tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Modified utils.sh and 2.25 to be compatible with CentOS.

This commit is contained in:
Samson-W 2019-08-02 04:16:53 +08:00
parent c9ba18c101
commit 359a7c3c5e
2 changed files with 54 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
bin/hardening/2.25_disable_automounting.sh
View File

@ -1,7 +1,8 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 7/8/9 Hardening # harbian audit 7/8/9/10 or CentOS Hardening
# Modify by: Samson-W (samson@hardenedlinux.org)
# #
# #
@ -38,18 +39,31 @@ apply () {
info "Checking if $SERVICE_NAME is enabled" info "Checking if $SERVICE_NAME is enabled"
is_service_enabled $SERVICE_NAME is_service_enabled $SERVICE_NAME
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
if [ $OS_RELEASE -eq 2 ]; then
:
else
is_debian_9 is_debian_9
fi
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
info "Disabling $SERVICE_NAME" info "Disabling $SERVICE_NAME"
systemctl stop $SERVICE_NAME systemctl stop $SERVICE_NAME
systemctl disable $SERVICE_NAME systemctl disable $SERVICE_NAME
if [ $OS_RELEASE -eq 2 ]; then
yum -y autoremove $SERVICE_NAME
else
apt-get -y purge --autoremove $SERVICE_NAME apt-get -y purge --autoremove $SERVICE_NAME
fi
else else
info "Disabling $SERVICE_NAME" info "Disabling $SERVICE_NAME"
update-rc.d $SERVICE_NAME remove > /dev/null 2>&1 update-rc.d $SERVICE_NAME remove > /dev/null 2>&1
fi fi
else else
ok "$SERVICE_NAME is disabled" ok "$SERVICE_NAME is disabled"
if [ $OS_RELEASE -eq 2 ]; then
yum -y autoremove $SERVICE_NAME
else
apt-get -y purge --autoremove $SERVICE_NAME
fi
fi fi
else else
ok "$SERVICE_NAME is not installed" ok "$SERVICE_NAME is not installed"

21
lib/utils.sh
View File

@ -241,9 +241,14 @@ does_group_exist() {
is_service_enabled() { is_service_enabled() {
local SERVICE=$1 local SERVICE=$1
if [ $OS_RELEASE -eq 2 ]; then
FNRET=0
else
is_debian_9 is_debian_9
fi
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
if [ $(systemctl is-enabled $SERVICE | grep -wc "^enabled") -eq 1 ]; then
if [ $(systemctl is-active $SERVICE | grep -c "^active") -eq 1 ]; then
debug "Service $SERVICE is enabled" debug "Service $SERVICE is enabled"
FNRET=0 FNRET=0
else else
@ -493,6 +498,15 @@ apt_install()
is_pkg_installed() is_pkg_installed()
{ {
PKG_NAME=$1 PKG_NAME=$1
if [ $OS_RELEASE -eq 2 ]; then
if [ $(rpm -qa | grep -c $PKG_NAME) -gt 0 ]; then
debug "$PKG_NAME is installed"
FNRET=0
else
debug "$PKG_NAME is not installed"
FNRET=1
fi
else
if $(dpkg -s $PKG_NAME 2> /dev/null | grep -q '^Status: install ') ; then if $(dpkg -s $PKG_NAME 2> /dev/null | grep -q '^Status: install ') ; then
debug "$PKG_NAME is installed" debug "$PKG_NAME is installed"
FNRET=0 FNRET=0
@ -500,11 +514,15 @@ is_pkg_installed()
debug "$PKG_NAME is not installed" debug "$PKG_NAME is not installed"
FNRET=1 FNRET=1
fi fi
fi
} }
verify_integrity_all_packages() verify_integrity_all_packages()
{ {
if [ $OS_RELEASE -eq 2 ]; then
:
else
dpkg -V > /dev/shm/dpkg_verify_ret dpkg -V > /dev/shm/dpkg_verify_ret
if [ $(cat /dev/shm/dpkg_verify_ret | wc -l) -gt 0 ]; then if [ $(cat /dev/shm/dpkg_verify_ret | wc -l) -gt 0 ]; then
debug "Verify integrity all packages is fail" debug "Verify integrity all packages is fail"
@ -514,6 +532,7 @@ verify_integrity_all_packages()
debug "Verify integrity all packages is OK" debug "Verify integrity all packages is OK"
FNRET=0 FNRET=0
fi fi
fi
} }
check_param_pair_by_pam() check_param_pair_by_pam()