#!/bin/sh

#################################################################################
#
#   Lynis
# ------------------
#
# Copyright 2007-2008, Michael Boelen (michael@rootkit.nl), The Netherlands
# Web site: http://www.rootkit.nl
#
# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
# welcome to redistribute it under the terms of the GNU General Public License.
# See LICENSE file for usage of this software.
#
#################################################################################
#
# Lynis is an automated auditing tool for Unix based operating systems.
#
#################################################################################
#

# Program information
PROGRAM_name="Lynis"
PROGRAM_version="1.1.7"
PROGRAM_releasedate="28 June 2008"
PROGRAM_author="Michael Boelen"
PROGRAM_author_contact="michael@rootkit.nl"
PROGRAM_website="http://www.rootkit.nl/"
PROGRAM_copyright="Copyright 2007-2008 - ${PROGRAM_author}, ${PROGRAM_website}"
PROGRAM_license="${PROGRAM_name} comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
 welcome to redistribute it under the terms of the GNU General Public License.
 See LICENSE file for details about using this software."
 
PROGRAM_extrainfo=""
# Release version (beta || final)
PROGRAM_releasetype="final"
# Version number of report files (when format changes in future)
REPORT_version_major="1"; REPORT_version_minor="0"
REPORT_version="${REPORT_version_major}.${REPORT_version_minor}"

#
#################################################################################
#
# Configure Include path and files
#
#################################################################################
#
    #####
    # Test from which directory we can use all functions and tests
    #####
    
    # Set default to none for later testing
    INCLUDEDIR=""; PLUGINDIR="";
    # Default paths to check (CWD as last option, in case we run from standalone)
    tINCLUDE_TARGETS="/usr/local/include/lynis /usr/local/lynis/include /usr/share/lynis/include ./include"
    tPLUGIN_TARGETS="/usr/local/lynis/plugins /usr/local/share/lynis/plugins /usr/share/lynis/plugins /etc/lynis/plugins ./plugins"
    tDB_TARGETS="/usr/local/share/lynis/db /usr/local/lynis/db /usr/share/lynis/db ./db"
    
    for I in ${tINCLUDE_TARGETS}; do if [ -d ${I} ]; then INCLUDEDIR=${I}; fi; done
    for I in ${tPLUGIN_TARGETS};  do if [ -d ${I} ]; then PLUGINDIR=${I};  fi; done
    for I in ${tDB_TARGETS};      do if [ -d ${I} ]; then DBDIR=${I};      fi; done    
    
    # Drop out if our include directory can't be found
    if [ "${INCLUDEDIR}" = "" ]; then
        echo "Fatal error: can't find include directory"
	echo "Make sure to execute ${PROGRAM_name} from untarred directory or check installation"
        exit 1
    fi

    # Drop out if our plugin directory can't be found
    if [ "${PLUGINDIR}" = "" ]; then
        echo "Fatal error: can't find plugin directory"
	echo "Make sure to execute ${PROGRAM_name} from untarred directory or check installation"
        exit 1
    fi

#
#################################################################################
#
# Consts
# (bin paths, text strings, colors)
#
#################################################################################
#
    . ${INCLUDEDIR}/consts
#
#################################################################################
#
# Include functions, traps
#
#################################################################################
#
    . ${INCLUDEDIR}/functions
    
    trap Maid INT
    
    # Use safe umask for the files we create
    umask 027
#
#################################################################################
#
# Parameter checks
#
#################################################################################
#
    . ${INCLUDEDIR}/parameters

#
#################################################################################
#
# Program information
#
#################################################################################
#
    # CV - Current Version
    PROGRAM_AC=`echo ${PROGRAM_version} | awk '{ print $1 }' | sed 's/[.]//g'`
    DB_MALWARE_CV=`grep "^#version=" ${DBDIR}/malware.db | cut -d '=' -f2`
    DB_FILEPERMS_CV=`grep "^#version=" ${DBDIR}/fileperms.db | cut -d '=' -f2`

    # Number of signatures
    DB_MALWARE_IC=`grep -v "^#" ${DBDIR}/malware.db | wc -l | tr -s ' ' | tr -d ' '`
    
    if [ ${VIEWUPDATEINFO} -eq 1 ]; then
    
	CheckUpdates
	
	echo ""
	echo " == ${WHITE}${PROGRAM_name}${NORMAL} =="
	echo -n "  Version       :   ${PROGRAM_version}"
	if [ ${PROGRAM_LV} -gt ${PROGRAM_AC} ]; then echo " [ ${WARNING}Outdated${NORMAL} ]"; else echo ""; fi
	echo "  Release date  :   ${PROGRAM_releasedate}"; echo ""
	echo " == ${WHITE}Databases${NORMAL} =="
        echo "                    Current          Latest            Status"
        echo "  -----------------------------------------------------------------------------"    
        echo -n "  Malware       :   ${DB_MALWARE_CV}       ${DB_MALWARE_LV}       "
	if [ ${DB_MALWARE_LV} -gt ${DB_MALWARE_CV} ]; then echo "${WARNING}Outdated${NORMAL}"; else echo "${OK}Up-to-date${NORMAL}"; fi
        echo -n "  File perms    :   ${DB_FILEPERMS_CV}       ${DB_FILEPERMS_LV}       "
	if [ ${DB_FILEPERMS_LV} -gt ${DB_FILEPERMS_CV} ]; then echo "${WARNING}Outdated${NORMAL}"; else echo "${OK}Up-to-date${NORMAL}"; fi
	echo ""; echo ""
	echo "${PROGRAM_copyright}"; echo ""
	
	# Quit program
        ExitClean
    fi
#
#################################################################################
#
# Initialize and default settings
#
#################################################################################
#
    if [ "${PROGRAM_releasetype}" = "beta" ]; then
        echo "${YELLOW}"
	echo "  #########################################################"
	echo "  #   BETA SOFTWARE                                       #"
        echo "  #########################################################"
        echo ""
        echo "  Thank you for testing a beta release. Make sure to read"
        echo "  all available documentation before proceeding and/or"
        echo "  requesting support. Due the nature of beta releases, it"
        echo "  is possible new features give unexpected warnings."
    	echo ""
        echo "  Press [ENTER] to continue or [CTRL] + C to break"
        echo ""
        echo "  #########################################################"
        echo "${NORMAL}"; echo ""
        if [ ${NEVERBREAK} -eq 0 ]; then read void; fi
    fi
    
    if [ ${QUIET} -eq 0 ]; then
        echo ""
        echo "${WHITE}[ ${PROGRAM_name} ${PROGRAM_version} ]${NORMAL}"
        echo ""
        echo "################################################################################"
        echo " ${PROGRAM_license}"
        echo ""
        echo " ${PROGRAM_copyright}"
        echo "################################################################################"
    fi
#
#################################################################################
#
    InsertSection "Initializing program"

    # Try to find a default profile file, if none is specified
    if [ "${PROFILE}" = "" ]; then
        tPROFILE_TARGETS="/usr/local/etc/lynis/default.prf /etc/lynis/default.prf ./default.prf"
        for I in ${tPROFILE_TARGETS}; do
            if [ -f ${I} ]; then PROFILE=${I}; fi
	done
    fi
    # Initialize and check profile file, auditor name, log file and report file
    if [ ! -r ${PROFILE} ];		then echo "Fatal error: Can't open profile file (${PROFILE})"; exit 1; fi
    if [ "${AUDITORNAME}" = "" ];	then AUDITORNAME="[Unknown]"; fi
    if [ "${LOGFILE}" = "" ];		then LOGFILE="/var/log/lynis.log"; fi
    if [ "${REPORTFILE}" = "" ];	then REPORTFILE="/var/log/lynis-report.dat"; fi

#
#################################################################################
#
# PID :: Check PID file, to avoid multiple instances running at the same time.
#
#################################################################################
#
    # Check user. We need root to be able to audit and use all required system tools
    if [ ! `id -u` -eq 0 ]; then
        echo "${WARNING}Fatal error${NORMAL}: ${NOTICE}Incorrect UID.${NORMAL}"
        echo "You have to be root (or equivalent) to perform an audit. Please su(do) and try again."
        exit 1
    fi

    # Check PID file
    if [ -f lynis.pid -o -f /var/run/lynis.pid ]; then
        echo "      ${WARNING}Warning${NORMAL}: ${WHITE}PID file exists, probably another Lynis process is running.${NORMAL}"
        echo "      ------------------------------------------------------------------------------"
        echo "      If you are unsure another Lynis process is running currently, you are adviced "
        echo "      to stop current process and check the process list first. If you cancelled"
        echo "      (by using CTRL+C) a previous instance, you can ignore this message."
        echo "      ------------------------------------------------------------------------------"
        echo ""
        echo "      ${YELLOW}Note: ${WHITE}Cancelling the program can leave temporary files behind${NORMAL}"
        echo ""    
        wait_for_keypress
	Display --indent 2 --text "- Deleting old PID file..."
        if [ -f lynis.pid ]; then rm -f lynis.pid
	  elif [ -f /var/run/lynis.pid ]; then rm -f /var/run/lynis.pid; fi
    fi

    # Create new PID file (use work directory if /var/run is not available)
    if [ -d /var/run ]; then PIDFILE="/var/run/lynis.pid"; else PIDFILE="lynis.pid"; fi
    OURPID=`echo $$`
    echo ${OURPID} > ${PIDFILE}
    chmod 600 ${PIDFILE}
#
#################################################################################
#
# Check program parameters
#
#################################################################################
#
    # Bail out if we didn't get any parameter, or incorrect ones
    if [ ${PARAMCOUNT} -eq 0 -o ${WRONGOPTION} -eq 1 -o ${VIEWHELP} -eq 1 ]; then
        #echo "  =================================================="
        echo "  ${WHITE}Valid parameters:${NORMAL}"
        echo "    --auditor \"<name>\"        : Auditor name"
        echo "    --check-all (-c)          : Check system"
        echo "    --check-update            : Check for updates"
	echo "    --no-colors               : Don't use colors in output"
        echo "    --no-log                  : Don't create a log file"
        echo "    --profile <profile>       : Scan the system with the given profile file"
	echo "    --reverse-colors          : Optimize color display for light backgrounds"
        echo "    --quick (-Q)              : Quick mode, don't wait for user input"
        echo "    --view-manpage (--man)    : View man page"
        echo "    --version (-V)            : Display version number and quit"
        echo ""

        if [ ${WRONGOPTION} -eq 1 ]; then
            echo "  ${RED}Error${NORMAL}: ${WHITE}Invalid option ${WRONGOPTION_value}!${NORMAL}"
          else
	    if [ ${VIEWHELP} -eq 0 ]; then
                echo "  ${RED}Error${NORMAL}: ${WHITE}No parameters specified!${NORMAL}"
	    fi
        fi
        echo "  See man page and documentation for all available options."
        echo ""
        echo "Exiting.."
        # Cleanup PID file if we drop out earlier
        RemovePIDFile    
        # Exit with exit code 1
        exit 1
    fi
#
#################################################################################
#
# OS Detection
#
#################################################################################
#
    . ${INCLUDEDIR}/osdetection
    Display --indent 2 --text "- Detecting OS... " --result DONE --color GREEN

    # Hostname
    HOSTNAME=`hostname`
#
#################################################################################
#
# Clear log and report files 
#
#################################################################################
#
    # Clear log file and test if it's writable
    logtext "### Starting ${PROGRAM_name} ${PROGRAM_version} with PID ${OURPID}, build date ${PROGRAM_releasedate} ###" > ${LOGFILE}
    if [ $? -eq 0 ]; then
	Display --indent 2 --text "- Clearing log file (${LOGFILE})... " --result DONE --color GREEN
      else
	Display --indent 2 --text "- Clearing log file (${LOGFILE})... " --result WARNING --color RED
        echo "${WARNING}Fatal error${NORMAL}: problem while writing to log file. Check location and permissions."
	RemovePIDFile    
        exit 1
    fi
    logtext "### ${PROGRAM_copyright} ###"

    # Clear report file (to avoid appending to an existing file)
    echo "# ${PROGRAM_name} Report" > ${REPORTFILE}
    report "[General]"
    report "report_version_major=${REPORT_version_major}"
    report "report_version_minor=${REPORT_version_minor}"
    CDATE=`date "+%H:%M:%S"`
    report "report_datetime=${CDATE}"
    report "auditor=${AUDITORNAME}"
    report "lynis_version=${PROGRAM_version}"
    report "[Operating System]"
    report "os=${OS}"
    report "os_fullname=${OS_FULLNAME}"
    report "hostname=${HOSTNAME}"
#
#################################################################################
#
# Show program information to display
#
#################################################################################
#
    if [ ${QUIET} -eq 0 ]; then
        echo ""
        echo "  ---------------------------------------------------"
        echo "  Program version:           ${PROGRAM_version}"
        echo "  Operating system:          ${OS_NAME}"
        echo "  Operating system version:  ${OS_VERSION}" 
        if [ ! "${OS_MODE}" = "" ]; then echo "  Operating system mode:     ${OS_MODE}"; fi
        echo "  Kernel version:            ${OS_KERNELVERSION}"
        echo "  Hardware platform:         ${HARDWARE}"
        echo "  Hostname:                  ${HOSTNAME}"
        echo "  Auditor:                   ${AUDITORNAME}"
        echo "  Profile:                   ${PROFILE}"
        echo "  Log file:                  ${LOGFILE}"
        echo "  Report file:               ${REPORTFILE}"
        echo "  Report version:            ${REPORT_version}"
        echo "  ---------------------------------------------------"
    fi
    
    logtext "Program version:           ${PROGRAM_version}"
    logtext "Operating system:          ${OS_NAME}"
    logtext "Operating system version:  ${OS_VERSION}"
    if [ ! "${OS_MODE}" = "" ]; then logtext "Operating system mode:     ${OS_MODE}"; fi
    logtext "Kernel version:            ${OS_KERNELVERSION}"
    logtext "Hardware platform:         ${HARDWARE}"
    logtext "Hostname:                  ${HOSTNAME}"
    logtext "Auditor:                   ${AUDITORNAME}"
    logtext "Profile:                   ${PROFILE}"
    logtext "Log file:                  ${LOGFILE}"
    logtext "Report file:               ${REPORTFILE}"
    logtext "Report version:            ${REPORT_version}"
    logtext "-----------------------------------------------------"
    logtext "Include directory:         ${INCLUDEDIR}"
    logtext "Plugin directory:          ${PLUGINDIR}"
    logtext "Database directory:        ${DBDIR}"
    logtextbreak
    wait_for_keypress

#
#################################################################################
#
# Read profile/template/plugins
#
#################################################################################
#
    . ${INCLUDEDIR}/profiles  
#
#################################################################################
#
# Check for program update (people tend to be lazy and don't perform updates =))
#
#################################################################################
#
    logtext "Test: Checking for program update..."

    if [ ${SKIP_UPGRADE_TEST} -eq 1 ]; then
        logtext "Upgrade test skipped due profile option set (skip_upgrade_test)"
        PROGRAM_LV="${PROGRAM_AC}"
      else  
        CheckUpdates
    fi
    if [ "${PROGRAM_AC}" = "" -o "${PROGRAM_LV}" = "" ]; then
        Display --indent 2 --text "- Program update status... " --result UNKNOWN --color YELLOW
        logtext "Result: Update check failed. No connection?"
        # Set both to safe values
        PROGRAM_AC=0; PROGRAM_LV=0
      else
        logtext "Current installed version  : ${PROGRAM_AC}"
        logtext "Latest stable version      : ${PROGRAM_LV}"
        if [ $PROGRAM_LV -gt $PROGRAM_AC ]; then
            Display --indent 2 --text "- Program update status... " --result "UPDATE AVAILABLE" --color YELLOW
	    echo ""
    	    echo "      ==============================================================================="
    	    echo "        ${NOTICE}Notice: ${WHITE}${PROGRAM_name} update available${NORMAL}"
    	    echo "          Current version : ${WHITE}${PROGRAM_AC}${NORMAL}"
    	    echo "          Latest version  : ${WHITE}${PROGRAM_LV}${NORMAL}"
	    echo "          ${WHITE}Please update to the latest version for new options, bug fixes"
	    echo "          audit tests and baselines.${NORMAL}"
    	    echo "      ==============================================================================="
	    echo ""
    	    logtext "Result: newer ${PROGRAM_name} release available!"
	    logtext "Suggestion: update to the latest stable release."
    	    wait_for_keypress
	  else
    	    Display --indent 2 --text "- Program update status... " --result "NO UPDATE" --color GREEN
    	    logtext "No ${PROGRAM_name} update available."
        fi  
    fi

    # YYY add a minimal required version check, to stimulate people to upgrade if they are *really* outdated
    logtextbreak
#
#################################################################################
#
# Check which tools are installed
#
#################################################################################
#
    Display --indent 2 --text "- Scanning available tools..."
    logtext "Start scanning for available audit binaries and tools..."

    for I in ${BINPATHS}; do
      J=${I}"/apache2";      	if [ -f ${J} ]; then HTTPDFOUND=1;    	HTTPDBINARY=${J};   	logtext "Found ${J}";   fi
      J=${I}"/chkconfig"; 	if [ -f ${J} ]; then CHKCONFIGFOUND=1;  CHKCONFIGBINARY=${J};	logtext "Found ${J}";   fi
      J=${I}"/chkrootkit"; 	if [ -f ${J} ]; then CHKROOTKITFOUND=1; CHKROOTKITBINARY=${J};  logtext "Found ${J}";    	fi
      J=${I}"/dig"; 		if [ -f ${J} ]; then DIGFOUND=1; 	DIGBINARY=${J};  	logtext "Found ${J}";    	fi
      J=${I}"/exim";      	if [ -f ${J} ]; then EXIMFOUND=1;	EXIMBINARY=${J};	EXIMVERSION=`${J} -bV | grep 'Exim version' | awk '{ print $3 }' | xargs`; 	logtext "Found ${J} (version ${EXIMVERSION})";		fi
      J=${I}"/find";      	if [ -f ${J} ]; then FINDFOUND=1;	FINDBINARY=${J};	logtext "Found ${J}";     	       	fi
      J=${I}"/grpck";      	if [ -f ${J} ]; then logtext "Found ${J}"; GRPCKFOUND=1;    	 GRPCKBINARY=${J};     	fi
      J=${I}"/httpd";      	if [ -f ${J} ]; then logtext "Found ${J}"; HTTPDFOUND=1;    	 HTTPDBINARY=${J};      fi
      J=${I}"/ip";      	if [ -f ${J} ]; then logtext "Found ${J}"; IPFOUND=1;    	 IPBINARY=${J};      	fi
      J=${I}"/ifconfig";	if [ -f ${J} ]; then logtext "Found ${J}"; IFCONFIGFOUND=1;      IFCONFIGBINARY=${J};   fi
      J=${I}"/iptables";    	if [ -f ${J} ]; then IPTABLESFOUND=1;	 IPTABLESBINARY=${J}; 				logtext "Found ${J}";		fi
      J=${I}"/kldstat";		if [ -f ${J} ]; then logtext "Found ${J}"; KLDSTATFOUND=1;       KLDSTATBINARY=${J};    fi
      J=${I}"/locate";    	if [ -f ${J} ]; then logtext "Found ${J}"; LOCATEFOUND=1;	 LOCATEBINARY=${J};     fi
      J=${I}"/ls";      	if [ -f ${J} ]; then logtext "Found ${J}"; LSFOUND=1;   	 LSBINARY=${J};         fi
      J=${I}"/lsattr";     	if [ -f ${J} ]; then logtext "Found ${J}"; LSATTRFOUND=1;  	 LSATTRBINARY=${J};     fi
      J=${I}"/lsmod";      	if [ -f ${J} ]; then logtext "Found ${J}"; LSMODFOUND=1;    	 LSMODBINARY=${J};      fi
      J=${I}"/lsof";    	if [ -f ${J} ]; then logtext "Found ${J}"; LSOFFOUND=1;    	 LSOFBINARY=${J};       fi
      J=${I}"/lynx";    	if [ -f ${J} ]; then LYNXFOUND=1;	 LYNXBINARY=${J}; 	LYNXVERSION=`${J} -version | grep "^Lynx Version" | cut -d ' ' -f3`;		logtext "Found ${J} (version ${LYNXVERSION})";		fi
      J=${I}"/md5";     	if [ -f ${J} ]; then logtext "Found ${J}"; MD5FOUND=1;     	 MD5BINARY=${J};        fi
      J=${I}"/md5sum";  	if [ -f ${J} ]; then logtext "Found ${J}"; MD5FOUND=1;     	 MD5BINARY=${J};        fi
      J=${I}"/netstat";  	if [ -f ${J} ]; then logtext "Found ${J}"; NETSTATFOUND=1;     	 NETSTATBINARY=${J};    fi
      J=${I}"/nmap";    	if [ -f ${J} ]; then NMAPFOUND=1; 	 NMAPBINARY=${J};   	NMAPVERSION=`${J} -V | grep "^Nmap version" | awk '{ print $3 }'`;	  		logtext "Found ${J} (version ${NMAPVERSION})";      fi
      J=${I}"/openssl";    	if [ -f ${J} ]; then OPENSSLFOUND=1;  	 OPENSSLBINARY=${J};	OPENSSLVERSION=`${J} version | head -n 1 | awk '{ print $2 }' | xargs`;		 logtext "Found ${J} (version ${OPENSSLVERSION})";	fi
      J=${I}"/perl";        	if [ -f ${J} ]; then PERLFOUND=1;	 PERLBINARY=${J};	PERLVERSION=`${J} -V:version | ${J} -pi -e "s/^version='(.*)';$/\1/" | xargs`;   logtext "Found ${J} (version ${PERLVERSION})";		fi
      J=${I}"/postconf";   	if [ -f ${J} ]; then logtext "Found ${J}"; POSTCONFFOUND=1; 	 POSTCONFBINARY=${J};   fi
      J=${I}"/postfix";   	if [ -f ${J} ]; then logtext "Found ${J}"; POSTFIXFOUND=1; 	 POSTFIXBINARY=${J};    fi
      J=${I}"/prelink";   	if [ -f ${J} ]; then logtext "Found ${J}"; PRELINKFOUND=1; 	 PRELINKBINARY=${J};    fi
      J=${I}"/ps";      	if [ -f ${J} ]; then logtext "Found ${J}"; PSFOUND=1;      	 PSBINARY=${J};         fi
      J=${I}"/rkhunter";   	if [ -f ${J} ]; then logtext "Found ${J}"; RKHUNTERFOUND=1;	 RKHUNTERBINARY=${J};        fi    
      J=${I}"/rpm";    		if [ -f ${J} ]; then logtext "Found ${J}"; RPMFOUND=1;	 	 RPMBINARY=${J};        fi  
      J=${I}"/slocate";    	if [ -f ${J} ]; then logtext "Found ${J}"; LOCATEFOUND=1;	 LOCATEBINARY=${J};     fi
      J=${I}"/sockstat";   	if [ -f ${J} ]; then logtext "Found ${J}"; SOCKSTATFOUND=1;	 SOCKSTATBINARY=${J};   fi
      J=${I}"/stat"; 		if [ -f ${J} ]; then logtext "Found ${J}"; STATFOUND=1;	   	 STATBINARY=${J};       fi
      J=${I}"/sshd"; 		if [ -f ${J} ]; then SSHDFOUND=1;	 SSHDBINARY=${J};	SSHDVERSION=`${J} -t -d 2>&1 | head -n 1 | awk '{ print $4 }' | cut -d '_' -f2 | xargs`; logtext "Found ${J} (version ${SSHDVERSION})";		fi
      J=${I}"/strings"; 	if [ -f ${J} ]; then logtext "Found ${J}"; STRINGSFOUND=1; 	 STRINGSBINARY=${J};    fi
      J=${I}"/syslog-ng";	if [ -x ${J} ]; then SYSLOGNGFOUND=1;	SYSLOGNGBINARY=${J};	SYSLOGNGVERSION=`${J} -V 2>&1 | grep "^syslog-ng" | awk '{ print $2 }'`		logtext "Found ${J} (version ${SYSLOGNGVERSION})";		fi
      J=${I}"/wget";    	if [ -f ${J} ]; then WGETFOUND=1;    	 WGETBINARY=${J}; 	WGETVERSION=`${J} -V | grep "^GNU Wget" | awk '{ print $3 }'`;  		logtext "Found ${J} (version ${WGETVERSION})";			fi
    done

#
#################################################################################
#
    # Test sections
    INCLUDE_TESTS="boot_services kernel memory_processes authentication shells \
                   filesystems storage ports_packages networking printers_spools \
		   mail_messaging file_integrity firewalls nameserver webservers \
		   databases ldap php malware file_permissions homedirs logging \
		   banners scheduling accounting time crypto virtualization \
		   auditing hardening"

    # Include available tests
    for INCLUDE_TEST in ${INCLUDE_TESTS}; do
      . ${INCLUDEDIR}/tests_${INCLUDE_TEST}
    done
#
#################################################################################
#
    # Custom tests
    if [ -f ${INCLUDEDIR}/tests_custom ]; then . ${INCLUDEDIR}/tests_custom; fi
#
#################################################################################
#
# Show test results overview
#
#################################################################################
#
    # Store total performed tests
    report "lynis_tests_done=${CTESTS_PERFORMED}"
    
    # Only show overview if not running in quiet mode
    if [ ${QUIET} -eq 0 ]; then
        echo ""; echo "================================================================================"
        echo ""; echo "  -[ ${WHITE}${PROGRAM_name} ${PROGRAM_version} Results${NORMAL} ]-"
        echo ""; echo "  ${SECTION}Tests performed${NORMAL}: ${CTESTS_PERFORMED}"
    
        # Show warnings from logfile
        SWARNINGS=`cat ${LOGFILE} | grep -i 'warning:' | sed 's/ /!space!/g'`

        if [ "${SWARNINGS}" = "" ]; then
	    echo ""; echo "  ${OK}No warnings${NORMAL}"; echo ""
          else
            echo "  ${WARNING}Warnings${NORMAL}:"
            echo "  ----------------------------"
            for WARNING in ${SWARNINGS}; do
                SHOWWARNING=`echo ${WARNING} | sed 's/!space!/ /g'`
                echo "   - ${SHOWWARNING}"
            done
        fi

        echo "================================================================================"
        echo "  ${SECTION}Files${NORMAL}:"
        echo "  - Test and debug information      : ${WHITE}${LOGFILE}${NORMAL}."
        echo "  - Report data                     : ${WHITE}${REPORTFILE}${NORMAL}."
        echo "================================================================================"
        if [ $PROGRAM_LV -gt $PROGRAM_AC ]; then
            echo "  ${NOTICE}Notice: ${WHITE}${PROGRAM_name} update available${NORMAL}"
            echo "  Current version : ${WHITE}${PROGRAM_AC}${NORMAL}    Latest version : ${WHITE}${PROGRAM_LV}${NORMAL}"
            echo "================================================================================"
        fi
        echo "  ${PROGRAM_name} ${PROGRAM_version}"
        echo "  ${PROGRAM_copyright}"
        echo "================================================================================"
        echo ""; echo ""
    fi

    logtext "================================================================================"
    logtext "Tests performed:     ${CTESTS_PERFORMED}"
    logtext "Total tests:         ${TOTAL_TESTS}"
    logtext "================================================================================"
    logtext "${PROGRAM_name} ${PROGRAM_version}"
    logtext "${PROGRAM_copyright}"
    logtext "Program ended successfully"

    # Delete PID file
    RemovePIDFile

    # The End
    exit 0

###########################################################################
##%HASH-SHA1%----------------------------%
###########################################################################

#
#================================================================================
# Lynis - Copyright 2007-2008, Michael Boelen - www.rootkit.nl - The Netherlands
