Skip to content

Commit 2d6fe3b

Browse files
author
damien cavagnini
committed
feat: add debian12 scripts
- etc_shells_permissions.sh -> 7.1.9 - etc_security_opasswd_permissions.sh -> 7.1.10 - passwd_accounts_use_shadow.sh -> 7.2.1 - etc_shadow_fields_not_empty.sh -> 7.2.2 - etc_passwd_groups_in_etc_group.sh -> 7.2.3
1 parent 1c77bc3 commit 2d6fe3b

10 files changed

+638
-0
lines changed

‎bin/hardening/etc_passwd_accounts_use_shadow.sh‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure accounts in /etc/passwd use shadowed passwords (Manual)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=1
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure accounts in /etc/passwd use shadowed passwords"
19+
EXCEPTIONS=""
20+
21+
# This function will be called if the script status is on enabled / audit mode
22+
audit() {
23+
INVALID_USERS=""
24+
# Accounts with a shadowed password have an x in the second field in /etc/passwd.
25+
INVALID_USERS=$(awk -F: '($2 != "x" ) { print $1}' /etc/passwd)
26+
27+
if [ -n "$INVALID_USERS" ]; then
28+
for user in $INVALID_USERS; do
29+
if [ -n "$EXCEPTIONS" ]; then
30+
if ! grep -w "$user" <<<"$EXCEPTIONS" >/dev/null; then
31+
crit "$user does not use a shadow password"
32+
fi
33+
else
34+
crit "$user does not use a shadow password"
35+
fi
36+
done
37+
fi
38+
39+
}
40+
41+
# This function will be called if the script status is on enabled mode
42+
apply() {
43+
# the CIS recommendation says to "Analyze the output of the Audit step above and perform the appropriate action to correct
44+
#any discrepancies found."
45+
# so we do this manually instead of the recommended "automated"
46+
info "Please review the faulty accounts and update their password configuration, or set them as exceptions in the configuration"
47+
}
48+
49+
# This function will check config parameters required
50+
check_config() {
51+
:
52+
}
53+
54+
# maybe someone is gonna have a legit use case....
55+
create_config() {
56+
cat <<EOF
57+
# shellcheck disable=2034
58+
status=audit
59+
# Put here the accounts that should keep their non shadowed password
60+
EXCEPTIONS=''
61+
EOF
62+
}
63+
64+
# Source Root Dir Parameter
65+
if [ -r /etc/default/cis-hardening ]; then
66+
# shellcheck source=../../debian/default
67+
. /etc/default/cis-hardening
68+
fi
69+
if [ -z "$CIS_LIB_DIR" ]; then
70+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
71+
echo "Cannot source CIS_LIB_DIR variable, aborting."
72+
exit 128
73+
fi
74+
75+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
76+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
77+
# shellcheck source=../../lib/main.sh
78+
. "${CIS_LIB_DIR}"/main.sh
79+
else
80+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
81+
exit 128
82+
fi

‎bin/hardening/etc_passwd_groups_in_etc_group.sh‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure all groups in /etc/passwd exist in /etc/group (Manual)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=1
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure all groups in /etc/passwd exist in /etc/group"
19+
20+
# This function will be called if the script status is on enabled / audit mode
21+
audit() {
22+
local invalid_group_gid=""
23+
local passwd_group_gid=""
24+
local group_gid=""
25+
26+
# straight from the debian CIS pdf, works fine as is
27+
passwd_group_gid=("$(awk -F: '{print $4}' /etc/passwd | sort -u)")
28+
group_gid=("$(awk -F: '{print $3}' /etc/group | sort -u)")
29+
passwd_group_diff=("$(printf '%s\n' "${group_gid[@]}" "${passwd_group_gid[@]}" | sort | uniq -u)")
30+
31+
while IFS= read -r l_gid; do
32+
invalid_group_gid=$(awk -F: '($4 == '"$l_gid"') {print $4}' /etc/passwd)
33+
if [ -n "$invalid_group_gid" ]; then
34+
crit "group with gid $invalid_group_gid is present in /etc/passwd but absent from /etc/group"
35+
fi
36+
done < <(printf '%s\n' "${passwd_group_gid[@]}" "${passwd_group_diff[@]}" | sort | uniq -D | uniq)
37+
38+
}
39+
40+
# This function will be called if the script status is on enabled mode
41+
apply() {
42+
# the CIS recommendation is to do it in an automated way, while also "Investigate to determine if the account is logged in and what it is being used for, to
43+
# determine if it needs to be forced off"
44+
# so we do this manually
45+
info "Please review the faulty accounts and update their password configuration, or set them as exceptions in the configuration"
46+
}
47+
48+
# This function will check config parameters required
49+
check_config() {
50+
:
51+
}
52+
53+
# Source Root Dir Parameter
54+
if [ -r /etc/default/cis-hardening ]; then
55+
# shellcheck source=../../debian/default
56+
. /etc/default/cis-hardening
57+
fi
58+
if [ -z "$CIS_LIB_DIR" ]; then
59+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
60+
echo "Cannot source CIS_LIB_DIR variable, aborting."
61+
exit 128
62+
fi
63+
64+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
65+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
66+
# shellcheck source=../../lib/main.sh
67+
. "${CIS_LIB_DIR}"/main.sh
68+
else
69+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
70+
exit 128
71+
fi

‎bin/hardening/etc_security_opasswd_permissions.sh‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure permissions on /etc/security/opasswd are configured (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=1
17+
# shellcheck disable=2034
18+
DESCRIPTION="verify /etc/security/opasswd and /etc/security/opasswd.old are mode 600 or more restrictive, Uid is 0/root and Gid is
19+
0/root"
20+
21+
FILES='/etc/security/opasswd /etc/security/opasswd.old'
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
# we treat both files as one for simplicity
26+
PERMS_VALID=0
27+
UID_VALID=0
28+
GID_VALID=0
29+
30+
VALID_FILES=""
31+
for file in $FILES; do
32+
does_file_exist "$file"
33+
if [ "$FNRET" -eq 0 ]; then
34+
VALID_FILES="$VALID_FILES $file"
35+
fi
36+
done
37+
38+
for file in $VALID_FILES; do
39+
40+
file_stats=$(stat -Lc '%a %u %g' "$file")
41+
42+
if ! grep "[0-6]00" <<<"$(awk '{print $1}' <<<"$file_stats")" >/dev/null; then
43+
crit "$file 's perms are not 600 or less"
44+
PERMS_VALID=1
45+
fi
46+
47+
if [ "$(awk '{print $2}' <<<"$file_stats")" -ne 0 ]; then
48+
crit "$file owner's uid is not 0"
49+
UID_VALID=1
50+
fi
51+
52+
if [ "$(awk '{print $3}' <<<"$file_stats")" -ne 0 ]; then
53+
crit "$file group's gid is not 0"
54+
GID_VALID=1
55+
fi
56+
57+
done
58+
59+
}
60+
61+
# This function will be called if the script status is on enabled mode
62+
apply() {
63+
if [ "$PERMS_VALID" -eq 1 ]; then
64+
for file in $VALID_FILES; do
65+
info "changing permission to 600 on $file"
66+
chmod 600 "$file"
67+
done
68+
fi
69+
70+
if [ "$UID_VALID" -eq 1 ]; then
71+
for file in $VALID_FILES; do
72+
info "changing owner to 0 on $file"
73+
chown 0 "$file"
74+
done
75+
fi
76+
77+
if [ "$GID_VALID" -eq 1 ]; then
78+
for file in $VALID_FILES; do
79+
info "changing group to 0 on $file"
80+
chgrp 0 "$file"
81+
done
82+
fi
83+
}
84+
85+
# This function will check config parameters required
86+
check_config() {
87+
:
88+
}
89+
90+
# Source Root Dir Parameter
91+
if [ -r /etc/default/cis-hardening ]; then
92+
# shellcheck source=../../debian/default
93+
. /etc/default/cis-hardening
94+
fi
95+
if [ -z "$CIS_LIB_DIR" ]; then
96+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
97+
echo "Cannot source CIS_LIB_DIR variable, aborting."
98+
exit 128
99+
fi
100+
101+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
102+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
103+
# shellcheck source=../../lib/main.sh
104+
. "${CIS_LIB_DIR}"/main.sh
105+
else
106+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
107+
exit 128
108+
fi

‎bin/hardening/etc_shadow_fields_not_empty.sh‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure /etc/shadow password fields are not empty (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=1
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure /etc/shadow password fields are not empty"
19+
EXCEPTIONS=""
20+
21+
# This function will be called if the script status is on enabled / audit mode
22+
audit() {
23+
INVALID_USERS=""
24+
25+
local tmp_invalid_users=""
26+
tmp_invalid_users=$($SUDO_CMD cat /etc/shadow | awk -F: '($2 == "" ) { print $1 }')
27+
28+
if [ -n "$tmp_invalid_users" ]; then
29+
for user in $tmp_invalid_users; do
30+
if [ -n "$EXCEPTIONS" ]; then
31+
if ! grep -w "$user" <<<"$EXCEPTIONS" >/dev/null; then
32+
crit "$user does not have a password"
33+
INVALID_USERS="$INVALID_USERS $user"
34+
fi
35+
else
36+
crit "$user does not have a password"
37+
INVALID_USERS="$INVALID_USERS $user"
38+
fi
39+
done
40+
fi
41+
42+
}
43+
44+
# This function will be called if the script status is on enabled mode
45+
apply() {
46+
47+
if [ -n "$INVALID_USERS" ]; then
48+
for user in $INVALID_USERS; do
49+
info "locking $user"
50+
passwd -l "$user"
51+
done
52+
fi
53+
}
54+
55+
# This function will check config parameters required
56+
check_config() {
57+
:
58+
}
59+
60+
# maybe someone is gonna have a legit use case....
61+
create_config() {
62+
cat <<EOF
63+
# shellcheck disable=2034
64+
status=audit
65+
# Put here the accounts that should keep their non shadowed password
66+
EXCEPTIONS=''
67+
EOF
68+
}
69+
70+
# Source Root Dir Parameter
71+
if [ -r /etc/default/cis-hardening ]; then
72+
# shellcheck source=../../debian/default
73+
. /etc/default/cis-hardening
74+
fi
75+
if [ -z "$CIS_LIB_DIR" ]; then
76+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
77+
echo "Cannot source CIS_LIB_DIR variable, aborting."
78+
exit 128
79+
fi
80+
81+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
82+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
83+
# shellcheck source=../../lib/main.sh
84+
. "${CIS_LIB_DIR}"/main.sh
85+
else
86+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
87+
exit 128
88+
fi

0 commit comments

Comments
 (0)