It contains a list of the modules in the lsat
package and what they check for.

It also has a premier at the end for creating
modules.

----------------------------------------------------------------------------
Modules in the LSAT package:

checkdotfiles:
- Looks for .forward, .exrc, .rhosts and .netrc files on the system.
- Does not span "other" filesystems. 

checkfiles:
- checks that /tmp and /var/tmp have sitcky bit set
- checks utmp, wtmp, motd, mtab for chmod 644.
- checks /usr, /var dirs/files for root ownership.

checkftpusers:
- checks that all accounts in /etc/passwd are in /etc/ftpusers.

checkhostsfiles:
- Reads /etc/hosts.allow and /etc/hosts.deny files
- Checkes deny for ALL:ALL statement.
- Checks allow for any ALL statements.

checkinetd:
- Checks either /etc/inetd.conf or /etc/xinetd.d/* 
- If inetd.conf, it checks for entries not hashed out.
	(All entries should be commented out :)
- If xinetd.d it checks all files in that dir for disable = yes.

checkkbd:
- checks that ctrlaltdel function is disabled under linux.
- checks for KEYBOARD_DISABLE to be enabled under Solaris.

checklimits:
- performs simple check of limits.conf file

checknet:
- checks what ports the system is listening to.
- (may not check _all_ ports. I have to RTFM on this one)

checknetforward:
- checks that ipv4 forwarding is disabled under linux
- checks that ipforwarding & source routing are disabled under Solaris
- checks that norouter & defaultrouter exist under Solaris

checkpasswd:
- checks /etc/passwd for unneeded accounts.
- checks that only root is SUID=0.

checkpkgs:
- Checks list of packages (rpms, debs) installed on the system.
- Checks against a list of "should not have" rpms.
- (this list quite possibly needs to be expanded)

checkrc:
- checks /etc/rcn.d or /etc/rc.d/init.d and reports unneeded scripts.

checkset:
- Checks system for all setuid/setgid files.
- Also checks for block or char files in /dev/ that do not belong.

checkumask:
- checks that the default umask on the system is sensible.

checkwrite:
- Checks system for world writable files



-------------------------------------------------------------------------
Writing modules:

All modules are (thus far) written in C. (hopefully ANSI C)
Looking back on this, perhaps it should have been in Python...
or perl or ADA or LISP or [insert your favorite prog language here]...

All modules (execpt dostuff.c) are called from lsatmain.c
A small description of the module is in lsatheader.h

Parameters:
A module (read function) can be passed (as of now) up
to four parameters. They are:

char release[]: basically the first field of "uname -a" output
char kernel[]: basically the third field of "uname -a" output
const char *const out_file: the file that lsat will output checks to
int verbose: integer flag to indicate we should be verbose

A module (in my mind :) should be an independant entity. 
If I were to take a module and stick it in a "main" c function
and pass it whatever parameters listed above it needs it should
function. Properly.

In doing the above I am setting this up to where modules can 
be added or deleted without problems. Having a module depend
on the output of another is not my goal or desire. It may 
run a little slower for some things like this, but one
can customize it whenever and however they see fit with
relative ease.

Modules should return zero or greater on success and a negative
number on failure. Modules should themselves output error msgs,
not lsatmain.c. (although lsatmain.c will say "Module x failed,
you should have seen errors.", upon receiving a negative number
from a returning module)

Modules should have a small description at the top and _should_
be able to cope with being on different systems (Linux vs
Solaris for instance). Yes I still need to work on mine. :O

The dostuff module is a module (written by nordi (nordi at addcom dot de))
that is used to run shellcode, write to tempfiles, and append headers
and/or the tempfile to the output file. The description at the top
of dostuff is given below... written by Nordi, I quote:

"This is a function that does all the filehandling stuff for the lsat modules 
so that you don't have to reinvent the wheel every time you want to do something. 
Afterall we have to get rid of, eradicate and stamp out all kinds of redundancies.

As arguments it takes four pointers to strings: tempfile, outfile, shellcode and
header. Header can be NULL, then it simply will not be printed. One of the other
pointers can be NULL as well. In this case refer to the following list:

no NULL pointer            default behaviour
  create tempfile
  run shellcode
  append header to outfile
  append tempfile to outfile
  delete tempfile

outfile == NULL            if you want to do keep working with tempfile
  create tempfile
  run shellcode

tempfile == NULL           if you already have a tempfile and want to keep it
  run shellcode

shellcode == NULL          if you already got a tempfile but now you're finished
  append header to outfile
  append tempfile to outfile
  delete tempfile

Special Case:              just print the header to the outfile
tempfile==shellcode==NULL
  append header to outfile

Will return 0 on success and negative value on failure." - End Nordi quote.


This has (thus far) made it a lot easier to write modules. In general,
using dostuff.c one can concentrate more on exactly what they want
a module to do and not have to worry about opening files and writing
temp files etal every time one writes a module.

A basic template for a module (IMHO) would be:

int module(release, kernel, distribution, filename, verbose)
{
	/* above parameters are optional, depending on module */

	/* some internal variable defs here */

	
	/* these should be in all modules */
	const char * tempfile =NULL;
        const char * shellcode=NULL;
        const char * header   =NULL;

	if (verbose > 0)
	{
		printf("Starting module: module\n");
	}
	
	/* do something you want to... */
	/* we ALWAYS call the tempfiles lsatn.lsat, 	*/
	/* where n is an integer... this is for cleanup */
	/* purposes...					*/

 	if (verbose > 0)
	{
		printf(" Generating list of badstuffs\n");
	}
        tempfile = "/tmp/lsat1.lsat";
	shellcode = "find / -name badstuff 2>/dev/null >/tmp/lsat1.lsat";
        header = "I am finding the bad stuff man\n";
	if ((dostuff(tempfile, filename, shellcode, header)) < 0)
	{
		/* "but Den, with the Loc-nar we could have returned to earth..." */
		perror(" Could not generate list");
		return(-1);
	}

	if (verbose > 0)
	{
		printf("Finished in module: module...\n");
	}
	
	return(0);
}

Some things worth noting are this:
- We always call tempfiles lsatn.lsat where n is an integer.
- We always use verbose > 0, and the first and last verbose
statements have no space before the output. The inner
verbose statements have a space. This makes verbose output pertty.
- We always check the return value of dostuff, and perror if problems.
- We always return 0 on success and something less than 0 on
failure.

There are times when one needs to create a temp file for storage 
due to the fact tha the module may be looping through some data 
that the shellcode has generated. This can be done and is ok, but
use the following example as a guide to (safely) create a temp file:

int fileval;
if ((fileval = open("/tmp/lsat4.lsat", O_RDWR | O_CREAT, 0600)) < 0)
{
    perror("Could not make file w/perms 0600...\n");
    perror("Possible link attack while creating/opening file!\n");
    exit(-1);
}

One thing to point out is to be careful of open files when
doing this two temp file procedure. If one calls dostuff and
the file was already open, it will puke, hurl and pass out.

I will put some more info in here when I get some time :)



../number9