tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-31 01:24:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add new feature: Implement the exception handling feature for the specified service. Just implement http for 6.10

Browse Source
This commit is contained in:
samson 2019-03-28 03:39:16 +08:00
parent f3e43720cf
commit 372b6627ed
2 changed files with 28 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
bin/hardening.sh
View File

@ -188,6 +188,12 @@ if [ -n "$SET_HARDENING_LEVEL" -a "$SET_HARDENING_LEVEL" != 0 ] ; then
wantedstatus=disabled wantedstatus=disabled
[ "$script_level" -le "$SET_HARDENING_LEVEL" ] && wantedstatus=enabled [ "$script_level" -le "$SET_HARDENING_LEVEL" ] && wantedstatus=enabled
sed -i -re "s/^status=.+/status=$wantedstatus/" $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_BASENAME.cfg sed -i -re "s/^status=.+/status=$wantedstatus/" $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_BASENAME.cfg
# If use --allow-service to set, add HARDENING_EXCEPTION=1 to SCRTPT_BASENAME.cfg
template=$(grep "^HARDENING_EXCEPTION=" "$SCRIPT" | cut -d= -f2)
if [ -n "$template" -a $(echo "${ALLOWED_SERVICES_LIST[@]}" | grep -wc "$template") -eq 1 ]; then
sed -i "s/^ISEXCEPTION=./ISEXCEPTION=1/" $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_BASENAME.cfg
fi
done done
echo "Configuration modified to enable scripts for hardening level at or below $SET_HARDENING_LEVEL" echo "Configuration modified to enable scripts for hardening level at or below $SET_HARDENING_LEVEL"
exit 0 exit 0

26
bin/hardening/6.10_disable_http_server.sh
View File

@ -22,7 +22,11 @@ audit () {
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed!" if [ $ISEXCEPTION -eq 1 ]; then
warn "$PACKAGE is installed! But Exception is set to 1, so it's pass!"
else
crit "$PACKAGE is installed!"
fi
else else
ok "$PACKAGE is absent" ok "$PACKAGE is absent"
fi fi
@ -34,15 +38,29 @@ apply () {
for PACKAGE in $PACKAGES; do for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed, purging it" if [ $ISEXCEPTION -eq 1 ]; then
apt-get purge $PACKAGE -y warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
apt-get autoremove else
crit "$PACKAGE is installed, purging it"
apt-get purge $PACKAGE
apt-get autoremove
fi
else else
ok "$PACKAGE is absent" ok "$PACKAGE is absent"
fi fi
done done
} }
# This function will create the config file for this check with default values
create_config() {
cat <<EOF
status=disabled
# Put here exception to pass this case, if set is 1, don't need apply, let to pass.
ISEXCEPTION=0
EOF
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :