tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix some bugs for Debian11(bullseye).

This commit is contained in:
Samson-W 2021-02-22 03:53:02 +08:00
parent 5e8b093cd5
commit 64bececd2d
3 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
bin/hardening/1.2_enable_verify_sign_packages_from_repository.sh
View File

@ -19,7 +19,7 @@ YUM_CONF='/etc/yum.conf'
audit_debian ()
{
if [ $(grep -v "^#" /etc/apt/ -r | grep -c "${OPTION}.*true") -gt 0 ]; then
if [ $(grep -v "^#" /etc/apt/ -Ir | grep -c "${OPTION}.*true") -gt 0 ]; then
crit "The signature of packages option is disable "
FNRET=1
else
@ -63,7 +63,7 @@ apply_debian () {
ok "The signature of packages option is enable "
else
warn "Set to enabled signature of packages option"
for CONFFILE in $(grep -i "${OPTION}" /etc/apt/ -r | grep -v "^#" | awk -F: '{print $1}')
for CONFFILE in $(grep -i "${OPTION}" /etc/apt/ -Ir | grep -v "^#" | awk -F: '{print $1}')
do
sed -i "/${OPTION}/d" ${CONFFILE}
#sed -i "s/${OPTION}.*true.*/${OPTION} \"false\";/g" ${CONFFILE}

4
bin/hardening/1.4_set_no_allow_insecure_repository_by_apt.sh
View File

@ -19,7 +19,7 @@ YUM_OPTION='repo_gpgcheck'
YUM_CONFFILE='/etc/yum.conf'
audit_debian () {
if [ $(grep -v "^#" /etc/apt/ -r | grep -c "${OPTION}.*true") -gt 0 ]; then
if [ $(grep -v "^#" /etc/apt/ -rI | grep -c "${OPTION}.*true") -gt 0 ]; then
crit "The allow insecure repository when by apt update is enable"
FNRET=1
else
@ -61,7 +61,7 @@ apply_debian () {
ok "The allow insecure repository when by apt update is disable"
else
warn "Set no allow insecure repository when by apt update"
for CONFFILE in $(grep -i "${OPTION}" /etc/apt/ -r | grep -v "^#" | awk -F: '{print $1}')
for CONFFILE in $(grep -i "${OPTION}" /etc/apt/ -rI | grep -v "^#" | awk -F: '{print $1}')
do
sed -i "s/${OPTION}.*true.*/${OPTION} \"false\";/g" ${CONFFILE}
done

2
lib/utils.sh
View File

@ -1240,7 +1240,7 @@ check_sshd_conf_for_one_value_runtime ()
# Example: $1='nf_nat_sip'
check_blacklist_module_set ()
{
MODPROBE_CONF_FILE_PATTERN='/etc/modprobe.d/*'
MODPROBE_CONF_FILE_PATTERN="/etc/modprobe.d/*"
COUNT=$(grep -w $1 -r $MODPROBE_CONF_FILE_PATTERN | grep "^blacklist" | wc -l)
if [ $COUNT -ge 1 ]; then
debug "$1 has set in $MODPROBE_CONF_FILE_PATTERN"