jcoffey-dev
e8c0a73dba
set -euo pipefail across all four, but added deliberately rather than pasted in -- each script needed the places where a non-zero exit is normal handled first, or strict mode would have made them worse: - sys_monitor / process_monitor: `ps | head -n 6` is a latent SIGPIPE. head closes the pipe after six lines, and on a host with enough processes ps fills the buffer and exits 141, which pipefail turns into a script abort -- on exactly the busy machine you wanted to inspect. Confirmed the mechanism (a large producer into head returns 141) and those pipelines now tolerate it. - security_audit: find exits non-zero when it cannot read a directory, which is routine when walking the whole filesystem. Without handling, set -e aborted the audit part way while still looking complete. Also notes that a clean report as non-root means little, since find cannot descend where it may not read. - network_info: iptables needs root, so the last section aborted the script for ordinary users. Now reports the failure, and falls back to nft where iptables is absent. process_monitor also no longer kills on sight. `pkill -x` by name can match several processes at once, and as root that is an easy way to take down more than intended. It now prints what it matched and asks, with FORCE=1 for unattended use and a refusal rather than a hang when there is no tty. All four run clean; the kill path was tested against a live process and left it alive.
53 lines
2.1 KiB
Bash
53 lines
2.1 KiB
Bash
#!/bin/bash
|
|
# security_audit.sh - Check for common security issues (permissions, open ports)
|
|
#
|
|
# Copyright (C) 2025 LINUXexpert.org
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify it
|
|
# under the terms of the GNU General Public License as published by the
|
|
# Free Software Foundation, version 3 of the License.
|
|
#
|
|
# This program is distributed in the hope that it will be useful, but
|
|
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
# for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License along
|
|
# with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
#
|
|
# Usage: security_audit.sh (no arguments)
|
|
# Description: Lists world-writable files/dirs, SUID/SGID files, and listening ports.
|
|
#
|
|
# Run as root for a complete picture: as an unprivileged user, find
|
|
# cannot descend into directories it may not read, so a clean report
|
|
# below is not the same as a clean system.
|
|
|
|
set -euo pipefail
|
|
|
|
# Each find below ends in `|| true`. find exits non-zero when it could
|
|
# not read some directory -- routine here, since we deliberately walk the
|
|
# whole filesystem -- and without this, set -e would abort the audit part
|
|
# way through and still look like it had finished.
|
|
|
|
# World-writable files (perm bits: others have write)
|
|
echo "==== World-Writable Files (potentially unsafe) ===="
|
|
find / -xdev -type f -perm -0002 -printf '%M %u %g %p\n' 2>/dev/null || true
|
|
|
|
# World-writable directories without sticky bit
|
|
echo -e "\n==== World-Writable Directories (no sticky bit) ===="
|
|
find / -xdev -type d -perm -0002 ! -perm -1000 -printf '%M %u %g %p\n' 2>/dev/null || true
|
|
|
|
# SUID/SGID files (files with setuid or setgid bits)
|
|
echo -e "\n==== SUID/SGID Files ===="
|
|
find / -xdev \( -perm -4000 -o -perm -2000 \) -printf '%M %u %g %p\n' 2>/dev/null || true
|
|
|
|
# Open listening ports
|
|
echo -e "\n==== Listening Network Ports ===="
|
|
if command -v ss &> /dev/null; then
|
|
ss -tulwn
|
|
elif command -v netstat &> /dev/null; then
|
|
netstat -tuln
|
|
else
|
|
echo "No command available to list network ports."
|
|
fi
|