Skip to content

Commit b89e608

Browse files
damcav35damien cavagnini
damcav35
and
damien cavagnini
authored
feat: add debian12 scripts (#291)
- aide_daliy_check -> 6.1.2 - journald_is_enabled.sh -> 6.2.1.1.1 - systemd_journald_remote_is_installed.sh -> 6.2.1.2.1 - systemd_journal_upload_is_enabled.sh - -> 6.2.1.2.3 - systemd_journal_remote_is_disabled.sh -> 6.2.1.2.4 Co-authored-by: damien cavagnini <damien.cavagnini@corp.ovh.com>
1 parent 605963d commit b89e608

10 files changed

+485
-0
lines changed

‎bin/hardening/aide_daily_check.sh‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure AIDE daily checks (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure AIDE daily checks"
19+
SERVICE="dailyaidecheck.service"
20+
TIMER="dailyaidecheck.timer"
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
SERVICE_ENABLED=1
25+
TIMER_ENABLED=1
26+
27+
is_service_enabled "$SERVICE"
28+
if [ "$FNRET" -eq 0 ]; then
29+
SERVICE_ENABLED=0
30+
ok "$SERVICE is enabled"
31+
else
32+
crit "$SERVICE is not enabled"
33+
fi
34+
35+
is_timer_enabled "$TIMER"
36+
if [ "$FNRET" -eq 0 ]; then
37+
TIMER_ENABLED=0
38+
ok "$TIMER is enabled"
39+
else
40+
crit "$TIMER is not enabled"
41+
fi
42+
}
43+
44+
# This function will be called if the script status is on enabled mode
45+
apply() {
46+
if [ "$SERVICE_ENABLED" -ne 0 ]; then
47+
info "unmasking and enabling $SERVICE"
48+
manage_service unmask "$SERVICE"
49+
manage_service enable "$SERVICE"
50+
fi
51+
52+
if [ "$TIMER_ENABLED" -ne 0 ]; then
53+
info "unmasking and enabling $TIMER"
54+
manage_service unmask "$TIMER"
55+
manage_service enable "$TIMER"
56+
fi
57+
}
58+
59+
# This function will check config parameters required
60+
check_config() {
61+
:
62+
}
63+
64+
# Source Root Dir Parameter
65+
if [ -r /etc/default/cis-hardening ]; then
66+
# shellcheck source=../../debian/default
67+
. /etc/default/cis-hardening
68+
fi
69+
if [ -z "$CIS_LIB_DIR" ]; then
70+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
71+
echo "Cannot source CIS_LIB_DIR variable, aborting."
72+
exit 128
73+
fi
74+
75+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
76+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
77+
# shellcheck source=../../lib/main.sh
78+
. "${CIS_LIB_DIR}"/main.sh
79+
else
80+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
81+
exit 128
82+
fi

‎bin/hardening/journald_is_enabled.sh‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure journald service is enabled and active (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure journald service is enabled and active"
19+
SERVICE="systemd-journald.service"
20+
21+
# This function will be called if the script status is on enabled / audit mode
22+
audit() {
23+
SERVICE_ENABLED=1
24+
SERVICE_ACTIVE=1
25+
26+
is_service_enabled "$SERVICE"
27+
if [ "$FNRET" -eq 0 ]; then
28+
ok "$SERVICE is enabled"
29+
SERVICE_ENABLED=0
30+
else
31+
crit "$SERVICE is not enabled"
32+
fi
33+
34+
is_service_active "$SERVICE"
35+
if [ "$FNRET" -eq 0 ]; then
36+
ok "$SERVICE is active"
37+
SERVICE_ACTIVE=0
38+
else
39+
crit "$SERVICE is not active"
40+
fi
41+
}
42+
43+
# This function will be called if the script status is on enabled mode
44+
apply() {
45+
if [ "$SERVICE_ENABLED" -ne 0 ]; then
46+
info "unmasking and enabling $SERVICE"
47+
manage_service unmask "$SERVICE"
48+
manage_service enable "$SERVICE"
49+
fi
50+
51+
if [ "$SERVICE_ACTIVE" -ne 0 ]; then
52+
info "starting $SERVICE"
53+
manage_service start "$SERVICE"
54+
fi
55+
56+
}
57+
58+
# This function will check config parameters required
59+
check_config() {
60+
:
61+
}
62+
63+
# Source Root Dir Parameter
64+
if [ -r /etc/default/cis-hardening ]; then
65+
# shellcheck source=../../debian/default
66+
. /etc/default/cis-hardening
67+
fi
68+
if [ -z "$CIS_LIB_DIR" ]; then
69+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
70+
echo "Cannot source CIS_LIB_DIR variable, aborting."
71+
exit 128
72+
fi
73+
74+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
75+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
76+
# shellcheck source=../../lib/main.sh
77+
. "${CIS_LIB_DIR}"/main.sh
78+
else
79+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
80+
exit 128
81+
fi

‎bin/hardening/systemd_journal_remote_is_disabled.sh‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure systemd-journal-remote service is not in use (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure systemd-journal-remote service is not in use : client is able to send logs, not receive them"
19+
SERVICE="systemd-journal-remote.service"
20+
SOCKET="systemd-journal-remote.socket"
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
SERVICE_ENABLED=1
25+
SERVICE_ACTIVE=1
26+
SOCKET_ENABLED=1
27+
SOCKET_ACTIVE=1
28+
29+
is_service_enabled "$SERVICE"
30+
if [ "$FNRET" -eq 0 ]; then
31+
crit "$SERVICE is enabled"
32+
SERVICE_ENABLED=0
33+
else
34+
ok "$SERVICE is not enabled"
35+
fi
36+
37+
is_service_active "$SERVICE"
38+
if [ "$FNRET" -eq 0 ]; then
39+
crit "$SERVICE is active"
40+
SERVICE_ACTIVE=0
41+
else
42+
ok "$SERVICE is not active"
43+
fi
44+
45+
is_socket_enabled "$SOCKET"
46+
if [ "$FNRET" -eq 0 ]; then
47+
crit "$SOCKET is enabled"
48+
SOCKET_ENABLED=0
49+
else
50+
ok "$SOCKET is not enabled"
51+
fi
52+
53+
is_socket_active "$SOCKET"
54+
if [ "$FNRET" -eq 0 ]; then
55+
crit "$SOCKET is active"
56+
SOCKET_ACTIVE=0
57+
else
58+
ok "$SOCKET is not active"
59+
fi
60+
61+
}
62+
63+
# This function will be called if the script status is on enabled mode
64+
apply() {
65+
if [ "$SERVICE_ENABLED" -eq 0 ]; then
66+
info "Disabling and masking $SERVICE"
67+
manage_service disable "$SERVICE"
68+
manage_service mask "$SERVICE"
69+
fi
70+
71+
if [ "$SERVICE_ACTIVE" -eq 0 ]; then
72+
info "Stopping $SERVICE"
73+
manage_service stop "$SERVICE"
74+
fi
75+
76+
if [ "$SOCKET_ENABLED" -eq 0 ]; then
77+
info "Disabling and masking $SOCKET"
78+
manage_service disable "$SOCKET"
79+
manage_service mask "$SOCKET"
80+
fi
81+
82+
if [ "$SOCKET_ACTIVE" -eq 0 ]; then
83+
info "Stopping $SOCKET"
84+
manage_service stop "$SOCKET"
85+
fi
86+
87+
}
88+
89+
# This function will check config parameters required
90+
check_config() {
91+
:
92+
}
93+
94+
# Source Root Dir Parameter
95+
if [ -r /etc/default/cis-hardening ]; then
96+
# shellcheck source=../../debian/default
97+
. /etc/default/cis-hardening
98+
fi
99+
if [ -z "$CIS_LIB_DIR" ]; then
100+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
101+
echo "Cannot source CIS_LIB_DIR variable, aborting."
102+
exit 128
103+
fi
104+
105+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
106+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
107+
# shellcheck source=../../lib/main.sh
108+
. "${CIS_LIB_DIR}"/main.sh
109+
else
110+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
111+
exit 128
112+
fi

‎bin/hardening/systemd_journal_remote_is_installed.sh‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure systemd-journal-remote is installed (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure systemd-journal-remote is installed"
19+
PACKAGE="systemd-journal-remote"
20+
21+
# This function will be called if the script status is on enabled / audit mode
22+
audit() {
23+
PACKAGE_INSTALLED=1
24+
is_pkg_installed "$PACKAGE"
25+
if [ "$FNRET" != 0 ]; then
26+
crit "$PACKAGE is absent!"
27+
else
28+
PACKAGE_INSTALLED=0
29+
ok "$PACKAGE is installed"
30+
fi
31+
}
32+
33+
# This function will be called if the script status is on enabled mode
34+
apply() {
35+
if [ "$PACKAGE_INSTALLED" -eq 1 ]; then
36+
info "installing '$PACKAGE'"
37+
apt_install "$PACKAGE"
38+
info "'$PACKAGE' installed"
39+
fi
40+
}
41+
42+
# This function will check config parameters required
43+
check_config() {
44+
:
45+
}
46+
47+
# Source Root Dir Parameter
48+
if [ -r /etc/default/cis-hardening ]; then
49+
# shellcheck source=../../debian/default
50+
. /etc/default/cis-hardening
51+
fi
52+
if [ -z "$CIS_LIB_DIR" ]; then
53+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
54+
echo "Cannot source CIS_LIB_DIR variable, aborting."
55+
exit 128
56+
fi
57+
58+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
59+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
60+
# shellcheck source=../../lib/main.sh
61+
. "${CIS_LIB_DIR}"/main.sh
62+
else
63+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
64+
exit 128
65+
fi

0 commit comments

Comments
 (0)