Updates to scanner with CVE saving and auto update
This commit is contained in:
Mark Gregory
+187
-33
@@ -19,6 +19,7 @@ enum SSHScanner {
|
|||||||
if [ -r /etc/os-release ]; then
|
if [ -r /etc/os-release ]; then
|
||||||
. /etc/os-release
|
. /etc/os-release
|
||||||
printf 'ID=%s\n' "${ID:-unknown}"
|
printf 'ID=%s\n' "${ID:-unknown}"
|
||||||
|
printf 'ID_LIKE=%s\n' "${ID_LIKE:-}"
|
||||||
printf 'VERSION_ID=%s\n' "${VERSION_ID:-unknown}"
|
printf 'VERSION_ID=%s\n' "${VERSION_ID:-unknown}"
|
||||||
printf 'VERSION_CODENAME=%s\n' "${VERSION_CODENAME:-unknown}"
|
printf 'VERSION_CODENAME=%s\n' "${VERSION_CODENAME:-unknown}"
|
||||||
fi
|
fi
|
||||||
@@ -28,46 +29,199 @@ enum SSHScanner {
|
|||||||
done | sort -u
|
done | sort -u
|
||||||
printf '===FPM===\n'; systemctl list-units --all --type=service --no-legend --no-pager 2>/dev/null | grep -E 'php[0-9.]+-fpm' || true
|
printf '===FPM===\n'; systemctl list-units --all --type=service --no-legend --no-pager 2>/dev/null | grep -E 'php[0-9.]+-fpm' || true
|
||||||
printf '===NGINX===\n'; grep -Rh 'fastcgi_pass' /etc/nginx/sites-enabled/ 2>/dev/null | sort -u || true
|
printf '===NGINX===\n'; grep -Rh 'fastcgi_pass' /etc/nginx/sites-enabled/ 2>/dev/null | sort -u || true
|
||||||
|
printf '===PACKAGE_MANAGER===\n'
|
||||||
|
if command -v dpkg-query >/dev/null 2>&1; then
|
||||||
|
package_manager=apt
|
||||||
|
elif command -v zypper >/dev/null 2>&1; then
|
||||||
|
package_manager=zypper
|
||||||
|
elif command -v apk >/dev/null 2>&1; then
|
||||||
|
package_manager=apk
|
||||||
|
elif command -v rpm >/dev/null 2>&1; then
|
||||||
|
if command -v dnf >/dev/null 2>&1; then
|
||||||
|
package_manager=dnf
|
||||||
|
elif command -v yum >/dev/null 2>&1; then
|
||||||
|
package_manager=yum
|
||||||
|
else
|
||||||
|
package_manager=rpm
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
package_manager=unknown
|
||||||
|
fi
|
||||||
|
printf '%s\n' "$package_manager"
|
||||||
|
|
||||||
printf '===PACKAGES===\n'
|
printf '===PACKAGES===\n'
|
||||||
dpkg-query -W \
|
case "$package_manager" in
|
||||||
-f='${db:Status-Abbrev} ${binary:Package} ${Version}\n' \
|
apt)
|
||||||
'php*' 2>/dev/null |
|
dpkg-query -W \
|
||||||
awk '$1 ~ /^ii/ && $2 ~ /^php/ { print $2, $3 }' |
|
-f='${db:Status-Abbrev} ${binary:Package} ${Version}\n' \
|
||||||
sort -u || true
|
'php*' 2>/dev/null |
|
||||||
|
awk '$1 ~ /^ii/ && $2 ~ /^php/ { print $2, $3 }' |
|
||||||
|
sort -u || true
|
||||||
|
;;
|
||||||
|
|
||||||
|
dnf|yum|rpm|zypper)
|
||||||
|
rpm -qa \
|
||||||
|
--queryformat '%{NAME} %{VERSION}-%{RELEASE}\n' \
|
||||||
|
2>/dev/null |
|
||||||
|
awk '$1 ~ /^php/ || $1 ~ /^rh-php/' |
|
||||||
|
sort -u || true
|
||||||
|
;;
|
||||||
|
|
||||||
|
apk)
|
||||||
|
apk info -v 2>/dev/null |
|
||||||
|
grep -E '^php[0-9]*-' |
|
||||||
|
sort -u || true
|
||||||
|
;;
|
||||||
|
|
||||||
|
*)
|
||||||
|
printf 'Package manager unsupported\n'
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
printf '===PACKAGE_SOURCES===\n'
|
printf '===PACKAGE_SOURCES===\n'
|
||||||
dpkg-query -W \
|
case "$package_manager" in
|
||||||
-f='${db:Status-Abbrev}|${binary:Package}|${Version}|${source:Package}|${source:Version}\n' \
|
apt)
|
||||||
'php*' 2>/dev/null |
|
dpkg-query -W \
|
||||||
while IFS='|' read -r state binary version src srcversion; do
|
-f='${db:Status-Abbrev}|${binary:Package}|${Version}|${source:Package}|${source:Version}\n' \
|
||||||
case "$state" in ii*) ;; *) continue ;; esac
|
'php*' 2>/dev/null |
|
||||||
case "$binary" in php*) ;; *) continue ;; esac
|
while IFS='|' read -r state binary version src srcversion; do
|
||||||
|
case "$state" in ii*) ;; *) continue ;; esac
|
||||||
|
case "$binary" in php*) ;; *) continue ;; esac
|
||||||
|
|
||||||
[ -n "$version" ] || continue
|
[ -n "$version" ] || continue
|
||||||
[ -n "$src" ] || src="$binary"
|
[ -n "$src" ] || src="$binary"
|
||||||
[ -n "$srcversion" ] || srcversion="$version"
|
[ -n "$srcversion" ] || srcversion="$version"
|
||||||
|
|
||||||
|
printf '%s|%s|%s|%s\n' \
|
||||||
|
"$binary" "$version" "$src" "$srcversion"
|
||||||
|
done
|
||||||
|
;;
|
||||||
|
|
||||||
|
dnf|yum|rpm|zypper)
|
||||||
|
rpm -qa \
|
||||||
|
--queryformat '%{NAME}|%{VERSION}-%{RELEASE}|%{SOURCERPM}\n' \
|
||||||
|
2>/dev/null |
|
||||||
|
while IFS='|' read -r binary version source_rpm; do
|
||||||
|
case "$binary" in
|
||||||
|
php*|rh-php*) ;;
|
||||||
|
*) continue ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
[ -n "$version" ] || continue
|
||||||
|
|
||||||
|
printf '%s|%s|%s|%s\n' \
|
||||||
|
"$binary" "$version" "$source_rpm" "$version"
|
||||||
|
done
|
||||||
|
;;
|
||||||
|
|
||||||
|
apk)
|
||||||
|
apk info -v 2>/dev/null |
|
||||||
|
while IFS= read -r entry; do
|
||||||
|
case "$entry" in php*) ;; *) continue ;; esac
|
||||||
|
|
||||||
|
name=$(printf '%s\n' "$entry" |
|
||||||
|
sed -E 's/-[0-9]+(\.[0-9]+)+(-r[0-9]+)?$//')
|
||||||
|
|
||||||
|
version=${entry#"$name"-}
|
||||||
|
|
||||||
|
[ "$version" != "$entry" ] || continue
|
||||||
|
|
||||||
|
printf '%s|%s|%s|%s\n' \
|
||||||
|
"$name" "$version" "$name" "$version"
|
||||||
|
done
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
printf '%s|%s|%s|%s\n' \
|
|
||||||
"$binary" "$version" "$src" "$srcversion"
|
|
||||||
done
|
|
||||||
printf '===UPDATES===\n'
|
printf '===UPDATES===\n'
|
||||||
if command -v apt >/dev/null 2>&1; then
|
case "$package_manager" in
|
||||||
apt list --upgradable 2>/dev/null | grep -E '^php[^ /]*/' || true
|
apt)
|
||||||
else
|
if command -v apt >/dev/null 2>&1; then
|
||||||
printf 'Package manager not supported\n'
|
apt list --upgradable 2>/dev/null |
|
||||||
fi
|
grep -E '^php[^ /]*/' || true
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
|
||||||
|
dnf)
|
||||||
|
dnf -q --cacheonly check-update 'php*' \
|
||||||
|
2>/dev/null || true
|
||||||
|
;;
|
||||||
|
|
||||||
|
yum)
|
||||||
|
yum -q -C check-update 'php*' \
|
||||||
|
2>/dev/null || true
|
||||||
|
;;
|
||||||
|
|
||||||
|
zypper)
|
||||||
|
zypper --non-interactive --no-refresh \
|
||||||
|
list-updates 2>/dev/null |
|
||||||
|
grep -Ei '(^|[[:space:]|])php' || true
|
||||||
|
;;
|
||||||
|
|
||||||
|
apk)
|
||||||
|
apk version -l '<' 2>/dev/null |
|
||||||
|
grep -E '^php' || true
|
||||||
|
;;
|
||||||
|
|
||||||
|
*)
|
||||||
|
printf 'Update metadata unavailable\n'
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
printf '===PACKAGE_ORIGINS===\n'
|
printf '===PACKAGE_ORIGINS===\n'
|
||||||
if command -v apt-cache >/dev/null 2>&1; then
|
case "$package_manager" in
|
||||||
dpkg-query -W -f='${Package}\n' 'php*' 2>/dev/null | grep -E '^php[0-9.-]*([a-z-]+)?$' | sort -u | while IFS= read -r pkg; do
|
apt)
|
||||||
[ -n "$pkg" ] || continue
|
if command -v apt-cache >/dev/null 2>&1; then
|
||||||
installed=$(dpkg-query -W -f='${Version}' "$pkg" 2>/dev/null || true)
|
dpkg-query -W -f='${Package}\n' 'php*' \
|
||||||
candidate=$(apt-cache policy "$pkg" 2>/dev/null | sed -n 's/^[[:space:]]*Candidate: //p' | head -1)
|
2>/dev/null |
|
||||||
printf '%s installed=%s candidate=%s\n' "$pkg" "$installed" "${candidate:-unknown}"
|
grep -E '^php[0-9.-]*([a-z-]+)?$' |
|
||||||
apt-cache policy "$pkg" 2>/dev/null | grep -E 'https?://|/ubuntu |/ubuntu$' | head -3 | sed 's/^[[:space:]]*/ /'
|
sort -u |
|
||||||
done
|
while IFS= read -r pkg; do
|
||||||
else
|
[ -n "$pkg" ] || continue
|
||||||
printf 'APT metadata unavailable\n'
|
|
||||||
fi
|
installed=$(dpkg-query -W -f='${Version}' \
|
||||||
|
"$pkg" 2>/dev/null || true)
|
||||||
|
|
||||||
|
candidate=$(apt-cache policy "$pkg" 2>/dev/null |
|
||||||
|
sed -n 's/^[[:space:]]*Candidate: //p' |
|
||||||
|
head -1)
|
||||||
|
|
||||||
|
printf '%s installed=%s candidate=%s\n' \
|
||||||
|
"$pkg" "$installed" "${candidate:-unknown}"
|
||||||
|
|
||||||
|
apt-cache policy "$pkg" 2>/dev/null |
|
||||||
|
grep -E 'https?://|/ubuntu |/ubuntu$' |
|
||||||
|
head -3 |
|
||||||
|
sed 's/^[[:space:]]*/ /'
|
||||||
|
done
|
||||||
|
else
|
||||||
|
printf 'APT metadata unavailable\n'
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
|
||||||
|
dnf|yum|rpm|zypper)
|
||||||
|
rpm -qa \
|
||||||
|
--queryformat '%{NAME} installed=%{VERSION}-%{RELEASE} vendor=%{VENDOR}\n' \
|
||||||
|
2>/dev/null |
|
||||||
|
grep -E '^(php|rh-php)' |
|
||||||
|
sort -u || true
|
||||||
|
;;
|
||||||
|
|
||||||
|
apk)
|
||||||
|
printf 'Alpine repositories:\n'
|
||||||
|
|
||||||
|
if [ -r /etc/apk/repositories ]; then
|
||||||
|
grep -v '^[[:space:]]*#' /etc/apk/repositories |
|
||||||
|
grep -v '^[[:space:]]*$'
|
||||||
|
else
|
||||||
|
printf 'Repository metadata unavailable\n'
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
|
||||||
|
*)
|
||||||
|
printf 'Package origins unavailable\n'
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
printf '===DOCKER===\n'
|
printf '===DOCKER===\n'
|
||||||
if ! command -v docker >/dev/null 2>&1; then
|
if ! command -v docker >/dev/null 2>&1; then
|
||||||
printf 'STATUS|not-installed\n'
|
printf 'STATUS|not-installed\n'
|
||||||
|
|||||||
Reference in New Issue
Block a user