From a824e064b36b451bbbd2d112d46f92ee620496bc Mon Sep 17 00:00:00 2001 From: jonnyCodev Date: Tue, 4 Feb 2020 14:39:42 +0200 Subject: [PATCH 1/3] Check if user have unused console login --- checks/check_extra774 | 33 +++++++++++++++++++++++++++++++++ groups/group1_iam | 2 +- 2 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 checks/check_extra774 diff --git a/checks/check_extra774 b/checks/check_extra774 new file mode 100644 index 00000000..22b17327 --- /dev/null +++ b/checks/check_extra774 @@ -0,0 +1,33 @@ +#!/usr/bin/env bash + +# Prowler - the handy cloud security tool (copyright 2018) by Toni de la Fuente +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may not +# use this file except in compliance with the License. You may obtain a copy +# of the License at http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. +CHECK_ID_extra774="1.23" +CHECK_TITLE_extra774="[extra774] Check if user have unused console login" +CHECK_SCORED_extra774="NOT_SCORED" +CHECK_TYPE_extra774="EXTRA" +CHECK_ALTERNATE_check774="extra774" +MAX_DAYS=-30 +extra774(){ + LIST_USERS_WITH_PASSWORD_ENABLED=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$4,$5 }' |grep true | awk '{ print $1 }') + + for i in $LIST_USERS_WITH_PASSWORD_ENABLED; do + user=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$3 }' |grep "^$i " |awk '{ print $1 }') + last_login_date=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$3 }' |grep "^$i " |awk '{ print $2 }') + + days_not_in_use=$(how_many_days_from_today ${last_login_date%T*}) + if [ "$days_not_in_use" -lt "$MAX_DAYS" ];then + textFail "User $user has not used console login for more then ${MAX_DAYS#-} days" + else + textPass "User $user has used console login in the past ${MAX_DAYS#-} days" + fi + done +} \ No newline at end of file diff --git a/groups/group1_iam b/groups/group1_iam index e999b7c7..19026030 100644 --- a/groups/group1_iam +++ b/groups/group1_iam @@ -12,4 +12,4 @@ GROUP_ID[1]='group1' GROUP_NUMBER[1]='1.0' GROUP_TITLE[1]='Identity and Access Management - [group1] **********************' GROUP_RUN_BY_DEFAULT[1]='Y' # run it when execute_all is called -GROUP_CHECKS[1]='check11,check12,check13,check14,check15,check16,check17,check18,check19,check110,check111,check112,check113,check114,check115,check116,check117,check118,check119,check120,check121,check122' +GROUP_CHECKS[1]='check11,check12,check13,check14,check15,check16,check17,check18,check19,check110,check111,check112,check113,check114,check115,check116,check117,check118,check119,check120,check121,check122,extra774' From d473ebe3f21ed0fbd2184653c7c2de56b52aca58 Mon Sep 17 00:00:00 2001 From: jonnyCodev <42693227+jonnyCodev@users.noreply.github.com> Date: Wed, 5 Feb 2020 11:15:14 +0200 Subject: [PATCH 2/3] moving MAX_DAYS to the inner scope of the function --- checks/check_extra774 | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/checks/check_extra774 b/checks/check_extra774 index 22b17327..baae7869 100644 --- a/checks/check_extra774 +++ b/checks/check_extra774 @@ -15,8 +15,9 @@ CHECK_TITLE_extra774="[extra774] Check if user have unused console login" CHECK_SCORED_extra774="NOT_SCORED" CHECK_TYPE_extra774="EXTRA" CHECK_ALTERNATE_check774="extra774" -MAX_DAYS=-30 + extra774(){ + MAX_DAYS=-30 LIST_USERS_WITH_PASSWORD_ENABLED=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$4,$5 }' |grep true | awk '{ print $1 }') for i in $LIST_USERS_WITH_PASSWORD_ENABLED; do @@ -30,4 +31,4 @@ extra774(){ textPass "User $user has used console login in the past ${MAX_DAYS#-} days" fi done -} \ No newline at end of file +} From 2abe36083f7959d55d03ccce98120771eb71148d Mon Sep 17 00:00:00 2001 From: jonnyCodev <42693227+jonnyCodev@users.noreply.github.com> Date: Wed, 5 Feb 2020 15:55:09 +0200 Subject: [PATCH 3/3] Update group7_extras --- groups/group7_extras | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/groups/group7_extras b/groups/group7_extras index 5a36dbca..84280f8e 100644 --- a/groups/group7_extras +++ b/groups/group7_extras @@ -15,7 +15,7 @@ GROUP_ID[7]='extras' GROUP_NUMBER[7]='7.0' GROUP_TITLE[7]='Extras - [extras] **********************************************' GROUP_RUN_BY_DEFAULT[7]='Y' # run it when execute_all is called -GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733,extra734,extra735,extra736,extra737,extra738,extra739,extra740,extra741,extra742,extra743,extra744,extra745,extra746,extra747,extra748,extra749,extra750,extra751,extra752,extra753,extra754,extra755,extra756,extra757,extra758,extra761,extra762,extra763,extra764,extra765,extra767,extra768,extra769,extra770,extra771,extra772,extra773' +GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733,extra734,extra735,extra736,extra737,extra738,extra739,extra740,extra741,extra742,extra743,extra744,extra745,extra746,extra747,extra748,extra749,extra750,extra751,extra752,extra753,extra754,extra755,extra756,extra757,extra758,extra761,extra762,extra763,extra764,extra765,extra767,extra768,extra769,extra770,extra771,extra772,extra773,extra774' # Extras 759 and 760 (lambda variables and code secrets finder are not included) # to run detect-secrets use `./prowler -g secrets`