Skip to content

Commit ced7616

Browse files
author
damien cavagnini
committed
Add new debian12 scripts
 bin/hardening/cron_allow_restrictions.sh -> 2.4.1.8 bin/hardening/gdm_disable_automount_overriden.sh -> 1.7.7 bin/hardening/gdm_disable_autorun.sh -> 1.7.8 bin/hardening/gdm_disable_xdmcp.sh -> 1.7.10 bin/hardening/pam_pwhistory_enforce_root.sh -> 5.3.3.3.2 bin/hardening/pam_pwhistory_use_authtok.sh -> 5.3.3.3.3
1 parent 5e25306 commit ced7616

12 files changed

+1023
-0
lines changed

‎bin/hardening/cron_allow_restrictions.sh‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure cron is restricted to authorized users (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure cron is restricted to authorized users."
19+
20+
PACKAGE='cron'
21+
CRON_ALLOW='/etc/cron.allow'
22+
CRON_DENY='/etc/cron.deny'
23+
PERMISSIONS='640'
24+
USER='root'
25+
GROUP='root'
26+
27+
# Global state
28+
CRON_ALLOW_RESTR_INSTALLED=1
29+
CRON_ALLOW_RESTR_FILE_OK=1
30+
CRON_DENY_FILE_OK=1
31+
32+
# This function will be called if the script status is on enabled / audit mode
33+
audit() {
34+
is_pkg_installed "$PACKAGE"
35+
if [ "$FNRET" != 0 ]; then
36+
ok "$PACKAGE is not installed, cron restrictions not applicable"
37+
CRON_ALLOW_RESTR_INSTALLED=0
38+
return
39+
fi
40+
ok "$PACKAGE is installed"
41+
42+
# Check /etc/cron.allow
43+
if [ ! -f "$CRON_ALLOW" ]; then
44+
crit "$CRON_ALLOW does not exist"
45+
CRON_ALLOW_RESTR_FILE_OK=0
46+
else
47+
has_file_correct_ownership "$CRON_ALLOW" "$USER" "$GROUP"
48+
if [ "$FNRET" != 0 ]; then
49+
crit "$CRON_ALLOW ownership is not $USER:$GROUP"
50+
CRON_ALLOW_RESTR_FILE_OK=0
51+
else
52+
ok "$CRON_ALLOW has correct ownership"
53+
fi
54+
55+
has_file_correct_permissions "$CRON_ALLOW" "$PERMISSIONS"
56+
if [ "$FNRET" != 0 ]; then
57+
crit "$CRON_ALLOW permissions are not $PERMISSIONS"
58+
CRON_ALLOW_RESTR_FILE_OK=0
59+
else
60+
ok "$CRON_ALLOW has correct permissions"
61+
fi
62+
fi
63+
64+
# Check /etc/cron.deny - should not exist or have restrictive permissions
65+
if [ -f "$CRON_DENY" ]; then
66+
warn "$CRON_DENY exists, it should be removed when using $CRON_ALLOW"
67+
CRON_DENY_FILE_OK=0
68+
else
69+
ok "$CRON_DENY does not exist"
70+
fi
71+
}
72+
73+
# This function will be called if the script status is on enabled mode
74+
apply() {
75+
if [ "$CRON_ALLOW_RESTR_INSTALLED" -eq 0 ]; then
76+
ok "$PACKAGE is not installed, nothing to apply"
77+
return
78+
fi
79+
80+
# Create/fix cron.allow
81+
if [ "$CRON_ALLOW_RESTR_FILE_OK" -eq 0 ]; then
82+
if [ ! -f "$CRON_ALLOW" ]; then
83+
info "Creating $CRON_ALLOW"
84+
touch "$CRON_ALLOW"
85+
fi
86+
87+
info "Setting ownership and permissions on $CRON_ALLOW"
88+
chown "$USER":"$GROUP" "$CRON_ALLOW"
89+
chmod "$PERMISSIONS" "$CRON_ALLOW"
90+
else
91+
ok "$CRON_ALLOW is correctly configured"
92+
fi
93+
94+
# Remove cron.deny if it exists
95+
if [ "$CRON_DENY_FILE_OK" -eq 0 ]; then
96+
if [ -f "$CRON_DENY" ]; then
97+
info "Removing $CRON_DENY"
98+
rm -f "$CRON_DENY"
99+
fi
100+
fi
101+
}
102+
103+
# This function will check config parameters required
104+
check_config() {
105+
:
106+
}
107+
108+
# Source Root Dir Parameter
109+
if [ -r /etc/default/cis-hardening ]; then
110+
# shellcheck source=../../debian/default
111+
. /etc/default/cis-hardening
112+
fi
113+
if [ -z "${CIS_LIB_DIR}" ]; then
114+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
115+
echo "Cannot source CIS_LIB_DIR variable, aborting."
116+
exit 128
117+
fi
118+
119+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
120+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
121+
# shellcheck source=../../lib/main.sh
122+
. "${CIS_LIB_DIR}"/main.sh
123+
else
124+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is ${CIS_LIB_DIR} in /etc/default/cis-hardening"
125+
exit 128
126+
fi

‎bin/hardening/gdm_disable_automount_overriden.sh‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure GDM disabling automatic mounting of removable media is not overridden (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure GDM disabling automatic mounting of removable media is not overridden."
19+
20+
PACKAGES='gdm gdm3'
21+
DCONF_DB_DIR='/etc/dconf/db/local.d'
22+
23+
# Global state
24+
GDM_DA_INSTALLED=0
25+
GDM_DA_AUTOMOUNT_OK=0
26+
GDM_DA_AUTOMOUNT_OPEN_OK=0
27+
28+
# This function will be called if the script status is on enabled / audit mode
29+
audit() {
30+
# Check if GNOME Desktop Manager is installed
31+
local l_pkg_installed=0
32+
for l_package in $PACKAGES; do
33+
is_pkg_installed "$l_package"
34+
if [ "$FNRET" = 0 ]; then
35+
ok "Package $l_package is installed"
36+
l_pkg_installed=1
37+
GDM_DA_INSTALLED=1
38+
break
39+
fi
40+
done
41+
42+
if [ "$l_pkg_installed" -eq 0 ]; then
43+
ok "GNOME Desktop Manager package is not installed on the system - Recommendation is not applicable"
44+
return
45+
fi
46+
47+
# Search /etc/dconf/db/local.d/ for automount settings
48+
local l_automount_setting
49+
local l_automount_open_setting
50+
51+
l_automount_setting=$(grep -Psir -- '^\h*automount=false\b' "$DCONF_DB_DIR" 2>/dev/null || true)
52+
l_automount_open_setting=$(grep -Psir -- '^\h*automount-open=false\b' "$DCONF_DB_DIR" 2>/dev/null || true)
53+
54+
# Check for automount setting
55+
if [ -n "$l_automount_setting" ]; then
56+
ok "automount setting found and set to false"
57+
GDM_DA_AUTOMOUNT_OK=1
58+
else
59+
crit "automount setting not found or not set to false in $DCONF_DB_DIR"
60+
GDM_DA_AUTOMOUNT_OK=0
61+
fi
62+
63+
# Check for automount-open setting
64+
if [ -n "$l_automount_open_setting" ]; then
65+
ok "automount-open setting found and set to false"
66+
GDM_DA_AUTOMOUNT_OPEN_OK=1
67+
else
68+
crit "automount-open setting not found or not set to false in $DCONF_DB_DIR"
69+
GDM_DA_AUTOMOUNT_OPEN_OK=0
70+
fi
71+
}
72+
73+
# This function will be called if the script status is on enabled mode
74+
apply() {
75+
if [ "$GDM_DA_INSTALLED" -eq 0 ]; then
76+
ok "GNOME Desktop Manager is not installed, nothing to apply"
77+
return
78+
fi
79+
80+
# Create the directory if it doesn't exist
81+
if [ ! -d "$DCONF_DB_DIR" ]; then
82+
info "Creating directory $DCONF_DB_DIR"
83+
mkdir -p "$DCONF_DB_DIR"
84+
fi
85+
86+
# Apply automount settings if needed
87+
if [ "$GDM_DA_AUTOMOUNT_OK" -eq 0 ] || [ "$GDM_DA_AUTOMOUNT_OPEN_OK" -eq 0 ]; then
88+
local l_kfile="$DCONF_DB_DIR/00-media-automount"
89+
info "Configuring automount settings in $l_kfile"
90+
91+
if [ -f "$l_kfile" ]; then
92+
# Remove any existing automount settings to avoid duplicates
93+
sed -i '/^\s*automount\s*=/d' "$l_kfile"
94+
sed -i '/^\s*automount-open\s*=/d' "$l_kfile"
95+
else
96+
# Create file with section header if it doesn't exist
97+
echo "[org/gnome/desktop/media-handling]" >"$l_kfile"
98+
fi
99+
100+
# Add the section header if it doesn't exist
101+
if ! grep -q '^\[org/gnome/desktop/media-handling\]' "$l_kfile"; then
102+
echo "[org/gnome/desktop/media-handling]" >>"$l_kfile"
103+
fi
104+
105+
# Add the correct settings
106+
sed -i '/^\[org\/gnome\/desktop\/media-handling\]/a automount=false' "$l_kfile"
107+
sed -i '/^\[org\/gnome\/desktop\/media-handling\]/a automount-open=false' "$l_kfile"
108+
fi
109+
110+
# Update dconf database
111+
if command -v dconf >/dev/null 2>&1; then
112+
info "Updating dconf database"
113+
dconf update
114+
fi
115+
}
116+
117+
# This function will check config parameters required
118+
check_config() {
119+
:
120+
}
121+
122+
# Source Root Dir Parameter
123+
if [ -r /etc/default/cis-hardening ]; then
124+
# shellcheck source=../../debian/default
125+
. /etc/default/cis-hardening
126+
fi
127+
if [ -z "${CIS_LIB_DIR}" ]; then
128+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
129+
echo "Cannot source CIS_LIB_DIR variable, aborting."
130+
exit 128
131+
fi
132+
133+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
134+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
135+
# shellcheck source=../../lib/main.sh
136+
. "${CIS_LIB_DIR}"/main.sh
137+
else
138+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is ${CIS_LIB_DIR} in /etc/default/cis-hardening"
139+
exit 128
140+
fi

0 commit comments

Comments
 (0)