1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
|
#!/bin/sh
#
# tiger - A UN*X security checking system
# Copyright (C) 1993 Douglas Lee Schales, David K. Hess, David R. Safford
#
# Please see the file `COPYING' for the complete copyright notice.
#
# check_anonftp - 06/14/93
#
# 04/28/93 dls Duh... added -L option to 'ls' when reading permission
# bits so that we don't get them off a symbolic link.
#
# 04/27/93 dls Added check for .rhosts file in ~ftp
#
#-----------------------------------------------------------------------------
#
TigerInstallDir='.'
#
# Set default base directory.
# Order or preference:
# -B option
# TIGERHOMEDIR environment variable
# TigerInstallDir installed location
#
basedir=${TIGERHOMEDIR:=$TigerInstallDir}
for parm
do
case $parm in
-B) basedir=$2; break;;
esac
done
#
# Verify that a config file exists there, and if it does
# source it.
#
[ ! -r $basedir/config ] && {
echo "--ERROR-- [init002e] No 'config' file in \`$basedir'."
exit 1
}
. $basedir/config
. $BASEDIR/initdefs
#
# If run in test mode (-t) this will verify that all required
# elements are set.
#
[ "$Tiger_TESTMODE" = 'Y' ] && {
haveallcmds LS CAT AWK RM GROUPC FIND SGREP GREP || exit 1
haveallfiles BASEDIR WORKDIR || exit 1
echo "--CONFIG-- [init003c] $0: Configuration ok..."
exit 0
}
#------------------------------------------------------------------------
echo
echo "# Performing check of anonymous FTP..."
haveallcmds CAT LS AWK SGREP GREP || exit 1
haveallfiles BASEDIR WORKDIR || exit 1
checkfiles()
{
level=$1
msgid=$2
rootcheck=$3
getpermit |
$SED -e "s%$ftphome%~ftp%" |
while read _f owner group ur uw ux gr gw gx or ow ox suid sgid stk
do
if [ "$_f" = "~ftp" ]; then
what='Anonymous FTP directory'
else
what="$_f"
fi
indirgrp=NO
for grp in $ftpgroups
do
[ "$grp" = "$group" ] && indirgrp=YES
done
if [ "$owner" != 'root' ]; then
if [ "$owner" = 'ftp' ]; then
if [ $uw = 1 ]; then
message $level ftp007$msgid "" "$what owned and writable by 'ftp'."
else
message $level ftp008$msgid "" "$what owned by 'ftp' (but not writable)."
fi
else
if [ \( $indirgrp = YES -a $gw = 1 \) -o $ow = 1 ]; then
message $level ftp007$msgid "" "$what is writable by 'ftp'."
elif [ "$rootcheck" = "Y" ]; then
message WARN ftp009w "" "$what not owned by 'root' (owner '$owner')."
fi
fi
else
[ \( $indirgrp = YES -a $gw = 1 \) -o $ow = 1 ] && {
message $level ftp010$msgid "" "$what is writable by 'ftp'."
}
fi
done
}
status=1
haveallcmds GETUSERHOME && {
ftphome=`$GETUSERHOME ftp`
status=$?
}
{
# TODO: this should be fixed to use the password sources (gen_passwd)
# instead of using the system's directly (might lead to false
# positives)
if $GREP '^ftp:' /etc/passwd && [ $status = 0 ]; then
if [ ! -d "$ftphome" ]; then
message WARN ftp006w "" "Anonymous FTP enabled, but directory does not exist."
elif [ ! -n "$ftphome" ]; then
message WARN ftp004w "" "Anonymous FTP directory is '' (null)"
elif [ "$ftphome" = "/" ]; then
message WARN ftp005f "" "Anonymous FTP directory is '/'"
else
ftpgroups=
haveallcmds GROUPC && ftpgroups=`$GROUPC ftp`
(
for file in "" /bin /dev /usr /usr/lib /usr/lib/ld.so /usr/lib/lib\* /.rhosts /.forward
do
echo ${ftphome}$file
done |
checkfiles FAIL f Y
haveallcmds FIND && {
(cd /;$FIND $ftphome -type d -print) |
checkfiles WARN w N
}
)
$SGREP '^[^:]*:[a-zA-Z0-9\./,]*:' $ftphome/etc/passwd && {
message WARN ftp003w "" '~ftp/etc/passwd contains accounts with passwords.'
}
[ -s $ftphome/.rhosts ] && {
message ALERT ftp002a "" '~ftp/.rhosts exists and is not empty:'
$CAT $ftphome/.rhosts
echo
}
fi
else
message INFO ftp001i "" 'Anonymous FTP not configured on this machine.'
fi
} |
$OUTPUTMETHOD
|
