#!/bin/sh

#################################################################################
#
#   Lynis
# ------------------
#
# Copyright 2007-2009, Michael Boelen (michael@rootkit.nl), The Netherlands
# Web site: http://www.rootkit.nl
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Logging and related files
#
#################################################################################
#
    LOGROTATE_CONFIG_FOUND=0
    SOLARIS_LOGHOST_FOUND=0
    SYSLOG_DAEMON_PRESENT=0
    SYSLOG_NG_DAEMON_PRESENT=0
#
#################################################################################
#

    InsertSection "Logging and files"

    # Test        : LOGG-2130
    # Description : Check for a running syslog daemon
    Register --test-no LOGG-2130 --weight L --network NO --description "Check for running syslog daemon"
    if [ ${SKIPTEST} -eq 0 ]; then
        logtext "Test: Searching for a logging daemon... "
        FIND=`${PSBINARY} ax | egrep "syslogd|syslog-ng|metalog" | grep -v "grep"`
        if [ "${FIND}" = "" ]; then
            Display --indent 2 --text "- Checking for a running syslog daemon..." --result WARNING --color RED
	    logtext "Result: Could not find a syslog daemon like syslog, syslog-ng, metalog"
	    ReportSuggestion ${TEST_NO} "Check if any syslog daemon is running and correctly configured."
	    ReportWarning ${TEST_NO} "H" "No syslog daemon found"
	  else
	    Display --indent 2 --text "- Checking for a running syslog daemon..." --result OK --color GREEN
	    logtext "Result: Found a logging daemon"
	    SYSLOG_DAEMON_PRESENT=1
	fi
    fi
#
#################################################################################
#
    # Test        : LOGG-2132
    # Description : Check for a running syslog-ng daemon
    Register --test-no LOGG-2132 --weight L --network NO --description "Check for running syslog-ng daemon"
    if [ ${SKIPTEST} -eq 0 ]; then
        logtext "Test: Searching for syslog-ngg daemon in process list... "
        FIND=`${PSBINARY} ax | grep "syslog-ng" | grep -v "grep"`
        if [ "${FIND}" = "" ]; then	
	    logtext "Result: Syslog-ng NOT found in process list"
	  else
	    logtext "Result: Found syslog-ng in process list"
	    SYSLOG_NG_DAEMON_PRESENT=1
	fi
    fi	  
#
#################################################################################
#
    # Test        : LOGG-2134
    # Description : Check for Syslog-NG configuration file consistency
    if [ ! -z "${SYSLOGNGBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no LOGG-2134 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking Syslog-NG configuration file consistency"
    if [ ${SKIPTEST} -eq 0 ]; then
	FIND=`${SYSLOGNGBINARY} -s; echo $?`
	if [ "${FIND}" = "0" ]; then
	    logtext "Result: Syslog-NG configuration file seems to be consistent"
	    Display --indent 2 --text "- Checking Syslog-NG consistency" --result OK --color GREEN
	  else
	    logtext "Result: Syslog-NG configuration file seems NOT to be consistent"
	    Display --indent 2 --text "- Checking Syslog-NG consistency" --result WARNING --color RED
	    ReportWarning ${TEST_NO} "L" "Found one or more problems in Syslog-NG configuration file"
	    ReportSuggestion ${TEST_NO} "Check the Syslog-NG configuration file and/or run a manual consistency check with: syslog-ng -s"
	fi
    fi
#
#################################################################################
#
    # Test        : LOGG-2138
    # Description : Check for klogd presence on Linux systems
    Register --test-no LOGG-2138 --os Linux --weight L --network NO --description "Checking kernel logger daemon on Linux"
    if [ ${SKIPTEST} -eq 0 ]; then
        # Search for klogd, but ignore other lines related to klogd (like dd with input/output file)
        FIND=`${PSBINARY} ax | grep "klogd" | grep -v "dd" | grep -v "grep"`    
        if [ ! "${FIND}" = "" ]; then	
	    logtext "Result: klogd running"
	    Display --indent 2 --text "- Checking klogd" --result OK --color GREEN
	  else
	    logtext "Result: No klogd found"
	    if [ ${SYSLOG_NG_DAEMON_PRESENT} -eq 1 ]; then
	        logtext "Result: syslog-ng is running and most likely logs kernel messages instead of klogd"
		Display --indent 2 --text "- Checking klogd" --result OK --color GREEN
	      else
	        # Syslog-ng is not running, nor klogd
	        Display --indent 2 --text "- Checking Syslog-NG consistency" --result WARNING --color RED
		ReportWarning ${TEST_NO} "L" "klogd is not running, which could lead to missing kernel messages in log files"
	        ReportSuggestion ${TEST_NO} "Check why klogd is not running"
	    fi
	fi
    fi
#
#################################################################################
#
    # Test        : LOGG-2142
    # Description : Check for minilogd presence on Linux systems
    Register --test-no LOGG-2142 --os Linux --weight L --network NO --description "Checking minilog daemon"
    if [ ${SKIPTEST} -eq 0 ]; then
	logtext "Result: Checking for unkilled minilogd instances.."
        # Search for minilogd. It shouldn't be running normally, if another syslog daemon is started
        FIND=`${PSBINARY} ax | grep "minilogd" | grep -v "grep"`    
        if [ "${FIND}" = "" ]; then	
	    Display --indent 2 --text "- Checking minilogd instances" --result OK --color GREEN
	    logtext "Result: No minilogd is running.."
	  else
	    Display --indent 2 --text "- Checking minilogd instances" --result WARNING --color RED
	    logtext "Result: minilogd found in process list"
	    # minilogd daemon seems to be running..
	    ReportWarning ${TEST_NO} "L" "minilogd is running, which should normally not be running"
	    ReportSuggestion ${TEST_NO} "Check minilogd is active and if other syslog daemons are started up properly"	    
	fi
    fi
#
#################################################################################
#
    # Test        : LOGG-2146
    # Description : Check for logrotate (/etc/logrotate.conf and logrotate.d)
    Register --test-no LOGG-2146 --weight L --os Linux --network NO --description "Checking logrotate.conf and logrotate.d"
    if [ ${SKIPTEST} -eq 0 ]; then
	logtext "Result: Checking for /etc/logrotate.conf"
	if [ -f /etc/logrotate.conf ]; then
	    LOGROTATE_CONFIG_FOUND=1
	    logtext "Result: /etc/logrotate.conf found (file)"
	  else
	    logtext "Result: /etc/logrotate.conf NOT found"
	fi  
	logtext "Result: Checking for /etc/logrotate.d (directory)"
	if [ -d /etc/logrotate.d ]; then
	    LOGROTATE_CONFIG_FOUND=1
	    logtext "Result: /etc/logrotate.d found"
	  else
	    logtext "Result: /etc/logrotate.conf found"
	fi
        if [ ${LOGROTATE_CONFIG_FOUND} -eq 1 ]; then
	    Display --indent 2 --text "- Checking logrotate presence" --result OK --color GREEN
	    logtext "Result: logrotate configuration found"
	  else
	    Display --indent 2 --text "- Checking logrotate presence" --result WARNING --color RED
	    logtext "Result: No logrotate configuration found"
	    ReportWarning ${TEST_NO} "L" "No logrotate configuration has been found"
	    ReportSuggestion ${TEST_NO} "Check if files are properly rotated by a some tool instead of logrotate"
	fi
    fi
#
#################################################################################
#
    # Test        : LOGG-2148
    # Description : Checking log files rotated with logrotate
    Register --test-no LOGG-2148 --weight L --os Solaris --network NO --description "Checking logrotated files"
    if [ ${SKIPTEST} -eq 0 ]; then
	logtext "Test: Checking which files are rotated with logrotate and if they exist"
	FIND=`logrotate -d -v /etc/logrotate.conf 2>&1 | egrep "considering log|skipping" | grep -v '*' | awk '{ if ($2!="log") { print "File:"$2":does_not_exist" } else { print "File:"$3":exists" } }'`
	if [ "${FIND}" = "" ]; then
	    logtext "Result: nothing found"
	  else
	    logtext "Result: found one or more files which are rotated via logrotate"
	    for I in ${FIND}; do
	      logtext "Output: ${I}"
	    done
	fi
    fi        
#
#################################################################################
#
    # Test        : LOGG-2152
    # Description : Check for Solaris 'loghost' entry in /etc/inet/hosts, or
    #               succesful resolving via DNS or any other name service.
    Register --test-no LOGG-2152 --weight L --os Solaris --network NO --description "Checking loghost"
    if [ ${SKIPTEST} -eq 0 ]; then
	# Try local hosts file
	logtext "Result: Checking for loghost in /etc/inet/hosts"
	FIND=`grep loghost /etc/inet/hosts`
	if [ ! "${FIND}" = "" ]; then
	    SOLARIS_LOGHOST_FOUND=1
	    logtext "Result: Found loghost entry in /etc/inet/hosts"
	  else
	    logtext "Result: No loghost entry found in /etc/inet/hosts"

	    # Try name resolving if no entry is present in local host file
	    logtext "Result: Checking for loghost via name resolving"	
	    FIND=`getent hosts loghost | grep loghost`
	    if [ ! "${FIND}" = "" ]; then
		SOLARIS_LOGHOST_FOUND=1
	        logtext "Result: name resolving was succesful"
	        logtext "Output: ${FIND}"
    	      else
		logtext "Result: name resolving didn't find results"
	    fi
	fi  
	
        if [ ${SOLARIS_LOGHOST_FOUND} -eq 1 ]; then
	    Display --indent 2 --text "- Checking loghost entry" --result OK --color GREEN
	    logtext "Result: loghost entry found and most likely used to send syslog messages"
	  else
	    Display --indent 2 --text "- Checking loghost entry" --result WARNING --color RED
	    logtext "Result: No loghost entry found"
	    ReportWarning ${TEST_NO} "L" "No loghost entry found"
	    ReportSuggestion ${TEST_NO} "Add a loghost entry to /etc/inet/hosts or other name services"
	fi
    fi
#
#################################################################################
#
    # Test        : LOGG-2156
    # Description : Check to see if remote logging is enabled
    #    SYSLOG_FILES="/etc/syslog.conf /etc/syslog-ng/syslog-ng.conf"
    #    FIND=`grep '@' $I | grep -v '^#'`
#
#################################################################################
#
    # Test        : LOGG-2160
    # Description : Check for /etc/newsyslog.conf (FreeBSD/OpenBSD)
    if [ -f /etc/newsyslog.conf ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no LOGG-2160 --preqs-met ${PREQS_MET} --weight L --network NO --description "Checking /etc/newsyslog.conf"
    if [ ${SKIPTEST} -eq 0 ]; then
        logtext "Result: /etc/newsyslog.conf found"
	Display --indent 2 --text "- Checking /etc/newsyslog.conf" --result FOUND --color GREEN	
	# YYY check files in /etc/newsyslog.conf
    fi
#
#################################################################################
#

wait_for_keypress

#
#================================================================================
# Lynis - Copyright 2007-2009, Michael Boelen - www.rootkit.nl - The Netherlands
