From f379f6210a5531673c7c7d92febc3481be9b4678 Mon Sep 17 00:00:00 2001
From: Tristan <tpilat@evolix.fr>
Date: Mon, 11 Mar 2019 15:17:23 +0100
Subject: [PATCH 01/96] Under OpenBSD, add advbase value detection

---
 evocheck.sh | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index 2a61464..dda3855 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -916,6 +916,19 @@ fi
 
 if [ `uname -s` == "OpenBSD" ]; then
 
+    if [ "$IS_ADVBASE" = 1 ]; then
+        if [[ ls /etc/hostname.carp* 1> /dev/null 2>&1 ]]; then
+            for advbase in $(ifconfig carp | grep advbase | awk -F 'advbase' '{print $2}' | awk '{print $1}' | xargs); do
+            if [[ "$advbase" gt 1 ]]; then
+                echo 'IS_ADVBASE FAILED!'
+                if [[ "$VERBOSE" == 1 ]]; then
+                        echo "At least one CARP interface has advbase greater than 5 seconds!" 
+                fi
+            fi
+            done
+        fi
+    fi
+
     if [ "$IS_SOFTDEP" = 1 ]; then
         grep -q "softdep" /etc/fstab || echo 'IS_SOFTDEP FAILED!'
     fi

From c90de6ec1f040fb5e1d4a8e92d160ae83dac5ae1 Mon Sep 17 00:00:00 2001
From: Tristan <tpilat@evolix.fr>
Date: Mon, 11 Mar 2019 15:53:04 +0100
Subject: [PATCH 02/96] Under OpenBSD, fix if statement for hostname.carp file
 detection

---
 evocheck.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index dda3855..2541e8b 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -917,7 +917,7 @@ fi
 if [ `uname -s` == "OpenBSD" ]; then
 
     if [ "$IS_ADVBASE" = 1 ]; then
-        if [[ ls /etc/hostname.carp* 1> /dev/null 2>&1 ]]; then
+        if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
             for advbase in $(ifconfig carp | grep advbase | awk -F 'advbase' '{print $2}' | awk '{print $1}' | xargs); do
             if [[ "$advbase" gt 1 ]]; then
                 echo 'IS_ADVBASE FAILED!'

From 4c83cf1a28da55a13f7426af53f1ce561c7d85fc Mon Sep 17 00:00:00 2001
From: Tristan <tpilat@evolix.fr>
Date: Mon, 11 Mar 2019 16:02:41 +0100
Subject: [PATCH 03/96] Under OpenBSD, for 'wheel' group activation detection
 in sudoers file check if /etc/sudoers exists first

---
 evocheck.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index 2541e8b..59e6b95 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -934,7 +934,9 @@ if [ `uname -s` == "OpenBSD" ]; then
     fi
 
     if [ "$IS_WHEEL" = 1 ]; then
-        grep -qE "^%wheel.*$" /etc/sudoers || echo 'IS_WHEEL FAILED!'
+        if test -f /etc/sudoers; then
+            grep -qE "^%wheel.*$" /etc/sudoers || echo 'IS_WHEEL FAILED!'
+        fi
     fi
 
     if [ "$IS_SUDOADMIN" = 1 ]; then

From 2815c211f458a0f90395e0677d86dc51322fa7da Mon Sep 17 00:00:00 2001
From: Tristan <tpilat@evolix.fr>
Date: Mon, 11 Mar 2019 16:04:23 +0100
Subject: [PATCH 04/96] We don't need that part anymore

---
 evocheck.sh | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 59e6b95..5774f5a 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -939,10 +939,6 @@ if [ `uname -s` == "OpenBSD" ]; then
         fi
     fi
 
-    if [ "$IS_SUDOADMIN" = 1 ]; then
-    grep -qE "^User_Alias ADMIN=.*$" /etc/sudoers || echo 'IS_SUDOADMIN FAILED!'
-    fi
-
     if [ "$IS_PKGMIRROR" = 1 ]; then
         grep -qE "^export PKG_PATH=http://ftp\.fr\.openbsd\.org/pub/OpenBSD/[0-9.]+/packages/[a-z0-9]+/$" /root/.profile || echo 'IS_PKGMIRROR FAILED!'
     fi

From 5be38dc4f505117f594e33dd7e7d137236a5ea22 Mon Sep 17 00:00:00 2001
From: Tristan <tpilat@evolix.fr>
Date: Mon, 11 Mar 2019 16:32:58 +0100
Subject: [PATCH 05/96] Update OpenBSD IS_PKGMIRROR check

---
 evocheck.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index 5774f5a..675223d 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -940,7 +940,10 @@ if [ `uname -s` == "OpenBSD" ]; then
     fi
 
     if [ "$IS_PKGMIRROR" = 1 ]; then
-        grep -qE "^export PKG_PATH=http://ftp\.fr\.openbsd\.org/pub/OpenBSD/[0-9.]+/packages/[a-z0-9]+/$" /root/.profile || echo 'IS_PKGMIRROR FAILED!'
+        grep -qE "^https://cdn\.openbsd\.org/pub/OpenBSD" /etc/installurl || echo 'IS_PKGMIRROR FAILED!'
+        if [[ "$VERBOSE" == 1 ]]; then
+            echo "Check whether the right repo is present in the /etc/installurl file"
+        fi
     fi
 
     if [ "$IS_HISTORY" = 1 ]; then

From f10df1114316ad0c84539603ad39ca4f3dab73a6 Mon Sep 17 00:00:00 2001
From: Tristan <tpilat@evolix.fr>
Date: Tue, 12 Mar 2019 17:33:01 +0100
Subject: [PATCH 06/96] Add PREEMPT detection

---
 evocheck.sh | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index 675223d..cc5a3e7 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -929,6 +929,26 @@ if [ `uname -s` == "OpenBSD" ]; then
         fi
     fi
 
+    if [ "$IS_PREEMPT" = 1 ]; then
+        if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
+            preempt=$(sysctl net.inet.carp.preempt | cut -d"=" -f2)
+            if [[ "$preempt" -ne 1 ]]; then
+                echo 'IS_PREEMPT FAILED!'
+                if [[ "$VERBOSE" == 1 ]]; then
+                    echo "The preempt function is not activated! Please type 'sysctl net.inet.carp.preempt=1' in"
+                fi
+            fi
+            if [ -f /etc/sysctl.conf ]; then
+                grep -qE "^net.inet.carp.preempt=1" /etc/sysctl.conf || echo 'IS_PREEMPT FAILED!'
+            else
+                echo 'IS_PREEMPT FAILED!'
+                if [[ "$VERBOSE" == 1 ]]; then
+                    echo "The preempt parameter is not permanently activated! Please add 'net.inet.carp.preempt=1' in /etc/sysctl.conf"
+                fi
+            fi
+        fi
+    fi
+
     if [ "$IS_SOFTDEP" = 1 ]; then
         grep -q "softdep" /etc/fstab || echo 'IS_SOFTDEP FAILED!'
     fi

From 6f4f299006fb7e85fd64023d402d94880b308f54 Mon Sep 17 00:00:00 2001
From: Tristan <tpilat@evolix.fr>
Date: Tue, 12 Mar 2019 17:34:40 +0100
Subject: [PATCH 07/96] Fix a condition mistake

---
 evocheck.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index cc5a3e7..5aa2bd8 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -919,7 +919,7 @@ if [ `uname -s` == "OpenBSD" ]; then
     if [ "$IS_ADVBASE" = 1 ]; then
         if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
             for advbase in $(ifconfig carp | grep advbase | awk -F 'advbase' '{print $2}' | awk '{print $1}' | xargs); do
-            if [[ "$advbase" gt 1 ]]; then
+            if [[ "$advbase" -gt 1 ]]; then
                 echo 'IS_ADVBASE FAILED!'
                 if [[ "$VERBOSE" == 1 ]]; then
                         echo "At least one CARP interface has advbase greater than 5 seconds!" 

From 9a52beedbe57a30bedc0b8a96250808226231148 Mon Sep 17 00:00:00 2001
From: Tristan <tpilat@evolix.fr>
Date: Tue, 12 Mar 2019 17:38:41 +0100
Subject: [PATCH 08/96] It's more readable when using that syntax with test

---
 evocheck.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index 5aa2bd8..5037fca 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -954,7 +954,7 @@ if [ `uname -s` == "OpenBSD" ]; then
     fi
 
     if [ "$IS_WHEEL" = 1 ]; then
-        if test -f /etc/sudoers; then
+        if [ -f /etc/sudoers ]; then
             grep -qE "^%wheel.*$" /etc/sudoers || echo 'IS_WHEEL FAILED!'
         fi
     fi

From d52aa4915bbaa47bf18185216a1a3a5bff93fb4d Mon Sep 17 00:00:00 2001
From: Tristan <tpilat@evolix.fr>
Date: Tue, 12 Mar 2019 17:42:44 +0100
Subject: [PATCH 09/96] Now using 'command -v' instead of 'which'

---
 evocheck.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index 5037fca..d927383 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -976,7 +976,7 @@ if [ `uname -s` == "OpenBSD" ]; then
     fi
 
     if [ "$IS_VIM" = 1 ]; then
-        which vim 2>1 >> /dev/null || echo 'IS_VIM FAILED!'
+        command -v vim 2>1 >> /dev/null || echo 'IS_VIM FAILED!'
     fi
 
     if [ "$IS_TTYC0SECURE" = 1 ]; then

From 9832da8b0307fe798aec15c08bb1a36a32be18cd Mon Sep 17 00:00:00 2001
From: Tristan <tpilat@evolix.fr>
Date: Wed, 13 Mar 2019 14:37:49 +0100
Subject: [PATCH 10/96] Check whether the send of a mail after every reboot is
 present in the rc.local file

---
 evocheck.sh | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index d927383..bf0a72c 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -949,6 +949,17 @@ if [ `uname -s` == "OpenBSD" ]; then
         fi
     fi
 
+    if [ "$IS_REBOOTMAIL" = 1 ]; then
+        if [ -f /etc/rc.local ]; then
+            grep -qE '^date | mail -s "boot/reboot of' /etc/rc.local || echo 'IS_REBOOTMAIL FAILED!'
+        else
+            echo 'IS_REBOOTMAIL FAILED!'
+            if [[ "$VERBOSE" == 1 ]]; then
+                echo "Make sure /etc/rc.local exist and 'date | mail -s \"boot/reboot of $hostname' is present!"
+            fi
+        fi
+    fi
+
     if [ "$IS_SOFTDEP" = 1 ]; then
         grep -q "softdep" /etc/fstab || echo 'IS_SOFTDEP FAILED!'
     fi

From 4dc94a19b07edc21dbcfbce5835b750beacfcb23 Mon Sep 17 00:00:00 2001
From: Tristan <tpilat@evolix.fr>
Date: Wed, 13 Mar 2019 14:43:03 +0100
Subject: [PATCH 11/96] Some characters have to be escaped

---
 evocheck.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index bf0a72c..3c3fe60 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -951,11 +951,11 @@ if [ `uname -s` == "OpenBSD" ]; then
 
     if [ "$IS_REBOOTMAIL" = 1 ]; then
         if [ -f /etc/rc.local ]; then
-            grep -qE '^date | mail -s "boot/reboot of' /etc/rc.local || echo 'IS_REBOOTMAIL FAILED!'
+            grep -qE '^date \| mail -s "boot/reboot of' /etc/rc.local || echo 'IS_REBOOTMAIL FAILED!'
         else
             echo 'IS_REBOOTMAIL FAILED!'
             if [[ "$VERBOSE" == 1 ]]; then
-                echo "Make sure /etc/rc.local exist and 'date | mail -s \"boot/reboot of $hostname' is present!"
+                echo "Make sure /etc/rc.local exist and 'date | mail -s \"boot/reboot of \$hostname' is present!"
             fi
         fi
     fi

From 4c43e1b21aacfa0d34ab4daec23bc2794b4f71f9 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Wed, 20 Mar 2019 09:43:50 +0100
Subject: [PATCH 12/96] Remove Linux/OpenBSD condition test and clean up some
 useless evocheck tests under OpenBSD

---
 evocheck.sh | 1045 +++++++++------------------------------------------
 1 file changed, 172 insertions(+), 873 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 3c3fe60..a36a8c9 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -142,914 +142,213 @@ if [ "$1" = "--cron" ]; then
     IS_UPTIME=0
 fi
 
-# Functions
-is_pack_web(){
-    test -e /usr/share/scripts/web-add.sh || test -e /usr/share/scripts/evoadmin/web-add.sh
-}
+if [ "$IS_CUSTOMSUDOERS" = 1 ]; then
+    grep -E -qr "umask=0077" /etc/sudoers* || echo 'IS_CUSTOMSUDOERS FAILED!'
+fi
 
-is_pack_samba(){
-    test -e /usr/share/scripts/add.pl
-}
+if [ "$IS_TMPNOEXEC" = 1 ]; then
+    mount | grep "on /tmp" | grep -q noexec || echo 'IS_TMPNOEXEC FAILED!'
+fi
 
-is_installed(){
-    for pkg in $*; do
-            dpkg -l $pkg 2>/dev/null | grep -q -E '^(i|h)i' || return 1
+if [ "$IS_SSHALLOWUSERS" = 1 ]; then
+    grep -E -qi "(AllowUsers|AllowGroups)" /etc/ssh/sshd_config || echo 'IS_SSHALLOWUSERS FAILED!'
+fi
+
+if [ "$IS_TMOUTPROFILE" = 1 ]; then
+    grep -q TMOUT= /etc/profile /etc/profile.d/evolinux.sh || echo 'IS_TMOUTPROFILE FAILED!'
+fi
+
+# Verification de la configuration du raid soft (mdadm)
+if [ "$IS_RAIDSOFT" = 1 ]; then
+    test -e /proc/mdstat && grep -q md /proc/mdstat && \
+        ( grep -q "^AUTOCHECK=true" /etc/default/mdadm \
+    && grep -q "^START_DAEMON=true" /etc/default/mdadm \
+    && grep -qv "^MAILADDR ___MAIL___" /etc/mdadm/mdadm.conf || echo 'IS_RAIDSOFT FAILED!')
+fi
+
+# Verification de la mise en place d'evobackup
+if [ "$IS_EVOBACKUP" = 1 ]; then
+    ls /etc/cron* |grep -q "evobackup" || echo 'IS_EVOBACKUP FAILED!'
+fi
+
+# Verification si le système doit redémarrer suite màj kernel.
+if [ "$IS_KERNELUPTODATE" = 1 ]; then
+    if is_installed linux-image* && [ $(date -d $(ls --full-time -lcrt /boot | tail -n1 | tr -s " " | cut -d " " -f 6) +%s) -gt $(($(date +%s) - $(cut -f1 -d '.' /proc/uptime))) ]; then
+        echo 'IS_KERNELUPTODATE FAILED!'
+    fi
+fi
+
+# Check if the server is running for more than a year.
+if [ "$IS_UPTIME" = 1 ]; then
+    if is_installed linux-image* && [ $(date -d "now - 2 year" +%s) -gt $(($(date +%s) - $(cut -f1 -d '.' /proc/uptime))) ]; then
+        echo 'IS_UPTIME FAILED!'
+    fi
+fi
+
+# Check if files in /home/backup/ are up-to-date
+if [ "$IS_BACKUPUPTODATE" = 1 ]; then
+    [ -d /home/backup/ ] && for file in /home/backup/*; do
+        if [ -f $file ] && [ $(stat -c "%Y" $file) -lt $(date +"%s" -d "now - 2 day") ]; then
+            echo 'IS_BACKUPUPTODATE FAILED!'
+            break;
+        fi
     done
-}
+fi
 
-is_debianversion(){
-    [ $(lsb_release -c -s) = $1 ] && return 0
-}
+# Check if /etc/.git/ has read/write permissions for root only.
+if [ "$IS_GITPERMS" = 1 ]; then
+    test -d /etc/.git && [ "$(stat -c "%a" /etc/.git/)" = "700" ] || echo 'IS_GITPERMS FAILED!'
+fi
 
-is_debianversion squeeze && MINIFW_FILE=/etc/firewall.rc
-is_debianversion wheezy && MINIFW_FILE=/etc/firewall.rc
-is_debianversion jessie && MINIFW_FILE=/etc/default/minifirewall
-is_debianversion stretch && MINIFW_FILE=/etc/default/minifirewall
-
-#-----------------------------------------------------------
-#Vérifie si c'est une debian et fait les tests appropriés.
-#-----------------------------------------------------------
-
-if [ -e /etc/debian_version ]; then
-
-    if [ "$IS_DPKGWARNING" = 1 ]; then
-        is_debianversion squeeze && ( [ "$IS_USRRO" = 1 ] || [ "$IS_TMPNOEXEC" = 1 ] ) && ( \
-            grep -E -i "(Pre-Invoke ..echo Are you sure to have rw on|Post-Invoke ..echo Dont forget to mount -o remount)" \
-            /etc/apt/apt.conf | wc -l | grep -q ^2$ || echo 'IS_DPKGWARNING FAILED!' )
-        is_debianversion wheezy && ( ( [ "$IS_USRRO" = 1 ] || [ "$IS_TMPNOEXEC" = 1 ] ) && \
-            ( test -e /etc/apt/apt.conf.d/80evolinux || echo 'IS_DPKGWARNING FAILED!' )
-            test -e /etc/apt/apt.conf && echo 'IS_DPKGWARNING FAILED!' )
-        is_debianversion stretch && (test -e /etc/apt/apt.conf.d/z-evolinux.conf || echo 'IS_DPKGWARNING FAILED!')
-    fi
-
-    if [ "$IS_UMASKSUDOERS" = 1 ]; then
-        is_debianversion squeeze && ( grep -q ^Defaults.*umask=0077 /etc/sudoers || echo 'IS_UMASKSUDOERS FAILED!' )
-    fi
-
-    # Verifying check_mailq in Nagios NRPE config file. (Option "-M postfix" need to be set if the MTA is Postfix)
-    if [ "$IS_NRPEPOSTFIX" = 1 ]; then
-        is_debianversion squeeze && is_installed postfix && ( grep -q "^command.*check_mailq -M postfix" /etc/nagios/nrpe.cfg || echo 'IS_NRPEPOSTFIX FAILED!' )
-        is_debianversion squeeze || ( is_installed postfix && ( test -e /etc/nagios/nrpe.cfg && grep -qr "^command.*check_mailq -M postfix" /etc/nagios/nrpe.* || echo 'IS_NRPEPOSTFIX FAILED!' ) )
-    fi
-
-    # Check if mod-security config file is present
-    if [ "$IS_MODSECURITY" = 1 ]; then
-        is_debianversion squeeze && is_installed libapache-mod-security && \
-            (test -e /etc/apache2/conf.d/mod-security2.conf || echo 'IS_MODSECURITY FAILED!')
-        is_debianversion wheezy && is_installed libapache2-modsecurity && \
-            (test -e /etc/apache2/conf.d/mod-security2.conf || echo 'IS_MODSECURITY FAILED!')
-    fi
-
-    if [ "$IS_CUSTOMSUDOERS" = 1 ]; then
-        grep -E -qr "umask=0077" /etc/sudoers* || echo 'IS_CUSTOMSUDOERS FAILED!'
-    fi
-
-    if [ "$IS_VARTMPFS" = 1 ]; then
-        df /var/tmp | grep -q tmpfs || echo 'IS_VARTMPFS FAILED!'
-    fi
-
-    if [ "$IS_SERVEURBASE" = 1 ]; then
-        is_installed serveur-base || echo 'IS_SERVEURBASE FAILED!'
-    fi
-
-    if [ "$IS_LOGROTATECONF" = 1 ]; then
-        test -e /etc/logrotate.d/zsyslog || echo 'IS_LOGROTATECONF FAILED!'
-    fi
-
-    if [ "$IS_SYSLOGCONF" = 1 ]; then
-        grep -q "^# Syslog for Pack Evolix serveur" /etc/*syslog.conf || echo 'IS_SYSLOGCONF FAILED!'
-    fi
-
-    if [ "$IS_DEBIANSECURITY" = 1 ]; then
-        grep -q "^deb.*security" /etc/apt/sources.list || echo 'IS_DEBIANSECURITY FAILED!'
-    fi
-
-    if [ "$IS_APTITUDEONLY" = 1 ]; then
-        is_debianversion squeeze && test -e /usr/bin/apt-get && echo 'IS_APTITUDEONLY FAILED!'
-        is_debianversion wheezy && test -e /usr/bin/apt-get && echo 'IS_APTITUDEONLY FAILED!'
-    fi
-
-    if [ "$IS_APTITUDE" = 1 ]; then
-        is_debianversion jessie && test -e /usr/bin/aptitude && echo 'IS_APTITUDE FAILED!'
-        is_debianversion stretch && test -e /usr/bin/aptitude && echo 'IS_APTITUDE FAILED!'
-    fi
-
-    if [ "$IS_APTGETBAK" = 1 ]; then
-        is_debianversion jessie && test -e /usr/bin/apt-get.bak && echo 'IS_APTGETBAK FAILED!'
-        is_debianversion stretch && test -e /usr/bin/apt-get.bak && echo 'IS_APTGETBAK FAILED!'
-    fi
-
-    if [ "$IS_APTICRON" = 1 ]; then
-        status="OK"
-        test -e /etc/cron.d/apticron || status="fail"
-        test -e /etc/cron.daily/apticron && status="fail"
-        test "$status" = "fail" || test -e /usr/bin/apt-get.bak || status="fail"
-        ( is_debianversion squeeze || is_debianversion wheezy ) && test "$status" = "fail" && echo 'IS_APTICRON FAILED!'
-    fi
-
-    if [ "$IS_USRRO" = 1 ]; then
-        grep /usr /etc/fstab | grep -q ro || echo 'IS_USRRO FAILED!'
-    fi
-
-    if [ "$IS_TMPNOEXEC" = 1 ]; then
-        mount | grep "on /tmp" | grep -q noexec || echo 'IS_TMPNOEXEC FAILED!'
-    fi
-
-    if [ "$IS_MOUNT_FSTAB" = 1 ]; then
-        # Test if lsblk available, if not skip this test...
-        if test -x "$(command -v lsblk)"; then
-            for mountPoint in $(lsblk -o MOUNTPOINT -l -n | grep '/'); do
-                grep -Eq "$mountPoint\W" /etc/fstab || echo 'IS_MOUNT_FSTAB FAILED!'
-            done
-        fi
-    fi
-
-    if [ "$IS_LISTCHANGESCONF" = 1 ]; then
-        if is_debianversion stretch; then
-            if is_installed apt-listchanges; then
-                echo 'IS_LISTCHANGESCONF FAILED!'
-                verbose "apt-listchanges must not be installed on Stretch"
-            fi
-        else
-            if [ -e "/etc/apt/listchanges.conf" ]; then
-                lines=$(grep -cE "(which=both|confirm=1)" /etc/apt/listchanges.conf)
-                if [ $lines != 2 ]; then
-                    echo 'IS_LISTCHANGESCONF FAILED!'
-                    verbose "apt-listchanges config is incorrect"
-                fi
-            else
-                echo 'IS_LISTCHANGESCONF FAILED!'
-                verbose "apt-listchanges config is missing"
-            fi
-        fi
-    fi
-
-    if [ "$IS_CUSTOMCRONTAB" = 1 ]; then
-        grep -E "^(17 \*|25 6|47 6|52 6)" /etc/crontab | wc -l | grep -q ^4$ && echo 'IS_CUSTOMCRONTAB FAILED!'
-    fi
-
-    if [ "$IS_SSHALLOWUSERS" = 1 ]; then
-        grep -E -qi "(AllowUsers|AllowGroups)" /etc/ssh/sshd_config || echo 'IS_SSHALLOWUSERS FAILED!'
-    fi
-
-    if [ "$IS_DISKPERF" = 1 ]; then
-        test -e /root/disk-perf.txt || echo 'IS_DISKPERF FAILED!'
-    fi
-
-    if [ "$IS_TMOUTPROFILE" = 1 ]; then
-        grep -q TMOUT= /etc/profile /etc/profile.d/evolinux.sh || echo 'IS_TMOUTPROFILE FAILED!'
-    fi
-
-    if [ "$IS_ALERT5BOOT" = 1 ]; then
-        grep -q ^date /etc/rc2.d/S*alert5 || echo 'IS_ALERT5BOOT FAILED!'
-    fi
-
-    if [ "$IS_ALERT5MINIFW" = 1 ]; then
-        grep -q ^/etc/init.d/minifirewall /etc/rc2.d/S*alert5 || echo 'IS_ALERT5MINIFW FAILED!'
-    fi
-
-    if [ "$IS_ALERT5MINIFW" = 1 ] && [ "$IS_MINIFW" = 1 ]; then
-        /sbin/iptables -L -n | grep -q -E "^ACCEPT\s*all\s*--\s*31\.170\.8\.4\s*0\.0\.0\.0/0\s*$" || echo 'IS_MINIFW FAILED!'
-    fi
-
-    if [ "$IS_NRPEPERMS" = 1 ]; then
-        test -d /etc/nagios && ls -ld /etc/nagios | grep -q drwxr-x--- || echo 'IS_NRPEPERMS FAILED!'
-    fi
-
-    if [ "$IS_MINIFWPERMS" = 1 ]; then
-        ls -l "$MINIFW_FILE" | grep -q -- -rw------- || echo 'IS_MINIFWPERMS FAILED!'
-    fi
-
-    if [ "$IS_NRPEDISKS" = 1 ]; then
-        NRPEDISKS=$(grep command.check_disk /etc/nagios/nrpe.cfg | grep ^command.check_disk[0-9] | sed -e "s/^command.check_disk\([0-9]\+\).*/\1/" | sort -n | tail -1)
-        DFDISKS=$(df -Pl | grep -E -v "(^Filesystem|/lib/init/rw|/dev/shm|udev|rpc_pipefs)" | wc -l)
-        [ "$NRPEDISKS" = "$DFDISKS" ] || echo 'IS_NRPEDISKS FAILED!'
-    fi
-
-    if [ "$IS_NRPEPID" = 1 ]; then
-        is_debianversion squeeze || (test -e /etc/nagios/nrpe.cfg && grep -q "^pid_file=/var/run/nagios/nrpe.pid" /etc/nagios/nrpe.cfg || echo 'IS_NRPEPID FAILED!')
-    fi
-
-    if [ "$IS_GRSECPROCS" = 1 ]; then
-        uname -a | grep -q grsec && ( grep -q ^command.check_total_procs..sudo /etc/nagios/nrpe.cfg && grep -A1 "^\[processes\]" /etc/munin/plugin-conf.d/munin-node | grep -q "^user root" || echo 'IS_GRSECPROCS FAILED!' )
-    fi
-
-    if [ "$IS_APACHEMUNIN" = 1 ]; then
-        test -e /etc/apache2/apache2.conf && ( is_debianversion stretch || ( grep -E -q "^env.url.*/server-status-[[:alnum:]]{4}" /etc/munin/plugin-conf.d/munin-node && grep -E -q "/server-status-[[:alnum:]]{4}" /etc/apache2/apache2.conf || grep -E -q "/server-status-[[:alnum:]]{4}" /etc/apache2/apache2.conf /etc/apache2/mods-enabled/status.conf 2>/dev/null || echo 'IS_APACHEMUNIN FAILED!' ) )
-        test -e /etc/apache2/apache2.conf && ( is_debianversion stretch && ( test -h /etc/apache2/mods-enabled/status.load && test -h /etc/munin/plugins/apache_accesses && test -h /etc/munin/plugins/apache_processes && test -h /etc/munin/plugins/apache_accesses || echo 'IS_APACHEMUNIN FAILED!' ) )
-    fi
-
-    # Verification mytop + Munin si MySQL
-    if [ "$IS_MYSQLUTILS" = 1 ]; then
-        MYSQL_ADMIN=${MYSQL_ADMIN:-mysqladmin}
-        if is_installed mysql-server; then
-            # You can configure MYSQL_ADMIN in evocheck.cf
-            if ! grep -qs "$MYSQL_ADMIN" /root/.my.cnf; then
-                echo 'IS_MYSQLUTILS FAILED!'
-                verbose 'mysqladmin missing in /root/.my.cnf'
-            fi
-            if ! test -x /usr/bin/mytop; then
-                if ! test -x /usr/local/bin/mytop; then
-                    echo 'IS_MYSQLUTILS FAILED!'
-                    verbose 'mytop binary missing'
-                fi
-            fi
-            if ! grep -qs debian-sys-maint /root/.mytop; then
-                echo 'IS_MYSQLUTILS FAILED!'
-                verbose 'debian-sys-maint missing in /root/.mytop'
-            fi
-        fi
-    fi
-
-    # Verification de la configuration du raid soft (mdadm)
-    if [ "$IS_RAIDSOFT" = 1 ]; then
-        test -e /proc/mdstat && grep -q md /proc/mdstat && \
-            ( grep -q "^AUTOCHECK=true" /etc/default/mdadm \
-        && grep -q "^START_DAEMON=true" /etc/default/mdadm \
-        && grep -qv "^MAILADDR ___MAIL___" /etc/mdadm/mdadm.conf || echo 'IS_RAIDSOFT FAILED!')
-    fi
-
-    # Verification du LogFormat de AWStats
-    if [ "$IS_AWSTATSLOGFORMAT" = 1 ]; then
-        is_installed apache2.2-common && ( grep -qE '^LogFormat=1' /etc/awstats/awstats.conf.local || echo 'IS_AWSTATSLOGFORMAT FAILED!' )
-    fi
-
-    # Verification de la présence de la config logrotate pour Munin
-    if [ "$IS_MUNINLOGROTATE" = 1 ]; then
-        ( test -e /etc/logrotate.d/munin-node && test -e /etc/logrotate.d/munin ) || echo 'IS_MUNINLOGROTATE FAILED!'
-    fi
-
-    # Verification de la présence de metche
-    #if [ "$IS_METCHE" = 1 ]; then
-    #	is_installed metche || echo 'IS_METCHE FAILED!'
-    #fi
-
-    # Verification de l'activation de Squid dans le cas d'un pack mail
-    if [ "$IS_SQUID" = 1 ]; then
-        squidconffile=/etc/squid*/squid.conf
-        is_debianversion stretch && squidconffile=/etc/squid/evolinux-custom.conf
-        is_pack_web && ( is_installed squid || is_installed squid3 \
-        && grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner --uid-owner proxy -j ACCEPT" $MINIFW_FILE \
-        && grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -d `hostname -i` -j ACCEPT" $MINIFW_FILE \
-        && grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -d 127.0.0.(1|0/8) -j ACCEPT" $MINIFW_FILE \
-        && grep -qE "^[^#]*iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --to-port.* `grep http_port $squidconffile | cut -f 2 -d " "`" $MINIFW_FILE || echo 'IS_SQUID FAILED!' )
-    fi
-
-    if [ "$IS_EVOMAINTENANCE_FW" = 1 ]; then
-        if [ -f "$MINIFW_FILE" ]; then
-            rulesNumber=$(grep -c "/sbin/iptables -A INPUT -p tcp --sport 5432 --dport 1024:65535 -s .* -m state --state ESTABLISHED,RELATED -j ACCEPT" "$MINIFW_FILE")
-            if [ "$rulesNumber" -lt 2 ]; then
-                echo 'IS_EVOMAINTENANCE_FW FAILED!'
-            fi
-        fi
-    fi
-
-    # Verification de la conf et de l'activation de mod-deflate
-    if [ "$IS_MODDEFLATE" = 1 ]; then
-        f=/etc/apache2/mods-enabled/deflate.conf
-        is_installed apache2.2 && (test -e $f && grep -q "AddOutputFilterByType DEFLATE text/html text/plain text/xml" $f \
-        && grep -q "AddOutputFilterByType DEFLATE text/css" $f \
-        && grep -q "AddOutputFilterByType DEFLATE application/x-javascript application/javascript" $f || echo 'IS_MODDEFLATE FAILED!')
-    fi
-
-    # Verification de la conf log2mail
-    if [ "$IS_LOG2MAILRUNNING" = 1 ]; then
-        is_pack_web && (is_installed log2mail && pgrep log2mail >/dev/null || echo 'IS_LOG2MAILRUNNING')
-    fi
-    if [ "$IS_LOG2MAILAPACHE" = 1 ]; then
-        if is_debianversion stretch; then
-            conf=/etc/log2mail/config/apache
-        else
-            conf=/etc/log2mail/config/default
-        fi
-        is_pack_web && ( is_installed log2mail && grep -q "^file = /var/log/apache2/error.log" $conf 2>/dev/null || echo 'IS_LOG2MAILAPACHE FAILED!' )
-    fi
-    if [ "$IS_LOG2MAILMYSQL" = 1 ]; then
-        is_pack_web && ( is_installed log2mail && grep -q "^file = /var/log/syslog" /etc/log2mail/config/{default,mysql,mysql.conf} 2>/dev/null || echo 'IS_LOG2MAILMYSQL FAILED!' )
-    fi
-    if [ "$IS_LOG2MAILSQUID" = 1 ]; then
-        is_pack_web && ( is_installed log2mail && grep -q "^file = /var/log/squid.*/access.log" \
-            /etc/log2mail/config/* 2>/dev/null || echo 'IS_LOG2MAILSQUID FAILED!' )
-    fi
-
-    # Verification si bind est chroote
-    if [ "$IS_BINDCHROOT" = 1 ]; then
-        if is_installed bind9 && $(netstat -utpln |grep "/named" |grep :53 |grep -qvE "(127.0.0.1|::1)"); then
-            if grep -q '^OPTIONS=".*-t' /etc/default/bind9 && grep -q '^OPTIONS=".*-u' /etc/default/bind9; then
-                if [ "$(md5sum /usr/sbin/named |cut -f 1 -d ' ')" != "$(md5sum /var/chroot-bind/usr/sbin/named |cut -f 1 -d ' ')" ]; then
-                    echo 'IS_BINDCHROOT FAILED!'
-                fi
-            else
-                echo 'IS_BINDCHROOT FAILED!'
-            fi
-        fi
-    fi
-
-    # Verification de la présence du depot volatile
-    if [ "$IS_REPVOLATILE" = 1 ]; then
-        test `cat /etc/debian_version |cut -d "." -f 1` -eq 5 && (grep -qE "^deb http://volatile.debian.org/debian-volatile" /etc/apt/sources.list || echo 'IS_REPVOLATILE FAILED!')
-            test `cat /etc/debian_version |cut -d "." -f 1` -eq 6 && (grep -qE "^deb.*squeeze-updates" /etc/apt/sources.list || echo 'IS_REPVOLATILE FAILED!')
-    fi
-
-    # /etc/network/interfaces should be present, we don't manage systemd-network yet
-    if [ "$IS_NETWORK_INTERFACES" = 1 ]; then
-        if ! test -f /etc/network/interfaces; then
-            echo "IS_NETWORK_INTERFACES FAILED!"
-            IS_AUTOIF=0
-            IS_INTERFACESGW=0
-        fi
-    fi
-
-    # Verify if all if are in auto
-    if [ "$IS_AUTOIF" = 1 ]; then
-        is_debianversion stretch || for interface in `/sbin/ifconfig -s |tail -n +2 |grep -E -v "^(lo|vnet|docker|veth|tun|tap|macvtap)" |cut -d " " -f 1 |tr "\n" " "`; do
-                    grep -q "^auto $interface" /etc/network/interfaces || (echo 'IS_AUTOIF FAILED!' && break)
-            done
-        is_debianversion stretch && for interface in `/sbin/ip address show up | grep ^[0-9]*: |grep -E -v "(lo|vnet|docker|veth|tun|tap|macvtap)" | cut -d " " -f 2 |tr -d : |cut -d@ -f1 |tr "\n" " "`; do
-                    grep -q "^auto $interface" /etc/network/interfaces || (echo 'IS_AUTOIF FAILED!' && break)
-            done
-    fi
-
-    # Network conf verification
-    if [ "$IS_INTERFACESGW" = 1 ]; then
-        number=$(grep -Ec "^[^#]*gateway [0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" /etc/network/interfaces)
-        test $number -gt 1 && echo 'IS_INTERFACESGW FAILED!'
-        number=$(grep -Ec "^[^#]*gateway [0-9a-fA-F]+:" /etc/network/interfaces)
-        test $number -gt 1 && echo 'IS_INTERFACESGW FAILED!'
-    fi
-
-    # Verification de la mise en place d'evobackup
-    if [ "$IS_EVOBACKUP" = 1 ]; then
-        ls /etc/cron* |grep -q "evobackup" || echo 'IS_EVOBACKUP FAILED!'
-    fi
-
-    # Verification de la presence du userlogrotate
-    if [ "$IS_USERLOGROTATE" = 1 ]; then
-        is_pack_web && (test -x /etc/cron.weekly/userlogrotate || echo 'IS_USERLOGROTATE FAILED!')
-    fi
-
-
-    # Verification de la syntaxe de la conf d'Apache
-    if [ "$IS_APACHECTL" = 1 ]; then
-        is_installed apache2.2-common && (/usr/sbin/apache2ctl configtest 2>&1 |grep -q "^Syntax OK$" || echo 'IS_APACHECTL FAILED!')
-    fi
-
-    # Check if there is regular files in Apache sites-enabled.
-    if [ "$IS_APACHESYMLINK" = 1 ]; then
-        is_installed apache2.2-common && \
-            (stat -c %F /etc/apache2/sites-enabled/* | grep -q regular && echo 'IS_APACHESYMLINK FAILED!')
-    fi
-
-    # Check if there is real IP addresses in Allow/Deny directives (no trailing space, inline comments or so).
-    if [ "$IS_APACHEIPINALLOW" = 1 ]; then
-        # Note: Replace "exit 1" by "print" in Perl code to debug it.
-        is_installed apache2.2-common && \
-            (grep -IrE "^[^#] *(Allow|Deny) from" /etc/apache2/ |grep -iv "from all" |grep -iv "env=" |perl -ne 'exit 1 unless (/from( [\da-f:.\/]+)+$/i)' || echo 'IS_APACHEIPINALLOW FAILED!')
-    fi
-
-    # Check if default Apache configuration file for munin is absent (or empty or commented).
-    if [ "$IS_MUNINAPACHECONF" = 1 ]; then
-        if is_debianversion squeeze || is_debianversion wheezy; then
-            muninconf="/etc/apache2/conf.d/munin"
-        else
-            muninconf="/etc/apache2/conf-available/munin.conf"
-        fi
-        is_installed apache2.2-common && ([ -e $muninconf ] && grep -vEq "^( |\t)*#" $muninconf && echo 'IS_MUNINAPACHECONF FAILED!')
-    fi
-
-    # Verification de la priorité du package samba si les backports sont utilisés
-    if [ "$IS_SAMBAPINPRIORITY" = 1 ]; then
-        is_pack_samba && grep -qrE "^[^#].*backport" /etc/apt/sources.list{,.d} && ( priority=`grep -E -A2 "^Package:.*samba" /etc/apt/preferences |grep -A1 "^Pin: release a=lenny-backports" |grep "^Pin-Priority:" |cut -f2 -d" "` && test $priority -gt 500 || echo 'IS_SAMBAPINPRIORITY FAILED!' )
-    fi
-
-    # Verification si le système doit redémarrer suite màj kernel.
-    if [ "$IS_KERNELUPTODATE" = 1 ]; then
-        if is_installed linux-image* && [ $(date -d $(ls --full-time -lcrt /boot | tail -n1 | tr -s " " | cut -d " " -f 6) +%s) -gt $(($(date +%s) - $(cut -f1 -d '.' /proc/uptime))) ]; then
-            echo 'IS_KERNELUPTODATE FAILED!'
-        fi
-    fi
-
-    # Check if the server is running for more than a year.
-    if [ "$IS_UPTIME" = 1 ]; then
-        if is_installed linux-image* && [ $(date -d "now - 2 year" +%s) -gt $(($(date +%s) - $(cut -f1 -d '.' /proc/uptime))) ]; then
-            echo 'IS_UPTIME FAILED!'
-        fi
-    fi
-
-    # Check if munin-node running and RRD files are up to date.
-    if [ "$IS_MUNINRUNNING" = 1 ]; then
-        pgrep munin-node >/dev/null || echo 'IS_MUNINRUNNING FAILED!'
-        [ "$(stat -c "%Y" /var/lib/munin/*/*load-g.rrd |sort |tail -1)" -lt $(date +"%s" -d "now - 10 minutes") ] && echo 'IS_MUNINRUNNING FAILED!'
-        grep -q "^graph_strategy cron" /etc/munin/munin.conf && ([ "$(stat -c "%Y" /var/cache/munin/www/*/*/load-day.png |sort |tail -1)" -lt $(date +"%s" -d "now - 10 minutes") ]) && echo 'IS_MUNINRUNNING FAILED!'
-    fi
-
-    # Check if files in /home/backup/ are up-to-date
-    if [ "$IS_BACKUPUPTODATE" = 1 ]; then
-        [ -d /home/backup/ ] && for file in /home/backup/*; do
-            if [ -f $file ] && [ $(stat -c "%Y" $file) -lt $(date +"%s" -d "now - 2 day") ]; then
-                echo 'IS_BACKUPUPTODATE FAILED!'
-                break;
-            fi
-        done
-    fi
-
-    # Check if /etc/.git/ has read/write permissions for root only.
-    if [ "$IS_GITPERMS" = 1 ]; then
-        test -d /etc/.git && [ "$(stat -c "%a" /etc/.git/)" = "700" ] || echo 'IS_GITPERMS FAILED!'
-    fi
-
-    # Check if no package has been upgraded since $limit.
-    if [ "$IS_NOTUPGRADED" = 1 ]; then
-        last_upgrade=0
-        upgraded=false
-        for log in /var/log/dpkg.log*; do
-            zgrep -qsm1 upgrade "$log"
-            if [ $? -eq 0 ]; then
-                # There is at least one upgrade
-                upgraded=true
-                break
-            fi
-        done
-        if $upgraded; then
-            last_upgrade=$(date +%s -d $(zgrep -h upgrade /var/log/dpkg.log* |sort -n |tail -1 |cut -f1 -d ' '))
-        fi
-        if grep -qs '^mailto="listupgrade-todo@' /etc/evolinux/listupgrade.cnf \
-        || grep -qs -E '^[[:digit:]]+[[:space:]]+[[:digit:]]+[[:space:]]+[^\*]' /etc/cron.d/listupgrade; then
-            # Manual upgrade process
-            limit=$(date +%s -d "now - 180 days")
-        else
-            # Regular process
-            limit=$(date +%s -d "now - 90 days")
-        fi
-        install_date=0
-        if [ -d /var/log/installer ]; then
-            install_date=$(stat -c %Z /var/log/installer)
-        fi
-        # Check install_date if the system never received an upgrade
-        if [ $last_upgrade -eq 0 ]; then
-            [ $install_date -lt $limit ] && echo 'IS_NOTUPGRADED FAILED!'
-        else
-            [ $last_upgrade -lt $limit ] && echo 'IS_NOTUPGRADED FAILED!'
-        fi
-    fi
-
-    # Check if reserved blocks for root is at least 5% on every mounted partitions.
-    if [ "$IS_TUNE2FS_M5" = 1 ]; then
-        parts=$(grep -E "ext(3|4)" /proc/mounts | cut -d ' ' -f1 | tr -s '\n' ' ')
-        for part in $parts; do
-            blockCount=$(dumpe2fs -h "$part" 2>/dev/null | grep -e "Block count:" | grep -Eo "[0-9]+")
-            # If buggy partition, skip it.
-            if [ -z $blockCount ]; then
-                continue
-            fi
-            reservedBlockCount=$(dumpe2fs -h "$part" 2>/dev/null | grep -e "Reserved block count:" | grep -Eo "[0-9]+")
-            percentage=$(python -c "print(int(round(float(${reservedBlockCount})/${blockCount}*100)))")
-            if [ "$percentage" -lt 5 ]; then
-                echo 'IS_TUNE2FS_M5 FAILED!'
-                verbose "Partition $part has less than 5% reserved blocks!"
-            fi
-        done
-    fi
-
-    if [ "$IS_EVOLINUXSUDOGROUP" = 1 ]; then
-        if is_debianversion stretch; then
-            (grep -q ^evolinux-sudo: /etc/group \
-                && grep -q '^%evolinux-sudo  ALL=(ALL:ALL) ALL' /etc/sudoers.d/evolinux) || echo 'IS_EVOLINUXSUDOGROUP FAILED!'
-        fi
-    fi
-
-    if [ "$IS_USERINADMGROUP" = 1 ]; then
-        if is_debianversion stretch; then
-            for user in $(grep ^evolinux-sudo: /etc/group |awk -F: '{print $4}' |tr ',' ' '); do
-                groups $user |grep -q adm || echo 'IS_USERINADMGROUP FAILED!'
-            done
-        fi
-    fi
-
-    if [ "$IS_APACHE2EVOLINUXCONF" = 1 ]; then
-        if (test -d /etc/apache2 && is_debianversion stretch); then
-            (test -L /etc/apache2/conf-enabled/z-evolinux-defaults.conf \
-                && test -L /etc/apache2/conf-enabled/zzz-evolinux-custom.conf \
-                && test -f /etc/apache2/ipaddr_whitelist.conf) || echo 'IS_APACHE2EVOLINUXCONF FAILED!'
-        fi
-    fi
-
-    if [ "$IS_BACKPORTSCONF" = 1 ]; then
-        if is_debianversion stretch; then
-            grep -qsE "^[^#].*backports" /etc/apt/sources.list \
-              && echo 'IS_BACKPORTSCONF FAILED!'
-            if grep -qsE "^[^#].*backports" /etc/apt/sources.list.d/*.list; then
-                grep -qsE "^[^#].*backports" /etc/apt/preferences.d/* \
-                  || echo 'IS_BACKPORTSCONF FAILED!'
-            fi
-        fi
-    fi
-
-    if [ "$IS_BIND9MUNIN" = 1 ]; then
-        if is_debianversion stretch && is_installed bind9; then
-            (test -L /etc/munin/plugins/bind9 && test -e /etc/munin/plugin-conf.d/bind9) || echo 'IS_BIND9MUNIN FAILED!'
-        fi
-    fi
-
-    if [ "$IS_BIND9LOGROTATE" = 1 ]; then
-        if is_debianversion stretch && is_installed bind9; then
-            test -e /etc/logrotate.d/bind9 || echo 'IS_BIND9LOGROTATE FAILED!'
-        fi
-    fi
-
-    if [ "$IS_BROADCOMFIRMWARE" = 1 ]; then
-        if lspci | grep -q 'NetXtreme II'; then
-            (is_installed firmware-bnx2 && grep -q "^deb http://mirror.evolix.org/debian.* non-free" /etc/apt/sources.list) || echo 'IS_BROADCOMFIRMWARE FAILED!'
-        fi
-    fi
-
-    if [ "$IS_HARDWARERAIDTOOL" = 1 ]; then
-        lspci |grep -q 'MegaRAID SAS' && (is_installed megacli && (is_installed megaclisas-status || is_installed megaraidsas-status) || echo 'IS_HARDWARERAIDTOOL FAILED!')
-        lspci |grep -q 'Hewlett-Packard Company Smart Array' && (is_installed cciss-vol-status || echo 'IS_HARDWARERAIDTOOL FAILED!')
-    fi
-
-    if [ "$IS_LOG2MAILSYSTEMDUNIT" = 1 ]; then
-        if is_debianversion stretch; then
-            (systemctl -q is-active log2mail.service && test -f /etc/systemd/system/log2mail.service && ! test -f /etc/init.d/log2mail) || echo 'IS_LOG2MAILSYSTEMDUNIT FAILED!'
-        fi
-    fi
-
-    if [ "$IS_LISTUPGRADE" = 1 ]; then
-        (test -f /etc/cron.d/listupgrade && test -x /usr/share/scripts/listupgrade.sh) || echo 'IS_LISTUPGRADE FAILED!'
-    fi
-
-    if [ "$IS_MARIADBEVOLINUXCONF" = 1 ]; then
-        if is_debianversion stretch && is_installed mariadb-server; then
-            (test -f /etc/mysql/mariadb.conf.d/z-evolinux-defaults.cnf \
-                && test -f /etc/mysql/mariadb.conf.d/zzz-evolinux-custom.cnf) || echo 'IS_MARIADBEVOLINUXCONF FAILED!'
-        fi
-    fi
-
-    if [ "$IS_SQL_BACKUP" = 1 ]; then
-        if (is_installed "mysql-server" || is_installed "mariadb-server"); then
-            # You could change the default path in /etc/evocheck.cf
-            SQL_BACKUP_PATH=${SQL_BACKUP_PATH:-"/home/backup/mysql.bak.gz"}
-            test -f "$SQL_BACKUP_PATH" || echo 'IS_SQL_BACKUP FAILED!'
-        fi
-    fi
-
-    if [ "$IS_POSTGRES_BACKUP" = 1 ]; then
-        if is_installed "postgresql-9*"; then
-            # If you use something like barman, you should deactivate this check
-            # You could change the default path in /etc/evocheck.cf
-            POSTGRES_BACKUP_PATH=${POSTGRES_BACKUP_PATH:-"/home/backup/pg.dump.bak"}
-            test -f "$POSTGRES_BACKUP_PATH" || echo 'IS_POSTGRES_BACKUP FAILED!'
-        fi
-    fi
-
-    if [ "$IS_MONGO_BACKUP" = 1 ]; then
-        if is_installed "mongodb-org-server"; then
-            # You could change the default path in /etc/evocheck.cf
-            MONGO_BACKUP_PATH=${MONGO_BACKUP_PATH:-"/home/backup/mongodump"}
-            if [ -d "$MONGO_BACKUP_PATH" ]; then
-                for file in ${MONGO_BACKUP_PATH}/*/*.{json,bson}; do
-                    # Skip indexes file.
-                    if ! [[ "$file" =~ indexes ]]; then
-                        if [ -f $file ] && [ $(stat -c "%Y" $file) -lt $(date +"%s" -d "now - 2 day") ]; then
-                            echo 'IS_MONGO_BACKUP FAILED!'
-                            break
-                        fi
-                    fi
-                done
-            else
-                echo 'IS_MONGO_BACKUP FAILED!'
-            fi
-        fi
-    fi
-
-    if [ "$IS_LDAP_BACKUP" = 1 ]; then
-        if is_installed slapd; then
-            # You could change the default path in /etc/evocheck.cf
-            LDAP_BACKUP_PATH=${LDAP_BACKUP_PATH:-"/home/backup/ldap.bak"}
-            test -f "$LDAP_BACKUP_PATH" || echo 'IS_LDAP_BACKUP FAILED!'
-        fi
-    fi
-
-    if [ "$IS_REDIS_BACKUP" = 1 ]; then
-        if is_installed redis-server; then
-            # You could change the default path in /etc/evocheck.cf
-            REDIS_BACKUP_PATH=${REDIS_BACKUP_PATH:-"/home/backup/dump.rdb"}
-            test -f "$REDIS_BACKUP_PATH" || echo 'IS_REDIS_BACKUP FAILED!'
-        fi
-    fi
-
-    if [ "$IS_ELASTIC_BACKUP" = 1 ]; then
-        if is_installed elasticsearch; then
-            # You could change the default path in /etc/evocheck.cf
-            ELASTIC_BACKUP_PATH=${ELASTIC_BACKUP_PATH:-"/home/backup/elasticsearch"}
-            test -d "$ELASTIC_BACKUP_PATH" || echo 'IS_ELASTIC_BACKUP FAILED!'
-        fi
-    fi
-
-    if [ "$IS_MARIADBSYSTEMDUNIT" = 1 ]; then
-        if is_debianversion stretch && is_installed mariadb-server; then
-            (systemctl -q is-active mariadb.service && test -f /etc/systemd/system/mariadb.service.d/evolinux.conf) || echo 'IS_MARIADBSYSTEMDUNIT FAILED!'
-        fi
-    fi
-
-    if [ "$IS_MYSQLMUNIN" = 1 ]; then
-        if is_debianversion stretch && is_installed mariadb-server; then
-            for file in mysql_bytes mysql_queries mysql_slowqueries \
-            mysql_threads mysql_connections mysql_files_tables \
-            mysql_innodb_bpool mysql_innodb_bpool_act mysql_innodb_io \
-            mysql_innodb_log mysql_innodb_rows mysql_innodb_semaphores \
-            mysql_myisam_indexes mysql_qcache mysql_qcache_mem \
-            mysql_sorts mysql_tmp_tables; do
-
-                if [[ ! -L /etc/munin/plugins/$file ]]; then
-                    echo 'IS_MYSQLMUNIN FAILED!'
-                    break
-                fi
-            done
-        fi
-    fi
-
-    if [ "$IS_MYSQLNRPE" = 1 ]; then
-        if is_debianversion stretch && is_installed mariadb-server; then
-            (test -f ~nagios/.my.cnf \
-                && [ $(stat -c %U ~nagios/.my.cnf) = "nagios" ] \
-                && [ $(stat -c %a ~nagios/.my.cnf) = "600" ] \
-                && grep -q -F "command[check_mysql]=/usr/lib/nagios/plugins/check_mysql -H localhost  -f ~nagios/.my.cnf") || echo 'IS_MYSQLNRPE FAILED!'
-        fi
-    fi
-
-    if [ "$IS_PHPEVOLINUXCONF" = 1 ]; then
-        if is_debianversion stretch && is_installed php; then
-            (test -f /etc/php/7.0/cli/conf.d/z-evolinux-defaults.ini \
-                && test -f /etc/php/7.0/cli/conf.d/zzz-evolinux-custom.ini) || echo 'IS_PHPEVOLINUXCONF FAILED!'
-        fi
-    fi
-
-    if [ "$IS_SQUIDLOGROTATE" = 1 ]; then
-        if is_debianversion stretch && is_installed squid; then
-            grep -q monthly /etc/logrotate.d/squid || echo 'IS_SQUIDLOGROTATE FAILED!'
-        fi
-    fi
-
-    if [ "$IS_SQUIDEVOLINUXCONF" = 1 ]; then
-        if is_debianversion stretch && is_installed squid; then
-            (grep -qs "^CONFIG=/etc/squid/evolinux-defaults.conf$" /etc/default/squid \
-                && test -f /etc/squid/evolinux-defaults.conf \
-                && test -f /etc/squid/evolinux-whitelist-defaults.conf \
-                && test -f /etc/squid/evolinux-whitelist-custom.conf \
-                && test -f /etc/squid/evolinux-acl.conf \
-                && test -f /etc/squid/evolinux-httpaccess.conf \
-                && test -f /etc/squid/evolinux-custom.conf) || echo 'IS_SQUIDEVOLINUXCONF FAILED!'
-        fi
-    fi
-
-    if [ "$IS_DUPLICATE_FS_LABEL" = 1 ]; then
-        # Do it only if thereis blkid binary
-        if [ -x "$(which blkid)" ]; then
-            tmpFile=$(mktemp -p /tmp)
-            parts=$(blkid | grep -ve raid_member -e EFI_SYSPART \
-              | grep -Eo ' LABEL=".*"' | cut -d'"' -f2)
-            for part in $parts; do
-                echo "$part" >> "$tmpFile"
-            done
-            tmpOutput=$(sort < "$tmpFile" | uniq -d)
-            # If there is no duplicate, uniq will have no output
-            # So, if $tmpOutput is not null, there is a duplicate
-            if [ -n "$tmpOutput" ]; then
-                echo 'IS_DUPLICATE_FS_LABEL FAILED!'
-                if [ "$VERBOSE" = 1 ]; then
-                    echo "Duplicate labels:"
-                    echo -e "$tmpOutput\n"
-                fi
-            fi
-            rm $tmpFile
-        fi
-    fi
-
-    if [ "$IS_EVOLIX_USER" = 1 ]; then
-        grep -q "evolix:" /etc/passwd && echo 'IS_EVOLIX_USER FAILED!'
-    fi
-
-    if [ "$IS_EVOACME_CRON" = 1 ]; then
-        if [ -f "/usr/local/sbin/evoacme" ]; then
-            # Old cron file, should be deleted
-            test -f /etc/cron.daily/certbot && echo 'IS_EVOACME_CRON FAILED!'
-            # evoacme cron file should be present
-            test -f /etc/cron.daily/evoacme || echo 'IS_EVOACME_CRON FAILED!'
-        fi
-    fi
-
-    if [ "$IS_EVOACME_LIVELINKS" = 1 ]; then
-        if [ -x "$(which evoacme)" ]; then
-            # Sometimes evoacme is installed but no certificates has been generated
-            numberOfLinks=$(find /etc/letsencrypt/ -type l | wc -l)
-            if [ $numberOfLinks -gt 0 ]; then
-                for live in /etc/letsencrypt/*/live; do
-                    actualLink=$(ls -lhad $live | tr -s ' ' | cut -d' ' -f 11)
-                    actualCertDate=$(cut -d'/' -f5 <<< $actualLink)
-                    liveDir=$(ls -lhad $live | tr -s ' ' | cut -d' ' -f 9)
-                    certDir=${liveDir%%/live}
-                    lastCertDir=$(stat -c %n ${certDir}/[0-9]* | tail -1)
-                    lastCertDate=$(cut -d'/' -f5 <<< $lastCertDir)
-                    if [[ "$actualCertDate" != "$lastCertDate" ]]; then
-                        echo 'IS_EVOACME_LIVELINKS FAILED!'
-                        break
-                    fi
-                done
-            fi
-        fi
-    fi
-
-    if [ "$IS_APACHE_CONFENABLED" = 1 ]; then
-        # Starting from Jessie and Apache 2.4, /etc/apache2/conf.d/
-        # must be replaced by conf-available/ and config files symlinked
-        # to conf-enabled/
-        if is_debianversion jessie || is_debianversion stretch; then
-            if [ -f /etc/apache2/apache2.conf ]; then
-                test -d /etc/apache2/conf.d/ && echo 'IS_APACHE_CONFENABLED FAILED!'
-                grep -q 'Include conf.d' /etc/apache2/apache2.conf && \
-                  echo 'IS_APACHE_CONFENABLED FAILED!'
-            fi
-        fi
-    fi
-
-    if [ "$IS_MELTDOWN_SPECTRE" = 1 ]; then
-        # For Stretch, detection is easy as the kernel use
-        # /sys/devices/system/cpu/vulnerabilities/
-        if is_debianversion stretch; then
-            for vuln in meltdown spectre_v1 spectre_v2; do
-                test -f /sys/devices/system/cpu/vulnerabilities/$vuln || echo 'IS_MELTDOWN_SPECTRE FAILED!'
-            done
-        # For Jessie this is quite complicated to verify and we need to use kernel config file
-        elif is_debianversion jessie; then
-            if grep -q BOOT_IMAGE= /proc/cmdline; then
-                kernelPath=$(grep -Eo 'BOOT_IMAGE=[^ ]+' /proc/cmdline | cut -d= -f2)
-                kernelVer=${kernelPath##*/vmlinuz-}
-                kernelConfig="config-${kernelVer}"
-                # Sometimes autodetection of kernel config file fail, so we test if the file really exists.
-                if [ -f /boot/$kernelConfig ]; then
-                    grep -Eq '^CONFIG_PAGE_TABLE_ISOLATION=y' /boot/$kernelConfig || echo 'IS_MELTDOWN_SPECTRE FAILED!'
-                    grep -Eq '^CONFIG_RETPOLINE=y' /boot/$kernelConfig || echo 'IS_MELTDOWN_SPECTRE FAILED!'
-                fi
-            fi
-        fi
+if [ "$IS_EVOLINUXSUDOGROUP" = 1 ]; then
+    if is_debianversion stretch; then
+        (grep -q ^evolinux-sudo: /etc/group \
+            && grep -q '^%evolinux-sudo  ALL=(ALL:ALL) ALL' /etc/sudoers.d/evolinux) || echo 'IS_EVOLINUXSUDOGROUP FAILED!'
     fi
+fi
 
-    if [ "$IS_OLD_HOME_DIR" = 1 ]; then
-        for dir in /home/*; do
-            statResult=$(stat -c "%n has owner %u resolved as %U" "$dir" \
-              | grep -Eve '.bak' -e '\.[0-9]{2}-[0-9]{2}-[0-9]{4}' \
-              | grep UNKNOWN)
-            # There is at least one dir matching
-            if [[ -n "$statResult" ]]; then
-                echo 'IS_OLD_HOME_DIR FAILED!'
-                if [[ "$VERBOSE" == 1 ]]; then
-                    echo "$statResult"
-                else
-                    break
-                fi
-            fi
+if [ "$IS_USERINADMGROUP" = 1 ]; then
+    if is_debianversion stretch; then
+        for user in $(grep ^evolinux-sudo: /etc/group |awk -F: '{print $4}' |tr ',' ' '); do
+            groups $user |grep -q adm || echo 'IS_USERINADMGROUP FAILED!'
         done
     fi
 fi
 
-
-if [ `uname -s` == "OpenBSD" ]; then
-
-    if [ "$IS_ADVBASE" = 1 ]; then
-        if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
-            for advbase in $(ifconfig carp | grep advbase | awk -F 'advbase' '{print $2}' | awk '{print $1}' | xargs); do
-            if [[ "$advbase" -gt 1 ]]; then
-                echo 'IS_ADVBASE FAILED!'
-                if [[ "$VERBOSE" == 1 ]]; then
-                        echo "At least one CARP interface has advbase greater than 5 seconds!" 
-                fi
-            fi
-            done
-        fi
-    fi
-
-    if [ "$IS_PREEMPT" = 1 ]; then
-        if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
-            preempt=$(sysctl net.inet.carp.preempt | cut -d"=" -f2)
-            if [[ "$preempt" -ne 1 ]]; then
-                echo 'IS_PREEMPT FAILED!'
-                if [[ "$VERBOSE" == 1 ]]; then
-                    echo "The preempt function is not activated! Please type 'sysctl net.inet.carp.preempt=1' in"
-                fi
-            fi
-            if [ -f /etc/sysctl.conf ]; then
-                grep -qE "^net.inet.carp.preempt=1" /etc/sysctl.conf || echo 'IS_PREEMPT FAILED!'
-            else
-                echo 'IS_PREEMPT FAILED!'
-                if [[ "$VERBOSE" == 1 ]]; then
-                    echo "The preempt parameter is not permanently activated! Please add 'net.inet.carp.preempt=1' in /etc/sysctl.conf"
-                fi
-            fi
-        fi
-    fi
-
-    if [ "$IS_REBOOTMAIL" = 1 ]; then
-        if [ -f /etc/rc.local ]; then
-            grep -qE '^date \| mail -s "boot/reboot of' /etc/rc.local || echo 'IS_REBOOTMAIL FAILED!'
-        else
-            echo 'IS_REBOOTMAIL FAILED!'
+if [ "$IS_OLD_HOME_DIR" = 1 ]; then
+    for dir in /home/*; do
+        statResult=$(stat -c "%n has owner %u resolved as %U" "$dir" \
+          | grep -Eve '.bak' -e '\.[0-9]{2}-[0-9]{2}-[0-9]{4}' \
+          | grep UNKNOWN)
+        # There is at least one dir matching
+        if [[ -n "$statResult" ]]; then
+            echo 'IS_OLD_HOME_DIR FAILED!'
             if [[ "$VERBOSE" == 1 ]]; then
-                echo "Make sure /etc/rc.local exist and 'date | mail -s \"boot/reboot of \$hostname' is present!"
+                echo "$statResult"
+            else
+                break
+            fi
+        fi
+    done
+fi
+
+if [ "$IS_ADVBASE" = 1 ]; then
+    if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
+        for advbase in $(ifconfig carp | grep advbase | awk -F 'advbase' '{print $2}' | awk '{print $1}' | xargs); do
+        if [[ "$advbase" -gt 1 ]]; then
+            echo 'IS_ADVBASE FAILED!'
+            if [[ "$VERBOSE" == 1 ]]; then
+                    echo "At least one CARP interface has advbase greater than 5 seconds!" 
+            fi
+        fi
+        done
+    fi
+fi
+
+if [ "$IS_PREEMPT" = 1 ]; then
+    if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
+        preempt=$(sysctl net.inet.carp.preempt | cut -d"=" -f2)
+        if [[ "$preempt" -ne 1 ]]; then
+            echo 'IS_PREEMPT FAILED!'
+            if [[ "$VERBOSE" == 1 ]]; then
+                echo "The preempt function is not activated! Please type 'sysctl net.inet.carp.preempt=1' in"
+            fi
+        fi
+        if [ -f /etc/sysctl.conf ]; then
+            grep -qE "^net.inet.carp.preempt=1" /etc/sysctl.conf || echo 'IS_PREEMPT FAILED!'
+        else
+            echo 'IS_PREEMPT FAILED!'
+            if [[ "$VERBOSE" == 1 ]]; then
+                echo "The preempt parameter is not permanently activated! Please add 'net.inet.carp.preempt=1' in /etc/sysctl.conf"
             fi
         fi
     fi
+fi
 
-    if [ "$IS_SOFTDEP" = 1 ]; then
-        grep -q "softdep" /etc/fstab || echo 'IS_SOFTDEP FAILED!'
-    fi
-
-    if [ "$IS_WHEEL" = 1 ]; then
-        if [ -f /etc/sudoers ]; then
-            grep -qE "^%wheel.*$" /etc/sudoers || echo 'IS_WHEEL FAILED!'
-        fi
-    fi
-
-    if [ "$IS_PKGMIRROR" = 1 ]; then
-        grep -qE "^https://cdn\.openbsd\.org/pub/OpenBSD" /etc/installurl || echo 'IS_PKGMIRROR FAILED!'
+if [ "$IS_REBOOTMAIL" = 1 ]; then
+    if [ -f /etc/rc.local ]; then
+        grep -qE '^date \| mail -s "boot/reboot of' /etc/rc.local || echo 'IS_REBOOTMAIL FAILED!'
+    else
+        echo 'IS_REBOOTMAIL FAILED!'
         if [[ "$VERBOSE" == 1 ]]; then
-            echo "Check whether the right repo is present in the /etc/installurl file"
+            echo "Make sure /etc/rc.local exist and 'date | mail -s \"boot/reboot of \$hostname' is present!"
         fi
     fi
+fi
 
-    if [ "$IS_HISTORY" = 1 ]; then
-        f=/root/.profile
-        grep -q "^HISTFILE=\$HOME/.histfile" $f \
-        && grep -q "^export HISTFILE" $f \
-        && grep -q "^HISTSIZE=1000" $f \
-        && grep -q "^export HISTSIZE" $f \
-        || echo 'IS_HISTORY FAILED!'
+if [ "$IS_SOFTDEP" = 1 ]; then
+    grep -q "softdep" /etc/fstab || echo 'IS_SOFTDEP FAILED!'
+fi
+
+if [ "$IS_WHEEL" = 1 ]; then
+    if [ -f /etc/sudoers ]; then
+        grep -qE "^%wheel.*$" /etc/sudoers || echo 'IS_WHEEL FAILED!'
     fi
+fi
 
-    if [ "$IS_VIM" = 1 ]; then
-        command -v vim 2>1 >> /dev/null || echo 'IS_VIM FAILED!'
+if [ "$IS_PKGMIRROR" = 1 ]; then
+    grep -qE "^https://cdn\.openbsd\.org/pub/OpenBSD" /etc/installurl || echo 'IS_PKGMIRROR FAILED!'
+    if [[ "$VERBOSE" == 1 ]]; then
+        echo "Check whether the right repo is present in the /etc/installurl file"
     fi
+fi
 
-    if [ "$IS_TTYC0SECURE" = 1 ]; then
-        grep -Eqv "^ttyC0.*secure$" /etc/ttys || echo 'IS_TTYC0SECURE FAILED!'
-    fi
+if [ "$IS_HISTORY" = 1 ]; then
+    f=/root/.profile
+    grep -q "^HISTFILE=\$HOME/.histfile" $f \
+    && grep -q "^export HISTFILE" $f \
+    && grep -q "^HISTSIZE=1000" $f \
+    && grep -q "^export HISTSIZE" $f \
+    || echo 'IS_HISTORY FAILED!'
+fi
 
-    if [ "$IS_CUSTOMSYSLOG" = 1 ]; then
-        grep -q Evolix /etc/newsyslog.conf || echo 'IS_CUSTOMSYSLOG FAILED!'
-    fi
+if [ "$IS_VIM" = 1 ]; then
+    command -v vim 2>1 >> /dev/null || echo 'IS_VIM FAILED!'
+fi
 
-    if [ "$IS_NOINETD" = 1 ]; then
-        grep -q inetd=NO /etc/rc.conf.local 2>/dev/null || echo 'IS_NOINETD FAILED!'
-    fi
+if [ "$IS_TTYC0SECURE" = 1 ]; then
+    grep -Eqv "^ttyC0.*secure$" /etc/ttys || echo 'IS_TTYC0SECURE FAILED!'
+fi
 
-    if [ "$IS_SUDOMAINT" = 1 ]; then
-        f=/etc/sudoers
-        grep -q "Cmnd_Alias MAINT = /usr/share/scripts/evomaintenance.sh" $f \
-        && grep -q "ADMIN ALL=NOPASSWD: MAINT" $f \
-        || echo 'IS_SUDOMAINT FAILED!'
-    fi
+if [ "$IS_CUSTOMSYSLOG" = 1 ]; then
+    grep -q Evolix /etc/newsyslog.conf || echo 'IS_CUSTOMSYSLOG FAILED!'
+fi
 
-    if [ "$IS_POSTGRESQL" = 1 ]; then
-        pkg info | grep -q postgresql-client || echo 'IS_POSTGRESQL FAILED!'
-    fi
+if [ "$IS_NOINETD" = 1 ]; then
+    grep -q inetd=NO /etc/rc.conf.local 2>/dev/null || echo 'IS_NOINETD FAILED!'
+fi
 
-    if [ "$IS_NRPE" = 1 ]; then
-        ( pkg info | grep -qE "nagios-plugins-[0-9.]" \
-        && pkg info | grep -q nagios-plugins-ntp \
-        && pkg info | grep -q nrpe ) || echo 'IS_NRPE FAILED!'
-    fi
+if [ "$IS_SUDOMAINT" = 1 ]; then
+    f=/etc/sudoers
+    grep -q "Cmnd_Alias MAINT = /usr/share/scripts/evomaintenance.sh" $f \
+    && grep -q "ADMIN ALL=NOPASSWD: MAINT" $f \
+    || echo 'IS_SUDOMAINT FAILED!'
+fi
 
-# if [ "$IS_NRPEDISKS" = 1 ]; then
-#     NRPEDISKS=$(grep command.check_disk /etc/nrpe.cfg 2>/dev/null | grep ^command.check_disk[0-9] | sed -e "s/^command.check_disk\([0-9]\+\).*/\1/" | sort -n | tail -1)
-#     DFDISKS=$(df -Pl | grep -E -v "(^Filesystem|/lib/init/rw|/dev/shm|udev|rpc_pipefs)" | wc -l)
-#     [ "$NRPEDISKS" = "$DFDISKS" ] || echo 'IS_NRPEDISKS FAILED!'
-# fi
+if [ "$IS_POSTGRESQL" = 1 ]; then
+    pkg info | grep -q postgresql-client || echo 'IS_POSTGRESQL FAILED!'
+fi
 
-# Verification du check_mailq dans nrpe.cfg (celui-ci doit avoir l'option "-M postfix" si le MTA est Postfix)
-#
-# if [ "$IS_NRPEPOSTFIX" = 1 ]; then
-#     pkg info | grep -q postfix && ( grep -q "^command.*check_mailq -M postfix" /etc/nrpe.cfg 2>/dev/null || echo 'IS_NRPEPOSTFIX FAILED!' )
-# fi
+if [ "$IS_NRPE" = 1 ]; then
+    ( pkg info | grep -qE "nagios-plugins-[0-9.]" \
+    && pkg info | grep -q nagios-plugins-ntp \
+    && pkg info | grep -q nrpe ) || echo 'IS_NRPE FAILED!'
+fi
 
-    if [ "$IS_NRPEDAEMON" = 1 ]; then
-        grep -q "echo -n ' nrpe';        /usr/local/sbin/nrpe -d" /etc/rc.local || echo 'IS_NREPEDAEMON FAILED!'
-    fi
+if [ "$IS_NRPEDAEMON" = 1 ]; then
+    grep -q "echo -n ' nrpe';        /usr/local/sbin/nrpe -d" /etc/rc.local || echo 'IS_NREPEDAEMON FAILED!'
+fi
 
-    if [ "$IS_ALERTBOOT" = 1 ]; then
-        grep -qE "^date \| mail -sboot/reboot .*evolix.fr$" /etc/rc.local || echo 'IS_ALERTBOOT FAILED!'
-    fi
+if [ "$IS_ALERTBOOT" = 1 ]; then
+    grep -qE "^date \| mail -sboot/reboot .*evolix.fr$" /etc/rc.local || echo 'IS_ALERTBOOT FAILED!'
+fi
 
-    if [ "$IS_RSYNC" = 1 ]; then
-        pkg info | grep -q rsync || echo 'IS_RSYNC FAILED!'
-    fi
+if [ "$IS_RSYNC" = 1 ]; then
+    pkg info | grep -q rsync || echo 'IS_RSYNC FAILED!'
+fi
 
-    if [ "$IS_CRONPATH" = 1 ]; then
-        grep -q "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin" /var/cron/tabs/root || echo 'IS_CRONPATH FAILED!'
-    fi
-
-    #TODO
-    # - Check en profondeur de postfix
-    # - NRPEDISK et NRPEPOSTFIX
+if [ "$IS_CRONPATH" = 1 ]; then
+    grep -q "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin" /var/cron/tabs/root || echo 'IS_CRONPATH FAILED!'
 fi
 
 if [ "$IS_TMP_1777" = 1 ]; then

From 53cd10f4a88aefe0b3d0c852783876a34a6180bb Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 14:52:25 +0100
Subject: [PATCH 13/96] Remove incompatible or useless checks under OpenBSD

---
 evocheck.sh | 61 +----------------------------------------------------
 1 file changed, 1 insertion(+), 60 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index a36a8c9..069f7b4 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -150,87 +150,28 @@ if [ "$IS_TMPNOEXEC" = 1 ]; then
     mount | grep "on /tmp" | grep -q noexec || echo 'IS_TMPNOEXEC FAILED!'
 fi
 
-if [ "$IS_SSHALLOWUSERS" = 1 ]; then
-    grep -E -qi "(AllowUsers|AllowGroups)" /etc/ssh/sshd_config || echo 'IS_SSHALLOWUSERS FAILED!'
-fi
-
 if [ "$IS_TMOUTPROFILE" = 1 ]; then
-    grep -q TMOUT= /etc/profile /etc/profile.d/evolinux.sh || echo 'IS_TMOUTPROFILE FAILED!'
+    grep -q TMOUT= /etc/skel/.profile /root/.profile || echo 'IS_TMOUTPROFILE FAILED!'
 fi
 
-# Verification de la configuration du raid soft (mdadm)
-if [ "$IS_RAIDSOFT" = 1 ]; then
-    test -e /proc/mdstat && grep -q md /proc/mdstat && \
-        ( grep -q "^AUTOCHECK=true" /etc/default/mdadm \
-    && grep -q "^START_DAEMON=true" /etc/default/mdadm \
-    && grep -qv "^MAILADDR ___MAIL___" /etc/mdadm/mdadm.conf || echo 'IS_RAIDSOFT FAILED!')
-fi
 
-# Verification de la mise en place d'evobackup
 if [ "$IS_EVOBACKUP" = 1 ]; then
-    ls /etc/cron* |grep -q "evobackup" || echo 'IS_EVOBACKUP FAILED!'
-fi
-
-# Verification si le système doit redémarrer suite màj kernel.
-if [ "$IS_KERNELUPTODATE" = 1 ]; then
-    if is_installed linux-image* && [ $(date -d $(ls --full-time -lcrt /boot | tail -n1 | tr -s " " | cut -d " " -f 6) +%s) -gt $(($(date +%s) - $(cut -f1 -d '.' /proc/uptime))) ]; then
-        echo 'IS_KERNELUPTODATE FAILED!'
     fi
 fi
 
 # Check if the server is running for more than a year.
 if [ "$IS_UPTIME" = 1 ]; then
-    if is_installed linux-image* && [ $(date -d "now - 2 year" +%s) -gt $(($(date +%s) - $(cut -f1 -d '.' /proc/uptime))) ]; then
         echo 'IS_UPTIME FAILED!'
     fi
 fi
 
 # Check if files in /home/backup/ are up-to-date
-if [ "$IS_BACKUPUPTODATE" = 1 ]; then
-    [ -d /home/backup/ ] && for file in /home/backup/*; do
-        if [ -f $file ] && [ $(stat -c "%Y" $file) -lt $(date +"%s" -d "now - 2 day") ]; then
-            echo 'IS_BACKUPUPTODATE FAILED!'
-            break;
-        fi
-    done
-fi
 
 # Check if /etc/.git/ has read/write permissions for root only.
 if [ "$IS_GITPERMS" = 1 ]; then
-    test -d /etc/.git && [ "$(stat -c "%a" /etc/.git/)" = "700" ] || echo 'IS_GITPERMS FAILED!'
-fi
-
-if [ "$IS_EVOLINUXSUDOGROUP" = 1 ]; then
-    if is_debianversion stretch; then
-        (grep -q ^evolinux-sudo: /etc/group \
-            && grep -q '^%evolinux-sudo  ALL=(ALL:ALL) ALL' /etc/sudoers.d/evolinux) || echo 'IS_EVOLINUXSUDOGROUP FAILED!'
     fi
 fi
 
-if [ "$IS_USERINADMGROUP" = 1 ]; then
-    if is_debianversion stretch; then
-        for user in $(grep ^evolinux-sudo: /etc/group |awk -F: '{print $4}' |tr ',' ' '); do
-            groups $user |grep -q adm || echo 'IS_USERINADMGROUP FAILED!'
-        done
-    fi
-fi
-
-if [ "$IS_OLD_HOME_DIR" = 1 ]; then
-    for dir in /home/*; do
-        statResult=$(stat -c "%n has owner %u resolved as %U" "$dir" \
-          | grep -Eve '.bak' -e '\.[0-9]{2}-[0-9]{2}-[0-9]{4}' \
-          | grep UNKNOWN)
-        # There is at least one dir matching
-        if [[ -n "$statResult" ]]; then
-            echo 'IS_OLD_HOME_DIR FAILED!'
-            if [[ "$VERBOSE" == 1 ]]; then
-                echo "$statResult"
-            else
-                break
-            fi
-        fi
-    done
-fi
 
 if [ "$IS_ADVBASE" = 1 ]; then
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then

From de487e964c3b270b9b11ac317164e3615824cdb7 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 14:53:32 +0100
Subject: [PATCH 14/96] Add VERBOSE message for the IS_TMPNOEXEC check

---
 evocheck.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index 069f7b4..a54073b 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -148,6 +148,9 @@ fi
 
 if [ "$IS_TMPNOEXEC" = 1 ]; then
     mount | grep "on /tmp" | grep -q noexec || echo 'IS_TMPNOEXEC FAILED!'
+    if [[ "$VERBOSE" == 1 ]]; then
+        echo "/tmp should be mounted with the noexec option"
+    fi
 fi
 
 if [ "$IS_TMOUTPROFILE" = 1 ]; then

From 954eaf5e288f19093479c151f5a84f441fb41b22 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 14:53:59 +0100
Subject: [PATCH 15/96] Add VERBOSE message for the IS_TMOUTPROFILE check

---
 evocheck.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index a54073b..4978b6b 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -155,6 +155,9 @@ fi
 
 if [ "$IS_TMOUTPROFILE" = 1 ]; then
     grep -q TMOUT= /etc/skel/.profile /root/.profile || echo 'IS_TMOUTPROFILE FAILED!'
+    if [[ "$VERBOSE" == 1 ]]; then
+        echo "In order to fix, add 'export TMOUT=36000' to both /etc/skel/.profile and /root/.profile files"
+    fi
 fi
 
 

From 823a4f9ee00ed4d9e4afff140b3ad841c3b919af Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 14:55:09 +0100
Subject: [PATCH 16/96] RAID check with bioctl is left to be done

---
 evocheck.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index 4978b6b..cf488c1 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -160,6 +160,10 @@ if [ "$IS_TMOUTPROFILE" = 1 ]; then
     fi
 fi
 
+# Check RAID state (bioctl)
+#if [ "$IS_RAIDOK" = 1 ]; then
+# TODO
+#fi
 
 if [ "$IS_EVOBACKUP" = 1 ]; then
     fi

From 37f3c1faee3aca6837bbb9c8f0f9bb10ccc6eea8 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 14:55:57 +0100
Subject: [PATCH 17/96] Update evobackup installation check for OpenBSD

---
 evocheck.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index cf488c1..aca557d 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -165,7 +165,15 @@ fi
 # TODO
 #fi
 
+# Check Evoackup installation
 if [ "$IS_EVOBACKUP" = 1 ]; then
+    if [ -f /etc/daily.local ]; then
+        grep -qE "^sh /usr/share/scripts/zzz_evobackup" /etc/daily.local || echo 'IS_EVOBACKUP FAILED!'
+    else
+        echo 'IS_EVOBACKUP FAILED!'
+        if [[ "$VERBOSE" == 1 ]]; then
+            echo "Make sure /etc/daily.local exist and 'sh /usr/share/scripts/zzz_evobackup' is present and activated in /etc/daily.local"
+        fi
     fi
 fi
 

From e4269d793c5ee46cfd4e42b211f55079d66b8057 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 14:56:46 +0100
Subject: [PATCH 18/96] Check whether the system should be restarted after an
 update is left to be done

---
 evocheck.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index aca557d..bbc6c7f 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -177,6 +177,11 @@ if [ "$IS_EVOBACKUP" = 1 ]; then
     fi
 fi
 
+# Check whether the system should be restarted (after a kernel update)
+#if [ "$IS_KERNELUPTODATE" = 1 ]; then
+# TODO
+#fi
+
 # Check if the server is running for more than a year.
 if [ "$IS_UPTIME" = 1 ]; then
         echo 'IS_UPTIME FAILED!'

From 08edb86da6f033c8062ec41706140ed416266e50 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 14:57:18 +0100
Subject: [PATCH 19/96] Update IS_UPTIME check for OpenBSD

---
 evocheck.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/evocheck.sh b/evocheck.sh
index bbc6c7f..cfc5410 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -184,6 +184,7 @@ fi
 
 # Check if the server is running for more than a year.
 if [ "$IS_UPTIME" = 1 ]; then
+    if [ $(uptime | cut -d" " -f 4) -gt 365 ]; then
         echo 'IS_UPTIME FAILED!'
     fi
 fi

From 8ae3707044017dce0e425e8aef20f95987acb131 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 14:57:58 +0100
Subject: [PATCH 20/96] Check IS_BACKUPUPTODATE is left to be done

---
 evocheck.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index cfc5410..dcc6934 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -190,6 +190,9 @@ if [ "$IS_UPTIME" = 1 ]; then
 fi
 
 # Check if files in /home/backup/ are up-to-date
+#if [ "$IS_BACKUPUPTODATE" = 1 ]; then
+# TODO
+#fi
 
 # Check if /etc/.git/ has read/write permissions for root only.
 if [ "$IS_GITPERMS" = 1 ]; then

From 950ea6fca635c4e6d0585f071e3416ccf9c42248 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 15:00:40 +0100
Subject: [PATCH 21/96] Check if /etc/.git has the proper rights

---
 evocheck.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index dcc6934..2690d02 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -196,6 +196,9 @@ fi
 
 # Check if /etc/.git/ has read/write permissions for root only.
 if [ "$IS_GITPERMS" = 1 ]; then
+    test -d /etc/.git && [ "$(stat -f %p /etc/.git/)" = "40700" ] || echo 'IS_GITPERMS FAILED!'
+    if [[ "$VERBOSE" == 1 ]]; then
+        echo "The directiry /etc/.git sould be in 700"
     fi
 fi
 

From d6ef05803e5c92248d1283488ba52d2ebde654e0 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 17:17:55 +0100
Subject: [PATCH 22/96] Update IS_HISTORY check for OpenBSD

---
 evocheck.sh | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 2690d02..1f155ca 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -265,12 +265,11 @@ if [ "$IS_PKGMIRROR" = 1 ]; then
 fi
 
 if [ "$IS_HISTORY" = 1 ]; then
-    f=/root/.profile
-    grep -q "^HISTFILE=\$HOME/.histfile" $f \
-    && grep -q "^export HISTFILE" $f \
-    && grep -q "^HISTSIZE=1000" $f \
-    && grep -q "^export HISTSIZE" $f \
-    || echo 'IS_HISTORY FAILED!'
+    file=/root/.profile
+    grep -qE "^HISTFILE=\$HOME/.histfile" $file && grep -qE "^export HISTSIZE=10000" $file || echo 'IS_HISTORY FAILED!'
+    if [[ "$VERBOSE" == 1 ]]; then
+        echo "Make sure both 'HISTFILE=$HOME/.histfile' and 'export HISTSIZE=10000' are present in /root/.profile"
+    fi
 fi
 
 if [ "$IS_VIM" = 1 ]; then

From 6a9ba37c3025295d9d859f77a6ba9941343fbfe1 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 17:18:25 +0100
Subject: [PATCH 23/96] Check IS_OLD_HOME_DIR is left to be done

---
 evocheck.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index 1f155ca..e6a6044 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -202,6 +202,8 @@ if [ "$IS_GITPERMS" = 1 ]; then
     fi
 fi
 
+#if [ "$IS_OLD_HOME_DIR" = 1 ]; then
+#fi
 
 if [ "$IS_ADVBASE" = 1 ]; then
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then

From e3f0b457241aae70a31e55acc75a233cdafd6c62 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 17:21:08 +0100
Subject: [PATCH 24/96] Let's use the proper tools to check if a package is
 present

---
 evocheck.sh | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index e6a6044..0ca7a3c 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -275,7 +275,10 @@ if [ "$IS_HISTORY" = 1 ]; then
 fi
 
 if [ "$IS_VIM" = 1 ]; then
-    command -v vim 2>1 >> /dev/null || echo 'IS_VIM FAILED!'
+    pkg_info | grep -q vim || echo 'IS_VIM FAILED!'
+    if [[ "$VERBOSE" == 1 ]]; then
+        echo "vim is not installed! Please add with pkg_add vim"
+    fi
 fi
 
 if [ "$IS_TTYC0SECURE" = 1 ]; then
@@ -298,7 +301,10 @@ if [ "$IS_SUDOMAINT" = 1 ]; then
 fi
 
 if [ "$IS_POSTGRESQL" = 1 ]; then
-    pkg info | grep -q postgresql-client || echo 'IS_POSTGRESQL FAILED!'
+    pkg_info | grep -q postgresql-client || echo 'IS_POSTGRESQL FAILED!'
+    if [[ "$VERBOSE" == 1 ]]; then
+        echo "postgresql-client is not installed! Please add with pkg_add postgresql-client"
+    fi
 fi
 
 if [ "$IS_NRPE" = 1 ]; then

From 5d5291f08d89e25c05899c28234ed3705e94d42f Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 17:21:43 +0100
Subject: [PATCH 25/96] Add VERBOSE message for the IS_TTYC0SECURE check

---
 evocheck.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index 0ca7a3c..27f34ea 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -283,6 +283,9 @@ fi
 
 if [ "$IS_TTYC0SECURE" = 1 ]; then
     grep -Eqv "^ttyC0.*secure$" /etc/ttys || echo 'IS_TTYC0SECURE FAILED!'
+    if [[ "$VERBOSE" == 1 ]]; then
+        echo "First tty should be secured"
+    fi
 fi
 
 if [ "$IS_CUSTOMSYSLOG" = 1 ]; then

From e509ea879ed8486477bb234b675611ccddffdaae Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 17:22:24 +0100
Subject: [PATCH 26/96] inetd is now disabled by default

---
 evocheck.sh | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 27f34ea..1c37fa9 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -292,10 +292,6 @@ if [ "$IS_CUSTOMSYSLOG" = 1 ]; then
     grep -q Evolix /etc/newsyslog.conf || echo 'IS_CUSTOMSYSLOG FAILED!'
 fi
 
-if [ "$IS_NOINETD" = 1 ]; then
-    grep -q inetd=NO /etc/rc.conf.local 2>/dev/null || echo 'IS_NOINETD FAILED!'
-fi
-
 if [ "$IS_SUDOMAINT" = 1 ]; then
     f=/etc/sudoers
     grep -q "Cmnd_Alias MAINT = /usr/share/scripts/evomaintenance.sh" $f \

From 4f1ee5a982f7e9beb38eab9b6e3ec684d2d14eeb Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 17:24:45 +0100
Subject: [PATCH 27/96] Update the IS_NRPE check

---
 evocheck.sh | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 1c37fa9..12704c0 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -307,9 +307,6 @@ if [ "$IS_POSTGRESQL" = 1 ]; then
 fi
 
 if [ "$IS_NRPE" = 1 ]; then
-    ( pkg info | grep -qE "nagios-plugins-[0-9.]" \
-    && pkg info | grep -q nagios-plugins-ntp \
-    && pkg info | grep -q nrpe ) || echo 'IS_NRPE FAILED!'
 fi
 
 if [ "$IS_NRPEDAEMON" = 1 ]; then
@@ -318,6 +315,10 @@ fi
 
 if [ "$IS_ALERTBOOT" = 1 ]; then
     grep -qE "^date \| mail -sboot/reboot .*evolix.fr$" /etc/rc.local || echo 'IS_ALERTBOOT FAILED!'
+    ( pkg_info | grep -q monitoring-plugins && pkg_info | grep -q nrpe ) || echo 'IS_NRPE FAILED!'
+    if [[ "$VERBOSE" == 1 ]]; then
+        echo "nrpe and/or monitoring-plugins are not installed! Please add with pkg_add nrpe monitoring-plugins"
+    fi
 fi
 
 if [ "$IS_RSYNC" = 1 ]; then

From 3948702561a0c0bde3804ad44d7a60f0b57f164f Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 17:30:42 +0100
Subject: [PATCH 28/96] IS_ALERTBOOT is redondant with IS_REBOOTMAIL

---
 evocheck.sh | 2 --
 1 file changed, 2 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 12704c0..61275f3 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -313,8 +313,6 @@ if [ "$IS_NRPEDAEMON" = 1 ]; then
     grep -q "echo -n ' nrpe';        /usr/local/sbin/nrpe -d" /etc/rc.local || echo 'IS_NREPEDAEMON FAILED!'
 fi
 
-if [ "$IS_ALERTBOOT" = 1 ]; then
-    grep -qE "^date \| mail -sboot/reboot .*evolix.fr$" /etc/rc.local || echo 'IS_ALERTBOOT FAILED!'
     ( pkg_info | grep -q monitoring-plugins && pkg_info | grep -q nrpe ) || echo 'IS_NRPE FAILED!'
     if [[ "$VERBOSE" == 1 ]]; then
         echo "nrpe and/or monitoring-plugins are not installed! Please add with pkg_add nrpe monitoring-plugins"

From ed93ba9f5dd6dff12ca006c821dde31d571c322e Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 17:32:20 +0100
Subject: [PATCH 29/96] This is not required anymore

---
 evocheck.sh | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 61275f3..d54193b 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -307,12 +307,6 @@ if [ "$IS_POSTGRESQL" = 1 ]; then
 fi
 
 if [ "$IS_NRPE" = 1 ]; then
-fi
-
-if [ "$IS_NRPEDAEMON" = 1 ]; then
-    grep -q "echo -n ' nrpe';        /usr/local/sbin/nrpe -d" /etc/rc.local || echo 'IS_NREPEDAEMON FAILED!'
-fi
-
     ( pkg_info | grep -q monitoring-plugins && pkg_info | grep -q nrpe ) || echo 'IS_NRPE FAILED!'
     if [[ "$VERBOSE" == 1 ]]; then
         echo "nrpe and/or monitoring-plugins are not installed! Please add with pkg_add nrpe monitoring-plugins"

From 7eba87917f5c9b2d722e6e875a184edf715429ce Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 17:32:48 +0100
Subject: [PATCH 30/96] Add VERBOSE message for the IS_RSYNC check

---
 evocheck.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index d54193b..e98af73 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -315,6 +315,9 @@ fi
 
 if [ "$IS_RSYNC" = 1 ]; then
     pkg info | grep -q rsync || echo 'IS_RSYNC FAILED!'
+    if [[ "$VERBOSE" == 1 ]]; then
+        echo "rsync is not installed! Please add with pkg_add rsync"
+    fi
 fi
 
 if [ "$IS_CRONPATH" = 1 ]; then

From 94cbf9e5891045e72af2bbdde5cbb98200370455 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 17:34:05 +0100
Subject: [PATCH 31/96] Fix IS_SSHPERMITROOTNO for OpenBSD

---
 evocheck.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index e98af73..ca805a8 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -337,8 +337,7 @@ if [ "$IS_USRSHARESCRIPTS" = 1 ]; then
 fi
 
 if [ "$IS_SSHPERMITROOTNO" = 1 ]; then
-    is_debianversion stretch || ( grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config || echo 'IS_SSHPERMITROOTNO FAILED!' )
-    is_debianversion stretch && grep -q ^PermitRoot /etc/ssh/sshd_config && ( grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config || echo 'IS_SSHPERMITROOTNO FAILED!' )
+    grep -qE ^PermitRoot /etc/ssh/sshd_config && ( grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config || echo 'IS_SSHPERMITROOTNO FAILED!' )
 fi
 
 if [ "$IS_EVOMAINTENANCEUSERS" = 1 ]; then

From ba43de597e58772cc9bc7a7c76d2cfb893a2fdce Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 17:36:01 +0100
Subject: [PATCH 32/96] Check IS_PFENABLED is left to be done

---
 evocheck.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index ca805a8..77d7bed 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -249,6 +249,9 @@ if [ "$IS_REBOOTMAIL" = 1 ]; then
     fi
 fi
 
+#if [ "$IS_PFENABLED" = 1 ]; then
+# TODO
+#fi
 if [ "$IS_SOFTDEP" = 1 ]; then
     grep -q "softdep" /etc/fstab || echo 'IS_SOFTDEP FAILED!'
 fi

From f8f0effa9438709c8d886514314b2d3191e59fd3 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 17:36:23 +0100
Subject: [PATCH 33/96] Check IS_PFCUSTOM is left to be done

---
 evocheck.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index 77d7bed..27eb705 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -252,6 +252,11 @@ fi
 #if [ "$IS_PFENABLED" = 1 ]; then
 # TODO
 #fi
+
+#if [ "$IS_PFCUSTOM" = 1 ]; then
+# TODO
+#fi
+
 if [ "$IS_SOFTDEP" = 1 ]; then
     grep -q "softdep" /etc/fstab || echo 'IS_SOFTDEP FAILED!'
 fi

From 6f55586f6bafbf1e0168ed3cde729d3702265ec4 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 17:51:06 +0100
Subject: [PATCH 34/96] That check is not required in our use case for OpenBSD

---
 evocheck.sh | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 27eb705..5e5033d 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -398,13 +398,3 @@ if [ "$IS_EVOMAINTENANCECONF" = 1 ]; then
     && grep "^URGENCYTEL" $f |grep -qv "06.00.00.00.00" \
     && grep "^REALM" $f |grep -qv "example.com" ) || echo 'IS_EVOMAINTENANCECONF FAILED!'
 fi
-
-if [ "$IS_PRIVKEYWOLRDREADABLE" = 1 ]; then
-    for f in /etc/ssl/private/*; do
-        perms=$(stat -L -c "%a" $f)
-        if [ ${perms: -1} != "0" ]; then
-            echo 'IS_PRIVKEYWOLRDREADABLE FAILED!'
-            break
-        fi
-    done
-fi

From ec7de84aa7b182689be64ad7069fb385299caa70 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Fri, 22 Mar 2019 17:51:56 +0100
Subject: [PATCH 35/96] Update default variables

---
 evocheck.sh | 117 ++++++++--------------------------------------------
 1 file changed, 18 insertions(+), 99 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 5e5033d..fa9459a 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -1,129 +1,48 @@
 #!/bin/bash
 
 # EvoCheck
-# Script to verify compliance of a Debian/OpenBSD server
-# powered by Evolix
+# Script to verify compliance of a OpenBSD server powered by Evolix
 
 # Disable LANG*
+
 export LANG=C
 export LANGUAGE=C
 
 # Default configuration values
-IS_TMP_1777=1
-IS_ROOT_0700=1
-IS_VARTMPFS=1
-IS_USRSHARESCRIPTS=1
-IS_SERVEURBASE=1
-IS_LOGROTATECONF=1
-IS_SYSLOGCONF=1
-IS_DEBIANSECURITY=1
-IS_APTITUDEONLY=1
-IS_APTITUDE=1
-IS_APTGETBAK=1
-IS_APTICRON=0
-IS_USRRO=1
-IS_TMPNOEXEC=1
-IS_LISTCHANGESCONF=1
-IS_DPKGWARNING=1
-IS_CUSTOMCRONTAB=1
+
 IS_CUSTOMSUDOERS=1
-IS_SSHPERMITROOTNO=1
-IS_SSHALLOWUSERS=1
+IS_TMPNOEXEC=1
 IS_TMOUTPROFILE=1
-IS_ALERT5BOOT=1
-IS_ALERT5MINIFW=1
-IS_MINIFW=1
-IS_NRPEPERMS=1
-IS_MINIFWPERMS=1
-IS_NRPEDISKS=0
-IS_NRPEPOSTFIX=1
-IS_NRPEPID=1
-IS_GRSECPROCS=1
-IS_UMASKSUDOERS=1
-IS_EVOMAINTENANCEUSERS=1
-IS_APACHEMUNIN=1
-IS_MYSQLUTILS=1
-IS_RAIDSOFT=1
-IS_AWSTATSLOGFORMAT=1
-IS_MUNINLOGROTATE=1
-IS_EVOMAINTENANCECONF=1
-#IS_METCHE=1
-IS_SQUID=1
-IS_MODDEFLATE=1
-IS_LOG2MAILRUNNING=1
-IS_LOG2MAILAPACHE=1
-IS_LOG2MAILMYSQL=1
-IS_LOG2MAILSQUID=1
-IS_BINDCHROOT=1
-IS_REPVOLATILE=1
-IS_AUTOIF=1
-IS_INTERFACESGW=1
-IS_TOOMUCHDEBIANSYSMAINT=1
-IS_USERLOGROTATE=1
-IS_MODSECURITY=1
-IS_APACHECTL=1
-IS_APACHESYMLINK=1
-IS_APACHEIPINALLOW=1
-IS_MUNINAPACHECONF=1
-IS_SAMBAPINPRIORITY=1
+IS_RAIDOK=1
+IS_EVOBACKUP=1
 IS_KERNELUPTODATE=1
 IS_UPTIME=1
-IS_MUNINRUNNING=1
 IS_BACKUPUPTODATE=1
 IS_GITPERMS=1
-IS_NOTUPGRADED=1
-IS_TUNE2FS_M5=1
-IS_PRIVKEYWOLRDREADABLE=1
-IS_EVOLINUXSUDOGROUP=1
-IS_USERINADMGROUP=1
-IS_APACHE2EVOLINUXCONF=1
-IS_BACKPORTSCONF=1
-IS_BIND9MUNIN=1
-IS_BIND9LOGROTATE=1
-IS_BROADCOMFIRMWARE=1
-IS_HARDWARERAIDTOOL=1
-IS_LOG2MAILSYSTEMDUNIT=1
-IS_LISTUPGRADE=1
-IS_MARIADBEVOLINUXCONF=1
-IS_MARIADBSYSTEMDUNIT=1
-IS_MYSQLMUNIN=1
-IS_PHPEVOLINUXCONF=1
-IS_SQUIDLOGROTATE=1
-IS_SQUIDEVOLINUXCONF=1
-IS_SQL_BACKUP=1
-IS_POSTGRES_BACKUP=1
-IS_LDAP_BACKUP=1
-IS_REDIS_BACKUP=1
-IS_ELASTIC_BACKUP=1
-IS_MONGO_BACKUP=1
-IS_MOUNT_FSTAB=1
-IS_NETWORK_INTERFACES=1
-IS_EVOBACKUP=1
-IS_DUPLICATE_FS_LABEL=1
-IS_EVOMAINTENANCE_FW=1
-IS_EVOLIX_USER=1
-IS_EVOACME_CRON=1
-IS_EVOACME_LIVELINKS=1
-IS_APACHE_CONFENABLED=1
-IS_MELTDOWN_SPECTRE=1
 IS_OLD_HOME_DIR=1
-
-#Proper to OpenBSD
+IS_ADVBASE=1
+IS_PREEMPT=1
+IS_REBOOTMAIL=1
+IS_PFENABLED=1
+IS_PFCUSTOM=1
 IS_SOFTDEP=1
 IS_WHEEL=1
-IS_SUDOADMIN=1
 IS_PKGMIRROR=1
 IS_HISTORY=1
 IS_VIM=1
 IS_TTYC0SECURE=1
 IS_CUSTOMSYSLOG=1
-IS_NOINETD=1
 IS_SUDOMAINT=1
 IS_POSTGRESQL=1
 IS_NRPE=1
-IS_NRPEDAEMON=1
-IS_ALERTBOOT=1
 IS_RSYNC=1
+IS_CRONPATH=1
+IS_TMP_1777=1
+IS_ROOT_0700=1
+IS_USRSHARESCRIPTS=1
+IS_SSHPERMITROOTNO=1
+IS_EVOMAINTENANCEUSERS=1
+IS_EVOMAINTENANCECONF=1
 
 # Verbose function
 verbose() {

From 3a18ec50a7916914f275a5213eeb441423c12f43 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Mon, 25 Mar 2019 17:02:51 +0100
Subject: [PATCH 36/96] Since the script is compatible with sh, let's switch to
 /bin/sh

---
 evocheck.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index fa9459a..49808f9 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/sh
 
 # EvoCheck
 # Script to verify compliance of a OpenBSD server powered by Evolix

From 53c7c423245fb945536745bd945b46d158f713c8 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Mon, 25 Mar 2019 17:06:09 +0100
Subject: [PATCH 37/96] Import some functions from the cleanup branch

---
 evocheck.sh | 105 +++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 104 insertions(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index 49808f9..6483614 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -44,6 +44,9 @@ IS_SSHPERMITROOTNO=1
 IS_EVOMAINTENANCEUSERS=1
 IS_EVOMAINTENANCECONF=1
 
+# Default return code : 0 = no error
+RC=0
+
 # Verbose function
 verbose() {
     msg="${1:-$(cat /dev/stdin)}"
@@ -53,7 +56,107 @@ verbose() {
 # Source configuration file
 test -f /etc/evocheck.cf && . /etc/evocheck.cf
 
-VERBOSE="${VERBOSE:-0}"
+# Functions
+
+show_version() {
+    cat <<END
+evocheck version ${VERSION}
+
+Copyright 2009-2019 Evolix <info@evolix.fr>,
+                    Romain Dessort <rdessort@evolix.fr>,
+                    Benoit Série <bserie@evolix.fr>,
+                    Gregory Colpart <reg@evolix.fr>,
+                    Jérémy Lecour <jlecour@evolix.fr>,
+                    Tristan Pilat <tpilat@evolix.fr>,
+                    Victor Laborie <vlaborie@evolix.fr>
+                    and others.
+
+evocheck comes with ABSOLUTELY NO WARRANTY.  This is free software,
+and you are welcome to redistribute it under certain conditions.
+See the GNU General Public License v3.0 for details.
+END
+}
+
+show_help() {
+    cat <<END
+evocheck is a script that verifies Evolix conventions on OpenBSD servers.
+
+Usage: evocheck
+  or   evocheck --cron
+  or   evocheck --quiet
+  or   evocheck --verbose
+
+Options
+     --cron                  disable a few checks
+ -v, --verbose               increase verbosity of checks
+ -q, --quiet                 nothing is printed on stdout nor stderr
+ -h, --help                  print this message and exit
+     --version               print version and exit
+END
+}
+
+is_installed(){
+    for pkg in "$@"; do
+        dpkg -l "$pkg" 2> /dev/null | grep -q -E '^(i|h)i' || return 1
+    done
+}
+
+# logging
+failed() {
+    check_name=$1
+    shift
+    check_comments=$*
+
+    RC=1
+    if [ "${QUIET}" != 1 ]; then
+        if [ -n "${check_comments}" ] && [ "${VERBOSE}" = 1 ]; then
+            printf "%s FAILED! %s\n" "${check_name}" "${check_comments}" 2>&1
+        else
+            printf "%s FAILED!\n" "${check_name}" 2>&1
+        fi
+    fi
+}
+
+# Parse options
+# based on https://gist.github.com/deshion/10d3cb5f88a21671e17a
+while :; do
+    case $1 in
+        -h|-\?|--help)
+            show_help
+            exit 0
+            ;;
+        --version)
+            show_version
+            exit 0
+            ;;
+        --cron)
+            IS_KERNELUPTODATE=0
+            IS_UPTIME=0
+            ;;
+        -v|--verbose)
+            VERBOSE=1
+            ;;
+        -q|--quiet)
+            QUIET=1
+            VERBOSE=0
+            ;;
+        --)
+            # End of all options.
+            shift
+            break
+            ;;
+        -?*|[[:alnum:]]*)
+            # ignore unknown options
+            printf 'WARN: Unknown option (ignored): %s\n' "$1" >&2
+            ;;
+        *)
+            # Default case: If no more options then break out of the loop.
+            break
+            ;;
+    esac
+
+    shift
+done
 
 # If --cron is passed, ignore some checks.
 if [ "$1" = "--cron" ]; then

From 71436c2f44c188bc636105d7425524c17ad831c9 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Mon, 25 Mar 2019 17:08:08 +0100
Subject: [PATCH 38/96] Amend all the checks to use the new logging function

---
 evocheck.sh | 109 +++++++++++++++-------------------------------------
 1 file changed, 32 insertions(+), 77 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 6483614..73d3c10 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -10,7 +10,7 @@ export LANGUAGE=C
 
 # Default configuration values
 
-IS_CUSTOMSUDOERS=1
+IS_UMASKSUDOERS=1
 IS_TMPNOEXEC=1
 IS_TMOUTPROFILE=1
 IS_RAIDOK=1
@@ -164,22 +164,16 @@ if [ "$1" = "--cron" ]; then
     IS_UPTIME=0
 fi
 
-if [ "$IS_CUSTOMSUDOERS" = 1 ]; then
-    grep -E -qr "umask=0077" /etc/sudoers* || echo 'IS_CUSTOMSUDOERS FAILED!'
+if [ "$IS_UMASKSUDOERS" = 1 ]; then
+    grep -E -qr "umask=0077" /etc/sudoers* || failed "IS_UMASKSUDOERS" "sudoers must set umask to 0077"
 fi
 
 if [ "$IS_TMPNOEXEC" = 1 ]; then
-    mount | grep "on /tmp" | grep -q noexec || echo 'IS_TMPNOEXEC FAILED!'
-    if [[ "$VERBOSE" == 1 ]]; then
-        echo "/tmp should be mounted with the noexec option"
-    fi
+    mount | grep "on /tmp" | grep -q noexec || failed "IS_TMPNOEXEC" "/tmp should be mounted with the noexec option"
 fi
 
 if [ "$IS_TMOUTPROFILE" = 1 ]; then
-    grep -q TMOUT= /etc/skel/.profile /root/.profile || echo 'IS_TMOUTPROFILE FAILED!'
-    if [[ "$VERBOSE" == 1 ]]; then
-        echo "In order to fix, add 'export TMOUT=36000' to both /etc/skel/.profile and /root/.profile files"
-    fi
+    grep -q TMOUT= /etc/skel/.profile /root/.profile || failed "IS_TMOUTPROFILE" "In order to fix, add 'export TMOUT=36000' to both /etc/skel/.profile and /root/.profile files"
 fi
 
 # Check RAID state (bioctl)
@@ -190,12 +184,9 @@ fi
 # Check Evoackup installation
 if [ "$IS_EVOBACKUP" = 1 ]; then
     if [ -f /etc/daily.local ]; then
-        grep -qE "^sh /usr/share/scripts/zzz_evobackup" /etc/daily.local || echo 'IS_EVOBACKUP FAILED!'
+        grep -qE "^sh /usr/share/scripts/zzz_evobackup" /etc/daily.local || failed "IS_EVOBACKUP" "Make sure 'sh /usr/share/scripts/zzz_evobackup' is present and activated in /etc/daily.local"
     else
-        echo 'IS_EVOBACKUP FAILED!'
-        if [[ "$VERBOSE" == 1 ]]; then
-            echo "Make sure /etc/daily.local exist and 'sh /usr/share/scripts/zzz_evobackup' is present and activated in /etc/daily.local"
-        fi
+        failed "IS_EVOBACKUP" "Make sure /etc/daily.local exists and 'sh /usr/share/scripts/zzz_evobackup' is present and activated in /etc/daily.local"
     fi
 fi
 
@@ -207,7 +198,7 @@ fi
 # Check if the server is running for more than a year.
 if [ "$IS_UPTIME" = 1 ]; then
     if [ $(uptime | cut -d" " -f 4) -gt 365 ]; then
-        echo 'IS_UPTIME FAILED!'
+        failed "IS_UPTIME" "The server is running for more than a year!"
     fi
 fi
 
@@ -218,10 +209,7 @@ fi
 
 # Check if /etc/.git/ has read/write permissions for root only.
 if [ "$IS_GITPERMS" = 1 ]; then
-    test -d /etc/.git && [ "$(stat -f %p /etc/.git/)" = "40700" ] || echo 'IS_GITPERMS FAILED!'
-    if [[ "$VERBOSE" == 1 ]]; then
-        echo "The directiry /etc/.git sould be in 700"
-    fi
+    test -d /etc/.git && [ "$(stat -f %p /etc/.git/)" = "40700" ] || failed "IS_GITPERMS" "The directiry /etc/.git sould be in 700"
 fi
 
 #if [ "$IS_OLD_HOME_DIR" = 1 ]; then
@@ -231,10 +219,7 @@ if [ "$IS_ADVBASE" = 1 ]; then
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
         for advbase in $(ifconfig carp | grep advbase | awk -F 'advbase' '{print $2}' | awk '{print $1}' | xargs); do
         if [[ "$advbase" -gt 1 ]]; then
-            echo 'IS_ADVBASE FAILED!'
-            if [[ "$VERBOSE" == 1 ]]; then
-                    echo "At least one CARP interface has advbase greater than 5 seconds!" 
-            fi
+            failed "IS_ADVBASE" "At least one CARP interface has advbase greater than 5 seconds!"
         fi
         done
     fi
@@ -244,30 +229,21 @@ if [ "$IS_PREEMPT" = 1 ]; then
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
         preempt=$(sysctl net.inet.carp.preempt | cut -d"=" -f2)
         if [[ "$preempt" -ne 1 ]]; then
-            echo 'IS_PREEMPT FAILED!'
-            if [[ "$VERBOSE" == 1 ]]; then
-                echo "The preempt function is not activated! Please type 'sysctl net.inet.carp.preempt=1' in"
-            fi
+            failed "IS_PREEMPT" "The preempt function is not activated! Please type 'sysctl net.inet.carp.preempt=1' in"
         fi
         if [ -f /etc/sysctl.conf ]; then
-            grep -qE "^net.inet.carp.preempt=1" /etc/sysctl.conf || echo 'IS_PREEMPT FAILED!'
+            grep -qE "^net.inet.carp.preempt=1" /etc/sysctl.conf || failed "IS_PREEMPT" "The preempt parameter is not permanently activated! Please add 'net.inet.carp.preempt=1' in /etc/sysctl.conf"
         else
-            echo 'IS_PREEMPT FAILED!'
-            if [[ "$VERBOSE" == 1 ]]; then
-                echo "The preempt parameter is not permanently activated! Please add 'net.inet.carp.preempt=1' in /etc/sysctl.conf"
-            fi
+	    failed "IS_PREEMPT" "Make sure /etc/sysctl.conf exists and contains the line 'net.inet.carp.preempt=1'"
         fi
     fi
 fi
 
 if [ "$IS_REBOOTMAIL" = 1 ]; then
     if [ -f /etc/rc.local ]; then
-        grep -qE '^date \| mail -s "boot/reboot of' /etc/rc.local || echo 'IS_REBOOTMAIL FAILED!'
+        grep -qE '^date \| mail -s "boot/reboot of' /etc/rc.local || failed "IS_REBOOTMAIL" "Make sure the line 'date | mail -s \"boot/reboot of \$hostname' is present in the /etc/rc.local file!"
     else
-        echo 'IS_REBOOTMAIL FAILED!'
-        if [[ "$VERBOSE" == 1 ]]; then
-            echo "Make sure /etc/rc.local exist and 'date | mail -s \"boot/reboot of \$hostname' is present!"
-        fi
+        failed "IS_REBOOTMAIL" "Make sure /etc/rc.local exist and 'date | mail -s \"boot/reboot of \$hostname' is present!"
     fi
 fi
 
@@ -280,94 +256,73 @@ fi
 #fi
 
 if [ "$IS_SOFTDEP" = 1 ]; then
-    grep -q "softdep" /etc/fstab || echo 'IS_SOFTDEP FAILED!'
+    grep -q "softdep" /etc/fstab || failed "IS_SOFTDEP" ""
 fi
 
 if [ "$IS_WHEEL" = 1 ]; then
     if [ -f /etc/sudoers ]; then
-        grep -qE "^%wheel.*$" /etc/sudoers || echo 'IS_WHEEL FAILED!'
+        grep -qE "^%wheel.*$" /etc/sudoers || failed "IS_WHEEL" ""
     fi
 fi
 
 if [ "$IS_PKGMIRROR" = 1 ]; then
-    grep -qE "^https://cdn\.openbsd\.org/pub/OpenBSD" /etc/installurl || echo 'IS_PKGMIRROR FAILED!'
-    if [[ "$VERBOSE" == 1 ]]; then
-        echo "Check whether the right repo is present in the /etc/installurl file"
-    fi
+    grep -qE "^https://cdn\.openbsd\.org/pub/OpenBSD" /etc/installurl || failed "IS_PKGMIRROR" "Check whether the right repo is present in the /etc/installurl file"
 fi
 
 if [ "$IS_HISTORY" = 1 ]; then
     file=/root/.profile
-    grep -qE "^HISTFILE=\$HOME/.histfile" $file && grep -qE "^export HISTSIZE=10000" $file || echo 'IS_HISTORY FAILED!'
-    if [[ "$VERBOSE" == 1 ]]; then
-        echo "Make sure both 'HISTFILE=$HOME/.histfile' and 'export HISTSIZE=10000' are present in /root/.profile"
-    fi
+    grep -qE "^HISTFILE=\$HOME/.histfile" $file && grep -qE "^export HISTSIZE=10000" $file || failed "IS_HISTORY" "Make sure both 'HISTFILE=$HOME/.histfile' and 'export HISTSIZE=10000' are present in /root/.profile"
 fi
 
 if [ "$IS_VIM" = 1 ]; then
-    pkg_info | grep -q vim || echo 'IS_VIM FAILED!'
-    if [[ "$VERBOSE" == 1 ]]; then
-        echo "vim is not installed! Please add with pkg_add vim"
-    fi
+    pkg_info | grep -q vim || failed "IS_VIM" "vim is not installed! Please add with pkg_add vim"
 fi
 
 if [ "$IS_TTYC0SECURE" = 1 ]; then
-    grep -Eqv "^ttyC0.*secure$" /etc/ttys || echo 'IS_TTYC0SECURE FAILED!'
-    if [[ "$VERBOSE" == 1 ]]; then
-        echo "First tty should be secured"
-    fi
+    grep -Eqv "^ttyC0.*secure$" /etc/ttys || failed "IS_TTYC0SECURE" "First tty should be secured"
 fi
 
 if [ "$IS_CUSTOMSYSLOG" = 1 ]; then
-    grep -q Evolix /etc/newsyslog.conf || echo 'IS_CUSTOMSYSLOG FAILED!'
+    grep -q Evolix /etc/newsyslog.conf || failed "IS_CUSTOMSYSLOG" ""
 fi
 
 if [ "$IS_SUDOMAINT" = 1 ]; then
     f=/etc/sudoers
     grep -q "Cmnd_Alias MAINT = /usr/share/scripts/evomaintenance.sh" $f \
     && grep -q "ADMIN ALL=NOPASSWD: MAINT" $f \
-    || echo 'IS_SUDOMAINT FAILED!'
+    || failed "IS_SUDOMAINT" ""
 fi
 
 if [ "$IS_POSTGRESQL" = 1 ]; then
-    pkg_info | grep -q postgresql-client || echo 'IS_POSTGRESQL FAILED!'
-    if [[ "$VERBOSE" == 1 ]]; then
-        echo "postgresql-client is not installed! Please add with pkg_add postgresql-client"
-    fi
+    pkg_info | grep -q postgresql-client || failed "IS_POSTGRESQL" "postgresql-client is not installed! Please add with pkg_add postgresql-client"
 fi
 
 if [ "$IS_NRPE" = 1 ]; then
-    ( pkg_info | grep -q monitoring-plugins && pkg_info | grep -q nrpe ) || echo 'IS_NRPE FAILED!'
-    if [[ "$VERBOSE" == 1 ]]; then
-        echo "nrpe and/or monitoring-plugins are not installed! Please add with pkg_add nrpe monitoring-plugins"
-    fi
+    ( pkg_info | grep -q monitoring-plugins && pkg_info | grep -q nrpe ) || failed "IS_NRPE" "nrpe and/or monitoring-plugins are not installed! Please add with pkg_add nrpe monitoring-plugins"
 fi
 
 if [ "$IS_RSYNC" = 1 ]; then
-    pkg info | grep -q rsync || echo 'IS_RSYNC FAILED!'
-    if [[ "$VERBOSE" == 1 ]]; then
-        echo "rsync is not installed! Please add with pkg_add rsync"
-    fi
+    pkg_info | grep -q rsync || failed "IS_RSYNC" "rsync is not installed! Please add with pkg_add rsync"
 fi
 
 if [ "$IS_CRONPATH" = 1 ]; then
-    grep -q "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin" /var/cron/tabs/root || echo 'IS_CRONPATH FAILED!'
+    grep -q "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin" /var/cron/tabs/root || failed "IS_CRONPATH" ""
 fi
 
 if [ "$IS_TMP_1777" = 1 ]; then
-    ls -ld /tmp | grep -q drwxrwxrwt || echo 'IS_TMP_1777 FAILED!'
+    ls -ld /tmp | grep -q drwxrwxrwt || failed "IS_TMP_1777" ""
 fi
 
 if [ "$IS_ROOT_0700" = 1 ]; then
-    ls -ld /root | grep -q drwx------ || echo 'IS_ROOT_0700 FAILED!'
+    ls -ld /root | grep -q drwx------ || failed "IS_ROOT_0700" ""
 fi
 
 if [ "$IS_USRSHARESCRIPTS" = 1 ]; then
-    ls -ld /usr/share/scripts | grep -q drwx------ || echo 'IS_USRSHARESCRIPTS FAILED!'
+    ls -ld /usr/share/scripts | grep -q drwx------ || failed "IS_USRSHARESCRIPTS" ""
 fi
 
 if [ "$IS_SSHPERMITROOTNO" = 1 ]; then
-    grep -qE ^PermitRoot /etc/ssh/sshd_config && ( grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config || echo 'IS_SSHPERMITROOTNO FAILED!' )
+    grep -qE ^PermitRoot /etc/ssh/sshd_config && ( grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config || failed "IS_SSHPERMITROOTNO" "" )
 fi
 
 if [ "$IS_EVOMAINTENANCEUSERS" = 1 ]; then
@@ -418,5 +373,5 @@ if [ "$IS_EVOMAINTENANCECONF" = 1 ]; then
     && grep "^FULLFROM" $f |grep -qv "John Doe <jdoe@example.com>" \
     && grep "^URGENCYFROM" $f |grep -qv "mama.doe@example.com" \
     && grep "^URGENCYTEL" $f |grep -qv "06.00.00.00.00" \
-    && grep "^REALM" $f |grep -qv "example.com" ) || echo 'IS_EVOMAINTENANCECONF FAILED!'
+    && grep "^REALM" $f |grep -qv "example.com" ) || failed "IS_EVOMAINTENANCECONF" ""
 fi

From 1add27c67d4dbe51eeb47151d65d3510f67e1bec Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Mon, 25 Mar 2019 17:09:49 +0100
Subject: [PATCH 39/96] We don't have to test whether the system is Debian or
 OpenBSD anymore

---
 evocheck.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 73d3c10..38ac505 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -328,11 +328,11 @@ fi
 if [ "$IS_EVOMAINTENANCEUSERS" = 1 ]; then
     # Can be changed in evocheck.cf
     homeDir=${homeDir:-/home}
-    if ! is_debianversion stretch; then
-        if [ -f /etc/sudoers.d/evolinux ]; then
-            sudoers="/etc/sudoers.d/evolinux"
-        else
-            sudoers="/etc/sudoers"
+    sudoers="/etc/sudoers"
+    for i in $( (grep "^User_Alias *ADMIN" $sudoers | cut -d= -f2 | tr -d " "; grep ^sudo /etc/group |cut -d: -f 4) | tr "," "\n" |sort -u); do
+        grep -qs "^trap.*sudo.*evomaintenance.sh" ${homeDir}/${i}/.*profile
+        if [ $? != 0 ]; then
+            failed "IS_EVOMAINTENANCEUSERS" "$i doesn't have evomaintenance trap!"
         fi
         for i in $( (grep "^User_Alias *ADMIN" $sudoers | cut -d= -f2 | tr -d " "; grep ^sudo /etc/group |cut -d: -f 4) | tr "," "\n" |sort -u); do
             grep -qs "^trap.*sudo.*evomaintenance.sh" ${homeDir}/${i}/.*profile

From 477c15df8a099502b3b9fd7c0fb290fa9ddb84f0 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Mon, 25 Mar 2019 17:10:22 +0100
Subject: [PATCH 40/96] Fix the stat command for OpenBSD

---
 evocheck.sh | 27 ++-------------------------
 1 file changed, 2 insertions(+), 25 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 38ac505..21df006 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -334,37 +334,14 @@ if [ "$IS_EVOMAINTENANCEUSERS" = 1 ]; then
         if [ $? != 0 ]; then
             failed "IS_EVOMAINTENANCEUSERS" "$i doesn't have evomaintenance trap!"
         fi
-        for i in $( (grep "^User_Alias *ADMIN" $sudoers | cut -d= -f2 | tr -d " "; grep ^sudo /etc/group |cut -d: -f 4) | tr "," "\n" |sort -u); do
-            grep -qs "^trap.*sudo.*evomaintenance.sh" ${homeDir}/${i}/.*profile
-            if [ $? != 0 ]; then
-                echo 'IS_EVOMAINTENANCEUSERS FAILED!'
-                if [ "$VERBOSE" = 1 ]; then
-                    echo "$i doesn't have evomaintenance trap!"
-                else
-                    break
-                fi
-            fi
-        done
-    else
-        for i in $(getent group evolinux-sudo | cut -d':' -f4 | tr ',' ' '); do
-            grep -qs "^trap.*sudo.*evomaintenance.sh" ${homeDir}/$i/.*profile
-            if [ $? != 0 ]; then
-                echo 'IS_EVOMAINTENANCEUSERS FAILED!'
-                if [ "$VERBOSE" = 1 ]; then
-                    echo "$i doesn't have evomaintenance trap!"
-                else
-                    break
-                fi
-            fi
-        done
-    fi
+    done
 fi
 
 # Verification de la configuration d'evomaintenance
 if [ "$IS_EVOMAINTENANCECONF" = 1 ]; then
     f=/etc/evomaintenance.cf
     ( test -e $f \
-    && test $(stat -c "%a" $f) = "600" \
+    && test $(stat -f %p $f) = "100600" \
     && grep "^export PGPASSWORD" $f |grep -qv "your-passwd" \
     && grep "^PGDB" $f |grep -qv "your-db" \
     && grep "^PGTABLE" $f |grep -qv "your-table" \

From 12ccfa914ba2baaa3892c68b0de42652464ac180 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Mon, 25 Mar 2019 17:49:22 +0100
Subject: [PATCH 41/96] Fix is_installed function to work on OpenBSD

---
 evocheck.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index 21df006..ce02c7c 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -97,7 +97,7 @@ END
 
 is_installed(){
     for pkg in "$@"; do
-        dpkg -l "$pkg" 2> /dev/null | grep -q -E '^(i|h)i' || return 1
+	pkg_info | grep -q $pkg || return 1
     done
 }
 

From 53015152b3a60545106c794120df7a66c3a2df3c Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Mon, 25 Mar 2019 17:50:10 +0100
Subject: [PATCH 42/96] We now use is_installed function to test whether a
 package is installed

---
 evocheck.sh | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index ce02c7c..b20c775 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -275,7 +275,9 @@ if [ "$IS_HISTORY" = 1 ]; then
 fi
 
 if [ "$IS_VIM" = 1 ]; then
-    pkg_info | grep -q vim || failed "IS_VIM" "vim is not installed! Please add with pkg_add vim"
+    if ! is_installed vim; then
+    	failed "IS_VIM" "vim is not installed! Please add with pkg_add vim"
+    fi
 fi
 
 if [ "$IS_TTYC0SECURE" = 1 ]; then
@@ -294,15 +296,21 @@ if [ "$IS_SUDOMAINT" = 1 ]; then
 fi
 
 if [ "$IS_POSTGRESQL" = 1 ]; then
-    pkg_info | grep -q postgresql-client || failed "IS_POSTGRESQL" "postgresql-client is not installed! Please add with pkg_add postgresql-client"
+    if ! is_installed postgresql-client; then
+    	failed "IS_POSTGRESQL" "postgresql-client is not installed! Please add with pkg_add postgresql-client"
+    fi
 fi
 
 if [ "$IS_NRPE" = 1 ]; then
-    ( pkg_info | grep -q monitoring-plugins && pkg_info | grep -q nrpe ) || failed "IS_NRPE" "nrpe and/or monitoring-plugins are not installed! Please add with pkg_add nrpe monitoring-plugins"
+    if ! is_installed monitoring-plugins || ! is_installed nrpe; then
+    	failed "IS_NRPE" "nrpe and/or monitoring-plugins are not installed! Please add with pkg_add nrpe monitoring-plugins"
+    fi
 fi
 
 if [ "$IS_RSYNC" = 1 ]; then
-    pkg_info | grep -q rsync || failed "IS_RSYNC" "rsync is not installed! Please add with pkg_add rsync"
+    if ! is_installed rsync; then
+    	failed "IS_RSYNC" "rsync is not installed! Please add with pkg_add rsync"
+    fi
 fi
 
 if [ "$IS_CRONPATH" = 1 ]; then

From ef2b234d49ead1bf72d2e356d8f10cae940c275a Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Tue, 21 Apr 2020 16:59:08 +0200
Subject: [PATCH 43/96] Fix a mistake in the description

---
 evocheck.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index b20c775..40675a7 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 
 # EvoCheck
-# Script to verify compliance of a OpenBSD server powered by Evolix
+# Script to verify compliance of an OpenBSD server powered by Evolix
 
 # Disable LANG*
 

From 82af0db8b260599ed459393d81aad08334b8c1c6 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Tue, 21 Apr 2020 16:59:58 +0200
Subject: [PATCH 44/96] Delete default configuration values since they are now
 included in the main function

---
 evocheck.sh | 35 -----------------------------------
 1 file changed, 35 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 40675a7..d3f73ad 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -8,41 +8,6 @@
 export LANG=C
 export LANGUAGE=C
 
-# Default configuration values
-
-IS_UMASKSUDOERS=1
-IS_TMPNOEXEC=1
-IS_TMOUTPROFILE=1
-IS_RAIDOK=1
-IS_EVOBACKUP=1
-IS_KERNELUPTODATE=1
-IS_UPTIME=1
-IS_BACKUPUPTODATE=1
-IS_GITPERMS=1
-IS_OLD_HOME_DIR=1
-IS_ADVBASE=1
-IS_PREEMPT=1
-IS_REBOOTMAIL=1
-IS_PFENABLED=1
-IS_PFCUSTOM=1
-IS_SOFTDEP=1
-IS_WHEEL=1
-IS_PKGMIRROR=1
-IS_HISTORY=1
-IS_VIM=1
-IS_TTYC0SECURE=1
-IS_CUSTOMSYSLOG=1
-IS_SUDOMAINT=1
-IS_POSTGRESQL=1
-IS_NRPE=1
-IS_RSYNC=1
-IS_CRONPATH=1
-IS_TMP_1777=1
-IS_ROOT_0700=1
-IS_USRSHARESCRIPTS=1
-IS_SSHPERMITROOTNO=1
-IS_EVOMAINTENANCEUSERS=1
-IS_EVOMAINTENANCECONF=1
 
 # Default return code : 0 = no error
 RC=0

From 5ee0d20fe92975142d54c6e1f61b2b73445fc000 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Tue, 21 Apr 2020 17:30:39 +0200
Subject: [PATCH 45/96] Add VERSION variable from linux version

---
 evocheck.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index d3f73ad..e75b839 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,6 +3,8 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
+readonly VERSION="20.04.1"
+
 # Disable LANG*
 
 export LANG=C

From 9164fe2459958abb07089058e9e40c5c782d7b1a Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Tue, 21 Apr 2020 17:32:48 +0200
Subject: [PATCH 46/96] Amend show_help function for a more complete

---
 evocheck.sh | 43 ++++++++++++++++++++++++++++++++-----------
 1 file changed, 32 insertions(+), 11 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index e75b839..9e11a40 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -46,19 +46,40 @@ END
 
 show_help() {
     cat <<END
-evocheck is a script that verifies Evolix conventions on OpenBSD servers.
+NAME:
+   evocheck - a system configuration verification tool
 
-Usage: evocheck
-  or   evocheck --cron
-  or   evocheck --quiet
-  or   evocheck --verbose
+VERSION:
+   ${VERSION}
 
-Options
-     --cron                  disable a few checks
- -v, --verbose               increase verbosity of checks
- -q, --quiet                 nothing is printed on stdout nor stderr
- -h, --help                  print this message and exit
-     --version               print version and exit
+DESCRIPTION:
+   A script that verifies Evolix conventions on OpenBSD servers
+
+AUTHORS:
+   Benoit Serie <bserie@evolix.fr>
+   Gregory Colpart <reg@evolix.fr>
+   Jeremy Dubois <jdubois@evolix.fr>
+   Jeremy Lecour <jlecour@evolix.fr>
+   Ludovic Poujol <lpoujol@evolix.fr>
+   Romain Dessort <rdessort@evolix.fr>
+   Tristan Pilat <tpilat@evolix.fr>
+   Victor Laborie <vlaborie@evolix.fr>
+
+USAGE: evocheck
+   or  evocheck --cron 
+   or  evocheck --quiet 
+   or  evocheck --verbose 
+
+OPTIONS:
+       --cron                  disable a few checks
+   -v, --verbose               increase verbosity of checks
+   -q, --quiet                 nothing is printed on stdout nor stderr
+   -h, --help, --version       print this message and exit
+
+COPYRIGHT:
+   evocheck comes with ABSOLUTELY NO WARRANTY. This is free software,
+   and you are welcome to redistribute it under certain conditions.
+   See the GNU General Public License v3.0 for details. 2009-2020
 END
 }
 

From fe76e40b351ef12137285316072602acdeeb8fac Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Tue, 21 Apr 2020 17:34:19 +0200
Subject: [PATCH 47/96] Delete show_version since it is now included in
 show_help function

---
 evocheck.sh | 19 -------------------
 1 file changed, 19 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 9e11a40..ca43b87 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -25,25 +25,6 @@ test -f /etc/evocheck.cf && . /etc/evocheck.cf
 
 # Functions
 
-show_version() {
-    cat <<END
-evocheck version ${VERSION}
-
-Copyright 2009-2019 Evolix <info@evolix.fr>,
-                    Romain Dessort <rdessort@evolix.fr>,
-                    Benoit Série <bserie@evolix.fr>,
-                    Gregory Colpart <reg@evolix.fr>,
-                    Jérémy Lecour <jlecour@evolix.fr>,
-                    Tristan Pilat <tpilat@evolix.fr>,
-                    Victor Laborie <vlaborie@evolix.fr>
-                    and others.
-
-evocheck comes with ABSOLUTELY NO WARRANTY.  This is free software,
-and you are welcome to redistribute it under certain conditions.
-See the GNU General Public License v3.0 for details.
-END
-}
-
 show_help() {
     cat <<END
 NAME:

From 425b08552a0c93b8c8e8da10f58a8064ed2ff90a Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Tue, 21 Apr 2020 17:37:07 +0200
Subject: [PATCH 48/96] Merge --version flag to --help. Both are now showing
 the help message

---
 evocheck.sh | 76 +++++++++++++++++++++++++----------------------------
 1 file changed, 36 insertions(+), 40 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index ca43b87..7d3d256 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -86,46 +86,6 @@ failed() {
     fi
 }
 
-# Parse options
-# based on https://gist.github.com/deshion/10d3cb5f88a21671e17a
-while :; do
-    case $1 in
-        -h|-\?|--help)
-            show_help
-            exit 0
-            ;;
-        --version)
-            show_version
-            exit 0
-            ;;
-        --cron)
-            IS_KERNELUPTODATE=0
-            IS_UPTIME=0
-            ;;
-        -v|--verbose)
-            VERBOSE=1
-            ;;
-        -q|--quiet)
-            QUIET=1
-            VERBOSE=0
-            ;;
-        --)
-            # End of all options.
-            shift
-            break
-            ;;
-        -?*|[[:alnum:]]*)
-            # ignore unknown options
-            printf 'WARN: Unknown option (ignored): %s\n' "$1" >&2
-            ;;
-        *)
-            # Default case: If no more options then break out of the loop.
-            break
-            ;;
-    esac
-
-    shift
-done
 
 # If --cron is passed, ignore some checks.
 if [ "$1" = "--cron" ]; then
@@ -329,3 +289,39 @@ if [ "$IS_EVOMAINTENANCECONF" = 1 ]; then
     && grep "^URGENCYTEL" $f |grep -qv "06.00.00.00.00" \
     && grep "^REALM" $f |grep -qv "example.com" ) || failed "IS_EVOMAINTENANCECONF" ""
 fi
+# Parse options
+# based on https://gist.github.com/deshion/10d3cb5f88a21671e17a
+while :; do
+    case $1 in
+        -h|-\?|--help|--version)
+            show_help
+            exit 0
+            ;;
+        --cron)
+            IS_KERNELUPTODATE=0
+            IS_UPTIME=0
+            ;;
+        -v|--verbose)
+            VERBOSE=1
+            ;;
+        -q|--quiet)
+            QUIET=1
+            VERBOSE=0
+            ;;
+        --)
+            # End of all options.
+            shift
+            break
+            ;;
+        -?*|[[:alnum:]]*)
+            # ignore unknown options
+            printf 'WARN: Unknown option (ignored): %s\n' "$1" >&2
+            ;;
+        *)
+            # Default case: If no more options then break out of the loop.
+            break
+            ;;
+    esac
+
+    shift
+done

From e69e08160d644008667858cf9d3ae6f825cfd2c7 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Tue, 21 Apr 2020 17:40:28 +0200
Subject: [PATCH 49/96] We now use functions instead of if statements as in the
 linux version of the script

---
 evocheck.sh | 188 +++++++++++++++++++++++++---------------------------
 1 file changed, 89 insertions(+), 99 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 7d3d256..9d722bd 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -93,58 +93,50 @@ if [ "$1" = "--cron" ]; then
     IS_UPTIME=0
 fi
 
-if [ "$IS_UMASKSUDOERS" = 1 ]; then
+check_umasksudoers(){
     grep -E -qr "umask=0077" /etc/sudoers* || failed "IS_UMASKSUDOERS" "sudoers must set umask to 0077"
-fi
+}
 
-if [ "$IS_TMPNOEXEC" = 1 ]; then
+check_tmpnoexec(){
     mount | grep "on /tmp" | grep -q noexec || failed "IS_TMPNOEXEC" "/tmp should be mounted with the noexec option"
-fi
+}
 
-if [ "$IS_TMOUTPROFILE" = 1 ]; then
+check_tmoutprofile(){
     grep -q TMOUT= /etc/skel/.profile /root/.profile || failed "IS_TMOUTPROFILE" "In order to fix, add 'export TMOUT=36000' to both /etc/skel/.profile and /root/.profile files"
-fi
+}
 
-# Check RAID state (bioctl)
-#if [ "$IS_RAIDOK" = 1 ]; then
-# TODO
-#fi
+check_raidok(){
+}
 
-# Check Evoackup installation
-if [ "$IS_EVOBACKUP" = 1 ]; then
+check_evobackup(){
     if [ -f /etc/daily.local ]; then
         grep -qE "^sh /usr/share/scripts/zzz_evobackup" /etc/daily.local || failed "IS_EVOBACKUP" "Make sure 'sh /usr/share/scripts/zzz_evobackup' is present and activated in /etc/daily.local"
     else
         failed "IS_EVOBACKUP" "Make sure /etc/daily.local exists and 'sh /usr/share/scripts/zzz_evobackup' is present and activated in /etc/daily.local"
     fi
-fi
+}
 
 # Check whether the system should be restarted (after a kernel update)
-#if [ "$IS_KERNELUPTODATE" = 1 ]; then
-# TODO
-#fi
+check_kerneluptodate(){
+}
 
-# Check if the server is running for more than a year.
-if [ "$IS_UPTIME" = 1 ]; then
+check_uptime(){
     if [ $(uptime | cut -d" " -f 4) -gt 365 ]; then
         failed "IS_UPTIME" "The server is running for more than a year!"
     fi
-fi
+}
 
-# Check if files in /home/backup/ are up-to-date
-#if [ "$IS_BACKUPUPTODATE" = 1 ]; then
-# TODO
-#fi
+check_backuptodate(){
+}
 
-# Check if /etc/.git/ has read/write permissions for root only.
-if [ "$IS_GITPERMS" = 1 ]; then
+check_gitperms(){
     test -d /etc/.git && [ "$(stat -f %p /etc/.git/)" = "40700" ] || failed "IS_GITPERMS" "The directiry /etc/.git sould be in 700"
-fi
+}
 
-#if [ "$IS_OLD_HOME_DIR" = 1 ]; then
-#fi
+check_oldhomedir(){
+}
 
-if [ "$IS_ADVBASE" = 1 ]; then
+check_advbase(){
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
         for advbase in $(ifconfig carp | grep advbase | awk -F 'advbase' '{print $2}' | awk '{print $1}' | xargs); do
         if [[ "$advbase" -gt 1 ]]; then
@@ -152,9 +144,9 @@ if [ "$IS_ADVBASE" = 1 ]; then
         fi
         done
     fi
-fi
+}
 
-if [ "$IS_PREEMPT" = 1 ]; then
+check_preempt(){
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
         preempt=$(sysctl net.inet.carp.preempt | cut -d"=" -f2)
         if [[ "$preempt" -ne 1 ]]; then
@@ -163,106 +155,104 @@ if [ "$IS_PREEMPT" = 1 ]; then
         if [ -f /etc/sysctl.conf ]; then
             grep -qE "^net.inet.carp.preempt=1" /etc/sysctl.conf || failed "IS_PREEMPT" "The preempt parameter is not permanently activated! Please add 'net.inet.carp.preempt=1' in /etc/sysctl.conf"
         else
-	    failed "IS_PREEMPT" "Make sure /etc/sysctl.conf exists and contains the line 'net.inet.carp.preempt=1'"
+        failed "IS_PREEMPT" "Make sure /etc/sysctl.conf exists and contains the line 'net.inet.carp.preempt=1'"
         fi
     fi
-fi
+}
 
-if [ "$IS_REBOOTMAIL" = 1 ]; then
+check_rebootmail(){
     if [ -f /etc/rc.local ]; then
         grep -qE '^date \| mail -s "boot/reboot of' /etc/rc.local || failed "IS_REBOOTMAIL" "Make sure the line 'date | mail -s \"boot/reboot of \$hostname' is present in the /etc/rc.local file!"
     else
         failed "IS_REBOOTMAIL" "Make sure /etc/rc.local exist and 'date | mail -s \"boot/reboot of \$hostname' is present!"
     fi
-fi
+}
 
-#if [ "$IS_PFENABLED" = 1 ]; then
-# TODO
-#fi
+check_pfenabled(){
+}
 
-#if [ "$IS_PFCUSTOM" = 1 ]; then
-# TODO
-#fi
+check_pfcustom(){
+}
 
-if [ "$IS_SOFTDEP" = 1 ]; then
+check_softdep(){
     grep -q "softdep" /etc/fstab || failed "IS_SOFTDEP" ""
-fi
+}
 
-if [ "$IS_WHEEL" = 1 ]; then
+check_wheel(){
     if [ -f /etc/sudoers ]; then
         grep -qE "^%wheel.*$" /etc/sudoers || failed "IS_WHEEL" ""
     fi
-fi
+}
 
-if [ "$IS_PKGMIRROR" = 1 ]; then
+check_pkgmirror(){
     grep -qE "^https://cdn\.openbsd\.org/pub/OpenBSD" /etc/installurl || failed "IS_PKGMIRROR" "Check whether the right repo is present in the /etc/installurl file"
-fi
+}
 
-if [ "$IS_HISTORY" = 1 ]; then
+check_history(){
     file=/root/.profile
     grep -qE "^HISTFILE=\$HOME/.histfile" $file && grep -qE "^export HISTSIZE=10000" $file || failed "IS_HISTORY" "Make sure both 'HISTFILE=$HOME/.histfile' and 'export HISTSIZE=10000' are present in /root/.profile"
-fi
+}
 
-if [ "$IS_VIM" = 1 ]; then
+check_vim(){
     if ! is_installed vim; then
-    	failed "IS_VIM" "vim is not installed! Please add with pkg_add vim"
+        failed "IS_VIM" "vim is not installed! Please add with pkg_add vim"
     fi
-fi
+}
 
-if [ "$IS_TTYC0SECURE" = 1 ]; then
+check_ttyc0secure(){
     grep -Eqv "^ttyC0.*secure$" /etc/ttys || failed "IS_TTYC0SECURE" "First tty should be secured"
-fi
+}
 
-if [ "$IS_CUSTOMSYSLOG" = 1 ]; then
+check_customsyslog(){
     grep -q Evolix /etc/newsyslog.conf || failed "IS_CUSTOMSYSLOG" ""
-fi
+}
 
-if [ "$IS_SUDOMAINT" = 1 ]; then
-    f=/etc/sudoers
-    grep -q "Cmnd_Alias MAINT = /usr/share/scripts/evomaintenance.sh" $f \
-    && grep -q "ADMIN ALL=NOPASSWD: MAINT" $f \
+check_sudomaint(){
+    file=/etc/sudoers
+    grep -q "Cmnd_Alias MAINT = /usr/share/scripts/evomaintenance.sh" $file \
+    && grep -q "ADMIN ALL=NOPASSWD: MAINT" $file \
     || failed "IS_SUDOMAINT" ""
-fi
+}
 
-if [ "$IS_POSTGRESQL" = 1 ]; then
+check_postgresql(){
     if ! is_installed postgresql-client; then
-    	failed "IS_POSTGRESQL" "postgresql-client is not installed! Please add with pkg_add postgresql-client"
+        failed "IS_POSTGRESQL" "postgresql-client is not installed! Please add with pkg_add postgresql-client"
     fi
-fi
+}
 
-if [ "$IS_NRPE" = 1 ]; then
+check_nrpe(){
     if ! is_installed monitoring-plugins || ! is_installed nrpe; then
-    	failed "IS_NRPE" "nrpe and/or monitoring-plugins are not installed! Please add with pkg_add nrpe monitoring-plugins"
-    fi
-fi
+        failed "IS_NRPE" "nrpe and/or monitoring-plugins are not installed! Please add with pkg_add nrpe monitoring-plugins"
+    fi 
+}
 
-if [ "$IS_RSYNC" = 1 ]; then
+check_rsync(){
     if ! is_installed rsync; then
-    	failed "IS_RSYNC" "rsync is not installed! Please add with pkg_add rsync"
+        failed "IS_RSYNC" "rsync is not installed! Please add with pkg_add rsync"
     fi
-fi
+}
 
-if [ "$IS_CRONPATH" = 1 ]; then
+check_cronpath(){
     grep -q "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin" /var/cron/tabs/root || failed "IS_CRONPATH" ""
-fi
+}
 
-if [ "$IS_TMP_1777" = 1 ]; then
+check_tmp1777(){
     ls -ld /tmp | grep -q drwxrwxrwt || failed "IS_TMP_1777" ""
-fi
+}
 
-if [ "$IS_ROOT_0700" = 1 ]; then
+check_root0700(){
     ls -ld /root | grep -q drwx------ || failed "IS_ROOT_0700" ""
-fi
+}
 
-if [ "$IS_USRSHARESCRIPTS" = 1 ]; then
+check_usrsharescripts(){
     ls -ld /usr/share/scripts | grep -q drwx------ || failed "IS_USRSHARESCRIPTS" ""
-fi
+}
 
-if [ "$IS_SSHPERMITROOTNO" = 1 ]; then
+check_sshpermitrootno() {
     grep -qE ^PermitRoot /etc/ssh/sshd_config && ( grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config || failed "IS_SSHPERMITROOTNO" "" )
-fi
+}
 
-if [ "$IS_EVOMAINTENANCEUSERS" = 1 ]; then
+check_evomaintenanceusers(){
     # Can be changed in evocheck.cf
     homeDir=${homeDir:-/home}
     sudoers="/etc/sudoers"
@@ -271,24 +261,24 @@ if [ "$IS_EVOMAINTENANCEUSERS" = 1 ]; then
         if [ $? != 0 ]; then
             failed "IS_EVOMAINTENANCEUSERS" "$i doesn't have evomaintenance trap!"
         fi
-    done
-fi
+    done 
+}
+
+check_evomaintenanceconf(){
+    file=/etc/evomaintenance.cf
+    ( test -e $file \
+    && test $(stat -f %p $file) = "100600" \
+    && grep "^export PGPASSWORD" $file |grep -qv "your-passwd" \
+    && grep "^PGDB" $file |grep -qv "your-db" \
+    && grep "^PGTABLE" $file |grep -qv "your-table" \
+    && grep "^PGHOST" $file |grep -qv "your-pg-host" \
+    && grep "^FROM" $file |grep -qv "jdoe@example.com" \
+    && grep "^FULLFROM" $file |grep -qv "John Doe <jdoe@example.com>" \
+    && grep "^URGENCYFROM" $file |grep -qv "mama.doe@example.com" \
+    && grep "^URGENCYTEL" $file |grep -qv "06.00.00.00.00" \
+    && grep "^REALM" $file |grep -qv "example.com" ) || failed "IS_EVOMAINTENANCECONF" ""
+}
 
-# Verification de la configuration d'evomaintenance
-if [ "$IS_EVOMAINTENANCECONF" = 1 ]; then
-    f=/etc/evomaintenance.cf
-    ( test -e $f \
-    && test $(stat -f %p $f) = "100600" \
-    && grep "^export PGPASSWORD" $f |grep -qv "your-passwd" \
-    && grep "^PGDB" $f |grep -qv "your-db" \
-    && grep "^PGTABLE" $f |grep -qv "your-table" \
-    && grep "^PGHOST" $f |grep -qv "your-pg-host" \
-    && grep "^FROM" $f |grep -qv "jdoe@example.com" \
-    && grep "^FULLFROM" $f |grep -qv "John Doe <jdoe@example.com>" \
-    && grep "^URGENCYFROM" $f |grep -qv "mama.doe@example.com" \
-    && grep "^URGENCYTEL" $f |grep -qv "06.00.00.00.00" \
-    && grep "^REALM" $f |grep -qv "example.com" ) || failed "IS_EVOMAINTENANCECONF" ""
-fi
 # Parse options
 # based on https://gist.github.com/deshion/10d3cb5f88a21671e17a
 while :; do

From 6f5b5d78d873cfd96c9ea0712774f3b16576ea16 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Tue, 21 Apr 2020 17:44:37 +0200
Subject: [PATCH 50/96] Create the main function and add calls to all checks

---
 evocheck.sh | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index 9d722bd..cb1e720 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -279,6 +279,47 @@ check_evomaintenanceconf(){
     && grep "^REALM" $file |grep -qv "example.com" ) || failed "IS_EVOMAINTENANCECONF" ""
 }
 
+
+main() {
+    # Default return code : 0 = no error
+    RC=0
+
+    test "${IS_UMASKSUDOERS:=1}" = 1 && check_umasksudoers
+    test "${IS_TMPNOEXEC:=1}" = 1 && check_tmpnoexec
+    test "${IS_TMOUTPROFILE:=1}" = 1 && check_tmoutprofile
+    test "${IS_RAIDOK:=1}" = 1 && check_raidok
+    test "${IS_EVOBACKUP:=1}" = 1 && check_evobackup
+    test "${IS_KERNELUPTODATE:=1}" = 1 && check_kerneluptodate
+    test "${IS_UPTIME:=1}" = 1 && check_uptime
+    test "${IS_BACKUPUPTODATE:=1}" = 1 && check_backuptodate
+    test "${IS_GITPERMS:=1}" = 1 && check_gitperms
+    test "${IS_OLD_HOME_DIR:=1}" = 1 && check_oldhomedir
+    test "${IS_ADVBASE:=1}" = 1 && check_advbase
+    test "${IS_PREEMPT:=1}" = 1 && check_preempt
+    test "${IS_REBOOTMAIL:=1}" = 1 && check_rebootmail
+    test "${IS_PFENABLED:=1}" = 1 && check_pfenabled
+    test "${IS_PFCUSTOM:=1}" = 1 && check_pfcustom
+    test "${IS_SOFTDEP:=1}" = 1 && check_softdep
+    test "${IS_WHEEL:=1}" = 1 && check_wheel
+    test "${IS_PKGMIRROR:=1}" = 1 && check_pkgmirror
+    test "${IS_HISTORY:=1}" = 1 && check_history
+    test "${IS_VIM:=1}" = 1 && check_vim
+    test "${IS_TTYC0SECURE:=1}" = 1 && check_ttyc0secure
+    test "${IS_CUSTOMSYSLOG:=1}" = 1 && check_customsyslog
+    test "${IS_SUDOMAINT:=1}" = 1 && check_sudomaint
+    test "${IS_POSTGRESQL:=1}" = 1 && check_postgresql
+    test "${IS_NRPE:=1}" = 1 && check_nrpe
+    test "${IS_RSYNC:=1}" = 1 && check_rsync
+    test "${IS_CRONPATH:=1}" = 1 && check_cronpath
+    test "${IS_TMP_1777:=1}" = 1 && check_tmp1777
+    test "${IS_ROOT_0700:=1}" = 1 && check_root0700
+    test "${IS_USRSHARESCRIPTS:=1}" = 1 && check_usrsharescripts
+    test "${IS_SSHPERMITROOTNO:=1}" = 1 && check_sshpermitrootno
+    test "${IS_EVOMAINTENANCEUSERS:=1}" = 1 && check_evomaintenanceusers
+    test "${IS_EVOMAINTENANCECONF:=1}" = 1 && check_evomaintenanceconf
+
+    exit ${RC}
+}
 # Parse options
 # based on https://gist.github.com/deshion/10d3cb5f88a21671e17a
 while :; do
@@ -315,3 +356,5 @@ while :; do
 
     shift
 done
+
+main ${ARGS}

From 68823b7c91ecaad98bc3e3299d1c2b23e660275c Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Tue, 21 Apr 2020 18:16:53 +0200
Subject: [PATCH 51/96] We can't run the OpenBSD version of evocheck in DroneCI

---
 .drone.yml | 8 --------
 1 file changed, 8 deletions(-)
 delete mode 100644 .drone.yml

diff --git a/.drone.yml b/.drone.yml
deleted file mode 100644
index 7cc86c6..0000000
--- a/.drone.yml
+++ /dev/null
@@ -1,8 +0,0 @@
-kind: pipeline
-name: default
-
-steps:
-- name: run shellcheck on evocheck.sh 
-  image: vlaborie/shellcheck
-  commands:
-  - LC_ALL=C.UTF-8 shellcheck evocheck.sh

From c72a779f6c6f08f8c579391e3fd501ce544ce586 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Tue, 21 Apr 2020 18:17:51 +0200
Subject: [PATCH 52/96] Let's create a new changelog file for this version of
 evocheck

---
 CHANGELOG | 80 +++++++------------------------------------------------
 1 file changed, 10 insertions(+), 70 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 83c820a..e95ea2e 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,76 +1,16 @@
-The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
-and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
-## [0.13] - 2018-04-10
-
-### Added
-
-* New checks:
-  IS_EVOLIX_USER
+## [6.6] - 2020-04-21
 
 ### Changed
 
-* Fixing IS_DUPLICATE_FS_LEVEL check
-* Custom limit for IS_NOTUPGRADED
-* IS_SSHALLOWUSERS now check also for AllowGroups
-
-## [0.12] - 2018-03-19
-
-### Added
-
-* New checks:
-  IS_DUPLICATE_FS_LEVEL
-
-### Changed
-
-* Enabling IS_EVOBACKUP by default
-* Better output for IS_MYSQLMUNIN
-
-## [0.11] - 2018-02-07
-
-### Added
-
-  * Bunch of new checks:                                                   
-    IS_PRIVKEYWOLRDREADABLE                                                
-    IS_EVOLINUXSUDOGROUP                                                   
-    IS_USERINADMGROUP                                                      
-    IS_APACHE2EVOLINUXCONF    
-    IS_BACKPORTSCONF                       
-    IS_BIND9MUNIN                         
-    IS_BIND9LOGROTATE                      
-    IS_BROADCOMFIRMWARE                                                 
-    IS_HARDWARERAIDTOOL
-    IS_LOG2MAILSYSTEMDUNIT                                              
-    IS_LISTUPGRADE
-    IS_MARIADBEVOLINUXCONF              
-    IS_MARIADBSYSTEMDUNIT
-    IS_MYSQLMUNIN             
-    IS_PHPEVOLINUXCONF        
-    IS_SQUIDLOGROTATE                      
-    IS_SQUIDEVOLINUXCONF        
-    IS_SQL_BACKUP                          
-    IS_POSTGRES_BACKUP                    
-    IS_LDAP_BACKUP                         
-    IS_REDIS_BACKUP                       
-    IS_ELASTIC_BACKUP                                               
-    IS_MONGO_BACKUP
-    IS_MOUNT_FSTAB                                                  
-    IS_NETWORK_INTERFACES
-
-### Changed
-
-  * IS_UPTIME added in --cron mode                                          
-  * is_pack_web() for Stretch           
-  * IS_DPKGWARNING for Stretch                                              
-  * IS_MOUNT_FSTAB is disabled if lsblk not available
-  * IS_MINIFWPERMS for Stretch                                      
-  * IS_SQUID for Stretch
-  * IS_LOG2MAILAPACHE for Stretch                                   
-  * IS_AUTOIF for Stretch
-  * IS_UPTIME warn if uptime is more thant 2y, was 1y
-  * IS_NOTUPGRADED warn if last upgrade is older than 90d, was 30d
-  * IS_TUNE2FS_M5 use python in place of bc for calculation               
-  * IS_EVOMAINTENANCEUSERS for Stretch
-  * IS_EVOMAINTENANCECONF check also the mode of the file (600)           
+- Rewrite if statements to functions
+- Add a main function
+- New help message

From f019e82255ebd9f16b70e0a2dc2f6c2c81ffdc68 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Tue, 21 Apr 2020 18:18:39 +0200
Subject: [PATCH 53/96] Update main contributors of this branch

---
 CONTRIBUTING.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index ae7d3f1..5be0a31 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,4 +1,4 @@
-Current project leader: Benoît
+Current project leader: Jérémy D and Tristan
 
 - Use English
-- Always do a Merge Request
\ No newline at end of file
+- Always do a Merge Request

From cf975ee14bb8ac092f9ff3c83a207853ebfac4d6 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Tue, 21 Apr 2020 18:19:33 +0200
Subject: [PATCH 54/96] We have no use of Vagrant here

---
 Vagrantfile | 43 -------------------------------------------
 1 file changed, 43 deletions(-)
 delete mode 100644 Vagrantfile

diff --git a/Vagrantfile b/Vagrantfile
deleted file mode 100644
index 619e2da..0000000
--- a/Vagrantfile
+++ /dev/null
@@ -1,43 +0,0 @@
-# -*- mode: ruby -*-
-# vi: set ft=ruby :
-
-Vagrant::DEFAULT_SERVER_URL.replace('https://vagrantcloud.com')
-
-# Load ~/.VagrantFile if exist, permit local config provider
-vagrantfile = File.join("#{Dir.home}", '.VagrantFile')
-load File.expand_path(vagrantfile) if File.exists?(vagrantfile)
-
-Vagrant.configure('2') do |config|
-  config.vm.synced_folder "./", "/vagrant", type: "rsync", rsync__exclude: [ '.vagrant', '.git' ]
-  config.ssh.shell="/bin/sh"
-
-  $deps = <<SCRIPT
-rm -f /usr/share/scripts/evocheck.sh
-ln -s /vagrant/evocheck.sh /usr/share/scripts/evocheck.sh
-cat >/etc/evocheck.cf <<EOF
-IS_CUSTOMSUDOERS=0
-IS_VARTMPFS=0
-IS_USRRO=0
-IS_TMPNOEXEC=0
-IS_SSHALLOWUSERS=0
-IS_ALERT5MINIFW=0
-IS_MINIFW=0
-IS_MINIFWPERMS=0
-IS_EVOBACKUP=0
-IS_MUNINRUNNING=0
-IS_EVOLINUXSUDOGROUP=0
-IS_LOG2MAILSYSTEMDUNIT=0
-IS_LISTUPGRADE=0
-IS_EVOMAINTENANCECONF=0
-EOF
-SCRIPT
-
-  config.vm.define :evocheck do |node|
-    node.vm.hostname = "evocheck.example.com"
-    node.vm.box = "evolix/evolinux"
-
-    node.vm.provision "deps", type: "shell", :inline => $deps
-
-  end
-
-end

From b1868829aaaf0660dab779e3d31f7a75cf770d8a Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Tue, 21 Apr 2020 18:21:03 +0200
Subject: [PATCH 55/96] It might be useful to have /usr/share/scripts in the
 crontab PATH

---
 evocheck.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index cb1e720..af476ee 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -233,7 +233,7 @@ check_rsync(){
 }
 
 check_cronpath(){
-    grep -q "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin" /var/cron/tabs/root || failed "IS_CRONPATH" ""
+    grep -q "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/share/scripts" /var/cron/tabs/root || failed "IS_CRONPATH" ""
 }
 
 check_tmp1777(){

From 0b6ad08b5be56852b78a1dee81af06779c7dd7ad Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Wed, 22 Apr 2020 17:53:26 +0200
Subject: [PATCH 56/96] Add RAID check

---
 evocheck.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index af476ee..45e48e2 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -106,6 +106,15 @@ check_tmoutprofile(){
 }
 
 check_raidok(){
+    egrep 'sd.*RAID' /var/run/dmesg.boot 1> /dev/null 2>&1
+    RESULT=$?
+    if [ $RESULT -eq 0 ]; then
+        raid_device=$(egrep 'sd.*RAID' /var/run/dmesg.boot | awk '{ print $1 }')
+        raid_status=$(bioctl $raid_device | grep softraid | awk '{ print $3 }')
+        if [ $raid_status != "Online" ]; then
+            failed "IS_RAIDOK" "One of the RAID disk members is faulty. Use bioctl -h $raid_device for more informations"
+        fi
+    fi
 }
 
 check_evobackup(){

From 82a9050e00d046ec969803241a4a9c5632f57eb3 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Mon, 27 Apr 2020 15:27:31 +0200
Subject: [PATCH 57/96] Now use a version-naming scheme based on OpenBSD's one

---
 evocheck.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index 45e48e2..725825e 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,7 +3,7 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
-readonly VERSION="20.04.1"
+readonly VERSION="6.6.2"
 
 # Disable LANG*
 

From 1d47e0f8d8d8d6de806c91ed1cb177e3f1c0da7c Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Mon, 27 Apr 2020 15:28:59 +0200
Subject: [PATCH 58/96] Raname kerneluptodate function to uptodate

---
 evocheck.sh | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 725825e..f511449 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -125,8 +125,6 @@ check_evobackup(){
     fi
 }
 
-# Check whether the system should be restarted (after a kernel update)
-check_kerneluptodate(){
 }
 
 check_uptime(){
@@ -298,7 +296,6 @@ main() {
     test "${IS_TMOUTPROFILE:=1}" = 1 && check_tmoutprofile
     test "${IS_RAIDOK:=1}" = 1 && check_raidok
     test "${IS_EVOBACKUP:=1}" = 1 && check_evobackup
-    test "${IS_KERNELUPTODATE:=1}" = 1 && check_kerneluptodate
     test "${IS_UPTIME:=1}" = 1 && check_uptime
     test "${IS_BACKUPUPTODATE:=1}" = 1 && check_backuptodate
     test "${IS_GITPERMS:=1}" = 1 && check_gitperms

From a5a034e6116a9b4a788b57ead89e1149c71df643 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Mon, 27 Apr 2020 15:30:00 +0200
Subject: [PATCH 59/96] Add check_uptodate function

---
 evocheck.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index f511449..2591dd8 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -125,6 +125,12 @@ check_evobackup(){
     fi
 }
 
+check_uptodate(){
+    if [ -f $(command -v syspatch) ]; then
+        if syspatch -c | egrep "." 1> /dev/null 2>&1; then
+            failed "IS_UPTODATE" "Security update available! Update with syspatch(8)!"
+        fi
+    fi
 }
 
 check_uptime(){
@@ -296,6 +302,7 @@ main() {
     test "${IS_TMOUTPROFILE:=1}" = 1 && check_tmoutprofile
     test "${IS_RAIDOK:=1}" = 1 && check_raidok
     test "${IS_EVOBACKUP:=1}" = 1 && check_evobackup
+    test "${IS_UPTODATE:=1}" = 1 && check_uptodate
     test "${IS_UPTIME:=1}" = 1 && check_uptime
     test "${IS_BACKUPUPTODATE:=1}" = 1 && check_backuptodate
     test "${IS_GITPERMS:=1}" = 1 && check_gitperms

From c436480014ffb0d16e40fd5a908954009d9ecd89 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Mon, 27 Apr 2020 15:30:42 +0200
Subject: [PATCH 60/96] Add check_pfenabled function

---
 evocheck.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index 2591dd8..ca5537e 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -182,6 +182,9 @@ check_rebootmail(){
 }
 
 check_pfenabled(){
+    if pfctl -si | grep Disabled 1> /dev/null 2>&1; then
+        failed "IS_PFENABLED" "PF is disabled! Make sure pf=NO is absent from /etc/rc.conf.local and carefully run pfctl -e"
+    fi
 }
 
 check_pfcustom(){

From e0716d31973bf0f6703fb9ee341d01bc799a683b Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Mon, 27 Apr 2020 15:35:28 +0200
Subject: [PATCH 61/96] Remove check_oldhomedir - This information is
 irrelevant since we always keep home directories of former sysadmins

---
 evocheck.sh | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index ca5537e..6a72116 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -146,9 +146,6 @@ check_gitperms(){
     test -d /etc/.git && [ "$(stat -f %p /etc/.git/)" = "40700" ] || failed "IS_GITPERMS" "The directiry /etc/.git sould be in 700"
 }
 
-check_oldhomedir(){
-}
-
 check_advbase(){
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
         for advbase in $(ifconfig carp | grep advbase | awk -F 'advbase' '{print $2}' | awk '{print $1}' | xargs); do
@@ -309,7 +306,6 @@ main() {
     test "${IS_UPTIME:=1}" = 1 && check_uptime
     test "${IS_BACKUPUPTODATE:=1}" = 1 && check_backuptodate
     test "${IS_GITPERMS:=1}" = 1 && check_gitperms
-    test "${IS_OLD_HOME_DIR:=1}" = 1 && check_oldhomedir
     test "${IS_ADVBASE:=1}" = 1 && check_advbase
     test "${IS_PREEMPT:=1}" = 1 && check_preempt
     test "${IS_REBOOTMAIL:=1}" = 1 && check_rebootmail

From 4fead89240e6a24a50939ba7d928d5dc161fb7dd Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Mon, 27 Apr 2020 15:38:27 +0200
Subject: [PATCH 62/96] Add check_sync function - If a server is a Carp member
 we check whether the sync.sh script is present or not

---
 evocheck.sh | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index 6a72116..0c90051 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -292,6 +292,15 @@ check_evomaintenanceconf(){
     && grep "^REALM" $file |grep -qv "example.com" ) || failed "IS_EVOMAINTENANCECONF" ""
 }
 
+check_sync(){
+    if ifconfig carp | grep carp 1> /dev/null 2>&1; then
+        sync_script=/usr/share/scripts/sync.sh
+        if [ ! -f $sync_script ]; then
+            failed "IS_SYNC" "The sync.sh script is absent! As a carp member, a sync.sh script should be present in /usr/share/scripts"
+        fi
+    fi
+}
+
 
 main() {
     # Default return code : 0 = no error
@@ -329,6 +338,7 @@ main() {
     test "${IS_SSHPERMITROOTNO:=1}" = 1 && check_sshpermitrootno
     test "${IS_EVOMAINTENANCEUSERS:=1}" = 1 && check_evomaintenanceusers
     test "${IS_EVOMAINTENANCECONF:=1}" = 1 && check_evomaintenanceconf
+    test "${IS_SYNC:=1}" = 1 && check_sync
 
     exit ${RC}
 }

From 8d80e5bfc84592f499944e9e34fea9c722197bbc Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Mon, 27 Apr 2020 15:45:41 +0200
Subject: [PATCH 63/96] Update CHANGELOG to 6.6.2

---
 CHANGELOG | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index e95ea2e..3aa7387 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,7 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [6.6] - 2020-04-21
+## [6.6.2] - 2020-04-27
+
+### Added
+
+- Add check_sync function - If a server is a Carp member we check whether the sync.sh script is present or not
+- Add check_pfenabled function - We make sure PF is enabled
+- Add check_uptodate function - Use syspatch(8) to check if security updates are available
+
+### Changed
+
+- Remove check_oldhomedir - This information is irrelevant since we always keep home directories of former sysadmins
+- Now use a version-naming scheme based on OpenBSD's one
+
+## [6.6.1] - 2020-04-21
 
 ### Changed
 

From 239c5896df9fd6343bae1089e86dfab6508199b9 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Wed, 15 Jul 2020 11:08:32 +0200
Subject: [PATCH 64/96] We want evocheck advbase output to be uniq

---
 evocheck.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 0c90051..734b2af 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -148,11 +148,15 @@ check_gitperms(){
 
 check_advbase(){
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
+        bad_advbase=0
         for advbase in $(ifconfig carp | grep advbase | awk -F 'advbase' '{print $2}' | awk '{print $1}' | xargs); do
-        if [[ "$advbase" -gt 1 ]]; then
-            failed "IS_ADVBASE" "At least one CARP interface has advbase greater than 5 seconds!"
+        if [[ "$advbase" -gt 5 ]]; then
+            bad_advbase=1
         fi
         done
+        if [[ "$bad_advbase" -eq 1 ]]; then
+            failed "IS_ADVBASE" "At least one CARP interface has advbase greater than 5 seconds!"
+        fi
     fi
 }
 

From 5eedf3ad4d356cd497e4032683ad87f264bd731e Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Wed, 15 Jul 2020 11:19:30 +0200
Subject: [PATCH 65/96] Fix check_customsyslog - We have to check whether
 EvoBSD is present in newsyslog.conf file

---
 evocheck.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index 734b2af..9106ff1 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -221,7 +221,7 @@ check_ttyc0secure(){
 }
 
 check_customsyslog(){
-    grep -q Evolix /etc/newsyslog.conf || failed "IS_CUSTOMSYSLOG" ""
+    grep -q EvoBSD /etc/newsyslog.conf || failed "IS_CUSTOMSYSLOG" ""
 }
 
 check_sudomaint(){

From b58ad5130747cefbeebc5075f1bc621d6e254700 Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Wed, 15 Jul 2020 11:21:10 +0200
Subject: [PATCH 66/96] Fix check_sudomaint function - ADMIN group does not
 exist anymore, we now check that the wheel group has NOPASSWD for
 evomaintenance

---
 evocheck.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index 9106ff1..15f2657 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -227,7 +227,7 @@ check_customsyslog(){
 check_sudomaint(){
     file=/etc/sudoers
     grep -q "Cmnd_Alias MAINT = /usr/share/scripts/evomaintenance.sh" $file \
-    && grep -q "ADMIN ALL=NOPASSWD: MAINT" $file \
+    && grep -q "%wheel ALL=NOPASSWD: MAINT" $file \
     || failed "IS_SUDOMAINT" ""
 }
 

From c688b0d5246b7206d6e59ae2c400770c287036dd Mon Sep 17 00:00:00 2001
From: Tristan PILAT <tpilat@evolix.fr>
Date: Wed, 15 Jul 2020 11:31:38 +0200
Subject: [PATCH 67/96] Bump to version 6.7.1

---
 CHANGELOG   | 8 ++++++++
 evocheck.sh | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 3aa7387..d6eb02f 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.7.1] - 2020-07-15
+
+### Fixed
+
+- Fix check_customsyslog - We have to check whether EvoBSD is present in newsyslog.conf file
+- Fix check_sudomaint function - ADMIN group does not exist anymore, we now check that the wheel group has NOPASSWD to run the evomaintenance command alias
+- Fix check_advbase - We want the evocheck advbase function output to be uniq
+
 ## [6.6.2] - 2020-04-27
 
 ### Added
diff --git a/evocheck.sh b/evocheck.sh
index 15f2657..0363984 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,7 +3,7 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
-readonly VERSION="6.6.2"
+readonly VERSION="6.7.1"
 
 # Disable LANG*
 

From 04994ecebc08ab54db27ef3e4ab80d607d880276 Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Wed, 22 Jul 2020 14:27:27 +0200
Subject: [PATCH 68/96] Add check_defaultroute function and update CHANGELOG
 file to 6.7.2

---
 CHANGELOG   |  6 ++++++
 evocheck.sh | 11 ++++++++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index d6eb02f..f506390 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.7.2] - 2020-07-22
+
+### Added
+
+- Add check_defaultroute function - Make sure the default route in /etc/mygate file is the same that the one currently used
+
 ## [6.7.1] - 2020-07-15
 
 ### Fixed
diff --git a/evocheck.sh b/evocheck.sh
index 0363984..9652ecb 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,7 +3,7 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
-readonly VERSION="6.7.1"
+readonly VERSION="6.7.2"
 
 # Disable LANG*
 
@@ -305,6 +305,14 @@ check_sync(){
     fi
 }
 
+check_defaultroute(){
+    file_route=$(cat /etc/mygate)
+    used_route=$(route -n show -priority 8 | grep default | awk '{print $2}')
+    if [ "$file_route" != "$used_route" ]; then
+        failed "IS_DEFAULTROUTE" "The default route in /etc/mygate is different from the one currently used"
+    fi
+}
+
 
 main() {
     # Default return code : 0 = no error
@@ -343,6 +351,7 @@ main() {
     test "${IS_EVOMAINTENANCEUSERS:=1}" = 1 && check_evomaintenanceusers
     test "${IS_EVOMAINTENANCECONF:=1}" = 1 && check_evomaintenanceconf
     test "${IS_SYNC:=1}" = 1 && check_sync
+    test "${IS_DEFAULTROUTE:=1}" = 1 && check_defaultroute
 
     exit ${RC}
 }

From 3d86996f5deaade896ff69f9a25ebe681d8aa13a Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Thu, 23 Jul 2020 10:28:34 +0200
Subject: [PATCH 69/96] Fix check_defaultroute - We need to check if the
 /etc/mygate file exists before comparing it - version 6.7.3

---
 CHANGELOG   |  6 ++++++
 evocheck.sh | 14 +++++++++-----
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index f506390..a3bfbae 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.7.3] - 2020-07-23
+
+### Fixed
+
+- Fix check_defaultroute - We need to check if the /etc/mygate file exists before comparing it
+
 ## [6.7.2] - 2020-07-22
 
 ### Added
diff --git a/evocheck.sh b/evocheck.sh
index 9652ecb..48803d9 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,7 +3,7 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
-readonly VERSION="6.7.2"
+readonly VERSION="6.7.3"
 
 # Disable LANG*
 
@@ -306,10 +306,14 @@ check_sync(){
 }
 
 check_defaultroute(){
-    file_route=$(cat /etc/mygate)
-    used_route=$(route -n show -priority 8 | grep default | awk '{print $2}')
-    if [ "$file_route" != "$used_route" ]; then
-        failed "IS_DEFAULTROUTE" "The default route in /etc/mygate is different from the one currently used"
+    if [ -f /etc/mygate ]; then
+        file_route=$(cat /etc/mygate)
+        used_route=$(route -n show -priority 8 | grep default | awk '{print $2}')
+        if [ "$file_route" != "$used_route" ]; then
+            failed "IS_DEFAULTROUTE" "The default route in /etc/mygate is different from the one currently used"
+        fi
+    else
+        failed "IS_DEFAULTROUTE" "The file /etc/mygate does not exist. Make sure you have the same default route in this file as the one currently in use."
     fi
 }
 

From 57d44cbf911ee2b7286cada882c3613b5bd8c69e Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Thu, 23 Jul 2020 11:00:34 +0200
Subject: [PATCH 70/96] Removed check_postgresql - Deprecated since we now use
 an API

---
 CHANGELOG   | 4 ++++
 evocheck.sh | 7 -------
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index a3bfbae..80243f7 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -13,6 +13,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Fix check_defaultroute - We need to check if the /etc/mygate file exists before comparing it
 
+### Removed
+
+- Removed check_postgresql - Deprecated since we now use an API
+
 ## [6.7.2] - 2020-07-22
 
 ### Added
diff --git a/evocheck.sh b/evocheck.sh
index 48803d9..b3c6175 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -231,12 +231,6 @@ check_sudomaint(){
     || failed "IS_SUDOMAINT" ""
 }
 
-check_postgresql(){
-    if ! is_installed postgresql-client; then
-        failed "IS_POSTGRESQL" "postgresql-client is not installed! Please add with pkg_add postgresql-client"
-    fi
-}
-
 check_nrpe(){
     if ! is_installed monitoring-plugins || ! is_installed nrpe; then
         failed "IS_NRPE" "nrpe and/or monitoring-plugins are not installed! Please add with pkg_add nrpe monitoring-plugins"
@@ -344,7 +338,6 @@ main() {
     test "${IS_TTYC0SECURE:=1}" = 1 && check_ttyc0secure
     test "${IS_CUSTOMSYSLOG:=1}" = 1 && check_customsyslog
     test "${IS_SUDOMAINT:=1}" = 1 && check_sudomaint
-    test "${IS_POSTGRESQL:=1}" = 1 && check_postgresql
     test "${IS_NRPE:=1}" = 1 && check_nrpe
     test "${IS_RSYNC:=1}" = 1 && check_rsync
     test "${IS_CRONPATH:=1}" = 1 && check_cronpath

From 5bad0301d910f3dc04bd0057ec0092b4c0e15b8a Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Mon, 27 Jul 2020 16:59:54 +0200
Subject: [PATCH 71/96] Add check_ntp() - Check the ntpd configuration

---
 evocheck.sh | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/evocheck.sh b/evocheck.sh
index b3c6175..7af41af 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -311,6 +311,16 @@ check_defaultroute(){
     fi
 }
 
+check_ntp(){
+    if grep -q "server ntp.evolix.net" /etc/ntpd.conf; then
+        if [ $(wc -l /etc/ntpd.conf | awk '{print $1}') -ne 1 ]; then
+            failed "IS_NTP" "The /etc/ntpd.conf file should only contains \"server ntp.evolix.net\"."
+        fi
+    else
+        failed "IS_NTP" "The configuration in /etc/ntpd.conf is not compliant. It should contains \"server ntp.evolix.net\"."
+    fi
+}
+
 
 main() {
     # Default return code : 0 = no error
@@ -349,6 +359,7 @@ main() {
     test "${IS_EVOMAINTENANCECONF:=1}" = 1 && check_evomaintenanceconf
     test "${IS_SYNC:=1}" = 1 && check_sync
     test "${IS_DEFAULTROUTE:=1}" = 1 && check_defaultroute
+    test "${IS_NTP:=1}" = 1 && check_ntp
 
     exit ${RC}
 }

From 8eb2c5f9bc94620e5df7dde4561c85c1d201859e Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Mon, 27 Jul 2020 17:01:15 +0200
Subject: [PATCH 72/96] Update changelog

---
 CHANGELOG | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index 80243f7..12c66af 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -9,6 +9,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [6.7.3] - 2020-07-23
 
+### Added
+
+- Add check_ntp - Check the ntpd configuration
+
 ### Fixed
 
 - Fix check_defaultroute - We need to check if the /etc/mygate file exists before comparing it

From 4798873ace02d53f78f5ace20d4b96c7dad7d16f Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Tue, 4 Aug 2020 15:08:21 +0200
Subject: [PATCH 73/96] Add check_backupuptodate - Check that /home/backup is
 not older than 2 days

---
 CHANGELOG   |  6 ++++++
 evocheck.sh | 24 +++++++++++++++++++++---
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 12c66af..26b1de4 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.7.4] - 2020-08-04
+
+### Added
+
+- Add check_backupuptodate - Check that /home/backup is not older than 2 days
+
 ## [6.7.3] - 2020-07-23
 
 ### Added
diff --git a/evocheck.sh b/evocheck.sh
index 7af41af..dfbad68 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,7 +3,7 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
-readonly VERSION="6.7.3"
+readonly VERSION="6.7.4"
 
 # Disable LANG*
 
@@ -139,7 +139,25 @@ check_uptime(){
     fi
 }
 
-check_backuptodate(){
+check_backupuptodate(){
+    backup_dir="/home/backup"
+    if [ -d "${backup_dir}" ]; then
+        if [ -n "$(ls -A ${backup_dir})" ]; then
+            for file in ${backup_dir}/*; do
+                let "limit = $(date +"%s") - 172800"
+                updated_at=$(stat -f "%m" "$file")
+
+                if [ -f "$file" ] && [ "$limit" -gt "$updated_at" ]; then
+                    failed "IS_BACKUPUPTODATE" "$file has not been backed up"
+                    test "${VERBOSE}" = 1 || break;
+                fi
+            done
+        else
+            failed "IS_BACKUPUPTODATE" "${backup_dir}/ is empty"
+        fi
+    else
+        failed "IS_BACKUPUPTODATE" "${backup_dir}/ is missing"
+    fi
 }
 
 check_gitperms(){
@@ -333,7 +351,7 @@ main() {
     test "${IS_EVOBACKUP:=1}" = 1 && check_evobackup
     test "${IS_UPTODATE:=1}" = 1 && check_uptodate
     test "${IS_UPTIME:=1}" = 1 && check_uptime
-    test "${IS_BACKUPUPTODATE:=1}" = 1 && check_backuptodate
+    test "${IS_BACKUPUPTODATE:=1}" = 1 && check_backupuptodate
     test "${IS_GITPERMS:=1}" = 1 && check_gitperms
     test "${IS_ADVBASE:=1}" = 1 && check_advbase
     test "${IS_PREEMPT:=1}" = 1 && check_preempt

From 7cb6055af5b81e5eb1779ee3270b473dfd784690 Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Fri, 9 Oct 2020 14:09:21 +0200
Subject: [PATCH 74/96] Fix check_cronpath

Do not check PATH=XXX but only XXX
because XXX can also be in quotes
(PATH="XXX" would not be matched)
---
 CHANGELOG   | 6 ++++++
 evocheck.sh | 4 ++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 26b1de4..8ed1ae8 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.7.5] - 2020-10-09
+
+### Fixed
+
+- Fix check_cronpath - Do not check PATH=XXX but only XXX because XXX can also be in quotes (PATH="XXX" would not be matched)
+
 ## [6.7.4] - 2020-08-04
 
 ### Added
diff --git a/evocheck.sh b/evocheck.sh
index dfbad68..3bde7ac 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,7 +3,7 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
-readonly VERSION="6.7.4"
+readonly VERSION="6.7.5"
 
 # Disable LANG*
 
@@ -262,7 +262,7 @@ check_rsync(){
 }
 
 check_cronpath(){
-    grep -q "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/share/scripts" /var/cron/tabs/root || failed "IS_CRONPATH" ""
+    grep -q "/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/share/scripts" /var/cron/tabs/root || failed "IS_CRONPATH" ""
 }
 
 check_tmp1777(){

From 682cd3afaad17f893b68305539f8bf4fbdbfc71b Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Thu, 15 Oct 2020 10:18:55 +0200
Subject: [PATCH 75/96] Add check_noatime and fix check_softdep

Add check_noatime - Check that all ffs partitions are mounted with the noatime
option

Fix check_softdep - We now check the number of ffs partitions and we compare it
to the number of softdep options currently there
---
 CHANGELOG   | 10 ++++++++++
 evocheck.sh | 21 +++++++++++++++------
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 8ed1ae8..8a1c700 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.7.6] - 2020-10-15
+
+### Added
+
+- Add check_noatime - Check that all ffs partitions are mounted with the noatime option
+
+### Fixed
+
+- Fix check_softdep - We now check the number of ffs partitions and we compare it to the number of softdep options currently there
+
 ## [6.7.5] - 2020-10-09
 
 ### Fixed
diff --git a/evocheck.sh b/evocheck.sh
index 3bde7ac..857c5e0 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,7 +3,7 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
-readonly VERSION="6.7.5"
+readonly VERSION="6.7.6"
 
 # Disable LANG*
 
@@ -101,6 +101,18 @@ check_tmpnoexec(){
     mount | grep "on /tmp" | grep -q noexec || failed "IS_TMPNOEXEC" "/tmp should be mounted with the noexec option"
 }
 
+check_softdep(){
+    if [ $(grep -c softdep /etc/fstab) -ne $(grep -c ffs /etc/fstab) ]; then
+        failed "IS_SOFTDEP" "All partitions should have the softdep option"
+    fi
+}
+
+check_noatime(){
+    if [ $(mount | grep -c noatime) -ne $(grep -c ffs /etc/fstab) ]; then
+        failed "IS_NOATIME" "All partitions should be mounted with the noatime option"
+    fi
+}
+
 check_tmoutprofile(){
     grep -q TMOUT= /etc/skel/.profile /root/.profile || failed "IS_TMOUTPROFILE" "In order to fix, add 'export TMOUT=36000' to both /etc/skel/.profile and /root/.profile files"
 }
@@ -209,10 +221,6 @@ check_pfenabled(){
 check_pfcustom(){
 }
 
-check_softdep(){
-    grep -q "softdep" /etc/fstab || failed "IS_SOFTDEP" ""
-}
-
 check_wheel(){
     if [ -f /etc/sudoers ]; then
         grep -qE "^%wheel.*$" /etc/sudoers || failed "IS_WHEEL" ""
@@ -346,6 +354,8 @@ main() {
 
     test "${IS_UMASKSUDOERS:=1}" = 1 && check_umasksudoers
     test "${IS_TMPNOEXEC:=1}" = 1 && check_tmpnoexec
+    test "${IS_SOFTDEP:=1}" = 1 && check_softdep
+    test "${IS_NOATIME:=1}" = 1 && check_noatime
     test "${IS_TMOUTPROFILE:=1}" = 1 && check_tmoutprofile
     test "${IS_RAIDOK:=1}" = 1 && check_raidok
     test "${IS_EVOBACKUP:=1}" = 1 && check_evobackup
@@ -358,7 +368,6 @@ main() {
     test "${IS_REBOOTMAIL:=1}" = 1 && check_rebootmail
     test "${IS_PFENABLED:=1}" = 1 && check_pfenabled
     test "${IS_PFCUSTOM:=1}" = 1 && check_pfcustom
-    test "${IS_SOFTDEP:=1}" = 1 && check_softdep
     test "${IS_WHEEL:=1}" = 1 && check_wheel
     test "${IS_PKGMIRROR:=1}" = 1 && check_pkgmirror
     test "${IS_HISTORY:=1}" = 1 && check_history

From b49a1fbea594fdefa2150ec845bc16b105372fb4 Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Thu, 22 Oct 2020 12:12:42 +0200
Subject: [PATCH 76/96] Fix check_uptodate : properly check that syspatch
 exists

---
 evocheck.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index 857c5e0..e9bbefb 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -138,7 +138,7 @@ check_evobackup(){
 }
 
 check_uptodate(){
-    if [ -f $(command -v syspatch) ]; then
+    if [ $(command -v syspatch) ]; then
         if syspatch -c | egrep "." 1> /dev/null 2>&1; then
             failed "IS_UPTODATE" "Security update available! Update with syspatch(8)!"
         fi

From b6f4889ac5a621603a35fa57a11f8f8b2220ecad Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Thu, 22 Oct 2020 14:16:56 +0200
Subject: [PATCH 77/96] Fix check_raidok : the same device could be displayed
 multiple times

---
 evocheck.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index e9bbefb..b6c687e 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -121,7 +121,7 @@ check_raidok(){
     egrep 'sd.*RAID' /var/run/dmesg.boot 1> /dev/null 2>&1
     RESULT=$?
     if [ $RESULT -eq 0 ]; then
-        raid_device=$(egrep 'sd.*RAID' /var/run/dmesg.boot | awk '{ print $1 }')
+        raid_device=$(egrep 'sd.*RAID' /var/run/dmesg.boot | awk '{ print $1 }' | tail -1)
         raid_status=$(bioctl $raid_device | grep softraid | awk '{ print $3 }')
         if [ $raid_status != "Online" ]; then
             failed "IS_RAIDOK" "One of the RAID disk members is faulty. Use bioctl -h $raid_device for more informations"

From 04139f3d6045cf9d20325a1c05cb36c5fe93ecdf Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Thu, 22 Oct 2020 18:16:52 +0200
Subject: [PATCH 78/96] Add check_openvpncronlog and update CHANGELOG

A cron is needed to rotate logs, because a restart of OpenVPN would be needed
with the use of newsyslog to rotate logs
---
 CHANGELOG   | 11 +++++++++++
 evocheck.sh |  9 ++++++++-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 8a1c700..6c807e1 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.7.7] - 2020-10-22
+
+### Added
+
+- Add check_openvpncronlog : a cron is needed to rotate logs, because a restart of OpenVPN would be needed with the use of newsyslog to rotate logs
+
+### Fixed
+
+- Fix check_uptodate : properly check that syspatch exists
+- Fix check_raidok : the same device could be displayed multiple times
+
 ## [6.7.6] - 2020-10-15
 
 ### Added
diff --git a/evocheck.sh b/evocheck.sh
index b6c687e..73a7ef7 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,7 +3,7 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
-readonly VERSION="6.7.6"
+readonly VERSION="6.7.7"
 
 # Disable LANG*
 
@@ -347,6 +347,12 @@ check_ntp(){
     fi
 }
 
+check_openvpncronlog(){
+    if /etc/rc.d/openvpn check > /dev/null 2>&1; then
+        grep -q 'cp /var/log/openvpn.log /var/log/openvpn.log.$(date +\\%F) && echo "$(date +\\%F. .\\%R) - logfile turned over via cron" > /var/log/openvpn.log && gzip /var/log/openvpn.log.$(date +\\%F) && find /var/log/ -type f -name "openvpn.log.\*" -mtime .365 -exec rm {} \\+' /var/cron/tabs/root || failed "IS_OPENVPNCRONLOG" "OpenVPN is enabled but there is no log rotation in the root crontab, or the cron is not up to date (OpenVPN log rotation in newsyslog is not used because a restart is needed)."
+    fi
+}
+
 
 main() {
     # Default return code : 0 = no error
@@ -387,6 +393,7 @@ main() {
     test "${IS_SYNC:=1}" = 1 && check_sync
     test "${IS_DEFAULTROUTE:=1}" = 1 && check_defaultroute
     test "${IS_NTP:=1}" = 1 && check_ntp
+    test "${IS_OPENVPNCRONLOG:=1}" = 1 && check_openvpncronlog
 
     exit ${RC}
 }

From e21628fea78dfbb7601cfff2863314647f24a61d Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Fri, 23 Oct 2020 17:32:15 +0200
Subject: [PATCH 79/96] Fix check_noatime : do not take into account commented
 entry in fstab

---
 evocheck.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index 73a7ef7..e77b112 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -108,7 +108,7 @@ check_softdep(){
 }
 
 check_noatime(){
-    if [ $(mount | grep -c noatime) -ne $(grep -c ffs /etc/fstab) ]; then
+    if [ $(mount | grep -c noatime) -ne $(grep ffs /etc/fstab | grep -vc ^\#) ]; then
         failed "IS_NOATIME" "All partitions should be mounted with the noatime option"
     fi
 }

From 5bf2959aac8df2e90893fd46968af61599feff32 Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Fri, 23 Oct 2020 18:13:35 +0200
Subject: [PATCH 80/96] Update changelog and boost version number

---
 CHANGELOG | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index 6c807e1..7b8c009 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.8.0] - 2020-10-23
+
+### Fixed
+
+- Fix check_noatime : do not take into account commented entry in fstab
+
 ## [6.7.7] - 2020-10-22
 
 ### Added

From af259252be804b50e39eef47dd020fd2730f5a9a Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Fri, 16 Jul 2021 14:52:49 +0200
Subject: [PATCH 81/96] Add check_advskew and boot version

---
 CHANGELOG   |  6 ++++++
 evocheck.sh | 26 +++++++++++++++++++++++++-
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 7b8c009..45e462f 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.9.0] - 2021-07-16
+
+### Added
+
+- Add check_advskew : convention for CARP interfaces. CARP in master state must have advskew parameter between 1 and 50, CARP in backup state must have advskew parameter between 100 and 150, preventing a configuration error with the same value for master and backup
+
 ## [6.8.0] - 2020-10-23
 
 ### Fixed
diff --git a/evocheck.sh b/evocheck.sh
index e77b112..971a9ce 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,7 +3,7 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
-readonly VERSION="6.7.7"
+readonly VERSION="6.9.0"
 
 # Disable LANG*
 
@@ -353,6 +353,29 @@ check_openvpncronlog(){
     fi
 }
 
+check_advskew(){
+    if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
+        for carp in $(ifconfig carp | grep ^carp | awk '{print $1}' | tr -d ":"); do
+            ifconfig $carp | grep -q master
+            master=$?
+            ifconfig $carp | grep -q backup
+            backup=$?
+            advskew=$(ifconfig $carp | grep advbase | awk -F 'advskew' '{print $2}' | awk '{print $1}')
+            if [ "$master" -eq 0 ]; then
+                if [ $advskew -lt 1 ] || [ $advskew -gt 50 ]; then
+                    failed "IS_ADVSKEW" "Interface $carp is master : advskew must be between 1 and 50, and must remain lower than that of the backup - current value : $advskew"
+                fi
+            elif [ "$backup" -eq 0 ]; then
+                if [ $advskew -lt 100 ] || [ $advskew -gt 150 ]; then
+                    failed "IS_ADVSKEW" "Interface $carp is backup : advskew must be between 100 and 150, and must remain greater than that of the master - current value : $advskew"
+                fi
+            else
+                failed "IS_ADVSKEW" "Interface $carp is neither master nor backup. Check interface state."
+            fi
+        done
+    fi
+}
+
 
 main() {
     # Default return code : 0 = no error
@@ -394,6 +417,7 @@ main() {
     test "${IS_DEFAULTROUTE:=1}" = 1 && check_defaultroute
     test "${IS_NTP:=1}" = 1 && check_ntp
     test "${IS_OPENVPNCRONLOG:=1}" = 1 && check_openvpncronlog
+    test "${IS_ADVSKEW:=1}" = 1 && check_advskew
 
     exit ${RC}
 }

From 8a735ca4cabc504f4f371bd6cf079ec87149fcbf Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Fri, 23 Jul 2021 16:01:12 +0200
Subject: [PATCH 82/96] Renamed multiple CARP checks

Renamed check_advskew, check_preempt, check_advbase and their alert to add "carp" in them
---
 CHANGELOG   |  6 ++++++
 evocheck.sh | 26 +++++++++++++-------------
 2 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 45e462f..372840a 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.9.1] - 2021-07-23
+
+### Changed
+
+- Renamed check_advskew, check_preempt, check_advbase and their alert to add "carp" in them
+
 ## [6.9.0] - 2021-07-16
 
 ### Added
diff --git a/evocheck.sh b/evocheck.sh
index 971a9ce..78a41ce 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,7 +3,7 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
-readonly VERSION="6.9.0"
+readonly VERSION="6.9.1"
 
 # Disable LANG*
 
@@ -176,7 +176,7 @@ check_gitperms(){
     test -d /etc/.git && [ "$(stat -f %p /etc/.git/)" = "40700" ] || failed "IS_GITPERMS" "The directiry /etc/.git sould be in 700"
 }
 
-check_advbase(){
+check_carpadvbase(){
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
         bad_advbase=0
         for advbase in $(ifconfig carp | grep advbase | awk -F 'advbase' '{print $2}' | awk '{print $1}' | xargs); do
@@ -185,21 +185,21 @@ check_advbase(){
         fi
         done
         if [[ "$bad_advbase" -eq 1 ]]; then
-            failed "IS_ADVBASE" "At least one CARP interface has advbase greater than 5 seconds!"
+            failed "IS_CARPADVBASE" "At least one CARP interface has advbase greater than 5 seconds!"
         fi
     fi
 }
 
-check_preempt(){
+check_carppreempt(){
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
         preempt=$(sysctl net.inet.carp.preempt | cut -d"=" -f2)
         if [[ "$preempt" -ne 1 ]]; then
-            failed "IS_PREEMPT" "The preempt function is not activated! Please type 'sysctl net.inet.carp.preempt=1' in"
+            failed "IS_CARPPREEMPT" "The preempt function is not activated! Please type 'sysctl net.inet.carp.preempt=1' in"
         fi
         if [ -f /etc/sysctl.conf ]; then
             grep -qE "^net.inet.carp.preempt=1" /etc/sysctl.conf || failed "IS_PREEMPT" "The preempt parameter is not permanently activated! Please add 'net.inet.carp.preempt=1' in /etc/sysctl.conf"
         else
-        failed "IS_PREEMPT" "Make sure /etc/sysctl.conf exists and contains the line 'net.inet.carp.preempt=1'"
+        failed "IS_CARPPREEMPT" "Make sure /etc/sysctl.conf exists and contains the line 'net.inet.carp.preempt=1'"
         fi
     fi
 }
@@ -353,7 +353,7 @@ check_openvpncronlog(){
     fi
 }
 
-check_advskew(){
+check_carpadvskew(){
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
         for carp in $(ifconfig carp | grep ^carp | awk '{print $1}' | tr -d ":"); do
             ifconfig $carp | grep -q master
@@ -363,14 +363,14 @@ check_advskew(){
             advskew=$(ifconfig $carp | grep advbase | awk -F 'advskew' '{print $2}' | awk '{print $1}')
             if [ "$master" -eq 0 ]; then
                 if [ $advskew -lt 1 ] || [ $advskew -gt 50 ]; then
-                    failed "IS_ADVSKEW" "Interface $carp is master : advskew must be between 1 and 50, and must remain lower than that of the backup - current value : $advskew"
+                    failed "IS_CARPADVSKEW" "Interface $carp is master : advskew must be between 1 and 50, and must remain lower than that of the backup - current value : $advskew"
                 fi
             elif [ "$backup" -eq 0 ]; then
                 if [ $advskew -lt 100 ] || [ $advskew -gt 150 ]; then
-                    failed "IS_ADVSKEW" "Interface $carp is backup : advskew must be between 100 and 150, and must remain greater than that of the master - current value : $advskew"
+                    failed "IS_CARPADVSKEW" "Interface $carp is backup : advskew must be between 100 and 150, and must remain greater than that of the master - current value : $advskew"
                 fi
             else
-                failed "IS_ADVSKEW" "Interface $carp is neither master nor backup. Check interface state."
+                failed "IS_CARPADVSKEW" "Interface $carp is neither master nor backup. Check interface state."
             fi
         done
     fi
@@ -392,8 +392,8 @@ main() {
     test "${IS_UPTIME:=1}" = 1 && check_uptime
     test "${IS_BACKUPUPTODATE:=1}" = 1 && check_backupuptodate
     test "${IS_GITPERMS:=1}" = 1 && check_gitperms
-    test "${IS_ADVBASE:=1}" = 1 && check_advbase
-    test "${IS_PREEMPT:=1}" = 1 && check_preempt
+    test "${IS_CARPADVBASE:=1}" = 1 && check_carpadvbase
+    test "${IS_CARPPREEMPT:=1}" = 1 && check_carppreempt
     test "${IS_REBOOTMAIL:=1}" = 1 && check_rebootmail
     test "${IS_PFENABLED:=1}" = 1 && check_pfenabled
     test "${IS_PFCUSTOM:=1}" = 1 && check_pfcustom
@@ -417,7 +417,7 @@ main() {
     test "${IS_DEFAULTROUTE:=1}" = 1 && check_defaultroute
     test "${IS_NTP:=1}" = 1 && check_ntp
     test "${IS_OPENVPNCRONLOG:=1}" = 1 && check_openvpncronlog
-    test "${IS_ADVSKEW:=1}" = 1 && check_advskew
+    test "${IS_CARPADVSKEW:=1}" = 1 && check_carpadvskew
 
     exit ${RC}
 }

From e0202f28ffaf22e69aa4f4f34710d64eaf467943 Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Fri, 23 Jul 2021 16:21:32 +0200
Subject: [PATCH 83/96] Fix IS_PREEMPT remaining

---
 evocheck.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/evocheck.sh b/evocheck.sh
index 78a41ce..f0800d5 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -197,7 +197,7 @@ check_carppreempt(){
             failed "IS_CARPPREEMPT" "The preempt function is not activated! Please type 'sysctl net.inet.carp.preempt=1' in"
         fi
         if [ -f /etc/sysctl.conf ]; then
-            grep -qE "^net.inet.carp.preempt=1" /etc/sysctl.conf || failed "IS_PREEMPT" "The preempt parameter is not permanently activated! Please add 'net.inet.carp.preempt=1' in /etc/sysctl.conf"
+            grep -qE "^net.inet.carp.preempt=1" /etc/sysctl.conf || failed "IS_CARPPREEMPT" "The preempt parameter is not permanently activated! Please add 'net.inet.carp.preempt=1' in /etc/sysctl.conf"
         else
         failed "IS_CARPPREEMPT" "Make sure /etc/sysctl.conf exists and contains the line 'net.inet.carp.preempt=1'"
         fi

From f1c63f827ff3b223c32c8d97e0199fa2b157cb2c Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Fri, 17 Sep 2021 17:15:19 +0200
Subject: [PATCH 84/96] Fixed check_tmoutprofile and changed version numbering

---
 CHANGELOG   | 10 ++++++++++
 evocheck.sh |  8 ++++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 372840a..cf4955b 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [21.09] - 2021-09-17
+
+### Changed
+
+- Changed version numbering to use year.month and be capable to know the age of the script
+
+### Fixed
+
+- Fixed check_tmoutprofile : Add "if" to check if file exists
+
 ## [6.9.1] - 2021-07-23
 
 ### Changed
diff --git a/evocheck.sh b/evocheck.sh
index f0800d5..a0853d1 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,7 +3,7 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
-readonly VERSION="6.9.1"
+readonly VERSION="21.09"
 
 # Disable LANG*
 
@@ -114,7 +114,11 @@ check_noatime(){
 }
 
 check_tmoutprofile(){
-    grep -q TMOUT= /etc/skel/.profile /root/.profile || failed "IS_TMOUTPROFILE" "In order to fix, add 'export TMOUT=36000' to both /etc/skel/.profile and /root/.profile files"
+    if [ -f /etc/skel/.profile ]
+        grep -q TMOUT= /etc/skel/.profile /root/.profile || failed "IS_TMOUTPROFILE" "In order to fix, add 'export TMOUT=36000' to both /etc/skel/.profile and /root/.profile files"
+    else
+        failed "IS_TMOUTPROFILE" "File /etc/skel/.profile does not exist. Both /etc/skel/.profile and /root/.profile should contain at least 'export TMOUT=36000'"
+    fi
 }
 
 check_raidok(){

From 11d77659a08634c604432814b256c6dac7efbc06 Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Thu, 7 Oct 2021 15:01:48 +0200
Subject: [PATCH 85/96] Fixed check_tmoutprofile : syntax error on if/else/fi
 test

---
 CHANGELOG   | 6 ++++++
 evocheck.sh | 4 ++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index cf4955b..2b8702d 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [21.10] - 2021-10-07
+
+### Fixed
+
+- Fixed check_tmoutprofile : syntax error on if/else/fi test
+
 ## [21.09] - 2021-09-17
 
 ### Changed
diff --git a/evocheck.sh b/evocheck.sh
index a0853d1..2e578e1 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,7 +3,7 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
-readonly VERSION="21.09"
+readonly VERSION="21.10"
 
 # Disable LANG*
 
@@ -114,7 +114,7 @@ check_noatime(){
 }
 
 check_tmoutprofile(){
-    if [ -f /etc/skel/.profile ]
+    if [ -f /etc/skel/.profile ]; then
         grep -q TMOUT= /etc/skel/.profile /root/.profile || failed "IS_TMOUTPROFILE" "In order to fix, add 'export TMOUT=36000' to both /etc/skel/.profile and /root/.profile files"
     else
         failed "IS_TMOUTPROFILE" "File /etc/skel/.profile does not exist. Both /etc/skel/.profile and /root/.profile should contain at least 'export TMOUT=36000'"

From 3fcab1eeb3ce98357e747b75499428962270b94d Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Thu, 10 Mar 2022 16:46:31 +0100
Subject: [PATCH 86/96] Many improvements and bump to version 22.03. See
 CHANGELOG

---
 CHANGELOG   |  31 +++++
 evocheck.sh | 391 ++++++++++++++++++++++++++++++++++------------------
 2 files changed, 288 insertions(+), 134 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 2b8702d..2068ca1 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [22.03] - 2022-03-10
+
+### Added
+
+- check_evomaintenanceconf : check existence and rights of evomaintenance conf file
+- Added check_nrpeopensmtpd to ensure that opensmtpd is used for mailq nrpe check
+- Added check_sshallowusers to ensure that AllowUsers or AllowGroups directive is present in sshd_config
+- Added check_evobackup_exclude_mount to ensure that NFS mounts are excluded from backup
+- Added check_etcgit to ensure that /etc is a git repository
+- Added check_evolinuxsudogroup to ensure that evolinux-sudo is properly configured in sudo if group exist
+- Added check_bind9munin to ensure that a plugin for bind is configured when munin is installed
+- Added check_evolix_user to ensure that evolix user does not exist
+- Added check_versions and its functions (download_versions, get_command, get_version, check_version, add_to_path) to ensure that custom scripts are up to date
+
+### Changed
+
+- Overall improvement of evocheck : reordering, splitting version and help options, adding comments, developping some functions so they are more comprehensible
+- Improved check_umasksudoers to have a more complete grep
+- Updated check_history to reflect the new HISTSIZE value
+- Renamed check_tmp1777 and check_root0700 respectively to check_tmp_1777 and check_root_0700
+- Improved check_tmp_1777, check_root_0700, check_usrsharescripts in the way the folders rights are checked
+
+### Fixed
+
+- Fixed check_uptime : it didn't work at all, and tried to get uptime in the wrong way
+- Fixed check_evomaintenanceusers : sudo is not used for the evomaintenance trap, doas is ; and users were not found the better way
+
+### Removed
+
+- Removed empty check_pfcustom
+
 ## [21.10] - 2021-10-07
 
 ### Fixed
diff --git a/evocheck.sh b/evocheck.sh
index 2e578e1..87f5488 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,67 +3,46 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
-readonly VERSION="21.10"
+readonly VERSION="22.03"
 
-# Disable LANG*
+# base functions
 
-export LANG=C
-export LANGUAGE=C
-
-
-# Default return code : 0 = no error
-RC=0
-
-# Verbose function
-verbose() {
-    msg="${1:-$(cat /dev/stdin)}"
-    [ "${VERBOSE}" -eq 1 ] && [ -n "${msg}" ] && echo "${msg}"
-}
-
-# Source configuration file
-test -f /etc/evocheck.cf && . /etc/evocheck.cf
-
-# Functions
-
-show_help() {
+show_version() {
     cat <<END
-NAME:
-   evocheck - a system configuration verification tool
+evocheck version ${VERSION}
 
-VERSION:
-   ${VERSION}
+Copyright 2009-2021 Evolix <info@evolix.fr>,
+                    Romain Dessort <rdessort@evolix.fr>,
+                    Benoit Série <bserie@evolix.fr>,
+                    Gregory Colpart <reg@evolix.fr>,
+                    Jérémy Lecour <jlecour@evolix.fr>,
+                    Tristan Pilat <tpilat@evolix.fr>,
+                    Victor Laborie <vlaborie@evolix.fr>,
+                    Jérémy Dubois <jdubois@evolix.fr>
+                    and others.
 
-DESCRIPTION:
-   A script that verifies Evolix conventions on OpenBSD servers
-
-AUTHORS:
-   Benoit Serie <bserie@evolix.fr>
-   Gregory Colpart <reg@evolix.fr>
-   Jeremy Dubois <jdubois@evolix.fr>
-   Jeremy Lecour <jlecour@evolix.fr>
-   Ludovic Poujol <lpoujol@evolix.fr>
-   Romain Dessort <rdessort@evolix.fr>
-   Tristan Pilat <tpilat@evolix.fr>
-   Victor Laborie <vlaborie@evolix.fr>
-
-USAGE: evocheck
-   or  evocheck --cron 
-   or  evocheck --quiet 
-   or  evocheck --verbose 
-
-OPTIONS:
-       --cron                  disable a few checks
-   -v, --verbose               increase verbosity of checks
-   -q, --quiet                 nothing is printed on stdout nor stderr
-   -h, --help, --version       print this message and exit
-
-COPYRIGHT:
-   evocheck comes with ABSOLUTELY NO WARRANTY. This is free software,
-   and you are welcome to redistribute it under certain conditions.
-   See the GNU General Public License v3.0 for details. 2009-2020
+evocheck comes with ABSOLUTELY NO WARRANTY.  This is free software,
+and you are welcome to redistribute it under certain conditions.
+See the GNU General Public License v3.0 for details.
 END
 }
+show_help() {
+    cat <<END
+evocheck is a script that verifies Evolix conventions on OpenBSD servers.
 
+Usage: evocheck
+  or   evocheck --cron
+  or   evocheck --quiet
+  or   evocheck --verbose
+
+Options
+     --cron                  disable a few checks
+ -v, --verbose               increase verbosity of checks
+ -q, --quiet                 nothing is printed on stdout nor stderr
+ -h, --help                  print this message and exit
+     --version               print version and exit
+END
+}
 is_installed(){
     for pkg in "$@"; do
 	pkg_info | grep -q $pkg || return 1
@@ -71,6 +50,7 @@ is_installed(){
 }
 
 # logging
+
 failed() {
     check_name=$1
     shift
@@ -86,41 +66,31 @@ failed() {
     fi
 }
 
-
-# If --cron is passed, ignore some checks.
-if [ "$1" = "--cron" ]; then
-    IS_KERNELUPTODATE=0
-    IS_UPTIME=0
-fi
+# check functions
 
 check_umasksudoers(){
-    grep -E -qr "umask=0077" /etc/sudoers* || failed "IS_UMASKSUDOERS" "sudoers must set umask to 0077"
+    grep -Rq "^Defaults.*umask=0077" /etc/sudoers* || failed "IS_UMASKSUDOERS" "sudoers must set umask to 0077"
 }
-
 check_tmpnoexec(){
     mount | grep "on /tmp" | grep -q noexec || failed "IS_TMPNOEXEC" "/tmp should be mounted with the noexec option"
 }
-
 check_softdep(){
     if [ $(grep -c softdep /etc/fstab) -ne $(grep -c ffs /etc/fstab) ]; then
         failed "IS_SOFTDEP" "All partitions should have the softdep option"
     fi
 }
-
 check_noatime(){
     if [ $(mount | grep -c noatime) -ne $(grep ffs /etc/fstab | grep -vc ^\#) ]; then
         failed "IS_NOATIME" "All partitions should be mounted with the noatime option"
     fi
 }
-
 check_tmoutprofile(){
     if [ -f /etc/skel/.profile ]; then
-        grep -q TMOUT= /etc/skel/.profile /root/.profile || failed "IS_TMOUTPROFILE" "In order to fix, add 'export TMOUT=36000' to both /etc/skel/.profile and /root/.profile files"
+        grep -q TMOUT= /etc/skel/.profile /root/.profile || failed "IS_TMOUTPROFILE" "Add 'export TMOUT=36000' to both /etc/skel/.profile and /root/.profile files"
     else
         failed "IS_TMOUTPROFILE" "File /etc/skel/.profile does not exist. Both /etc/skel/.profile and /root/.profile should contain at least 'export TMOUT=36000'"
     fi
 }
-
 check_raidok(){
     egrep 'sd.*RAID' /var/run/dmesg.boot 1> /dev/null 2>&1
     RESULT=$?
@@ -132,7 +102,6 @@ check_raidok(){
         fi
     fi
 }
-
 check_evobackup(){
     if [ -f /etc/daily.local ]; then
         grep -qE "^sh /usr/share/scripts/zzz_evobackup" /etc/daily.local || failed "IS_EVOBACKUP" "Make sure 'sh /usr/share/scripts/zzz_evobackup' is present and activated in /etc/daily.local"
@@ -140,7 +109,6 @@ check_evobackup(){
         failed "IS_EVOBACKUP" "Make sure /etc/daily.local exists and 'sh /usr/share/scripts/zzz_evobackup' is present and activated in /etc/daily.local"
     fi
 }
-
 check_uptodate(){
     if [ $(command -v syspatch) ]; then
         if syspatch -c | egrep "." 1> /dev/null 2>&1; then
@@ -148,13 +116,12 @@ check_uptodate(){
         fi
     fi
 }
-
 check_uptime(){
-    if [ $(uptime | cut -d" " -f 4) -gt 365 ]; then
-        failed "IS_UPTIME" "The server is running for more than a year!"
+    let "uptime = $(date +"%s") - $(sysctl -n kern.boottime)"
+    if [ "$uptime" -gt "$(( 2*365*24*60*60 ))" ]; then
+        failed "IS_UPTIME" "The server has an uptime of more than 2 years, reboot on new kernel advised"
     fi
 }
-
 check_backupuptodate(){
     backup_dir="/home/backup"
     if [ -d "${backup_dir}" ]; then
@@ -175,11 +142,14 @@ check_backupuptodate(){
         failed "IS_BACKUPUPTODATE" "${backup_dir}/ is missing"
     fi
 }
-
-check_gitperms(){
-    test -d /etc/.git && [ "$(stat -f %p /etc/.git/)" = "40700" ] || failed "IS_GITPERMS" "The directiry /etc/.git sould be in 700"
+check_gitperms() {
+    GIT_DIR="/etc/.git"
+    if test -d $GIT_DIR; then
+        expected="40700"
+        actual=$(stat -f "%p" $GIT_DIR)
+        [ "$expected" = "$actual" ] || failed "IS_GITPERMS" "$GIT_DIR must be 700"
+    fi
 }
-
 check_carpadvbase(){
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
         bad_advbase=0
@@ -193,7 +163,6 @@ check_carpadvbase(){
         fi
     fi
 }
-
 check_carppreempt(){
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
         preempt=$(sysctl net.inet.carp.preempt | cut -d"=" -f2)
@@ -207,7 +176,6 @@ check_carppreempt(){
         fi
     fi
 }
-
 check_rebootmail(){
     if [ -f /etc/rc.local ]; then
         grep -qE '^date \| mail -s "boot/reboot of' /etc/rc.local || failed "IS_REBOOTMAIL" "Make sure the line 'date | mail -s \"boot/reboot of \$hostname' is present in the /etc/rc.local file!"
@@ -215,111 +183,106 @@ check_rebootmail(){
         failed "IS_REBOOTMAIL" "Make sure /etc/rc.local exist and 'date | mail -s \"boot/reboot of \$hostname' is present!"
     fi
 }
-
 check_pfenabled(){
     if pfctl -si | grep Disabled 1> /dev/null 2>&1; then
         failed "IS_PFENABLED" "PF is disabled! Make sure pf=NO is absent from /etc/rc.conf.local and carefully run pfctl -e"
     fi
 }
-
-check_pfcustom(){
-}
-
 check_wheel(){
     if [ -f /etc/sudoers ]; then
         grep -qE "^%wheel.*$" /etc/sudoers || failed "IS_WHEEL" ""
     fi
 }
-
 check_pkgmirror(){
     grep -qE "^https://cdn\.openbsd\.org/pub/OpenBSD" /etc/installurl || failed "IS_PKGMIRROR" "Check whether the right repo is present in the /etc/installurl file"
 }
-
 check_history(){
     file=/root/.profile
-    grep -qE "^HISTFILE=\$HOME/.histfile" $file && grep -qE "^export HISTSIZE=10000" $file || failed "IS_HISTORY" "Make sure both 'HISTFILE=$HOME/.histfile' and 'export HISTSIZE=10000' are present in /root/.profile"
+    grep -qE "^HISTFILE=\$HOME/.histfile" $file && grep -qE "^export HISTSIZE=100000" $file || failed "IS_HISTORY" "Make sure both 'HISTFILE=$HOME/.histfile' and 'export HISTSIZE=100000' are present in /root/.profile"
 }
-
 check_vim(){
     if ! is_installed vim; then
         failed "IS_VIM" "vim is not installed! Please add with pkg_add vim"
     fi
 }
-
 check_ttyc0secure(){
     grep -Eqv "^ttyC0.*secure$" /etc/ttys || failed "IS_TTYC0SECURE" "First tty should be secured"
 }
-
 check_customsyslog(){
     grep -q EvoBSD /etc/newsyslog.conf || failed "IS_CUSTOMSYSLOG" ""
 }
-
 check_sudomaint(){
     file=/etc/sudoers
     grep -q "Cmnd_Alias MAINT = /usr/share/scripts/evomaintenance.sh" $file \
     && grep -q "%wheel ALL=NOPASSWD: MAINT" $file \
     || failed "IS_SUDOMAINT" ""
 }
-
 check_nrpe(){
     if ! is_installed monitoring-plugins || ! is_installed nrpe; then
         failed "IS_NRPE" "nrpe and/or monitoring-plugins are not installed! Please add with pkg_add nrpe monitoring-plugins"
     fi 
 }
-
 check_rsync(){
     if ! is_installed rsync; then
         failed "IS_RSYNC" "rsync is not installed! Please add with pkg_add rsync"
     fi
 }
-
 check_cronpath(){
     grep -q "/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/share/scripts" /var/cron/tabs/root || failed "IS_CRONPATH" ""
 }
-
-check_tmp1777(){
-    ls -ld /tmp | grep -q drwxrwxrwt || failed "IS_TMP_1777" ""
+check_tmp_1777(){
+    actual=$(stat -f "%p" /tmp)
+    expected="41777"
+    test "$expected" = "$actual" || failed "IS_TMP_1777" "/tmp must be 1777"
 }
-
-check_root0700(){
-    ls -ld /root | grep -q drwx------ || failed "IS_ROOT_0700" ""
+check_root_0700(){
+    actual=$(stat -f "%p" /root)
+    expected="40700"
+    test "$expected" = "$actual" || failed "IS_ROOT_0700" "/root must be 700"
 }
-
 check_usrsharescripts(){
-    ls -ld /usr/share/scripts | grep -q drwx------ || failed "IS_USRSHARESCRIPTS" ""
+    actual=$(stat -f "%p" /usr/share/scripts)
+    expected="40700"
+    test "$expected" = "$actual" || failed "IS_USRSHARESCRIPTS" "/usr/share/scripts must be 700"
 }
-
 check_sshpermitrootno() {
-    grep -qE ^PermitRoot /etc/ssh/sshd_config && ( grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config || failed "IS_SSHPERMITROOTNO" "" )
+    if grep -q "^PermitRoot" /etc/ssh/sshd_config; then
+        grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config \
+            || failed "IS_SSHPERMITROOTNO" "PermitRoot should be set at no"
+    fi
 }
-
 check_evomaintenanceusers(){
-    # Can be changed in evocheck.cf
-    homeDir=${homeDir:-/home}
-    sudoers="/etc/sudoers"
-    for i in $( (grep "^User_Alias *ADMIN" $sudoers | cut -d= -f2 | tr -d " "; grep ^sudo /etc/group |cut -d: -f 4) | tr "," "\n" |sort -u); do
-        grep -qs "^trap.*sudo.*evomaintenance.sh" ${homeDir}/${i}/.*profile
-        if [ $? != 0 ]; then
-            failed "IS_EVOMAINTENANCEUSERS" "$i doesn't have evomaintenance trap!"
+    users=$(getent group evolinux-sudo | cut -d':' -f4 | tr ',' ' ')
+    for user in $users; do
+        user_home=$(getent passwd "$user" | cut -d: -f6)
+        if [ -n "$user_home" ] && [ -d "$user_home" ]; then
+            if ! grep -qs "^trap.*doas.*evomaintenance.sh" "${user_home}"/.*profile; then
+                echo "IS_EVOMAINTENANCEUSERS" "${user} doesn't have an evomaintenance trap"
+                test "${VERBOSE}" = 1 || break
+            fi
         fi
-    done 
+    done
 }
-
 check_evomaintenanceconf(){
-    file=/etc/evomaintenance.cf
-    ( test -e $file \
-    && test $(stat -f %p $file) = "100600" \
-    && grep "^export PGPASSWORD" $file |grep -qv "your-passwd" \
-    && grep "^PGDB" $file |grep -qv "your-db" \
-    && grep "^PGTABLE" $file |grep -qv "your-table" \
-    && grep "^PGHOST" $file |grep -qv "your-pg-host" \
-    && grep "^FROM" $file |grep -qv "jdoe@example.com" \
-    && grep "^FULLFROM" $file |grep -qv "John Doe <jdoe@example.com>" \
-    && grep "^URGENCYFROM" $file |grep -qv "mama.doe@example.com" \
-    && grep "^URGENCYTEL" $file |grep -qv "06.00.00.00.00" \
-    && grep "^REALM" $file |grep -qv "example.com" ) || failed "IS_EVOMAINTENANCECONF" ""
-}
+    f=/etc/evomaintenance.cf
+    if [ -e "$f" ]; then
+        perms=$(stat -f "%p" $f)
+        test "$perms" = "100600" || echo "IS_EVOMAINTENANCECONF" "Wrong permissions on \`$f' ($perms instead of 100600)"
 
+        { grep "^export PGPASSWORD" $f | grep -qv "your-passwd" \
+            && grep "^PGDB" $f | grep -qv "your-db" \
+            && grep "^PGTABLE" $f | grep -qv "your-table" \
+            && grep "^PGHOST" $f | grep -qv "your-pg-host" \
+            && grep "^FROM" $f | grep -qv "jdoe@example.com" \
+            && grep "^FULLFROM" $f | grep -qv "John Doe <jdoe@example.com>" \
+            && grep "^URGENCYFROM" $f | grep -qv "mama.doe@example.com" \
+            && grep "^URGENCYTEL" $f | grep -qv "06.00.00.00.00" \
+            && grep "^REALM" $f | grep -qv "example.com"
+        } || echo "IS_EVOMAINTENANCECONF" "evomaintenance is not correctly configured"
+    else
+        echo "IS_EVOMAINTENANCECONF" "Configuration file \`$f' is missing"
+    fi
+}
 check_sync(){
     if ifconfig carp | grep carp 1> /dev/null 2>&1; then
         sync_script=/usr/share/scripts/sync.sh
@@ -328,7 +291,6 @@ check_sync(){
         fi
     fi
 }
-
 check_defaultroute(){
     if [ -f /etc/mygate ]; then
         file_route=$(cat /etc/mygate)
@@ -340,7 +302,6 @@ check_defaultroute(){
         failed "IS_DEFAULTROUTE" "The file /etc/mygate does not exist. Make sure you have the same default route in this file as the one currently in use."
     fi
 }
-
 check_ntp(){
     if grep -q "server ntp.evolix.net" /etc/ntpd.conf; then
         if [ $(wc -l /etc/ntpd.conf | awk '{print $1}') -ne 1 ]; then
@@ -350,13 +311,11 @@ check_ntp(){
         failed "IS_NTP" "The configuration in /etc/ntpd.conf is not compliant. It should contains \"server ntp.evolix.net\"."
     fi
 }
-
 check_openvpncronlog(){
     if /etc/rc.d/openvpn check > /dev/null 2>&1; then
         grep -q 'cp /var/log/openvpn.log /var/log/openvpn.log.$(date +\\%F) && echo "$(date +\\%F. .\\%R) - logfile turned over via cron" > /var/log/openvpn.log && gzip /var/log/openvpn.log.$(date +\\%F) && find /var/log/ -type f -name "openvpn.log.\*" -mtime .365 -exec rm {} \\+' /var/cron/tabs/root || failed "IS_OPENVPNCRONLOG" "OpenVPN is enabled but there is no log rotation in the root crontab, or the cron is not up to date (OpenVPN log rotation in newsyslog is not used because a restart is needed)."
     fi
 }
-
 check_carpadvskew(){
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
         for carp in $(ifconfig carp | grep ^carp | awk '{print $1}' | tr -d ":"); do
@@ -379,7 +338,152 @@ check_carpadvskew(){
         done
     fi
 }
+check_nrpeopensmtpd() {
+    grep -Rq "^command.*check_mailq.pl -M opensmtpd" /etc/nrpe.* || failed "IS_NRPE_OPENSMTPD" "NRPE \"check_mailq\" is not configured for opensmtpd."
+}
+check_sshallowusers() {
+    grep -E -qir "(AllowUsers|AllowGroups)" /etc/ssh/sshd_config || failed "IS_SSHALLOWUSERS" "Missing AllowUsers or AllowGroups directive in sshd_config"
+}
+check_evobackup_exclude_mount() {
+    excludes_file=$(mktemp)
+    trap "rm -f ${excludes_file}" 0
+    for evobackup_file in $(grep -Eo "/usr/share/scripts/zzz_evobackup.*" /etc/daily.local | grep -v "^#" | awk '{print $1}'); do
+        grep -- "--exclude " "${evobackup_file}" | grep -E -o "\"[^\"]+\"" | tr -d '"' > "${excludes_file}"
+        not_excluded=$(mount | grep "type nfs" | awk '{print $3}' | grep -v -f "${excludes_file}")
+        for mount in ${not_excluded}; do
+            failed "IS_EVOBACKUP_EXCLUDE_MOUNT" "${mount} is not excluded from ${evobackup_file} backup script"
+        done
+    done
+    rm -rf "${excludes_file}"
+}
+check_etcgit() {
+    export GIT_DIR="/etc/.git" GIT_WORK_TREE="/etc"
+    git rev-parse --is-inside-work-tree > /dev/null 2>&1 || failed "IS_ETCGIT" "/etc is not a git repository"
+}
+check_evolinuxsudogroup() {
+    if grep -q "^evolinux-sudo:" /etc/group; then
+        grep -qE "^%evolinux-sudo ALL ?= ?\(ALL\) SETENV: ALL" /etc/sudoers || failed "IS_EVOLINUXSUDOGROUP" "Missing evolinux-sudo directive in sudoers file"
+    fi
+}
+check_bind9munin() {
+    if is_installed isc-bind; then
+        { test -L /etc/munin/plugins/bind9 \
+            && test -e /etc/munin/plugin-conf.d/bind9;
+        } || failed "IS_BIND9MUNIN" "missing bind plugin for munin"
+    fi
+}
+check_evolix_user() {
+    grep -q -E "^evolix:" /etc/passwd && failed "IS_EVOLIX_USER" "evolix user should not exist"
+}
+download_versions() {
+    local file
+    file=${1:-}
 
+    ## The file is supposed to list programs : each on a line, then its latest version number
+    ## Examples:
+    # evoacme 21.06
+    # evomaintenance 0.6.4
+
+    versions_url="https://upgrades.evolix.org/versions-openbsd"
+
+    # fetch timeout, in seconds
+    timeout=10
+
+    if command -v curl > /dev/null; then
+        curl -k --max-time ${timeout} --fail --silent --output "${versions_file}" "${versions_url}"
+        # "-k" required until OpenBSD 6.8
+    elif command -v wget > /dev/null; then
+        wget --timeout=${timeout} --quiet "${versions_url}" -O "${versions_file}"
+    elif command -v GET; then
+        GET -t ${timeout}s "${versions_url}" > "${versions_file}"
+    else
+        failed "IS_VERSIONS_CHECK" "failed to find curl, wget or GET"
+    fi
+    test "$?" -eq 0 || failed "IS_VERSIONS_CHECK" "failed to download ${versions_url} to ${versions_file}"
+}
+get_command() {
+    local program
+    program=${1:-}
+
+    case "${program}" in
+        ## Special cases where the program name is different than the command name
+        evocheck) echo "${0}" ;;
+        evomaintenance) command -v "evomaintenance.sh" ;;
+        motd-carp-state) command -v "motd-carp-state.sh" ;;
+        
+        ## General case, where the program name is the same as the command name
+        *) command -v "${program}" ;;
+    esac
+}
+get_version() {
+    local program
+    local command
+    program=${1:-}
+    command=${2:-}
+
+    case "${program}" in
+        ## Special case if `command --version => 'command` is not the standard way to get the version
+        # my_command)
+        #    /path/to/my_command --get-version 
+        #    ;;
+
+        motd-carp-state)
+            grep '^VERSION=' "${command}" | head -1 | cut -d '=' -f 2
+            ;;
+        ## General case to get the version
+        *) ${command} --version 2> /dev/null | head -1 | cut -d ' ' -f 3 ;;
+    esac
+}
+check_version() {
+    local program
+    local expected_version
+    program=${1:-}
+    expected_version=${2:-}
+
+    command=$(get_command "${program}")
+    if [ -n "${command}" ]; then
+        actual_version=$(get_version "${program}" "${command}")
+        # printf "program:%s expected:%s actual:%s\n" "${program}" "${expected_version}" "${actual_version}"
+        if [ -z "${actual_version}" ]; then
+            failed "IS_VERSIONS_CHECK" "failed to lookup actual version of ${program}"
+        elif [ "${actual_version}" = "${expected_version}" ]; then
+            : # Version check OK ; to check first because of the way the check works
+        elif [ "$(echo ${actual_version}\\n${expected_version} | sort -V | head -n 1)" = "${actual_version}" ]; then
+            failed "IS_VERSIONS_CHECK" "${program} version ${actual_version} is older than expected version ${expected_version}"
+        elif [ "$(echo ${actual_version}\\n${expected_version} | sort -V | head -n 1)" = "${expected_version}" ]; then
+            failed "IS_VERSIONS_CHECK" "${program} version ${actual_version} is newer than expected version ${expected_version}, you should update your index."
+        fi
+    fi
+}
+add_to_path() {
+    local new_path
+    new_path=${1:-}
+
+    echo "$PATH" | grep -qF "${new_path}" || export PATH="${PATH}:${new_path}"
+}
+check_versions() {
+    versions_file=$(mktemp -p /tmp "evocheck-versions.XXXXXXXX")
+    trap "rm -f ${versions_file}" 0
+    download_versions "${versions_file}"
+    add_to_path "/usr/share/scripts"
+
+    grep -v '^ *#' < "${versions_file}" | while IFS= read -r line; do
+        local program
+        local version
+        program=$(echo "${line}" | cut -d ' ' -f 1)
+        version=$(echo "${line}" | cut -d ' ' -f 2)
+
+        if [ -n "${program}" ]; then
+            if [ -n "${version}" ]; then
+                check_version "${program}" "${version}"
+            else
+                failed "IS_VERSIONS_CHECK" "failed to lookup expected version for ${program}"
+            fi
+        fi
+    done
+
+    rm -f "${versions_file}"
+}
 
 main() {
     # Default return code : 0 = no error
@@ -400,7 +504,6 @@ main() {
     test "${IS_CARPPREEMPT:=1}" = 1 && check_carppreempt
     test "${IS_REBOOTMAIL:=1}" = 1 && check_rebootmail
     test "${IS_PFENABLED:=1}" = 1 && check_pfenabled
-    test "${IS_PFCUSTOM:=1}" = 1 && check_pfcustom
     test "${IS_WHEEL:=1}" = 1 && check_wheel
     test "${IS_PKGMIRROR:=1}" = 1 && check_pkgmirror
     test "${IS_HISTORY:=1}" = 1 && check_history
@@ -411,8 +514,8 @@ main() {
     test "${IS_NRPE:=1}" = 1 && check_nrpe
     test "${IS_RSYNC:=1}" = 1 && check_rsync
     test "${IS_CRONPATH:=1}" = 1 && check_cronpath
-    test "${IS_TMP_1777:=1}" = 1 && check_tmp1777
-    test "${IS_ROOT_0700:=1}" = 1 && check_root0700
+    test "${IS_TMP_1777:=1}" = 1 && check_tmp_1777
+    test "${IS_ROOT_0700:=1}" = 1 && check_root_0700
     test "${IS_USRSHARESCRIPTS:=1}" = 1 && check_usrsharescripts
     test "${IS_SSHPERMITROOTNO:=1}" = 1 && check_sshpermitrootno
     test "${IS_EVOMAINTENANCEUSERS:=1}" = 1 && check_evomaintenanceusers
@@ -422,17 +525,37 @@ main() {
     test "${IS_NTP:=1}" = 1 && check_ntp
     test "${IS_OPENVPNCRONLOG:=1}" = 1 && check_openvpncronlog
     test "${IS_CARPADVSKEW:=1}" = 1 && check_carpadvskew
+    test "${IS_NRPE_OPENSMTPD:=1}" = 1 && check_nrpeopensmtpd
+    test "${IS_SSHALLOWUSERS:=1}" = 1 && check_sshallowusers
+    test "${IS_EVOBACKUP_EXCLUDE_MOUNT:=1}" = 1 && check_evobackup_exclude_mount
+    test "${IS_ETCGIT:=1}" = 1 && check_etcgit
+    test "${IS_EVOLINUXSUDOGROUP:=1}" = 1 && check_evolinuxsudogroup
+    test "${IS_BIND9MUNIN:=1}" = 1 && check_bind9munin
+    test "${IS_EVOLIX_USER:=1}" = 1 && check_evolix_user
+    test "${IS_VERSIONS_CHECK:=1}" = 1 && check_versions
 
     exit ${RC}
 }
+
+# Disable LANG*
+export LANG=C
+export LANGUAGE=C
+
+# Source configuration file
+test -f /etc/evocheck.cf && . /etc/evocheck.cf
+
 # Parse options
 # based on https://gist.github.com/deshion/10d3cb5f88a21671e17a
 while :; do
     case $1 in
-        -h|-\?|--help|--version)
+        -h|-\?|--help)
             show_help
             exit 0
             ;;
+        --version)
+            show_version
+            exit 0
+            ;;
         --cron)
             IS_KERNELUPTODATE=0
             IS_UPTIME=0

From 12818913630f6a2f8d47f23440f4611e5f1e897c Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Wed, 13 Apr 2022 15:57:10 +0200
Subject: [PATCH 87/96] Added check_root_user: make sure that root user does
 not have a password

---
 CHANGELOG   | 28 +++++++++++++++++-----------
 evocheck.sh |  8 +++++++-
 2 files changed, 24 insertions(+), 12 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 2068ca1..b491151 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,11 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [22.04] - 2022-04-13
+
+### Added
+
+- Added check_root_user: make sure that root user does not have a password
+
 ## [22.03] - 2022-03-10
 
 ### Added
 
-- check_evomaintenanceconf : check existence and rights of evomaintenance conf file
+- check_evomaintenanceconf: check existence and rights of evomaintenance conf file
 - Added check_nrpeopensmtpd to ensure that opensmtpd is used for mailq nrpe check
 - Added check_sshallowusers to ensure that AllowUsers or AllowGroups directive is present in sshd_config
 - Added check_evobackup_exclude_mount to ensure that NFS mounts are excluded from backup
@@ -23,7 +29,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- Overall improvement of evocheck : reordering, splitting version and help options, adding comments, developping some functions so they are more comprehensible
+- Overall improvement of evocheck: reordering, splitting version and help options, adding comments, developping some functions so they are more comprehensible
 - Improved check_umasksudoers to have a more complete grep
 - Updated check_history to reflect the new HISTSIZE value
 - Renamed check_tmp1777 and check_root0700 respectively to check_tmp_1777 and check_root_0700
@@ -31,8 +37,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- Fixed check_uptime : it didn't work at all, and tried to get uptime in the wrong way
-- Fixed check_evomaintenanceusers : sudo is not used for the evomaintenance trap, doas is ; and users were not found the better way
+- Fixed check_uptime: it didn't work at all, and tried to get uptime in the wrong way
+- Fixed check_evomaintenanceusers: sudo is not used for the evomaintenance trap, doas is ; and users were not found the better way
 
 ### Removed
 
@@ -42,7 +48,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- Fixed check_tmoutprofile : syntax error on if/else/fi test
+- Fixed check_tmoutprofile: syntax error on if/else/fi test
 
 ## [21.09] - 2021-09-17
 
@@ -52,7 +58,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- Fixed check_tmoutprofile : Add "if" to check if file exists
+- Fixed check_tmoutprofile: Add "if" to check if file exists
 
 ## [6.9.1] - 2021-07-23
 
@@ -64,24 +70,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- Add check_advskew : convention for CARP interfaces. CARP in master state must have advskew parameter between 1 and 50, CARP in backup state must have advskew parameter between 100 and 150, preventing a configuration error with the same value for master and backup
+- Add check_advskew: convention for CARP interfaces. CARP in master state must have advskew parameter between 1 and 50, CARP in backup state must have advskew parameter between 100 and 150, preventing a configuration error with the same value for master and backup
 
 ## [6.8.0] - 2020-10-23
 
 ### Fixed
 
-- Fix check_noatime : do not take into account commented entry in fstab
+- Fix check_noatime: do not take into account commented entry in fstab
 
 ## [6.7.7] - 2020-10-22
 
 ### Added
 
-- Add check_openvpncronlog : a cron is needed to rotate logs, because a restart of OpenVPN would be needed with the use of newsyslog to rotate logs
+- Add check_openvpncronlog: a cron is needed to rotate logs, because a restart of OpenVPN would be needed with the use of newsyslog to rotate logs
 
 ### Fixed
 
-- Fix check_uptodate : properly check that syspatch exists
-- Fix check_raidok : the same device could be displayed multiple times
+- Fix check_uptodate: properly check that syspatch exists
+- Fix check_raidok: the same device could be displayed multiple times
 
 ## [6.7.6] - 2020-10-15
 
diff --git a/evocheck.sh b/evocheck.sh
index 87f5488..4c55c27 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,7 +3,7 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
-readonly VERSION="22.03"
+readonly VERSION="22.04"
 
 # base functions
 
@@ -484,6 +484,11 @@ check_versions() {
 
     rm -f "${versions_file}"
 }
+check_root_user() {
+    if [ "$(grep "^root:" /etc/master.passwd | awk -F":" '{print $2}')" != "*************" ]; then
+        failed "IS_ROOT_USER" "root user should not have a password ; replace the password field with 'vipw' for the root user with '*************' (exactly 13 asterisks) "
+    fi
+}
 
 main() {
     # Default return code : 0 = no error
@@ -533,6 +538,7 @@ main() {
     test "${IS_BIND9MUNIN:=1}" = 1 && check_bind9munin
     test "${IS_EVOLIX_USER:=1}" = 1 && check_evolix_user
     test "${IS_VERSIONS_CHECK:=1}" = 1 && check_versions
+    test "${IS_ROOT_USER:=1}" = 1 && check_root_user
 
     exit ${RC}
 }

From 8d460b039db5245f97a4ae0a66582f3589d8a715 Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Thu, 14 Apr 2022 09:52:32 +0200
Subject: [PATCH 88/96] check_versions: renamed "IS_VERSIONS_CHECK" to
 "IS_CHECK_VERSIONS" to match function name logic, and do not run check in
 cron mode

---
 evocheck.sh | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/evocheck.sh b/evocheck.sh
index 4c55c27..83037c0 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -397,9 +397,9 @@ download_versions() {
     elif command -v GET; then
         GET -t ${timeout}s "${versions_url}" > "${versions_file}"
     else
-        failed "IS_VERSIONS_CHECK" "failed to find curl, wget or GET"
+        failed "IS_CHECK_VERSIONS" "failed to find curl, wget or GET"
     fi
-    test "$?" -eq 0 || failed "IS_VERSIONS_CHECK" "failed to download ${versions_url} to ${versions_file}"
+    test "$?" -eq 0 || failed "IS_CHECK_VERSIONS" "failed to download ${versions_url} to ${versions_file}"
 }
 get_command() {
     local program
@@ -445,13 +445,13 @@ check_version() {
         actual_version=$(get_version "${program}" "${command}")
         # printf "program:%s expected:%s actual:%s\n" "${program}" "${expected_version}" "${actual_version}"
         if [ -z "${actual_version}" ]; then
-            failed "IS_VERSIONS_CHECK" "failed to lookup actual version of ${program}"
+            failed "IS_CHECK_VERSIONS" "failed to lookup actual version of ${program}"
         elif [ "${actual_version}" = "${expected_version}" ]; then
             : # Version check OK ; to check first because of the way the check works
         elif [ "$(echo ${actual_version}\\n${expected_version} | sort -V | head -n 1)" = "${actual_version}" ]; then
-            failed "IS_VERSIONS_CHECK" "${program} version ${actual_version} is older than expected version ${expected_version}"
+            failed "IS_CHECK_VERSIONS" "${program} version ${actual_version} is older than expected version ${expected_version}"
         elif [ "$(echo ${actual_version}\\n${expected_version} | sort -V | head -n 1)" = "${expected_version}" ]; then
-            failed "IS_VERSIONS_CHECK" "${program} version ${actual_version} is newer than expected version ${expected_version}, you should update your index."
+            failed "IS_CHECK_VERSIONS" "${program} version ${actual_version} is newer than expected version ${expected_version}, you should update your index."
         fi
     fi
 }
@@ -477,7 +477,7 @@ check_versions() {
             if [ -n "${version}" ]; then
                 check_version "${program}" "${version}"
             else
-                failed "IS_VERSIONS_CHECK" "failed to lookup expected version for ${program}"
+                failed "IS_CHECK_VERSIONS" "failed to lookup expected version for ${program}"
             fi
         fi
     done
@@ -537,7 +537,7 @@ main() {
     test "${IS_EVOLINUXSUDOGROUP:=1}" = 1 && check_evolinuxsudogroup
     test "${IS_BIND9MUNIN:=1}" = 1 && check_bind9munin
     test "${IS_EVOLIX_USER:=1}" = 1 && check_evolix_user
-    test "${IS_VERSIONS_CHECK:=1}" = 1 && check_versions
+    test "${IS_CHECK_VERSIONS:=1}" = 1 && check_versions
     test "${IS_ROOT_USER:=1}" = 1 && check_root_user
 
     exit ${RC}
@@ -565,6 +565,7 @@ while :; do
         --cron)
             IS_KERNELUPTODATE=0
             IS_UPTIME=0
+            IS_CHECK_VERSIONS=0
             ;;
         -v|--verbose)
             VERBOSE=1

From d35d7491f14667f74b295c7227331b1807af453b Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Thu, 16 Jun 2022 17:21:06 +0200
Subject: [PATCH 89/96] Fixed various shellcheck violations and added a
 function to cleanup files at once instead of using multiple trap rm

---
 CHANGELOG   |  5 ++++
 evocheck.sh | 85 +++++++++++++++++++++++++++++++++++++----------------
 2 files changed, 64 insertions(+), 26 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index b491151..4a37b19 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- Fixed various shellcheck violations
+- Added a function to cleanup files at once instead of using multiple trap rm
+
 ## [22.04] - 2022-04-13
 
 ### Added
diff --git a/evocheck.sh b/evocheck.sh
index 83037c0..c604497 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -45,7 +45,7 @@ END
 }
 is_installed(){
     for pkg in "$@"; do
-	pkg_info | grep -q $pkg || return 1
+        pkg_info | grep -q "$pkg" || return 1
     done
 }
 
@@ -75,12 +75,12 @@ check_tmpnoexec(){
     mount | grep "on /tmp" | grep -q noexec || failed "IS_TMPNOEXEC" "/tmp should be mounted with the noexec option"
 }
 check_softdep(){
-    if [ $(grep -c softdep /etc/fstab) -ne $(grep -c ffs /etc/fstab) ]; then
+    if [ "$(grep -c softdep /etc/fstab)" -ne "$(grep -c ffs /etc/fstab)" ]; then
         failed "IS_SOFTDEP" "All partitions should have the softdep option"
     fi
 }
 check_noatime(){
-    if [ $(mount | grep -c noatime) -ne $(grep ffs /etc/fstab | grep -vc ^\#) ]; then
+    if [ "$(mount | grep -c noatime)" -ne "$(grep ffs /etc/fstab | grep -vc ^\#)" ]; then
         failed "IS_NOATIME" "All partitions should be mounted with the noatime option"
     fi
 }
@@ -92,12 +92,12 @@ check_tmoutprofile(){
     fi
 }
 check_raidok(){
-    egrep 'sd.*RAID' /var/run/dmesg.boot 1> /dev/null 2>&1
+    grep -E 'sd.*RAID' /var/run/dmesg.boot 1> /dev/null 2>&1
     RESULT=$?
     if [ $RESULT -eq 0 ]; then
-        raid_device=$(egrep 'sd.*RAID' /var/run/dmesg.boot | awk '{ print $1 }' | tail -1)
-        raid_status=$(bioctl $raid_device | grep softraid | awk '{ print $3 }')
-        if [ $raid_status != "Online" ]; then
+        raid_device=$(grep -E 'sd.*RAID' /var/run/dmesg.boot | awk '{ print $1 }' | tail -1)
+        raid_status=$(bioctl "$raid_device" | grep softraid | awk '{ print $3 }')
+        if [ "$raid_status" != "Online" ]; then
             failed "IS_RAIDOK" "One of the RAID disk members is faulty. Use bioctl -h $raid_device for more informations"
         fi
     fi
@@ -110,14 +110,14 @@ check_evobackup(){
     fi
 }
 check_uptodate(){
-    if [ $(command -v syspatch) ]; then
-        if syspatch -c | egrep "." 1> /dev/null 2>&1; then
+    if [ "$(command -v syspatch)" ]; then
+        if syspatch -c | grep -E "." 1> /dev/null 2>&1; then
             failed "IS_UPTODATE" "Security update available! Update with syspatch(8)!"
         fi
     fi
 }
 check_uptime(){
-    let "uptime = $(date +"%s") - $(sysctl -n kern.boottime)"
+    uptime=$(($(date +"%s") - $(sysctl -n kern.boottime)))
     if [ "$uptime" -gt "$(( 2*365*24*60*60 ))" ]; then
         failed "IS_UPTIME" "The server has an uptime of more than 2 years, reboot on new kernel advised"
     fi
@@ -126,8 +126,8 @@ check_backupuptodate(){
     backup_dir="/home/backup"
     if [ -d "${backup_dir}" ]; then
         if [ -n "$(ls -A ${backup_dir})" ]; then
-            for file in ${backup_dir}/*; do
-                let "limit = $(date +"%s") - 172800"
+            for file in "${backup_dir}"/*; do
+                limit=$(($(date +"%s") - 172800))
                 updated_at=$(stat -f "%m" "$file")
 
                 if [ -f "$file" ] && [ "$limit" -gt "$updated_at" ]; then
@@ -154,11 +154,11 @@ check_carpadvbase(){
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
         bad_advbase=0
         for advbase in $(ifconfig carp | grep advbase | awk -F 'advbase' '{print $2}' | awk '{print $1}' | xargs); do
-        if [[ "$advbase" -gt 5 ]]; then
+        if [ "$advbase" -gt 5 ]; then
             bad_advbase=1
         fi
         done
-        if [[ "$bad_advbase" -eq 1 ]]; then
+        if [ "$bad_advbase" -eq 1 ]; then
             failed "IS_CARPADVBASE" "At least one CARP interface has advbase greater than 5 seconds!"
         fi
     fi
@@ -166,7 +166,7 @@ check_carpadvbase(){
 check_carppreempt(){
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
         preempt=$(sysctl net.inet.carp.preempt | cut -d"=" -f2)
-        if [[ "$preempt" -ne 1 ]]; then
+        if [ "$preempt" -ne 1 ]; then
             failed "IS_CARPPREEMPT" "The preempt function is not activated! Please type 'sysctl net.inet.carp.preempt=1' in"
         fi
         if [ -f /etc/sysctl.conf ]; then
@@ -198,6 +198,7 @@ check_pkgmirror(){
 }
 check_history(){
     file=/root/.profile
+    # shellcheck disable=SC2015
     grep -qE "^HISTFILE=\$HOME/.histfile" $file && grep -qE "^export HISTSIZE=100000" $file || failed "IS_HISTORY" "Make sure both 'HISTFILE=$HOME/.histfile' and 'export HISTSIZE=100000' are present in /root/.profile"
 }
 check_vim(){
@@ -213,6 +214,7 @@ check_customsyslog(){
 }
 check_sudomaint(){
     file=/etc/sudoers
+    # shellcheck disable=SC2015
     grep -q "Cmnd_Alias MAINT = /usr/share/scripts/evomaintenance.sh" $file \
     && grep -q "%wheel ALL=NOPASSWD: MAINT" $file \
     || failed "IS_SUDOMAINT" ""
@@ -304,7 +306,7 @@ check_defaultroute(){
 }
 check_ntp(){
     if grep -q "server ntp.evolix.net" /etc/ntpd.conf; then
-        if [ $(wc -l /etc/ntpd.conf | awk '{print $1}') -ne 1 ]; then
+        if [ "$(wc -l /etc/ntpd.conf | awk '{print $1}')" -ne 1 ]; then
             failed "IS_NTP" "The /etc/ntpd.conf file should only contains \"server ntp.evolix.net\"."
         fi
     else
@@ -313,23 +315,24 @@ check_ntp(){
 }
 check_openvpncronlog(){
     if /etc/rc.d/openvpn check > /dev/null 2>&1; then
+        # shellcheck disable=SC2016
         grep -q 'cp /var/log/openvpn.log /var/log/openvpn.log.$(date +\\%F) && echo "$(date +\\%F. .\\%R) - logfile turned over via cron" > /var/log/openvpn.log && gzip /var/log/openvpn.log.$(date +\\%F) && find /var/log/ -type f -name "openvpn.log.\*" -mtime .365 -exec rm {} \\+' /var/cron/tabs/root || failed "IS_OPENVPNCRONLOG" "OpenVPN is enabled but there is no log rotation in the root crontab, or the cron is not up to date (OpenVPN log rotation in newsyslog is not used because a restart is needed)."
     fi
 }
 check_carpadvskew(){
     if ls /etc/hostname.carp* 1> /dev/null 2>&1; then
         for carp in $(ifconfig carp | grep ^carp | awk '{print $1}' | tr -d ":"); do
-            ifconfig $carp | grep -q master
+            ifconfig "$carp" | grep -q master
             master=$?
-            ifconfig $carp | grep -q backup
+            ifconfig "$carp" | grep -q backup
             backup=$?
-            advskew=$(ifconfig $carp | grep advbase | awk -F 'advskew' '{print $2}' | awk '{print $1}')
+            advskew=$(ifconfig "$carp" | grep advbase | awk -F 'advskew' '{print $2}' | awk '{print $1}')
             if [ "$master" -eq 0 ]; then
-                if [ $advskew -lt 1 ] || [ $advskew -gt 50 ]; then
+                if [ "$advskew" -lt 1 ] || [ "$advskew" -gt 50 ]; then
                     failed "IS_CARPADVSKEW" "Interface $carp is master : advskew must be between 1 and 50, and must remain lower than that of the backup - current value : $advskew"
                 fi
             elif [ "$backup" -eq 0 ]; then
-                if [ $advskew -lt 100 ] || [ $advskew -gt 150 ]; then
+                if [ "$advskew" -lt 100 ] || [ "$advskew" -gt 150 ]; then
                     failed "IS_CARPADVSKEW" "Interface $carp is backup : advskew must be between 100 and 150, and must remain greater than that of the master - current value : $advskew"
                 fi
             else
@@ -346,7 +349,9 @@ check_sshallowusers() {
 }
 check_evobackup_exclude_mount() {
     excludes_file=$(mktemp)
-    trap "rm -f ${excludes_file}" 0
+    files_to_cleanup="${files_to_cleanup} ${excludes_file}"
+
+    # shellcheck disable=SC2013
     for evobackup_file in $(grep -Eo "/usr/share/scripts/zzz_evobackup.*" /etc/daily.local | grep -v "^#" | awk '{print $1}'); do
         grep -- "--exclude " "${evobackup_file}" | grep -E -o "\"[^\"]+\"" | tr -d '"' > "${excludes_file}"
         not_excluded=$(mount | grep "type nfs" | awk '{print $3}' | grep -v -f "${excludes_file}")
@@ -376,6 +381,7 @@ check_evolix_user() {
     grep -q -E "^evolix:" /etc/passwd && failed "IS_EVOLIX_USER" "evolix user should not exist"
 }
 download_versions() {
+    # shellcheck disable=SC2039
     local file
     file=${1:-}
 
@@ -402,6 +408,7 @@ download_versions() {
     test "$?" -eq 0 || failed "IS_CHECK_VERSIONS" "failed to download ${versions_url} to ${versions_file}"
 }
 get_command() {
+    # shellcheck disable=SC2039
     local program
     program=${1:-}
 
@@ -416,7 +423,9 @@ get_command() {
     esac
 }
 get_version() {
+    # shellcheck disable=SC2039
     local program
+    # shellcheck disable=SC2039
     local command
     program=${1:-}
     command=${2:-}
@@ -434,8 +443,20 @@ get_version() {
         *) ${command} --version 2> /dev/null | head -1 | cut -d ' ' -f 3 ;;
     esac
 }
+get_lower_version() {
+    # shellcheck disable=SC2039
+    local actual_version
+    # shellcheck disable=SC2039
+    local expected_version
+    actual_version=${1:-}
+    expected_version=${2:-}
+
+    printf "%s\n%s" "${actual_version}" "${expected_version}" | sort -V | head -n 1
+}
 check_version() {
+    # shellcheck disable=SC2039
     local program
+    # shellcheck disable=SC2039
     local expected_version
     program=${1:-}
     expected_version=${2:-}
@@ -448,14 +469,15 @@ check_version() {
             failed "IS_CHECK_VERSIONS" "failed to lookup actual version of ${program}"
         elif [ "${actual_version}" = "${expected_version}" ]; then
             : # Version check OK ; to check first because of the way the check works
-        elif [ "$(echo ${actual_version}\\n${expected_version} | sort -V | head -n 1)" = "${actual_version}" ]; then
+        elif [ "$(get_lower_version "${actual_version}" "${expected_version}")" = "${actual_version}" ]; then
             failed "IS_CHECK_VERSIONS" "${program} version ${actual_version} is older than expected version ${expected_version}"
-        elif [ "$(echo ${actual_version}\\n${expected_version} | sort -V | head -n 1)" = "${expected_version}" ]; then
+        elif [ "$(get_lower_version "${actual_version}" "${expected_version}")" = "${expected_version}" ]; then
             failed "IS_CHECK_VERSIONS" "${program} version ${actual_version} is newer than expected version ${expected_version}, you should update your index."
         fi
     fi
 }
 add_to_path() {
+    # shellcheck disable=SC2039
     local new_path
     new_path=${1:-}
 
@@ -463,12 +485,15 @@ add_to_path() {
 }
 check_versions() {
     versions_file=$(mktemp -p /tmp "evocheck-versions.XXXXXXXX")
-    trap "rm -f ${versions_file}" 0
+    files_to_cleanup="${files_to_cleanup} ${versions_file}"
+
     download_versions "${versions_file}"
     add_to_path "/usr/share/scripts"
 
     grep -v '^ *#' < "${versions_file}" | while IFS= read -r line; do
+        # shellcheck disable=SC2039
         local program
+        # shellcheck disable=SC2039
         local version
         program=$(echo "${line}" | cut -d ' ' -f 1)
         version=$(echo "${line}" | cut -d ' ' -f 2)
@@ -542,12 +567,20 @@ main() {
 
     exit ${RC}
 }
+cleanup_temp_files() {
+    # shellcheck disable=SC2086
+    rm -f ${files_to_cleanup}
+}
 
 # Disable LANG*
 export LANG=C
 export LANGUAGE=C
 
+files_to_cleanup=""
+trap cleanup_temp_files 0
+
 # Source configuration file
+# shellcheck disable=SC1091
 test -f /etc/evocheck.cf && . /etc/evocheck.cf
 
 # Parse options
@@ -563,7 +596,6 @@ while :; do
             exit 0
             ;;
         --cron)
-            IS_KERNELUPTODATE=0
             IS_UPTIME=0
             IS_CHECK_VERSIONS=0
             ;;
@@ -592,4 +624,5 @@ while :; do
     shift
 done
 
+# shellcheck disable=SC2086
 main ${ARGS}

From b8496e754d783db25170212129b14d7e84347593 Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Thu, 16 Jun 2022 17:22:11 +0200
Subject: [PATCH 90/96] Release 22.06

---
 CHANGELOG   | 2 ++
 evocheck.sh | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 4a37b19..33fac49 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [22.06] - 2022-06-16
+
 ### Changed
 
 - Fixed various shellcheck violations
diff --git a/evocheck.sh b/evocheck.sh
index c604497..5311074 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,7 +3,7 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
-readonly VERSION="22.04"
+readonly VERSION="22.06"
 
 # base functions
 

From 18c531325de439eeac09095dfa1e186ecae5165b Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Thu, 4 Aug 2022 15:27:04 +0200
Subject: [PATCH 91/96] Fixed check_sshpermitrootno to check real configuration

---
 CHANGELOG   | 4 ++++
 evocheck.sh | 5 ++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 33fac49..b54bc7f 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Fixed check_sshpermitrootno to check real configuration
+
 ## [22.06] - 2022-06-16
 
 ### Changed
diff --git a/evocheck.sh b/evocheck.sh
index 5311074..c3f78f1 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -248,9 +248,8 @@ check_usrsharescripts(){
     test "$expected" = "$actual" || failed "IS_USRSHARESCRIPTS" "/usr/share/scripts must be 700"
 }
 check_sshpermitrootno() {
-    if grep -q "^PermitRoot" /etc/ssh/sshd_config; then
-        grep -E -qi "PermitRoot.*no" /etc/ssh/sshd_config \
-            || failed "IS_SSHPERMITROOTNO" "PermitRoot should be set at no"
+    if ! (sshd -T -C addr=,user=,host=,laddr=,lport=0,rdomain= | grep -q 'permitrootlogin no'); then
+       failed "IS_SSHPERMITROOTNO" "PermitRoot should be set to no"
     fi
 }
 check_evomaintenanceusers(){

From 2e1d873fe1c1250ddb3be7e29bab3ad25043eb72 Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Thu, 4 Aug 2022 15:28:20 +0200
Subject: [PATCH 92/96] Release 22.08

---
 CHANGELOG   | 2 ++
 evocheck.sh | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index b54bc7f..56731ea 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [22.08] - 2022-08-04
+
 ### Fixed
 
 - Fixed check_sshpermitrootno to check real configuration
diff --git a/evocheck.sh b/evocheck.sh
index c3f78f1..02f3c4b 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -3,7 +3,7 @@
 # EvoCheck
 # Script to verify compliance of an OpenBSD server powered by Evolix
 
-readonly VERSION="22.06"
+readonly VERSION="22.08"
 
 # base functions
 

From 271e8623b45f51808f2342ca21a79f434365fcc6 Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Thu, 4 Aug 2022 16:09:30 +0200
Subject: [PATCH 93/96] check_evobackup_exclude_mount : skip if
 --one-file-system is used, and exclude scripts without Rsync command

---
 CHANGELOG   |  4 ++++
 evocheck.sh | 17 ++++++++++++-----
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 56731ea..0de3763 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- check_evobackup_exclude_mount : skip if --one-file-system is used, and exclude scripts without Rsync command
+
 ## [22.08] - 2022-08-04
 
 ### Fixed
diff --git a/evocheck.sh b/evocheck.sh
index 02f3c4b..1c37691 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -352,11 +352,18 @@ check_evobackup_exclude_mount() {
 
     # shellcheck disable=SC2013
     for evobackup_file in $(grep -Eo "/usr/share/scripts/zzz_evobackup.*" /etc/daily.local | grep -v "^#" | awk '{print $1}'); do
-        grep -- "--exclude " "${evobackup_file}" | grep -E -o "\"[^\"]+\"" | tr -d '"' > "${excludes_file}"
-        not_excluded=$(mount | grep "type nfs" | awk '{print $3}' | grep -v -f "${excludes_file}")
-        for mount in ${not_excluded}; do
-            failed "IS_EVOBACKUP_EXCLUDE_MOUNT" "${mount} is not excluded from ${evobackup_file} backup script"
-        done
+        # if the file seems to be a backup script, with an Rsync invocation
+        if grep -q "^\s*rsync" "${evobackup_file}"; then
+            # If rsync is not limited by "one-file-system"
+            # then we verify that every mount is excluded
+            if ! grep -q -- "^\s*--one-file-system" "${evobackup_file}"; then
+                grep -- "--exclude " "${evobackup_file}" | grep -E -o "\"[^\"]+\"" | tr -d '"' > "${excludes_file}"
+                not_excluded=$(findmnt --type nfs,nfs4,fuse.sshfs, -o target --noheadings | grep -v -f "${excludes_file}")
+                for mount in ${not_excluded}; do
+                    failed "IS_EVOBACKUP_EXCLUDE_MOUNT" "${mount} is not excluded from ${evobackup_file} backup script"
+                done
+            fi
+        fi
     done
     rm -rf "${excludes_file}"
 }

From f2f3155fc35c492fa413d452d8ce1d5c468fe1d9 Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Thu, 4 Aug 2022 16:35:29 +0200
Subject: [PATCH 94/96] check_backupuptodate: use find with --max-depth=1 to
 limit the number of evaluated files

---
 CHANGELOG   | 1 +
 evocheck.sh | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 0de3763..587ca20 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - check_evobackup_exclude_mount : skip if --one-file-system is used, and exclude scripts without Rsync command
+- check_backupuptodate: use find with --max-depth=1 to limit the number of evaluated files
 
 ## [22.08] - 2022-08-04
 
diff --git a/evocheck.sh b/evocheck.sh
index 1c37691..b5a8276 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -126,7 +126,7 @@ check_backupuptodate(){
     backup_dir="/home/backup"
     if [ -d "${backup_dir}" ]; then
         if [ -n "$(ls -A ${backup_dir})" ]; then
-            for file in "${backup_dir}"/*; do
+            find "${backup_dir}" -maxdepth 1 -type f | while read -r file; do
                 limit=$(($(date +"%s") - 172800))
                 updated_at=$(stat -f "%m" "$file")
 

From 3f88645c6fbb59c7d0d488149ba7c04ce1b57861 Mon Sep 17 00:00:00 2001
From: Jeremy Dubois <jdubois@evolix.fr>
Date: Thu, 4 Aug 2022 16:39:15 +0200
Subject: [PATCH 95/96] check_sshpermitrootno: do not display sshd errors

---
 CHANGELOG   | 3 ++-
 evocheck.sh | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 587ca20..18b79fb 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -9,8 +9,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- check_evobackup_exclude_mount : skip if --one-file-system is used, and exclude scripts without Rsync command
+- check_evobackup_exclude_mount: skip if --one-file-system is used, and exclude scripts without Rsync command
 - check_backupuptodate: use find with --max-depth=1 to limit the number of evaluated files
+- check_sshpermitrootno: do not display sshd errors
 
 ## [22.08] - 2022-08-04
 
diff --git a/evocheck.sh b/evocheck.sh
index b5a8276..ecbb262 100755
--- a/evocheck.sh
+++ b/evocheck.sh
@@ -248,7 +248,7 @@ check_usrsharescripts(){
     test "$expected" = "$actual" || failed "IS_USRSHARESCRIPTS" "/usr/share/scripts must be 700"
 }
 check_sshpermitrootno() {
-    if ! (sshd -T -C addr=,user=,host=,laddr=,lport=0,rdomain= | grep -q 'permitrootlogin no'); then
+    if ! (sshd -T -C addr=,user=,host=,laddr=,lport=0,rdomain= 2> /dev/null | grep -qi 'permitrootlogin no'); then
        failed "IS_SSHPERMITROOTNO" "PermitRoot should be set to no"
     fi
 }

From 043d1e58b1e1bb03355999c0f9a5a4bf6039c60e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Dubois?= <jdubois@evolix.fr>
Date: Tue, 30 Aug 2022 09:51:10 +0200
Subject: [PATCH 96/96] prepare linux/openbsd split

---
 README.md                                  | 70 ----------------------
 CHANGELOG => openbsd/CHANGELOG             |  0
 CONTRIBUTING.md => openbsd/CONTRIBUTING.md |  0
 LICENSE => openbsd/LICENSE                 |  0
 evocheck.cf => openbsd/evocheck.cf         |  0
 evocheck.sh => openbsd/evocheck.sh         |  0
 6 files changed, 70 deletions(-)
 delete mode 100644 README.md
 rename CHANGELOG => openbsd/CHANGELOG (100%)
 rename CONTRIBUTING.md => openbsd/CONTRIBUTING.md (100%)
 rename LICENSE => openbsd/LICENSE (100%)
 rename evocheck.cf => openbsd/evocheck.cf (100%)
 rename evocheck.sh => openbsd/evocheck.sh (100%)

diff --git a/README.md b/README.md
deleted file mode 100644
index ce87da5..0000000
--- a/README.md
+++ /dev/null
@@ -1,70 +0,0 @@
-# Evocheck
-
-It runs many compliance checks of the server with Evolix conventions.
-Non-compliance warnings are printed on standard output.
-
-It supports Debian and OpenBSD systems.
-
-Some checks can be disabled in the `/etc/evocheck.cf` config file.
-
-Tests can be run with Vagrant and the provided `VagrantFile`.
-
-## How to build the package for a new Debian release
-
-On the master branch, add the last stable version with a release tag.
-```
-git tag -s v<VERSION> -m 'New release'
-git push --tags
-```
-
-Checkout the branch debian, merge the master branch.
-
-```
-git checkout debian
-git merge master --no-ff
-dch -v <VERSION>-1
-gbp buildpackage --git-debian-branch=debian --git-upstream-tree=master --git-export-dir=/tmp/build-area --git-ignore-new
-```
-
-If the build is OK, you can now build the final package.
-
-```
-dch -D stretch -r
-gbp buildpackage --git-debian-branch=debian --git-upstream-tree=master --git-export-dir=/tmp/build-area --git-tag --git-sign --git-keyid=<KEY>
-```
-
-## Testing
-
-Evocheck can be tested with Vagrant, if you don't have installed it yet :
-
-~~~
-apt install vagrant vagrant-libvirt
-~~~
-
-You can now start your Vagrant machine and connect to it :
-
-~~~
-vagrant up
-vagrant ssh
-sudo -i
-~~~
-
-Evocheck can be run with :
-
-~~~
-/usr/share/scripts/evocheck.sh
-~~~
-
-### Deployment
-
-Launch **vagrant rsync-auto** in a terminal to automatically synchronise
-your local code with the Vagrant VM :
-
-~~~
-vagrant rsync-auto
-~~~
-
-## License
-
-This is an [Evolix](https://evolix.com) project and is licensed
-under the GPLv3, see the [LICENSE](LICENSE) file for details.
diff --git a/CHANGELOG b/openbsd/CHANGELOG
similarity index 100%
rename from CHANGELOG
rename to openbsd/CHANGELOG
diff --git a/CONTRIBUTING.md b/openbsd/CONTRIBUTING.md
similarity index 100%
rename from CONTRIBUTING.md
rename to openbsd/CONTRIBUTING.md
diff --git a/LICENSE b/openbsd/LICENSE
similarity index 100%
rename from LICENSE
rename to openbsd/LICENSE
diff --git a/evocheck.cf b/openbsd/evocheck.cf
similarity index 100%
rename from evocheck.cf
rename to openbsd/evocheck.cf
diff --git a/evocheck.sh b/openbsd/evocheck.sh
similarity index 100%
rename from evocheck.sh
rename to openbsd/evocheck.sh