/usr/share/openscap/sectool-sce/05_xinetd.sh is in libopenscap8 1.2.15-1build1.
This file is owned by root:root, with mode 0o755.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 | #!/bin/bash
# Copyright (C) 2008 Red Hat, Inc.
# Written by Dan Kopecek <dkopecek@redhat.com>
# Adapted for SCE by Martin Preisler <mpreisle@redhat.com>
XINETDCONF="/etc/xinetd.conf"
XINETDDIR="/etc/xinetd.d/"
SERVICE_EXECUTABLE_PERM="755"
SERVICE_EXECUTABLE_OWNER="root:"
RET=$XCCDF_RESULT_PASS
function get_services () {
sed -ne 's|^[[:space:]]*service[[:space:]]*\([[:alnum:]]*\)[[:space:]]*.*$|\1|p' "${1}"
}
function get_service_vars () {
sed -ne '/^[[:space:]]*service[[:space:]]*'"${1}"'[[:space:]]*/,/^[[:space:]]*service[[:space:]]*.*$/ {
/^[[:space:]]*[a-zA-Z_]*[[:space:]]*[-+]\{0,1\}=/,/^[[:space:]]*[a-zA-Z_]*[[:space:]]*=/ s|^[[:space:]]*\([a-zA-Z_]*\)[[:space:]]*\([-+]\{0,1\}\)=[[:space:]]*\(.*\)$|local\ \1="\3"\
local\ \1_op="\2"|p
}' "${2}"
}
function get_default_vars () {
sed -ne '/^[[:space:]]*defaults[[:space:]]*$/,/^[[:space:]]*}[[:space:]]*$/ {
/^[[:space:]]*[a-zA-Z_]*[[:space:]]*[-+]\{0,1\}=/,/^[[:space:]]*[a-zA-Z_]*[[:space:]]*=/ s|^[[:space:]]*\([a-zA-Z_]*\)[[:space:]]*\([-+]\{0,1\}\)=[[:space:]]*\(.*\)$|local\ \1="\3"\
local\ \1_op="\2"|p
}' "${1}"
}
function common_checks () {
eval "${3}"
eval "${1}"
if [[ -n "${server}" ]]; then
case "${server}" in
/*)
check_file_perm "${server}" ${SERVICE_EXECUTABLE_PERM} ${SERVICE_EXECUTABLE_OWNER} 1 $ID_SERVICE_PERM "${2} service executable"
;;
*)
echo "Executable path for service ${service} IS NOT ABSOLUTE."
RET=$XCCDF_RESULT_FAIL
;;
esac
fi
return ${OK}
}
function check_auth () {
eval "${2}"
eval "${1}"
if [[ "${disabled}" != "yes" && "${enabled}" != "no" ]] && [[ "${disable}" != "yes" ]]; then
echo "Warning: auth service IS ENABLED"
[ "$RET" == $XCCDF_RESULT_FAIL ] || RET=$XCCDF_RESULT_INFORMATIONAL
fi
}
function check_ident () {
eval "${2}"
eval "${1}"
if [[ "${disabled}" != "yes" && "${enabled}" != "no" ]] && [[ "${disable}" != "yes" ]]; then
echo "Warning: ident service IS ENABLED"
[ "$RET" == $XCCDF_RESULT_FAIL ] || RET=$XCCDF_RESULT_INFORMATIONAL
fi
}
function check_systat () {
eval "${2}"
eval "${1}"
if [[ "${disabled}" != "yes" && "${enabled}" != "no" ]] && [[ "${disable}" != "yes" ]]; then
echo "Warning: systat service IS ENABLED"
[ "$RET" == $XCCDF_RESULT_FAIL ] || RET=$XCCDF_RESULT_INFORMATIONAL
fi
}
function check_chargen () {
eval "${2}"
eval "${1}"
if [[ "${disabled}" != "yes" && "${enabled}" != "no" ]] && [[ "${disable}" != "yes" ]]; then
echo "Warning: chargen service IS ENABLED"
[ "$RET" == $XCCDF_RESULT_FAIL ] || RET=$XCCDF_RESULT_INFORMATIONAL
fi
}
function check_echo () {
eval "${2}"
eval "${1}"
if [[ "${disabled}" != "yes" && "${enabled}" != "no" ]] && [[ "${disable}" != "yes" ]]; then
echo "Warning: echo service IS ENABLED"
[ "$RET" == $XCCDF_RESULT_FAIL ] || RET=$XCCDF_RESULT_INFORMATIONAL
fi
}
function check_finger () {
eval "${2}"
eval "${1}"
if [[ "${disabled}" != "yes" && "${enabled}" != "no" ]] && [[ "${disable}" != "yes" ]]; then
echo "Warning: finger service IS ENABLED"
[ "$RET" == $XCCDF_RESULT_FAIL ] || RET=$XCCDF_RESULT_INFORMATIONAL
fi
}
function check_netstat () {
eval "${2}"
eval "${1}"
if [[ "${disabled}" != "yes" && "${enabled}" != "no" ]] && [[ "${disable}" != "yes" ]]; then
echo "Warning: netstat service IS ENABLED"
[ "$RET" == $XCCDF_RESULT_FAIL ] || RET=$XCCDF_RESULT_INFORMATIONAL
fi
}
function check_rusers () {
eval "${2}"
eval "${1}"
if [[ "${disabled}" != "yes" && "${enabled}" != "no" ]] && [[ "${disable}" != "yes" ]]; then
echo "Warning: rusers service IS ENABLED"
[ "$RET" == $XCCDF_RESULT_FAIL ] || RET=$XCCDF_RESULT_INFORMATIONAL
fi
}
CONFIGFILES=""
DEFAULTS=""
if [[ -f "${XINETDCONF}" ]]; then
CONFIGFILES="${XINETDCONF}"
DEFAULTS="$(get_default_vars "${XINETDCONF}")"
fi
if [[ -d "${XINETDDIR}" ]]; then
CONFIGFILES="$(find ${XINETDDIR} -type f) ${CONFIGFILES}"
fi
for CONF in ${CONFIGFILES}; do
for service in $(get_services "${CONF}"); do
VARS="$(get_service_vars "${service}" "${CONF}")"
if [[ "$(type -t "check_${service}")" == "function" ]]; then
common_checks "${VARS}" "${service}" "${DEFAULTS}"
check_${service} "${VARS}" "${DEFAULTS}"
fi
done
done
exit $RET
|