Skip to content

Commit c42550f

Browse files
author
Damien Cavagnini
committed
start adding new scripts
1 parent ecd32e8 commit c42550f

10 files changed

+860
-0
lines changed

‎bin/hardening/enable_libpam_pwquality.sh‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure pam_pwquality module is enabled (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure pam_pwquality module is enabled."
19+
20+
PATTERN_COMMON='pam_pwquality.so'
21+
FILE_COMMON='/etc/pam.d/common-password'
22+
23+
OPTIONS=''
24+
FILE_QUALITY='/etc/security/pwquality.conf'
25+
26+
# This function will be called if the script status is on enabled / audit mode
27+
audit() {
28+
does_pattern_exist_in_file "$FILE_COMMON" "$PATTERN_COMMON"
29+
if [ "$FNRET" = 0 ]; then
30+
ok "$PATTERN_COMMON is present in $FILE_COMMON"
31+
else
32+
crit "$PATTERN_COMMON is not present in $FILE_COMMON"
33+
fi
34+
}
35+
36+
# This function will be called if the script status is on enabled mode
37+
apply() {
38+
does_pattern_exist_in_file $FILE_COMMON $PATTERN_COMMON
39+
if [ "$FNRET" = 0 ]; then
40+
ok "$PATTERN_COMMON is present in $FILE_COMMON"
41+
else
42+
warn "$PATTERN_COMMON is not present in $FILE_COMMON"
43+
add_line_file_before_pattern "$FILE_COMMON" "password requisite pam_pwquality.so retry=3" "# pam-auth-update(8) for details."
44+
fi
45+
}
46+
47+
# This function will check config parameters required
48+
check_config() {
49+
:
50+
}
51+
52+
# Source Root Dir Parameter
53+
if [ -r /etc/default/cis-hardening ]; then
54+
# shellcheck source=../../debian/default
55+
. /etc/default/cis-hardening
56+
fi
57+
if [ -z "$CIS_LIB_DIR" ]; then
58+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
59+
echo "Cannot source CIS_LIB_DIR variable, aborting."
60+
exit 128
61+
fi
62+
63+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
64+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
65+
# shellcheck source=../../lib/main.sh
66+
. "${CIS_LIB_DIR}"/main.sh
67+
else
68+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
69+
exit 128
70+
fi

‎bin/hardening/install_iptables.sh‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure iptables packages are installed (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure iptables firewall is installed, does not check for its configuration."
19+
20+
# Note: CIS recommends your iptables rules to be persistent.
21+
# Do as you want, but this script does not handle this
22+
23+
PACKAGES='iptables iptables-persistent'
24+
25+
# This function will be called if the script status is on enabled / audit mode
26+
audit() {
27+
FOUND=false
28+
for PACKAGE in $PACKAGES; do
29+
is_pkg_installed "$PACKAGE"
30+
if [ "$FNRET" = 0 ]; then
31+
ok "$PACKAGE provides firewalling feature"
32+
FOUND=true
33+
fi
34+
done
35+
if [ "$FOUND" = false ]; then
36+
crit "None of the following firewall packages are installed: $PACKAGES"
37+
fi
38+
}
39+
40+
# This function will be called if the script status is on enabled mode
41+
apply() {
42+
for PACKAGE in $PACKAGES; do
43+
is_pkg_installed "$PACKAGE"
44+
if [ "$FNRET" = 0 ]; then
45+
ok "$PACKAGE provides firewalling feature"
46+
FOUND=true
47+
fi
48+
done
49+
if [ "$FOUND" = false ]; then
50+
crit "None of the following firewall packages are installed: $PACKAGES, installing them"
51+
apt_install "$PACKAGES"
52+
fi
53+
}
54+
55+
# This function will check config parameters required
56+
check_config() {
57+
:
58+
}
59+
60+
# Source Root Dir Parameter
61+
if [ -r /etc/default/cis-hardening ]; then
62+
# shellcheck source=../../debian/default
63+
. /etc/default/cis-hardening
64+
fi
65+
if [ -z "$CIS_LIB_DIR" ]; then
66+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
67+
echo "Cannot source CIS_LIB_DIR variable, aborting."
68+
exit 128
69+
fi
70+
71+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
72+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
73+
# shellcheck source=../../lib/main.sh
74+
. "${CIS_LIB_DIR}"/main.sh
75+
else
76+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
77+
exit 128
78+
fi

‎bin/hardening/install_libpam_pwquality.sh‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure libpam-pwquality is installed (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure libpam-pwquality is installed "
19+
20+
PACKAGE='libpam-pwquality'
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
is_pkg_installed "$PACKAGE"
25+
if [ "$FNRET" != 0 ]; then
26+
crit "$PACKAGE is not installed!"
27+
else
28+
ok "$PACKAGE is installed"
29+
fi
30+
}
31+
32+
# This function will be called if the script status is on enabled mode
33+
apply() {
34+
is_pkg_installed "$PACKAGE"
35+
if [ "$FNRET" = 0 ]; then
36+
ok "$PACKAGE is installed"
37+
else
38+
crit "$PACKAGE is absent, installing it"
39+
apt_install "$PACKAGE"
40+
fi
41+
}
42+
43+
# This function will check config parameters required
44+
check_config() {
45+
:
46+
}
47+
48+
# Source Root Dir Parameter
49+
if [ -r /etc/default/cis-hardening ]; then
50+
# shellcheck source=../../debian/default
51+
. /etc/default/cis-hardening
52+
fi
53+
if [ -z "$CIS_LIB_DIR" ]; then
54+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
55+
echo "Cannot source CIS_LIB_DIR variable, aborting."
56+
exit 128
57+
fi
58+
59+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
60+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
61+
# shellcheck source=../../lib/main.sh
62+
. "${CIS_LIB_DIR}"/main.sh
63+
else
64+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
65+
exit 128
66+
fi

‎bin/hardening/install_nftables.sh‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure nftables is installed (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure nftables firewall is installed, does not check for its configuration."
19+
20+
# Note: CIS recommends your iptables rules to be persistent.
21+
# Do as you want, but this script does not handle this
22+
23+
PACKAGES='nftables'
24+
25+
# This function will be called if the script status is on enabled / audit mode
26+
audit() {
27+
FOUND=false
28+
for PACKAGE in $PACKAGES; do
29+
is_pkg_installed "$PACKAGE"
30+
if [ "$FNRET" = 0 ]; then
31+
ok "$PACKAGE provides firewalling feature"
32+
FOUND=true
33+
fi
34+
done
35+
if [ "$FOUND" = false ]; then
36+
crit "None of the following firewall packages are installed: $PACKAGES"
37+
fi
38+
}
39+
40+
# This function will be called if the script status is on enabled mode
41+
apply() {
42+
for PACKAGE in $PACKAGES; do
43+
is_pkg_installed "$PACKAGE"
44+
if [ "$FNRET" = 0 ]; then
45+
ok "$PACKAGE provides firewalling feature"
46+
FOUND=true
47+
fi
48+
done
49+
if [ "$FOUND" = false ]; then
50+
crit "None of the following firewall packages are installed: $PACKAGES, installing them"
51+
apt_install "$PACKAGES"
52+
fi
53+
}
54+
55+
# This function will check config parameters required
56+
check_config() {
57+
:
58+
}
59+
60+
# Source Root Dir Parameter
61+
if [ -r /etc/default/cis-hardening ]; then
62+
# shellcheck source=../../debian/default
63+
. /etc/default/cis-hardening
64+
fi
65+
if [ -z "$CIS_LIB_DIR" ]; then
66+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
67+
echo "Cannot source CIS_LIB_DIR variable, aborting."
68+
exit 128
69+
fi
70+
71+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
72+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
73+
# shellcheck source=../../lib/main.sh
74+
. "${CIS_LIB_DIR}"/main.sh
75+
else
76+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
77+
exit 128
78+
fi

‎bin/hardening/password_complexity.sh‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure password complexity is configured (Manual)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure password minimum length is configured "
19+
20+
OPTIONS=''
21+
FILE_QUALITY='/etc/security/pwquality.conf'
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
for PW_OPT in $OPTIONS; do
26+
PW_PARAM=$(echo "$PW_OPT" | cut -d= -f1)
27+
PW_VALUE=$(echo "$PW_OPT" | cut -d= -f2)
28+
PATTERN="^${PW_PARAM}[[:space:]]+=[[:space:]]+$PW_VALUE"
29+
does_pattern_exist_in_file "$FILE_QUALITY" "$PATTERN"
30+
31+
if [ "$FNRET" = 0 ]; then
32+
ok "$PATTERN is present in $FILE_QUALITY"
33+
else
34+
crit "$PATTERN is not present in $FILE_QUALITY"
35+
fi
36+
done
37+
}
38+
39+
# This function will be called if the script status is on enabled mode
40+
apply() {
41+
info "The values defined here should be adapted to one needs before applying."
42+
}
43+
44+
# This function will create the config file for this check with default values
45+
create_config() {
46+
cat <<EOF
47+
status=audit
48+
# Put your custom configuration here
49+
OPTIONS="minclass=3 dcredit=-1 ucredit=-2 ocredit=0 lcredit=-2"
50+
EOF
51+
}
52+
53+
# This function will check config parameters required
54+
check_config() {
55+
:
56+
}
57+
58+
# Source Root Dir Parameter
59+
if [ -r /etc/default/cis-hardening ]; then
60+
# shellcheck source=../../debian/default
61+
. /etc/default/cis-hardening
62+
fi
63+
if [ -z "$CIS_LIB_DIR" ]; then
64+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
65+
echo "Cannot source CIS_LIB_DIR variable, aborting."
66+
exit 128
67+
fi
68+
69+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
70+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
71+
# shellcheck source=../../lib/main.sh
72+
. "${CIS_LIB_DIR}"/main.sh
73+
else
74+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
75+
exit 128
76+
fi

0 commit comments

Comments
 (0)