tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix some bugs for 7.7.5

This commit is contained in:
Samson-W 2019-04-09 16:31:57 +08:00
parent 582476f7e8
commit 86ca90d417
2 changed files with 98 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

84
bin/hardening/7.7.5_ensure_loopback_traffic_is_configured.sh
View File

@ -21,67 +21,53 @@ IPS6=$(which ip6tables)
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
# Check the loopback interface to accept INPUT traffic. # Check the loopback interface to accept INPUT traffic.
if [ $(${IPS4} -S | grep -c "^\-A INPUT \-i lo \-j ACCEPT") -ge 1 -o $(${IPS4} -S | grep -c "^\-A INPUT \-i 127.0.0.1 \-j ACCEPT") -ge 1 ]; then ensure_lo_traffic_input_is_accept()
ok "Ip4tables loopback traffic INPUT has configured!" if [ $FNRET = 0 ]; then
FNRET=0 INPUT_ACCEPT=0
ok "Iptables loopback traffic INPUT has configured!"
else else
crit "Ip4tables: loopback traffic INPUT is not configured!" INPUT_ACCEPT=1
if [ $(${IPS6} -S | grep -c "^\-A INPUT \-i lo \-j ACCEPT") -ge 1 -o $(${IPS6} -S | grep -c "^\-A INPUT \-i ::/0 \-j ACCEPT") -ge 1 ]; then crit "Iptables: loopback traffic INPUT is not configured!"
ok "Ip6tables loopback traffic INPUT has configured!" fi
FNRET=0
else
crit "Ip6tables: loopback traffic INPUT is not configured!"
FNRET=1
fi
fi
# Check the loopback interface to accept OUTPUT traffic. # Check the loopback interface to accept OUTPUT traffic.
if [ $(${IPS4} -S | grep -c "^\-A OUTPUT \-o lo \-j ACCEPT") -ge 1 -o $(${IPS4} -S | grep -c "^\-A OUTPUT \-o 127.0.0.1 \-j ACCEPT") -ge 1 ]; then ensure_lo_traffic_output_is_accept()
ok "Ip4tables loopback traffic OUTPUT has configured!" if [ $FNRET = 0 ]; then
FNRET=0 OUTPUT_ACCEPT=0
ok "Iptables loopback traffic OUTPUT has configured!"
else else
crit "Ip4tables: loopback traffic OUTPUT is not configured!" OUTPUT_ACCEPT=1
if [ $(${IPS6} -S | grep -c "^\-A OUTPUT \-o lo \-j ACCEPT") -ge 1 -o $(${IPS6} -S | grep -c "^\-A OUTPUT \-o ::/0 \-j ACCEPT") -ge 1 ]; then crit "Iptables: loopback traffic OUTPUT is not configured!"
ok "Ip6tables loopback traffic OUTPUT has configured!" fi
FNRET=0
else
crit "Ip6tables: loopback traffic OUTPUT is not configured!"
FNRET=2
fi
fi
# all other interfaces to deny traffic to the loopback network. # all other interfaces to deny traffic to the loopback network.
if [ $(${IPS4} -S | grep -c "^\-A INPUT \-s 127.0.0.0/8 \-j ACCEPT") -ge 1 ]; then ensure_lo_traffic_other_if_input_is_deny()
crit "Ip4tables: loopback traffic INPUT deny from 127.0.0.0/8 is not configured!" if [ $FNRET = 0 ]; then
if [ $(${IPS6} -S | grep -c "^\-A INPUT \-s ::1 \-j ACCEPT") -ge 1 ]; then INPUT_DENY=0
crit "Ip6tables: loopback traffic INPUT deny from ::1 is not configured!" ok "Iptables loopback traffic INPUT deny from other interfaces has configured!"
FNRET=3
else
ok "Ip6tables loopback traffic INPUT deny from ::1 has configured!"
FNRET=0
fi
else else
ok "Ip4tables loopback traffic INPUT deny from 127.0.0.0/8 has configured!" INPUT_DENY=1
FNRET=0 crit "Iptables: loopback traffic INPUT deny from other interfaces is not configured!"
fi fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
case $FNRET in if [ $INPUT_ACCEPT = 0 ]; then
0) ok "Iptables loopback traffic INPUT has configured!"
ok "Iptables/Ip6tables loopback traffic has configured!" else
;;
1)
warn "Iptables/Ip6tables loopback traffic INPUT is not configured! need the administrator to manually add it. Howto set: iptables/ip6tables -A INPUT -i lo -j ACCEPT" warn "Iptables/Ip6tables loopback traffic INPUT is not configured! need the administrator to manually add it. Howto set: iptables/ip6tables -A INPUT -i lo -j ACCEPT"
;; fi
2)
if [ $OUTPUT_ACCEPT = 0 ]; then
ok "Iptables loopback traffic OUTPUT has configured!"
else
warn "Iptables/Ip6tables loopback traffic OUTPUT is not configured! need the administrator to manually add it. Howto set: iptables/ip6tables -A OUTPUT -o lo -j ACCEPT" warn "Iptables/Ip6tables loopback traffic OUTPUT is not configured! need the administrator to manually add it. Howto set: iptables/ip6tables -A OUTPUT -o lo -j ACCEPT"
;; fi
3)
if [ $INPUT_DENY = 0 ]; then
ok "Iptables loopback traffic INPUT deny from other interfaces has configured!"
else
warn "Iptables/Ip6tables loopback traffic INPUT deny from 127.0.0.0/8 is not configured! need the administrator to manually add it. Howto set: iptables/ip6tables -A INPUT -s 127.0.0.0/8 -j DROP" warn "Iptables/Ip6tables loopback traffic INPUT deny from 127.0.0.0/8 is not configured! need the administrator to manually add it. Howto set: iptables/ip6tables -A INPUT -s 127.0.0.0/8 -j DROP"
;; fi
esac
} }
# This function will check config parameters required # This function will check config parameters required

63
lib/utils.sh
View File

@ -691,3 +691,66 @@ check_auth_option_nullok_by_pam()
fi fi
} }
# Ensure is set accept for INPUT of loopback traffic
ensure_lo_traffic_input_is_accept()
{
IPS4=$(which iptables)
IPS6=$(which ip6tables)
# Check the loopback interface to accept INPUT traffic.
if [ $(${IPS4} -S | grep -c "^\-A INPUT \-i lo \-j ACCEPT") -ge 1 -o $(${IPS4} -S | grep -c "^\-A INPUT \-i 127.0.0.1 \-j ACCEPT") -ge 1 ]; then
ok "Ip4tables loopback traffic INPUT has configured!"
FNRET=0
else
crit "Ip4tables: loopback traffic INPUT is not configured!"
if [ $(${IPS6} -S | grep -c "^\-A INPUT \-i lo \-j ACCEPT") -ge 1 -o $(${IPS6} -S | grep -c "^\-A INPUT \-i ::/0 \-j ACCEPT") -ge 1 ]; then
ok "Ip6tables loopback traffic INPUT has configured!"
FNRET=0
else
crit "Ip6tables: loopback traffic INPUT is not configured!"
FNRET=1
fi
fi
}
# Ensure is set accept for OUTPUT of loopback traffic
ensure_lo_traffic_output_is_accept()
{
IPS4=$(which iptables)
IPS6=$(which ip6tables)
# Check the loopback interface to accept OUTPUT traffic.
if [ $(${IPS4} -S | grep -c "^\-A OUTPUT \-o lo \-j ACCEPT") -ge 1 -o $(${IPS4} -S | grep -c "^\-A OUTPUT \-o 127.0.0.1 \-j ACCEPT") -ge 1 ]; then
ok "Ip4tables loopback traffic OUTPUT has configured!"
FNRET=0
else
crit "Ip4tables: loopback traffic OUTPUT is not configured!"
if [ $(${IPS6} -S | grep -c "^\-A OUTPUT \-o lo \-j ACCEPT") -ge 1 -o $(${IPS6} -S | grep -c "^\-A OUTPUT \-o ::/0 \-j ACCEPT") -ge 1 ]; then
ok "Ip6tables loopback traffic OUTPUT has configured!"
FNRET=0
else
crit "Ip6tables: loopback traffic OUTPUT is not configured!"
FNRET=1
fi
fi
}
# Ensure is set deny for other interfaces INPUT of loopback traffic
ensure_lo_traffic_other_if_input_is_deny()
{
IPS4=$(which iptables)
IPS6=$(which ip6tables)
# all other interfaces to deny traffic to the loopback network.
if [ $(${IPS4} -S | grep -c "^\-A INPUT \-s 127.0.0.0/8 \-j DROP") -eq 0 ]; then
crit "Ip4tables: loopback traffic INPUT deny from 127.0.0.0/8 is not configured!"
if [ $(${IPS6} -S | grep -c "^\-A INPUT \-s ::1 \-j DROP") -ge 0 ]; then
crit "Ip6tables: loopback traffic INPUT deny from ::1 is not configured!"
FNRET=1
else
ok "Ip6tables loopback traffic INPUT deny from ::1 has configured!"
FNRET=0
fi
else
ok "Ip4tables loopback traffic INPUT deny from 127.0.0.0/8 has configured!"
FNRET=0
fi
}