1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
|
#!/bin/sh
################################################################################
# #
# Copyright (C) 2008-2014 LABBE Corentin <clabbe.montjoie@gmail.com>
#
# YASAT is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# YASAT is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with YASAT. If not, see <http://www.gnu.org/licenses/>.
# #
################################################################################
POSSIBLE_BIND_CONF="/etc/bind/named.conf"
BIND_CONF="/etc/bind/named.conf"
BIND_CONF_REP="/etc/bind/"
for LOCATION in ${POSSIBLE_BIND_CONF}
do
if [ -e "$SCAN_ROOT/${LOCATION}" ] ;then
BIND_CONF="$SCAN_ROOT/${LOCATION}"
fi
done
Title "Check dns and bind conf"
if [ ! -e "$BIND_CONF" ] ;then
TESTNAME='NSAG=3.14.1 CCEID=3578-2,4219-2 Disable DNS Server if Possible'
Compliance --result OK --plugin dns --nsag 3.14.1 --cce 3578-2 --cce 4219-2
return 1;
fi
TESTNAME='NSAG=3.14.1 CCEID=3578-2,4219-2 Disable DNS Server if Possible'
Compliance --result NOTTESTED --plugin dns --nsag 3.14.1 --cce 3578-2 --cce 4219-2
TESTNAME='YASAT_TODO_BIND NSAG=3.14.3.2 CCEID=3985-9,4487-5,4258-0 Run DNS Software in a chroot Jail'
Compliance --result NOTIMPL --plugin dns --nsag 3.14.3.2 --cce 3985-9 --cce 4487-5 --cce 4258-0
TESTNAME='YASAT_TODO_BIND NSAG=3.14.3.3 Configure Firewalls to Protect the DNS Server'
Compliance --result NOTIMPL --plugin dns --nsag 3.14.3.3
TESTNAME='YASAT_TODO_BIND NSAG=3.14.4.1 Run Separate DNS Servers for External and Internal Queries if Possible'
Compliance --result NOTIMPL --plugin dns --nsag 3.14.4.1
TESTNAME='YASAT_TODO_BIND NSAG=3.14.4.2 Use Views to Partition External and Internal Information if Necessary'
Compliance --result NOTIMPL --plugin dns --nsag 3.14.4.2
TESTNAME='YASAT_TODO_BIND NSAG=3.14.4.3 Disable Zone Transfers from the Nameserver if Possible'
Compliance --result NOTIMPL --plugin dns --nsag 3.14.4.3
TESTNAME='YASAT_TODO_BIND NSAG=3.14.4.4 Authenticate Zone Transfers if Necessary'
Compliance --result NOTIMPL --plugin dns --nsag 3.14.4.4
TESTNAME='YASAT_TODO_BIND NSAG=3.14.4.5 CCEID=4399-2 Disable Dynamic Updates if Possible'
Compliance --result NOTIMPL --plugin dns --nsag 3.14.4.5 --cce 4399-2
prepare_bind_conf $SCAN_ROOT/$BIND_CONF_REP
BIND_CONF_LOCATION_TO_TEST="${TEMPYASATDIR}/named.conf"
if [ ! -e "$BIND_CONF_LOCATION_TO_TEST" ] ;then
echo "Error no $BIND_CONF_LOCATION_TO_TEST"
return 1;
fi
#exemple is version none;
FindValueOf $BIND_CONF_LOCATION_TO_TEST version JUSTTEST
if [ -z "$RESULTAT" ] ;then
Display --indent 2 --text "Hiding version" --result NOTFOUND --color RED --advice BIND_HIDE_VERSION
else
if [ "$RESULTAT" = "none" ]
then
Display --indent 2 --text "Hiding version" --result FOUND --color GREEN
else
Display --indent 2 --text "Hiding version" --result "$RESULTAT" --color ORANGE --advice BIND_HIDE_VERSION
fi
fi
FindValueOf $BIND_CONF_LOCATION_TO_TEST hostname JUSTTEST
if [ -z "$RESULTAT" ] ;then
Display --indent 2 --text "Hiding hostname" --result NOTFOUND --color RED --advice BIND_HIDE_HOSTNAME
else
if [ "$RESULTAT" = "none" ]
then
Display --indent 2 --text "Hiding hostname" --result FOUND --color GREEN
else
Display --indent 2 --text "Hiding hostname" --result "$RESULTAT" --color ORANGE --advice BIND_HIDE_HOSTNAME
fi
fi
#server-id is none by default according to docs
FindValueOf $BIND_CONF_LOCATION_TO_TEST server-id JUSTTEST
if [ -z "$RESULTAT" ] ;then
Display --indent 2 --text "Hiding server-id" --result NOTFOUND --color GREEN
else
if [ "$RESULTAT" = "none" ]
then
Display --indent 2 --text "Hiding server-id" --result FOUND --color GREEN
else
Display --indent 2 --text "Hiding server-id" --result "$RESULTAT" --color ORANGE --advice BIND_HIDE_SERVERID
fi
fi
#max-cache-size xxx;
FindValueOf $BIND_CONF_LOCATION_TO_TEST max-cache-size JUSTTEST
if [ -z "$RESULTAT" ] ;then
Display --indent 2 --text "Set max-cache-size" --result NOTFOUND --color RED --advice BIND_MAX_CACHE_SIZE
else
Display --indent 2 --text "max-cache-size set at" --result "$RESULTAT" --color GREEN
fi
ALLOW_PUBLIC_RECURSION=1
FindValueOf $BIND_CONF_LOCATION_TO_TEST recursion JUSTTEST
if [ "$RESULTAT" = "no" ];then
Display --indent 2 --text "Restrict recursive query" --result FOUND --color GREEN
ALLOW_PUBLIC_RECURSION=0
fi
RECURSION=0
for i in `cat $BIND_CONF_LOCATION_TO_TEST`
do
if [ "$i" = "allow-recursion" ] ;then
RECURSION=1
ALLOW_PUBLIC_RECURSION=0
Display --indent 2 --text "Restrict recursive query" --result FOUND --color GREEN
fi
if [ "$i" = "};" ] ;then
RECURSION=0
fi
# if [ $RECURSION -eq 1 ]
# then
# echo $i
# fi
done
if [ $ALLOW_PUBLIC_RECURSION -eq 1 ] ; then
Display --indent 2 --text "Restrict recursive query" --result ERROR --color RED --advice BIND_DISALLOW_RECURSIVE_QUERY
fi
#allow-query-cache {mynetworks;};
#http://www.bortzmeyer.org/fermer-les-recursifs-ouverts.html
#additional-from-cache no.
#TODO dnssec-enable yes;
#TODO dnssec-validation yes;
Is_installed_via_package_manager $BIND_PACKAGE_NAME
if [ "$RESULTAT" = 'NOTIMPLEMENTED' -o "$RESULTAT" = 'ERROR' ] ; then
Display --indent 2 --text "$BIND_PACKAGE_NAME installation" --result UNKNOWN --color BLUE
else
if [ "$RESULTAT" = "yes" ]
then
Display --indent 2 --text "$BIND_PACKAGE_NAME is installed by package" --result GOOD --color GREEN
else
Display --indent 2 --text "$BIND_PACKAGE_NAME is installed at hand" --result BAD --color ORANGE --advice GLOBAL_PACKAGE_INSTALLED_AT_HAND
fi
fi
NAMED_USER='named' #default, under debian it is bind
NAMED_GROUP='named'
if [ -e /etc/default/bind9 ] ; then
NAMED_USER=`grep 'OPTIONS=' /etc/default/bind9 | cut -d\" -f2 |sed 's,.*-u,,g' | cut -d\ -f2`
NAMED_GROUP_ID="`grep ^${NAMED_USER}: /etc/passwd|cut -d\: -f4`"
if [ ! -z $NAMED_GROUP_ID ];then
NAMED_GROUP="`grep :${NAMED_GROUP_ID}: /etc/group | cut -d\: -f1`"
fi
fi
if [ -z "$NAMED_USER" ] ; then
NAMED_USER='named'
fi
if [ -z "$NAMED_GROUP" ] ; then
NAMED_USER='named'
fi
#check -u named
NAMED_PROCESS="`ps aux |grep /usr/sbin/named | grep -v grep`"
if [ -z "$NAMED_PROCESS" ] ; then
Display --indent 2 --text "No bind running, fallback to default named user" --result NOTFOUND --color BLUE
else
NAMED_USER="`echo $NAMED_PROCESS | sed 's/[[:space:]].*$//'`"
Display --indent 2 --text "bind running as $NAMED_USER:$NAMED_GROUP" --result FOUND --color BLUE
#TODO test if named_user is root
fi
#TMP_RESULT="${TEMPYASATDIR}/bind_etc.out"
#check_directory_owner /etc/bind/ $NAMED_USER $TMP_RESULT 2
#TODO check right of named.conf
#TODO check right of rndc.key
#bind.keys
check_a_file "${BIND_CONF_REP}/named.conf" 2 root $NAMED_GROUP 640
check_a_file "${BIND_CONF_REP}/rndc.key" 2 root $NAMED_GROUP 640
check_a_file "${BIND_CONF_REP}/bind.keys" 2 root $NAMED_GROUP 640
TMP_RESULT="${TEMPYASATDIR}/bind_var.out"
#check right of /var/bind/ of /var/named
#if [ -d /var/bind/ ] ; then
# check_directory_owner /var/bind/ $NAMED_USER $TMP_RESULT 4
#fi
return 0;
|
