tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add add_line_file_after_pattern_lastline function. 

Add audit and apply methods for redhat/CentOS to 9.2.11.
This commit is contained in:
Samson-W 2020-01-13 16:08:51 +08:00
parent e777a839e3
commit 42b057347c
2 changed files with 39 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
bin/hardening/9.2.11_pam_deny_times_tally2.sh
View File

@ -1,8 +1,7 @@
#!/bin/bash
#
# harbian audit 7/8/9 Hardening
# todo for centos
# harbian audit 7/8/9 or CentOS8 Hardening
#
#
@ -21,7 +20,7 @@ PACKAGE='libpam-modules-bin'
PAMLIBNAME='pam_tally2.so'
AUTHPATTERN='^auth[[:space:]]*required[[:space:]]*pam_tally2.so'
AUTHFILE='/etc/pam.d/common-auth'
AUTHRULE='auth required pam_tally2.so deny=3 even_deny_root unlock_time=900'
AUTHRULE='auth required pam_tally2.so deny=3 even_deny_root unlock_time=900'
ADDPATTERNLINE='# pam-auth-update(8) for details.'
DENYOPTION='deny'
DENY_VAL=3
@ -39,7 +38,7 @@ audit () {
ok "$AUTHPATTERN is present in $AUTHFILE."
check_param_pair_by_pam $AUTHFILE $PAMLIBNAME $DENYOPTION le $DENY_VAL
if [ $FNRET = 0 ]; then
ok "$DENYOPTION set condition is $DENY_VAL"
ok "$DENYOPTION set condition is less-than-or-equal-to $DENY_VAL"
else
crit "$DENYOPTION set condition is not $DENY_VAL"
fi
@ -53,13 +52,17 @@ audit () {
# This function will be called if the script status is on enabled mode
apply () {
if [ $FNRET = 0 ]; then
ok "$PACKAGE is installed"
ok "$DENYOPTION set condition is less-than-or-equal-to $DENY_VAL"
elif [ $FNRET = 1 ]; then
warn "Apply:$PACKAGE is absent, installing it"
install_package $PACKAGE
elif [ $FNRET = 2 ]; then
warn "Apply:$AUTHPATTERN is not present in $AUTHFILE"
add_line_file_after_pattern "$AUTHFILE" "$AUTHRULE" "$ADDPATTERNLINE"
if [ $OS_RELEASE -eq 2 ]; then
add_line_file_after_pattern_lastline "$AUTHFILE" "$AUTHRULE" "$ADDPATTERNLINE"
else
add_line_file_after_pattern "$AUTHFILE" "$AUTHRULE" "$ADDPATTERNLINE"
fi
elif [ $FNRET = 3 ]; then
crit "$AUTHFILE is not exist, please check"
elif [ $FNRET = 4 ]; then
@ -73,7 +76,16 @@ apply () {
# This function will check config parameters required
check_config() {
:
if [ $OS_RELEASE -eq 2 ]; then
PACKAGE='pam'
PAMLIBNAME='pam_failloc.so'
AUTHPATTERN='^auth[[:space:]]*required[[:space:]]*pam_failloc.so'
AUTHFILE='/etc/pam.d/password-auth'
AUTHRULE='auth required pam_failloc.so deny=3 even_deny_root unlock_time=900'
ADDPATTERNLINE='auth[[:space:]]*required'
else
:
fi
}
# Source Root Dir Parameter

20
lib/utils.sh
View File

@ -231,6 +231,26 @@ add_line_file_after_pattern() {
FNRET=0
}
add_line_file_after_pattern_lastline() {
local FILE=$1
local LINE=$2
local PATTERN=$3
local LASTLINE=-1
backup_file "$FILE"
debug "Inserting $LINE after $PATTERN in $FILE"
PATTERN=$(sed 's@/@\\\/@g' <<< $PATTERN)
if [ $(grep "^$PATTERN" $FILE -c) -gt 0 ]; then
LASTLINE=$(grep "$PATTERN" $FILE -n | sed -n '$p' | awk -F: '{print $1}')
debug "sed -i '$LASTLINE a $LINE' $FILE"
sed -i "$LASTLINE a $LINE" $FILE
FNRET=0
else
crit "$PATTERN is not exist in $FILE"
FNRET=1
fi
}
replace_in_file() {
local FILE=$1
local SOURCE=$2