Skip to content

Commit 1c77bc3

Browse files
damcav35damien cavagnini
damcav35
and
damien cavagnini
authored
feat: add new debian12 scripts (#308)
- audit_conf_owner.sh -> 6.3.4.6 - audif_conf_group.sh -> 6.3.4.7 - audit_tools_perms.sh -> 6.3.4.8 - audit_tools_owner.sh -> 6.3.4.9 - audit_tools_group.sh -> 6.3.4.10 Co-authored-by: damien cavagnini <damien.cavagnini@corp.ovh.com>
1 parent 45b81ee commit 1c77bc3

File tree

10 files changed

+554
-0
lines changed

10 files changed

+554
-0
lines changed

‎bin/hardening/audit_conf_group.sh‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure audit configuration files belong to group root (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure audit configuration files belong to group root"
19+
20+
AUDITD_CONF_DIR="/etc/audit"
21+
AUDIT_CONF_GROUP=""
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
AUDIT_INVALID_FILES=""
26+
27+
does_file_exist "$AUDITD_CONF_DIR"
28+
if [ "$FNRET" -eq 0 ]; then
29+
30+
AUDIT_INVALID_FILES=$($SUDO_CMD find "$AUDITD_CONF_DIR" -type f \( -name '*.conf' -o -name '*.rules' \) ! -group "$AUDIT_CONF_GROUP")
31+
32+
if [ -n "$AUDIT_INVALID_FILES" ]; then
33+
crit "Some files in $AUDITD_CONF_DIR are not owned by group $AUDIT_CONF_GROUP"
34+
fi
35+
36+
else
37+
info "$AUDITD_CONF_DIR does not exist"
38+
fi
39+
}
40+
41+
# This function will be called if the script status is on enabled mode
42+
apply() {
43+
if [ -n "$AUDIT_INVALID_FILES" ]; then
44+
for file in $AUDIT_INVALID_FILES; do
45+
info "changing owner to $AUDIT_CONF_GROUP for $file"
46+
chgrp "$AUDIT_CONF_GROUP" "$file"
47+
done
48+
fi
49+
}
50+
51+
# This function will check config parameters required
52+
check_config() {
53+
:
54+
}
55+
56+
create_config() {
57+
cat <<EOF
58+
# shellcheck disable=2034
59+
status=audit
60+
# group of the audit configuration files
61+
AUDIT_CONF_GROUP='root'
62+
EOF
63+
}
64+
65+
# Source Root Dir Parameter
66+
if [ -r /etc/default/cis-hardening ]; then
67+
# shellcheck source=../../debian/default
68+
. /etc/default/cis-hardening
69+
fi
70+
if [ -z "$CIS_LIB_DIR" ]; then
71+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
72+
echo "Cannot source CIS_LIB_DIR variable, aborting."
73+
exit 128
74+
fi
75+
76+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
77+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
78+
# shellcheck source=../../lib/main.sh
79+
. "${CIS_LIB_DIR}"/main.sh
80+
else
81+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
82+
exit 128
83+
fi

‎bin/hardening/audit_conf_owner.sh‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure audit configuration files are owned by root (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure audit configuration files are owned by root"
19+
20+
AUDITD_CONF_DIR="/etc/audit"
21+
AUDIT_CONF_OWNER=""
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
AUDIT_INVALID_FILES=""
26+
27+
does_file_exist "$AUDITD_CONF_DIR"
28+
if [ "$FNRET" -eq 0 ]; then
29+
30+
AUDIT_INVALID_FILES=$($SUDO_CMD find "$AUDITD_CONF_DIR" -type f \( -name '*.conf' -o -name '*.rules' \) ! -user "$AUDIT_CONF_OWNER")
31+
32+
if [ -n "$AUDIT_INVALID_FILES" ]; then
33+
crit "Some files in $AUDITD_CONF_DIR are not owned by $AUDIT_CONF_OWNER"
34+
fi
35+
36+
else
37+
info "$AUDITD_CONF_DIR does not exist"
38+
fi
39+
}
40+
41+
# This function will be called if the script status is on enabled mode
42+
apply() {
43+
if [ -n "$AUDIT_INVALID_FILES" ]; then
44+
for file in $AUDIT_INVALID_FILES; do
45+
info "changing owner to $AUDIT_CONF_OWNER for $file"
46+
chown "$AUDIT_CONF_OWNER" "$file"
47+
done
48+
fi
49+
}
50+
51+
# This function will check config parameters required
52+
check_config() {
53+
:
54+
}
55+
56+
create_config() {
57+
cat <<EOF
58+
# shellcheck disable=2034
59+
status=audit
60+
# owner of the audit configuration files
61+
AUDIT_CONF_OWNER='root'
62+
EOF
63+
}
64+
65+
# Source Root Dir Parameter
66+
if [ -r /etc/default/cis-hardening ]; then
67+
# shellcheck source=../../debian/default
68+
. /etc/default/cis-hardening
69+
fi
70+
if [ -z "$CIS_LIB_DIR" ]; then
71+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
72+
echo "Cannot source CIS_LIB_DIR variable, aborting."
73+
exit 128
74+
fi
75+
76+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
77+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
78+
# shellcheck source=../../lib/main.sh
79+
. "${CIS_LIB_DIR}"/main.sh
80+
else
81+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
82+
exit 128
83+
fi

‎bin/hardening/audit_tools_group.sh‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure audit tools belong to group root (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure audit tools belong to group root"
19+
20+
AUDITD_TOOLS="/sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules"
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
AUDIT_INVALID_FILES=""
25+
local result
26+
27+
for file in $AUDITD_TOOLS; do
28+
29+
does_file_exist "$file"
30+
if [ "$FNRET" -eq 0 ]; then
31+
result=$(stat -Lc "%n %G" "$file" | awk '$2 != "root" {print}')
32+
if [ -n "$result" ]; then
33+
crit "wrong owner $file"
34+
AUDIT_INVALID_FILES="$AUDIT_INVALID_FILES $file"
35+
fi
36+
37+
else
38+
info "$file missing"
39+
fi
40+
41+
done
42+
43+
}
44+
45+
# This function will be called if the script status is on enabled mode
46+
apply() {
47+
if [ -n "$AUDIT_INVALID_FILES" ]; then
48+
for file in $AUDIT_INVALID_FILES; do
49+
info "changing group to root for $file"
50+
chgrp root "$file"
51+
done
52+
fi
53+
}
54+
55+
# This function will check config parameters required
56+
check_config() {
57+
:
58+
}
59+
60+
# Source Root Dir Parameter
61+
if [ -r /etc/default/cis-hardening ]; then
62+
# shellcheck source=../../debian/default
63+
. /etc/default/cis-hardening
64+
fi
65+
if [ -z "$CIS_LIB_DIR" ]; then
66+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
67+
echo "Cannot source CIS_LIB_DIR variable, aborting."
68+
exit 128
69+
fi
70+
71+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
72+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
73+
# shellcheck source=../../lib/main.sh
74+
. "${CIS_LIB_DIR}"/main.sh
75+
else
76+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
77+
exit 128
78+
fi

‎bin/hardening/audit_tools_owner.sh‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure audit tools are owned by root (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure audit tools are owned by root"
19+
20+
AUDITD_TOOLS="/sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules"
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
AUDIT_INVALID_FILES=""
25+
local result
26+
27+
for file in $AUDITD_TOOLS; do
28+
29+
does_file_exist "$file"
30+
if [ "$FNRET" -eq 0 ]; then
31+
result=$(stat -Lc "%n %U" "$file" | awk '$2 != "root" {print}')
32+
if [ -n "$result" ]; then
33+
crit "wrong owner $file"
34+
AUDIT_INVALID_FILES="$AUDIT_INVALID_FILES $file"
35+
fi
36+
37+
else
38+
info "$file missing"
39+
fi
40+
41+
done
42+
43+
}
44+
45+
# This function will be called if the script status is on enabled mode
46+
apply() {
47+
if [ -n "$AUDIT_INVALID_FILES" ]; then
48+
for file in $AUDIT_INVALID_FILES; do
49+
info "changing owner to root for $file"
50+
chown root "$file"
51+
done
52+
fi
53+
}
54+
55+
# This function will check config parameters required
56+
check_config() {
57+
:
58+
}
59+
60+
# Source Root Dir Parameter
61+
if [ -r /etc/default/cis-hardening ]; then
62+
# shellcheck source=../../debian/default
63+
. /etc/default/cis-hardening
64+
fi
65+
if [ -z "$CIS_LIB_DIR" ]; then
66+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
67+
echo "Cannot source CIS_LIB_DIR variable, aborting."
68+
exit 128
69+
fi
70+
71+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
72+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
73+
# shellcheck source=../../lib/main.sh
74+
. "${CIS_LIB_DIR}"/main.sh
75+
else
76+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
77+
exit 128
78+
fi

0 commit comments

Comments
 (0)