FM / include

/usr/share/lynis/include

Name	Size	Mode	Actions
binaries	39476	0644	edit dl rm
consts	10898	0644	edit dl rm
data_upload	13788	0644	edit dl rm
functions	163241	0644	edit dl rm
helper_audit_dockerfile	8000	0644	edit dl rm
helper_configure	3748	0644	edit dl rm
helper_generate	7557	0644	edit dl rm
helper_show	22820	0644	edit dl rm
helper_system_remote_scan	3620	0644	edit dl rm
helper_update	3671	0644	edit dl rm
osdetection	48570	0644	edit dl rm
parameters	16874	0644	edit dl rm
profiles	27540	0644	edit dl rm
report	18915	0644	edit dl rm
tests_accounting	25852	0644	edit dl rm
tests_authentication	86063	0644	edit dl rm
tests_banners	8562	0644	edit dl rm
tests_boot_services	56034	0644	edit dl rm
tests_containers	11439	0644	edit dl rm
tests_crypto	19456	0644	edit dl rm
tests_custom.template	6942	0644	edit dl rm
tests_databases	24863	0644	edit dl rm
tests_dns	3467	0644	edit dl rm
tests_filesystems	50995	0644	edit dl rm
tests_file_integrity	22714	0644	edit dl rm
tests_file_permissions	3185	0644	edit dl rm
tests_firewalls	32270	0644	edit dl rm
tests_hardening	7187	0644	edit dl rm
tests_homedirs	9392	0644	edit dl rm
tests_insecure_services	27528	0644	edit dl rm
tests_kerberos	8063	0644	edit dl rm
tests_kernel	61403	0644	edit dl rm
tests_kernel_hardening	5752	0644	edit dl rm
tests_ldap	4055	0644	edit dl rm
tests_logging	33726	0644	edit dl rm
tests_mac_frameworks	15067	0644	edit dl rm
tests_mail_messaging	21967	0644	edit dl rm
tests_malware	21101	0644	edit dl rm
tests_memory_processes	7334	0644	edit dl rm
tests_nameservices	35361	0644	edit dl rm
tests_networking	41705	0644	edit dl rm
tests_php	29772	0644	edit dl rm
tests_ports_packages	83692	0644	edit dl rm
tests_printers_spoolers	14188	0644	edit dl rm
tests_scheduling	16131	0644	edit dl rm
tests_shells	13643	0644	edit dl rm
tests_snmp	4273	0644	edit dl rm
tests_squid	17156	0644	edit dl rm
tests_ssh	18026	0644	edit dl rm
tests_storage	3680	0644	edit dl rm
tests_storage_nfs	8603	0644	edit dl rm
tests_system_integrity	2098	0644	edit dl rm
tests_time	33413	0644	edit dl rm
tests_tooling	22624	0644	edit dl rm
tests_usb	21554	0644	edit dl rm
tests_virtualization	1992	0644	edit dl rm
tests_webservers	33977	0644	edit dl rm
tool_tips	2205	0644	edit dl rm

Edit: /usr/share/lynis/include/tests_networking (41705B)

#!/bin/sh

#################################################################################
#
#   Lynis
# ------------------
#
# Copyright (c) Michael Boelen, CISOfy, and many contributors.
#
# Website  : https://cisofy.com
# Blog     : https://linux-audit.com/
# GitHub   : https://github.com/CISOfy/lynis
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Networking
#
#################################################################################
#
    FOUNDPROMISC=0                                  # Promiscuous interfaces
    LOCAL_DNSRESOLVER_FOUND=0                       # Local DNS resolver
    NUMBERACTIVENS=0                                # Number of active nameservers
    DHCP_CLIENT_RUNNING=0                           # DHCP client availability
    ARPWATCH_RUNNING=0                              # ARP-cache based attack monitoring software
    ARPON_RUNNING=0                                 # ARP-cache based attack monitoring software
#
#################################################################################
#
    InsertSection "${SECTION_NETWORKING}"
#
#################################################################################
#
    # Test        : NETW-2400
    # Description : Test hostname for valid characters and length
    # Notes       : FQDN: max 253 characters
    #             : component: a-z, 0-9, hyphen, not start with hyphen, max 63 characters
    #               dots allowed as separator
    Register --test-no NETW-2400 --weight L --network YES --category basics --description "Hostname length and value check"
    if [ ${SKIPTEST} -eq 0 ]; then
        # Test first the fully qualified domain name
        if [ ${#FQDN} -gt 253 ]; then
            # Too long
            LogText "Result: FQDN is more than 253 characters"
            Display --indent 2 --text "- Hostname (FQDN length)" --result "${STATUS_WARNING}" --color RED
            ReportWarning "${TEST_NO}" "Hostname is too long (more than 253 characters)"
        elif [ ${#FQDN} -eq 0 ]; then
            # FQDN not defined
            LogText "Result: FQDN is not defined"
            if IsVerbose; then Display --indent 2 --text "- Hostname (FQDN length)" --result "${STATUS_UNKNOWN}" --color YELLOW; fi
        else
            # Fine
            LogText "Result: FQDN is defined and not longer than 253 characters (${#FQDN} characters)"
            if IsVerbose; then Display --indent 2 --text "- Hostname (FQDN length)" --result "${STATUS_OK}" --color GREEN; fi
        fi
        # Now test short hostname
        if [ ${#HOSTNAME} -eq 0 ]; then
            if IsVerbose; then Display --indent 2 --text "- Hostname (FQDN length)" --result "${STATUS_NONE}" --color RED; fi
            LogText "Result: hostname is not defined"
        else
            # Test length
            if [ ${#HOSTNAME} -gt 63 ]; then
                LogText "Result: hostname is more than 63 characters"
                Display --indent 2 --text "- Hostname (length)" --result "${STATUS_WARNING}" --color RED
            else
                LogText "Result: hostnamed is defined and not longer than 63 characters"
            fi
            # Test valid characters (normally a dot should not be in the name, but we can't be 100% sure we have short name)
            FIND=$(echo "${HOSTNAME}" | ${TRBINARY} -d '[:alnum:]\.\-')
            if [ -z "${FIND}" ]; then
                LogText "Result: good, no unexpected characters discovered in hostname"
                if IsVerbose; then Display --indent 2 --text "- Hostname (allowed characters)" --result "${STATUS_OK}" --color GREEN; fi
            else
                LogText "Result: unexpected characters discovered in hostname (characters: ${FIND}), which may impact network connectivity"
                Display --indent 2 --text "- Hostname (allowed characters)" --result "${STATUS_WARNING}" --color RED
                ReportWarning "${TEST_NO}" "Hostname contains invalid characters" "hostname" "text:See log file for invalid characters"
            fi
        fi
    fi
#
#################################################################################
#
    # Test        : NETW-2600
    # Description : Gather IPv6 configuration
    Register --test-no NETW-2600 --os "Linux" --weight L --network YES --category security --description "Checking IPv6 configuration"
    if [ ${SKIPTEST} -eq 0 ]; then
        IPV6_CONFIGURED=0
        IPV6_ACCEPT_RA=255
        IPV6_ACCEPT_REDIRECTS=255
        IPV6_MANUAL_CONFIGURED=255
        IPV6_ONLY=255
        IPV6_MISCONFIGURED=0
        IPV6_MISCONFIGURED_MTU=0
        FIND=$(sysctl -a 2> /dev/null | ${GREPBINARY} "^net.ipv6" | ${SEDBINARY} "s/ = /=/")
        if [ -n "${FIND}" ]; then
            IPV6_CONFIGURED=1
            for I in ${FIND}; do
                SYSCTL_KEY=$(echo ${I} | ${AWKBINARY} -F= '{ print $1 }')
                SYSCTL_VALUE=$(echo ${I} | ${AWKBINARY} -F= '{ print $2 }')
                case ${SYSCTL_KEY} in
                    "net.ipv6.conf.default.accept_ra")
                        if [ "${SYSCTL_VALUE}" = "1" ]; then IPV6_ACCEPT_RA=1; else IPV6_ACCEPT_RA=0; fi
                    ;;
                    "net.ipv6.conf.default.accept_redirects")
                        if [ "${SYSCTL_VALUE}" = "1" ]; then IPV6_ACCEPT_REDIRECTS=1; else IPV6_ACCEPT_REDIRECTS=0; fi
                    ;;
                    "net.ipv6.bindv6only")
                        if [ "${SYSCTL_VALUE}" = "1" ]; then IPV6_ONLY=1; else IPV6_ONLY=0; fi
                    ;;
                    "net.ipv6.conf.all.mtu" | "net.ipv6.conf.default.mtu")
                        if [ ${SYSCTL_VALUE} -lt 1280 ]; then IPV6_MISCONFIGURED_MTU=1; fi
                    ;;

#if TestValue --function equals --value "${SYSCTL_VALUE}" --search "1"; then
                    #     echo "Found ${SYSCTL_VALUE}"
                    #else
                    #     echo "Not found"
                    #fi
                esac
            done
        else
            IPV6_MODE="disabled"
        fi
        # Check if we are manually configured (not accepting automatic configuration)
        if [ ${IPV6_ACCEPT_RA} -eq 0 -a ${IPV6_ACCEPT_REDIRECTS} -eq 0 ]; then
            IPV6_MANUAL_CONFIGURED=1
            IPV6_MODE="manual"
        elif [ ${IPV6_ACCEPT_RA} -eq 1 -o ${IPV6_ACCEPT_REDIRECTS} -eq 1 ]; then
            IPV6_MODE="auto"
        else
            IPV6_MODE="disabled"
        fi

LogText "Result: IPV6 mode is ${IPV6_MODE}"
        if [ ${IPV6_CONFIGURED} -eq 1 ]; then
            Display --indent 2 --text "- Checking IPv6 configuration" --result "${STATUS_ENABLED}" --color WHITE
            STATUS=$(echo ${IPV6_MODE} | ${TRBINARY} '[:lower:]' '[:upper:]')
            Display --indent 6 --text "Configuration method" --result "${STATUS}" --color WHITE
            if [ ${IPV6_ONLY} -eq 1 ]; then STATUS="${STATUS_YES}"; else STATUS="${STATUS_NO}"; fi
            LogText "Result: IPv6 only configuration: ${STATUS}"
            Display --indent 6 --text "IPv6 only" --result "${STATUS}" --color WHITE
        else
            Display --indent 2 --text "- Checking IPv6 configuration" --result "${STATUS_DISABLED}" --color WHITE
        fi
        # Configuration errors
        if [ ${IPV6_MISCONFIGURED_MTU} -eq 1 ]; then
            IPV6_MISCONFIGURED=1
            LogText "Result: MTU of IPv6 interfaces should be 1280 or higher"
            Display --indent 6 --text "Error: MTU is too low" --result "${STATUS_WARNING}" --color RED
            ReportSuggestion "${TEST_NO}" "Check your MTU configuration of IPv6 interfaces"
        fi

# Possible improvements:
        # - Check if we found IPv6 enabled nameservers

# Report
        Report "ipv6_mode=${IPV6_MODE}"
        Report "ipv6_only=${IPV6_ONLY}"
    fi
#
#################################################################################
#
    # Test        : NETW-2704
    # Description : Basic nameserver configuration tests (connectivity)
    Register --test-no NETW-2704 --weight L --network YES --category security --description "Basic nameserver configuration tests"
    if [ ${SKIPTEST} -eq 0 ]; then
        Display --indent 2 --text "- Checking configured nameservers"
        LogText "Test: Checking /etc/resolv.conf file"
        if [ -f /etc/resolv.conf ]; then
            LogText "Result: Found /etc/resolv.conf file"
            FIND=$(${GREPBINARY} '^nameserver' /etc/resolv.conf | ${TRBINARY} -d '\t' | ${SEDBINARY} 's/nameserver*//g' | uniq | ${CUTBINARY} -d# -f1)
            if [ -n "${FIND}" ]; then
                Display --indent 4 --text "- Testing nameservers"
                LogText "Test: Querying nameservers"
                for I in ${FIND}; do
                    LogText "Found nameserver: ${I}"
                    Report "nameserver[]=${I}"
                    # Check if a local resolver is available (like DNSMasq)
                    if [ "${I}" = "::1" -o "${I}" = "127.0.0.1" -o "${I}" = "127.0.0.53" -o "${I}" = "127.0.1.1" -o "${I}" = "0.0.0.0" ]; then
                        LOCAL_DNSRESOLVER_FOUND=1
                    fi
                    if [ -n "${DIGBINARY}" ]; then
                        # See if we can query something at the nameserver
                        # 0=good, other=bad
                        DNSRESPONSE=$(${DIGBINARY} +noall +time=3 +retry=0 @${I} ${FQDN} > /dev/null ; echo $?)
                        if [ "${DNSRESPONSE}" = "0" ]; then
                            Display --indent 8 --text "Nameserver: ${I}" --result "${STATUS_OK}" --color GREEN
                            LogText "Nameserver ${I} seems to respond to queries from this host."
                            # Count responsive nameservers
                            NUMBERACTIVENS=$((NUMBERACTIVENS + 1))
                        else
                            Display --indent 8 --text "Nameserver: ${I}" --result "NO RESPONSE" --color RED
                            LogText "Result: nameserver ${I} does NOT respond"
                            LogText "Exit-code from dig: ${DNSRESPONSE}"
                            ReportSuggestion "${TEST_NO}" "Check connection to this nameserver and make sure no outbound DNS queries are blocked (port 53 UDP and TCP)."
                            ReportWarning "${TEST_NO}" "Nameserver ${I} does not respond"
                        fi
                    else
                        LogText "Result: Nameserver test for ${I} skipped, 'dig' not installed"
                        Display --indent 6 --text "Nameserver: ${I}" --result "${STATUS_SKIPPED}" --color YELLOW
                    fi
                done
            fi
        fi
    fi
#
#################################################################################
#
    # Test        : NETW-2705
    # Description : Basic nameserver configuration tests (connectivity)
    if [ ${LOCAL_DNSRESOLVER_FOUND} -eq 0 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no NETW-2705 --preqs-met ${PREQS_MET} --weight L --network YES --category security --description "Check availability two nameservers"
    if [ ${SKIPTEST} -eq 0 ]; then
        SKIP=0
        if [ -n "${DIGBINARY}" ]; then
            if [ ${NUMBERACTIVENS} -lt 2 ]; then
                Display --indent 4 --text "- Minimal of 2 responsive nameservers" --result "${STATUS_WARNING}" --color RED
                LogText "Result: less than 2 responsive nameservers found"
                ReportWarning "${TEST_NO}" "Couldn't find 2 responsive nameservers"
                LogText "Note: Non responsive nameservers can give problems for your system(s). Like the lack of recursive lookups, bad connectivity to update servers etc."
                ReportSuggestion "${TEST_NO}" "Check your resolv.conf file and fill in a backup nameserver if possible"
                AddHP 1 2
            else
                Display --indent 4 --text "- Minimal of 2 responsive nameservers" --result "${STATUS_OK}" --color GREEN
                LogText "Result: found at least 2 responsive nameservers"
                AddHP 3 3
            fi
        else
            Display --indent 4 --text "- Minimal of 2 responsive nameservers" --result "${STATUS_SKIPPED}" --color YELLOW
            LogText "Result: dig not installed, test can't be fully performed"
        fi
    else
        LogText "Result: Test most likely skipped due having local resolver in /etc/resolv.conf"
    fi
#
#################################################################################
#
    # Test        : NETW-2706
    # Description : Check systemd-resolve output and upstream DNSSEC status
    # Notes       : Ubuntu 16.04 uses systemd-resolve, newer ones most likely resolvectl
    if [ -n "${RESOLVECTLBINARY}" ]; then
        PREQS_MET="YES"
        RESOLVE_CMD="${RESOLVECTLBINARY}"
        RESOLVE_CMD_PARAM="statistics"
    elif [ -n "$(command -v systemd-resolve 2> /dev/null)" ]; then
        PREQS_MET="YES"
        RESOLVE_CMD="$(command -v systemd-resolve 2> /dev/null)"
        RESOLVE_CMD_PARAM="--statistics"
    else
        PREQS_MET="NO"
    fi
    Register --test-no NETW-2706 --preqs-met "${PREQS_MET}" --weight L --network YES --category security --description "Check systemd-resolved and upstream DNSSEC status"
    if [ ${SKIPTEST} -eq 0 ]; then
        SKIP=0
        DNSSEC_STATUS=$(${RESOLVE_CMD} ${RESOLVE_CMD_PARAM} 2> /dev/null | ${AWKBINARY} -F ":" '/DNSSEC supported/ { print $2 }' | ${TRBINARY} -d ' ')
        if [ "${DNSSEC_STATUS}" = "yes" ]; then
            Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_YES}" --color GREEN
            LogText "Result: DNSSEC supported by systemd-resolved and upstream DNS servers"
        elif [ "${DNSSEC_STATUS}" = "no" ]; then
            Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_NO}" --color YELLOW
            LogText "Result: DNSSEC not supported by systemd-resolved or upstream DNS servers"
        else
            Display --indent 4 --text "- DNSSEC supported (systemd-resolved)" --result "${STATUS_UNKNOWN}" --color RED
            LogText "Result: command '${RESOLVE_CMD} ${RESOLVE_CMD_PARAM}' returned an error. Please run command manually to check for details."
        fi
    else
        LogText "Result: Test most likely skipped due to not having resolvectl"
    fi
#
#################################################################################
#
    # Test        : NETW-3001
    # Description : Find default gateway (route)
    # More info   : BSD: ^default   Linux: 0.0.0.0
    if [ -n "${NETSTATBINARY}" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no NETW-3001 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Find default gateway (route)"
    if [ $SKIPTEST -eq 0 ]; then
        LogText "Test: Searching default gateway(s)"
        FIND=$(${NETSTATBINARY} -rn | ${GREPBINARY} -E "^0.0.0.0|default" | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f2)
        if [ -n "${FIND}" ]; then
            for I in ${FIND}; do
                LogText "Result: Found default gateway ${I}"
                Report "default_gateway[]=${I}"
            done
            Display --indent 2 --text "- Checking default gateway" --result "${STATUS_DONE}" --color GREEN
        else
            LogText "Result: No default gateway found"
            Display --indent 2 --text "- Checking default gateway" --result "NONE FOUND" --color WHITE
        fi
    fi
#
#################################################################################
#
    # Test        : NETW-3004
    # Description : Find available network interfaces
    Register --test-no NETW-3004 --weight L --network NO --category security --description "Search for available network interfaces"
    if [ ${SKIPTEST} -eq 0 ]; then
        FIND=""
        case ${OS} in
            AIX)
                FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${GREPBINARY} "flags=" | ${AWKBINARY} -F ":" '{ print  $1 }')
            ;;
            Linux)
                if [ -n "${IPBINARY}" ]; then
                    FIND=$(${IPBINARY} link show 2> /dev/null | ${GREPBINARY} "^[0-9]" | ${AWKBINARY} '{ print $2 }' | ${SEDBINARY} 's/://g')
                elif [ -n "${IFCONFIGBINARY}" ]; then
                    FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ( $2 == "Link" ) { print  $1 }}')
                fi
            ;;
            DragonFly|FreeBSD|macOS|NetBSD)
                FIND=$(${IFCONFIGBINARY} -l 2> /dev/null)
            ;;
            OpenBSD|Solaris)
                FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${GREPBINARY} "flags=" | ${AWKBINARY} -F ": " '{ print  $1 }')
            ;;
            *)
                # Having a system currently unsupported? Share your details to determine network interfaces
                ReportException "${TEST_NO}:1" "No support for this OS (${OS}) to find available network interfaces"
            ;;
        esac
        if HasData "${FIND}"; then
            for ITEM in ${FIND}; do
                NETWORK_INTERFACES="${NETWORK_INTERFACES}|${ITEM}"
                LogText "Found network interface: ${ITEM}"
                Report "network_interface[]=${ITEM}"
            done
        else
            ReportException "${TEST_NO}:1" "No interfaces found on this system (OS=${OS})"
        fi
    fi
#
#################################################################################
#
    # Test        : NETW-3006
    # Description : Get network MAC addresses
    Register --test-no NETW-3006 --weight L --network NO --category security --description "Get network MAC addresses"
    if [ ${SKIPTEST} -eq 0 ]; then
        FIND=""
        case ${OS} in
            AIX)
                FIND=$(lscfg -vl ent* | ${GREPBINARY} "Network Address" | ${CUTBINARY} -d"." -f14 | ${AWKBINARY} '{ ctr=1; i=1; while (ctr <= 6) { d[ctr++]=substr($0,i,2);i=i+2 } printf("%s:%s:%s:%s:%s:%s\n",d[1],d[2],d[3],d[4],d[5],d[6]) }')
                ;;
            DragonFly|FreeBSD)
                FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="ether") print $2 }' | ${SORTBINARY} -u)
                ;;
            Linux)
                if [ -n "${IFCONFIGBINARY}" ]; then
                    FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${GREPBINARY} "HWaddr" | ${AWKBINARY} '{ if ($4=="HWaddr") print $5 }' | ${SORTBINARY} -u)
                    # CentOS 7.x and others may return nothing. Let's retry with 'ether' field.
                    if [ -z "${FIND}" ]; then
                        FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="ether") print $2 }' | ${SORTBINARY} -u)
                    fi
                else
                    if [ -n "${IPBINARY}" ]; then
                        LogText "Test: Using ip binary to gather hardware addresses"
                        FIND=$(${IPBINARY} link 2> /dev/null | ${GREPBINARY} "link/ether" | ${AWKBINARY} '{ print $2 }')
                    else
                        ReportException "${TEST_NO}:2" "Missing ifconfig or ip command to collect hardware address (MAC)"
                    fi
                fi
                ;;
            macOS)
                FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="lladdr" || $1=="ether") print $2 }' | ${SORTBINARY} -u)
                ;;
            NetBSD)
                FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="address:") print $2 }' | ${SORTBINARY} -u)
                ;;
            OpenBSD)
                FIND=$(${IFCONFIGBINARY} -A 2> /dev/null | ${AWKBINARY} '{ if ($1=="lladdr") print $2 }' | ${SORTBINARY} -u)
                ;;
            Solaris)
                FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="ether") print $2 }' | ${SORTBINARY} -u)
                ;;
            *)
                # Having a system currently unsupported? Share your details to determine MAC information
                ReportException "${TEST_NO}:1" "No support for this OS (${OS}) to find MAC information"
                ;;
        esac
        for ITEM in ${FIND}; do
            LogText "Found MAC address: ${ITEM}"
            Report "network_mac_address[]=${ITEM}"
        done
    fi
#
#################################################################################
#
    # Test        : NETW-3008
    # Description : Get network IPv4/6 addresses
    Register --test-no NETW-3008 --weight L --network NO --category security --description "Get network IP addresses"
    if [ ${SKIPTEST} -eq 0 ]; then
        FIND=""; FIND2=""
        case ${OS} in
            AIX)
                FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet") print $2 }')
                FIND2=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6") print $2 }')
                ;;
            DragonFly|FreeBSD|NetBSD)
                FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet") print $2 }')
                FIND2=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6") print $2 }')
                ;;
            Linux)
                if [ -n "${IFCONFIGBINARY}" ]; then
                    FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet") print $2 }' | ${CUTBINARY} -d ':' -f2)
                    # Version which works for multiple types of ifconfig (e.g. Slackware)
                    FIND2=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6" && $2=="addr:") { print $3 } else { if ($1=="inet6" && $3=="prefixlen") { print $2 } } }')
                else
                    if [ -n "${IPBINARY}" ]; then
                        LogText "Test: Using ip binary to gather IP addresses"
                        FIND=$(${IPBINARY} addr 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet") { print $2 }}' | ${SEDBINARY} 's/\/.*//')
                        FIND2=$(${IPBINARY} addr 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6") { print $2 }}' | ${SEDBINARY} 's/\/.*//')
                    else
                        ReportException "${TEST_NO}:2" "Missing ifconfig or ip command to collect hardware address (MAC)"
                    fi
                fi
                ;;
            macOS)
                FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet") print $2 }')
                FIND2=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6") print $2 }')
                ;;
            OpenBSD)
                FIND=$(${IFCONFIGBINARY} -A 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet") print $2 }')
                FIND2=$(${IFCONFIGBINARY} -A 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6") print $2 }')
                ;;
            Solaris)
                FIND=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet") print $2 }')
                FIND2=$(${IFCONFIGBINARY} -a 2> /dev/null | ${AWKBINARY} '{ if ($1=="inet6") print $2 }')
                ;;
            *)
                LogText "Result: no support yet for this OS (${OS}) to find IP address information. You can help improving this test by submitting your details."
                ReportException "${TEST_NO}:1" "IP address information test not implemented for this operating system"
                ;;
        esac

# IPv4
        for ITEM in ${FIND}; do
            LogText "Found IPv4 address: ${ITEM}"
            Report "network_ipv4_address[]=${ITEM}"
        done
        # IPv6
        for ITEM in ${FIND2}; do
            LogText "Found IPv6 address: ${ITEM}"
            Report "network_ipv6_address[]=${ITEM}"
        done
    fi
#
#################################################################################
#
    # Test        : NETW-3012
    # Description : Check listening ports
    Register --test-no NETW-3012 --weight L --network NO --category security --description "Check listening ports"
    if [ ${SKIPTEST} -eq 0 ]; then
        DATA=""
        FIND=""; FIND2=""
        COUNT=0
        case ${OS} in
            DragonFly | FreeBSD)
                if [ -n "${SOCKSTATBINARY}" ]; then
                    FIND=$(${SOCKSTATBINARY} | ${AWKBINARY} '{ if ($7 ~ /\*:\*/) print $5"|"$6"|"$2"|" }' | ${SORTBINARY} -u)
                    # To strip off IP's: ${SEDBINARY} 's/|.*:/|/'
                else
                    FIND=""
                fi
                FIND2=""
            ;;
            Linux)
                if [ -n "${SSBINARY}" ]; then
                    LogText "Test: Retrieving ss information to find listening ports"
                    DATA=$(${SSBINARY} --query=udp,tcp -plnt | ${AWKBINARY} '{ if ($1!="Netid") { print "raw,ss,v1|"$1"|"$5"|"$7"|" }}' | ${SEDBINARY} 's/pid=[0-9]\{1,\},fd=[0-9]\{1,\}//g' | ${SEDBINARY} 's/users://' | ${SEDBINARY} 's/,)//g' | ${TRBINARY} -d '()"')
                elif [ -n "${NETSTATBINARY}" ]; then
                    LogText "Test: Retrieving netstat information to find listening ports"
                    # UDP
                    FIND=$(${NETSTATBINARY} -nlp 2> /dev/null | ${GREPBINARY} "^udp" | ${AWKBINARY} '{ print $4"|"$1"|"$6"|" }' | ${SEDBINARY} 's:|[0-9]*/:|:')
                    # TCP
                    FIND2=$(${NETSTATBINARY} -nlp 2> /dev/null  | ${GREPBINARY} "^tcp" | ${AWKBINARY} '{ if($6=="LISTEN") { print $4"|"$1"|"$7"|" }}' | ${SEDBINARY} 's:|[0-9]*/:|:')
                else
                    ReportException "${TEST_NO}:1" "netstat and ss binary missing to gather listening ports"
                fi
            ;;

macOS)
                if [ -n "${LSOFBINARY}" ]; then
                    LogText "Test: Retrieving lsof information to find listening ports"
                    # UDP and TCP combined
                    FIND=$(${LSOFBINARY}${LSOF_EXTRA_OPTIONS} -i -P | ${AWKBINARY} '{ print $9"|"$8"|"$1"|" }' | ${SEDBINARY} 's/$.*$\-\>.*$\|.*$/\1\2/' | ${SEDBINARY} 's/\*/'$IP'/' | ${SORTBINARY} -u | ${GREPBINARY} -v "NAME")
                else
                    FIND=""
                fi
                # Not needed as we have a combined test
                FIND2=""
            ;;
            NetBSD)
                if [ -n "${SOCKSTATBINARY}" ]; then
                    LogText "Test: Retrieving sockstat information to find listening ports"
                    FIND=$(${SOCKSTATBINARY} 2> /dev/null | ${AWKBINARY} '{ if ($7 ~ /\*.\*/) print $5"|"$6"|"$2"|" }' | ${SORTBINARY} -u)
                else
                    FIND=""
                fi
                FIND2=""
            ;;
            OpenBSD)
                if [ -n "${NETSTATBINARY}" ]; then
                    LogText "Test: Retrieving netstat information to find listening ports"
                    # UDP
                    FIND=$(${NETSTATBINARY} -an 2> /dev/null | ${GREPBINARY} "^udp" | ${AWKBINARY} '{ print $4"|"$1"||" }')
                    # TCP
                    FIND2=$(${NETSTATBINARY} -an 2> /dev/null  | ${GREPBINARY} "^tcp" | ${AWKBINARY} '{ if($6=="LISTEN") { print $4"|"$1"||" }}')
                else
                    ReportException "${TEST_NO}:3" "netstat missing to gather listening ports"
                fi
            ;;
            Solaris)
                if [ -n "${NETSTATBINARY}" ]; then
                    LogText "Test: Retrieving netstat information to find listening ports"
                    FIND=$(${NETSTATBINARY} -an -P udp | ${AWKBINARY} '{ if($7=="LISTEN") { print $1"|udp|LISTEN|" }}')
                    FIND2=$(${NETSTATBINARY} -an -P tcp | ${AWKBINARY} '{ if($7=="LISTEN") { print $1"|tcp|LISTEN|" }}')
                else
                    ReportException "${TEST_NO}:4" "netstat missing to gather listening ports"
                fi
            ;;
            *)
                # Got this exception? Provide your details and output of netstat or any other tool to determine this information.
                ReportException "${TEST_NO}:2" "Unclear what method to use, to determine listening port information"
            ;;
        esac

if [ -n "${DATA}" ]; then
            for ITEM in ${DATA}; do
                COUNT=$((COUNT + 1))
                Report "network_listen[]=${ITEM}"
            done
        fi

if [ -n "${FIND}" ]; then
            for ITEM in ${FIND}; do
                COUNT=$((COUNT + 1))
                LogText "Found listening info: ${ITEM}"
                Report "network_listen_port[]=${ITEM}"
            done
        fi

if [ -n "${FIND2}" ]; then
            for ITEM in ${FIND2}; do
                COUNT=$((COUNT + 1))
                LogText "Found listening info: ${ITEM}"
                Report "network_listen_port[]=${ITEM}"
            done
        fi
        if [ -z "${DATA}" -a -z "${FIND}" ]; then
            Display --indent 2 --text "- Getting listening ports (TCP/UDP)" --result "${STATUS_SKIPPED}" --color YELLOW
        else
            Display --indent 2 --text "- Getting listening ports (TCP/UDP)" --result "${STATUS_DONE}" --color GREEN
        fi
    fi
#
#################################################################################
#
    # Test        : NETW-3014
    # Description : Checking promiscuous interfaces (BSD)
    # Note        : FreeBSD and others
    if [ "${OS}" = "DragonFly" -o "${OS}" = "FreeBSD" -o "${OS}" = "NetBSD" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no NETW-3014 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking promiscuous interfaces (BSD)"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Checking promiscuous interfaces (FreeBSD)"
        FIND=$(${IFCONFIGBINARY} 2> /dev/null | ${GREPBINARY} PROMISC | ${CUTBINARY} -d ':' -f1)
        if HasData "${FIND}"; then
            LogText "Result: Promiscuous interfaces: ${FIND}"
            for ITEM in ${FIND}; do
                WHITELISTED=0
                for PROFILE in ${PROFILES}; do
                    Debug "Checking if interface ${ITEM} is whitelisted in profile ${PROFILE}"
                    ISWHITELISTED=$(${GREPBINARY} "^if_promisc:${ITEM}:" ${PROFILE})
                    if HasData "${ISWHITELISTED}"; then
                        WHITELISTED=1
                        LogText "Result: this interface was whitelisted in profile (${PROFILE})"
                    fi
                done
                # Check if this interface was whitelisted
                if [ ${WHITELISTED} -eq 0 ]; then
                    FOUNDPROMISC=1
                    ReportWarning "${TEST_NO}" "Found promiscuous interface (${ITEM})"
                    LogText "Note: some tools put an interface into promiscuous mode, to capture/log network traffic"
                else
                    LogText "Result: Found promiscuous interface ${ITEM} (*whitelisted via profile*)"
                fi
            done
        fi

# Show result
        if [ ${FOUNDPROMISC} -eq 0 ]; then
            Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_OK}" --color GREEN
            LogText "Result: No promiscuous interfaces found"
        else
            Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_WARNING}" --color RED
        fi
    fi
#
#################################################################################
#
    # Test        : NETW-3015
    # Description : Checking promiscuous interfaces (Linux)
    Register --test-no NETW-3015 --os Linux --weight L --network NO --category security --description "Checking promiscuous interfaces (Linux)"
    if [ ${SKIPTEST} -eq 0 ]; then
        FOUNDPROMISC=99
        NETWORK=""
        USE_IP_INSTEAD_IFCONFIG=0

if [ -n "${IPBINARY}" ]; then
            LogText "Test: Using ip binary to retrieve network interfaces"
            NETWORK=$(${IPBINARY} -o link 2> /dev/null | ${GREPBINARY} "^[0-9]" | ${AWKBINARY} '{print $2 }' | ${TRBINARY} -d ':')
            USE_IP_INSTEAD_IFCONFIG=1
        elif [ -n "${IFCONFIGBINARY}" ]; then
            LogText "Test: Using ifconfig binary to retrieve network interfaces"
            NETWORK=$(${IFCONFIGBINARY} 2> /dev/null | ${GREPBINARY} Link | ${TRBINARY} -s ' ' | ${CUTBINARY} -d ' ' -f1)
        fi

LogText "Test: Checking all interfaces to discover any with promiscuous mode enabled"
        if [ -n "${NETWORK}" ]; then
            FOUNDPROMISC=0
            for I in ${NETWORK}; do
                if [ ${USE_IP_INSTEAD_IFCONFIG} -eq 1 ]; then
                    FIND=$(${IPBINARY} -o -d link show ${I} 2> /dev/null | ${GREPBINARY} "promiscuity [1-9]")
                else
                    FIND=$(${IFCONFIGBINARY} ${I} 2> /dev/null | ${GREPBINARY} PROMISC)
                fi
                if [ -n "${FIND}" ]; then
                    LogText "Result: Promiscuous interface: ${I}"
                    ISWHITELISTED=$(${GREPBINARY} "^if_promisc:${I}:" ${PROFILE})
                    if [ -z "${ISWHITELISTED}" ]; then
                        FOUNDPROMISC=1
                        ReportWarning "${TEST_NO}" "Found promiscuous interface" "${I}" "text:Determine if this mode is required or whitelist interface in profile"
                        LogText "Note: some tools put an interface into promiscuous mode, to capture/log network traffic"
                    else
                        LogText "Result: Found promiscuous interface ${I} (*whitelisted via profile*)"
                    fi
                fi
            done
        else
            LogText "Result: no network interfaces discovered, so nothing tested"
        fi

# Show result
        if [ ${FOUNDPROMISC} -eq 0 ]; then
            Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_OK}" --color GREEN
            LogText "Result: No promiscuous interfaces found"
        elif [ ${FOUNDPROMISC} -eq 1 ]; then
            Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_WARNING}" --color RED
        else
            Display --indent 2 --text "- Checking promiscuous interfaces" --result "${STATUS_UNKNOWN}" --color YELLOW
        fi
    fi
#
#################################################################################
#
    # Do you have a multipath configuration on Linux or other OS? Create a related test and send in a pull request on GitHub

# Test        : NETW-3020 TODO
    # Description : Checking multipath configuration
#
#################################################################################
#
    # Test        : NETW-3028
    # Description : Checking for many waiting connections
    # Type        : Performance
    # Notes       : It is common to see a healthy web server seeing to have several thousands of TCP connections in WAIT state
    if [ ! "${NETSTATBINARY}" = "" ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no NETW-3028 --preqs-met ${PREQS_MET} --weight L --network NO --category security --description "Checking connections in WAIT state"
    if [ ${SKIPTEST} -eq 0 ]; then
        LogText "Test: Using netstat for check for connections in WAIT state"
        FIND=$(${NETSTATBINARY} -an | ${GREPBINARY} WAIT | ${WCBINARY} -l | ${AWKBINARY} '{ print $1 }')
        if IsEmpty "${OPTIONS_CONN_MAX_WAIT_STATE}"; then OPTIONS_CONN_MAX_WAIT_STATE="5000"; fi
        LogText "Result: currently ${FIND} connections are in a waiting state (max configured: ${OPTIONS_CONN_MAX_WAIT_STATE})."
        if [ ${FIND} -gt ${OPTIONS_CONN_MAX_WAIT_STATE} ]; then
            Display --indent 2 --text "- Checking waiting connections" --result "${STATUS_WARNING}" --color YELLOW
            ReportSuggestion "${TEST_NO}" "Determine why system has many connections in WAIT state (${FIND})"
        else
            Display --indent 2 --text "- Checking waiting connections" --result "${STATUS_OK}" --color GREEN
            LogText "Result: ${FIND} connections are in WAIT state"
        fi
    fi
#
#################################################################################
#
    # Test        : NETW-3030
    # Description : Checking for DHCP client
    Register --test-no NETW-3030 --weight L --network NO --category security --description "Checking DHCP client status"
    if [ ${SKIPTEST} -eq 0 ]; then
        if IsRunning "dhclient" || IsRunning "dhcpcd" || IsRunning "udhcpc"; then
            Display --indent 2 --text "- Checking status DHCP client" --result "${STATUS_RUNNING}" --color WHITE
            DHCP_CLIENT_RUNNING=1
        else
            Display --indent 2 --text "- Checking status DHCP client" --result "${STATUS_NOT_ACTIVE}" --color WHITE
        fi
    fi
#
#################################################################################
#
    # Test        : NETW-3032
    # Description : Checking for ARP spoofing and related monitoring software
    Register --test-no NETW-3032 --os Linux --weight L --network NO --category security --description "Checking for ARP monitoring software"
    if [ ${SKIPTEST} -eq 0 ]; then
        FOUND=0

# addrwatch
        if IsRunning "addrwatch"; then
            FOUND=1
        fi

# arpwatch
        if IsRunning "arpwatch"; then
            FOUND=1
            ARPWATCH_RUNNING=1
        fi

# arpon
        if IsRunning "arpon"; then
            FOUND=1
            ARPON_RUNNING=1
        fi

if [ ${FOUND} -eq 1 ]; then
            Display --indent 2 --text "- Checking for ARP monitoring software" --result "${STATUS_RUNNING}" --color GREEN
        else
            Display --indent 2 --text "- Checking for ARP monitoring software" --result "${STATUS_NOT_FOUND}" --color YELLOW
            #ReportSuggestion "${TEST_NO}" "Consider running ARP monitoring software (addrwatch,arpwatch,arpon)"
        fi
    fi
#
#################################################################################
#
    # Test        : NETW-3200
    # Description : Determine available network protocols
    # Notes       : See all available supported modules: ls -d /lib/modules/$(uname -r )/kernel/net
    #               To see active/enabled protocols: ls -d /proc/sys/net
    Register --test-no NETW-3200 --weight L --network YES --category security --description "Determine available network protocols"
    if [ ${SKIPTEST} -eq 0 ]; then
        TESTED=0
        FOUND_UNCOMMON_PROTOCOL_ENABLED=0
        case ${OS} in
            Linux)
                TESTED=1
                LogText "Test: checking the status of some network protocols that typically are not used"
                UNCOMMON_PROTOCOLS="dccp sctp rds tipc"
                for P in ${UNCOMMON_PROTOCOLS}; do
                    LogText "Test: now checking module '${P}'"
                    if ! SkipAtomicTest "${TEST_NO}:${P}"; then
                        UNCOMMON_PROTOCOL_DISABLED=0
                        # First check modprobe.conf
                        if [ -f ${ROOTDIR}etc/modprobe.conf ]; then
                            DATA=$(${GREPBINARY} -E "^install[[:space:]]+${P}[[:space:]]+/bin/(true|false)$" ${ROOTDIR}etc/modprobe.conf)
                            if [ -n "${DATA}" ]; then
                                LogText "Result: found ${P} module disabled via modprobe.conf"
                                UNCOMMON_PROTOCOL_DISABLED=1
                            fi
                        fi
                        # Then additional modprobe configuration files
                        if [ -d ${ROOTDIR}etc/modprobe.d ]; then
                            # Return file names (-l) and suppress errors (-s)
                            DATA=$(${GREPBINARY} -l -s -E "^install[[:space:]]+${P}[[:space:]]+/bin/(true|false)$" ${ROOTDIR}etc/modprobe.d/*)
                            if [ -n "${DATA}" ]; then
                                UNCOMMON_PROTOCOL_DISABLED=1
                                for F in ${DATA}; do
                                    LogText "Result: found ${P} module disabled via ${F}"
                                done
                            fi
                        fi

if [ ${UNCOMMON_PROTOCOL_DISABLED} -eq 0 ]; then
                            ReportSuggestion "${TEST_NO}" "Determine if protocol '${P}' is really needed on this system"
                            Report "uncommon_network_protocol_enabled=${P}"
                            FOUND_UNCOMMON_PROTOCOL_ENABLED=1
                        fi
                    fi
                done

;;
            *)
                LogText "This test has no routine yet for this operating system."
                Debug "No routine implemented yet for this operating system to check for available network protocols"
            ;;
        esac
        if [ ${TESTED} -eq 1 ]; then
            if [ ${FOUND_UNCOMMON_PROTOCOL_ENABLED} -eq 1 ]; then
                Display --indent 2 --text "- Uncommon network protocols" --result "${FOUND}" --color YELLOW
            else
                Display --indent 2 --text "- Uncommon network protocols" --result "${STATUS_NOT_FOUND}" --color GREEN
            fi
        fi
        unset DATA F FOUND TESTED UNCOMMON_PROTOCOLS
    fi
#
#################################################################################
#

WaitForKeyPress

#
#================================================================================
# Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com

cmd: