57 lines
1.9 KiB
Bash
57 lines
1.9 KiB
Bash
#!/bin/sh
|
||
# Audit: minimal permissions (docs/Минимально_необходимые_полномочия_nginx)
|
||
set -eu
|
||
|
||
REPORT="${REPORT:-/reports/audit.log}"
|
||
|
||
section() { echo "" >> "$REPORT"; echo "=== $1 ===" >> "$REPORT"; echo "=== $1 ==="; }
|
||
|
||
: > "$REPORT"
|
||
echo "Permissions audit $(date -Iseconds)" >> "$REPORT"
|
||
|
||
section "Worker user"
|
||
nginx -T 2>/dev/null | grep '^user ' >> "$REPORT" || true
|
||
ps aux | grep 'nginx:' >> "$REPORT" || true
|
||
|
||
section "Config permissions"
|
||
ls -la /etc/nginx/ >> "$REPORT"
|
||
namei -l /etc/nginx/nginx.conf >> "$REPORT" 2>/dev/null || ls -l /etc/nginx/nginx.conf >> "$REPORT"
|
||
if su -s /bin/sh nginx -c 'test -w /etc/nginx/nginx.conf' 2>/dev/null; then
|
||
echo "FAIL: nginx can write nginx.conf" >> "$REPORT"
|
||
else
|
||
echo "OK: nginx cannot write nginx.conf" >> "$REPORT"
|
||
fi
|
||
|
||
section "Web root permissions"
|
||
ls -la /usr/share/nginx/html/public/ >> "$REPORT"
|
||
if su -s /bin/sh nginx -c 'test -w /usr/share/nginx/html/public/index.html' 2>/dev/null; then
|
||
echo "FAIL: nginx can write web root" >> "$REPORT"
|
||
else
|
||
echo "OK: nginx cannot write web root" >> "$REPORT"
|
||
fi
|
||
|
||
section "TLS certificates and keys"
|
||
ls -la /etc/nginx/ssl/ >> "$REPORT"
|
||
if su -s /bin/sh nginx -c 'cat /etc/nginx/ssl/server.key' 2>/dev/null; then
|
||
echo "FAIL: nginx can read private key" >> "$REPORT"
|
||
else
|
||
echo "OK: nginx cannot read private key" >> "$REPORT"
|
||
fi
|
||
|
||
section "htpasswd"
|
||
ls -la /etc/nginx/htpasswd >> "$REPORT" 2>/dev/null || true
|
||
if su -s /bin/sh nginx -c 'test -w /etc/nginx/htpasswd' 2>/dev/null; then
|
||
echo "FAIL: nginx can write htpasswd" >> "$REPORT"
|
||
else
|
||
echo "OK: nginx cannot write htpasswd" >> "$REPORT"
|
||
fi
|
||
|
||
section "Logs"
|
||
ls -la /var/log/nginx/ >> "$REPORT"
|
||
|
||
section "Temp/cache paths"
|
||
ls -la /var/cache/nginx/ >> "$REPORT" 2>/dev/null || echo "cache dir not yet created" >> "$REPORT"
|
||
nginx -T 2>/dev/null | grep -E 'client_body_temp_path|proxy_temp_path' >> "$REPORT" || true
|
||
|
||
echo "Audit permissions complete -> $REPORT"
|