#!/bin/bash

#DESC auditing security vulnerabilities for redhat. 
#PRDno

#init
OS="`cat /etc/redhat-release | cut -d" " -f6 | cut -d. -f1`"
[ ! -d /usr2/rh_vuln ] && mkdir /usr2/rh_vuln
cd /usr2/rh_vuln
rm -f *ds.xml*

#deps
yum install -y scap-security-guide yara

#CVEs
wget https://security.access.redhat.com/data/metrics/ds/v2/RHEL${OS}/rhel-${OS}.ds.xml.bz2
bunzip2 ./rhel-${OS}.ds.xml.bz2
oscap xccdf eval --results vuln_scan_$(hostname).xml --fetch-remote-resources --report vuln_scan_$(hostname).html ./rhel-${OS}.ds.xml 

#pa-dss
oscap xccdf eval \
--results padss_scan_$(hostname).xml \
--profile xccdf_org.ssgproject.content_profile_pci-dss \
--fetch-remote-resources \
--skip-rule xccdf_org.ssgproject.content_rule_accounts_password_last_change_is_in_past \
--skip-rule xccdf_org.ssgproject.content_rule_accounts_root_gid_zero \
--skip-rule xccdf_org.ssgproject.content_rule_rpm_verify_ownership \
--skip-rule xccdf_org.ssgproject.content_rule_sshd_limit_user_access \
--skip-rule xccdf_org.ssgproject.content_rule_sshd_use_approved_macs \
--skip-rule xccdf_org.ssgproject.content_rule_selinux_state \
--skip-rule xccdf_org.ssgproject.content_rule_package_firewalld_installed \
--skip-rule xccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons \
--skip-rule xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_restricted \
--skip-rule xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_trusted \
--skip-rule xccdf_org.ssgproject.content_rule_sudo_add_use_pty \
--skip-rule xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env \
/usr/share/xml/scap/ssg/content/ssg-rhel${OS}-ds.xml

oscap xccdf generate report --output padss_scan_$(hostname).html padss_scan_$(hostname).xml

#malware

#ssltest

exit $?