tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Modify functions for firewall

This commit is contained in:
Samson-W 2018-11-27 02:05:23 +08:00
parent 0aa16f3e6d
commit 217c3cd020
3 changed files with 3 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
bin/hardening/7.7.2_ensure_set_firewall_rules.sh
View File

@ -17,12 +17,9 @@ HARDENING_LEVEL=2
# Quick note here : CIS recommends your iptables rules to be persistent.
# Do as you want, but this script does not handle this
PARAM='SETRULE'
# This function will be called if the script status is on enabled / audit mode
audit () {
check_iptables_set ${PARAM}
if [ $FNRET != 0 ]; then
if [ $(/sbin/iptables -S | grep -Ec "^-A|^-I") -eq 0 ]; then
crit "Iptables is not set rule!"
FNRET=1
else

8
bin/hardening/7.7.3_ensure_firewall_set_protect_dos_attacks.sh
View File

@ -5,7 +5,7 @@
#
#
# 7.7.2 Ensure the Firewall is set rules of protect DOS attacks (Scored)
# 7.7.3 Ensure the Firewall is set rules of protect DOS attacks (Scored)
# Add this feature:Authors : Samson wen, Samson <sccxboy@gmail.com>
#
@ -17,13 +17,9 @@ HARDENING_LEVEL=2
# Quick note here : CIS recommends your iptables rules to be persistent.
# Do as you want, but this script does not handle this
PARAM='SETDOS'
# This function will be called if the script status is on enabled / audit mode
audit () {
check_iptables_set ${PARAM}
echo "fffffffffffffffffffffffffffffffffffff"
if [ $FNRET != 0 ]; then
if [ $(/sbin/iptables -S | grep -E "\-m.*limit" | grep -Ec "\-\-limit-burst") -eq 0 ]; then
crit "Iptables is not set rules of protect DOS attacks!"
FNRET=1
else

23
lib/utils.sh
View File

@ -673,26 +673,3 @@ check_auth_option_nullok_by_pam()
fi
}
check_iptables_set()
{
case $1 in
SETRULE)
COUNTLINE=$(/sbin/iptables -S | grep -Ec "^-A|^-I")
if [ ${COUNTLINE} -gt 0 ]; then
FNRET=0
else
FNRET=1
fi
;;
SETDOS)
COUNTLINE=$(/sbin/iptables -S | grep -E "\-m.*limit" | grep -Ec "\-\-limit-burst")
echo "fsfdsfdsfdfffffffffffffffff"
if [ ${COUNTLINE} -eq 0 ]; then
FNRET=1
else
FNRET=0
fi
;;
esac
}