Skip to content

Import Linux content #23

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Jwalker107 merged 3 commits into from
Sep 17, 2026
Merged

Import Linux content #23

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e734624
Import Linux content
Sep 17, 2026
028efbe
[bot] Apply pre-commit auto-fixes
github-actions[bot] Sep 17, 2026
d0950cc
Import Linux content
Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
104 changes: 104 additions & 0 deletions Sites/Linux Management/Fixlets/Fixlets/Apache Commons Text detection scan (Linux).bes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,104 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
BigFix Task Export

Title : Apache Commons Text detection scan (Linux)
ID : 26954
Author : JasonWalker
Domain : BESC
Imported : 2022-10-21T12:01:55
Source : bigfixm1_main @ BES-Root
-->
<BES xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="BES.xsd">
<Task>
<Title>Apache Commons Text detection scan (Linux)</Title>
<Description><![CDATA[<H3>This is Community Content. When you use these solutions, it is incumbent on your organization to test any solutions provided across the broadest available system base including various OS, storage solutions, and application inventory.</H3>
<P></P>
<P>Please see the <A href="https://forum.bigfix.com/t/log4j-vulnerability-identification-and-3rd-party-remediation-solution-testing-statement/40273"><FONT color=#0066cc>Community Solution Testing Statement</FONT></A></P>
<P>This Task performs a filesystem scan on Linux systems to attempt detecting Apache Commons Text versions vulnerable to CVE-2022-42889.</P>
<UL>
<LI><A href="https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om">https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om</A>
<LI><A href="https://nvd.nist.gov/vuln/detail/CVE-2022-42889">https://nvd.nist.gov/vuln/detail/CVE-2022-42889</A><BR></LI></UL>
<P>&nbsp;</P>
<P>This Task performs a filesystem search across all fixed disks on Linux platforms, to locate Apache Commons Text JAR files, either directly on the filesystem or embedded in a .WAR archive file.&nbsp; In the case any .WAR file is found on the system, the 'unzip' utility is used to perform a listing of files inside the archive to locate Apache Commons Text-related JAR files.&nbsp; Specifically, this Task searches for any versions of commons-text-X.X.X.jar.</P>
<P>Scan results are stored in a "Scans" subdirectory beneath the "BES Client" folder. 'apache-commons-text.log' contains the full script output for potential debugging or diagnosis, and 'apache-commons-text.txt' contains a listing of detected files in one of the forms</P>
<UL>
<LI>/tmp/commons-text/1.4/commons-text-1.4.jar
<LI>/tmp/commons-text.war::commons-text/1.10.0/commons-text-1.10.0.jar<BR></LI></UL>
<P>The first sample entry indicates a detected .jar file directly in the filesystem, while the second entry indicates a detected .jar file embedded within a .WAR archive.</P>
<P>This Task has several known limitations:</P>
<P></P>
<UL>
<LI>Archives are not extracted recursively - only .JAR files contained directly within a .WAR archive are found; archives embedded within multiple layers of .WAR archives are not detected.
<LI>There is no option to throttle the scan in terms of processor or disk i/o usage.&nbsp; Scans should be executed during non-critical hours, and staggered over time especially where multiple systems share a storage resource, such as a SAN or virtual machine storage pool.</LI></UL>
<P>This detection method uses&nbsp;Linux Bash script with&nbsp;external&nbsp;dependencies on 'df', 'find', 'sed', and&nbsp;'unzip'.&nbsp; Results of the scan may be retrieved using the related Analysis.</P>]]></Description>
<Relevance>name of operating system as lowercase contains &quot;linux&quot;</Relevance>
<Relevance>(if exists property &quot;in proxy agent context&quot; then not in proxy agent context else true)</Relevance>
<Source>Internal</Source>
<SourceReleaseDate>2022-03-31</SourceReleaseDate>
<MIMEField>
<Name>x-fixlet-modification-time</Name>
<Value>Thu, 20 Oct 2022 22:52:18 +0000</Value>
</MIMEField>
<Domain>BESC</Domain>
<DefaultAction ID="Action1">
<Description>
<PreLink>Click </PreLink>
<Link>here</Link>
<PostLink> to deploy this action.</PostLink>
</Description>
<ActionScript MIMEType="application/x-Fixlet-Windows-Shell"><![CDATA[parameter "ScansFolder" = "{(if (version of client >= "9" as version) then (pathname of parent folder of data folder of client) else (pathname of parent folder of parent folder of client folder of site "actionsite"))}/Scans"
folder create "{parameter "ScansFolder"}"
parameter "output"="{pathname of folder (parameter "ScansFolder")}/apache-commons-text.txt"
parameter "exec_output"="{pathname of folder (parameter "ScansFolder")}/apache-commons-text.log"
delete "{parameter "output"}"
delete "{parameter "exec_output"}"

delete __createfile
createfile until EOF_EOF_EOF_EOF
#!/bin/sh

# Enable trace output from script
set -o xtrace

OUTPUT_FILE={parameter "output"}

handle_file() {{
echo Handling $1
case $1 in
*.war|*.zip|*.ear|*.WAR|*.ZIP|*.EAR)
echo "${{1} is an archive, searching content via unzip";
for embeddedfile in `unzip -Z -1 "$1" *commons-text-*.jar -x *-sources.jar *-javadoc.jar *-tests.jar`
do
echo ${{1}::${{embeddedfile}>>${{OUTPUT_FILE}
done
;;
*)
echo ${{1}>>${{OUTPUT_FILE}
;;
esac
}



for j in `df -l --output=target -x tmpfs -x devtmpfs | sed 1d`

do echo "searching $j"
for targetfile in `find $j -xdev \( -name "commons-text-*.jar" -o -name "*.war" \) -a ! \( -name "*-sources.jar" -o -name "*-javadoc.jar" -o -name "*-tests.jar" \)`
do handle_file "$targetfile"
done

done



EOF_EOF_EOF_EOF

delete run_scan.sh
copy __createfile run_scan.sh
wait chmod +x run_scan.sh
wait /bin/sh -x -c "./run_scan.sh > '{parameter "exec_output"}' 2>&1"
]]></ActionScript>
</DefaultAction>
</Task>
</BES>
96 changes: 96 additions & 0 deletions ... Management/Fixlets/Fixlets/Change local user account password - Linux - BETA (21688).bes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,96 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
BigFix Fixlet Export

Title : Change local user account password - Linux - BETA
ID : 21688
Author : jgstew
Domain : BESC
Imported : 2016-09-21T15:15:53
Source : bigfixm1_main @ BES-Root
-->
<BES xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="BES.xsd">
<Fixlet>
<Title>Change local user account password - Linux - BETA</Title>
<Description><![CDATA[<LABEL for=secret><LABEL for=secret>
<P><LABEL for=secret><STRONG><FONT size=3>About this Task</FONT></STRONG></LABEL></P>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px" dir=ltr>
<P><LABEL for=secret>This task changes a specified local&nbsp;user account password using a secure parameter.</LABEL></P><LABEL for=secret>
<P><LABEL for=secret>This task is applicable on: *nix&nbsp;with version 9.0+ of the BESClient. This has only been tested on RedHat. <FONT color=#800000><STRONG>Use with caution.</STRONG></FONT></P></LABEL></LABEL></BLOCKQUOTE>
<P dir=ltr><LABEL for=secret><STRONG><FONT size=3>Action Description</FONT></STRONG></LABEL></P>
<UL dir=ltr>
<LI>
<DIV style="MARGIN-RIGHT: 0px"><LABEL for=secret><STRONG>Action1: Change specified local&nbsp;user account password.</STRONG></LABEL></DIV></LI></UL>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px" dir=ltr>
<P style="MARGIN-RIGHT: 0px"><LABEL for=secret>This action prompts for an existing&nbsp;local user account name and changes&nbsp;its password to the value specified in the "Password" field under "Customization Options".</LABEL></P></BLOCKQUOTE>
<P style="MARGIN-RIGHT: 0px" dir=ltr><LABEL for=secret><FONT color=#ff0000 size=3><STRONG>Important Notes</STRONG></FONT></LABEL></P>
<UL dir=ltr>
<LI>
<DIV style="MARGIN-RIGHT: 0px"><LABEL for=secret>You must enter a password in order to take an action.</LABEL></DIV>
<LI>
<DIV style="MARGIN-RIGHT: 0px"><LABEL for=secret>
<DIV>Because of the way secure parameters work, you cannot use this task in&nbsp;a baseline, target an action dynamically by property (e.g., automatic groups), use add additional actions.</DIV></LABEL></DIV>
<LI>
<DIV style="MARGIN-RIGHT: 0px"><LABEL for=secret>Changing a local user's password <EM>does not</EM> change the user's keychain password. At login, the user may recieve&nbsp;a message saying, "The system was unable to unlock your login keychain" and will have the following options:</LABEL></DIV>
<UL>
<LI>
<DIV style="MARGIN-RIGHT: 0px"><LABEL for=secret><LABEL for=secret>Continue Login, without creating a new keychain</LABEL> </DIV>
<LI>Create New Keychain, which creates a new keychain with the new password
<LI>Update Keychain Password, which updates the current keychain password (requires user to enter the old password)</LABEL></LI></UL></LI></UL></LABEL>
<P><LABEL for=secret><STRONG><FONT color=#008000 size=3>Customization Options</FONT></STRONG></LABEL></P></LABEL>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px" dir=ltr>
<P><LABEL for=secret>Password:</LABEL> <INPUT id=secret type=password name=secret> <script>
document.body.ontakeaction = function() {
var theSecret = document.getElementById( "secret" ).value;
if (theSecret==null || theSecret=="")
{alert("Hey, you forgot to enter a secure parameter! Please enter one on the Description tab before taking the action.");}
else
{TakeSecureFixletAction( Relevance('id of current fixlet'), Relevance('id of current bes site'), "Action1", {}, { secret: theSecret } );}
return false;
}
</script> </P></BLOCKQUOTE>]]></Description>
<Relevance><![CDATA[version of client >= "9.0"]]></Relevance>
<Relevance>(unix of operating system) OR (name of operating system starts with &quot;Linux&quot;)</Relevance>
<Relevance>( exists files whose(name of it as lowercase = &quot;chpasswd&quot;) of (folders it) of unique values of (it as trimmed string) of substrings separated by (&quot;;&quot;;&quot;:&quot;) of values of (variables &quot;PATH&quot; of it; (if (windows of operating system) then (x64 variables &quot;PATH&quot; of it) else NOTHINGS) ) of environments )</Relevance>
<Category>Accounts</Category>
<Source>Internal</Source>
<SourceID>jbt8, spg14, jgs194</SourceID>
<SourceReleaseDate>2013-05-03</SourceReleaseDate>
<MIMEField>
<Name>bigfixme-added-time</Name>
<Value>Fri, 06 Dec 2013 12:12:45 GMT</Value>
</MIMEField>
<MIMEField>
<Name>bigfixme-modification-time</Name>
<Value>Fri, 06 Dec 2013 12:12:45 GMT</Value>
</MIMEField>
<MIMEField>
<Name>bigfixme-keywords</Name>
<Value></Value>
</MIMEField>
<MIMEField>
<Name>bigfixme-ID</Name>
<Value>3673</Value>
</MIMEField>
<MIMEField>
<Name>x-fixlet-modification-time</Name>
<Value>Wed, 21 Sep 2016 22:14:16 +0000</Value>
</MIMEField>
<Domain>BESC</Domain>
<DefaultAction ID="Action1">
<Description>
<PreLink></PreLink>
<Link>Change</Link>
<PostLink>&amp;nbsp;specified local user account password.</PostLink>
</Description>
<ActionScript MIMEType="application/x-Fixlet-Windows-Shell">action parameter query &quot;username&quot; with description &quot;Please specify the name of an existing local user account&quot;

// verify the user exists already before continuing
continue if{ 2 = number of lines whose(it as lowercase starts with ( ( parameter &quot;username&quot; ) as lowercase ) ) of (files &quot;shadow&quot; of it; files &quot;passwd&quot; of it) of folders &quot;/etc&quot; }

wait sh -c &quot;echo &quot;{parameter &quot;username&quot; of action}:{parameter &quot;secret&quot; of action}&quot; | chpasswd&quot;
</ActionScript>
<SuccessCriteria Option="RunToCompletion"></SuccessCriteria>
</DefaultAction>
</Fixlet>
</BES>
40 changes: 40 additions & 0 deletions Sites/Linux Management/Fixlets/Fixlets/Fix _etc_nologin (3870).bes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
BigFix Fixlet Export

Title : Fix /etc/nologin
ID : 3870
Author : sinucus
Domain : BESC
Imported : 2014-10-09T06:53:24
Source : bigfixm1_main @ BES-Root
-->
<BES xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="BES.xsd">
<Fixlet>
<Title>Fix /etc/nologin</Title>
<Description></Description>
<Relevance>exists file &quot;/etc/redhat-release&quot; whose (exists line whose (exists match (regex &quot;Red Hat Enterprise Linux (Client|Server) release 5&quot;) of it) of it) AND NOT exists file &quot;/etc/vmware-release&quot; whose (exists line whose (it contains &quot;VMware ESX&quot;) of it) AND not exists file &quot;/etc/enterprise-release&quot; whose (exists line whose (it contains &quot;Enterprise Linux Enterprise Linux&quot;) of it) AND (if exists property &quot;in proxy agent context&quot; then (not in proxy agent context) else true) AND (if exists property &quot;android&quot; of type &quot;operating system&quot; then (not android of operating system) else true)</Relevance>
<Relevance><![CDATA[version of client >= "7.2.4.75"]]></Relevance>
<Relevance>not exists lines whose (it starts with &quot;/bin/rm -f /etc/nologin&quot;) of file &quot;/etc/rc.d/rc.local&quot;</Relevance>
<Source>Internal</Source>
<SourceReleaseDate>2013-07-30</SourceReleaseDate>
<MIMEField>
<Name>x-fixlet-first-propagation</Name>
<Value>Tue, 20 Sep 2011 03:22:23 +0000</Value>
</MIMEField>
<MIMEField>
<Name>x-fixlet-modification-time</Name>
<Value>Tue, 05 Aug 2014 12:29:09 +0000</Value>
</MIMEField>
<Domain>BESC</Domain>
<DefaultAction ID="Action1">
<Description>
<PreLink>Click </PreLink>
<Link>here</Link>
<PostLink> to initiate the deployment process.</PostLink>
</Description>
<ActionScript MIMEType="application/x-sh"><![CDATA[#!/bin/sh
echo "/bin/rm -f /etc/nologin" >> /etc/rc.d/rc.local]]></ActionScript>
</DefaultAction>
</Fixlet>
</BES>
41 changes: 41 additions & 0 deletions ...un_ PwnKit mitigation - Removing SUID permissions on pkexec - WITH MITIGATION (26905).bes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
BigFix Fixlet Export

Title : Run: PwnKit mitigation - Removing SUID permissions on pkexec - WITH MITIGATION
ID : 26905
Author : brolly33
Domain : BESC
Imported : 2022-02-01T06:38:23
Source : bigfixm1_main @ BES-Root
-->
<BES xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="BES.xsd">
<Fixlet>
<Title>Run: PwnKit mitigation - Removing SUID permissions on pkexec - WITH MITIGATION</Title>
<Description><![CDATA[<DIV><BR>
<P>This task will remove the SUID-bit from pkexec file.<BR>It is a generic command that can be deployed on all Linux-based endpoints <BR>chmod 0755 /usr/bin/pkexec<BR></P>
<P>You should favor patching the OS with the security update released by the vendor for any supported system, and only when this is not a viable solution, to use the mitigation approach. <BR></P>
<P><B>Removing the SUID-bit form the pkexec file may have a negative impact on any applications.<BR>Use this task to perform mitigation with care and test thoroughly in your environment.</B><BR></P></DIV>]]></Description>
<Relevance>exists file &quot;/usr/bin/pkexec&quot; and mode of file &quot;/usr/bin/pkexec&quot; as string != &quot;rwxr-xr-x&quot;</Relevance>
<Category>Workaround</Category>
<Source>Community Content</Source>
<SourceReleaseDate>2022-01-28</SourceReleaseDate>
<SourceSeverity>Important</SourceSeverity>
<CVENames>CVE-2021-4034</CVENames>
<MIMEField>
<Name>x-fixlet-modification-time</Name>
<Value>Tue, 01 Feb 2022 14:35:27 +0000</Value>
</MIMEField>
<Domain>BESC</Domain>
<DefaultAction ID="Action1">
<Description>
<PreLink>Click </PreLink>
<Link>here</Link>
<PostLink> to deploy this action.</PostLink>
</Description>
<ActionScript MIMEType="application/x-Fixlet-Windows-Shell">// Enter your action script here
wait &quot;/bin/bash&quot; -c &quot;chmod 0755 /usr/bin/pkexec&quot;</ActionScript>
<SuccessCriteria Option="RunToCompletion"></SuccessCriteria>
</DefaultAction>
</Fixlet>
</BES>
41 changes: 41 additions & 0 deletions ..._ PwnKit mitigation - Restore default permissions on pkexec - UNDO MITIGATION (26904).bes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
BigFix Fixlet Export

Title : Run: PwnKit mitigation - Restore default permissions on pkexec - UNDO MITIGATION
ID : 26904
Author : brolly33
Domain : BESC
Imported : 2022-02-01T06:38:00
Source : bigfixm1_main @ BES-Root
-->
<BES xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="BES.xsd">
<Fixlet>
<Title>Run: PwnKit mitigation - Restore default permissions on pkexec - UNDO MITIGATION</Title>
<Description><![CDATA[<DIV><BR>
<P>This task restore the default permission on the pkexec file, that is. <B>-rwsr-xr-x</B><BR>It is a generic command that can be deployed on all Linux-based endpoints<BR>chmod u+s /usr/bin/pkexec<BR></P>
<P>This task can be used in case the PwnKit mitigation task damaged an application running on the target endpoint. It will restore the default permissions on the pkexec file that were modified by the mitigation task.<BR>Use this task with care and test thoroughly in your environment<BR></P>
<P><B>NOTE:</B> The task restores the default (-rwsr-xr-x) to the pkexec file. <BR></P></DIV>]]></Description>
<Relevance>exists file &quot;/usr/bin/pkexec&quot; and mode of file &quot;/usr/bin/pkexec&quot; as string != &quot;rwsr-xr-x&quot;</Relevance>
<Category>Workaround</Category>
<Source>Community Content</Source>
<SourceReleaseDate>2022-01-28</SourceReleaseDate>
<SourceSeverity>Important</SourceSeverity>
<CVENames>CVE-2021-4034</CVENames>
<MIMEField>
<Name>x-fixlet-modification-time</Name>
<Value>Tue, 01 Feb 2022 14:35:36 +0000</Value>
</MIMEField>
<Domain>BESC</Domain>
<DefaultAction ID="Action1">
<Description>
<PreLink>Click </PreLink>
<Link>here</Link>
<PostLink> to deploy this action.</PostLink>
</Description>
<ActionScript MIMEType="application/x-Fixlet-Windows-Shell">// Enter your action script here
wait &quot;/bin/bash&quot; -c &quot;chmod u+s /usr/bin/pkexec&quot;</ActionScript>
<SuccessCriteria Option="RunToCompletion"></SuccessCriteria>
</DefaultAction>
</Fixlet>
</BES>
Loading
Loading