Add audit and apply methods for 2.27~2.29
This commit is contained in:
Samson-W
parent
f44528cddb
commit
739766c93f
|
|
@ -5,9 +5,9 @@
|
|||
#
|
||||
|
||||
#
|
||||
# 2.27 Set nosuid option for nfs filesystem/Partition (Scored)
|
||||
# 2.27 Set nosuid option for nfs/nfs4 filesystem/Partition (Scored)
|
||||
# Authors : Samson wen, Samson <sccxboy@gmail.com>
|
||||
# todo: Multiple cases
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
set -u # One variable unset, it's over
|
||||
|
|
@ -17,6 +17,7 @@ HARDENING_LEVEL=2
|
|||
# Quick factoring as many script use the same logic
|
||||
PARTITION_TYPE="nfs"
|
||||
OPTION="nosuid"
|
||||
FSTAB='/etc/fstab'
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit () {
|
||||
|
|
@ -52,9 +53,12 @@ apply () {
|
|||
no_entity " There is no mount directory with file system type $PARTITION_TYPE"
|
||||
elif [ $FNRET = 1 ]; then
|
||||
info "Adding $OPTION to fstab"
|
||||
add_option_to_fstab $PARTITION_TYPE $OPTION
|
||||
info "Remounting $PARTITION_TYPE from fstab"
|
||||
remount_partition $PARTITION_TYPE
|
||||
for PARTITION in $(grep $PARTITION_TYPE $FSTAB | grep -v $OPTION | awk '{print $2}')
|
||||
do
|
||||
add_option_to_fstab $PARTITION $OPTION
|
||||
info "Remounting $PARTITION from fstab"
|
||||
remount_partition $PARTITION
|
||||
done
|
||||
elif [ $FNRET = 3 ]; then
|
||||
info "Remounting $PARTITION_TYPE from fstab"
|
||||
remount_partition $PARTITION_TYPE
|
||||
|
|
|
|||
|
|
@ -0,0 +1,90 @@
|
|||
#!/bin/bash
|
||||
|
||||
#
|
||||
# harbian audit 9 Hardening
|
||||
#
|
||||
|
||||
#
|
||||
# 2.28 Set noexec option for nfs/nfs4 filesystem/Partition (Scored)
|
||||
# Authors : Samson wen, Samson <sccxboy@gmail.com>
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
set -u # One variable unset, it's over
|
||||
|
||||
HARDENING_LEVEL=2
|
||||
|
||||
# Quick factoring as many script use the same logic
|
||||
PARTITION_TYPE="nfs"
|
||||
OPTION="noexec"
|
||||
FSTAB='/etc/fstab'
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit () {
|
||||
info "Verifying that $PARTITION_TYPE is a filesystem/partition"
|
||||
is_mounted "$PARTITION_TYPE"
|
||||
if [ $FNRET -gt 0 ]; then
|
||||
no_entity " There is no mount directory with file system type $PARTITION_TYPE"
|
||||
FNRET=2
|
||||
else
|
||||
ok "$PARTITION_TYPE is a partition"
|
||||
has_mount_option $PARTITION_TYPE $OPTION
|
||||
if [ $FNRET -gt 0 ]; then
|
||||
crit "$PARTITION_TYPE has no option $OPTION in fstab!"
|
||||
FNRET=1
|
||||
else
|
||||
ok "$PARTITION_TYPE has $OPTION in fstab"
|
||||
has_mounted_option $PARTITION_TYPE $OPTION
|
||||
if [ $FNRET -gt 0 ]; then
|
||||
warn "$PARTITION_TYPE is not mounted with $OPTION at runtime"
|
||||
FNRET=3
|
||||
else
|
||||
ok "$PARTITION_TYPE mounted with $OPTION"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# This function will be called if the script status is on enabled mode
|
||||
apply () {
|
||||
if [ $FNRET = 0 ]; then
|
||||
ok "$PARTITION_TYPE is correctly set"
|
||||
elif [ $FNRET = 2 ]; then
|
||||
no_entity " There is no mount directory with file system type $PARTITION_TYPE"
|
||||
elif [ $FNRET = 1 ]; then
|
||||
info "Adding $OPTION to fstab"
|
||||
for PARTITION in $(grep $PARTITION_TYPE $FSTAB | grep -v $OPTION | awk '{print $2}')
|
||||
do
|
||||
add_option_to_fstab $PARTITION $OPTION
|
||||
info "Remounting $PARTITION from fstab"
|
||||
remount_partition $PARTITION
|
||||
done
|
||||
elif [ $FNRET = 3 ]; then
|
||||
info "Remounting $PARTITION_TYPE from fstab"
|
||||
remount_partition $PARTITION_TYPE
|
||||
fi
|
||||
}
|
||||
|
||||
# This function will check config parameters required
|
||||
check_config() {
|
||||
# No param for this script
|
||||
:
|
||||
}
|
||||
|
||||
# Source Root Dir Parameter
|
||||
if [ -r /etc/default/cis-hardening ]; then
|
||||
. /etc/default/cis-hardening
|
||||
fi
|
||||
if [ -z "$CIS_ROOT_DIR" ]; then
|
||||
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
|
||||
echo "Cannot source CIS_ROOT_DIR variable, aborting."
|
||||
exit 128
|
||||
fi
|
||||
|
||||
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
|
||||
if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then
|
||||
. $CIS_ROOT_DIR/lib/main.sh
|
||||
else
|
||||
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_ROOT_DIR in /etc/default/cis-hardening"
|
||||
exit 128
|
||||
fi
|
||||
|
|
@ -0,0 +1,90 @@
|
|||
#!/bin/bash
|
||||
|
||||
#
|
||||
# harbian audit 9 Hardening
|
||||
#
|
||||
|
||||
#
|
||||
# 2.29 Set RPCSEC_GSS option for nfs/nfs4 filesystem/Partition (Scored)
|
||||
# Authors : Samson wen, Samson <sccxboy@gmail.com>
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
set -u # One variable unset, it's over
|
||||
|
||||
HARDENING_LEVEL=2
|
||||
|
||||
# Quick factoring as many script use the same logic
|
||||
PARTITION_TYPE="nfs"
|
||||
OPTION="sec=krb5:krb5i:krb5p"
|
||||
FSTAB='/etc/fstab'
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit () {
|
||||
info "Verifying that $PARTITION_TYPE is a filesystem/partition"
|
||||
is_mounted "$PARTITION_TYPE"
|
||||
if [ $FNRET -gt 0 ]; then
|
||||
no_entity " There is no mount directory with file system type $PARTITION_TYPE"
|
||||
FNRET=2
|
||||
else
|
||||
ok "$PARTITION_TYPE is a partition"
|
||||
has_mount_option $PARTITION_TYPE $OPTION
|
||||
if [ $FNRET -gt 0 ]; then
|
||||
crit "$PARTITION_TYPE has no option $OPTION in fstab!"
|
||||
FNRET=1
|
||||
else
|
||||
ok "$PARTITION_TYPE has $OPTION in fstab"
|
||||
has_mounted_option $PARTITION_TYPE $OPTION
|
||||
if [ $FNRET -gt 0 ]; then
|
||||
warn "$PARTITION_TYPE is not mounted with $OPTION at runtime"
|
||||
FNRET=3
|
||||
else
|
||||
ok "$PARTITION_TYPE mounted with $OPTION"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# This function will be called if the script status is on enabled mode
|
||||
apply () {
|
||||
if [ $FNRET = 0 ]; then
|
||||
ok "$PARTITION_TYPE is correctly set"
|
||||
elif [ $FNRET = 2 ]; then
|
||||
no_entity " There is no mount directory with file system type $PARTITION_TYPE"
|
||||
elif [ $FNRET = 1 ]; then
|
||||
info "Adding $OPTION to fstab"
|
||||
for PARTITION in $(grep $PARTITION_TYPE $FSTAB | grep -v $OPTION | awk '{print $2}')
|
||||
do
|
||||
add_option_to_fstab $PARTITION $OPTION
|
||||
info "Remounting $PARTITION from fstab"
|
||||
remount_partition $PARTITION
|
||||
done
|
||||
elif [ $FNRET = 3 ]; then
|
||||
info "Remounting $PARTITION_TYPE from fstab"
|
||||
remount_partition $PARTITION_TYPE
|
||||
fi
|
||||
}
|
||||
|
||||
# This function will check config parameters required
|
||||
check_config() {
|
||||
# No param for this script
|
||||
:
|
||||
}
|
||||
|
||||
# Source Root Dir Parameter
|
||||
if [ -r /etc/default/cis-hardening ]; then
|
||||
. /etc/default/cis-hardening
|
||||
fi
|
||||
if [ -z "$CIS_ROOT_DIR" ]; then
|
||||
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
|
||||
echo "Cannot source CIS_ROOT_DIR variable, aborting."
|
||||
exit 128
|
||||
fi
|
||||
|
||||
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
|
||||
if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then
|
||||
. $CIS_ROOT_DIR/lib/main.sh
|
||||
else
|
||||
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_ROOT_DIR in /etc/default/cis-hardening"
|
||||
exit 128
|
||||
fi
|
||||
Loading…
Reference in New Issue