tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-30 09:06:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

Modified 6.7~6.20 to be compatible with CentOS.

Browse Source
This commit is contained in:
Samson-W 2019-08-08 05:13:55 +08:00
parent d0a730c321
commit 19b3831baf
13 changed files with 240 additions and 158 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
bin/hardening/6.10_disable_http_server.sh
View File

@ -1,7 +1,8 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9 or CentOS Hardening
# Modify by: Samson-W (samson@hardenedlinux.org)
# #
# #
@ -16,9 +17,13 @@ HARDENING_EXCEPTION=http
# Based on aptitude search '~Phttpd' # Based on aptitude search '~Phttpd'
PACKAGES='nginx apache2 lighttpd micro-httpd mini-httpd yaws boa bozohttpd' PACKAGES='nginx apache2 lighttpd micro-httpd mini-httpd yaws boa bozohttpd'
PACKAGES_REDHAT='httpd pcp-pmda-nginx'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
if [ $OS_RELEASE -eq 2 ]; then
PACKAGES=$PACKAGES_REDHAT
fi
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -35,6 +40,9 @@ audit () {
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
if [ $OS_RELEASE -eq 2 ]; then
PACKAGES=$PACKAGES_REDHAT
fi
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -42,9 +50,13 @@ apply () {
warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate." warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
else else
crit "$PACKAGE is installed, purging it" crit "$PACKAGE is installed, purging it"
if [ $OS_RELEASE -eq 2 ]; then
yum autoremove $PACKAGE
else
apt-get purge $PACKAGE apt-get purge $PACKAGE
apt-get autoremove apt-get autoremove
fi fi
fi
else else
ok "$PACKAGE is absent" ok "$PACKAGE is absent"
fi fi

10
bin/hardening/6.11_disable_imap_pop.sh
View File

@ -1,7 +1,7 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9 or CentOS Hardening
# #
# #
@ -19,6 +19,9 @@ PACKAGES='citadel-server courier-imap cyrus-imapd-2.4 dovecot-imapd mailutils-im
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
if [ $OS_RELEASE -eq 2 ]; then
ok "Redhat or CentOS does not have this check, so PASS"
else
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -31,10 +34,14 @@ audit () {
ok "$PACKAGE is absent" ok "$PACKAGE is absent"
fi fi
done done
fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
if [ $OS_RELEASE -eq 2 ]; then
ok "Redhat or CentOS does not have this check, so PASS"
else
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -49,6 +56,7 @@ apply () {
ok "$PACKAGE is absent" ok "$PACKAGE is absent"
fi fi
done done
fi
} }
# This function will create the config file for this check with default values # This function will create the config file for this check with default values

7
bin/hardening/6.12_disable_samba.sh
View File

@ -1,7 +1,8 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9 or CentOS Hardening
# Modify by: Samson-W (samson@hardenedlinux.org)
# #
# #
@ -41,9 +42,13 @@ apply () {
warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate." warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
else else
crit "$PACKAGE is installed, purging it" crit "$PACKAGE is installed, purging it"
if [ $OS_RELEASE -eq 2 ]; then
yum autoremove $PACKAGE -y
else
apt-get purge $PACKAGE -y apt-get purge $PACKAGE -y
apt-get autoremove apt-get autoremove
fi fi
fi
else else
ok "$PACKAGE is absent" ok "$PACKAGE is absent"
fi fi

14
bin/hardening/6.13_disable_http_proxy.sh
View File

@ -1,7 +1,8 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9 or CentOS Hardening
# Modify by: Samson-W (samson@hardenedlinux.org)
# #
# #
@ -15,9 +16,13 @@ HARDENING_LEVEL=3
HARDENING_EXCEPTION=http HARDENING_EXCEPTION=http
PACKAGES='squid3 squid' PACKAGES='squid3 squid'
PACKAGES_REDHAT='squid gssproxy haproxy'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
if [ $OS_RELEASE -eq 2 ]; then
PACKAGES=$PACKAGES_REDHAT
fi
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -34,6 +39,9 @@ audit () {
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
if [ $OS_RELEASE -eq 2 ]; then
PACKAGES=$PACKAGES_REDHAT
fi
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -41,9 +49,13 @@ apply () {
warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate." warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
else else
crit "$PACKAGE is installed, purging it" crit "$PACKAGE is installed, purging it"
if [ $OS_RELEASE -eq 2 ]; then
yum autoremove $PACKAGE -y
else
apt-get purge $PACKAGE -y apt-get purge $PACKAGE -y
apt-get autoremove apt-get autoremove
fi fi
fi
else else
ok "$PACKAGE is absent" ok "$PACKAGE is absent"
fi fi

10
bin/hardening/6.14_disable_snmp_server.sh
View File

@ -1,7 +1,7 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9 or CentOS Hardening
# #
# #
@ -18,6 +18,9 @@ PACKAGES='snmpd'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
if [ $OS_RELEASE -eq 2 ]; then
ok "Redhat or CentOS does not have this check, so PASS"
else
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -30,10 +33,14 @@ audit () {
ok "$PACKAGE is absent" ok "$PACKAGE is absent"
fi fi
done done
fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
if [ $OS_RELEASE -eq 2 ]; then
ok "Redhat or CentOS does not have this check, so PASS"
else
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -47,6 +54,7 @@ apply () {
ok "$PACKAGE is absent" ok "$PACKAGE is absent"
fi fi
done done
fi
} }
# This function will create the config file for this check with default values # This function will create the config file for this check with default values

10
bin/hardening/6.16_disable_rsync.sh
View File

@ -1,7 +1,7 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9 or CentOS Hardening
# #
# #
@ -21,6 +21,9 @@ RSYNC_DEFAULT_PATTERN_TO_SEARCH='RSYNC_ENABLE=true'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
if [ $OS_RELEASE -eq 2 ]; then
ok "Redhat or CentOS does not have this check, so PASS"
else
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
ok "$PACKAGE is not installed" ok "$PACKAGE is not installed"
@ -33,10 +36,14 @@ audit () {
ok "$RSYNC_DEFAULT_PATTERN found in $RSYNC_DEFAULT_FILE" ok "$RSYNC_DEFAULT_PATTERN found in $RSYNC_DEFAULT_FILE"
fi fi
fi fi
fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
if [ $OS_RELEASE -eq 2 ]; then
ok "Redhat or CentOS does not have this check, so PASS"
else
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
ok "$PACKAGE is not installed" ok "$PACKAGE is not installed"
@ -51,6 +58,7 @@ apply () {
ok "$RSYNC_DEFAULT_PATTERN found in $RSYNC_DEFAULT_FILE" ok "$RSYNC_DEFAULT_PATTERN found in $RSYNC_DEFAULT_FILE"
fi fi
fi fi
fi
} }
# This function will check config parameters required # This function will check config parameters required

2
bin/hardening/6.17_ensure_virul_scan_server_is_enabled.sh
View File

@ -2,7 +2,7 @@
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9 Hardening
# # todo test for centos
# #
# 6.17 Ensure virul scan Server is enabled (Scored) # 6.17 Ensure virul scan Server is enabled (Scored)

2
bin/hardening/6.18_ensure_virusscan_program_update_is_enabled.sh
View File

@ -2,7 +2,7 @@
# #
# harbian audit 9 Hardening # harbian audit 9 Hardening
# # todo test for centos
# #
# 6.18 Ensure virul scan Server update is enabled (Scored) # 6.18 Ensure virul scan Server update is enabled (Scored)

6
bin/hardening/6.19_configure_ntp.sh
View File

@ -1,11 +1,11 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9 or CentOS Hardening
# # todo base redhat7 v2r3 of STIG
# #
# 6.5 Configure Network Time Protocol (NTP) (Scored) # 6.19 Configure Network Time Protocol (NTP) (Scored)
# Modify Author : Samson wen, Samson <sccxboy@gmail.com> # Modify Author : Samson wen, Samson <sccxboy@gmail.com>
# #

8
bin/hardening/6.20_configure_chrony.sh
View File

@ -23,6 +23,9 @@ NTP_POOL_CFG='pool 2.debian.pool.ntp.org iburst'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
if [ $OS_RELEASE -eq 2 ]; then
ok "Redhat or CentOS does not have this check, so PASS"
else
is_pkg_installed $ANALOGONS_PKG is_pkg_installed $ANALOGONS_PKG
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "Analogons pagkage $ANALOGONS_PKG is installed. So pass check." ok "Analogons pagkage $ANALOGONS_PKG is installed. So pass check."
@ -40,10 +43,14 @@ audit () {
fi fi
fi fi
fi fi
fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
if [ $OS_RELEASE -eq 2 ]; then
ok "Redhat or CentOS does not have this check, so PASS"
else
is_pkg_installed $ANALOGONS_PKG is_pkg_installed $ANALOGONS_PKG
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "Analogons pagkage $ANALOGONS_PKG is installed. So pass check." ok "Analogons pagkage $ANALOGONS_PKG is installed. So pass check."
@ -66,6 +73,7 @@ apply () {
exit 1 exit 1
fi fi
fi fi
fi
} }
# This function will check config parameters required # This function will check config parameters required

11
bin/hardening/6.7_disable_nfs_rpc.sh
View File

@ -1,7 +1,8 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9 or CentOS Hardening
# Modify by: Samson-W (samson@hardenedlinux.org)
# #
# #
@ -18,6 +19,9 @@ PACKAGES='rpcbind nfs-kernel-server'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
if [ $OS_RELEASE -eq 2 ]; then
ok "Redhat or CentOS does not have this check, so PASS"
else
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -30,10 +34,14 @@ audit () {
ok "$PACKAGE is absent" ok "$PACKAGE is absent"
fi fi
done done
fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
if [ $OS_RELEASE -eq 2 ]; then
ok "Redhat or CentOS does not have this check, so PASS"
else
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -48,6 +56,7 @@ apply () {
ok "$PACKAGE is absent" ok "$PACKAGE is absent"
fi fi
done done
fi
} }
# This function will create the config file for this check with default values # This function will create the config file for this check with default values

14
bin/hardening/6.8_disable_dns_server.sh
View File

@ -1,7 +1,8 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9 or CentOS Hardening
# Modify by: Samson-W (samson@hardenedlinux.org)
# #
# #
@ -15,9 +16,13 @@ HARDENING_LEVEL=3
HARDENING_EXCEPTION=dns HARDENING_EXCEPTION=dns
PACKAGES='bind9 unbound' PACKAGES='bind9 unbound'
PACKAGES_REDHAT='bind unbound'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
if [ $OS_RELEASE -eq 2 ]; then
PACKAGES=$PACKAGES_REDHAT
fi
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -34,6 +39,9 @@ audit () {
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
if [ $OS_RELEASE -eq 2 ]; then
PACKAGES=$PACKAGES_REDHAT
fi
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -41,9 +49,13 @@ apply () {
warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate." warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
else else
crit "$PACKAGE is installed, purging it" crit "$PACKAGE is installed, purging it"
if [ $OS_RELEASE -eq 2 ]; then
yum autoremove $PACKAGE -y
else
apt-get purge $PACKAGE -y apt-get purge $PACKAGE -y
apt-get autoremove apt-get autoremove
fi fi
fi
else else
ok "$PACKAGE is absent" ok "$PACKAGE is absent"
fi fi

2
bin/hardening/6.9_disable_ftp.sh
View File

@ -51,7 +51,7 @@ apply () {
else else
crit "$PACKAGE is installed, purging it" crit "$PACKAGE is installed, purging it"
if [ $OS_RELEASE -eq 2 ]; then if [ $OS_RELEASE -eq 2 ]; then
yum remove $PACKAGE -y yum autoremove $PACKAGE -y
else else
apt-get purge $PACKAGE -y apt-get purge $PACKAGE -y
apt-get autoremove apt-get autoremove