tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Modify 9.2.3~9.2.10 to be compatible with CentOS.

This commit is contained in:
Samson-W 2019-08-26 18:25:28 +08:00
parent f5de9a24f9
commit 2ba13e7318
8 changed files with 450 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
bin/hardening/9.2.10_pam_maxclassrepeat_cracklib.sh
View File

@ -1,7 +1,7 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9/10 or CentOS Hardening
# #
# #
@ -19,13 +19,15 @@ PAMLIBNAME='pam_cracklib.so'
PATTERN='^password.*pam_cracklib.so' PATTERN='^password.*pam_cracklib.so'
FILE='/etc/pam.d/common-password' FILE='/etc/pam.d/common-password'
# Redhat/CentOS default use pam_pwquality
FILE_REDHAT='/etc/security/pwquality.conf'
OPTIONNAME='maxclassrepeat' OPTIONNAME='maxclassrepeat'
# condition # condition
CONDT_VAL=4 CONDT_VAL=4
# This function will be called if the script status is on enabled / audit mode audit_debian () {
audit () {
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
crit "$PACKAGE is not installed!" crit "$PACKAGE is not installed!"
@ -49,8 +51,32 @@ audit () {
fi fi
} }
# This function will be called if the script status is on enabled mode audit_redhat () {
apply () { check_param_pair_by_value $FILE_REDHAT $OPTIONNAME le $CONDT_VAL
if [ $FNRET = 0 ]; then
ok "Option $OPTIONNAME set condition is $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 1 ]; then
crit "Option $OPTIONNAME set condition is not set $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 2 ]; then
crit "Option $OPTIONNAME is not conf in $FILE_REDHAT"
elif [ $FNRET = 3 ]; then
crit "Config file $FILE_REDHAT is not exist!"
fi
}
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 1 ]; then
audit_debian
elif [ $OS_RELEASE -eq 2 ]; then
audit_redhat
else
crit "Current OS is not support!"
FNRET=44
fi
}
apply_debian () {
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
elif [ $FNRET = 1 ]; then elif [ $FNRET = 1 ]; then
@ -70,6 +96,31 @@ apply () {
fi fi
} }
apply_redhat () {
if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 1 ]; then
warn "Set option $OPTIONNAME to $CONDT_VAL in $FILE_REDHAT"
replace_in_file $FILE_REDHAT "^$OPTIONNAME.*" "$OPTIONNAME = $CONDT_VAL"
elif [ $FNRET = 2 ]; then
warn "$OPTIONNAME is not conf, add to $FILE_REDHAT"
add_end_of_file $FILE_REDHAT "$OPTIONNAME = $CONDT_VAL"
elif [ $FNRET = 3 ]; then
crit "Config file $FILE_REDHAT is not exist!"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 1 ]; then
apply_debian
elif [ $OS_RELEASE -eq 2 ]; then
apply_redhat
else
crit "Current OS is not support!"
fi
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :

61
bin/hardening/9.2.3_pam_dcredit_cracklib.sh
View File

@ -1,7 +1,7 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 9 Hardening # harbian audit 9/10 or CentOS Hardening
# #
# #
@ -19,13 +19,15 @@ PAMLIBNAME='pam_cracklib.so'
PATTERN='^password.*pam_cracklib.so' PATTERN='^password.*pam_cracklib.so'
FILE='/etc/pam.d/common-password' FILE='/etc/pam.d/common-password'
# Redhat/CentOS default use pam_pwquality
FILE_REDHAT='/etc/security/pwquality.conf'
OPTIONNAME='dcredit' OPTIONNAME='dcredit'
# condition # condition
CONDT_VAL=-1 CONDT_VAL=-1
# This function will be called if the script status is on enabled / audit mode audit_debian () {
audit () {
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
crit "$PACKAGE is not installed!" crit "$PACKAGE is not installed!"
@ -49,8 +51,32 @@ audit () {
fi fi
} }
# This function will be called if the script status is on enabled mode audit_redhat () {
apply () { check_param_pair_by_value $FILE_REDHAT $OPTIONNAME le $CONDT_VAL
if [ $FNRET = 0 ]; then
ok "Option $OPTIONNAME set condition is $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 1 ]; then
crit "Option $OPTIONNAME set condition is not set $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 2 ]; then
crit "Option $OPTIONNAME is not conf in $FILE_REDHAT"
elif [ $FNRET = 3 ]; then
crit "Config file $FILE_REDHAT is not exist!"
fi
}
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 1 ]; then
audit_debian
elif [ $OS_RELEASE -eq 2 ]; then
audit_redhat
else
crit "Current OS is not support!"
FNRET=44
fi
}
apply_debian () {
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
elif [ $FNRET = 1 ]; then elif [ $FNRET = 1 ]; then
@ -70,6 +96,31 @@ apply () {
fi fi
} }
apply_redhat () {
if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 1 ]; then
warn "Set option $OPTIONNAME to $CONDT_VAL in $FILE_REDHAT"
replace_in_file $FILE_REDHAT "^$OPTIONNAME.*" "$OPTIONNAME = $CONDT_VAL"
elif [ $FNRET = 2 ]; then
warn "$OPTIONNAME is not conf, add to $FILE_REDHAT"
add_end_of_file $FILE_REDHAT "$OPTIONNAME = $CONDT_VAL"
elif [ $FNRET = 3 ]; then
crit "Config file $FILE_REDHAT is not exist!"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 1 ]; then
apply_debian
elif [ $OS_RELEASE -eq 2 ]; then
apply_redhat
else
crit "Current OS is not support!"
fi
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :

62
bin/hardening/9.2.4_pam_ucredit_cracklib.sh
View File

@ -1,7 +1,7 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 9 Hardening # harbian audit 9/10 or CentOS Hardening
# #
# #
@ -19,13 +19,15 @@ PAMLIBNAME='pam_cracklib.so'
PATTERN='^password.*pam_cracklib.so' PATTERN='^password.*pam_cracklib.so'
FILE='/etc/pam.d/common-password' FILE='/etc/pam.d/common-password'
# Redhat/CentOS default use pam_pwquality
FILE_REDHAT='/etc/security/pwquality.conf'
OPTIONNAME='ucredit' OPTIONNAME='ucredit'
# condition # condition
CONDT_VAL=-1 CONDT_VAL=-1
# This function will be called if the script status is on enabled / audit mode audit_debian () {
audit () {
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
crit "$PACKAGE is not installed!" crit "$PACKAGE is not installed!"
@ -49,8 +51,33 @@ audit () {
fi fi
} }
# This function will be called if the script status is on enabled mode audit_redhat () {
apply () { check_param_pair_by_value $FILE_REDHAT $OPTIONNAME le $CONDT_VAL
if [ $FNRET = 0 ]; then
ok "Option $OPTIONNAME set condition is $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 1 ]; then
crit "Option $OPTIONNAME set condition is not set $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 2 ]; then
crit "Option $OPTIONNAME is not conf in $FILE_REDHAT"
elif [ $FNRET = 3 ]; then
crit "Config file $FILE_REDHAT is not exist!"
fi
}
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 1 ]; then
audit_debian
elif [ $OS_RELEASE -eq 2 ]; then
audit_redhat
else
crit "Current OS is not support!"
FNRET=44
fi
}
apply_debian () {
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
elif [ $FNRET = 1 ]; then elif [ $FNRET = 1 ]; then
@ -70,6 +97,31 @@ apply () {
fi fi
} }
apply_redhat () {
if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 1 ]; then
warn "Set option $OPTIONNAME to $CONDT_VAL in $FILE_REDHAT"
replace_in_file $FILE_REDHAT "^$OPTIONNAME.*" "$OPTIONNAME = $CONDT_VAL"
elif [ $FNRET = 2 ]; then
warn "$OPTIONNAME is not conf, add to $FILE_REDHAT"
add_end_of_file $FILE_REDHAT "$OPTIONNAME = $CONDT_VAL"
elif [ $FNRET = 3 ]; then
crit "Config file $FILE_REDHAT is not exist!"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 1 ]; then
apply_debian
elif [ $OS_RELEASE -eq 2 ]; then
apply_redhat
else
crit "Current OS is not support!"
fi
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :

62
bin/hardening/9.2.5_pam_ocredit_cracklib.sh
View File

@ -1,7 +1,7 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 9 Hardening # harbian audit 9/10 or CentOS Hardening
# #
# #
@ -19,13 +19,15 @@ PAMLIBNAME='pam_cracklib.so'
PATTERN='^password.*pam_cracklib.so' PATTERN='^password.*pam_cracklib.so'
FILE='/etc/pam.d/common-password' FILE='/etc/pam.d/common-password'
# Redhat/CentOS default use pam_pwquality
FILE_REDHAT='/etc/security/pwquality.conf'
OPTIONNAME='ocredit' OPTIONNAME='ocredit'
# condition # condition
CONDT_VAL=-1 CONDT_VAL=-1
# This function will be called if the script status is on enabled / audit mode audit_debian () {
audit () {
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
crit "$PACKAGE is not installed!" crit "$PACKAGE is not installed!"
@ -49,8 +51,32 @@ audit () {
fi fi
} }
# This function will be called if the script status is on enabled mode audit_redhat () {
apply () { check_param_pair_by_value $FILE_REDHAT $OPTIONNAME le $CONDT_VAL
if [ $FNRET = 0 ]; then
ok "Option $OPTIONNAME set condition is $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 1 ]; then
crit "Option $OPTIONNAME set condition is not set $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 2 ]; then
crit "Option $OPTIONNAME is not conf in $FILE_REDHAT"
elif [ $FNRET = 3 ]; then
crit "Config file $FILE_REDHAT is not exist!"
fi
}
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 1 ]; then
audit_debian
elif [ $OS_RELEASE -eq 2 ]; then
audit_redhat
else
crit "Current OS is not support!"
FNRET=44
fi
}
apply_debian () {
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
elif [ $FNRET = 1 ]; then elif [ $FNRET = 1 ]; then
@ -70,6 +96,32 @@ apply () {
fi fi
} }
apply_redhat () {
if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 1 ]; then
warn "Set option $OPTIONNAME to $CONDT_VAL in $FILE_REDHAT"
replace_in_file $FILE_REDHAT "^$OPTIONNAME.*" "$OPTIONNAME = $CONDT_VAL"
elif [ $FNRET = 2 ]; then
warn "$OPTIONNAME is not conf, add to $FILE_REDHAT"
add_end_of_file $FILE_REDHAT "$OPTIONNAME = $CONDT_VAL"
elif [ $FNRET = 3 ]; then
crit "Config file $FILE_REDHAT is not exist!"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 1 ]; then
apply_debian
elif [ $OS_RELEASE -eq 2 ]; then
apply_redhat
else
crit "Current OS is not support!"
fi
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :

61
bin/hardening/9.2.6_pam_lcredit_cracklib.sh
View File

@ -1,7 +1,7 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 9 Hardening # harbian audit 9/10 or CentOS Hardening
# #
# #
@ -19,13 +19,15 @@ PAMLIBNAME='pam_cracklib.so'
PATTERN='^password.*pam_cracklib.so' PATTERN='^password.*pam_cracklib.so'
FILE='/etc/pam.d/common-password' FILE='/etc/pam.d/common-password'
# Redhat/CentOS default use pam_pwquality
FILE_REDHAT='/etc/security/pwquality.conf'
OPTIONNAME='lcredit' OPTIONNAME='lcredit'
# condition # condition
CONDT_VAL=-1 CONDT_VAL=-1
# This function will be called if the script status is on enabled / audit mode audit_debian () {
audit () {
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
crit "$PACKAGE is not installed!" crit "$PACKAGE is not installed!"
@ -49,8 +51,32 @@ audit () {
fi fi
} }
# This function will be called if the script status is on enabled mode audit_redhat () {
apply () { check_param_pair_by_value $FILE_REDHAT $OPTIONNAME le $CONDT_VAL
if [ $FNRET = 0 ]; then
ok "Option $OPTIONNAME set condition is $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 1 ]; then
crit "Option $OPTIONNAME set condition is not set $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 2 ]; then
crit "Option $OPTIONNAME is not conf in $FILE_REDHAT"
elif [ $FNRET = 3 ]; then
crit "Config file $FILE_REDHAT is not exist!"
fi
}
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 1 ]; then
audit_debian
elif [ $OS_RELEASE -eq 2 ]; then
audit_redhat
else
crit "Current OS is not support!"
FNRET=44
fi
}
apply_debian () {
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
elif [ $FNRET = 1 ]; then elif [ $FNRET = 1 ]; then
@ -70,6 +96,31 @@ apply () {
fi fi
} }
apply_redhat () {
if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 1 ]; then
warn "Set option $OPTIONNAME to $CONDT_VAL in $FILE_REDHAT"
replace_in_file $FILE_REDHAT "^$OPTIONNAME.*" "$OPTIONNAME = $CONDT_VAL"
elif [ $FNRET = 2 ]; then
warn "$OPTIONNAME is not conf, add to $FILE_REDHAT"
add_end_of_file $FILE_REDHAT "$OPTIONNAME = $CONDT_VAL"
elif [ $FNRET = 3 ]; then
crit "Config file $FILE_REDHAT is not exist!"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 1 ]; then
apply_debian
elif [ $OS_RELEASE -eq 2 ]; then
apply_redhat
else
crit "Current OS is not support!"
fi
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :

61
bin/hardening/9.2.7_pam_difok_cracklib.sh
View File

@ -1,7 +1,7 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9/10 or CentOS Hardening
# #
# #
@ -19,13 +19,15 @@ PAMLIBNAME='pam_cracklib.so'
PATTERN='^password.*pam_cracklib.so' PATTERN='^password.*pam_cracklib.so'
FILE='/etc/pam.d/common-password' FILE='/etc/pam.d/common-password'
# Redhat/CentOS default use pam_pwquality
FILE_REDHAT='/etc/security/pwquality.conf'
OPTIONNAME='difok' OPTIONNAME='difok'
# condition # condition
CONDT_VAL=8 CONDT_VAL=8
# This function will be called if the script status is on enabled / audit mode audit_debian () {
audit () {
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
crit "$PACKAGE is not installed!" crit "$PACKAGE is not installed!"
@ -49,8 +51,32 @@ audit () {
fi fi
} }
# This function will be called if the script status is on enabled mode audit_redhat () {
apply () { check_param_pair_by_value $FILE_REDHAT $OPTIONNAME ge $CONDT_VAL
if [ $FNRET = 0 ]; then
ok "Option $OPTIONNAME set condition is $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 1 ]; then
crit "Option $OPTIONNAME set condition is not set $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 2 ]; then
crit "Option $OPTIONNAME is not conf in $FILE_REDHAT"
elif [ $FNRET = 3 ]; then
crit "Config file $FILE_REDHAT is not exist!"
fi
}
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 1 ]; then
audit_debian
elif [ $OS_RELEASE -eq 2 ]; then
audit_redhat
else
crit "Current OS is not support!"
FNRET=44
fi
}
apply_debian () {
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
elif [ $FNRET = 1 ]; then elif [ $FNRET = 1 ]; then
@ -70,6 +96,31 @@ apply () {
fi fi
} }
apply_redhat () {
if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 1 ]; then
warn "Set option $OPTIONNAME to $CONDT_VAL in $FILE_REDHAT"
replace_in_file $FILE_REDHAT "^$OPTIONNAME.*" "$OPTIONNAME = $CONDT_VAL"
elif [ $FNRET = 2 ]; then
warn "$OPTIONNAME is not conf, add to $FILE_REDHAT"
add_end_of_file $FILE_REDHAT "$OPTIONNAME = $CONDT_VAL"
elif [ $FNRET = 3 ]; then
crit "Config file $FILE_REDHAT is not exist!"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 1 ]; then
apply_debian
elif [ $OS_RELEASE -eq 2 ]; then
apply_redhat
else
crit "Current OS is not support!"
fi
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :

61
bin/hardening/9.2.8_pam_minclass_cracklib.sh
View File

@ -1,7 +1,7 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9/10 or CentOS Hardening
# #
# #
@ -19,13 +19,15 @@ PAMLIBNAME='pam_cracklib.so'
PATTERN='^password.*pam_cracklib.so' PATTERN='^password.*pam_cracklib.so'
FILE='/etc/pam.d/common-password' FILE='/etc/pam.d/common-password'
# Redhat/CentOS default use pam_pwquality
FILE_REDHAT='/etc/security/pwquality.conf'
OPTIONNAME='minclass' OPTIONNAME='minclass'
# condition # condition
CONDT_VAL=4 CONDT_VAL=4
# This function will be called if the script status is on enabled / audit mode audit_debian () {
audit () {
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
crit "$PACKAGE is not installed!" crit "$PACKAGE is not installed!"
@ -49,8 +51,32 @@ audit () {
fi fi
} }
# This function will be called if the script status is on enabled mode audit_redhat () {
apply () { check_param_pair_by_value $FILE_REDHAT $OPTIONNAME ge $CONDT_VAL
if [ $FNRET = 0 ]; then
ok "Option $OPTIONNAME set condition is $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 1 ]; then
crit "Option $OPTIONNAME set condition is not set $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 2 ]; then
crit "Option $OPTIONNAME is not conf in $FILE_REDHAT"
elif [ $FNRET = 3 ]; then
crit "Config file $FILE_REDHAT is not exist!"
fi
}
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 1 ]; then
audit_debian
elif [ $OS_RELEASE -eq 2 ]; then
audit_redhat
else
crit "Current OS is not support!"
FNRET=44
fi
}
apply_debian () {
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
elif [ $FNRET = 1 ]; then elif [ $FNRET = 1 ]; then
@ -70,6 +96,31 @@ apply () {
fi fi
} }
apply_redhat () {
if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 1 ]; then
warn "Set option $OPTIONNAME to $CONDT_VAL in $FILE_REDHAT"
replace_in_file $FILE_REDHAT "^$OPTIONNAME.*" "$OPTIONNAME = $CONDT_VAL"
elif [ $FNRET = 2 ]; then
warn "$OPTIONNAME is not conf, add to $FILE_REDHAT"
add_end_of_file $FILE_REDHAT "$OPTIONNAME = $CONDT_VAL"
elif [ $FNRET = 3 ]; then
crit "Config file $FILE_REDHAT is not exist!"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 1 ]; then
apply_debian
elif [ $OS_RELEASE -eq 2 ]; then
apply_redhat
else
crit "Current OS is not support!"
fi
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :

61
bin/hardening/9.2.9_pam_maxrepeat_cracklib.sh
View File

@ -1,7 +1,7 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9/10 or CentOS Hardening
# #
# #
@ -19,13 +19,15 @@ PAMLIBNAME='pam_cracklib.so'
PATTERN='^password.*pam_cracklib.so' PATTERN='^password.*pam_cracklib.so'
FILE='/etc/pam.d/common-password' FILE='/etc/pam.d/common-password'
# Redhat/CentOS default use pam_pwquality
FILE_REDHAT='/etc/security/pwquality.conf'
OPTIONNAME='maxrepeat' OPTIONNAME='maxrepeat'
# condition # condition
CONDT_VAL=3 CONDT_VAL=3
# This function will be called if the script status is on enabled / audit mode audit_debian () {
audit () {
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
crit "$PACKAGE is not installed!" crit "$PACKAGE is not installed!"
@ -49,8 +51,32 @@ audit () {
fi fi
} }
# This function will be called if the script status is on enabled mode audit_redhat () {
apply () { check_param_pair_by_value $FILE_REDHAT $OPTIONNAME le $CONDT_VAL
if [ $FNRET = 0 ]; then
ok "Option $OPTIONNAME set condition is $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 1 ]; then
crit "Option $OPTIONNAME set condition is not set $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 2 ]; then
crit "Option $OPTIONNAME is not conf in $FILE_REDHAT"
elif [ $FNRET = 3 ]; then
crit "Config file $FILE_REDHAT is not exist!"
fi
}
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 1 ]; then
audit_debian
elif [ $OS_RELEASE -eq 2 ]; then
audit_redhat
else
crit "Current OS is not support!"
FNRET=44
fi
}
apply_debian () {
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
elif [ $FNRET = 1 ]; then elif [ $FNRET = 1 ]; then
@ -70,6 +96,31 @@ apply () {
fi fi
} }
apply_redhat () {
if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL in $FILE_REDHAT"
elif [ $FNRET = 1 ]; then
warn "Set option $OPTIONNAME to $CONDT_VAL in $FILE_REDHAT"
replace_in_file $FILE_REDHAT "^$OPTIONNAME.*" "$OPTIONNAME = $CONDT_VAL"
elif [ $FNRET = 2 ]; then
warn "$OPTIONNAME is not conf, add to $FILE_REDHAT"
add_end_of_file $FILE_REDHAT "$OPTIONNAME = $CONDT_VAL"
elif [ $FNRET = 3 ]; then
crit "Config file $FILE_REDHAT is not exist!"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 1 ]; then
apply_debian
elif [ $OS_RELEASE -eq 2 ]; then
apply_redhat
else
crit "Current OS is not support!"
fi
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :