diff --git a/checks/check_extra774 b/checks/check_extra774 new file mode 100644 index 00000000..22b17327 --- /dev/null +++ b/checks/check_extra774 @@ -0,0 +1,33 @@ +#!/usr/bin/env bash + +# Prowler - the handy cloud security tool (copyright 2018) by Toni de la Fuente +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may not +# use this file except in compliance with the License. You may obtain a copy +# of the License at http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. +CHECK_ID_extra774="1.23" +CHECK_TITLE_extra774="[extra774] Check if user have unused console login" +CHECK_SCORED_extra774="NOT_SCORED" +CHECK_TYPE_extra774="EXTRA" +CHECK_ALTERNATE_check774="extra774" +MAX_DAYS=-30 +extra774(){ + LIST_USERS_WITH_PASSWORD_ENABLED=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$4,$5 }' |grep true | awk '{ print $1 }') + + for i in $LIST_USERS_WITH_PASSWORD_ENABLED; do + user=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$3 }' |grep "^$i " |awk '{ print $1 }') + last_login_date=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$3 }' |grep "^$i " |awk '{ print $2 }') + + days_not_in_use=$(how_many_days_from_today ${last_login_date%T*}) + if [ "$days_not_in_use" -lt "$MAX_DAYS" ];then + textFail "User $user has not used console login for more then ${MAX_DAYS#-} days" + else + textPass "User $user has used console login in the past ${MAX_DAYS#-} days" + fi + done +} \ No newline at end of file diff --git a/groups/group1_iam b/groups/group1_iam index e999b7c7..19026030 100644 --- a/groups/group1_iam +++ b/groups/group1_iam @@ -12,4 +12,4 @@ GROUP_ID[1]='group1' GROUP_NUMBER[1]='1.0' GROUP_TITLE[1]='Identity and Access Management - [group1] **********************' GROUP_RUN_BY_DEFAULT[1]='Y' # run it when execute_all is called -GROUP_CHECKS[1]='check11,check12,check13,check14,check15,check16,check17,check18,check19,check110,check111,check112,check113,check114,check115,check116,check117,check118,check119,check120,check121,check122' +GROUP_CHECKS[1]='check11,check12,check13,check14,check15,check16,check17,check18,check19,check110,check111,check112,check113,check114,check115,check116,check117,check118,check119,check120,check121,check122,extra774'