tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update methods for 8.1.16

This commit is contained in:
Samson-W 2019-04-21 06:19:07 +08:00
parent 82019617bd
commit 6157ec0bfc
1 changed files with 28 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
bin/hardening/8.1.16_record_sudo_usage.sh
View File

@ -6,6 +6,7 @@
# #
# 8.1.16 Collect System Administrator Actions (sudolog) (Scored) # 8.1.16 Collect System Administrator Actions (sudolog) (Scored)
# Modify by: Samson-W (sccxboy@gmail.com)
# #
set -e # One error, it's over set -e # One error, it's over
@ -13,43 +14,49 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=4 HARDENING_LEVEL=4
AUDIT_PARAMS='-w /var/log/audit/audit.log -p wa -k sudoaction' SUDOLOG='/var/log/sudo.log'
AUDIT_VALUE='-w /var/log/sudo.log -p wa -k sudoaction'
FILE='/etc/audit/rules.d/audit.rules' FILE='/etc/audit/rules.d/audit.rules'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
# define custom IFS and save default one # define custom IFS and save default one
d_IFS=$IFS d_IFS=$IFS
c_IFS=$'\n' IFS=$'\n'
IFS=$c_IFS if [ -f $SUDOLOG ]; then
for AUDIT_VALUE in $AUDIT_PARAMS; do
debug "$AUDIT_VALUE should be in file $FILE" debug "$AUDIT_VALUE should be in file $FILE"
IFS=$d_IFS
does_pattern_exist_in_file $FILE "$AUDIT_VALUE" does_pattern_exist_in_file $FILE "$AUDIT_VALUE"
IFS=$c_IFS
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
crit "$AUDIT_VALUE is not in file $FILE" crit "$AUDIT_VALUE is not in file $FILE"
FNRET=2
else else
ok "$AUDIT_VALUE is present in $FILE" ok "$AUDIT_VALUE is present in $FILE"
fi fi
done else
crit "file $SUDOLOG is not exist!"
FNRET=1
fi
IFS=$d_IFS IFS=$d_IFS
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
IFS=$'\n' if [ $FNRET = 1 ]; then
for AUDIT_VALUE in $AUDIT_PARAMS; do warn "file $SUDOLOG is not exist! Set default logfile path in /etc/sudoers."
debug "$AUDIT_VALUE should be in file $FILE" sed -i '$aDefaults logfile="/var/log/sudo.log"' /etc/sudoers
does_pattern_exist_in_file $FILE "$AUDIT_VALUE" does_pattern_exist_in_file $FILE "$AUDIT_VALUE"
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
warn "$AUDIT_VALUE is not in file $FILE, adding it" warn "$AUDIT_VALUE is not in file $FILE, adding it"
add_end_of_file $FILE $AUDIT_VALUE add_end_of_file $FILE $AUDIT_VALUE
eval $(pkill -HUP -P 1 auditd)
fi
elif [ $FNRET = 2 ]; then
warn "$AUDIT_VALUE is not in file $FILE, adding it"
add_end_of_file $FILE $AUDIT_VALUE
eval $(pkill -HUP -P 1 auditd) eval $(pkill -HUP -P 1 auditd)
else else
ok "$AUDIT_VALUE is present in $FILE" ok "$AUDIT_VALUE is present in $FILE"
fi fi
done
} }
# This function will check config parameters required # This function will check config parameters required