tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-31 01:24:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Modify audit and apply methods for 9.3.24

Browse Source
This commit is contained in:
Samson-W 2019-05-09 14:06:04 +08:00
parent 9d8e8cf2e3
commit 1604707e56
1 changed files with 20 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
bin/hardening/9.3.24_ssh_check_priv_hostkey_permission.sh
View File

@ -14,25 +14,37 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=2 HARDENING_LEVEL=2
USER='root'
GROUP='root'
PERMISSIONS='0600'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
if [ $(find /etc/ssh/ -name "*ssh_host*key" ! -uid 0 -o ! -gid 0 | wc -l) -gt 0 ]; then
crit "There are file ownership was not set to $USER:$GROUP"
else
ok "There are file has correct ownership"
fi
if [ $(find /etc/ssh/ -name "*ssh_host*key" -perm /177 | wc -l) -gt 0 ]; then if [ $(find /etc/ssh/ -name "*ssh_host*key" -perm /177 | wc -l) -gt 0 ]; then
crit "There are file file has a mode more permissive than "0600"" crit "There are file file has a mode more permissive than $PERMISSIONS"
FNRET=1
else else
ok "Not any file has a mode more permissive than "0600"" ok "Not any file has a mode more permissive than $PERMISSIONS"
FNRET=0
fi fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
if [ $FNRET = 0 ]; then if [ $(find /etc/ssh/ -name "*ssh_host*key" ! -uid 0 -o ! -gid 0 | wc -l) -gt 0 ]; then
ok "any file has a mode more permissive than "0600"" warn "There are file ownership was not set to $USER:$GROUP"
else find /etc/ssh/ -name "*ssh_host*key" ! -uid 0 -o ! -gid 0 -exec chown $USER:$GROUP {} \;
else
ok "There are file has correct ownership"
fi
if [ $(find /etc/ssh/ -name "*ssh_host*key" -perm /177 | wc -l) -gt 0 ]; then
warn "Set ssh private host key permission to 0600" warn "Set ssh private host key permission to 0600"
find /etc/ssh/ -name "*ssh_host*key" -perm /177 -exec chmod 0600 {} \; find /etc/ssh/ -name "*ssh_host*key" -perm /177 -exec chmod $PERMISSIONS {} \;
else
ok "any file has a mode more permissive than "0600""
fi fi
} }