tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-04-08 17:06:34 +02:00
Code Issues Packages Projects Releases Wiki Activity

Modify for lib and 8.1.2

Browse Source
This commit is contained in:
Samson-W 2019-04-14 05:56:05 -04:00
parent e2313bd1ff
commit 822159dce1
2 changed files with 40 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
bin/hardening/8.1.2_enable_auditd.sh
View File

@ -34,21 +34,26 @@ audit () {
# This function will be called if the script status is on enabled mode
apply () {
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then
ok "$PACKAGE is installed"
else
warn "$PACKAGE is absent, installing it"
apt_install $PACKAGE
fi
is_service_enabled $SERVICE_NAME
if [ $FNRET = 0 ]; then
ok "$SERVICE_NAME is enabled"
else
warn "$SERVICE_NAME is not enabled, enabling it"
update-rc.d $SERVICE_NAME remove > /dev/null 2>&1
update-rc.d $SERVICE_NAME defaults > /dev/null 2>&1
fi
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then
ok "$PACKAGE is installed"
else
warn "$PACKAGE is absent, installing it"
apt_install $PACKAGE
fi
is_service_enabled $SERVICE_NAME
if [ $FNRET = 0 ]; then
ok "$SERVICE_NAME is enabled"
else
warn "$SERVICE_NAME is not enabled, enabling it"
is_debian_9
if [ $FNRET = 0 ]; then
systemctl enable auditd
else
update-rc.d $SERVICE_NAME remove > /dev/null 2>&1
update-rc.d $SERVICE_NAME defaults > /dev/null 2>&1
fi
fi
}
# This function will check config parameters required

40
lib/utils.sh
View File

@ -708,15 +708,15 @@ ensure_lo_traffic_input_is_accept()
IPS6=$(which ip6tables)
# Check the loopback interface to accept INPUT traffic.
if [ $(${IPS4} -S | grep -c "^\-A INPUT \-i lo \-j ACCEPT") -ge 1 -o $(${IPS4} -S | grep -c "^\-A INPUT \-i 127.0.0.1 \-j ACCEPT") -ge 1 ]; then
ok "Ip4tables loopback traffic INPUT has configured!"
debug "Ip4tables loopback traffic INPUT has configured!"
FNRET=0
else
crit "Ip4tables: loopback traffic INPUT is not configured!"
debug "Ip4tables: loopback traffic INPUT is not configured!"
if [ $(${IPS6} -S | grep -c "^\-A INPUT \-i lo \-j ACCEPT") -ge 1 -o $(${IPS6} -S | grep -c "^\-A INPUT \-i ::/0 \-j ACCEPT") -ge 1 ]; then
ok "Ip6tables loopback traffic INPUT has configured!"
debug "Ip6tables loopback traffic INPUT has configured!"
FNRET=0
else
crit "Ip6tables: loopback traffic INPUT is not configured!"
debug "Ip6tables: loopback traffic INPUT is not configured!"
FNRET=1
fi
fi
@ -729,15 +729,15 @@ ensure_lo_traffic_output_is_accept()
IPS6=$(which ip6tables)
# Check the loopback interface to accept OUTPUT traffic.
if [ $(${IPS4} -S | grep -c "^\-A OUTPUT \-o lo \-j ACCEPT") -ge 1 -o $(${IPS4} -S | grep -c "^\-A OUTPUT \-o 127.0.0.1 \-j ACCEPT") -ge 1 ]; then
ok "Ip4tables loopback traffic OUTPUT has configured!"
debug "Ip4tables loopback traffic OUTPUT has configured!"
FNRET=0
else
crit "Ip4tables: loopback traffic OUTPUT is not configured!"
debug "Ip4tables: loopback traffic OUTPUT is not configured!"
if [ $(${IPS6} -S | grep -c "^\-A OUTPUT \-o lo \-j ACCEPT") -ge 1 -o $(${IPS6} -S | grep -c "^\-A OUTPUT \-o ::/0 \-j ACCEPT") -ge 1 ]; then
ok "Ip6tables loopback traffic OUTPUT has configured!"
debug "Ip6tables loopback traffic OUTPUT has configured!"
FNRET=0
else
crit "Ip6tables: loopback traffic OUTPUT is not configured!"
debug "Ip6tables: loopback traffic OUTPUT is not configured!"
FNRET=1
fi
fi
@ -750,16 +750,16 @@ ensure_lo_traffic_other_if_input_is_deny()
IPS6=$(which ip6tables)
# all other interfaces to deny traffic to the loopback network.
if [ $(${IPS4} -S | grep -c "^\-A INPUT \-s 127.0.0.0/8 \-j DROP") -eq 0 ]; then
crit "Ip4tables: loopback traffic INPUT deny from 127.0.0.0/8 is not configured!"
debug "Ip4tables: loopback traffic INPUT deny from 127.0.0.0/8 is not configured!"
if [ $(${IPS6} -S | grep -c "^\-A INPUT \-s ::1 \-j DROP") -ge 0 ]; then
crit "Ip6tables: loopback traffic INPUT deny from ::1 is not configured!"
debug "Ip6tables: loopback traffic INPUT deny from ::1 is not configured!"
FNRET=1
else
ok "Ip6tables loopback traffic INPUT deny from ::1 has configured!"
debug "Ip6tables loopback traffic INPUT deny from ::1 has configured!"
FNRET=0
fi
else
ok "Ip4tables loopback traffic INPUT deny from 127.0.0.0/8 has configured!"
debug "Ip4tables loopback traffic INPUT deny from 127.0.0.0/8 has configured!"
FNRET=0
fi
}
@ -773,16 +773,16 @@ check_outbound_connect_is_accept()
# $1 maybe is: tcp udp icmp
proto=$1
if [ $(${IPS4} -S | grep "^\-A OUTPUT" | grep "\-p ${proto}" | grep -c "$PATTERN") -eq 0 ]; then
crit "Iptables: Protocol $proto outbound is not configured!"
debug "Iptables: Protocol $proto outbound is not configured!"
if [ $(${IPS6} -S | grep "^\-A OUTPUT" | grep "\-p ${proto}" | grep -c "$PATTERN") -eq 0 ]; then
crit "Ip6tables: Protocol $proto outbound is not configured!"
debug "Ip6tables: Protocol $proto outbound is not configured!"
FNRET=1
else
ok "Ip6tables: Protocol $proto outbound is configured!"
debug "Ip6tables: Protocol $proto outbound is configured!"
FNRET=0
fi
else
ok "Iptables: Protocol $proto outbound is configured!"
debug "Iptables: Protocol $proto outbound is configured!"
FNRET=0
fi
}
@ -796,16 +796,16 @@ check_input_with_established_is_accept()
# $1 maybe is: tcp udp icmp
proto=$1
if [ $(${IPS4} -S | grep "^\-A INPUT" | grep "\-p ${proto}" | grep -c "$PATTERN") -eq 0 ]; then
crit "Iptables: Protocol $proto INPUT is not configured!"
debug "Iptables: Protocol $proto INPUT is not configured!"
if [ $(${IPS6} -S | grep "^\-A INPUT" | grep "\-p ${proto}" | grep -c "$PATTERN") -eq 0 ]; then
crit "Ip6tables: Protocol $proto INPUT is not configured!"
debug "Ip6tables: Protocol $proto INPUT is not configured!"
FNRET=1
else
ok "Ip6tables: Protocol $proto INPUT is configured!"
debug "Ip6tables: Protocol $proto INPUT is configured!"
FNRET=0
fi
else
ok "Iptables: Protocol $proto INPUT is configured!"
debug "Iptables: Protocol $proto INPUT is configured!"
FNRET=0
fi
}