
This is the readme for modules. 

It contains a list of the modules in the lsat
package and what they check for.

It also has a premier at the end for creating
modules.

----------------------------------------------------------------------------
Modules in the LSAT package:

checkdotfiles:
- Looks for .forward, .exrc, .rhosts and .netrc files on the system.
- Does not span "other" filesystems. 

checkhostsfiles:
- Reads /etc/hosts.allow and /etc/hosts.deny files
- Checkes deny for ALL:ALL statement.
- Checks allow for any ALL statements.

checkinetd:
- Checks either /etc/inetd.conf or /etc/xinetd.d/* 
- If inetd.conf, it checks for entries not hashed out.
	(All entries should be commented out :)
- If xinetd.d it checks all files in that dir for disable = yes.

checkkbd:
- Checks that the ctrl-alt-del function under linux is disabled.
- If system is Solaris/SunOS checks that STOP-A function is disabled.

checknet:
- checks what ports the system is listening to.
- (may not check _all_ ports. I have to RTFM on this one)

checkrpms:
- Checks list of rpms installed on the system.
- Checks against a list of "should not have" rpms.
- (this list quite possibly needs to be expanded)

checkset:
- Checks system for all setuid/setgid files.
- Also checks for block or char files in /dev/ that do not belong.

checkwrite:
- Checks system for world writable files



-------------------------------------------------------------------------
Writing modules:

All modules are (thus far) written in C. (hopefully ANSI C)
Looking back on this, perhaps it should have been in Python...
or perl or ADA or LISP or <insert your favorite lang here>...

My reasons for C were twofold:
1) I am better at C than any other language. This is not saying much.
   (NOTE: I am not a programmer by trade, but an electrical engineer)
2) Sometimes I install Linux/UNIX w/out those other languages, and
(I think) C is more default installed on UNIX... 

All modules are called from lsatmain.c
All module declerations are in lsatheader.h
A small description of the module is in lsatheader.h

Parameters:
A module (read function) can be passed (as of now) up
to four parameters. They are:

char release[]: basically the first field of "uname -a" output
char kernel[]: basically the third field of "uname -a" output
const char *const out_file: the file that lsat will output checks to
int verbose: integer flag to indicate we should be verbose

A module (in my mind :) should be an independant entity. 
If I were to take a module and stick it in a "main" c function
and pass it whatever parameters listed above it needs it should
function. Properly.

In doing the above I am setting this up to where modules can 
be added or deleted without problems. Having a module depend
on the output of another is not my goal or desire. It may 
run a little slower for some things like this, but one
can customize it whenever and however they see fit with
relative ease.

Having said that... modules should not have to spawn or
fork others. If I find myself (or you find yourself)
writing a _huge_ module that you think needs to spawn
or fork, perhaps there need to be two modules, each called
from lsatmain.c?

Modules should return zero or greater on success and a negative
number on failure. Modules should themselves output error msgs,
not lsatmain.c. (although lsatmain.c will say "Module x failed,
you should have seen errors.", upon recieving a negative number
from a returning module)

Modules should have a small description at the top and _should_
be able to cope with being on different systems (Linux vs
Solaris for instance). Yes I still need to work on mine. :O

I will add more to this when I get some time...

../number9
