#!/bin/bash

# =============================
# Check vulnerabilities
#
# echo "polkit vulnerability"
result=$(ls -l /usr/bin/pkexec)
if [[ ${result:0:10} == '-rwxr-xr-x' ]]; then
echo "polkit vulneability fixed"
else
echo "polkit vulneability not fixed"
fi
if [[ ${result:0:10} != '*s*' ]]; then
echo "polkit vulneability fixed"
else
echo "polkit vulneability not fixed"
fi

# echo "NFS share vulnerability"
#result=$(exportfs -v)
#if [ -z "$result" ]; then
#echo "NFS share vulnerability is fixed"
#else
#echo "NFS share vulnerability is not fixed"
#fi
result=$(cat /root/.profile | grep exportfs)
if [ "$result" == "exportfs -ua" ]; then
echo "NFS share vulnerability is fixed"
else
echo "NFS share vulnerability is not fixed"
fi

result=$(tsinode)

if grep -q "servers are down" <<< "$result"; then
 echo "Node.js not running"
elif grep -q "/usr/local/bin/redis-server" <<< "$result"; then

 result=$(redis-cli auth ROSSTSI4000)
 expected='no password is set'
 if [[ "$result" == "$expected" ]]; then
  echo "Unsecured Redis vulnerability is NOT fixed (1)"
  exit
 fi

 result=$(redis-cli auth ROSSTSI4000)
 if [ "$result" == "OK" ]; then
  echo "Unsecured Redis vulnerability is fixed"
 else
  echo "Unsecured Redis vulnerability NOT is fixed (2)"
 fi

 result=$(redis-cli auth test)
 expected='WRONGPASS'
 if [[ "$result" == *"$expected"* ]]; then
  echo "Unsecured Redis vulnerability is fixed"
 else
  echo "Unsecured Redis vulnerability NOT is fixed (3)"
 fi
 
else
 echo "Node.js is offline: use 'tsinode on"
fi

#result=$(redis-cli auth ROSSTSI4000)
#if [ "$result" == "*refused*" ]; then
#echo "Node.js is not running"
#elif [ "$result" == "*/usr/local/bin/redis-server*" ]; then
#echo ""
#fi

exit

# check for NFS export
cat /root/.profile | grep exportfs
exportfs -v
# check for polkit vulnerability
ls -l /usr/bin/pkexec
# check for Redis Server Unprotected by Password Authentication
redis-cli auth ROSSTSI4000


