init/rw|/dev/shm|udev|rpc_pipefs)" | wc -l) @@ -304,21 +304,21 @@ if [ -e /etc/debian_version ]; then if [ "$IS_NRPEPID" = 1 ]; then is_debianversion squeeze || (test -e /etc/nagios/nrpe.cfg && grep -q "^pid_file=/var/run/nagios/nrpe.pid" /etc/nagios/nrpe.cfg || echo 'IS_NRPEPID FAILED!') fi - + if [ "$IS_GRSECPROCS" = 1 ]; then uname -a | grep -q grsec && ( grep -q ^command.check_total_procs..sudo /etc/nagios/nrpe.cfg && grep -A1 "^\[processes\]" /etc/munin/plugin-conf.d/munin-node | grep -q "^user root" || echo 'IS_GRSECPROCS FAILED!' ) fi - + if [ "$IS_APACHEMUNIN" = 1 ]; then test -e /etc/apache2/apache2.conf && ( is_debianversion stretch || ( egrep -q "^env.url.*/server-status-[[:alnum:]]{4}" /etc/munin/plugin-conf.d/munin-node && egrep -q "/server-status-[[:alnum:]]{4}" /etc/apache2/apache2.conf || egrep -q "/server-status-[[:alnum:]]{4}" /etc/apache2/apache2.conf /etc/apache2/mods-enabled/status.conf 2>/dev/null || echo 'IS_APACHEMUNIN FAILED!' ) ) test -e /etc/apache2/apache2.conf && ( is_debianversion stretch && ( test -h /etc/apache2/mods-enabled/status.load && test -h /etc/munin/plugins/apache_accesses && test -h /etc/munin/plugins/apache_processes && test -h /etc/munin/plugins/apache_accesses || echo 'IS_APACHEMUNIN FAILED!' ) ) fi - + # Verification mytop + Munin si MySQL if [ "$IS_MYSQLUTILS" = 1 ]; then is_installed mysql-server && ( grep -q mysqladmin /root/.my.cnf && test -x /usr/bin/mytop && grep -q debian-sys-maint /root/.mytop || echo 'IS_MYSQLUTILS FAILED!' ) fi - + # Verification de la configuration du raid soft (mdadm) if [ "$IS_RAIDSOFT" = 1 ]; then test -e /proc/mdstat && grep -q md /proc/mdstat && \ @@ -326,12 +326,12 @@ if [ -e /etc/debian_version ]; then && grep -q "^START_DAEMON=true" /etc/default/mdadm \ && grep -qv "^MAILADDR ___MAIL___" /etc/mdadm/mdadm.conf || echo 'IS_RAIDSOFT FAILED!') fi - + # Verification du LogFormat de AWStats if [ "$IS_AWSTATSLOGFORMAT" = 1 ]; then is_installed apache2.2-common && ( grep -qE '^LogFormat=1' /etc/awstats/awstats.conf.local || echo 'IS_AWSTATSLOGFORMAT FAILED!' ) fi - + # Verification de la présence de la config logrotate pour Munin if [ "$IS_MUNINLOGROTATE" = 1 ]; then ( test -e /etc/logrotate.d/munin-node && test -e /etc/logrotate.d/munin ) || echo 'IS_MUNINLOGROTATE FAILED!' @@ -341,7 +341,7 @@ if [ -e /etc/debian_version ]; then #if [ "$IS_METCHE" = 1 ]; then # is_installed metche || echo 'IS_METCHE FAILED!' #fi - + # Verification de l'activation de Squid dans le cas d'un pack mail if [ "$IS_SQUID" = 1 ]; then squidconffile=/etc/squid*/squid.conf @@ -369,7 +369,7 @@ if [ -e /etc/debian_version ]; then && grep -q "AddOutputFilterByType DEFLATE text/css" $f \ && grep -q "AddOutputFilterByType DEFLATE application/x-javascript application/javascript" $f || echo 'IS_MODDEFLATE FAILED!') fi - + # Verification de la conf log2mail if [ "$IS_LOG2MAILRUNNING" = 1 ]; then is_pack_web && (is_installed log2mail && pgrep log2mail >/dev/null || echo 'IS_LOG2MAILRUNNING') @@ -389,7 +389,7 @@ if [ -e /etc/debian_version ]; then is_pack_web && ( is_installed log2mail && grep -q "^file = /var/log/squid.*/access.log" \ /etc/log2mail/config/* 2>/dev/null || echo 'IS_LOG2MAILSQUID FAILED!' ) fi - + # Verification si bind est chroote if [ "$IS_BINDCHROOT" = 1 ]; then if is_installed bind9 && $(netstat -utpln |grep "/named" |grep :53 |grep -qvE "(127.0.0.1|::1)"); then @@ -402,13 +402,13 @@ if [ -e /etc/debian_version ]; then fi fi fi - + # Verification de la présence du depot volatile if [ "$IS_REPVOLATILE" = 1 ]; then test `cat /etc/debian_version |cut -d "." -f 1` -eq 5 && (grep -qE "^deb http://volatile.debian.org/debian-volatile" /etc/apt/sources.list || echo 'IS_REPVOLATILE FAILED!') test `cat /etc/debian_version |cut -d "." -f 1` -eq 6 && (grep -qE "^deb.*squeeze-updates" /etc/apt/sources.list || echo 'IS_REPVOLATILE FAILED!') fi - + # /etc/network/interfaces should be present, we don't manage systemd-network yet if [ "$IS_NETWORK_INTERFACES" = 1 ]; then if ! test -f /etc/network/interfaces; then @@ -427,7 +427,7 @@ if [ -e /etc/debian_version ]; then grep -q "^auto $interface" /etc/network/interfaces || (echo 'IS_AUTOIF FAILED!' && break) done fi - + # Network conf verification if [ "$IS_INTERFACESGW" = 1 ]; then number=$(grep -Ec "^[^#]*gateway [0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" /etc/network/interfaces) @@ -440,13 +440,13 @@ if [ -e /etc/debian_version ]; then if [ "$IS_EVOBACKUP" = 1 ]; then ls /etc/cron* |grep -q "evobackup" || echo 'IS_EVOBACKUP FAILED!' fi - + # Verification de la presence du userlogrotate if [ "$IS_USERLOGROTATE" = 1 ]; then is_pack_web && (test -x /etc/cron.weekly/userlogrotate || echo 'IS_USERLOGROTATE FAILED!') fi - - + + # Verification de la syntaxe de la conf d'Apache if [ "$IS_APACHECTL" = 1 ]; then is_installed apache2.2-common && (/usr/sbin/apache2ctl configtest 2>&1 |grep -q "^Syntax OK$" || echo 'IS_APACHECTL FAILED!') @@ -474,19 +474,19 @@ if [ -e /etc/debian_version ]; then fi is_installed apache2.2-common && ([ -e $muninconf ] && grep -vEq "^( |\t)*#" $muninconf && echo 'IS_MUNINAPACHECONF FAILED!') fi - + # Verification de la priorité du package samba si les backports sont utilisés if [ "$IS_SAMBAPINPRIORITY" = 1 ]; then is_pack_samba && grep -qrE "^[^#].*backport" /etc/apt/sources.list{,.d} && ( priority=`grep -E -A2 "^Package:.*samba" /etc/apt/preferences |grep -A1 "^Pin: release a=lenny-backports" |grep "^Pin-Priority:" |cut -f2 -d" "` && test $priority -gt 500 || echo 'IS_SAMBAPINPRIORITY FAILED!' ) fi - + # Verification si le système doit redémarrer suite màj kernel. if [ "$IS_KERNELUPTODATE" = 1 ]; then if is_installed linux-image* && [ $(date -d $(ls --full-time -lcrt /boot | tail -n1 | tr -s " " | cut -d " " -f 6) +%s) -gt $(($(date +%s) - $(cut -f1 -d '.' /proc/uptime))) ]; then echo 'IS_KERNELUPTODATE FAILED!' fi fi - + # Check if the server is running for more than a year. if [ "$IS_UPTIME" = 1 ]; then if is_installed linux-image* && [ $(date -d "now - 2 year" +%s) -gt $(($(date +%s) - $(cut -f1 -d '.' /proc/uptime))) ]; then @@ -773,19 +773,19 @@ if [ `uname -s` == "OpenBSD" ]; then if [ "$IS_SOFTDEP" = 1 ]; then grep -q "softdep" /etc/fstab || echo 'IS_SOFTDEP FAILED!' fi - + if [ "$IS_WHEEL" = 1 ]; then grep -qE "^%wheel.*$" /etc/sudoers || echo 'IS_WHEEL FAILED!' fi - + if [ "$IS_SUDOADMIN" = 1 ]; then grep -qE "^User_Alias ADMIN=.*$" /etc/sudoers || echo 'IS_SUDOADMIN FAILED!' fi - + if [ "$IS_PKGMIRROR" = 1 ]; then grep -qE "^export PKG_PATH=http://ftp\.fr\.openbsd\.org/pub/OpenBSD/[0-9.]+/packages/[a-z0-9]+/$" /root/.profile || echo 'IS_PKGMIRROR FAILED!' fi - + if [ "$IS_HISTORY" = 1 ]; then f=/root/.profile grep -q "^HISTFILE=\$HOME/.histfile" $f \ @@ -794,68 +794,68 @@ if [ `uname -s` == "OpenBSD" ]; then && grep -q "^export HISTSIZE" $f \ || echo 'IS_HISTORY FAILED!' fi - + if [ "$IS_VIM" = 1 ]; then which vim 2>1 >> /dev/null || echo 'IS_VIM FAILED!' fi - + if [ "$IS_TTYC0SECURE" = 1 ]; then grep -Eqv "^ttyC0.*secure$" /etc/ttys || echo 'IS_TTYC0SECURE FAILED!' fi - + if [ "$IS_CUSTOMSYSLOG" = 1 ]; then grep -q Evolix /etc/newsyslog.conf || echo 'IS_CUSTOMSYSLOG FAILED!' fi - + if [ "$IS_NOINETD" = 1 ]; then grep -q inetd=NO /etc/rc.conf.local 2>/dev/null || echo 'IS_NOINETD FAILED!' fi - + if [ "$IS_SUDOMAINT" = 1 ]; then f=/etc/sudoers grep -q "Cmnd_Alias MAINT = /usr/share/scripts/evomaintenance.sh" $f \ && grep -q "ADMIN ALL=NOPASSWD: MAINT" $f \ || echo 'IS_SUDOMAINT FAILED!' fi - + if [ "$IS_POSTGRESQL" = 1 ]; then pkg info | grep -q postgresql-client || echo 'IS_POSTGRESQL FAILED!' fi - + if [ "$IS_NRPE" = 1 ]; then ( pkg info | grep -qE "nagios-plugins-[0-9.]" \ && pkg info | grep -q nagios-plugins-ntp \ && pkg info | grep -q nrpe ) || echo 'IS_NRPE FAILED!' fi - + # if [ "$IS_NRPEDISKS" = 1 ]; then # NRPEDISKS=$(grep command.check_disk /etc/nrpe.cfg 2>/dev/null | grep ^command.check_disk[0-9] | sed -e "s/^command.check_disk\([0-9]\+\).*/\1/" | sort -n | tail -1) # DFDISKS=$(df -Pl | egrep -v "(^Filesystem|/lib/init/rw|/dev/shm|udev|rpc_pipefs)" | wc -l) # [ "$NRPEDISKS" = "$DFDISKS" ] || echo 'IS_NRPEDISKS FAILED!' # fi - + # Verification du check_mailq dans nrpe.cfg (celui-ci doit avoir l'option "-M postfix" si le MTA est Postfix) -# +# # if [ "$IS_NRPEPOSTFIX" = 1 ]; then # pkg info | grep -q postfix && ( grep -q "^command.*check_mailq -M postfix" /etc/nrpe.cfg 2>/dev/null || echo 'IS_NRPEPOSTFIX FAILED!' ) # fi - + if [ "$IS_NRPEDAEMON" = 1 ]; then grep -q "echo -n ' nrpe'; /usr/local/sbin/nrpe -d" /etc/rc.local || echo 'IS_NREPEDAEMON FAILED!' fi - + if [ "$IS_ALERTBOOT" = 1 ]; then grep -qE "^date \| mail -sboot/reboot .*evolix.fr$" /etc/rc.local || echo 'IS_ALERTBOOT FAILED!' fi - + if [ "$IS_RSYNC" = 1 ]; then pkg info | grep -q rsync || echo 'IS_RSYNC FAILED!' fi - + if [ "$IS_CRONPATH" = 1 ]; then grep -q "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin" /var/cron/tabs/root || echo 'IS_CRONPATH FAILED!' fi - + #TODO # - Check en profondeur de postfix # - NRPEDISK et NRPEPOSTFIX @@ -889,7 +889,7 @@ if [ "$IS_EVOMAINTENANCEUSERS" = 1 ]; then grep -q "^trap.*sudo.*evomaintenance.sh" /home/$i/.*profile || echo 'IS_EVOMAINTENANCEUSERS FAILED!' done else - for i in $(getent group evolinux-sudo | cut -d':' -f4 | tr ',' ' '); do + for i in $(getent group evolinux-sudo | cut -d':' -f4 | tr ',' ' '); do grep -q "^trap.*sudo.*evomaintenance.sh" /home/$i/.*profile || echo 'IS_EVOMAINTENANCEUSERS FAILED!' done fi From 80a07783c89455fa9d06456961598c1e85fb047d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Lecour?= Date: Thu, 29 Mar 2018 22:30:31 +0200 Subject: [PATCH 4/7] IS_SSHALLOWUSERS is looking for AllowUsers or AllowGroups --- evocheck.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/evocheck.sh b/evocheck.sh index 57aa9d3..5dadad9 100755 --- a/evocheck.sh +++ b/evocheck.sh @@ -264,7 +264,7 @@ if [ -e /etc/debian_version ]; then fi if [ "$IS_SSHALLOWUSERS" = 1 ]; then - egrep -qi "AllowUsers" /etc/ssh/sshd_config || echo 'IS_SSHALLOWUSERS FAILED!' + egrep -qi "(AllowUsers|AllowGroups)" /etc/ssh/sshd_config || echo 'IS_SSHALLOWUSERS FAILED!' fi if [ "$IS_DISKPERF" = 1 ]; then From 9c221e2919f4531701a4d3168853caa277677ff8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Lecour?= Date: Thu, 29 Mar 2018 22:31:50 +0200 Subject: [PATCH 5/7] Use "grep -E" instead of "egrep" (deprecated) --- evocheck.sh | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/evocheck.sh b/evocheck.sh index 5dadad9..1e9c876 100755 --- a/evocheck.sh +++ b/evocheck.sh @@ -161,7 +161,7 @@ if [ -e /etc/debian_version ]; then if [ "$IS_DPKGWARNING" = 1 ]; then is_debianversion squeeze && ( [ "$IS_USRRO" = 1 ] || [ "$IS_TMPNOEXEC" = 1 ] ) && ( \ - egrep -i "(Pre-Invoke ..echo Are you sure to have rw on|Post-Invoke ..echo Dont forget to mount -o remount)" \ + grep -E -i "(Pre-Invoke ..echo Are you sure to have rw on|Post-Invoke ..echo Dont forget to mount -o remount)" \ /etc/apt/apt.conf | wc -l | grep -q ^2$ || echo 'IS_DPKGWARNING FAILED!' ) is_debianversion wheezy && ( ( [ "$IS_USRRO" = 1 ] || [ "$IS_TMPNOEXEC" = 1 ] ) && \ ( test -e /etc/apt/apt.conf.d/80evolinux || echo 'IS_DPKGWARNING FAILED!' ) @@ -188,7 +188,7 @@ if [ -e /etc/debian_version ]; then fi if [ "$IS_CUSTOMSUDOERS" = 1 ]; then - egrep -qr "umask=0077" /etc/sudoers* || echo 'IS_CUSTOMSUDOERS FAILED!' + grep -E -qr "umask=0077" /etc/sudoers* || echo 'IS_CUSTOMSUDOERS FAILED!' fi if [ "$IS_VARTMPFS" = 1 ]; then @@ -255,16 +255,16 @@ if [ -e /etc/debian_version ]; then if is_debianversion stretch; then is_installed apt-listchanges && echo 'IS_LISTCHANGESCONF FAILED!' else - test -e /etc/apt/listchanges.conf && egrep "(which=both|confirm=1)" /etc/apt/listchanges.conf | wc -l | grep -q ^2$ || echo 'IS_LISTCHANGESCONF FAILED!' + test -e /etc/apt/listchanges.conf && grep -E "(which=both|confirm=1)" /etc/apt/listchanges.conf | wc -l | grep -q ^2$ || echo 'IS_LISTCHANGESCONF FAILED!' fi fi if [ "$IS_CUSTOMCRONTAB" = 1 ]; then - egrep "^(17 \*|25 6|47 6|52 6)" /etc/crontab | wc -l | grep -q ^4$ && echo 'IS_CUSTOMCRONTAB FAILED!' + grep -E "^(17 \*|25 6|47 6|52 6)" /etc/crontab | wc -l | grep -q ^4$ && echo 'IS_CUSTOMCRONTAB FAILED!' fi if [ "$IS_SSHALLOWUSERS" = 1 ]; then - egrep -qi "(AllowUsers|AllowGroups)" /etc/ssh/sshd_config || echo 'IS_SSHALLOWUSERS FAILED!' + grep -E -qi "(AllowUsers|AllowGroups)" /etc/ssh/sshd_config || echo 'IS_SSHALLOWUSERS FAILED!' fi if [ "$IS_DISKPERF" = 1 ]; then @@ -297,7 +297,7 @@ if [ -e /etc/debian_version ]; then if [ "$IS_NRPEDISKS" = 1 ]; then NRPEDISKS=$(grep command.check_disk /etc/nagios/nrpe.cfg | grep ^command.check_disk[0-9] | sed -e "s/^command.check_disk\([0-9]\+\).*/\1/" | sort -n | tail -1) - DFDISKS=$(df -Pl | egrep -v "(^Filesystem|/lib/init/rw|/dev/shm|udev|rpc_pipefs)" | wc -l) + DFDISKS=$(df -Pl | grep -E -v "(^Filesystem|/lib/init/rw|/dev/shm|udev|rpc_pipefs)" | wc -l) [ "$NRPEDISKS" = "$DFDISKS" ] || echo 'IS_NRPEDISKS FAILED!' fi @@ -310,7 +310,7 @@ if [ -e /etc/debian_version ]; then fi if [ "$IS_APACHEMUNIN" = 1 ]; then - test -e /etc/apache2/apache2.conf && ( is_debianversion stretch || ( egrep -q "^env.url.*/server-status-[[:alnum:]]{4}" /etc/munin/plugin-conf.d/munin-node && egrep -q "/server-status-[[:alnum:]]{4}" /etc/apache2/apache2.conf || egrep -q "/server-status-[[:alnum:]]{4}" /etc/apache2/apache2.conf /etc/apache2/mods-enabled/status.conf 2>/dev/null || echo 'IS_APACHEMUNIN FAILED!' ) ) + test -e /etc/apache2/apache2.conf && ( is_debianversion stretch || ( grep -E -q "^env.url.*/server-status-[[:alnum:]]{4}" /etc/munin/plugin-conf.d/munin-node && grep -E -q "/server-status-[[:alnum:]]{4}" /etc/apache2/apache2.conf || grep -E -q "/server-status-[[:alnum:]]{4}" /etc/apache2/apache2.conf /etc/apache2/mods-enabled/status.conf 2>/dev/null || echo 'IS_APACHEMUNIN FAILED!' ) ) test -e /etc/apache2/apache2.conf && ( is_debianversion stretch && ( test -h /etc/apache2/mods-enabled/status.load && test -h /etc/munin/plugins/apache_accesses && test -h /etc/munin/plugins/apache_processes && test -h /etc/munin/plugins/apache_accesses || echo 'IS_APACHEMUNIN FAILED!' ) ) fi @@ -420,10 +420,10 @@ if [ -e /etc/debian_version ]; then # Verify if all if are in auto if [ "$IS_AUTOIF" = 1 ]; then - is_debianversion stretch || for interface in `/sbin/ifconfig -s |tail -n +2 |egrep -v "^(lo|vnet|docker|veth|tun|tap|macvtap)" |cut -d " " -f 1 |tr "\n" " "`; do + is_debianversion stretch || for interface in `/sbin/ifconfig -s |tail -n +2 |grep -E -v "^(lo|vnet|docker|veth|tun|tap|macvtap)" |cut -d " " -f 1 |tr "\n" " "`; do grep -q "^auto $interface" /etc/network/interfaces || (echo 'IS_AUTOIF FAILED!' && break) done - is_debianversion stretch && for interface in `/sbin/ip address show up | grep ^[0-9]*: |egrep -v "(lo|vnet|docker|veth|tun|tap|macvtap)" | cut -d " " -f 2 |tr -d : |cut -d@ -f1 |tr "\n" " "`; do + is_debianversion stretch && for interface in `/sbin/ip address show up | grep ^[0-9]*: |grep -E -v "(lo|vnet|docker|veth|tun|tap|macvtap)" | cut -d " " -f 2 |tr -d : |cut -d@ -f1 |tr "\n" " "`; do grep -q "^auto $interface" /etc/network/interfaces || (echo 'IS_AUTOIF FAILED!' && break) done fi @@ -830,7 +830,7 @@ if [ `uname -s` == "OpenBSD" ]; then # if [ "$IS_NRPEDISKS" = 1 ]; then # NRPEDISKS=$(grep command.check_disk /etc/nrpe.cfg 2>/dev/null | grep ^command.check_disk[0-9] | sed -e "s/^command.check_disk\([0-9]\+\).*/\1/" | sort -n | tail -1) -# DFDISKS=$(df -Pl | egrep -v "(^Filesystem|/lib/init/rw|/dev/shm|udev|rpc_pipefs)" | wc -l) +# DFDISKS=$(df -Pl | grep -E -v "(^Filesystem|/lib/init/rw|/dev/shm|udev|rpc_pipefs)" | wc -l) # [ "$NRPEDISKS" = "$DFDISKS" ] || echo 'IS_NRPEDISKS FAILED!' # fi @@ -874,8 +874,8 @@ if [ "$IS_USRSHARESCRIPTS" = 1 ]; then fi if [ "$IS_SSHPERMITROOTNO" = 1 ]; then - is_debianversion stretch || ( egrep -qi "PermitRoot.*no" /etc/ssh/sshd_config || echo 'IS_SSHPERMITROOTNO FAILED!' ) - is_debianversion stretch && grep -q ^PermitRoot /etc/ssh/sshd_config && ( egrep -qi "PermitRoot.*no" /etc/ssh/sshd_config || echo 'IS_SSHPERMITROOTNO FAILED!' ) + is_debianversion stretch || ( grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config || echo 'IS_SSHPERMITROOTNO FAILED!' ) + is_debianversion stretch && grep -q ^PermitRoot /etc/ssh/sshd_config && ( grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config || echo 'IS_SSHPERMITROOTNO FAILED!' ) fi if [ "$IS_EVOMAINTENANCEUSERS" = 1 ]; then From 311423d295a72e63a17eae69e50b4e8c8aabaa65 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Beno=C3=AEt=20S?= Date: Tue, 3 Apr 2018 11:41:45 +0200 Subject: [PATCH 6/7] Update CHANGELOG --- CHANGELOG | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG b/CHANGELOG index 315d0e2..f9b76e4 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -10,11 +10,13 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0. * New checks: IS_DUPLICATE_FS_LEVEL IS_EVOMAINTENANCE_FW + IS_EVOLIX_USER ### Changed * Enabling IS_EVOBACKUP by default * Better output for IS_MYSQLMUNIN +* Custom limit for IS_NOTUPGRADED ## [0.11] - 2018-02-07 From a2fef6cb9bc15c045dbe646aa345458a428e73d5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Beno=C3=AEt=20S?= Date: Tue, 3 Apr 2018 11:46:29 +0200 Subject: [PATCH 7/7] Update CHANGELOG --- CHANGELOG | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG b/CHANGELOG index f9b76e4..1f1962a 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -17,6 +17,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0. * Enabling IS_EVOBACKUP by default * Better output for IS_MYSQLMUNIN * Custom limit for IS_NOTUPGRADED +* IS_SSHALLOWUSERS now check also for AllowGroups ## [0.11] - 2018-02-07