Skip to content

Commit 69497c1

Browse files
author
damien cavagnini
committed
add new scripts for debian12
bin/hardening/sshd_disable_gssapi.sh -> 5.1.9 bin/hardening/timesyncd_authorized_server.sh -> 2.3.2.1 bin/hardening/chrony_authorized_server.sh -> 2.3.3.1 bin/hardening/dev_shm_nodev.sh -> 1.1.2.2.2 bin/hardening/dev_shm_noexec.sh -> 1.1.2.2.4 bin/hardening/dev_shm_nosuid.sh -> 1.1.2.2.3
1 parent 5e25306 commit 69497c1

12 files changed

+1176
-0
lines changed

‎bin/hardening/chrony_authorized_server.sh‎

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure chrony is configured with authorized timeserver (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure chrony is configured with authorized timeserver."
19+
20+
PACKAGE='chrony'
21+
SOURCES_DIR='/etc/chrony/sources.d'
22+
SOURCES_FILE="$SOURCES_DIR/authorized.sources"
23+
MAIN_CONF='/etc/chrony/chrony.conf'
24+
25+
# Configurable via create_config
26+
CHRONY_TIME_SOURCES=''
27+
28+
# Global state (0=success, 1=failure)
29+
CHRONY_AUTH_PKG_INSTALLED=1
30+
CHRONY_AUTH_CONFIG_OK=1
31+
32+
# Check function to populate state
33+
chrony_auth_check() {
34+
CHRONY_AUTH_PKG_INSTALLED=1
35+
CHRONY_AUTH_CONFIG_OK=1
36+
37+
is_pkg_installed "$PACKAGE"
38+
if [ "$FNRET" != 0 ]; then
39+
# Package not installed (1=not installed/failure)
40+
CHRONY_AUTH_PKG_INSTALLED=1
41+
return
42+
fi
43+
# Package is installed (0=installed/success)
44+
CHRONY_AUTH_PKG_INSTALLED=0
45+
46+
# Check if sources.d directory is included in main config
47+
if [ -f "$MAIN_CONF" ]; then
48+
does_pattern_exist_in_file "$MAIN_CONF" "^sourcedir.*$SOURCES_DIR"
49+
if [ "$FNRET" != 0 ]; then
50+
# sourcedir not configured (1=not OK/failure)
51+
CHRONY_AUTH_CONFIG_OK=1
52+
return
53+
fi
54+
else
55+
# Main config not found (1=not OK/failure)
56+
CHRONY_AUTH_CONFIG_OK=1
57+
return
58+
fi
59+
60+
# Check sources file
61+
if [ ! -f "$SOURCES_FILE" ]; then
62+
# Sources file doesn't exist (1=not OK/failure)
63+
CHRONY_AUTH_CONFIG_OK=1
64+
return
65+
fi
66+
67+
if [ -z "$CHRONY_TIME_SOURCES" ]; then
68+
# Cannot verify without configured sources (1=not OK/failure)
69+
CHRONY_AUTH_CONFIG_OK=1
70+
return
71+
fi
72+
73+
# Check if configured sources are present
74+
does_pattern_exist_in_file "$SOURCES_FILE" "$CHRONY_TIME_SOURCES"
75+
if [ "$FNRET" != 0 ]; then
76+
# Sources not found (1=not OK/failure)
77+
CHRONY_AUTH_CONFIG_OK=1
78+
return
79+
fi
80+
81+
# All checks passed (0=OK/success)
82+
CHRONY_AUTH_CONFIG_OK=0
83+
}
84+
85+
# This function will be called if the script status is on enabled / audit mode
86+
audit() {
87+
chrony_auth_check
88+
89+
if [ "$CHRONY_AUTH_PKG_INSTALLED" -ne 0 ]; then
90+
crit "$PACKAGE is not installed"
91+
return
92+
fi
93+
ok "$PACKAGE is installed"
94+
95+
if [ "$CHRONY_AUTH_CONFIG_OK" -ne 0 ]; then
96+
crit "Chrony configuration is not correct"
97+
else
98+
ok "Time sources correctly configured"
99+
fi
100+
}
101+
102+
# This function will be called if the script status is on enabled mode
103+
apply() {
104+
if [ "$CHRONY_AUTH_PKG_INSTALLED" -ne 0 ]; then
105+
crit "$PACKAGE is not installed, cannot apply"
106+
return
107+
fi
108+
109+
if [ "$CHRONY_AUTH_CONFIG_OK" -ne 0 ]; then
110+
# Ensure sourcedir directive exists in main config
111+
info "Ensuring sourcedir is configured in $MAIN_CONF"
112+
if [ -f "$MAIN_CONF" ]; then
113+
does_pattern_exist_in_file "$MAIN_CONF" "^sourcedir.*$SOURCES_DIR"
114+
if [ "$FNRET" != 0 ]; then
115+
backup_file "$MAIN_CONF"
116+
add_end_of_file "$MAIN_CONF" "sourcedir $SOURCES_DIR"
117+
fi
118+
fi
119+
120+
# Create sources directory and file
121+
info "Creating chrony sources configuration"
122+
mkdir -p "$SOURCES_DIR"
123+
124+
if [ -n "$CHRONY_TIME_SOURCES" ]; then
125+
echo "$CHRONY_TIME_SOURCES" >"$SOURCES_FILE"
126+
fi
127+
128+
# Restart chronyd service
129+
info "Restarting chronyd service"
130+
is_systemctl_running
131+
if [ "$FNRET" = 0 ]; then
132+
systemctl restart chronyd
133+
else
134+
info "Systemd is not running, skipping service restart"
135+
fi
136+
else
137+
ok "Chrony configuration already correct"
138+
fi
139+
}
140+
141+
# This function will check config parameters required
142+
check_config() {
143+
if [ -z "$CHRONY_TIME_SOURCES" ]; then
144+
crit "CHRONY_TIME_SOURCES is not configured"
145+
exit 128
146+
fi
147+
}
148+
149+
# This function will create the config file for this check with default values
150+
create_config() {
151+
cat <<EOF
152+
status=audit
153+
# Configuration for script: $SCRIPT_NAME
154+
# Put your authorized NTP time servers here in chrony.sources format
155+
# Example: pool 2.debian.pool.ntp.org iburst
156+
CHRONY_TIME_SOURCES='pool 2.debian.pool.ntp.org iburst'
157+
EOF
158+
}
159+
160+
# Source Root Dir Parameter
161+
if [ -r /etc/default/cis-hardening ]; then
162+
# shellcheck source=../../debian/default
163+
. /etc/default/cis-hardening
164+
fi
165+
if [ -z "${CIS_LIB_DIR}" ]; then
166+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
167+
echo "Cannot source CIS_LIB_DIR variable, aborting."
168+
exit 128
169+
fi
170+
171+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
172+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
173+
# shellcheck source=../../lib/main.sh
174+
. "${CIS_LIB_DIR}"/main.sh
175+
else
176+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is ${CIS_LIB_DIR} in /etc/default/cis-hardening"
177+
exit 128
178+
fi

‎bin/hardening/dev_shm_nodev.sh‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure nodev option set on /dev/shm partition (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure nodev option set on /dev/shm partition."
19+
20+
PARTITION="/dev/shm"
21+
OPTION="nodev"
22+
23+
# Global state (0=success, 1=failure)
24+
DEV_SHM_NODEV_IS_PARTITION=1
25+
DEV_SHM_NODEV_FSTAB_HAS_OPTION=1
26+
DEV_SHM_NODEV_MOUNTED_WITH_OPTION=1
27+
28+
# Check function to populate state
29+
dev_shm_nodev_check() {
30+
DEV_SHM_NODEV_IS_PARTITION=1
31+
DEV_SHM_NODEV_FSTAB_HAS_OPTION=1
32+
DEV_SHM_NODEV_MOUNTED_WITH_OPTION=1
33+
34+
is_a_partition "$PARTITION"
35+
if [ "$FNRET" -eq 0 ]; then
36+
# Is a partition (0=is partition/success)
37+
DEV_SHM_NODEV_IS_PARTITION=0
38+
else
39+
# Not a partition (1=not a partition/failure)
40+
return
41+
fi
42+
43+
has_mount_option "$PARTITION" "$OPTION"
44+
if [ "$FNRET" -eq 0 ]; then
45+
# Has option in fstab (0=has option/success)
46+
DEV_SHM_NODEV_FSTAB_HAS_OPTION=0
47+
fi
48+
49+
has_mounted_option "$PARTITION" "$OPTION"
50+
if [ "$FNRET" -eq 0 ]; then
51+
# Mounted with option (0=mounted with option/success)
52+
DEV_SHM_NODEV_MOUNTED_WITH_OPTION=0
53+
fi
54+
}
55+
56+
# This function will be called if the script status is on enabled / audit mode
57+
audit() {
58+
dev_shm_nodev_check
59+
60+
if [ "$DEV_SHM_NODEV_IS_PARTITION" -ne 0 ]; then
61+
crit "$PARTITION is not a partition"
62+
return
63+
fi
64+
65+
if [ "$DEV_SHM_NODEV_FSTAB_HAS_OPTION" -ne 0 ]; then
66+
crit "$PARTITION has no option $OPTION in fstab!"
67+
else
68+
ok "$PARTITION has $OPTION in fstab"
69+
fi
70+
71+
if [ "$DEV_SHM_NODEV_MOUNTED_WITH_OPTION" -ne 0 ]; then
72+
warn "$PARTITION is not mounted with $OPTION at runtime"
73+
else
74+
ok "$PARTITION mounted with $OPTION"
75+
fi
76+
}
77+
78+
# This function will be called if the script status is on enabled mode
79+
apply() {
80+
if [ "$DEV_SHM_NODEV_IS_PARTITION" -ne 0 ]; then
81+
crit "$PARTITION is not a partition, cannot apply"
82+
return
83+
fi
84+
85+
if [ "$DEV_SHM_NODEV_FSTAB_HAS_OPTION" -ne 0 ]; then
86+
info "Adding $OPTION to $PARTITION in fstab"
87+
add_option_to_fstab "$PARTITION" "$OPTION"
88+
fi
89+
90+
if [ "$DEV_SHM_NODEV_MOUNTED_WITH_OPTION" -ne 0 ]; then
91+
info "Remounting $PARTITION with $OPTION"
92+
remount_partition "$PARTITION"
93+
fi
94+
}
95+
96+
# This function will check config parameters required
97+
check_config() {
98+
:
99+
}
100+
101+
# Source Root Dir Parameter
102+
if [ -r /etc/default/cis-hardening ]; then
103+
# shellcheck source=../../debian/default
104+
. /etc/default/cis-hardening
105+
fi
106+
if [ -z "${CIS_LIB_DIR}" ]; then
107+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
108+
echo "Cannot source CIS_LIB_DIR variable, aborting."
109+
exit 128
110+
fi
111+
112+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
113+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
114+
# shellcheck source=../../lib/main.sh
115+
. "${CIS_LIB_DIR}"/main.sh
116+
else
117+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is ${CIS_LIB_DIR} in /etc/default/cis-hardening"
118+
exit 128
119+
fi

0 commit comments

Comments
 (0)