From 6a302f13c4560634e364f807943aaf9451f9608a Mon Sep 17 00:00:00 2001 From: Samson-W Date: Tue, 23 Apr 2019 04:41:54 +0800 Subject: [PATCH] Add 8.2.3 8.2.4 for rsyslog. --- bin/hardening/8.2.3_configure_rsyslog.sh | 65 +++++++++ ....4_check_logfile_perm_4_runtime_rsyslog.sh | 131 ++++++++++++++++++ bin/hardening/8.3.4_set_logfile_perm.sh | 2 +- 3 files changed, 197 insertions(+), 1 deletion(-) create mode 100755 bin/hardening/8.2.3_configure_rsyslog.sh create mode 100755 bin/hardening/8.2.4_check_logfile_perm_4_runtime_rsyslog.sh diff --git a/bin/hardening/8.2.3_configure_rsyslog.sh b/bin/hardening/8.2.3_configure_rsyslog.sh new file mode 100755 index 0000000..8a23b6c --- /dev/null +++ b/bin/hardening/8.2.3_configure_rsyslog.sh @@ -0,0 +1,65 @@ +#!/bin/bash + +# +# harbian audit 7/8/9 Hardening +# + +# +# 8.2.3 Configure /etc/rsyslog.conf (Not Scored) +# Author : Samson wen, Samson +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +HARDENING_LEVEL=3 + +SERVICE_NAME="rsyslog" +PACKAGE_NG='syslog-ng' + +# This function will be called if the script status is on enabled / audit mode +audit () { + is_pkg_installed $PACKAGE_NG + if [ $FNRET = 0 ]; then + ok "$PACKAGE_NG has installed, so pass." + FNRET=0 + else + info "Ensure default and local facilities are preserved on the system" + info "No measure here, please review the file by yourself" + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + is_pkg_installed $PACKAGE_NG + if [ $FNRET = 0 ]; then + ok "$PACKAGE_NG has installed, so pass." + FNRET=0 + else + info "Ensure default and local facilities are preserved on the system" + info "No measure here, please review the file by yourself" + fi +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ -r /etc/default/cis-hardening ]; then + . /etc/default/cis-hardening +fi +if [ -z "$CIS_ROOT_DIR" ]; then + echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment." + echo "Cannot source CIS_ROOT_DIR variable, aborting." + exit 128 +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then + . $CIS_ROOT_DIR/lib/main.sh +else + echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_ROOT_DIR in /etc/default/cis-hardening" + exit 128 +fi diff --git a/bin/hardening/8.2.4_check_logfile_perm_4_runtime_rsyslog.sh b/bin/hardening/8.2.4_check_logfile_perm_4_runtime_rsyslog.sh new file mode 100755 index 0000000..71c7f83 --- /dev/null +++ b/bin/hardening/8.2.4_check_logfile_perm_4_runtime_rsyslog.sh @@ -0,0 +1,131 @@ +#!/bin/bash + +# +# harbian audit 7/8/9 Hardening +# + +# +# 8.2.4 Check Permissions on rsyslog Log Files on runtime (Scored) +# Author : Samson wen, Samson +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +HARDENING_LEVEL=3 + +PACKAGE_NG='syslog-ng' + +PERMISSIONS='640' +USER='root' +GROUP='adm' + +# This function will be called if the script status is on enabled / audit mode +audit () { + is_pkg_installed $PACKAGE_NG + if [ $FNRET = 0 ]; then + ok "$PACKAGE_NG has installed, so pass." + else + does_file_exist "$SYSLOG_BASEDIR/rsyslog.conf" + if [ $FNRET != 0 ]; then + warn "$SYSLOG_BASEDIR/rsyslog.conf is not exist! " + else + FILES=$(grep -v "^#" $SYSLOG_BASEDIR/rsyslog.conf | grep "-" | awk '{print $2}' | awk -F- '{print $2}') + for FILE in $FILES; do + does_file_exist $FILE + if [ $FNRET != 0 ]; then + crit "$FILE does not exist" + else + has_file_correct_ownership $FILE $USER $GROUP + if [ $FNRET = 0 ]; then + ok "$FILE has correct ownership" + else + crit "$FILE ownership was not set to $USER:$GROUP" + fi + has_file_correct_permissions $FILE $PERMISSIONS + if [ $FNRET = 0 ]; then + ok "$FILE has correct permissions" + else + crit "$FILE permissions were not set to $PERMISSIONS" + fi + fi + done + fi + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + is_pkg_installed $PACKAGE_NG + if [ $FNRET = 0 ]; then + ok "$PACKAGE_NG has installed, so pass." + else + does_file_exist "$SYSLOG_BASEDIR/rsyslog.conf" + if [ $FNRET != 0 ]; then + warn "$SYSLOG_BASEDIR/rsyslog.conf is not exist! " + else + FILES=$(grep -v "^#" $SYSLOG_BASEDIR/rsyslog.conf | grep "-" | awk '{print $2}' | awk -F- '{print $2}') + for FILE in $FILES; do + does_file_exist $FILE + if [ $FNRET != 0 ]; then + info "$FILE does not exist, create $FILE" + extend_touch_file $FILE + fi + has_file_correct_ownership $FILE $USER $GROUP + if [ $FNRET = 0 ]; then + ok "$FILE has correct ownership" + else + warn "fixing $FILE ownership to $USER:$GROUP" + chown $USER:$GROUP $FILE + fi + has_file_correct_permissions $FILE $PERMISSIONS + if [ $FNRET = 0 ]; then + ok "$FILE has correct permissions" + else + info "fixing $FILE permissions to $PERMISSIONS" + chmod 0$PERMISSIONS $FILE + fi + done + fi + fi +} + +# This function will create the config file for this check with default values +create_config() { + cat <