UNIX Security Script

# Author:
# Version: 2.01b.2
# Date:
# Org: Deloitte & Touche
# Dep: Enterprise Risk Services
# Change History - key on date changed
# - add directories to permission list
# General information

SEKHOSTN=`uname -n`
SEKDDMMYY=`date +%d/%m/%y`
SEKHHMM=`date +%H:%M`
SEKSYSTN=`uname -s`
SEKRLSEN=`uname -r`
SEKVERN=`uname -v`
SEKMACHN=`uname -m`
echo "Host Name: " $SEKHOSTN > hostname.txt
echo "Analysis Date: " $SEKDDMMYY >> hostname.txt
echo "Analysis Time: " $SEKHHMM >> hostname.txt
echo "Operating System:" $SEKSYSTN >> hostname.txt
echo "OS Release: " $SEKRLSEN >> hostname.txt
echo "OS Version: " $SEKVERN >> hostname.txt
echo "Machine: " $SEKMACHN >> hostname.txt
echo "Extracted By: " $LOGNAME >> hostname.txt
#passwd file
cat /etc/passwd > dtpasswd.txt

# group file

cat /etc/group > dtgroup.txt

# shadow password file AIX, SUN, Solaris, System V,

cat /etc/shadow > dtshad1.txt
cat /etc/security/passwd > dtshad2.txt

# user settings AIX

cat /etc/security/user > dtuser1.txt #En solaris no funciona!!!
cat /etc/security/mkuser.default > dtuser2.txt #En solaris no funciona!!!

# password rules SUN, Solaris

cat /etc/security/login.cfg > dtpwset1.txt
cat /etc/default/passwd > dtpwset2.txt
# password rules DEC enhanced security
cat /etc/auth/system/default > dtpwset3.txt
# terminal security

cat /etc/ttytab > dtterm1.txt
cat /etc/securetty > dtterm2.txt
cat /etc/default/login > dtterm3.txt
cat /etc/securettys > dtterm4.txt
cat /etc/ttys > dtterm5.txt
# system environment

cat /etc/environment > dtenviro.txt

# system profiles

cat /etc/profile > dtprof1.txt
cat /etc/csh.login > dtprof2.txt

touch dtprof3.txt
touch dtprof4.txt

for i in `find / \( -name .profile -o -name .cshrc -o -name .login -o -name .ksh
rc \) -print`
do
ls -al $i >> dtprof3.txt
ls -al $i >> dtprof4.txt
cat $i >> dtprof3.txt
done

# file security

ls -lRaq /etc > dtetc.txt
ls -lRaq /bin > dtbin.txt
ls -lRaq /sbin > dtsbin.txt
ls -laq / > dtroot.txt
ls -laRq /devices > dtdevice.txt
ls -lRaq /dev > dtdev.txt
#
ls -laq /usr > dtusr.txt
ls -laq /usr/sbin > dtusrsbin.txt
ls -laq /usr/spool > dtusrspool.txt
ls -laq /var > dtvar.txt
ls -laq /etc/passwd > dtppasswd.txt
ls -laq /etc/shadow > dtsshadow.txt
ls -laq /etc/security/passwd >dtspasswd
ls -laq /etc/profile > dtsprofile.txt
ls -laq home/.profile > dtspermisos.txt
ls -laq /etc/group > dtsgrupo.txt
ls -laq /etc/inet/hosts > dtsphosts.txt
ls -laq /etc/security/login.cfg > dtslogins.txt
# end of added commands
find / -perm -002 -exec ls -laq {} \; > dtwwfd.txt
find / -user root \( -perm -4000 -o -perm -2000 \) -exec ls -laq {} \; > dtsguid
.txt

# UNIX init processes general

cat /etc/inittab > dtinitta.txt
# Network security

cat /etc/services > dtservic.txt
cat /etc/inetd.conf > dtinitdc.txt
cat /etc/hosts.equiv > dthoeqiv.txt
cat /etc/ftpd/ftpusers > dtftpuse.txt
cat /etc/hosts > dthost.txt
cat /etc/hosts.allow > dthostal.txt
cat /etc/hosts.deny > dthostde.txt
cat /etc/remote > dtremote.txt
cat /etc/dialups > dtdialup.txt
cat /etc/.rhost
cat /etc/.forward
cat /etc/.netrc
cat /etc/host.lpd

touch dtrhost1.txt
touch dtrhost2.txt

for i in `find / \( -name .rhosts -o -name .netrc \) -print`
do
ls -al $i >> dtrhost1.txt
ls -al $i >> dtrhost2.txt
cat $i >> dtrhost2.txt
done

# NFS exports definition Solaris, SUN and other UNIX
cat /etc/dfs/dfstab > dtdfstab.txt
cat /etc/exports > dtnfs.txt
# logging

cat /var/adm/sulog > dtsulog.txt
cat /var/adm/loginlog > dtloginl.txt
who -a /var/adm/wtmp > dtwtmp.txt
cat /etc/syslog.conf > dtsyslog.txt
last > dtlast.txt
lastb > dtlastb.txt
cat /var/adm/messages > dtmess.txt
cat /usr/adm/syslog >dtsyslog1.txt
/var/adm/log/osmlog >dtosmlog.txt

# crontab

cat /etc/cron.d/cron.allow > dtcrallo.txt
cat /etc/cron.d/cron.deny > dtcrdeny.txt
ls -al /var/spool/cron/crontabs > dtcruser.txt
cat /var/spool/cron/crontabs/* > dtcronta.txt
cat /var/cron/log > dtcrlog.txt
# X windows Solaris
cat /usr/openwin/lib/xdm/xdm-config > dtxdm.txt
# Sendmail configuration
cat /etc/mail/aliases > dtalias.txt
cat /etc/mail/sendmail.cf > dtsendma.txt

# Contents NIS maps
ypcat passwd > dtyppw.txt
ypcat group > dtypgr.txt
# NIS settings Solaris
cat /etc/nsswitch.conf > dtnsswit.txt
# netgroup settings
cat /etc/netgroup > dtnetgr1.txt
cat /usr/etc/netgroup > dtnetgr2.txt