Skip to content

Commit 30401be

Browse files
author
damien cavagnini
committed
add new debian12 scripts
 bin/hardening/audit_chacl.sh -> 6.3.3.17 bin/hardening/audit_chcon.sh -> 6.3.3.15 bin/hardening/audit_file_deletion.sh -> 6.3.3.13 bin/hardening/audit_setfacl.sh -> 6.3.3.16 bin/hardening/audit_sudo_log.sh -> 6.3.3.3 ?
1 parent 5e25306 commit 30401be

File tree

10 files changed

+708
-0
lines changed

10 files changed

+708
-0
lines changed

‎bin/hardening/audit_chacl.sh‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure use of chacl command is audited (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=4
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure audit rules for chacl command are configured."
19+
20+
AUDIT_RULES_FILE='/etc/audit/rules.d/50-perm_chng.rules'
21+
AUDIT_RULES_DIR='/etc/audit/rules.d'
22+
23+
# Global state
24+
AC_RULES_OK=1
25+
AC_UID_MIN=""
26+
27+
# This function will be called if the script status is on enabled / audit mode
28+
audit() {
29+
30+
# Get UID_MIN
31+
AC_UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
32+
if [ -z "$AC_UID_MIN" ]; then
33+
crit "Unable to determine UID_MIN from /etc/login.defs"
34+
return
35+
fi
36+
37+
# Check on disk configuration
38+
local l_ondisk_result
39+
l_ondisk_result=$(awk "/^ *-a *always,exit/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&/ -F *auid>=${AC_UID_MIN}/ &&/ -F *perm=x/ &&/ -F *path=\/usr\/bin\/chacl/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)" "$AUDIT_RULES_DIR"/*.rules 2>/dev/null || true)
40+
41+
# Check running configuration
42+
local l_running_result
43+
l_running_result=$(auditctl -l 2>/dev/null | awk "/^ *-a *always,exit/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&/ -F *auid>=${AC_UID_MIN}/ &&/ -F *perm=x/ &&/ -F *path=\/usr\/bin\/chacl/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)" || true)
44+
45+
if [ -n "$l_ondisk_result" ] && [ -n "$l_running_result" ]; then
46+
ok "chacl audit rules are correctly configured on disk and running"
47+
AC_RULES_OK=0
48+
else
49+
if [ -z "$l_ondisk_result" ]; then
50+
crit "chacl audit rule not found in on-disk configuration"
51+
fi
52+
if [ -z "$l_running_result" ]; then
53+
crit "chacl audit rule not found in running configuration"
54+
fi
55+
AC_RULES_OK=1
56+
fi
57+
}
58+
59+
# This function will be called if the script status is on enabled mode
60+
apply() {
61+
if [ "$AC_RULES_OK" -eq 0 ]; then
62+
ok "chacl audit rules already correctly configured"
63+
return
64+
fi
65+
66+
if [ -z "$AC_UID_MIN" ]; then
67+
crit "Unable to determine UID_MIN, cannot apply"
68+
return
69+
fi
70+
71+
info "Configuring chacl audit rules"
72+
mkdir -p "$AUDIT_RULES_DIR"
73+
74+
# Remove any existing chacl rules to avoid duplicates
75+
if [ -f "$AUDIT_RULES_FILE" ]; then
76+
sed -i '/path=\/usr\/bin\/chacl/d' "$AUDIT_RULES_FILE"
77+
fi
78+
79+
# Create file with header if it doesn't exist
80+
if [ ! -f "$AUDIT_RULES_FILE" ]; then
81+
echo "## Permission modification" >"$AUDIT_RULES_FILE"
82+
fi
83+
84+
# Add the rule
85+
echo "-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=${AC_UID_MIN} -F auid!=unset -k perm_chng" >>"$AUDIT_RULES_FILE"
86+
87+
# Load the rules
88+
info "Loading audit rules"
89+
augenrules --load
90+
ok "chacl audit rules configured and loaded"
91+
}
92+
93+
# This function will check config parameters required
94+
check_config() {
95+
:
96+
}
97+
98+
# Source Root Dir Parameter
99+
if [ -r /etc/default/cis-hardening ]; then
100+
# shellcheck source=../../debian/default
101+
. /etc/default/cis-hardening
102+
fi
103+
if [ -z "${CIS_LIB_DIR}" ]; then
104+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
105+
echo "Cannot source CIS_LIB_DIR variable, aborting."
106+
exit 128
107+
fi
108+
109+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
110+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
111+
# shellcheck source=../../lib/main.sh
112+
. "${CIS_LIB_DIR}"/main.sh
113+
else
114+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is ${CIS_LIB_DIR} in /etc/default/cis-hardening"
115+
exit 128
116+
fi

‎bin/hardening/audit_chcon.sh‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure use of chcon command is audited (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=4
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure audit rules for chcon command are configured."
19+
20+
AUDIT_RULES_FILE='/etc/audit/rules.d/50-perm_chng.rules'
21+
AUDIT_RULES_DIR='/etc/audit/rules.d'
22+
23+
# Global state
24+
ACO_RULES_OK=1
25+
ACO_UID_MIN=""
26+
27+
# This function will be called if the script status is on enabled / audit mode
28+
audit() {
29+
30+
# Get UID_MIN
31+
ACO_UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
32+
if [ -z "$ACO_UID_MIN" ]; then
33+
crit "Unable to determine UID_MIN from /etc/login.defs"
34+
return
35+
fi
36+
37+
# Check on disk configuration
38+
local l_ondisk_result
39+
l_ondisk_result=$(awk "/^ *-a *always,exit/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&/ -F *auid>=${ACO_UID_MIN}/ &&/ -F *perm=x/ &&/ -F *path=\/usr\/bin\/chcon/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)" "$AUDIT_RULES_DIR"/*.rules 2>/dev/null || true)
40+
41+
# Check running configuration
42+
local l_running_result
43+
l_running_result=$(auditctl -l 2>/dev/null | awk "/^ *-a *always,exit/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&/ -F *auid>=${ACO_UID_MIN}/ &&/ -F *perm=x/ &&/ -F *path=\/usr\/bin\/chcon/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)" || true)
44+
45+
if [ -n "$l_ondisk_result" ] && [ -n "$l_running_result" ]; then
46+
ok "chcon audit rules are correctly configured on disk and running"
47+
ACO_RULES_OK=0
48+
else
49+
if [ -z "$l_ondisk_result" ]; then
50+
crit "chcon audit rule not found in on-disk configuration"
51+
fi
52+
if [ -z "$l_running_result" ]; then
53+
crit "chcon audit rule not found in running configuration"
54+
fi
55+
ACO_RULES_OK=1
56+
fi
57+
}
58+
59+
# This function will be called if the script status is on enabled mode
60+
apply() {
61+
if [ "$ACO_RULES_OK" -eq 0 ]; then
62+
ok "chcon audit rules already correctly configured"
63+
return
64+
fi
65+
66+
if [ -z "$ACO_UID_MIN" ]; then
67+
crit "Unable to determine UID_MIN, cannot apply"
68+
return
69+
fi
70+
71+
info "Configuring chcon audit rules"
72+
mkdir -p "$AUDIT_RULES_DIR"
73+
74+
# Remove any existing chcon rules to avoid duplicates
75+
if [ -f "$AUDIT_RULES_FILE" ]; then
76+
sed -i '/path=\/usr\/bin\/chcon/d' "$AUDIT_RULES_FILE"
77+
fi
78+
79+
# Create file with header if it doesn't exist
80+
if [ ! -f "$AUDIT_RULES_FILE" ]; then
81+
echo "## Permission modification" >"$AUDIT_RULES_FILE"
82+
fi
83+
84+
# Add the rule
85+
echo "-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=${ACO_UID_MIN} -F auid!=unset -k perm_chng" >>"$AUDIT_RULES_FILE"
86+
87+
# Load the rules
88+
info "Loading audit rules"
89+
augenrules --load
90+
ok "chcon audit rules configured and loaded"
91+
}
92+
93+
# This function will check config parameters required
94+
check_config() {
95+
:
96+
}
97+
98+
# Source Root Dir Parameter
99+
if [ -r /etc/default/cis-hardening ]; then
100+
# shellcheck source=../../debian/default
101+
. /etc/default/cis-hardening
102+
fi
103+
if [ -z "${CIS_LIB_DIR}" ]; then
104+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
105+
echo "Cannot source CIS_LIB_DIR variable, aborting."
106+
exit 128
107+
fi
108+
109+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
110+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
111+
# shellcheck source=../../lib/main.sh
112+
. "${CIS_LIB_DIR}"/main.sh
113+
else
114+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is ${CIS_LIB_DIR} in /etc/default/cis-hardening"
115+
exit 128
116+
fi

‎bin/hardening/audit_file_deletion.sh‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure file deletion events by users are collected
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=4
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure file deletion events are audited"
19+
20+
AUDIT_RULES_FILE="/etc/audit/rules.d/50-delete.rules"
21+
AUDIT_RULES_DIR='/etc/audit/rules.d'
22+
23+
# Global state
24+
AFD_RULES_OK=1
25+
AFD_UID_MIN=""
26+
27+
# This function will be called if the script status is on enabled / audit mode
28+
audit() {
29+
30+
# Get UID_MIN
31+
AFD_UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
32+
if [ -z "$AFD_UID_MIN" ]; then
33+
crit "Unable to determine UID_MIN from /etc/login.defs"
34+
return
35+
fi
36+
37+
# Check on disk configuration
38+
local l_ondisk_result
39+
l_ondisk_result=$(awk "/^ *-a *always,exit/ &&/ -F *arch=b(32|64)/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&/ -F *auid>=${AFD_UID_MIN}/ &&/ -S/ &&(/unlink/||/rename/||/unlinkat/||/renameat/) &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)" "$AUDIT_RULES_DIR"/*.rules 2>/dev/null || true)
40+
41+
# Check running configuration
42+
local l_running_result
43+
l_running_result=$(auditctl -l 2>/dev/null | awk "/^ *-a *always,exit/ &&/ -F *arch=b(32|64)/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&/ -F *auid>=${AFD_UID_MIN}/ &&/ -S/ &&(/unlink/||/rename/||/unlinkat/||/renameat/) &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)" || true)
44+
45+
# We need both b64 and b32 rules in both configurations
46+
local l_ondisk_b64 l_ondisk_b32 l_running_b64 l_running_b32
47+
l_ondisk_b64=$(echo "$l_ondisk_result" | grep -c "b64" || true)
48+
l_ondisk_b32=$(echo "$l_ondisk_result" | grep -c "b32" || true)
49+
l_running_b64=$(echo "$l_running_result" | grep -c "b64" || true)
50+
l_running_b32=$(echo "$l_running_result" | grep -c "b32" || true)
51+
52+
if [ "$l_ondisk_b64" -ge 1 ] && [ "$l_ondisk_b32" -ge 1 ] && [ "$l_running_b64" -ge 1 ] && [ "$l_running_b32" -ge 1 ]; then
53+
ok "File deletion events are correctly configured on disk and running"
54+
AFD_RULES_OK=0
55+
else
56+
if [ "$l_ondisk_b64" -eq 0 ] || [ "$l_ondisk_b32" -eq 0 ]; then
57+
crit "File deletion audit rules not found or incomplete in on-disk configuration"
58+
fi
59+
if [ "$l_running_b64" -eq 0 ] || [ "$l_running_b32" -eq 0 ]; then
60+
crit "File deletion audit rules not found or incomplete in running configuration"
61+
fi
62+
AFD_RULES_OK=1
63+
fi
64+
}
65+
66+
# This function will be called if the script status is on enabled mode
67+
apply() {
68+
if [ "$AFD_RULES_OK" -eq 0 ]; then
69+
ok "File deletion audit rules already correctly configured"
70+
return
71+
fi
72+
73+
if [ -z "$AFD_UID_MIN" ]; then
74+
crit "Unable to determine UID_MIN, cannot apply"
75+
return
76+
fi
77+
78+
info "Configuring file deletion audit rules"
79+
mkdir -p "$AUDIT_RULES_DIR"
80+
81+
# Remove any existing delete rules to avoid duplicates
82+
if [ -f "$AUDIT_RULES_FILE" ]; then
83+
sed -i '/\-k delete/d' "$AUDIT_RULES_FILE"
84+
fi
85+
86+
# Create file with header if it doesn't exist
87+
if [ ! -f "$AUDIT_RULES_FILE" ]; then
88+
echo "## File deletion events" >"$AUDIT_RULES_FILE"
89+
fi
90+
91+
# Add the rules
92+
{
93+
echo "-a always,exit -F arch=b64 -S rename,unlink,unlinkat,renameat -F auid>=${AFD_UID_MIN} -F auid!=unset -k delete"
94+
echo "-a always,exit -F arch=b32 -S rename,unlink,unlinkat,renameat -F auid>=${AFD_UID_MIN} -F auid!=unset -k delete"
95+
} >>"$AUDIT_RULES_FILE"
96+
97+
# Load the rules
98+
info "Loading audit rules"
99+
augenrules --load
100+
ok "File deletion audit rules configured and loaded"
101+
}
102+
103+
# This function will check config parameters required
104+
check_config() {
105+
:
106+
}
107+
108+
# Source Root Dir Parameter
109+
if [ -r /etc/default/cis-hardening ]; then
110+
# shellcheck source=../../debian/default
111+
. /etc/default/cis-hardening
112+
fi
113+
if [ -z "$CIS_LIB_DIR" ]; then
114+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
115+
echo "Cannot source CIS_LIB_DIR variable, aborting."
116+
exit 128
117+
fi
118+
119+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
120+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
121+
# shellcheck source=../../lib/main.sh
122+
. "${CIS_LIB_DIR}"/main.sh
123+
else
124+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
125+
exit 128
126+
fi

0 commit comments

Comments
 (0)