Skip to content

Commit d938746

Browse files
author
damien cavagnini
committed
Add new debian12 scripts
 bin/hardening/cron_allow_restrictions.sh -> 2.4.1.8 bin/hardening/gdm_disable_automount.sh -> 1.7.6 / 1.7.7 bin/hardening/gdm_disable_autorun.sh -> 1.7.8 / 1.7.9 bin/hardening/gdm_disable_xdmcp.sh -> 1.7.10 bin/hardening/pam_pwhistory_enforce_root.sh -> 5.3.3.3.2 bin/hardening/pam_pwhistory_use_authtok.sh -> 5.3.3.3.3
1 parent 5e25306 commit d938746

12 files changed

+1036
-0
lines changed

‎bin/hardening/cron_allow_restrictions.sh‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure cron is restricted to authorized users (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure cron is restricted to authorized users."
19+
20+
PACKAGE='cron'
21+
CRON_ALLOW='/etc/cron.allow'
22+
CRON_DENY='/etc/cron.deny'
23+
PERMISSIONS='640'
24+
USER='root'
25+
GROUP='root'
26+
27+
# Global state
28+
CRON_ALLOW_RESTR_INSTALLED=1
29+
CRON_ALLOW_RESTR_FILE_OK=1
30+
CRON_DENY_FILE_OK=1
31+
32+
# This function will be called if the script status is on enabled / audit mode
33+
audit() {
34+
is_pkg_installed "$PACKAGE"
35+
if [ "$FNRET" != 0 ]; then
36+
ok "$PACKAGE is not installed, cron restrictions not applicable"
37+
CRON_ALLOW_RESTR_INSTALLED=0
38+
return
39+
fi
40+
ok "$PACKAGE is installed"
41+
42+
# Check /etc/cron.allow
43+
if [ ! -f "$CRON_ALLOW" ]; then
44+
crit "$CRON_ALLOW does not exist"
45+
CRON_ALLOW_RESTR_FILE_OK=0
46+
else
47+
has_file_correct_ownership "$CRON_ALLOW" "$USER" "$GROUP"
48+
if [ "$FNRET" != 0 ]; then
49+
crit "$CRON_ALLOW ownership is not $USER:$GROUP"
50+
CRON_ALLOW_RESTR_FILE_OK=0
51+
else
52+
ok "$CRON_ALLOW has correct ownership"
53+
fi
54+
55+
has_file_correct_permissions "$CRON_ALLOW" "$PERMISSIONS"
56+
if [ "$FNRET" != 0 ]; then
57+
crit "$CRON_ALLOW permissions are not $PERMISSIONS"
58+
CRON_ALLOW_RESTR_FILE_OK=0
59+
else
60+
ok "$CRON_ALLOW has correct permissions"
61+
fi
62+
fi
63+
64+
# Check /etc/cron.deny - should not exist or have restrictive permissions
65+
if [ -f "$CRON_DENY" ]; then
66+
warn "$CRON_DENY exists, it should be removed when using $CRON_ALLOW"
67+
CRON_DENY_FILE_OK=0
68+
else
69+
ok "$CRON_DENY does not exist"
70+
fi
71+
}
72+
73+
# This function will be called if the script status is on enabled mode
74+
apply() {
75+
if [ "$CRON_ALLOW_RESTR_INSTALLED" -eq 0 ]; then
76+
ok "$PACKAGE is not installed, nothing to apply"
77+
return
78+
fi
79+
80+
# Create/fix cron.allow
81+
if [ "$CRON_ALLOW_RESTR_FILE_OK" -eq 0 ]; then
82+
if [ ! -f "$CRON_ALLOW" ]; then
83+
info "Creating $CRON_ALLOW"
84+
touch "$CRON_ALLOW"
85+
fi
86+
87+
info "Setting ownership and permissions on $CRON_ALLOW"
88+
chown "$USER":"$GROUP" "$CRON_ALLOW"
89+
chmod "$PERMISSIONS" "$CRON_ALLOW"
90+
else
91+
ok "$CRON_ALLOW is correctly configured"
92+
fi
93+
94+
# Remove cron.deny if it exists
95+
if [ "$CRON_DENY_FILE_OK" -eq 0 ]; then
96+
if [ -f "$CRON_DENY" ]; then
97+
info "Removing $CRON_DENY"
98+
rm -f "$CRON_DENY"
99+
fi
100+
fi
101+
}
102+
103+
# This function will check config parameters required
104+
check_config() {
105+
:
106+
}
107+
108+
# Source Root Dir Parameter
109+
if [ -r /etc/default/cis-hardening ]; then
110+
# shellcheck source=../../debian/default
111+
. /etc/default/cis-hardening
112+
fi
113+
if [ -z "${CIS_LIB_DIR}" ]; then
114+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
115+
echo "Cannot source CIS_LIB_DIR variable, aborting."
116+
exit 128
117+
fi
118+
119+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
120+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
121+
# shellcheck source=../../lib/main.sh
122+
. "${CIS_LIB_DIR}"/main.sh
123+
else
124+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is ${CIS_LIB_DIR} in /etc/default/cis-hardening"
125+
exit 128
126+
fi

‎bin/hardening/gdm_disable_automount.sh‎

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure GDM disabling of automount is not overridden (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure GDM disabling of automount is not overridden."
19+
20+
PACKAGE='gdm3'
21+
DCONF_PROFILE_DIR='/etc/dconf/profile'
22+
DCONF_DB_DIR='/etc/dconf/db/local.d'
23+
DCONF_LOCK_DIR='/etc/dconf/db/local.d/locks'
24+
USER_PROFILE_FILE="$DCONF_PROFILE_DIR/user"
25+
AUTOMOUNT_CONF_FILE="$DCONF_DB_DIR/00-media-automount"
26+
AUTOMOUNT_LOCK_FILE="$DCONF_LOCK_DIR/media-automount"
27+
28+
# Global state
29+
GDM_AUTOMOUNT_INSTALLED=1
30+
GDM_AUTOMOUNT_PROFILE_OK=1
31+
GDM_AUTOMOUNT_SETTINGS_OK=1
32+
GDM_AUTOMOUNT_LOCKS_OK=1
33+
34+
# This function will be called if the script status is on enabled / audit mode
35+
audit() {
36+
is_pkg_installed "$PACKAGE"
37+
if [ "$FNRET" != 0 ]; then
38+
ok "$PACKAGE is not installed, automount settings not applicable"
39+
GDM_AUTOMOUNT_INSTALLED=0
40+
return
41+
fi
42+
ok "$PACKAGE is installed"
43+
44+
# Check profile file
45+
if [ ! -f "$USER_PROFILE_FILE" ]; then
46+
crit "DConf user profile file $USER_PROFILE_FILE does not exist"
47+
GDM_AUTOMOUNT_PROFILE_OK=0
48+
else
49+
does_pattern_exist_in_file "$USER_PROFILE_FILE" "user-db:user"
50+
if [ "$FNRET" != 0 ]; then
51+
crit "DConf user profile missing 'user-db:user' directive"
52+
GDM_AUTOMOUNT_PROFILE_OK=0
53+
else
54+
does_pattern_exist_in_file "$USER_PROFILE_FILE" "system-db:local"
55+
if [ "$FNRET" != 0 ]; then
56+
crit "DConf user profile missing 'system-db:local' directive"
57+
GDM_AUTOMOUNT_PROFILE_OK=0
58+
else
59+
ok "DConf user profile correctly configured"
60+
fi
61+
fi
62+
fi
63+
64+
# Check automount settings
65+
if [ ! -f "$AUTOMOUNT_CONF_FILE" ]; then
66+
crit "Automount configuration file $AUTOMOUNT_CONF_FILE does not exist"
67+
GDM_AUTOMOUNT_SETTINGS_OK=0
68+
else
69+
does_pattern_exist_in_file "$AUTOMOUNT_CONF_FILE" "automount=false"
70+
if [ "$FNRET" != 0 ]; then
71+
crit "automount not set to false in $AUTOMOUNT_CONF_FILE"
72+
GDM_AUTOMOUNT_SETTINGS_OK=0
73+
else
74+
ok "automount correctly set to false"
75+
fi
76+
does_pattern_exist_in_file "$AUTOMOUNT_CONF_FILE" "automount-open=false"
77+
if [ "$FNRET" != 0 ]; then
78+
crit "automount-open not set to false in $AUTOMOUNT_CONF_FILE"
79+
GDM_AUTOMOUNT_SETTINGS_OK=0
80+
else
81+
ok "automount-open correctly set to false"
82+
fi
83+
fi
84+
85+
# Check locks
86+
if [ ! -f "$AUTOMOUNT_LOCK_FILE" ]; then
87+
crit "Automount lock file $AUTOMOUNT_LOCK_FILE does not exist"
88+
GDM_AUTOMOUNT_LOCKS_OK=0
89+
else
90+
does_pattern_exist_in_file "$AUTOMOUNT_LOCK_FILE" "/org/gnome/desktop/media-handling/automount"
91+
if [ "$FNRET" != 0 ]; then
92+
crit "automount not locked in $AUTOMOUNT_LOCK_FILE"
93+
GDM_AUTOMOUNT_LOCKS_OK=0
94+
else
95+
ok "automount is locked"
96+
fi
97+
does_pattern_exist_in_file "$AUTOMOUNT_LOCK_FILE" "/org/gnome/desktop/media-handling/automount-open"
98+
if [ "$FNRET" != 0 ]; then
99+
crit "automount-open not locked in $AUTOMOUNT_LOCK_FILE"
100+
GDM_AUTOMOUNT_LOCKS_OK=0
101+
else
102+
ok "automount-open is locked"
103+
fi
104+
fi
105+
}
106+
107+
# This function will be called if the script status is on enabled mode
108+
apply() {
109+
if [ "$GDM_AUTOMOUNT_INSTALLED" -eq 0 ]; then
110+
ok "$PACKAGE is not installed, nothing to apply"
111+
return
112+
fi
113+
114+
# Create profile directory and file
115+
if [ "$GDM_AUTOMOUNT_PROFILE_OK" -eq 0 ]; then
116+
info "Creating/updating DConf user profile"
117+
mkdir -p "$DCONF_PROFILE_DIR"
118+
cat >"$USER_PROFILE_FILE" <<EOF
119+
user-db:user
120+
system-db:local
121+
EOF
122+
GDM_AUTOMOUNT_PROFILE_OK=1
123+
fi
124+
125+
# Create automount settings
126+
if [ "$GDM_AUTOMOUNT_SETTINGS_OK" -eq 0 ]; then
127+
info "Creating automount configuration"
128+
mkdir -p "$DCONF_DB_DIR"
129+
cat >"$AUTOMOUNT_CONF_FILE" <<EOF
130+
[org/gnome/desktop/media-handling]
131+
automount=false
132+
automount-open=false
133+
EOF
134+
GDM_AUTOMOUNT_SETTINGS_OK=1
135+
fi
136+
137+
# Create locks
138+
if [ "$GDM_AUTOMOUNT_LOCKS_OK" -eq 0 ]; then
139+
info "Creating automount locks"
140+
mkdir -p "$DCONF_LOCK_DIR"
141+
cat >"$AUTOMOUNT_LOCK_FILE" <<EOF
142+
/org/gnome/desktop/media-handling/automount
143+
/org/gnome/desktop/media-handling/automount-open
144+
EOF
145+
GDM_AUTOMOUNT_LOCKS_OK=1
146+
fi
147+
148+
# Update dconf database
149+
if command -v dconf >/dev/null 2>&1; then
150+
info "Updating dconf database"
151+
dconf update
152+
fi
153+
}
154+
155+
# This function will check config parameters required
156+
check_config() {
157+
:
158+
}
159+
160+
# Source Root Dir Parameter
161+
if [ -r /etc/default/cis-hardening ]; then
162+
# shellcheck source=../../debian/default
163+
. /etc/default/cis-hardening
164+
fi
165+
if [ -z "${CIS_LIB_DIR}" ]; then
166+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
167+
echo "Cannot source CIS_LIB_DIR variable, aborting."
168+
exit 128
169+
fi
170+
171+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
172+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
173+
# shellcheck source=../../lib/main.sh
174+
. "${CIS_LIB_DIR}"/main.sh
175+
else
176+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is ${CIS_LIB_DIR} in /etc/default/cis-hardening"
177+
exit 128
178+
fi

0 commit comments

Comments
 (0)