Startwind\Inventorio\Collector\System\Security\GeneralSecurityCollector

Complexity

Total Complexity

19

Size/Duplication

Total Lines	102
Duplicated Lines	0 %

Importance

Changes	2
Bugs	0	Features	0

4 Methods

Rating	Name	Duplication	Size	Complexity
A	isUnattendedUpgradesUsable()	0	11	3
A	isUnattendedUpgradesEnabled()	0	20	4
A	collect()	0	18	2
B	checkSshKeyOnlyLogin()	0	43	10

<?php

namespace Startwind\Inventorio\Collector\System\Security;

use Startwind\Inventorio\Collector\BasicCollector;
use Startwind\Inventorio\Exec\Runner;
use Startwind\Inventorio\Exec\System;

class GeneralSecurityCollector extends BasicCollector
{
    protected string $identifier = 'SystemSecurity';

    public function collect(): array
    {
        $available = $this->isUnattendedUpgradesUsable();
        $enabled = false;
        if ($available) {
            $enabled = $this->isUnattendedUpgradesEnabled();
        }

        $sshOnlyConfig = $this->checkSshKeyOnlyLogin();

        $result = [
            'unattendedUpgradesAvailable' => $available,
            'unattendedUpgradesEnabled' => $enabled,
            'sshKeyOnlyAvailable' => $sshOnlyConfig['supported'],
            'sshKeyOnlyEnabled' => $sshOnlyConfig['enforced'],
        ];

        return $result;
    }

    private function isUnattendedUpgradesEnabled(): bool
    {
        $configFile = '/etc/apt/apt.conf.d/20auto-upgrades';

        $runner = Runner::getInstance();

        if (!$runner->fileExists($configFile)) {
            return false;
        }

        $content = $runner->getFileContents($configFile);

        if ($content === false) {

The condition $content === false is always false.

            return false;
        }

        $updateListEnabled = preg_match('/APT::Periodic::Update-Package-Lists\s+"1";/', $content);
        $unattendedUpgradeEnabled = preg_match('/APT::Periodic::Unattended-Upgrade\s+"1";/', $content);

        return $updateListEnabled && $unattendedUpgradeEnabled;
    }

    private function isUnattendedUpgradesUsable(): bool
    {
        if (stripos(strtolower(System::getInstance()->getPlatform()), 'linux') === false) {
            return false;
        }

        $runner = Runner::getInstance();

        if (!$runner->commandExists('apt')) return false;

        return !empty($runner->run('apt-cache show unattended-upgrades 2>/dev/null')->getOutput());
    }

    function checkSshKeyOnlyLogin(): array

It is generally recommended to explicitly declare the visibility for methods.

    {
        $result = ['supported' => false, 'enforced' => false];

        if (stripos(strtolower(System::getInstance()->getPlatform()), 'linux') === false) {
            return $result;
        }

        $runner = Runner::getInstance();

        $configPath = '/etc/ssh/sshd_config';
        if (!$runner->fileExists($configPath)) {
            return $result;
        }

        $result['supported'] = true;

        $config = $runner->getFileContents($configPath);
        if ($config === false) {

The condition $config === false is always false.

            return $result;
        }

        $lines = preg_split('/\r\n|\r|\n/', $config);
        $settings = [];

        foreach ($lines as $line) {
            $line = trim(preg_replace('/#.*/', '', $line)); // Kommentare entfernen
            if ($line === '') continue;

            if (preg_match('/^\s*(\w+)\s+(yes|no)\s*$/i', $line, $matches)) {
                $key = strtolower($matches[1]);
                $value = strtolower($matches[2]);
                $settings[$key] = $value;
            }
        }

        $passwordOff = isset($settings['passwordauthentication']) && $settings['passwordauthentication'] === 'no';
        $challengeOff = isset($settings['challengeresponseauthentication']) && $settings['challengeresponseauthentication'] === 'no';

The assignment to $challengeOff is dead and can be removed.

        $usePamOff = isset($settings['usepam']) && $settings['usepam'] === 'no';

The assignment to $usePamOff is dead and can be removed.

        $result['enforced'] = $passwordOff; // && $challengeOff && $usePamOff;

        return $result;
    }
}