#!/bin/sh
#
#     tiger - A UN*X security checking system
#     Copyright (C) 1993 Douglas Lee Schales, David K. Hess, David R. Safford
#
#    This program is free software; you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation; either version 2, or (at your option)
#    any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#     Please see the file `COPYING' for the complete copyright notice.
#
# check_logfiles - 11/10/2001
# 
# Check for the presence of a given number of logfiles and their permissions.
# Note that these check is operating system dependant.
#
# check_logfiles - 08/09/2001 - jfs - fixed to add GREP and WC to haveallcmds
#                  detected when testing in Solaris 8. Also changed == to =
#
# check_logfiles - 04/15/2003 - jfs - separated logfiles and umask checks
#                  added permission checks for the logfiles based on 
#                  Solaris recommendations. 
#                  Logfile location is no longer hardcoded but can be changed
#                  depending on $OS
# check_logfiles - 06/20/2003 - jfs - based on patch from Ryan Bradetich fixed
#                  logic errors in check_fileperm(). Updated the error codes to 
#                  match the appropriate descriptions.
#                  Also fixed a typo in MESSAGEs and modified the script to not
#                  warn if LOGINLOG does not exist (as is the Linux case)
#                  Also, file permissions in systems in which WTMP and UTMP
#                  are group 'utmp' should be 664
#
#-----------------------------------------------------------------------------
#
TigerInstallDir="."

#
# Set default base directory.
# Order or preference:
#      -B option
#      TIGERHOMEDIR environment variable
#      TigerInstallDir installed location
#
basedir=${TIGERHOMEDIR:=$TigerInstallDir}

for parm
do
   case $parm in
   -B) basedir=$2; break;;
   esac
done

#
# Verify that a config file exists there, and if it does
# source it.
#
[ ! -r $basedir/config ] && {
  echo "--ERROR-- [init002e] No 'config' file in \`$basedir'."
  exit 1
}

. $basedir/config

. $BASEDIR/initdefs

#
# If run in test mode (-t) this will verify that all required
# elements are set.
#
[ "$Tiger_TESTMODE" = 'Y' ] && {
  haveallcmds AWK || exit 1
  haveallfiles BASEDIR WORKDIR || exit 1
  haveallvars TESTLINK HOSTNAME
  
  echo "--CONFIG-- [init003c] $0: Configuration ok..."
  exit 0
}

#------------------------------------------------------------------------

echo
echo "# Checking for existence of log files..."

haveallcmds AWK || exit 1

check_fileperm () {
  file=$1
  permission=$2
  value=1
  realpermission=`getpermit $1 | $AWK '{ print $4$5$6$7$8$9$10$11$12 }' `
  [ "$realpermission" = "$permission" ]  && value=0
  return $value
}


#####
# Check various accounting files
#####
WTMP=/var/log/wtmp
BTMP=/var/log/btmp
LASTLOG=/var/log/lastlog
UTMP=/var/run/utmp
LOGINLOG=/var/log/loginlog
MESSAGES=/var/log/messages

if [ "$OS" = "SunOS" ] ; then
	WTMP=/var/adm/wtmpx
	UTMP=/var/adm/utmpx
# Check: Note BTMP does not seem to exist
# And maybe also sulog and messages should be checked.
fi
if [ "$OS" = "Linux" ] ; then
# Loginlog and btmp do not exist
	LOGINLOG=""
	BTMP=""
fi

if [ ! -r "$WTMP" ] ; then
    #echo "...Warning: $WTMP does not exist"
    message FAIL logf001f "" "Log file $WTMP does not exist"
else
    group=`getpermit $WTMP | $AWK '{ print $3 }'`
    if [  "$group" = "utmp" ] ; then
        check_fileperm $WTMP 110110100 || 
       	message FAIL logf005f "" "Log file $WTMP permission should be 664"
    else
	check_fileperm $WTMP 110100100 || 
 	message FAIL logf005f "" "Log file $WTMP permission should be 644"
    fi
fi

[ -n "$BTMP" -a ! -r "$BTMP" ] &&
    #echo "...Warning: $BTMP does not exist"
    message FAIL logf002f "" "Log file $BTMP does not exist"

[ ! -r "$LASTLOG" ] && 
    #echo "...Warning: $LASTLOG does not exist"
    message FAIL logf003f "" "Log file $LASTLOG does not exist"

if [ ! -r "$UTMP" ] ; then
    #echo "...Warning: $UTMP does not exist"
    message FAIL logf004f "" "Log file $UTMP does not exist"
else
    group=`getpermit $UTMP | $AWK '{ print $3 }'`
    if [  "$group" = "utmp" ] ; then
	check_fileperm $UTMP 110110100 || 
   	message FAIL logf005f "" "Log file $UTMP permission should be 664"
    else
	check_fileperm $UTMP 110100100 || 
	message FAIL logf005f "" "Log file $UTMP permission should be 644"
    fi
fi

[ -n "$LOGINLOG" ] && {
if [ ! -r "$LOGINLOG" ] ; then
    #echo "...Warning: $LOGINGLOG does not exist"
    message FAIL logf006f "" "Log file $LOGINLOG does not exist"
else
    check_fileperm $LOGINLOG 110000000 || 
    	message FAIL logf005f "" "Log file $LOGINLOG permission should be 600"
fi
}
 
if [ ! -r "$MESSAGES"  ] ; then
    #echo "...Warning: $MESSAGES does not exist"
    message FAIL logf007f "" "Log file $MESSAGES does not exist"
else 
    check_fileperm $MESSAGES 110100000 || 
    	message FAIL logf005f "" "Log file $MESSAGES permission should be 640"
fi
 
exit 0
