Skip to content

Commit 5c4fd20

Browse files
author
damien cavagnini
committed
to be completed
1 parent 5e25306 commit 5c4fd20

File tree

10 files changed

+713
-0
lines changed

10 files changed

+713
-0
lines changed

‎bin/hardening/audit_chacl.sh‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure use of chacl command is audited (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=4
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure audit rules for chacl command are configured."
19+
20+
AUDIT_RULES_FILE='/etc/audit/rules.d/50-perm_chng.rules'
21+
AUDIT_RULES_DIR='/etc/audit/rules.d'
22+
23+
# Global state
24+
AC_RULES_OK=0
25+
AC_UID_MIN=""
26+
27+
# This function will be called if the script status is on enabled / audit mode
28+
audit() {
29+
AC_RULES_OK=0
30+
31+
# Get UID_MIN
32+
AC_UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
33+
if [ -z "$AC_UID_MIN" ]; then
34+
crit "Unable to determine UID_MIN from /etc/login.defs"
35+
return
36+
fi
37+
38+
# Check on disk configuration
39+
local l_ondisk_result
40+
l_ondisk_result=$(awk "/^ *-a *always,exit/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&/ -F *auid>=${AC_UID_MIN}/ &&/ -F *perm=x/ &&/ -F *path=\/usr\/bin\/chacl/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)" "$AUDIT_RULES_DIR"/*.rules 2>/dev/null || true)
41+
42+
# Check running configuration
43+
local l_running_result
44+
l_running_result=$(auditctl -l 2>/dev/null | awk "/^ *-a *always,exit/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&/ -F *auid>=${AC_UID_MIN}/ &&/ -F *perm=x/ &&/ -F *path=\/usr\/bin\/chacl/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)" || true)
45+
46+
if [ -n "$l_ondisk_result" ] && [ -n "$l_running_result" ]; then
47+
ok "chacl audit rules are correctly configured on disk and running"
48+
AC_RULES_OK=1
49+
else
50+
if [ -z "$l_ondisk_result" ]; then
51+
crit "chacl audit rule not found in on-disk configuration"
52+
fi
53+
if [ -z "$l_running_result" ]; then
54+
crit "chacl audit rule not found in running configuration"
55+
fi
56+
AC_RULES_OK=0
57+
fi
58+
}
59+
60+
# This function will be called if the script status is on enabled mode
61+
apply() {
62+
if [ "$AC_RULES_OK" -eq 1 ]; then
63+
ok "chacl audit rules already correctly configured"
64+
return
65+
fi
66+
67+
if [ -z "$AC_UID_MIN" ]; then
68+
crit "Unable to determine UID_MIN, cannot apply"
69+
return
70+
fi
71+
72+
info "Configuring chacl audit rules"
73+
mkdir -p "$AUDIT_RULES_DIR"
74+
75+
# Remove any existing chacl rules to avoid duplicates
76+
if [ -f "$AUDIT_RULES_FILE" ]; then
77+
sed -i '/path=\/usr\/bin\/chacl/d' "$AUDIT_RULES_FILE"
78+
fi
79+
80+
# Create file with header if it doesn't exist
81+
if [ ! -f "$AUDIT_RULES_FILE" ]; then
82+
echo "## Permission modification" >"$AUDIT_RULES_FILE"
83+
fi
84+
85+
# Add the rule
86+
echo "-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=${AC_UID_MIN} -F auid!=unset -k perm_chng" >>"$AUDIT_RULES_FILE"
87+
88+
# Load the rules
89+
info "Loading audit rules"
90+
augenrules --load
91+
ok "chacl audit rules configured and loaded"
92+
}
93+
94+
# This function will check config parameters required
95+
check_config() {
96+
:
97+
}
98+
99+
# Source Root Dir Parameter
100+
if [ -r /etc/default/cis-hardening ]; then
101+
# shellcheck source=../../debian/default
102+
. /etc/default/cis-hardening
103+
fi
104+
if [ -z "${CIS_LIB_DIR}" ]; then
105+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
106+
echo "Cannot source CIS_LIB_DIR variable, aborting."
107+
exit 128
108+
fi
109+
110+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
111+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
112+
# shellcheck source=../../lib/main.sh
113+
. "${CIS_LIB_DIR}"/main.sh
114+
else
115+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is ${CIS_LIB_DIR} in /etc/default/cis-hardening"
116+
exit 128
117+
fi

‎bin/hardening/audit_chcon.sh‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure use of chcon command is audited (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=4
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure audit rules for chcon command are configured."
19+
20+
AUDIT_RULES_FILE='/etc/audit/rules.d/50-perm_chng.rules'
21+
AUDIT_RULES_DIR='/etc/audit/rules.d'
22+
23+
# Global state
24+
ACO_RULES_OK=0
25+
ACO_UID_MIN=""
26+
27+
# This function will be called if the script status is on enabled / audit mode
28+
audit() {
29+
ACO_RULES_OK=0
30+
31+
# Get UID_MIN
32+
ACO_UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
33+
if [ -z "$ACO_UID_MIN" ]; then
34+
crit "Unable to determine UID_MIN from /etc/login.defs"
35+
return
36+
fi
37+
38+
# Check on disk configuration
39+
local l_ondisk_result
40+
l_ondisk_result=$(awk "/^ *-a *always,exit/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&/ -F *auid>=${ACO_UID_MIN}/ &&/ -F *perm=x/ &&/ -F *path=\/usr\/bin\/chcon/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)" "$AUDIT_RULES_DIR"/*.rules 2>/dev/null || true)
41+
42+
# Check running configuration
43+
local l_running_result
44+
l_running_result=$(auditctl -l 2>/dev/null | awk "/^ *-a *always,exit/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&/ -F *auid>=${ACO_UID_MIN}/ &&/ -F *perm=x/ &&/ -F *path=\/usr\/bin\/chcon/ &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)" || true)
45+
46+
if [ -n "$l_ondisk_result" ] && [ -n "$l_running_result" ]; then
47+
ok "chcon audit rules are correctly configured on disk and running"
48+
ACO_RULES_OK=1
49+
else
50+
if [ -z "$l_ondisk_result" ]; then
51+
crit "chcon audit rule not found in on-disk configuration"
52+
fi
53+
if [ -z "$l_running_result" ]; then
54+
crit "chcon audit rule not found in running configuration"
55+
fi
56+
ACO_RULES_OK=0
57+
fi
58+
}
59+
60+
# This function will be called if the script status is on enabled mode
61+
apply() {
62+
if [ "$ACO_RULES_OK" -eq 1 ]; then
63+
ok "chcon audit rules already correctly configured"
64+
return
65+
fi
66+
67+
if [ -z "$ACO_UID_MIN" ]; then
68+
crit "Unable to determine UID_MIN, cannot apply"
69+
return
70+
fi
71+
72+
info "Configuring chcon audit rules"
73+
mkdir -p "$AUDIT_RULES_DIR"
74+
75+
# Remove any existing chcon rules to avoid duplicates
76+
if [ -f "$AUDIT_RULES_FILE" ]; then
77+
sed -i '/path=\/usr\/bin\/chcon/d' "$AUDIT_RULES_FILE"
78+
fi
79+
80+
# Create file with header if it doesn't exist
81+
if [ ! -f "$AUDIT_RULES_FILE" ]; then
82+
echo "## Permission modification" >"$AUDIT_RULES_FILE"
83+
fi
84+
85+
# Add the rule
86+
echo "-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=${ACO_UID_MIN} -F auid!=unset -k perm_chng" >>"$AUDIT_RULES_FILE"
87+
88+
# Load the rules
89+
info "Loading audit rules"
90+
augenrules --load
91+
ok "chcon audit rules configured and loaded"
92+
}
93+
94+
# This function will check config parameters required
95+
check_config() {
96+
:
97+
}
98+
99+
# Source Root Dir Parameter
100+
if [ -r /etc/default/cis-hardening ]; then
101+
# shellcheck source=../../debian/default
102+
. /etc/default/cis-hardening
103+
fi
104+
if [ -z "${CIS_LIB_DIR}" ]; then
105+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
106+
echo "Cannot source CIS_LIB_DIR variable, aborting."
107+
exit 128
108+
fi
109+
110+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
111+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
112+
# shellcheck source=../../lib/main.sh
113+
. "${CIS_LIB_DIR}"/main.sh
114+
else
115+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is ${CIS_LIB_DIR} in /etc/default/cis-hardening"
116+
exit 128
117+
fi

‎bin/hardening/audit_file_deletion.sh‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure file deletion events by users are collected
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=4
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure file deletion events are audited"
19+
20+
AUDIT_RULES_FILE="/etc/audit/rules.d/50-delete.rules"
21+
AUDIT_RULES_DIR='/etc/audit/rules.d'
22+
23+
# Global state
24+
AFD_RULES_OK=0
25+
AFD_UID_MIN=""
26+
27+
# This function will be called if the script status is on enabled / audit mode
28+
audit() {
29+
AFD_RULES_OK=0
30+
31+
# Get UID_MIN
32+
AFD_UID_MIN=$(awk '/^\s*UID_MIN/{print $2}' /etc/login.defs)
33+
if [ -z "$AFD_UID_MIN" ]; then
34+
crit "Unable to determine UID_MIN from /etc/login.defs"
35+
return
36+
fi
37+
38+
# Check on disk configuration
39+
local l_ondisk_result
40+
l_ondisk_result=$(awk "/^ *-a *always,exit/ &&/ -F *arch=b(32|64)/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&/ -F *auid>=${AFD_UID_MIN}/ &&/ -S/ &&(/unlink/||/rename/||/unlinkat/||/renameat/) &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)" "$AUDIT_RULES_DIR"/*.rules 2>/dev/null || true)
41+
42+
# Check running configuration
43+
local l_running_result
44+
l_running_result=$(auditctl -l 2>/dev/null | awk "/^ *-a *always,exit/ &&/ -F *arch=b(32|64)/ &&(/ -F *auid!=unset/||/ -F *auid!=-1/||/ -F *auid!=4294967295/) &&/ -F *auid>=${AFD_UID_MIN}/ &&/ -S/ &&(/unlink/||/rename/||/unlinkat/||/renameat/) &&(/ key= *[!-~]* *$/||/ -k *[!-~]* *$/)" || true)
45+
46+
# We need both b64 and b32 rules in both configurations
47+
local l_ondisk_b64 l_ondisk_b32 l_running_b64 l_running_b32
48+
l_ondisk_b64=$(echo "$l_ondisk_result" | grep -c "b64" || true)
49+
l_ondisk_b32=$(echo "$l_ondisk_result" | grep -c "b32" || true)
50+
l_running_b64=$(echo "$l_running_result" | grep -c "b64" || true)
51+
l_running_b32=$(echo "$l_running_result" | grep -c "b32" || true)
52+
53+
if [ "$l_ondisk_b64" -ge 1 ] && [ "$l_ondisk_b32" -ge 1 ] && [ "$l_running_b64" -ge 1 ] && [ "$l_running_b32" -ge 1 ]; then
54+
ok "File deletion events are correctly configured on disk and running"
55+
AFD_RULES_OK=1
56+
else
57+
if [ "$l_ondisk_b64" -eq 0 ] || [ "$l_ondisk_b32" -eq 0 ]; then
58+
crit "File deletion audit rules not found or incomplete in on-disk configuration"
59+
fi
60+
if [ "$l_running_b64" -eq 0 ] || [ "$l_running_b32" -eq 0 ]; then
61+
crit "File deletion audit rules not found or incomplete in running configuration"
62+
fi
63+
AFD_RULES_OK=0
64+
fi
65+
}
66+
67+
# This function will be called if the script status is on enabled mode
68+
apply() {
69+
if [ "$AFD_RULES_OK" -eq 1 ]; then
70+
ok "File deletion audit rules already correctly configured"
71+
return
72+
fi
73+
74+
if [ -z "$AFD_UID_MIN" ]; then
75+
crit "Unable to determine UID_MIN, cannot apply"
76+
return
77+
fi
78+
79+
info "Configuring file deletion audit rules"
80+
mkdir -p "$AUDIT_RULES_DIR"
81+
82+
# Remove any existing delete rules to avoid duplicates
83+
if [ -f "$AUDIT_RULES_FILE" ]; then
84+
sed -i '/\-k delete/d' "$AUDIT_RULES_FILE"
85+
fi
86+
87+
# Create file with header if it doesn't exist
88+
if [ ! -f "$AUDIT_RULES_FILE" ]; then
89+
echo "## File deletion events" >"$AUDIT_RULES_FILE"
90+
fi
91+
92+
# Add the rules
93+
{
94+
echo "-a always,exit -F arch=b64 -S rename,unlink,unlinkat,renameat -F auid>=${AFD_UID_MIN} -F auid!=unset -k delete"
95+
echo "-a always,exit -F arch=b32 -S rename,unlink,unlinkat,renameat -F auid>=${AFD_UID_MIN} -F auid!=unset -k delete"
96+
} >>"$AUDIT_RULES_FILE"
97+
98+
# Load the rules
99+
info "Loading audit rules"
100+
augenrules --load
101+
ok "File deletion audit rules configured and loaded"
102+
}
103+
104+
# This function will check config parameters required
105+
check_config() {
106+
:
107+
}
108+
109+
# Source Root Dir Parameter
110+
if [ -r /etc/default/cis-hardening ]; then
111+
# shellcheck source=../../debian/default
112+
. /etc/default/cis-hardening
113+
fi
114+
if [ -z "$CIS_LIB_DIR" ]; then
115+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
116+
echo "Cannot source CIS_LIB_DIR variable, aborting."
117+
exit 128
118+
fi
119+
120+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
121+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
122+
# shellcheck source=../../lib/main.sh
123+
. "${CIS_LIB_DIR}"/main.sh
124+
else
125+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
126+
exit 128
127+
fi

0 commit comments

Comments
 (0)