0
if [ "$(stat -c "%a" /etc/crontab)" == "644" ]
then
  echo "Is there a vulnerability: No, Permission set on /etc/crontab file is correct."
else
  echo "Is there a vulnerability: Yes, Permission set on /etc/crontab file is incorrect. echo awk -F: $(stat -c "%a" /etc/crontab)"
fi

This is an audit script i am working on, and I would like to output the current Permissions of the /etc/crontab file, if it is not equals to chmod 644. I've tried many methods to no avail. I am doing this in a RHEL 7 server if it matters.

Xavier Lim Jun Yi
  • 1
  • 1
    Where exactly did you notice a problem? – Cyrus Nov 13 '19 at 08:33
  • 1
    `echo "Is there a vulnerability: Yes, Permission set on /etc/crontab file is incorrect. echo awk -F: $(stat -c "%a" /etc/crontab)"`. Should it be `echo "Is there a vulnerability: Yes, Permission set on /etc/crontab file is incorrect : $(stat -c "%a" /etc/crontab)"` ? (without `awk -F:`) – anishsane Nov 13 '19 at 08:36
  • 1
    The code looks fine and works for me. Beside this you should considered using the recommended arithmetic context in `Bash`: `if (( "$(stat -c "%a" /etc/crontab)" == 644 )); then echo "Vulnerability"; fi`. – stephanmg Nov 13 '19 at 08:38
  • 1
    See also https://stackoverflow.com/questions/18668556/comparing-numbers-in-bash. – stephanmg Nov 13 '19 at 08:38
  • 1
    Can you share the output of `stat -c "%a" /etc/crontab` ? Given that this is audit script, might be that the file has more restricted permission than 0644, which should be OK for the audit purpose (e.g., 0600, or even 0400). – dash-o Nov 13 '19 at 09:24

2 Answers2

1

This should be the most correct way to do what you want

#!/bin/bash

if (( $(stat -c "%a" /etc/crontab) == 644 ))
then
  echo "Is there a vulnerability: No, Permission set on /etc/crontab file is correct."
else
  echo "Is there a vulnerability: Yes, Permission set on /etc/crontab file is incorrect: $(stat -c "%a" /etc/crontab)"
fi
franzisk
  • 1,644
  • 13
  • 18
  • That's what I wrote in my comment above, though. – stephanmg Nov 13 '19 at 09:25
  • 1
    Your comment pointed out the numeric compare and it's right, another comment fixed the awk command substitution, also right. This is the whole solution, with the correct syntax, not just one part – franzisk Nov 13 '19 at 09:31
0

When you compare numbers in bash you should use -eq instead of ==. So your if from this:

if [ "$(stat -c "%a" /etc/crontab)" == "644" ]

must be

if [ "$(stat -c "%a" /etc/crontab)" -eq "644" ]

And in this line

 echo "Is there a vulnerability: Yes, Permission set on /etc/crontab file is incorrect. echo awk -F: $(stat -c "%a" /etc/crontab)"

you should remove quotes around %a

Romeo Ninov
  • 5,508
  • 1
  • 20
  • 29