Skip to content

Commit fde8d2b

Browse files
damcav35damien cavagnini
damcav35
and
damien cavagnini
authored
feat: add debian12 scripts (#292)
- auditd_logs_full_halt.sh -> 6.3.2.3 - systemd_journal_upload_remote_auth.sh -> 6.2.1.2.2 - sudo_auth_timeout.sh -> 5.2.6 - libpam_modules_is_installed.sh -> 5.3.1.2 - ufw_not_installed_with_nftables.sh -> 4.2.2 - ufw_not_installed_with_iptables.sh -> 4.3.1.3 Co-authored-by: damien cavagnini <damien.cavagnini@corp.ovh.com>
1 parent b89e608 commit fde8d2b

13 files changed

+621
-0
lines changed

‎bin/hardening/auditd_logs_full_halt.sh‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure system is disabled when audit logs are full (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=4
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure system is disabled when audit logs are full"
19+
AUDIT_CONF="/etc/audit/auditd.conf"
20+
21+
# This function will be called if the script status is on enabled / audit mode
22+
# shellcheck disable=2120
23+
audit() {
24+
local disk_full_action=""
25+
local disk_error_action=""
26+
27+
DISK_FULL_ACTION_IS_VALID=0
28+
DISK_ERROR_ACTION_IS_VALID=0
29+
30+
# shellcheck disable=2016
31+
# otherwise $2 will interpreted in awk, this is not what is intended
32+
disk_full_action=$($SUDO_CMD grep -E "^[[:space:]]?disk_full_action" "$AUDIT_CONF" | awk -F '=' '{print $2}' | sed 's/\ //g')
33+
# shellcheck disable=2016
34+
disk_error_action=$($SUDO_CMD grep -E "^[[:space:]]?disk_error_action" "$AUDIT_CONF" | awk -F '=' '{print $2}' | sed 's/\ //g')
35+
36+
if [ "$disk_full_action" != "halt" ] && [ "$disk_full_action" != 'single' ]; then
37+
DISK_FULL_ACTION_IS_VALID=1
38+
crit "'disk_full_action' is not configured to 'halt' or 'single'"
39+
warn "The recommendation is to stop the system when the logs disk is full. Make sure to understand the consequences before applying it"
40+
else
41+
ok "'disk_full_action' is configured to 'halt' or 'single'"
42+
fi
43+
44+
if [ "$disk_error_action" != "halt" ] && [ "$disk_error_action" != 'single' ] && [ "$disk_error_action" != 'syslog' ]; then
45+
DISK_ERROR_ACTION_IS_VALID=1
46+
crit "'disk_error_action' is not configured to 'syslog', 'halt' or 'single'"
47+
warn "The recommendation is to stop the system when there are errors on the logs disk. Make sure to understand the consequences before applying it"
48+
else
49+
ok "'disk_error_action' is configured to 'syslog', 'halt' or 'single'"
50+
fi
51+
52+
}
53+
54+
# This function will be called if the script status is on enabled mode
55+
apply() {
56+
if [ "$DISK_FULL_ACTION_IS_VALID" -eq 1 ]; then
57+
replace_in_file "$AUDIT_CONF" "^[[:space:]]\?disk_full_action" "disk_full_action = halt"
58+
fi
59+
60+
if [ "$DISK_ERROR_ACTION_IS_VALID" -eq 1 ]; then
61+
replace_in_file "$AUDIT_CONF" "^[[:space:]]\?disk_error_action" "disk_error_action = halt"
62+
fi
63+
}
64+
65+
# This function will check config parameters required
66+
check_config() {
67+
:
68+
}
69+
70+
# Source Root Dir Parameter
71+
if [ -r /etc/default/cis-hardening ]; then
72+
# shellcheck source=../../debian/default
73+
. /etc/default/cis-hardening
74+
fi
75+
if [ -z "$CIS_LIB_DIR" ]; then
76+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
77+
echo "Cannot source CIS_LIB_DIR variable, aborting."
78+
exit 128
79+
fi
80+
81+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
82+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
83+
# shellcheck source=../../lib/main.sh
84+
. "${CIS_LIB_DIR}"/main.sh
85+
else
86+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
87+
exit 128
88+
fi

‎bin/hardening/libpam_modules_is_installed.sh‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure libpam-modules is installed (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure libpam-modules is installed"
19+
PACKAGE='libpam-modules'
20+
21+
# This function will be called if the script status is on enabled / audit mode
22+
audit() {
23+
is_pkg_installed "$PACKAGE"
24+
if [ "$FNRET" -eq 0 ]; then
25+
ok "$PACKAGE is installed"
26+
else
27+
crit "$PACKAGE is not installed"
28+
fi
29+
}
30+
31+
# This function will be called if the script status is on enabled mode
32+
apply() {
33+
is_pkg_installed "$PACKAGE"
34+
if [ "$FNRET" -ne 0 ]; then
35+
info "Installing $PACKAGE"
36+
apt_install "$PACKAGE"
37+
fi
38+
audit
39+
}
40+
41+
# This function will check config parameters required
42+
check_config() {
43+
:
44+
}
45+
46+
# Source Root Dir Parameter
47+
if [ -r /etc/default/cis-hardening ]; then
48+
# shellcheck source=../../debian/default
49+
. /etc/default/cis-hardening
50+
fi
51+
if [ -z "$CIS_LIB_DIR" ]; then
52+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
53+
echo "Cannot source CIS_LIB_DIR variable, aborting."
54+
exit 128
55+
fi
56+
57+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
58+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
59+
# shellcheck source=../../lib/main.sh
60+
. "${CIS_LIB_DIR}"/main.sh
61+
else
62+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
63+
exit 128
64+
fi

‎bin/hardening/sudo_auth_timeout.sh‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure sudo authentication timeout is configured correctly (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure sudo authentication timeout is configured correctly"
19+
TIMEOUT_VALUE=15
20+
21+
# This function will be called if the script status is on enabled / audit mode
22+
# shellcheck disable=2120
23+
audit() {
24+
SUDO_TIMEOUT_IS_VALID=0
25+
26+
local timestamp_timeout
27+
local sudo_files
28+
29+
sudo_files="/etc/sudoers $(find /etc/sudoers.d -type f ! -name README | paste -s)"
30+
# shellcheck disable=2016
31+
# shellcheck disable=2086
32+
timestamp_timeout=$($SUDO_CMD grep "timestamp_timeout" $sudo_files | awk -F '=' '{print $2}')
33+
34+
if [ "$(wc -l <<<"$timestamp_timeout")" -eq 0 ]; then
35+
# look for the default
36+
# shellcheck disable=2016
37+
timestamp_timeout=$(sudo -V | awk -F ':' '/Authentication timestamp timeout/ {print $2}' | sed -e 's/\..*$//' -e 's/\ //g')
38+
if [ "$timestamp_timeout" -le "$TIMEOUT_VALUE" ]; then
39+
ok "sudo timestamp timeout is $timestamp_timeout"
40+
else
41+
crit "sudo timestamp timeout is $timestamp_timeout"
42+
SUDO_TIMEOUT_IS_VALID=1
43+
fi
44+
else
45+
for timeout in $timestamp_timeout; do
46+
if [ "$timeout" -le "$TIMEOUT_VALUE" ]; then
47+
ok "sudo timestamp timeout is $timeout"
48+
else
49+
crit "sudo timestamp timeout is $timeout"
50+
SUDO_TIMEOUT_IS_VALID=1
51+
fi
52+
done
53+
fi
54+
}
55+
56+
# This function will be called if the script status is on enabled mode
57+
apply() {
58+
audit
59+
if [ "$SUDO_TIMEOUT_IS_VALID" -ne 0 ]; then
60+
61+
sudo_files="/etc/sudoers $(find /etc/sudoers.d -type f ! -name README | paste -s)"
62+
for file in $sudo_files; do
63+
delete_line_in_file "$file" "timestamp_timeout"
64+
done
65+
add_end_of_file /etc/sudoers "Defaults timestamp_timeout=$TIMEOUT_VALUE"
66+
67+
fi
68+
}
69+
70+
# This function will check config parameters required
71+
check_config() {
72+
:
73+
}
74+
75+
# Source Root Dir Parameter
76+
if [ -r /etc/default/cis-hardening ]; then
77+
# shellcheck source=../../debian/default
78+
. /etc/default/cis-hardening
79+
fi
80+
if [ -z "$CIS_LIB_DIR" ]; then
81+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
82+
echo "Cannot source CIS_LIB_DIR variable, aborting."
83+
exit 128
84+
fi
85+
86+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
87+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
88+
# shellcheck source=../../lib/main.sh
89+
. "${CIS_LIB_DIR}"/main.sh
90+
else
91+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
92+
exit 128
93+
fi

‎bin/hardening/systemd_journal_upload_remote_auth.sh‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure systemd-journal-remote authentication is configured (Manual)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure systemd-journal-remote authentication is configured"
19+
JOURNAL_CONF="/etc/systemd/journal-upload.conf"
20+
21+
# This function will be called if the script status is on enabled / audit mode
22+
# shellcheck disable=2120
23+
audit() {
24+
local conf_lines
25+
# We are looking for URL, ServerKeyFile, ServerCertificateFile, TrustedCertificateFile
26+
# shellcheck disable=2126
27+
conf_lines=$(grep -P "^ *URL=|^ *ServerKeyFile=|^ *ServerCertificateFile=|^ *TrustedCertificateFile=" "$JOURNAL_CONF" | wc -l)
28+
if [ "$conf_lines" -eq 4 ]; then
29+
ok "remote authentication is configured, review it manually to ensure it is the expected one"
30+
else
31+
crit "remote authentication is not configured. Either configure it, or disable this recommendation if not needed."
32+
fi
33+
}
34+
35+
# This function will be called if the script status is on enabled mode
36+
apply() {
37+
info "Please review manually your authentication configuration"
38+
}
39+
40+
# This function will check config parameters required
41+
check_config() {
42+
:
43+
}
44+
45+
# Source Root Dir Parameter
46+
if [ -r /etc/default/cis-hardening ]; then
47+
# shellcheck source=../../debian/default
48+
. /etc/default/cis-hardening
49+
fi
50+
if [ -z "$CIS_LIB_DIR" ]; then
51+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
52+
echo "Cannot source CIS_LIB_DIR variable, aborting."
53+
exit 128
54+
fi
55+
56+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
57+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
58+
# shellcheck source=../../lib/main.sh
59+
. "${CIS_LIB_DIR}"/main.sh
60+
else
61+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
62+
exit 128
63+
fi

‎bin/hardening/ufw_not_installed_with_iptables.sh‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure ufw is uninstalled or disabled with iptables (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
DESCRIPTION="Ensure ufw is uninstalled or disabled with iptables"
18+
PACKAGE='ufw'
19+
CONFLICT_PACKAGE='iptables'
20+
21+
# This function will be called if the script status is on enabled / audit mode
22+
audit() {
23+
PACKAGE_INSTALLED=1
24+
CONFLICT_PACKAGE_INSTALLED=1
25+
26+
is_pkg_installed "$PACKAGE"
27+
if [ "$FNRET" -eq 0 ]; then
28+
PACKAGE_INSTALLED=0
29+
fi
30+
31+
is_pkg_installed "$CONFLICT_PACKAGE"
32+
if [ "$FNRET" -eq 0 ]; then
33+
CONFLICT_PACKAGE_INSTALLED=0
34+
fi
35+
36+
if [ "$PACKAGE_INSTALLED" -eq 0 ] && [ "$CONFLICT_PACKAGE_INSTALLED" -eq 0 ]; then
37+
crit "'$PACKAGE' is installed with '$CONFLICT_PACKAGE'"
38+
else
39+
ok "'$PACKAGE' is not installed with '$CONFLICT_PACKAGE'"
40+
fi
41+
}
42+
43+
# This function will be called if the script status is on enabled mode
44+
apply() {
45+
if [ "$PACKAGE_INSTALLED" -eq 0 ] && [ "$CONFLICT_PACKAGE_INSTALLED" -eq 0 ]; then
46+
info "Trying to remove $PACKAGE"
47+
apt_remove "$PACKAGE"
48+
fi
49+
}
50+
51+
# This function will check config parameters required
52+
check_config() {
53+
:
54+
}
55+
56+
# Source Root Dir Parameter
57+
if [ -r /etc/default/cis-hardening ]; then
58+
# shellcheck source=../../debian/default
59+
. /etc/default/cis-hardening
60+
fi
61+
if [ -z "$CIS_LIB_DIR" ]; then
62+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
63+
echo "Cannot source CIS_LIB_DIR variable, aborting."
64+
exit 128
65+
fi
66+
67+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
68+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
69+
# shellcheck source=../../lib/main.sh
70+
. "${CIS_LIB_DIR}"/main.sh
71+
else
72+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
73+
exit 128
74+
fi

0 commit comments

Comments
 (0)