WIP: add collection of OpenSSH Include config files

README.md

@@ -4,14 +4,14 @@ SUSE Linux Enterprise support utilities. Gathers system information.
 
 ## Branching Strategy
 
-**dev**: Unstable branch with current fixes. 
+**dev**: Unstable branch with current fixes to SLE15 and SLE16
 
-**sle12**: SUSE Linux Enterprise Server 12 branch for all changes to SLE12
+**master**: Current stable changes for SLE15 and SLE16. Protected branch requires pull request from **dev** branch.
 
-**sle11**: SUSE Linux Enterprise Server 11 branch for all changes to SLE11
+**sle15sp3**: SUSE Linux Enterprise Server 15 branch. Derived from master but contains scplugin.rc.
 
-**master**: Current stable changes for SLE15 and beyond. Protected branch requires pull request from **dev** branch.
+**sle12**: SUSE Linux Enterprise Server 12 branch for all changes to SLE12
 
-**sle15: DEPRICATED Do not use.** SUSE Linux Enterprise Server 15 branch for all changes to SLE15
+**sle11**: SUSE Linux Enterprise Server 11 branch for all changes to SLE11
 
 Applicable fixes must be checked into each corresponding branch.

bin/supportconfig

@@ -98,6 +98,8 @@ show_help() {
 	echo "  -f From directory. Don't collect report files, just use the directory or files in that"
 	echo "     directory."
 	echo "  -g Use gzip instead of the default xz compression"
+	echo "  -j Scrub sensitive data with supportutils-scrub before packing."
+	echo "     Use SUPPORTUTILS_SCRUB_OPTS env var for extra options (--verify, --keywords ...)."
 	echo "  -i <keyword list>"
 	echo "     Include keywords. A comma separated list of feature keywords that specify"
 	echo "     which features to include. Use -F to see a list of valid keywords."
@@ -336,7 +338,6 @@ basic_healthcheck() {
 		rm -f $TOPTMP
 	fi
 
-
 	if grep 'security=apparmor' /proc/cmdline &>/dev/null; then
 		log_write $AARTMP "#==[ Summary ]======================================#"
 		log_write $AARTMP "# AppArmor REJECT Messages"
@@ -372,6 +373,8 @@ basic_healthcheck() {
 	cat $PSPTMP >> $LOG/$OF
 	rm $PSPTMP
 
+	rpm_verify $OF procps
+
 	echolog Done
 }
 
@@ -402,7 +405,6 @@ rpm_info() {
 		printf "%-63s %-35s %s\n" SIGNATURE VENDOR PACKAGE >> $LOGFILE
 		$RPM_BIN -qa --queryformat "%{SIGPGP:pgpsig}  %-35{VENDOR}  %{NAME}-%{VERSION}-%{RELEASE}\n" | sort -k 11 -t " " -i >> $LOGFILE 2>&1
 		log_write $RPMFILE
-		# Jul 12, 2018 ; Added by Ahmad AL Zayed to get a list of RPM DB Backups 
 		RETURN=$(grep RPMDB_BACKUP_DIR /etc/sysconfig/backup 2>/dev/null | grep -v "^#" | cut -d= -f2 | tr -d "\"")
 		[[ -d $RETURN ]] && { log_cmd $RPMFILE "ls -ltr $RETURN" ;} 
 	fi
@@ -655,7 +657,13 @@ boot_info() {
 	OF=boot.txt
 	addHeaderFile $OF
 	log_cmd $OF "uname -a"
-	# Feb 6, 2024 - Ahmad Alzayed - Added grep -E '[0-9]' to avoid getting duplicated output
+	if [[ "$(readlink -f /boot/initrd)" == *"$(uname -r)"* ]]; then
+		echo -e "Current running kernel matches /boot/initrd\n" >> $LOG/$OF
+	else
+		echo "**WARNING -- MISMATCH**: Running kernel DOES NOT match version of $(readlink -f /boot/initrd)" >> $LOG/$OF
+		echo -e "This could be due to a different kernel installed but not rebooted, booted to a different kernel, chrooted in rescue, or other cause.\n" >> $LOG/$OF
+	fi
+
 	KERNELS=$(cat $LOG/$RPMFILE | grep '^kernel-' | grep -v 'kernel-source' | awk '{print $1}' | grep -E '[0-9]')
 	for KERNEL in $KERNELS
 	do
@@ -668,9 +676,10 @@ boot_info() {
 	fi
 	if $RPM_BIN -q grub2 &> /dev/null; then
 		rpm_verify $OF grub2
-		conf_files $OF /etc/default/grub /etc/default/grub_installdevice /boot/grub2/device.map
+		conf_files $OF /etc/default/grub /etc/default/grub_installdevice /boot/grub2/device.map /boot/grub2/grubenv
 		BKOP=$ADD_OPTION_LOGS
-		ADD_OPTION_LOGS=1 conf_files $OF /boot/grub2/grub.cfg
+		ADD_OPTION_LOGS=1
+		conf_files $OF /boot/grub2/grub.cfg
 		ADD_OPTION_LOGS=$BKOP
 	fi
 	if $RPM_BIN -q lilo &> /dev/null; then
@@ -709,7 +718,7 @@ boot_info() {
 	conf_files $OF /proc/cmdline /etc/sysconfig/kernel $FILES
 
 	log_cmd $OF 'ls -lR --time-style=long-iso /boot/'
-	log_cmd $OF "lsinitrd -k $(uname -r)"
+	log_cmd $OF 'lsinitrd $(readlink -f /boot/initrd)'
 	(( $ADD_OPTION_LOGS )) && log_files $OF 0 $FILES || log_files $OF $VAR_OPTION_LINE_COUNT $FILES
 	log_cmd $OF 'journalctl --boot=0 --no-pager --disk-usage'
 	if [[ -x $JOURNALCTL_BIN ]]; then
@@ -776,6 +785,7 @@ bpf_info() {
 				fi
 			fi
 		else
+			log_entry $OF note "Install bpftool to display more information."
 			log_cmd $OF 'grep -E bpf_prog_[a-f0-9]{16} /proc/kallsyms'
 		fi
 		echolog Done
@@ -948,11 +958,16 @@ pam_info() {
 		log_write $OF "#==[ Files in /etc/security ]=======================#"
 		[[ -d /etc/security ]] && FILES="$(find -L /etc/security/ -type f -name \*conf)" || FILES=""
 		conf_files $OF $FILES
-		# Nov 24, 2023 ,, Added by Ahmad Alzayed
 		log_cmd $OF "ls -lt --time-style=long-iso /etc/pam.d/"
 		log_write $OF "#==[ Files in /etc/pam.d ]==========================#"
 		[[ -d /etc/pam.d ]] && FILES="$(find -L /etc/pam.d/ -type f | sort)" || FILES=""
 		conf_files $OF $FILES
+		if [[ -d /usr/lib/pam.d ]]; then
+			log_write $OF "#==[ Files in /usr/lib/pam.d ]==========================#"
+			log_cmd $OF "ls -lt --time-style=long-iso /usr/lib/pam.d/"
+			FILES="$(find -L /usr/lib/pam.d/ -type f | sort)" || FILES=""
+			conf_files $OF $FILES
+		fi
 		echolog Done
 	else
 		log_entry $OF note "Restricted"
@@ -1063,6 +1078,8 @@ environment_info() {
 	conf_files $OF /etc/profile /etc/profile.local /etc/profile.d/*
 	conf_files $OF /etc/bash.bashrc /etc/csh\.* /etc/ksh*
 	sed -i -e 's/\r//g' $LOG/$OF
+	# Mar 26, 2026 - Added by Ahmad Alzayed to remove proxy information from env file.
+	_sanitize_file $OF
 	echolog Done
 }
 
@@ -1112,6 +1129,10 @@ systemd_info() {
 		do
 			log_cmd $OF2 "systemctl status '$i'"
 		done
+		for i in $($SYSTEMCTL_BIN --no-pager list-unit-files --type=service 2>/dev/null | sed 's/^[^-_:\\a-zA-Z0-9]*//' | grep -vE '^UNIT |^LOAD |^ACTIVE |^SUB |^To |^[[:digit:]]* ' | awk '{print $1}')
+		do
+			log_cmd $OF "systemctl cat '$i'"
+		done
 	fi
 	log_cmd $OF 'ls -alR /etc/systemd/'
 	log_cmd $OF 'ls -alR /usr/lib/systemd/'
@@ -2518,7 +2539,7 @@ crash_info() {
 	log_cmd $OF 'sysctl kernel 2>/dev/null | grep panic'
 	if rpm -q kdump &>/dev/null ; then
 		if [[ -x $READ_KDUMP_CONFIG ]]; then
-			. $READ_KDUMP_CONFIG
+			source $READ_KDUMP_CONFIG 2>&1 | grep -v "deprecated, ignoring"
 			DUMPDIR=${KDUMP_SAVEDIR#file://}
 		else
 			DUMPDIR=''
@@ -2825,10 +2846,8 @@ ha_info() {
 			log_cmd $OF 'chronyc sources -v'
 			log_cmd $OF 'crm_mon -r -1'
 			log_cmd $OF 'crm_mon -r -n -1'
-			# Display node attributes ; Nov 15, 2018 ; Added by Ahmad Al Zayed
 			log_cmd $OF 'crm_mon -A -1' 
 			log_cmd $OF 'corosync-cfgtool -s'
-			# More corosync information ; Dec 6, 2018 ; Added by Ahmad Al Zayed
 			log_cmd $OF 'crm corosync status' 
 			log_cmd $OF 'crm configure show'
 			conf_files $OF $CONF_FILES
@@ -2857,6 +2876,8 @@ ha_info() {
 					done
 				fi
 			done
+			log_cmd $OF "grep -E '^hacluster:[x*]:' /etc/passwd"
+			log_cmd $OF "grep -E '^haclient:[x*]:' /etc/group"
 			cd $CURRENT_PATH
 			CURRENT_CIB=''
 			FILES=''
@@ -3081,7 +3102,6 @@ drbd_info() {
 		log_cmd $OF "grep drbd /proc/modules"
 		log_cmd $OF "modinfo drbd"
 		log_cmd $OF "drbd-overview" 
-		# Added By Ahmad Al Zayed - Feb 21, 2019 to get few drbd output & configuration 
 		log_cmd $OF "drbdadm status" 
 		log_cmd $OF "drbdadm dump"
 		log_cmd $OF "cat /proc/drbd"
@@ -3714,7 +3734,9 @@ ssh_info() {
 	if rpm_verify $OF openssh
 	then
 		log_cmd $OF "systemctl status sshd.service"
-		conf_files $OF /etc/ssh/sshd_config /etc/ssh/ssh_config /etc/pam.d/sshd
+		FILES=({/usr,}/etc/ssh/ssh_config {/usr,}/etc/ssh/sshd_config  {/usr/lib,/etc}/pam.d/sshd)
+		INCLUDE_FILES=($(expand_globs_to_paths $(grep -Pho '^\s*Include\s+\K([^$#]+)' {/usr,}/etc/ssh/ssh_config {/usr,}/etc/ssh/sshd_config 2>/dev/null)))
+		conf_files $OF ${FILES[@]} ${INCLUDE_FILES[@]}
 		log_cmd $OF 'ss -nlp | grep sshd'
 		echolog Done
 	else
@@ -4208,7 +4230,7 @@ get_sles_ver
 NSA_CHECK=0
 ALL_ARGS="$@"
 declare -a KV_PAIRS
-while getopts :\#AB:CDE:FG:H:I:JLM:N:O:P:QR:S:T:U:W:X:V:abcdef:ghi:klmo:pqr:st:uvwx:yz TMPOPT
+while getopts :\#AB:CDE:FG:H:I:JLM:N:O:P:QR:S:T:U:W:X:V:abcdef:ghi:jklmo:pqr:st:uvwx:yz TMPOPT
 do
 	case $TMPOPT in
 	\:)	clear; title
@@ -4257,6 +4279,7 @@ do
 	g) COMPRESS="tgz"; COMPRESS_OPT="zcf" ;;
 	h) title; show_help; exit_code 0 ;;
 	i) SELECTED_FEATURE_LIST=$OPTARG; set_to_min; selected_features on ;;
+	j) ADD_OPTION_SCRUB=1 ;;
 	k) MIN_OPTION_AUTOMOD=0 ;;
 	l) ADD_OPTION_LOGS=1 ;;
 	m) set_to_min ;;
@@ -4283,6 +4306,8 @@ do
 	esac
 done
 
+(( $ADD_OPTION_SCRUB )) && validate_scrubbing
+
 (( $ADD_OPTION_LOGS )) && ADD_OPTION_MAXYAST=1
 
 umask 0077
@@ -4506,6 +4531,8 @@ else
 	(( $VAR_OPTION_SILENT )) || { clear; title; }
 fi
 
+(( ADD_OPTION_SCRUB )) && scrub_dir
+
 # don't continue if SAVE_LOGS_ONLY is set
 (( $SAVE_LOGS_ONLY )) && exit_code 0;
 

bin/supportconfig.rc

@@ -101,6 +101,7 @@ ADD_OPTION_LOGS=0
 ADD_OPTION_MINDISK=0
 ADD_OPTION_MAXYAST=0
 ADD_OPTION_RPMV=0
+ADD_OPTION_SCRUB=0
 ADD_OPTION_SLP=0
 ADD_OPTION_LOCAL_ONLY=0
 
@@ -145,13 +146,15 @@ VAR_OPTION_WAIT_TRACE=0
 : ${FORCE_OPTION_PAM:=0}
 : ${LOCAL_PODMAN_USERS:=''}
 
+
 LANG=C
 PATH="/sbin:/usr/sbin:/bin:/usr/bin:$PATH"
 PATH_ORIG=$PATH
 export PATH LANG
 LIB_DIR='/usr/lib/supportconfig'
 CONFIG_DIR='/etc/supportutils'
 SC_RESOURCE_FILE="${LIB_DIR}/resources/supportconfig.rc"
+SCRUB_PKG="supportutils-scrub"
 XPLUGIN_DIR="${LIB_DIR}/plugins"
 CURRENT_SCRIPT=$(basename $0)
 ARCHIVE_PREFIX='scc_'
@@ -195,7 +198,7 @@ EXT_SCALING_PID_LIMIT=1000
 EXT_SCALING_IRQ_LIMIT=1000
 EXT_SCALING_EXEC_LIMIT=9000000
 
-PROC_FILES="/proc/mounts /proc/zoneinfo"
+PROC_FILES="/proc/mounts /proc/zoneinfo /proc/softirqs"
 PROC_DIRS_DEPTH_ONE="/proc/sys/kernel/ /proc/scsi/ /proc/net/ /proc/dasd/"
 PROC_DIRS_DEPTH_FULL="/proc/irq/ /proc/sys/"
 PROC_DIRS_DEPTH_ONE_FILTER_OUT="rt_acct$|/sched_domain/"
@@ -237,6 +240,8 @@ IP_BIN=$(command -v ip)
 BRCTL_BIN=$(command -v brctl)
 LOGGER_BIN=$(command -v logger)
 KLP_BIN=$(command -v klp)
+SCRUB_BIN=$(command -v supportutils-scrub 2>/dev/null)
+
 
 trap "{ echolog TERMINATED BY USER; echo; exit 5; }" SIGINT
 trap "{ echolog SKIPPED BY USER; return 4; }" SIGQUIT
@@ -528,6 +533,81 @@ printlog() {
 	fi
 }
 
+validate_scrubbing() {
+	if rpm -q $SCRUB_PKG &> /dev/null; then
+		if ! [[ -x $SCRUB_BIN ]]; then
+			title
+			echo "ERROR: Unable to scrub data files, invalid or missing supportutils-scrub utility."
+			echo "       Please reinstall the $SCRUB_PKG package or turn off scrubbing with ADD_OPTION_SCRUB=0"
+			echo
+			exit 15
+		fi
+	else
+		title
+		echo "ERROR: Unable to scrub data files, missing $SCRUB_PKG package."
+		echo "       Please install the $SCRUB_PKG package or turn off scrubbing with ADD_OPTION_SCRUB=0"
+		echo
+		exit 15
+	fi
+	SCRUB_VER=$(rpm -q --queryformat '%{VERSION}' supportutils-scrub 2>/dev/null)
+	if [[ $(echo -e "1.2\n$SCRUB_VER" | sort -V | head -1) != "1.2" ]]; then
+		title
+		echo "ERROR: supportutils-scrub version $SCRUB_VER is too old. Version 1.4 or later required."
+		echo "       Please update the supportutils-scrub package."
+		echo
+		exit 15
+	fi
+	export SCRUB_VER
+}
+
+scrub_dir() {
+	echolog "Scrubbing supportconfig files..."
+
+        # supportutils-scrub v1.4 returns the supportconfig scrubbed path to stdout
+	if [[ $(echo -e "1.4\n$SCRUB_VER" | sort -V | head -1) == "1.4" ]]; then
+		local SCRUBBED_DIR RC NEW_BASE NEW_LOG
+		SCRUBBED_DIR=$("$SCRUB_BIN" --quiet "$LOG")
+		RC=$?
+
+		if (( RC == 0 )) || (( RC == 2 )); then
+			if [[ -d "$SCRUBBED_DIR" ]]; then
+				rm -rf "$LOG"
+				NEW_BASE=$(basename "$SCRUBBED_DIR" | sed 's/_scrubbed$//')
+				NEW_LOG="$(dirname "$LOG")/$NEW_BASE"
+				mv "$SCRUBBED_DIR" "$NEW_LOG"
+				LOG="$NEW_LOG"
+				BASE="$NEW_BASE"
+				export LOG BASE
+				echolog "Supportconfig scrubbing complete. "
+			else
+				echo "WARNING: supportutils-scrub did not produce output directory." >&2
+			fi
+		elif (( RC == 3 )); then
+			echo "ERROR: supportutils-scrub --verify found remaining sensitive data." >&2
+			echo " Removing the original and the scrubbed supportconfig to prevent any potential leak." >&2
+			rm -rf "$LOG"
+			[[ -n "$SCRUBBED_DIR" ]] && rm -rf "$SCRUBBED_DIR"
+			exit 15
+		else
+			echo "WARNING: supportutils-scrub exited with rc=$RC -- data not scrubbed." >&2
+		fi
+	else
+		# v1.2/v1.3 does not support hostname scrubbing from folder name
+		# the --quiet option is supported from v1.3
+		local QUIET_OPT=""
+		[[ $(echo -e "1.3\n$SCRUB_VER" | sort -V | head -1) == "1.3" ]] && QUIET_OPT="--quiet"
+		$SCRUB_BIN "$LOG" $QUIET_OPT ${SUPPORTUTILS_SCRUB_OPTS}
+		if [[ -d "${LOG}_scrubbed" ]]; then
+			LOG="${LOG}_scrubbed"
+			BASE="${BASE}_scrubbed"
+			export LOG BASE
+			echolog "Data scrubbing complete."
+		else
+			echo "WARNING: supportutils-scrub did not produce ${LOG}_scrubbed -- data not scrubbed." >&2
+		fi
+	fi
+}
+
 printvrpmlog() {
 	CSLOGFILE=$LOG/${CSFILE}
 	(( $VAR_OPTION_SILENT )) && printf "  %-40s %12s ... " "$1" "$2" >> $CSLOGFILE || printf "  %-40s %12s ... " "$1" "$2" | tee -a $CSLOGFILE
@@ -1058,6 +1138,7 @@ ehr() {
 	echo "-----------------------------------------------------------------------------"
 }
 
+
 encrypt_tarball() {
 	log2sys "Encrypt Tar Ball"
 	if [[ -x $GPG_BIN ]]; then
@@ -1490,4 +1571,18 @@ get_sles_ver() {
 	fi
 }
 
+expand_globs_to_paths() {
+	local pattern file
+	local -a results=()
+	shopt -s nullglob
 
+	for pattern in "$@"; do
+		for file in $pattern; do
+			if [[ -e $file ]]; then
+				results+=( "$(realpath -e -- "$file")" )
+			fi
+		done
+	done
+	shopt -u nullglob
+	printf '%s\n' "${results[@]}" | awk '!seen[$0]++'
+}