Skip to content

Commit 8aeb22f

Browse files
damcav35damien cavagnini
damcav35
and
damien cavagnini
authored
Damcava35/deb12 scripts 5 (#289)
* refacto: systemd is-active / is-enabled Manage different object types (service, socket, timer...) in a generic way. * feat: add debian12 scripts ufw_is_installed.sh -> 4.1.1 iptables_persistent_is_not_installed.sh -> 4.1.2 ufw_is_enabled -> 4.1.3 nftables_not_installed_with_iptables.sh -> 4.3.1.2 libpam_runtime_is_version -> 5.3.1.1 --------- Co-authored-by: damien cavagnini <damien.cavagnini@corp.ovh.com>
1 parent 94f110d commit 8aeb22f

11 files changed

+562
-19
lines changed

‎bin/hardening/iptables_persistent_is_not_installed.sh‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure iptables-persistent is not installed with ufw (Manual)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure iptables-persistent is not installed, requirement for ufw."
19+
20+
PACKAGE='iptables-persistent'
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
is_pkg_installed "$PACKAGE"
25+
if [ "$FNRET" -eq 0 ]; then
26+
crit "$PACKAGE is installed"
27+
else
28+
ok "$PACKAGE is not installed."
29+
fi
30+
}
31+
32+
# This function will be called if the script status is on enabled mode
33+
apply() {
34+
is_pkg_installed "$PACKAGE"
35+
if [ "$FNRET" -eq 0 ]; then
36+
# Debian 12 CIS suggests to do it in an automated way, but this also conflicts with another recommendation:
37+
# -> '4.1.2' wants to remove it while '4.3.1.1' wants to install it :/
38+
crit "'$PACKAGE' is installed. You should either disable this recommendation, or remove the package manually"
39+
fi
40+
}
41+
42+
# This function will check config parameters required
43+
check_config() {
44+
:
45+
}
46+
47+
# Source Root Dir Parameter
48+
if [ -r /etc/default/cis-hardening ]; then
49+
# shellcheck source=../../debian/default
50+
. /etc/default/cis-hardening
51+
fi
52+
if [ -z "$CIS_LIB_DIR" ]; then
53+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
54+
echo "Cannot source CIS_LIB_DIR variable, aborting."
55+
exit 128
56+
fi
57+
58+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
59+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
60+
# shellcheck source=../../lib/main.sh
61+
. "${CIS_LIB_DIR}"/main.sh
62+
else
63+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
64+
exit 128
65+
fi

‎bin/hardening/libpam_runtime_is_version.sh‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure latest version of pam is installed (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure latest version of pam is installed."
19+
PACKAGE='libpam-runtime'
20+
MIN_VERSION=''
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
PACKAGE_IS_VERSION=0
25+
if [ "$DEB_MAJ_VER" -ge 12 ]; then
26+
27+
version=$(dpkg-query --show --showformat '${Version}' "$PACKAGE")
28+
if dpkg --compare-versions "$version" ge "$MIN_VERSION"; then
29+
ok "$PACKAGE is $version"
30+
else
31+
crit "$PACKAGE is $version"
32+
PACKAGE_IS_VERSION=1
33+
fi
34+
35+
else
36+
info "This recommendation requires at least a debian 12 system"
37+
fi
38+
}
39+
40+
# This function will be called if the script status is on enabled mode
41+
apply() {
42+
if [ "$PACKAGE_IS_VERSION" -eq 1 ]; then
43+
apt upgrade -y libpam-runtime
44+
fi
45+
}
46+
47+
create_config() {
48+
local PACKAGE_VERSION=""
49+
if [ "$DEB_MAJ_VER" -eq 12 ]; then
50+
PACKAGE_VERSION="1.5.2-6"
51+
elif [ "$DEB_MAJ_VER" -eq 13 ]; then
52+
PACKAGE_VERSION="1.7.0-5"
53+
fi
54+
cat <<EOF
55+
status=audit
56+
MIN_VERSION="$PACKAGE_VERSION"
57+
EOF
58+
}
59+
60+
# This function will check config parameters required
61+
check_config() {
62+
:
63+
}
64+
65+
# Source Root Dir Parameter
66+
if [ -r /etc/default/cis-hardening ]; then
67+
# shellcheck source=../../debian/default
68+
. /etc/default/cis-hardening
69+
fi
70+
if [ -z "$CIS_LIB_DIR" ]; then
71+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
72+
echo "Cannot source CIS_LIB_DIR variable, aborting."
73+
exit 128
74+
fi
75+
76+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
77+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
78+
# shellcheck source=../../lib/main.sh
79+
. "${CIS_LIB_DIR}"/main.sh
80+
else
81+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
82+
exit 128
83+
fi

‎bin/hardening/nftables_not_installed_with_iptables.sh‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure nftables is not installed with iptables (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
DESCRIPTION="Ensure nftables is not installed with iptables"
18+
PACKAGE='nftables'
19+
CONFLICT_PACKAGE='iptables'
20+
21+
# This function will be called if the script status is on enabled / audit mode
22+
audit() {
23+
PACKAGE_INSTALLED=1
24+
CONFLICT_PACKAGE_INSTALLED=1
25+
26+
is_pkg_installed "$PACKAGE"
27+
if [ "$FNRET" -eq 0 ]; then
28+
PACKAGE_INSTALLED=0
29+
fi
30+
31+
is_pkg_installed "$CONFLICT_PACKAGE"
32+
if [ "$FNRET" -eq 0 ]; then
33+
CONFLICT_PACKAGE_INSTALLED=0
34+
fi
35+
36+
if [ "$PACKAGE_INSTALLED" -eq 0 ] && [ "$CONFLICT_PACKAGE_INSTALLED" -eq 0 ]; then
37+
crit "'$PACKAGE' is installed with '$CONFLICT_PACKAGE'"
38+
else
39+
ok "'$PACKAGE' is not installed with '$CONFLICT_PACKAGE'"
40+
fi
41+
}
42+
43+
# This function will be called if the script status is on enabled mode
44+
apply() {
45+
if [ "$PACKAGE_INSTALLED" -eq 0 ] && [ "$CONFLICT_PACKAGE_INSTALLED" -eq 0 ]; then
46+
info "Trying to remove $PACKAGE"
47+
apt_remove "$PACKAGE"
48+
fi
49+
}
50+
51+
# This function will check config parameters required
52+
check_config() {
53+
:
54+
}
55+
56+
# Source Root Dir Parameter
57+
if [ -r /etc/default/cis-hardening ]; then
58+
# shellcheck source=../../debian/default
59+
. /etc/default/cis-hardening
60+
fi
61+
if [ -z "$CIS_LIB_DIR" ]; then
62+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
63+
echo "Cannot source CIS_LIB_DIR variable, aborting."
64+
exit 128
65+
fi
66+
67+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
68+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
69+
# shellcheck source=../../lib/main.sh
70+
. "${CIS_LIB_DIR}"/main.sh
71+
else
72+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
73+
exit 128
74+
fi

‎bin/hardening/ufw_is_enabled.sh‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure ufw service is enabled (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure ufw service is enabled"
19+
SERVICE="ufw.service"
20+
CREATE_SSH_RULE=""
21+
SSH_RULE="allow proto tcp from any to any port 22"
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
SERVICE_ENABLED=1
26+
SERVICE_ACTIVE=1
27+
28+
is_service_enabled "$SERVICE"
29+
if [ "$FNRET" -eq 0 ]; then
30+
ok "$SERVICE is enabled"
31+
SERVICE_ENABLED=0
32+
else
33+
crit "$SERVICE is not enabled"
34+
fi
35+
36+
is_service_active "$SERVICE"
37+
if [ "$FNRET" -eq 0 ]; then
38+
ok "$SERVICE is active"
39+
SERVICE_ACTIVE=0
40+
else
41+
crit "$SERVICE is not active"
42+
fi
43+
}
44+
45+
# This function will be called if the script status is on enabled mode
46+
apply() {
47+
audit
48+
if [ "$SERVICE_ENABLED" -ne 0 ]; then
49+
manage_service unmask "$SERVICE"
50+
manage_service enable "$SERVICE"
51+
fi
52+
53+
if [ "$SERVICE_ACTIVE" -ne 0 ]; then
54+
# When running ufw enable or starting ufw via its initscript, ufw will flush its chains.
55+
# This is required so ufw can maintain a consistent state, but it may drop existing
56+
# connections (eg ssh). ufw does support adding rules before enabling the firewall.
57+
if [ "$CREATE_SSH_RULE" -eq 0 ]; then
58+
info "we are going to modify ufw rules to ensure ssh stays allowed"
59+
ufw "$SSH_RULE"
60+
fi
61+
manage_service start "$SERVICE"
62+
fi
63+
64+
}
65+
66+
create_config() {
67+
cat <<EOF
68+
status=audit
69+
# Put your custom configuration here
70+
# 0 = create rule (bash value for boolean true)
71+
# 1 = do not create rule (bash value for boolean true)
72+
CREATE_SSH_RULE=0
73+
EOF
74+
}
75+
76+
# This function will check config parameters required
77+
check_config() {
78+
:
79+
}
80+
81+
# Source Root Dir Parameter
82+
if [ -r /etc/default/cis-hardening ]; then
83+
# shellcheck source=../../debian/default
84+
. /etc/default/cis-hardening
85+
fi
86+
if [ -z "$CIS_LIB_DIR" ]; then
87+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
88+
echo "Cannot source CIS_LIB_DIR variable, aborting."
89+
exit 128
90+
fi
91+
92+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
93+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
94+
# shellcheck source=../../lib/main.sh
95+
. "${CIS_LIB_DIR}"/main.sh
96+
else
97+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
98+
exit 128
99+
fi

‎bin/hardening/ufw_is_installed.sh‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure ufw is installed (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure ufw is installed."
19+
20+
PACKAGE='ufw'
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
is_pkg_installed "$PACKAGE"
25+
if [ "$FNRET" -eq 0 ]; then
26+
ok "$PACKAGE is installed"
27+
else
28+
crit "$PACKAGE is not installed"
29+
fi
30+
}
31+
32+
# This function will be called if the script status is on enabled mode
33+
apply() {
34+
is_pkg_installed "$PACKAGE"
35+
if [ "$FNRET" -ne 0 ]; then
36+
# "iptables-persistent" is gonna be removed by ufw installation
37+
# if present, let the user manually chose the best decision based on his needs
38+
info "checking for 'iptables-persistent' installation"
39+
is_pkg_installed iptables-persistent
40+
if [ "$FNRET" -eq 0 ]; then
41+
crit "'iptables-persistent' is gonna be removed by 'ufw' installation. Either disable this recommendation, or manually remove 'iptables-persistent'"
42+
else
43+
info "Installing $PACKAGE"
44+
apt_install "$PACKAGE"
45+
fi
46+
fi
47+
audit
48+
}
49+
50+
# This function will check config parameters required
51+
check_config() {
52+
:
53+
}
54+
55+
# Source Root Dir Parameter
56+
if [ -r /etc/default/cis-hardening ]; then
57+
# shellcheck source=../../debian/default
58+
. /etc/default/cis-hardening
59+
fi
60+
if [ -z "$CIS_LIB_DIR" ]; then
61+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
62+
echo "Cannot source CIS_LIB_DIR variable, aborting."
63+
exit 128
64+
fi
65+
66+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
67+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
68+
# shellcheck source=../../lib/main.sh
69+
. "${CIS_LIB_DIR}"/main.sh
70+
else
71+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
72+
exit 128
73+
fi

0 commit comments

Comments
 (0)