From 53f097c2af2d7e2b36d078f96d23a1f0facc9c5a Mon Sep 17 00:00:00 2001 From: Dominick Bellizzi Date: Fri, 6 Dec 2019 14:49:36 -0800 Subject: [PATCH 01/11] Add "access-analyzer:ListTagsForResource" to prowler-additions-policy.json check extra769 (Check if IAM Access Analyzer is enabled and its findings) requires this IAM permission --- iam/prowler-additions-policy.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/iam/prowler-additions-policy.json b/iam/prowler-additions-policy.json index c706b6f487..ef6cc42c53 100644 --- a/iam/prowler-additions-policy.json +++ b/iam/prowler-additions-policy.json @@ -3,6 +3,7 @@ "Statement": [ { "Action": [ + "access-analyzer:ListTagsForResource", "apigateway:get*", "apigatewayv2:get*", "aws-marketplace:viewsubscriptions", @@ -103,4 +104,4 @@ "Resource": "*" } ] -} \ No newline at end of file +} From 2da125ff8b6585563ebd7c6d4d86dff9f7e0c35e Mon Sep 17 00:00:00 2001 From: JohnVonNeumann Date: Thu, 12 Dec 2019 11:28:52 +1100 Subject: [PATCH 02/11] UPDATE README.md - fix incorrect group flag To run prowler with the cislevelx group you use '-g', not '-c' --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index c1bbfdbc9d..8ce7773e25 100644 --- a/README.md +++ b/README.md @@ -179,7 +179,7 @@ This script has been written in bash using AWS-CLI and it works in Linux and OSX ./prowler -M mono | aws s3 cp - s3://bucket-name/prowler-report.txt ``` -1. To perform an assessment based on CIS Profile Definitions you can use cislevel1 or cislevel2 with `-c` flag, more information about this [here, page 8](https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf): +1. To perform an assessment based on CIS Profile Definitions you can use cislevel1 or cislevel2 with `-g` flag, more information about this [here, page 8](https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf): ```sh ./prowler -g cislevel1 From 559b0585dc663dc3a9a6a673ffca401966ac3f2c Mon Sep 17 00:00:00 2001 From: Nimrod Kor Date: Thu, 12 Dec 2019 09:42:42 +0200 Subject: [PATCH 03/11] Add trail count to check21 and fail if no trail exist (cherry picked from commit fcf28dfa70fb93df9f61393b8dff2cc5fc14729e) --- checks/check21 | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/checks/check21 b/checks/check21 index 64b82ebcce..383578e3d2 100644 --- a/checks/check21 +++ b/checks/check21 @@ -15,19 +15,25 @@ CHECK_TYPE_check21="LEVEL1" CHECK_ALTERNATE_check201="check21" check21(){ + trail_count=0 # "Ensure CloudTrail is enabled in all regions (Scored)" for regx in $REGIONS; do LIST_OF_TRAILS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].Name' --output text --no-include-shadow-trails) if [[ $LIST_OF_TRAILS ]];then for trail in $LIST_OF_TRAILS;do - MULTIREGION_TRAIL_STATUS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].IsMultiRegionTrail' --output text --trail-name-list $trail) - if [[ "$MULTIREGION_TRAIL_STATUS" == 'False' ]];then - textFail "$trail trail in $regx is not enabled in multi region mode" - else - textPass "$trail trail in $regx is enabled for all regions" - fi + trail_count=$((trail_count + 1)) + MULTIREGION_TRAIL_STATUS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $regx --query 'trailList[*].IsMultiRegionTrail' --output text --trail-name-list $trail) + if [[ "$MULTIREGION_TRAIL_STATUS" == 'False' ]];then + textFail "$trail trail in $regx is not enabled in multi region mode" + else + textPass "$trail trail in $regx is enabled for all regions" + fi done fi done + + if [[ $trail_count == 0 ]]; then + textFail "No CloudTrail trails were found in the account" + fi } From 3b264d556bd7da1ae375f06b3e956fa3043c66d3 Mon Sep 17 00:00:00 2001 From: Kinnaird McQuade Date: Thu, 12 Dec 2019 11:07:14 -0500 Subject: [PATCH 04/11] Added check_extra770, which checks for internet facing instances with an Instance Profile attached. --- checks/check_extra770 | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 checks/check_extra770 diff --git a/checks/check_extra770 b/checks/check_extra770 new file mode 100644 index 0000000000..f39de56471 --- /dev/null +++ b/checks/check_extra770 @@ -0,0 +1,35 @@ +#!/usr/bin/env bash + +# Prowler - the handy cloud security tool (copyright 2018) by Toni de la Fuente +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may not +# use this file except in compliance with the License. You may obtain a copy +# of the License at http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. +CHECK_ID_extra770="7.70" +CHECK_TITLE_extra770="[extra770] Check for internet facing EC2 instances with Instance Profiles attached (Not Scored) (Not part of CIS benchmark)" +CHECK_SCORED_extra770="NOT_SCORED" +CHECK_TYPE_extra770="EXTRA" +CHECK_ALTERNATE_check770="extra770" + +extra770(){ + # "Check for internet facing EC2 Instances (Not Scored) (Not part of CIS benchmark)" + textInfo "Looking for instances in all regions... " + for regx in $REGIONS; do + LIST_OF_PUBLIC_INSTANCES_WITH_INSTANCE_PROFILES=$($AWSCLI ec2 describe-instances $PROFILE_OPT --region $regx --query 'Reservations[*].Instances[?((IamInstanceProfile!=`null` && PublicIpAddress!=`null`))].[InstanceId,PublicIpAddress,IamInstanceProfile.Arn]' --output text) + if [[ $LIST_OF_PUBLIC_INSTANCES_WITH_INSTANCE_PROFILES ]];then + while read -r instance;do + INSTANCE_ID=$(echo $instance | awk '{ print $1; }') + PUBLIC_IP=$(echo $instance | awk '{ print $2; }') + INSTANCE_PROFILE=$(echo $instance | awk '{ print $3; }') + textFail "$regx: Instance: $INSTANCE_ID at IP: $PUBLIC_IP is internet-facing with Instance Profile $INSTANCE_PROFILE" "$regx" + done <<< "$LIST_OF_PUBLIC_INSTANCES_WITH_INSTANCE_PROFILES" + else + textPass "$regx: no Internet Facing EC2 Instances with Instance Profiles found" "$regx" + fi + done +} From 7cb869ad3337828fdd58b824ff22931f68501cf7 Mon Sep 17 00:00:00 2001 From: Dominick Bellizzi Date: Thu, 12 Dec 2019 09:36:19 -0800 Subject: [PATCH 05/11] use more generic access-analyzer:List* --- iam/prowler-additions-policy.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/iam/prowler-additions-policy.json b/iam/prowler-additions-policy.json index ef6cc42c53..c95b05f202 100644 --- a/iam/prowler-additions-policy.json +++ b/iam/prowler-additions-policy.json @@ -3,7 +3,7 @@ "Statement": [ { "Action": [ - "access-analyzer:ListTagsForResource", + "access-analyzer:List*", "apigateway:get*", "apigatewayv2:get*", "aws-marketplace:viewsubscriptions", From 8e1aa17a800c410695fda230f2548f23b750105f Mon Sep 17 00:00:00 2001 From: Nimrod Kor Date: Sun, 15 Dec 2019 15:53:46 +0200 Subject: [PATCH 06/11] Fix check26 - get the account ID from sts (cherry picked from commit ae20d9c5b770ac593e64fa399fde55312d97ae1c) --- checks/check26 | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/checks/check26 b/checks/check26 index 133a4176d8..41281b5646 100644 --- a/checks/check26 +++ b/checks/check26 @@ -18,10 +18,10 @@ check26(){ # "Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket (Scored)" CLOUDTRAILS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].Name' --output text| tr '\011' '\012' | awk -F: '{print $1}') + ACCOUNT_ID=$($AWSCLI sts get-caller-identity --output json $PROFILE_OPT --region $REGION --query "Account" | tr -d '"') if [[ $CLOUDTRAILS ]];then for trail in $CLOUDTRAILS; do - CLOUDTRAIL_LOGGROUP_REGION=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].TrailARN' --output text | tr '\011' '\012' | grep "$trail" | awk -F: '{ print $4 }' | head -n 1) CLOUDTRAIL_ACCOUNT_ID=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].TrailARN' --output text | tr '\011' '\012' | grep "$trail" | awk -F: '{ print $5 }' | head -n 1) CLOUDTRAILBUCKET=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region $REGION --query 'trailList[*].[Name, S3BucketName]' --output text | tr '\011' ':' | grep "$trail" | awk -F: '{ print $2 }' ) @@ -29,12 +29,12 @@ check26(){ bucket=$CLOUDTRAILBUCKET if [ "$CLOUDTRAIL_ACCOUNT_ID" == "$ACCOUNT_ID" ];then CLOUDTRAILBUCKET_LOGENABLED=$($AWSCLI s3api get-bucket-logging --bucket $bucket $PROFILE_OPT --region $REGION --query 'LoggingEnabled.TargetBucket' --output text|grep -v None) - fi - if [[ $CLOUDTRAILBUCKET_LOGENABLED ]];then - textPass "Bucket access logging enabled in CloudTrail S3 bucket $bucket for $trail" - elif [ "$CLOUDTRAIL_ACCOUNT_ID" == "$ACCOUNT_ID" ];then - textFail "Bucket access logging is not enabled in CloudTrail S3 bucket $bucket for $trail" - else + if [[ $CLOUDTRAILBUCKET_LOGENABLED ]];then + textPass "Bucket access logging enabled in CloudTrail S3 bucket $bucket for $trail" + else + textFail "Bucket access logging is not enabled in CloudTrail S3 bucket $bucket for $trail" + fi + else textInfo "CloudTrail S3 bucket $bucket for trail $trail is not in current account" fi From 2d5d5516969eac01bbf175bcf3787994e22dc1aa Mon Sep 17 00:00:00 2001 From: Nimrod Kor Date: Sun, 15 Dec 2019 16:50:26 +0200 Subject: [PATCH 07/11] Initial commit --- checks/check_extra771 | 74 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 checks/check_extra771 diff --git a/checks/check_extra771 b/checks/check_extra771 new file mode 100644 index 0000000000..26c5fbcf2e --- /dev/null +++ b/checks/check_extra771 @@ -0,0 +1,74 @@ +#!/usr/bin/env bash + +# Prowler - the handy cloud security tool (copyright 2018) by Toni de la Fuente +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may not +# use this file except in compliance with the License. You may obtain a copy +# of the License at http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. +CHECK_ID_extra734="7.34" +CHECK_TITLE_extra734="[extra734] Check if S3 buckets have default encryption (SSE) enabled or use a bucket policy to enforce it (Not Scored) (Not part of CIS benchmark)" +CHECK_SCORED_extra734="NOT_SCORED" +CHECK_TYPE_extra734="EXTRA" +CHECK_ALTERNATE_check734="extra734" + +extra734(){ + LIST_OF_BUCKETS=$($AWSCLI s3api list-buckets $PROFILE_OPT --query Buckets[*].Name --output text|xargs -n1) + if [[ $LIST_OF_BUCKETS ]]; then + for bucket in $LIST_OF_BUCKETS;do + + # For this test to pass one of the following must be present: + # - Configure ServerSideEncryptionConfiguration rule for AES256 or aws:kms + # OR + # - Have bucket policy denying s3:PutObject when s3:x-amz-server-side-encryption is absent + + # query to get if has encryption enabled or not + RESULT=$($AWSCLI s3api get-bucket-encryption $PROFILE_OPT --bucket $bucket --query ServerSideEncryptionConfiguration.Rules[].ApplyServerSideEncryptionByDefault[].SSEAlgorithm --output text 2>&1) + if [[ $(echo "$RESULT" | grep AccessDenied) ]]; then + textFail "Access Denied Trying to Get Encryption for $bucket" + continue + fi + + if [[ $RESULT == "AES256" || $RESULT == "aws:kms" ]]; + then + textPass "Bucket $bucket is enabled for default encryption with $RESULT" + continue + fi + + TEMP_SSE_POLICY_FILE=$(mktemp -t prowler-${ACCOUNT_NUM}-${bucket}.policy.XXXXXXXXXX) + + # get bucket policy + $AWSCLI s3api get-bucket-policy $PROFILE_OPT --bucket $bucket --output text --query Policy > $TEMP_SSE_POLICY_FILE 2> /dev/null + if [[ $(grep AccessDenied $TEMP_SSE_POLICY_FILE) ]]; then + textFail "Access Denied Trying to Get Bucket Policy for $bucket" + rm -fr $TEMP_SSE_POLICY_FILE + continue + fi + if [[ $(grep NoSuchBucketPolicy $TEMP_SSE_POLICY_FILE) ]]; then + textFail "No bucket policy for $bucket" + rm -fr $TEMP_SSE_POLICY_FILE + continue + fi + + # check if the S3 policy forces SSE s3:x-amz-server-side-encryption:true + CHECK_BUCKET_SSE_POLICY_PRESENT=$(cat $TEMP_SSE_POLICY_FILE | jq --arg arn "arn:aws:s3:::${bucket}/*" '.Statement[]|select(.Effect=="Deny" and ((.Principal|type == "object") and .Principal.AWS == "*") or ((.Principal|type == "string") and .Principal == "*") and .Action=="s3:PutObject" and .Resource==$arn and .Condition.StringEquals."s3:x-amz-server-side-encryption" != null)') + if [[ $CHECK_BUCKET_SSE_POLICY_PRESENT == "" ]]; then + textFail "Bucket $bucket does not enforce encryption!" + rm -fr $TEMP_SSE_POLICY_FILE + continue + fi + CHECK_BUCKET_SSE_POLICY_VALUE=$(echo "$CHECK_BUCKET_SSE_POLICY_PRESENT" | jq -r '.Condition.StringNotEquals."s3:x-amz-server-side-encryption"') + + textPass "Bucket $bucket has S3 bucket policy to enforce encryption with $CHECK_BUCKET_SSE_POLICY_VALUE" + + rm -fr $TEMP_SSE_POLICY_FILE + done + + else + textInfo "No S3 Buckets found" + fi +} From 7e803bb6a9df00f49af4907bbc1a4807334cf5f6 Mon Sep 17 00:00:00 2001 From: Nimrod Kor Date: Sun, 15 Dec 2019 18:14:29 +0200 Subject: [PATCH 08/11] Change to check 771 --- checks/check_extra771 | 67 +++++++++++-------------------------------- 1 file changed, 16 insertions(+), 51 deletions(-) diff --git a/checks/check_extra771 b/checks/check_extra771 index 26c5fbcf2e..943bbffe61 100644 --- a/checks/check_extra771 +++ b/checks/check_extra771 @@ -10,62 +10,27 @@ # under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR # CONDITIONS OF ANY KIND, either express or implied. See the License for the # specific language governing permissions and limitations under the License. -CHECK_ID_extra734="7.34" -CHECK_TITLE_extra734="[extra734] Check if S3 buckets have default encryption (SSE) enabled or use a bucket policy to enforce it (Not Scored) (Not part of CIS benchmark)" -CHECK_SCORED_extra734="NOT_SCORED" -CHECK_TYPE_extra734="EXTRA" -CHECK_ALTERNATE_check734="extra734" +CHECK_ID_extra771="7.71" +CHECK_TITLE_extra771="[extra771] Check if S3 buckets have policies which allow WRITE access (Not Scored) (Not part of CIS benchmark)" +CHECK_SCORED_extra771="NOT_SCORED" +CHECK_TYPE_extra771="EXTRA" +CHECK_ALTERNATE_check771="extra771" -extra734(){ +extra771(){ LIST_OF_BUCKETS=$($AWSCLI s3api list-buckets $PROFILE_OPT --query Buckets[*].Name --output text|xargs -n1) if [[ $LIST_OF_BUCKETS ]]; then for bucket in $LIST_OF_BUCKETS;do - - # For this test to pass one of the following must be present: - # - Configure ServerSideEncryptionConfiguration rule for AES256 or aws:kms - # OR - # - Have bucket policy denying s3:PutObject when s3:x-amz-server-side-encryption is absent - - # query to get if has encryption enabled or not - RESULT=$($AWSCLI s3api get-bucket-encryption $PROFILE_OPT --bucket $bucket --query ServerSideEncryptionConfiguration.Rules[].ApplyServerSideEncryptionByDefault[].SSEAlgorithm --output text 2>&1) - if [[ $(echo "$RESULT" | grep AccessDenied) ]]; then - textFail "Access Denied Trying to Get Encryption for $bucket" - continue + BUCKET_POLICY_STATEMENTS=$($AWSCLI s3api $PROFILE_OPT get-bucket-policy --bucket $bucket --output json --query Policy 2>&1) + if [[ $BUCKET_POLICY_STATEMENTS == *GetBucketPolicy* ]]; then + textInfo "Bucket policy does not exist for bucket $bucket" + else + BUCKET_POLICY_BAD_STATEMENTS=$(echo $BUCKET_POLICY_STATEMENTS | jq --arg arn "arn:aws:s3:::$bucket" 'fromjson | .Statement[]|select(.Effect=="Allow" and (((.Principal|type == "object") and .Principal.AWS == "*") or ((.Principal|type == "string") and .Principal == "*")) and (.Action|startswith("s3:Put") or startswith("s3:*")))') + if [[ $BUCKET_POLICY_BAD_STATEMENTS != "" ]]; then + textFail "Bucket $bucket allows public write: $BUCKET_POLICY_BAD_STATEMENTS" + else + textPass "Bucket $bucket has S3 bucket policy which does not allow public write access" + fi fi - - if [[ $RESULT == "AES256" || $RESULT == "aws:kms" ]]; - then - textPass "Bucket $bucket is enabled for default encryption with $RESULT" - continue - fi - - TEMP_SSE_POLICY_FILE=$(mktemp -t prowler-${ACCOUNT_NUM}-${bucket}.policy.XXXXXXXXXX) - - # get bucket policy - $AWSCLI s3api get-bucket-policy $PROFILE_OPT --bucket $bucket --output text --query Policy > $TEMP_SSE_POLICY_FILE 2> /dev/null - if [[ $(grep AccessDenied $TEMP_SSE_POLICY_FILE) ]]; then - textFail "Access Denied Trying to Get Bucket Policy for $bucket" - rm -fr $TEMP_SSE_POLICY_FILE - continue - fi - if [[ $(grep NoSuchBucketPolicy $TEMP_SSE_POLICY_FILE) ]]; then - textFail "No bucket policy for $bucket" - rm -fr $TEMP_SSE_POLICY_FILE - continue - fi - - # check if the S3 policy forces SSE s3:x-amz-server-side-encryption:true - CHECK_BUCKET_SSE_POLICY_PRESENT=$(cat $TEMP_SSE_POLICY_FILE | jq --arg arn "arn:aws:s3:::${bucket}/*" '.Statement[]|select(.Effect=="Deny" and ((.Principal|type == "object") and .Principal.AWS == "*") or ((.Principal|type == "string") and .Principal == "*") and .Action=="s3:PutObject" and .Resource==$arn and .Condition.StringEquals."s3:x-amz-server-side-encryption" != null)') - if [[ $CHECK_BUCKET_SSE_POLICY_PRESENT == "" ]]; then - textFail "Bucket $bucket does not enforce encryption!" - rm -fr $TEMP_SSE_POLICY_FILE - continue - fi - CHECK_BUCKET_SSE_POLICY_VALUE=$(echo "$CHECK_BUCKET_SSE_POLICY_PRESENT" | jq -r '.Condition.StringNotEquals."s3:x-amz-server-side-encryption"') - - textPass "Bucket $bucket has S3 bucket policy to enforce encryption with $CHECK_BUCKET_SSE_POLICY_VALUE" - - rm -fr $TEMP_SSE_POLICY_FILE done else From fc3f4e830e4489b68270ef194d7cac65ddd67ddb Mon Sep 17 00:00:00 2001 From: Nimrod Kor Date: Tue, 17 Dec 2019 09:29:06 +0200 Subject: [PATCH 09/11] Reuse ACCOUNT_NUM --- checks/check26 | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/checks/check26 b/checks/check26 index 41281b5646..0c6dfa0c3b 100644 --- a/checks/check26 +++ b/checks/check26 @@ -18,7 +18,6 @@ check26(){ # "Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket (Scored)" CLOUDTRAILS=$($AWSCLI cloudtrail describe-trails $PROFILE_OPT --region "$REGION" --query 'trailList[*].Name' --output text| tr '\011' '\012' | awk -F: '{print $1}') - ACCOUNT_ID=$($AWSCLI sts get-caller-identity --output json $PROFILE_OPT --region $REGION --query "Account" | tr -d '"') if [[ $CLOUDTRAILS ]];then for trail in $CLOUDTRAILS; do @@ -27,7 +26,7 @@ check26(){ if [[ $CLOUDTRAILBUCKET ]];then bucket=$CLOUDTRAILBUCKET - if [ "$CLOUDTRAIL_ACCOUNT_ID" == "$ACCOUNT_ID" ];then + if [ "$CLOUDTRAIL_ACCOUNT_ID" == "$ACCOUNT_NUM" ];then CLOUDTRAILBUCKET_LOGENABLED=$($AWSCLI s3api get-bucket-logging --bucket $bucket $PROFILE_OPT --region $REGION --query 'LoggingEnabled.TargetBucket' --output text|grep -v None) if [[ $CLOUDTRAILBUCKET_LOGENABLED ]];then textPass "Bucket access logging enabled in CloudTrail S3 bucket $bucket for $trail" From 39c7ea52c67e7b30898b7db0616b983175116718 Mon Sep 17 00:00:00 2001 From: Toni de la Fuente Date: Tue, 17 Dec 2019 10:37:14 +0100 Subject: [PATCH 10/11] Add feature custom checks folder issue #439 --- prowler | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/prowler b/prowler index fb60a32f41..437b72941c 100755 --- a/prowler +++ b/prowler @@ -74,12 +74,13 @@ USAGE: -b do not print Prowler banner -V show version number & exit -s show scoring report + -x specify external directory with custom checks (i.e. /my/own/checks, files must start by "check") -h this help " exit } -while getopts ":hlLkp:r:c:g:f:m:M:E:enbVs" OPTION; do +while getopts ":hlLkp:r:c:g:f:m:M:E:enbVsx:" OPTION; do case $OPTION in h ) usage @@ -136,6 +137,9 @@ while getopts ":hlLkp:r:c:g:f:m:M:E:enbVs" OPTION; do s ) SCORING=1 ;; + x ) + EXTERNAL_CHECKS_PATH=$OPTARG + ;; : ) echo "" echo "$OPTRED ERROR!$OPTNORMAL -$OPTARG requires an argument" @@ -185,6 +189,13 @@ for checks in $(ls $PROWLER_DIR/checks/check*|grep -v check_sample); do . "$checks" done +# include checks if external folder is specified +if [[ $EXTERNAL_CHECKS_PATH ]]; then + for checks in $(ls $EXTERNAL_CHECKS_PATH/check*); do + . "$checks" + done +fi + # Function to show the title of the check # using this way instead of arrays to keep bash3 (osx) and bash4(linux) compatibility show_check_title() { From d2b3e5ecdc85a99cc0c213d105f24f6232d5fc65 Mon Sep 17 00:00:00 2001 From: Toni de la Fuente Date: Tue, 17 Dec 2019 10:44:38 +0100 Subject: [PATCH 11/11] Added new checks to extras group --- groups/group7_extras | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/groups/group7_extras b/groups/group7_extras index c9eaa5ad63..12afb988ee 100644 --- a/groups/group7_extras +++ b/groups/group7_extras @@ -15,7 +15,7 @@ GROUP_ID[7]='extras' GROUP_NUMBER[7]='7.0' GROUP_TITLE[7]='Extras - [extras] **********************************************' GROUP_RUN_BY_DEFAULT[7]='Y' # run it when execute_all is called -GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733,extra734,extra735,extra736,extra737,extra738,extra739,extra740,extra741,extra742,extra743,extra744,extra745,extra746,extra747,extra748,extra749,extra750,extra751,extra752,extra753,extra754,extra755,extra756,extra757,extra758,extra761,extra762,extra763,extra764,extra765,extra766,extra767,extra768,extra769' +GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733,extra734,extra735,extra736,extra737,extra738,extra739,extra740,extra741,extra742,extra743,extra744,extra745,extra746,extra747,extra748,extra749,extra750,extra751,extra752,extra753,extra754,extra755,extra756,extra757,extra758,extra761,extra762,extra763,extra764,extra765,extra766,extra767,extra768,extra769,extra770,extra771' # Extras 759 and 760 (lambda variables and code secrets finder are not included) # to run detect-secrets use `./prowler -g secrets`