#!/bin/bash

# nagios check for CVE-2015-3245

NAGIOS_OK=0
NAGIOS_ERROR=2

PAKITI_RESULT="pakiti_results"

if [ -f "$PAKITI_RESULT" ]; then
    cve=$(echo $0 | sed 's/.*check_//')
    grep -q "$cve" "$PAKITI_RESULT" 2>/dev/null
    if [ $? -eq 1 ]; then
        echo "No $cve vulnerability found, skipping the mitigation check"
        exit $NAGIOS_OK
    fi
fi

awk -F: '{if ($1 != "root") print $7}' /etc/passwd | grep '/bin/.*sh$' > /dev/null
if [ $? -eq 1 ]; then
    echo "OK: No non-root account detected, finishing."
    exit $NAGIOS_OK
fi

grep 'auth.*required.*pam_deny.so' /etc/pam.d/chfn > /dev/null
if [ $? -eq 1 ]; then
    echo "CRITICAL: chfn still available to users!"
    exit $NAGIOS_ERROR
fi

grep 'auth.*required.*pam_deny.so' /etc/pam.d/chsh > /dev/null
if [ $? -eq 1 ]; then
    echo "CRITICAL: chsh still available to users!"
    exit $NAGIOS_ERROR
fi

