tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Modified 4.6 5.1.1~5.1.7 to be compatible with CentOS.

This commit is contained in:
Samson-W 2019-08-06 06:03:15 +08:00
parent f8aa395b6e
commit 22ca3864d4
8 changed files with 272 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
bin/hardening/4.6_disable_usb_devices.sh
View File

@ -1,11 +1,13 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening / # harbian audit 7/8/9/10 or CentOS Hardening
# Modify by: Samson-W (samson@hardenedlinux.org)
# #
# #
# 4.6 Disable USB Devices # 4.6 Disable USB Devices
# TODO test
# #
set -e # One error, it's over set -e # One error, it's over
@ -18,8 +20,11 @@ PATTERN='ACTION=="add", SUBSYSTEMS=="usb", TEST=="authorized_default", ATTR{auth
FILES_TO_SEARCH='/etc/udev/rules.d' FILES_TO_SEARCH='/etc/udev/rules.d'
FILE='/etc/udev/rules.d/CIS_4.6_usb_devices.conf' FILE='/etc/udev/rules.d/CIS_4.6_usb_devices.conf'
# This function will be called if the script status is on enabled / audit mode BLACKRULEPATTERN='^blacklist[[:blank:]].*usb-storage'
audit () { BLACKRULE='blacklist usb-storage'
BLACKCONFILE='/etc/modprobe.d/blacklist.conf'
audit_debian () {
SEARCH_RES=0 SEARCH_RES=0
for FILE_SEARCHED in $FILES_TO_SEARCH; do for FILE_SEARCHED in $FILES_TO_SEARCH; do
if [ $SEARCH_RES = 1 ]; then break; fi if [ $SEARCH_RES = 1 ]; then break; fi
@ -50,6 +55,22 @@ audit () {
fi fi
} }
audit_redhat () {
:
}
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 1 ]; then
audit_debian
elif [ $OS_RELEASE -eq 2 ]; then
audit_redhat
else
crit "Current OS is not support!"
FNRET=44
fi
}
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
SEARCH_RES=0 SEARCH_RES=0

20
bin/hardening/5.1.1_disable_nis.sh
View File

@ -1,7 +1,8 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9/10 or CentOS Hardening
# Modify by: Samson-W (samson@hardenedlinux.org)
# #
# #
@ -14,10 +15,14 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=3 HARDENING_LEVEL=3
PACKAGE='nis' PACKAGE='nis'
PACKAGE_REDHAT='ypserv'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
is_pkg_installed $PACKAGE if [ $OS_RELEASE -eq 2 ]; then
PACKAGE=$PACKAGE_REDHAT
fi
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed!" crit "$PACKAGE is installed!"
else else
@ -28,11 +33,18 @@ audit () {
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
if [ $OS_RELEASE -eq 2 ]; then
PACKAGE=$PACKAGE_REDHAT
fi
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed, purging it" crit "$PACKAGE is installed, purging it"
apt-get purge $PACKAGE -y if [ $OS_RELEASE -eq 2 ]; then
apt-get autoremove yum -y autoremove $PACKAGE
else
apt-get purge $PACKAGE -y
apt-get autoremove
fi
else else
ok "$PACKAGE is absent" ok "$PACKAGE is absent"
fi fi

51
bin/hardening/5.1.2_disable_rsh.sh
View File

@ -1,7 +1,8 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9/10 or CentOS Hardening
# Modify by: Samson-W (samson@hardenedlinux.org)
# #
# #
@ -15,11 +16,11 @@ HARDENING_LEVEL=2
# Based on aptitude search '~Prsh-server' # Based on aptitude search '~Prsh-server'
PACKAGES='rsh-server rsh-redone-server heimdal-servers' PACKAGES='rsh-server rsh-redone-server heimdal-servers'
PACKAGE_REDHAT='rsh-server'
FILE='/etc/inetd.conf' FILE='/etc/inetd.conf'
PATTERN='^(shell|login|exec)' PATTERN='^(shell|login|exec)'
# This function will be called if the script status is on enabled / audit mode audit_debian () {
audit () {
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -41,8 +42,27 @@ audit () {
done done
} }
# This function will be called if the script status is on enabled mode audit_redhat () {
apply () { is_pkg_installed $PACKAGE_REDHAT
if [ $FNRET = 0 ]; then
crit "$PACKAGE_REDHAT is installed!"
else
ok "$PACKAGE_REDHAT is absent"
fi
}
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 1 ]; then
audit_debian
elif [ $OS_RELEASE -eq 2 ]; then
audit_redhat
else
crit "Current OS is not support!"
FNRET=44
fi
}
apply_debian () {
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -70,6 +90,27 @@ apply () {
done done
} }
apply_redhat () {
is_pkg_installed $PACKAGE_REDHAT
if [ $FNRET = 0 ]; then
crit "$$PACKAGE_REDHAT is installed, purging it"
yum -y remove $PACKAGE_REDHAT
else
ok "$PACKAGE_REDHAT is absent"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 1 ]; then
apply_debian
elif [ $OS_RELEASE -eq 2 ]; then
apply_redhat
else
crit "Current OS is not support!"
fi
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :

47
bin/hardening/5.1.3_disable_rsh_client.sh
View File

@ -1,7 +1,8 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9/10 or CentOS Hardening
# Modify by: Samson-W (samson@hardenedlinux.org)
# #
# #
@ -18,28 +19,36 @@ PACKAGES='rsh-client rsh-redone-client heimdal-clients'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
for PACKAGE in $PACKAGES; do if [ $OS_RELEASE -eq 2 ]; then
is_pkg_installed $PACKAGE ok "Redhat or CentOS does not have this check, so PASS"
if [ $FNRET = 0 ]; then else
crit "$PACKAGE is installed" for PACKAGE in $PACKAGES; do
else is_pkg_installed $PACKAGE
ok "$PACKAGE is absent" if [ $FNRET = 0 ]; then
fi crit "$PACKAGE is installed"
done else
ok "$PACKAGE is absent"
fi
done
fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
for PACKAGE in $PACKAGES; do if [ $OS_RELEASE -eq 2 ]; then
is_pkg_installed $PACKAGE ok "Redhat or CentOS does not have this check, so PASS"
if [ $FNRET = 0 ]; then else
warn "$PACKAGE is installed, purging" for PACKAGE in $PACKAGES; do
apt-get purge $PACKAGE -y is_pkg_installed $PACKAGE
apt-get autoremove if [ $FNRET = 0 ]; then
else warn "$PACKAGE is installed, purging"
ok "$PACKAGE is absent" apt-get purge $PACKAGE -y
fi apt-get autoremove
done else
ok "$PACKAGE is absent"
fi
done
fi
} }
# This function will check config parameters required # This function will check config parameters required

55
bin/hardening/5.1.4_disable_talk.sh
View File

@ -1,7 +1,8 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9/10 or CentOS Hardening
# Modify by: Samson-W (samson@hardenedlinux.org)
# #
# #
@ -16,9 +17,9 @@ HARDENING_LEVEL=2
PACKAGES='inetutils-talkd talkd' PACKAGES='inetutils-talkd talkd'
FILE='/etc/inetd.conf' FILE='/etc/inetd.conf'
PATTERN='^(talk|ntalk)' PATTERN='^(talk|ntalk)'
PACKAGES_REDHAT='talk-server'
# This function will be called if the script status is on enabled / audit mode audit_debian () {
audit () {
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -40,8 +41,30 @@ audit () {
done done
} }
# This function will be called if the script status is on enabled mode audit_redhat () {
apply () { for PACKAGE in $PACKAGES_REDHAT; do
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed"
else
ok "$PACKAGE is absent"
fi
done
}
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 1 ]; then
audit_debian
elif [ $OS_RELEASE -eq 2 ]; then
audit_redhat
else
crit "Current OS is not support!"
FNRET=44
fi
}
apply_debian () {
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -69,6 +92,28 @@ apply () {
done done
} }
apply_redhat () {
for PACKAGE in $PACKAGES_REDHAT; do
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed, purging it"
yum remove $PACKAGE -y
else
ok "$PACKAGE is absent"
fi
done
}
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 1 ]; then
apply_debian
elif [ $OS_RELEASE -eq 2 ]; then
apply_redhat
else
crit "Current OS is not support!"
fi
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :

18
bin/hardening/5.1.5_disable_talk_client.sh
View File

@ -1,7 +1,8 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9/10 or CentOS Hardening
# Modify by: Samson-W (samson@hardenedlinux.org)
# #
# #
@ -14,9 +15,13 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=2 HARDENING_LEVEL=2
PACKAGES='talk inetutils-talk' PACKAGES='talk inetutils-talk'
PACKAGES_REDHAT='talk'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
if [ $OS_RELEASE -eq 2 ]; then
PACKAGES=$PACKAGES_REDHAT
fi
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -29,12 +34,19 @@ audit () {
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
if [ $OS_RELEASE -eq 2 ]; then
PACKAGES=$PACKAGES_REDHAT
fi
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
warn "$PACKAGE is installed, purging" warn "$PACKAGE is installed, purging"
apt-get purge $PACKAGE -y if [ $OS_RELEASE -eq 2 ]; then
apt-get autoremove yum remove $PACKAGE -y
else
apt-get purge $PACKAGE -y
apt-get autoremove
fi
else else
ok "$PACKAGE is absent" ok "$PACKAGE is absent"
fi fi

52
bin/hardening/5.1.6_disable_telnet_server.sh
View File

@ -1,7 +1,8 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9/10 or CentOS Hardening
# Modify by: Samson-W (samson@hardenedlinux.org)
# #
# #
@ -17,9 +18,9 @@ HARDENING_LEVEL=2
PACKAGES='telnetd inetutils-telnetd telnetd-ssl krb5-telnetd heimdal-servers' PACKAGES='telnetd inetutils-telnetd telnetd-ssl krb5-telnetd heimdal-servers'
FILE='/etc/inetd.conf' FILE='/etc/inetd.conf'
PATTERN='^telnet' PATTERN='^telnet'
PACKAGE_REDHAT='telnet-server'
# This function will be called if the script status is on enabled / audit mode audit_debian () {
audit () {
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -41,8 +42,28 @@ audit () {
done done
} }
# This function will be called if the script status is on enabled mode audit_redhat () {
apply () { is_pkg_installed $PACKAGE_REDHAT
if [ $FNRET = 0 ]; then
crit "$PACKAGE_REDHAT is installed"
else
ok "$PACKAGE_REDHAT is absent"
fi
}
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 1 ]; then
audit_debian
elif [ $OS_RELEASE -eq 2 ]; then
audit_redhat
else
crit "Current OS is not support!"
FNRET=44
fi
}
apply_debian () {
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -70,6 +91,27 @@ apply () {
done done
} }
apply_redhat () {
is_pkg_installed $PACKAGE_REDHAT
if [ $FNRET = 0 ]; then
crit "$PACKAGE_REDHAT is installed, purging it"
yum remove $PACKAGE_REDHAT -y
else
ok "$PACKAGE_REDHAT is absent"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 1 ]; then
apply_debian
elif [ $OS_RELEASE -eq 2 ]; then
apply_redhat
else
crit "Current OS is not support!"
fi
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :

51
bin/hardening/5.1.7_disable_tftp_server.sh
View File

@ -1,7 +1,8 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9/10 or CentOS Hardening
# Modify by: Samson-W (samson@hardenedlinux.org)
# #
# #
@ -16,9 +17,9 @@ HARDENING_LEVEL=2
PACKAGES='tftpd tftpd-hpa atftpd' PACKAGES='tftpd tftpd-hpa atftpd'
FILE='/etc/inetd.conf' FILE='/etc/inetd.conf'
PATTERN='^tftp' PATTERN='^tftp'
PACKAGE_REDHAT='tftp-server'
# This function will be called if the script status is on enabled / audit mode audit_debian () {
audit () {
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -40,8 +41,28 @@ audit () {
done done
} }
# This function will be called if the script status is on enabled mode audit_redhat () {
apply () { is_pkg_installed $PACKAGE_REDHAT
if [ $FNRET = 0 ]; then
crit "$PACKAGE_REDHAT is installed"
else
ok "$PACKAGE_REDHAT is absent"
fi
}
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 1 ]; then
audit_debian
elif [ $OS_RELEASE -eq 2 ]; then
audit_redhat
else
crit "Current OS is not support!"
FNRET=44
fi
}
apply_debian () {
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
@ -69,6 +90,26 @@ apply () {
done done
} }
apply_redhat () {a
is_pkg_installed $PACKAGE_REDHAT
if [ $FNRET = 0 ]; then
crit "$PACKAGE_REDHAT is installed, purging it"
yum remove $PACKAGE_REDHAT -y
else
ok "$PACKAGE_REDHAT is absent"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 1 ]; then
apply_debian
elif [ $OS_RELEASE -eq 2 ]; then
apply_redhat
else
crit "Current OS is not support!"
fi
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :