Skip to content

Commit 0dd5f32

Browse files
author
damien cavagnini
committed
adding the following missing scripts:
bin/hardening/audit_chacl.sh -> 6.3.3.17 bin/hardening/audit_chcon.sh -> 6.3.3.15 bin/hardening/audit_file_deletion.sh -> 6.3.3.13 bin/hardening/audit_setfacl.sh -> 6.3.3.16 bin/hardening/audit_sudo_log.sh -> 6.3.3.3 ? bin/hardening/audit_user_emulation.sh -> 6.3.3.2 bin/hardening/audit_usermod.sh -> 6.3.3.18 bin/hardening/auditd_space_left_action.sh -> 6.3.2.4 bin/hardening/check_root_is_only_gid_0_account.sh -> 5.4.2.2 bin/hardening/check_root_is_only_uid_0.sh -> 5.4.2.1 bin/hardening/chrony_authorized_server.sh -> 2.3.3.1 bin/hardening/cron_allow_restrictions.sh -> 2.4.1.8 bin/hardening/dev_shm_nodev.sh -> 1.1.2.2.2 bin/hardening/dev_shm_noexec.sh -> 1.1.2.2.4 bin/hardening/dev_shm_nosuid.sh -> 1.1.2.2.3 bin/hardening/gdm_disable_automount.sh -> 1.7.6 / 1.7.7 bin/hardening/gdm_disable_autorun.sh -> 1.7.8 / 1.7.9 bin/hardening/gdm_disable_xdmcp.sh -> 1.7.10 bin/hardening/gdm_screen_lock.sh -> 1.7.5 bin/hardening/pam_pwhistory_enforce_root.sh -> 5.3.3.3.2 bin/hardening/pam_pwhistory_use_authtok.sh -> 5.3.3.3.3 bin/hardening/sshd_disable_gssapi.sh -> 5.1.9 bin/hardening/timesyncd_authorized_server.sh -> 2.3.2.1
1 parent efbd5b3 commit 0dd5f32

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+3293
-0
lines changed

‎bin/hardening/audit_chacl.sh‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure use of chacl command is audited (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=4
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure audit rules for chacl command are configured."
19+
20+
AUDIT_RULES_FILE='/etc/audit/rules.d/50-perm_chng.rules'
21+
UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
22+
23+
# Global state
24+
RULES_OK=1
25+
26+
# This function will be called if the script status is on enabled / audit mode
27+
audit() {
28+
RULES_OK=1
29+
30+
if [ ! -f "$AUDIT_RULES_FILE" ]; then
31+
crit "Audit rules file $AUDIT_RULES_FILE does not exist"
32+
RULES_OK=0
33+
return
34+
fi
35+
36+
# Check for chacl rules
37+
if ! grep -qE "chacl.*-k perm_chng" "$AUDIT_RULES_FILE"; then
38+
crit "chacl audit rule not found"
39+
RULES_OK=0
40+
else
41+
ok "chacl audit rules are correctly configured"
42+
fi
43+
}
44+
45+
# This function will be called if the script status is on enabled mode
46+
apply() {
47+
if [ "$RULES_OK" -eq 0 ]; then
48+
info "Creating chacl audit rules"
49+
mkdir -p "$(dirname "$AUDIT_RULES_FILE")"
50+
51+
# Create or append to the file
52+
if [ ! -f "$AUDIT_RULES_FILE" ]; then
53+
cat >"$AUDIT_RULES_FILE" <<EOF
54+
## Permission modification
55+
EOF
56+
fi
57+
58+
# Add chacl rules if not present
59+
if ! grep -q "chacl" "$AUDIT_RULES_FILE" 2>/dev/null; then
60+
cat >>"$AUDIT_RULES_FILE" <<EOF
61+
-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=$UID_MIN -F auid!=unset -k perm_chng
62+
EOF
63+
fi
64+
65+
# Load the rules
66+
info "Loading audit rules"
67+
augenrules --load || true
68+
else
69+
ok "chacl audit rules already configured"
70+
fi
71+
}
72+
73+
# This function will check config parameters required
74+
check_config() {
75+
:
76+
}
77+
78+
# Source Root Dir Parameter
79+
if [ -r /etc/default/cis-hardening ]; then
80+
# shellcheck source=../../debian/default
81+
. /etc/default/cis-hardening
82+
fi
83+
if [ -z "${CIS_LIB_DIR}" ]; then
84+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
85+
echo "Cannot source CIS_LIB_DIR variable, aborting."
86+
exit 128
87+
fi
88+
89+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
90+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
91+
# shellcheck source=../../lib/main.sh
92+
. "${CIS_LIB_DIR}"/main.sh
93+
else
94+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is ${CIS_LIB_DIR} in /etc/default/cis-hardening"
95+
exit 128
96+
fi

‎bin/hardening/audit_chcon.sh‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure use of chcon command is audited (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=4
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure audit rules for chcon command are configured."
19+
20+
AUDIT_RULES_FILE='/etc/audit/rules.d/50-perm_chng.rules'
21+
UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
22+
23+
# Global state
24+
RULES_OK=1
25+
26+
# This function will be called if the script status is on enabled / audit mode
27+
audit() {
28+
RULES_OK=1
29+
30+
if [ ! -f "$AUDIT_RULES_FILE" ]; then
31+
crit "Audit rules file $AUDIT_RULES_FILE does not exist"
32+
RULES_OK=0
33+
return
34+
fi
35+
36+
# Check for chcon rules
37+
if ! grep -qE "chcon.*-k perm_chng" "$AUDIT_RULES_FILE"; then
38+
crit "chcon audit rule not found"
39+
RULES_OK=0
40+
else
41+
ok "chcon audit rules are correctly configured"
42+
fi
43+
}
44+
45+
# This function will be called if the script status is on enabled mode
46+
apply() {
47+
if [ "$RULES_OK" -eq 0 ]; then
48+
info "Creating chcon audit rules"
49+
mkdir -p "$(dirname "$AUDIT_RULES_FILE")"
50+
51+
# Create or append to the file
52+
if [ ! -f "$AUDIT_RULES_FILE" ]; then
53+
cat >"$AUDIT_RULES_FILE" <<EOF
54+
## Permission modification
55+
EOF
56+
fi
57+
58+
# Add chcon rules if not present
59+
if ! grep -q "chcon" "$AUDIT_RULES_FILE" 2>/dev/null; then
60+
cat >>"$AUDIT_RULES_FILE" <<EOF
61+
-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=$UID_MIN -F auid!=unset -k perm_chng
62+
EOF
63+
fi
64+
65+
# Load the rules
66+
info "Loading audit rules"
67+
augenrules --load || true
68+
else
69+
ok "chcon audit rules already configured"
70+
fi
71+
}
72+
73+
# This function will check config parameters required
74+
check_config() {
75+
:
76+
}
77+
78+
# Source Root Dir Parameter
79+
if [ -r /etc/default/cis-hardening ]; then
80+
# shellcheck source=../../debian/default
81+
. /etc/default/cis-hardening
82+
fi
83+
if [ -z "${CIS_LIB_DIR}" ]; then
84+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
85+
echo "Cannot source CIS_LIB_DIR variable, aborting."
86+
exit 128
87+
fi
88+
89+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
90+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
91+
# shellcheck source=../../lib/main.sh
92+
. "${CIS_LIB_DIR}"/main.sh
93+
else
94+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is ${CIS_LIB_DIR} in /etc/default/cis-hardening"
95+
exit 128
96+
fi

‎bin/hardening/audit_file_deletion.sh‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure file deletion events by users are collected
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=4
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure file deletion events are audited"
19+
20+
AUDIT_RULES_FILE="/etc/audit/rules.d/50-delete.rules"
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
if [ ! -f "$AUDIT_RULES_FILE" ]; then
25+
crit "Audit rules file $AUDIT_RULES_FILE does not exist"
26+
FNRET=1
27+
return
28+
fi
29+
30+
UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
31+
if [ -z "$UID_MIN" ]; then
32+
crit "Unable to determine UID_MIN from /etc/login.defs"
33+
FNRET=1
34+
return
35+
fi
36+
37+
# Check for required rules
38+
RULES_OK=0
39+
if grep -q "^\-a always,exit \-F arch=b64 \-S unlink,unlinkat,rename,renameat \-F auid>=${UID_MIN} \-F auid!=unset \-k delete" "$AUDIT_RULES_FILE" &&
40+
grep -q "^\-a always,exit \-F arch=b32 \-S unlink,unlinkat,rename,renameat \-F auid>=${UID_MIN} \-F auid!=unset \-k delete" "$AUDIT_RULES_FILE"; then
41+
RULES_OK=1
42+
fi
43+
44+
if [ "$RULES_OK" -eq 1 ]; then
45+
ok "File deletion events are correctly configured in $AUDIT_RULES_FILE"
46+
FNRET=0
47+
else
48+
crit "File deletion events rules are not correctly configured in $AUDIT_RULES_FILE"
49+
FNRET=2
50+
fi
51+
}
52+
53+
# This function will be called if the script status is on enabled mode
54+
apply() {
55+
if [ "$FNRET" -eq 0 ]; then
56+
ok "File deletion events are already correctly configured"
57+
elif [ "$FNRET" -eq 1 ]; then
58+
warn "Creating audit rules file $AUDIT_RULES_FILE"
59+
UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
60+
if [ -z "$UID_MIN" ]; then
61+
crit "Unable to determine UID_MIN from /etc/login.defs"
62+
return
63+
fi
64+
65+
cat >"$AUDIT_RULES_FILE" <<EOF
66+
# Ensure file deletion events by users are collected
67+
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F auid>=${UID_MIN} -F auid!=unset -k delete
68+
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F auid>=${UID_MIN} -F auid!=unset -k delete
69+
EOF
70+
71+
augenrules --load
72+
ok "File deletion audit rules created and loaded"
73+
elif [ "$FNRET" -eq 2 ]; then
74+
warn "Updating audit rules in $AUDIT_RULES_FILE"
75+
UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
76+
77+
# Remove any existing delete rules
78+
sed -i '/\-k delete/d' "$AUDIT_RULES_FILE"
79+
80+
# Add correct rules
81+
cat >>"$AUDIT_RULES_FILE" <<EOF
82+
# Ensure file deletion events by users are collected
83+
-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F auid>=${UID_MIN} -F auid!=unset -k delete
84+
-a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F auid>=${UID_MIN} -F auid!=unset -k delete
85+
EOF
86+
87+
augenrules --load
88+
ok "File deletion audit rules updated and loaded"
89+
fi
90+
}
91+
92+
# This function will check config parameters required
93+
check_config() {
94+
:
95+
}
96+
97+
# Source Root Dir Parameter
98+
if [ -r /etc/default/cis-hardening ]; then
99+
# shellcheck source=../../debian/default
100+
. /etc/default/cis-hardening
101+
fi
102+
if [ -z "$CIS_LIB_DIR" ]; then
103+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
104+
echo "Cannot source CIS_LIB_DIR variable, aborting."
105+
exit 128
106+
fi
107+
108+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
109+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
110+
# shellcheck source=../../lib/main.sh
111+
. "${CIS_LIB_DIR}"/main.sh
112+
else
113+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
114+
exit 128
115+
fi

0 commit comments

Comments
 (0)