#!/bin/sh

#################################################################################
#
#   Lynis
# ------------------
#
# Copyright 2007-2014, Michael Boelen (michael@rootkit.nl), The Netherlands
# Web site: http://www.rootkit.nl
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Malware scanners
#
#################################################################################
#
    InsertSection "Software: Malware scanners"
#
#################################################################################
#
    CLAMD_RUNNING=0
    MALWARE_SCANNER_INSTALLED=0
#
#################################################################################
#
    # Test        : MALW-3275
    # Description : Check for installed tool (chkrootkit)
    Register --test-no MALW-3275 --weight L --network NO --description "Check for chkrootkit"
    if [ ${SKIPTEST} -eq 0 ]; then
        logtext "Test: checking presence chkrootkit"
        if [ ! "${CHKROOTKITBINARY}" = "" ]; then
    	    Display --indent 2 --text "- Checking chkrootkit..." --result "FOUND" --color GREEN
	    logtext "Result: Found ${CHKROOTKITBINARY}"
	    MALWARE_SCANNER_INSTALLED=1
	    AddHP 2 2
          else
	    Display --indent 2 --text "- Checking chkrootkit..." --result "NOT FOUND" --color WHITE
	    logtext "Result: chkrootkit not found"
        fi
    fi
#
#################################################################################
#
    # Test        : MALW-3276
    # Description : Check for installed tool (Rootkit Hunter) 
    Register --test-no MALW-3276 --weight L --network NO --description "Check for Rootkit Hunter"
    if [ ${SKIPTEST} -eq 0 ]; then
        logtext "Test: checking presence Rootkit Hunter"
	if [ ! "${RKHUNTERBINARY}" = "" ]; then
	    Display --indent 2 --text "- Checking Rootkit Hunter..." --result "FOUND" --color GREEN
	    logtext "Result: Found ${RKHUNTERBINARY}"
	    MALWARE_SCANNER_INSTALLED=1
	    AddHP 2 2
          else
	    Display --indent 2 --text "- Checking Rootkit Hunter..." --result "NOT FOUND" --color WHITE
	    logtext "Result: Rootkit Hunter not found"
	fi
    fi
#
#################################################################################
#
    # Test        : MALW-3282
    # Description : Check if clamscan is installed
    Register --test-no MALW-3282 --weight L --network NO --description "Check for clamscan"
    if [ ${SKIPTEST} -eq 0 ]; then
	logtext "Test: checking presence clamscan"
	if [ ! "${CLAMSCANBINARY}" = "" ]; then
	    Display --indent 2 --text "- Checking ClamAV scanner..." --result "FOUND" --color GREEN
	    logtext "Result: Found ${CLAMSCANBINARY}"
	    MALWARE_SCANNER_INSTALLED=1
	    AddHP 2 2
	  else
	    Display --indent 2 --text "- Checking ClamAV scanner..." --result "NOT FOUND" --color WHITE
	    logtext "Result: clamscan couldn't be found"
	fi
    fi
#
#################################################################################
#
    # Test        : MALW-3284
    # Description : Check running clamd process
    Register --test-no MALW-3284 --weight L --network NO --description "Check for clamd"
    if [ ${SKIPTEST} -eq 0 ]; then
	logtext "Test: checking running ClamAV daemon (clamd)"
	FIND=`${PSBINARY} ax | grep "/clamd" | grep -v "grep"`
	if [ ! "${FIND}" = "" ]; then
	    Display --indent 2 --text "- Checking ClamAV daemon..." --result "FOUND" --color GREEN
	    logtext "Result: found running clamd process"
	    MALWARE_SCANNER_INSTALLED=1
	    CLAMD_RUNNING=1
	  else
	    Display --indent 2 --text "- Checking ClamAV daemon..." --result "NOT FOUND" --color WHITE
	    logtext "Result: clamd not running"
	fi
    fi
#
#################################################################################
#
    # Test        : MALW-3286
    # Description : Check running freshclam if clamd process is running
    if [ ${CLAMD_RUNNING} -eq 1 ]; then PREQS_MET="YES"; else PREQS_MET="NO"; fi
    Register --test-no MALW-3286 --preqs-met ${PREQS_MET} --weight L --network NO --description "Check for freshclam"
    if [ ${SKIPTEST} -eq 0 ]; then
	logtext "Test: checking running freshclam daemon"
	FIND=`${PSBINARY} ax | grep "/freshclam" | grep -v "grep"`
	if [ ! "${FIND}" = "" ]; then
	    Display --indent 4 --text "- Checking freshclam..." --result "FOUND" --color GREEN
	    logtext "Result: found running freshclam process"
	    AddHP 2 2
	  else
	    Display --indent 4 --text "- Checking freshclam..." --result "SUGGESTION" --color YELLOW
	    logtext "Result: freshclam is not running"
	    ReportSuggestion ${TEST_NO} "Confirm that freshclam is properly configured and keeps updating the ClamAV database"
	fi
    fi
#
#################################################################################
#
    # Test        : MALW-3292
    # Description : Check if at least one malware scanner is installed
#    Register --test-no MALW-3292 --weight L --network NO --description "Check for at least one malware scanner"
#    if [ ${SKIPTEST} -eq 0 ]; then
#	if [ ${MALWARE_SCANNER_INSTALLED} -eq 1 ]; then
#	    logtext "Result: At least one malware scanner is installed"
#	    Display --indent 2 --text "- Checking presence malware scanner..." --result "FOUND" --color GREEN
#	    #AddHP 3 3
#	  else
#	    logtext "Result: No malware scanners found"
#	    Display --indent 2 --text "- Checking presence malware scanner..." --result "NOT FOUND" --color YELLOW
#	    ReportSuggestion ${TEST_NO} "Install at least one malware scanner to perform periodic integrity tests on the system"
#	    #AddHP 0 3
#	fi
#    fi
#
#################################################################################
#
# Other projects: maldetect (rfxn)
#
#################################################################################
#

report "malware_scanner_installed=${MALWARE_SCANNER_INSTALLED}"

wait_for_keypress

#
#================================================================================
# Lynis - Copyright 2007-2014, Michael Boelen - www.rootkit.nl - The Netherlands
