Release 21.07

.gitignore

@@ -1,4 +1,3 @@
 .vagrant
 
 *.swp
-.DS_Store

CHANGELOG

@@ -15,112 +15,16 @@ and this project **does not adhere to [Semantic Versioning](http://semver.org/sp
 
 ### Security
 
-## [22.06] 2022-06-03
-
-### Added
-
-* IS_AUTOIF: Ignore WireGuard interfaces
-* IS_NETWORKING_SERVICE: check if networking service is enabled
-
-### Changed
-
-* IS_DEBIANSECURITY: Fix Debian security repo for Bullseye, cf https://www.debian.org/releases/stable/errata
-
-## [22.05] 2022-05-12
-
-### Changed
-
-* IS_EVOBACKUP_EXCLUDE_MOUNT: exclude scripts without Rsync command
-
-## [22.04.1] 2022-04-25
-
-### Changed
-
-* fix various shellcheck violations
-
-### Fixed
-
-* IS_EVOBACKUP_EXCLUDE_MOUNT: fix one-file-system restriction
-
-## [22.04] 2022-04-25
-
-### Changed
-
-* IS_EVOBACKUP_EXCLUDE_MOUNT : skip if --one-file-system is used
-
-### Fixed
-
-* check_versions: "IS_CHECK_VERSIONS" was checked but "IS_VERSIONS_CHECK" was echoed, now "IS_CHECK_VERSIONS" everywhere
-
-### Security
-
-* check_debiansecurity: Consider both https://deb\.debian\.org/debian-security/ and https://security\.debian\.org/debian-security/ as valid since both are documented as such.
-
-## [22.03.1] 2022-03-22
-
-### Changed
-
-* check_autoif : Ignore lxcbr interfaces, new since bullseye
-
-## [22.03] 2022-03-15
-
-### Added
-
-* check_mysqlmunin : Complain if munin plugin mysql_commands returns an error
-* check_versions : track minifirewall version
-
-## [21.10.4] 2021-10-25
-
-### Changed
-
-* IS_CHECK_VERSIONS disabled in cron mode
-
-## [21.10.3] 2021-10-22
-
-### Added
-
-* Check for newer versions
-* don't use "add-vm --version" yet
-
-## [21.10.2] 2021-10-22
-
-### Changed
-
-* Let's try the --version flag before falling back to grep for the constant
-
-## [21.10.1] 2021-10-01
-
-### Added
-
-* IS_SSHALLOWUSERS: also scan /etc/ssh/sshd_config.d
-* IS_CHECK_VERSIONS: check installed versions of Evolix programs
-
-## [21.10] 2021-10-01
-
-### Fixed
-
-* IS_DEBIANSECURITY: optional trailing slash 
-
-## [21.09] 2021-09-30
-
-### Added
-
-* Check for bullseye security repository
-* Checks for new minifirewall configuration
-* Improve MySQL utils configuration checks
-
 ## [21.07] 2021-07-07
 
 ### Added
 
-* Preliminary Debian 11 « Bullseye » support
+* Initial support for Debian 11 « Bullseye »
 
 ### Fixed
 
 * IS_HARDWARERAIDTOOL: match more RAID PCI cards
 
-### Security
-
 ## [20.12] 2021-01-18
 
 ### Fixed

evocheck.sh

@@ -4,7 +4,7 @@
 # Script to verify compliance of a Debian/OpenBSD server
 # powered by Evolix
 
-VERSION="22.06"
+VERSION="21.07"
 readonly VERSION
 
 # base functions
@@ -13,14 +13,13 @@ show_version() {
     cat <<END
 evocheck version ${VERSION}
 
-Copyright 2009-2022 Evolix <info@evolix.fr>,
+Copyright 2009-2021 Evolix <info@evolix.fr>,
                     Romain Dessort <rdessort@evolix.fr>,
                     Benoit Série <bserie@evolix.fr>,
                     Gregory Colpart <reg@evolix.fr>,
                     Jérémy Lecour <jlecour@evolix.fr>,
                     Tristan Pilat <tpilat@evolix.fr>,
-                    Victor Laborie <vlaborie@evolix.fr>,
-                    Alexis Ben Miloud--Josselin <abenmiloud@evolix.fr>,
+                    Victor Laborie <vlaborie@evolix.fr>
                     and others.
 
 evocheck comes with ABSOLUTELY NO WARRANTY.  This is free software,
@@ -75,7 +74,7 @@ detect_os() {
 }
 
 is_debian() {
-    test -n "${DEBIAN_RELEASE}"
+  test -n "${DEBIAN_RELEASE}"
 }
 is_debian_lenny() {
     test "${DEBIAN_RELEASE}" = "lenny"
@@ -143,9 +142,9 @@ failed() {
     RC=1
     if [ "${QUIET}" != 1 ]; then
         if [ -n "${check_comments}" ] && [ "${VERBOSE}" = 1 ]; then
-            printf "%s FAILED! %s\n" "${check_name}" "${check_comments}" >> "${main_output_file}"
+            printf "%s FAILED! %s\n" "${check_name}" "${check_comments}" 2>&1
         else
-            printf "%s FAILED!\n" "${check_name}" >> "${main_output_file}"
+            printf "%s FAILED!\n" "${check_name}" 2>&1
         fi
     fi
 }
@@ -221,6 +220,7 @@ check_vartmpfs() {
     else
         df /var/tmp | grep -q tmpfs || failed "IS_VARTMPFS" "/var/tmp is not a tmpfs"
     fi
+    
 }
 check_serveurbase() {
     is_installed serveur-base || failed "IS_SERVEURBASE" "serveur-base package is not installed"
@@ -233,20 +233,8 @@ check_syslogconf() {
         || failed "IS_SYSLOGCONF" "syslog evolix config file missing"
 }
 check_debiansecurity() {
-    if is_debian_bullseye; then
-        # https://www.debian.org/releases/bullseye/amd64/release-notes/ch-information.html#security-archive
-        # https://www.debian.org/security/
-        pattern="^deb  ?(\[.*\])? ?http://security\.debian\.org/debian-security/? bullseye-security main"
-    elif is_debian_buster; then
-        pattern="^deb  ?(\[.*\])? ?http://security\.debian\.org/debian-security/? buster/updates main"
-    elif is_debian_stretch; then
-        pattern="^deb  ?(\[.*\])? ?http://security\.debian\.org/debian-security/? stretch/updates main"
-    else
-        pattern="^deb.*security"
-    fi
-
-    source_file="/etc/apt/sources.list"
-    grep -qE "${pattern}" "${source_file}" || failed "IS_DEBIANSECURITY" "missing debian security repository"
+    grep -q "^deb.*security" /etc/apt/sources.list \
+        || failed "IS_DEBIANSECURITY" "missing debian security repository"
 }
 check_aptitudeonly() {
     if is_debian_squeeze || is_debian_wheezy; then
@@ -261,7 +249,7 @@ check_aptitude() {
 }
 check_aptgetbak() {
     if is_debian_jessie || is_debian_stretch || is_debian_buster || is_debian_bullseye; then
-        test -e /usr/bin/apt-get.bak && failed "IS_APTGETBAK" "prohibit the installation of apt-get.bak with dpkg-divert(1)"
+        test -e /usr/bin/apt-get.bak && failed "IS_APTGETBAK" "missing dpkg-divert apt-get.bak"
     fi
 }
 check_apticron() {
@@ -317,7 +305,7 @@ check_customcrontab() {
     test "$found_lines" = 4 && failed "IS_CUSTOMCRONTAB" "missing custom field in crontab"
 }
 check_sshallowusers() {
-    grep -E -qir "(AllowUsers|AllowGroups)" /etc/ssh/sshd_config /etc/ssh/sshd_config.d \
+    grep -E -qi "(AllowUsers|AllowGroups)" /etc/ssh/sshd_config \
         || failed "IS_SSHALLOWUSERS" "missing AllowUsers or AllowGroups directive in sshd_config"
 }
 check_diskperf() {
@@ -330,16 +318,11 @@ check_tmoutprofile() {
 check_alert5boot() {
     if is_debian_buster || is_debian_bullseye; then
         grep -qs "^date" /usr/share/scripts/alert5.sh || failed "IS_ALERT5BOOT" "boot mail is not sent by alert5 init script"
-        if [ -f /etc/systemd/system/alert5.service ]; then
-            systemctl is-enabled alert5.service -q || failed "IS_ALERT5BOOT" "alert5 unit is not enabled"
-        else
-            failed "IS_ALERT5BOOT" "alert5 unit file is missing"
-        fi
+        test -f /etc/systemd/system/alert5.service || failed "IS_ALERT5BOOT" "alert5 unit file is missing"
+        systemctl is-enabled alert5 -q || failed "IS_ALERT5BOOT" "alert5 unit is not enabled"
     else
         if [ -n "$(find /etc/rc2.d/ -name 'S*alert5')" ]; then
             grep -q "^date" /etc/rc2.d/S*alert5 || failed "IS_ALERT5BOOT" "boot mail is not sent by alert5 init script"
-        elif [ -n "$(find /etc/init.d/ -name 'alert5')" ]; then
-            grep -q "^date" /etc/init.d/alert5 || failed "IS_ALERT5BOOT" "boot mail is not sent by alert5 int script"
         else
             failed "IS_ALERT5BOOT" "alert5 init script is missing"
         fi
@@ -353,9 +336,6 @@ check_alert5minifw() {
         if [ -n "$(find /etc/rc2.d/ -name 'S*alert5')" ]; then
             grep -q "^/etc/init.d/minifirewall" /etc/rc2.d/S*alert5 \
                 || failed "IS_ALERT5MINIFW" "Minifirewall is not started by alert5 init script"
-        elif [ -n "$(find /etc/init.d/ -name 'alert5')" ]; then
-            grep -q "^/etc/init.d/minifirewall" /etc/init.d/alert5 \
-                || failed "IS_ALERT5MINIFW" "Minifirewall is not started by alert5 init script"
         else
             failed "IS_ALERT5MINIFW" "alert5 init script is missing"
         fi
@@ -363,14 +343,7 @@ check_alert5minifw() {
 }
 check_minifw() {
     /sbin/iptables -L -n | grep -q -E "^ACCEPT\s*all\s*--\s*31\.170\.8\.4\s*0\.0\.0\.0/0\s*$" \
-        || failed "IS_MINIFW" "minifirewall seems not started"
-}
-check_minifw_includes() {
-    if is_debian_bullseye; then
-        if grep -q -e '/sbin/iptables' -e '/sbin/ip6tables' "${MINIFW_FILE}"; then
-            failed "IS_MINIFWINCLUDES" "minifirewall has direct iptables invocations in ${MINIFW_FILE} that should go in /etc/minifirewall.d/"
-        fi
-    fi
+        || failed "IS_MINIFW" "minifirewall seems not starded"
 }
 check_nrpeperms() {
     if [ -d /etc/nagios ]; then
@@ -432,20 +405,17 @@ check_apachemunin() {
 check_mysqlutils() {
     MYSQL_ADMIN=${MYSQL_ADMIN:-mysqladmin}
     if is_installed mysql-server; then
-        # With Debian 11 and later, root can connect to MariaDB with the socket
-        if is_debian_wheezy || is_debian_jessie ||  is_debian_stretch || is_debian_buster; then
-            # You can configure MYSQL_ADMIN in evocheck.cf
-            if ! grep -qs "^user *= *${MYSQL_ADMIN}" /root/.my.cnf; then
-                failed "IS_MYSQLUTILS" "${MYSQL_ADMIN} missing in /root/.my.cnf"
-            fi
+        # You can configure MYSQL_ADMIN in evocheck.cf
+        if ! grep -qs "$MYSQL_ADMIN" /root/.my.cnf; then
+            failed "IS_MYSQLUTILS" "mysqladmin missing in /root/.my.cnf"
         fi
         if ! test -x /usr/bin/mytop; then
             if ! test -x /usr/local/bin/mytop; then
                 failed "IS_MYSQLUTILS" "mytop binary missing"
             fi
         fi
-        if ! grep -qs '^user *=' /root/.mytop; then
-            failed "IS_MYSQLUTILS" "credentials missing in /root/.mytop"
+        if ! grep -qs debian-sys-maint /root/.mytop; then
+            failed "IS_MYSQLUTILS" "debian-sys-maint missing in /root/.mytop"
         fi
     fi
 }
@@ -487,8 +457,7 @@ check_squid() {
             && grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -d $host -j ACCEPT" "$MINIFW_FILE" \
             && grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -d 127.0.0.(1|0/8) -j ACCEPT" "$MINIFW_FILE" \
             && grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-port.* $http_port" "$MINIFW_FILE";
-        } || grep -qE "^PROXY='?on'?" "$MINIFW_FILE" \
-          || failed "IS_SQUID" "missing squid rules in minifirewall"
+        } || failed "IS_SQUID" "missing squid rules in minifirewall"
     fi
 }
 check_evomaintenance_fw() {
@@ -577,9 +546,9 @@ check_network_interfaces() {
 # Verify if all if are in auto
 check_autoif() {
     if is_debian_stretch || is_debian_buster || is_debian_bullseye; then
-        interfaces=$(/sbin/ip address show up | grep "^[0-9]*:" | grep -E -v "(lo|vnet|docker|veth|tun|tap|macvtap|vrrp|lxcbr|wg)" | cut -d " " -f 2 | tr -d : | cut -d@ -f1 | tr "\n" " ")
+        interfaces=$(/sbin/ip address show up | grep "^[0-9]*:" | grep -E -v "(lo|vnet|docker|veth|tun|tap|macvtap)" | cut -d " " -f 2 | tr -d : | cut -d@ -f1 | tr "\n" " ")
     else
-        interfaces=$(/sbin/ifconfig -s | tail -n +2 | grep -E -v "^(lo|vnet|docker|veth|tun|tap|macvtap|vrrp)" | cut -d " " -f 1 |tr "\n" " ")
+        interfaces=$(/sbin/ifconfig -s | tail -n +2 | grep -E -v "^(lo|vnet|docker|veth|tun|tap|macvtap)" | cut -d " " -f 1 |tr "\n" " ")
     fi
     for interface in $interfaces; do
         if ! grep -q "^auto $interface" /etc/network/interfaces; then
@@ -595,16 +564,6 @@ check_interfacesgw() {
     number=$(grep -Ec "^[^#]*gateway [0-9a-fA-F]+:" /etc/network/interfaces)
     test "$number" -gt 1 && failed "IS_INTERFACESGW" "there is more than 1 IPv6 gateway"
 }
-# Verification de l’état du service networking
-check_networking_service() {
-    if is_debian_stretch || is_debian_buster || is_debian_bullseye; then
-        if systemctl is-enabled networking.service > /dev/null; then
-            if ! systemctl is-active networking.service > /dev/null; then
-                failed "IS_NETWORKING_SERVICE" "networking.service is not active"
-            fi
-        fi
-    fi
-}
 # Verification de la mise en place d'evobackup
 check_evobackup() {
     evobackup_found=$(find /etc/cron* -name '*evobackup*' | wc -l)
@@ -612,23 +571,16 @@ check_evobackup() {
 }
 # Vérification de l'exclusion des montages (NFS) dans les sauvegardes
 check_evobackup_exclude_mount() {
-    excludes_file=$(mktemp --tmpdir="${TMPDIR:-/tmp}" "evocheck.evobackup_exclude_mount.XXXXX")
-    files_to_cleanup="${files_to_cleanup} ${excludes_file}"
-
+    excludes_file=$(mktemp)
+    # shellcheck disable=SC2064
+    trap "rm -f ${excludes_file}" 0
     # shellcheck disable=SC2044
     for evobackup_file in $(find /etc/cron* -name '*evobackup*' | grep -v -E ".disabled$"); do
-        # if the file seems to be a backup script, with an Rsync invocation
-        if grep -q "^\s*rsync" "${evobackup_file}"; then
-            # If rsync is not limited by "one-file-system"
-            # then we verify that every mount is excluded
-            if ! grep -q -- "^\s*--one-file-system" "${evobackup_file}"; then
-                grep -- "--exclude " "${evobackup_file}" | grep -E -o "\"[^\"]+\"" | tr -d '"' > "${excludes_file}"
-                not_excluded=$(findmnt --type nfs,nfs4,fuse.sshfs, -o target --noheadings | grep -v -f "${excludes_file}")
-                for mount in ${not_excluded}; do
-                    failed "IS_EVOBACKUP_EXCLUDE_MOUNT" "${mount} is not excluded from ${evobackup_file} backup script"
-                done
-            fi
-        fi
+        grep -- "--exclude " "${evobackup_file}" | grep -E -o "\"[^\"]+\"" | tr -d '"' > "${excludes_file}"
+        not_excluded=$(findmnt --type nfs,nfs4,fuse.sshfs, -o target --noheadings | grep -v -f "${excludes_file}")
+        for mount in ${not_excluded}; do
+            failed "IS_EVOBACKUP_EXCLUDE_MOUNT" "${mount} is not excluded from ${evobackup_file} backup script"
+        done
     done
 }
 # Verification de la presence du userlogrotate
@@ -742,7 +694,6 @@ check_backupuptodate() {
     backup_dir="/home/backup"
     if [ -d "${backup_dir}" ]; then
         if [ -n "$(ls -A ${backup_dir})" ]; then
-            # shellcheck disable=SC2231
             for file in ${backup_dir}/*; do
                 limit=$(date +"%s" -d "now - 2 day")
                 updated_at=$(stat -c "%Y" "$file")
@@ -835,10 +786,8 @@ check_tune2fs_m5() {
 check_evolinuxsudogroup() {
     if is_debian_stretch || is_debian_buster || is_debian_bullseye; then
         if grep -q "^evolinux-sudo:" /etc/group; then
-            if [ -f /etc/sudoers.d/evolinux ]; then
-                grep -qE '^%evolinux-sudo +ALL ?= ?\(ALL:ALL\) ALL' /etc/sudoers.d/evolinux \
-                    || failed "IS_EVOLINUXSUDOGROUP" "missing evolinux-sudo directive in sudoers file"
-            fi
+            grep -qE '^%evolinux-sudo +ALL ?= ?\(ALL:ALL\) ALL' /etc/sudoers.d/evolinux \
+                || failed "IS_EVOLINUXSUDOGROUP" "missing evolinux-sudo directive in sudoers file"
         fi
     fi
 }
@@ -855,7 +804,7 @@ check_userinadmgroup() {
 }
 check_apache2evolinuxconf() {
     if is_debian_stretch || is_debian_buster || is_debian_bullseye; then
-        if is_installed apache2; then
+        if test -d /etc/apache2; then
             { test -L /etc/apache2/conf-enabled/z-evolinux-defaults.conf \
                 && test -L /etc/apache2/conf-enabled/zzz-evolinux-custom.conf \
                 && test -f /etc/apache2/ipaddr_whitelist.conf;
@@ -971,7 +920,7 @@ check_mongo_backup() {
         # You could change the default path in /etc/evocheck.cf
         MONGO_BACKUP_PATH=${MONGO_BACKUP_PATH:-"/home/backup/mongodump"}
         if [ -d "$MONGO_BACKUP_PATH" ]; then
-            for file in "${MONGO_BACKUP_PATH}"/*/*.{json,bson}.*; do
+            for file in "${MONGO_BACKUP_PATH}"/*/*.{json,bson}; do
                 # Skip indexes file.
                 if ! [[ "$file" =~ indexes ]]; then
                     limit=$(date +"%s" -d "now - 2 day")
@@ -1034,8 +983,6 @@ check_mysqlmunin() {
                     test "${VERBOSE}" = 1 || break
                 fi
             done
-            munin-run mysql_commands 2> /dev/null > /dev/null
-            test $? -eq 0 || failed "IS_MYSQLMUNIN" "Munin plugin mysql_commands returned an error"
         fi
     fi
 }
@@ -1070,7 +1017,7 @@ check_phpevolinuxconf() {
 check_squidlogrotate() {
     if is_debian_stretch || is_debian_buster || is_debian_bullseye; then
         if is_installed squid; then
-            grep -q -e monthly -e daily /etc/logrotate.d/squid \
+            grep -q monthly /etc/logrotate.d/squid \
                 || failed "IS_SQUIDLOGROTATE" "missing squid logrotate file"
         fi
     fi
@@ -1092,10 +1039,8 @@ check_squidevolinuxconf() {
 check_duplicate_fs_label() {
     # Do it only if thereis blkid binary
     BLKID_BIN=$(command -v blkid)
-    if [ -n "$BLKID_BIN" ]; then
-        tmpFile=$(mktemp --tmpdir="${TMPDIR:-/tmp}" "evocheck.duplicate_fs_label.XXXXX")
-        files_to_cleanup="${files_to_cleanup} ${tmpFile}"
-
+    if [ -x "$BLKID_BIN" ]; then
+        tmpFile=$(mktemp -p /tmp)
         parts=$($BLKID_BIN -c /dev/null | grep -ve raid_member -e EFI_SYSPART | grep -Eo ' LABEL=".*"' | cut -d'"' -f2)
         for part in $parts; do
             echo "$part" >> "$tmpFile"
@@ -1108,6 +1053,7 @@ check_duplicate_fs_label() {
             labels=$(echo -n $tmpOutput | tr '\n' ' ')
             failed "IS_DUPLICATE_FS_LABEL" "Duplicate labels: $labels"
         fi
+        rm "$tmpFile"
     else
         failed "IS_DUPLICATE_FS_LABEL" "blkid not found in ${PATH}"
     fi
@@ -1217,20 +1163,14 @@ check_usrsharescripts() {
     test "$expected" = "$actual" || failed "IS_USRSHARESCRIPTS" "/usr/share/scripts must be $expected"
 }
 check_sshpermitrootno() {
-    sshd_args="-C addr=,user=,host=,laddr=,lport=0"
-    if is_debian_jessie || is_debian_stretch; then
-	# Noop, we'll use the default $sshd_args
-        :
-    elif is_debian_buster; then
-	sshd_args="${sshd_args},rdomain="
+    if is_debian_stretch || is_debian_buster || is_debian_bullseye; then
+        if grep -q "^PermitRoot" /etc/ssh/sshd_config; then
+            grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config \
+                || failed "IS_SSHPERMITROOTNO" "PermitRoot should be set at no"
+        fi
     else
-	# NOTE: From Debian Bullseye 11 onward, with OpenSSH 8.1, the argument
-        # -T doesn't require the additional -C.
-	sshd_args=
-    fi
-    # XXX: We want parameter expension here
-    if ! (sshd -T $sshd_args | grep -q 'permitrootlogin no'); then
-       failed "IS_SSHPERMITROOTNO" "PermitRoot should be set to no"
+        grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config \
+            || failed "IS_SSHPERMITROOTNO" "PermitRoot should be set at no"
     fi
 }
 check_evomaintenanceusers() {
@@ -1370,165 +1310,12 @@ check_nginx_letsencrypt_uptodate() {
     fi
 }
 
-check_lxc_container_resolv_conf() {
-    if is_installed lxc; then
-        container_list=$(lxc-ls)
-        current_resolvers=$(grep nameserver /etc/resolv.conf | sed 's/nameserver//g' )
-
-       for container in $container_list; do
-            if [ -f "/var/lib/lxc/${container}/rootfs/etc/resolv.conf" ]; then
-
-                while read -r resolver; do
-                    if ! grep -qE "^nameserver\s+${resolver}" "/var/lib/lxc/${container}/rootfs/etc/resolv.conf"; then
-                        failed "IS_LXC_CONTAINER_RESOLV_CONF" "resolv.conf miss-match beween host and container : missing nameserver ${resolver} in container ${container} resolv.conf"
-                    fi
-                done <<< "${current_resolvers}"
-
-            else
-                failed "IS_LXC_CONTAINER_RESOLV_CONF" "resolv.conf missing in container ${container}"
-            fi
-        done 
-    fi
-}
-download_versions() {
-    local file
-    file=${1:-}
-
-    ## The file is supposed to list programs : each on a line, then its latest version number
-    ## Examples:
-    # evoacme 21.06
-    # evomaintenance 0.6.4
-
-    if is_debian; then
-        versions_url="https://upgrades.evolix.org/versions-${DEBIAN_RELEASE}"
-    elif is_openbsd; then
-        versions_url="https://upgrades.evolix.org/versions-${OPENBSD_RELEASE}"
-    else
-        failed "IS_CHECK_VERSIONS" "error determining os release"
-    fi
-
-    # fetch timeout, in seconds
-    timeout=10
-
-    if command -v curl > /dev/null; then
-        curl --max-time ${timeout} --fail --silent --output "${versions_file}" "${versions_url}"
-    elif command -v wget > /dev/null; then
-        wget --timeout=${timeout} --quiet "${versions_url}" -O "${versions_file}"
-    elif command -v GET; then
-        GET -t ${timeout}s "${versions_url}" > "${versions_file}"
-    else
-        failed "IS_CHECK_VERSIONS" "failed to find curl, wget or GET"
-    fi
-    test "$?" -eq 0 || failed "IS_CHECK_VERSIONS" "failed to download ${versions_url} to ${versions_file}"
-}
-get_command() {
-    local program
-    program=${1:-}
-
-    case "${program}" in
-        ## Special cases where the program name is different than the command name
-        evocheck) echo "${0}" ;;
-        evomaintenance) command -v "evomaintenance.sh" ;;
-        listupgrade) command -v "evolistupgrade.sh" ;;
-        old-kernel-autoremoval) command -v "old-kernel-autoremoval.sh" ;;
-        mysql-queries-killer) command -v "mysql-queries-killer.sh" ;;
-        minifirewall) echo "/etc/init.d/minifirewall" ;;
-
-        ## General case, where the program name is the same as the command name
-        *) command -v "${program}" ;;
-    esac
-}
-get_version() {
-    local program
-    local command
-    program=${1:-}
-    command=${2:-}
-
-    case "${program}" in
-        ## Special case if `command --version => 'command` is not the standard way to get the version
-        # my_command)
-        #    /path/to/my_command --get-version 
-        #    ;;
-
-        add-vm)
-            grep '^VERSION=' "${command}" | head -1 | cut -d '=' -f 2
-            ;;
-        minifirewall)
-            ${command} version | head -1 | cut -d ' ' -f 3
-            ;;
-        ## Let's try the --version flag before falling back to grep for the constant
-        kvmstats)
-            if ${command} --version > /dev/null 2> /dev/null; then
-                 ${command} --version 2> /dev/null | head -1 | cut -d ' ' -f 3
-            else
-                grep '^VERSION=' "${command}" | head -1 | cut -d '=' -f 2
-            fi
-            ;;
-
-        ## General case to get the version
-        *) ${command} --version 2> /dev/null | head -1 | cut -d ' ' -f 3 ;;
-    esac
-}
-check_version() {
-    local program
-    local expected_version
-    program=${1:-}
-    expected_version=${2:-}
-
-    command=$(get_command "${program}")
-    if [ -n "${command}" ]; then
-        # shellcheck disable=SC2086
-        actual_version=$(get_version "${program}" "${command}")
-        # printf "program:%s expected:%s actual:%s\n" "${program}" "${expected_version}" "${actual_version}"
-        if [ -z "${actual_version}" ]; then
-            failed "IS_CHECK_VERSIONS" "failed to lookup actual version of ${program}"
-        elif dpkg --compare-versions "${actual_version}" lt "${expected_version}"; then
-            failed "IS_CHECK_VERSIONS" "${program} version ${actual_version} is older than expected version ${expected_version}"
-        elif dpkg --compare-versions "${actual_version}" gt "${expected_version}"; then
-            failed "IS_CHECK_VERSIONS" "${program} version ${actual_version} is newer than expected version ${expected_version}, you should update your index."
-        else
-            : # Version check OK
-        fi
-    fi
-}
-add_to_path() {
-    local new_path
-    new_path=${1:-}
-
-    echo "$PATH" | grep -qF "${new_path}" || export PATH="${PATH}:${new_path}"
-}
-check_versions() {
-    versions_file=$(mktemp --tmpdir="${TMPDIR:-/tmp}" "evocheck.versions.XXXXX")
-    files_to_cleanup="${files_to_cleanup} ${versions_file}"
-
-    download_versions "${versions_file}"
-    add_to_path "/usr/share/scripts"
-
-    grep -v '^ *#' < "${versions_file}" | while IFS= read -r line; do
-        local program
-        local version
-        program=$(echo "${line}" | cut -d ' ' -f 1)
-        version=$(echo "${line}" | cut -d ' ' -f 2)
-
-        if [ -n "${program}" ]; then
-            if [ -n "${version}" ]; then
-                check_version "${program}" "${version}"
-            else
-                failed "IS_CHECK_VERSIONS" "failed to lookup expected version for ${program}"
-            fi
-        fi
-    done
-}
-
 main() {
     # Default return code : 0 = no error
     RC=0
     # Detect operating system name, version and release
     detect_os
 
-    main_output_file=$(mktemp --tmpdir="${TMPDIR:-/tmp}" "evocheck.main.XXXXX")
-    files_to_cleanup="${files_to_cleanup} ${main_output_file}"
-
     #-----------------------------------------------------------
     # Tests communs à tous les systèmes
     #-----------------------------------------------------------
@@ -1577,8 +1364,6 @@ main() {
         test "${IS_ALERT5MINIFW:=1}" = 1 && test "${IS_MINIFW:=1}" = 1 && check_minifw
         test "${IS_NRPEPERMS:=1}" = 1 && check_nrpeperms
         test "${IS_MINIFWPERMS:=1}" = 1 && check_minifwperms
-        # Enable when minifirewall is released
-        test "${IS_MINIFWINCLUDES:=0}" = 1 && check_minifw_includes
         test "${IS_NRPEDISKS:=0}" = 1 && check_nrpedisks
         test "${IS_NRPEPID:=1}" = 1 && check_nrpepid
         test "${IS_GRSECPROCS:=1}" = 1 && check_grsecprocs
@@ -1599,7 +1384,6 @@ main() {
         test "${IS_NETWORK_INTERFACES:=1}" = 1 && check_network_interfaces
         test "${IS_AUTOIF:=1}" = 1 && check_autoif
         test "${IS_INTERFACESGW:=1}" = 1 && check_interfacesgw
-        test "${IS_NETWORKING_SERVICE:=1}" = 1 && check_networking_service
         test "${IS_EVOBACKUP:=1}" = 1 && check_evobackup
         test "${IS_EVOBACKUP_EXCLUDE_MOUNT:=1}" = 1 && check_evobackup_exclude_mount
         test "${IS_USERLOGROTATE:=1}" = 1 && check_userlogrotate
@@ -1652,8 +1436,6 @@ main() {
         test "${IS_APT_VALID_UNTIL:=1}" = 1 && check_apt_valid_until
         test "${IS_CHROOTED_BINARY_UPTODATE:=1}" = 1 && check_chrooted_binary_uptodate
         test "${IS_NGINX_LETSENCRYPT_UPTODATE:=1}" = 1 && check_nginx_letsencrypt_uptodate
-        test "${IS_LXC_CONTAINER_RESOLV_CONF:=1}" = 1 && check_lxc_container_resolv_conf
-        test "${IS_CHECK_VERSIONS:=1}" = 1 && check_versions
     fi
 
     #-----------------------------------------------------------
@@ -1758,21 +1540,8 @@ main() {
         # - NRPEDISK et NRPEPOSTFIX
     fi
 
-    if [ -f "${main_output_file}" ]; then
-        lines_found=$(wc -l < "${main_output_file}")
-        # shellcheck disable=SC2086
-        if [ ${lines_found} -gt 0 ]; then
-
-            cat "${main_output_file}" 2>&1
-        fi
-    fi
-
     exit ${RC}
 }
-cleanup_temp_files() {
-    # shellcheck disable=SC2086
-    rm -f ${files_to_cleanup}
-}
 
 PROGNAME=$(basename "$0")
 # shellcheck disable=SC2034
@@ -1786,10 +1555,6 @@ readonly ARGS
 export LANG=C
 export LANGUAGE=C
 
-files_to_cleanup=""
-# shellcheck disable=SC2064
-trap cleanup_temp_files 0
-
 # Source configuration file
 # shellcheck disable=SC1091
 test -f /etc/evocheck.cf && . /etc/evocheck.cf
@@ -1810,7 +1575,6 @@ while :; do
             IS_KERNELUPTODATE=0
             IS_UPTIME=0
             IS_MELTDOWN_SPECTRE=0
-            IS_CHECK_VERSIONS=0
             ;;
         -v|--verbose)
             VERBOSE=1