tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-31 01:24:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix some bugs for Debian11(bullseye).

Browse Source
This commit is contained in:
Samson-W 2021-02-22 03:53:02 +08:00
parent 5e8b093cd5
commit 64bececd2d
3 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
bin/hardening/1.2_enable_verify_sign_packages_from_repository.sh
View File

@ -19,7 +19,7 @@ YUM_CONF='/etc/yum.conf'
audit_debian () audit_debian ()
{ {
if [ $(grep -v "^#" /etc/apt/ -r | grep -c "${OPTION}.*true") -gt 0 ]; then if [ $(grep -v "^#" /etc/apt/ -Ir | grep -c "${OPTION}.*true") -gt 0 ]; then
crit "The signature of packages option is disable " crit "The signature of packages option is disable "
FNRET=1 FNRET=1
else else
@ -63,7 +63,7 @@ apply_debian () {
ok "The signature of packages option is enable " ok "The signature of packages option is enable "
else else
warn "Set to enabled signature of packages option" warn "Set to enabled signature of packages option"
for CONFFILE in $(grep -i "${OPTION}" /etc/apt/ -r | grep -v "^#" | awk -F: '{print $1}') for CONFFILE in $(grep -i "${OPTION}" /etc/apt/ -Ir | grep -v "^#" | awk -F: '{print $1}')
do do
sed -i "/${OPTION}/d" ${CONFFILE} sed -i "/${OPTION}/d" ${CONFFILE}
#sed -i "s/${OPTION}.*true.*/${OPTION} \"false\";/g" ${CONFFILE} #sed -i "s/${OPTION}.*true.*/${OPTION} \"false\";/g" ${CONFFILE}

4
bin/hardening/1.4_set_no_allow_insecure_repository_by_apt.sh
View File

@ -19,7 +19,7 @@ YUM_OPTION='repo_gpgcheck'
YUM_CONFFILE='/etc/yum.conf' YUM_CONFFILE='/etc/yum.conf'
audit_debian () { audit_debian () {
if [ $(grep -v "^#" /etc/apt/ -r | grep -c "${OPTION}.*true") -gt 0 ]; then if [ $(grep -v "^#" /etc/apt/ -rI | grep -c "${OPTION}.*true") -gt 0 ]; then
crit "The allow insecure repository when by apt update is enable" crit "The allow insecure repository when by apt update is enable"
FNRET=1 FNRET=1
else else
@ -61,7 +61,7 @@ apply_debian () {
ok "The allow insecure repository when by apt update is disable" ok "The allow insecure repository when by apt update is disable"
else else
warn "Set no allow insecure repository when by apt update" warn "Set no allow insecure repository when by apt update"
for CONFFILE in $(grep -i "${OPTION}" /etc/apt/ -r | grep -v "^#" | awk -F: '{print $1}') for CONFFILE in $(grep -i "${OPTION}" /etc/apt/ -rI | grep -v "^#" | awk -F: '{print $1}')
do do
sed -i "s/${OPTION}.*true.*/${OPTION} \"false\";/g" ${CONFFILE} sed -i "s/${OPTION}.*true.*/${OPTION} \"false\";/g" ${CONFFILE}
done done

2
lib/utils.sh
View File

@ -1240,7 +1240,7 @@ check_sshd_conf_for_one_value_runtime ()
# Example: $1='nf_nat_sip' # Example: $1='nf_nat_sip'
check_blacklist_module_set () check_blacklist_module_set ()
{ {
MODPROBE_CONF_FILE_PATTERN='/etc/modprobe.d/*' MODPROBE_CONF_FILE_PATTERN="/etc/modprobe.d/*"
COUNT=$(grep -w $1 -r $MODPROBE_CONF_FILE_PATTERN | grep "^blacklist" | wc -l) COUNT=$(grep -w $1 -r $MODPROBE_CONF_FILE_PATTERN | grep "^blacklist" | wc -l)
if [ $COUNT -ge 1 ]; then if [ $COUNT -ge 1 ]; then
debug "$1 has set in $MODPROBE_CONF_FILE_PATTERN" debug "$1 has set in $MODPROBE_CONF_FILE_PATTERN"