tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-09-25 18:58:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Modify audit and apply methods for redhat/CentOS to 10.1.8

Browse Source
This commit is contained in:
Samson-W 2020-01-16 04:27:58 +08:00
parent cd82d799fc
commit 665e54898a
1 changed files with 70 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

87
bin/hardening/10.1.8_set_fail_delay_seconds.sh
View File

@ -1,7 +1,7 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 9 Hardening # harbian audit debian 9 or CentOS8 Hardening
# #
# #
@ -14,19 +14,7 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=2 HARDENING_LEVEL=2
audit_debian () {
PACKAGE='libpam-modules'
PAMLIBNAME='pam_faildelay.so'
PATTERN='^auth.*pam_faildelay.so'
FILE='/etc/pam.d/login'
OPTIONNAME='delay'
# condition (microseconds)
CONDT_VAL=4000000
# This function will be called if the script status is on enabled / audit mode
audit () {
is_pkg_installed $PACKAGE is_pkg_installed $PACKAGE
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
crit "$PACKAGE is not installed!" crit "$PACKAGE is not installed!"
@ -49,8 +37,30 @@ audit () {
fi fi
} }
# This function will be called if the script status is on enabled mode audit_redhat () {
apply () { for SSH_OPTION in $OPTIONS; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2)
PATTERN="^$SSH_PARAM[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN"
if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE"
else
crit "$PATTERN is not present in $FILE"
fi
done
}
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 2 ]; then
audit_redhat
else
audit_debian
fi
}
apply_debian () {
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
elif [ $FNRET = 1 ]; then elif [ $FNRET = 1 ]; then
@ -70,9 +80,52 @@ apply () {
fi fi
} }
apply_redhat () {
for SSH_OPTION in $OPTIONS; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2)
PATTERN="^$SSH_PARAM[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN"
if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE"
else
warn "$PATTERN is not present in $FILE, adding it"
does_pattern_exist_in_file $FILE "^$SSH_PARAM"
if [ $FNRET != 0 ]; then
add_end_of_file $FILE "$SSH_PARAM $SSH_VALUE"
else
info "Parameter $SSH_PARAM is present but with the wrong value -- Fixing"
replace_in_file $FILE "^$SSH_PARAM[[:space:]]*.*" "$SSH_PARAM $SSH_VALUE"
fi
fi
done
}
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 2 ]; then
apply_redhat
else
apply_debian
fi
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: # CentOS
if [ $OS_RELEASE -eq 2 ]; then
OPTIONS='FAIL_DELAY=4'
FILE='/etc/login.defs'
# Debian
else
PACKAGE='libpam-modules'
PAMLIBNAME='pam_faildelay.so'
PATTERN='^auth.*pam_faildelay.so'
FILE='/etc/pam.d/login'
OPTIONNAME='delay'
# condition (microseconds)
CONDT_VAL=4000000
fi
} }
# Source Root Dir Parameter # Source Root Dir Parameter