diff --git a/bin/hardening/12.1_etc_passwd_permissions.sh b/bin/hardening/12.1_etc_passwd_permissions.sh index eb0651c..31f2656 100755 --- a/bin/hardening/12.1_etc_passwd_permissions.sh +++ b/bin/hardening/12.1_etc_passwd_permissions.sh @@ -6,6 +6,7 @@ # # 12.1 Verify Permissions on /etc/passwd (Scored) +# Modify by: Samson-W (sccxboy@gmail.com) # set -e # One error, it's over diff --git a/bin/hardening/12.2_etc_shadow_permissions.sh b/bin/hardening/12.2_etc_shadow_permissions.sh index 89ed2a8..90234dd 100755 --- a/bin/hardening/12.2_etc_shadow_permissions.sh +++ b/bin/hardening/12.2_etc_shadow_permissions.sh @@ -6,6 +6,7 @@ # # 12.2 Verify Permissions on /etc/shadow (Scored) +# Modify by: Samson-W (sccxboy@gmail.com) # set -e # One error, it's over @@ -15,9 +16,17 @@ HARDENING_LEVEL=1 FILE='/etc/shadow' PERMISSIONS='640' +USER='root' +GROUP='shadow' # This function will be called if the script status is on enabled / audit mode audit () { + has_file_correct_ownership $FILE $USER $GROUP + if [ $FNRET = 0 ]; then + ok "$FILE has correct ownership" + else + crit "$FILE ownership was not set to $USER:$GROUP" + fi has_file_correct_permissions $FILE $PERMISSIONS if [ $FNRET = 0 ]; then ok "$FILE has correct permissions" @@ -28,6 +37,13 @@ audit () { # This function will be called if the script status is on enabled mode apply () { + has_file_correct_ownership $FILE $USER $GROUP + if [ $FNRET = 0 ]; then + ok "$FILE has correct ownership" + else + warn "fixing $FILE ownership to $USER:$GROUP" + chown $USER:$GROUP $FILE + fi has_file_correct_permissions $FILE $PERMISSIONS if [ $FNRET = 0 ]; then ok "$FILE has correct permissions" diff --git a/bin/hardening/12.3_etc_group_permissions.sh b/bin/hardening/12.3_etc_group_permissions.sh index 299fe51..84ad436 100755 --- a/bin/hardening/12.3_etc_group_permissions.sh +++ b/bin/hardening/12.3_etc_group_permissions.sh @@ -6,6 +6,7 @@ # # 12.3 Verify Permissions on /etc/group (Scored) +# Modify by: Samson-W (sccxboy@gmail.com) # set -e # One error, it's over @@ -15,9 +16,17 @@ HARDENING_LEVEL=1 FILE='/etc/group' PERMISSIONS='644' +USER='root' +GROUP='root' # This function will be called if the script status is on enabled / audit mode audit () { + has_file_correct_ownership $FILE $USER $GROUP + if [ $FNRET = 0 ]; then + ok "$FILE has correct ownership" + else + crit "$FILE ownership was not set to $USER:$GROUP" + fi has_file_correct_permissions $FILE $PERMISSIONS if [ $FNRET = 0 ]; then ok "$FILE has correct permissions" @@ -28,6 +37,13 @@ audit () { # This function will be called if the script status is on enabled mode apply () { + has_file_correct_ownership $FILE $USER $GROUP + if [ $FNRET = 0 ]; then + ok "$FILE has correct ownership" + else + warn "fixing $FILE ownership to $USER:$GROUP" + chown $USER:$GROUP $FILE + fi has_file_correct_permissions $FILE $PERMISSIONS if [ $FNRET = 0 ]; then ok "$FILE has correct permissions" diff --git a/bin/hardening/12.4_etc_passwd_ownership.sh b/bin/hardening/12.4_etc_passwd_ownership.sh deleted file mode 100755 index 89761db..0000000 --- a/bin/hardening/12.4_etc_passwd_ownership.sh +++ /dev/null @@ -1,76 +0,0 @@ -#!/bin/bash - -# -# harbian audit 7/8/9 Hardening -# - -# -# 12.4 Verify User/Group Ownership on /etc/passwd (Scored) -# - -set -e # One error, it's over -set -u # One variable unset, it's over - -HARDENING_LEVEL=1 - -FILE='/etc/passwd' -USER='root' -GROUP='root' - -# This function will be called if the script status is on enabled / audit mode -audit () { - has_file_correct_ownership $FILE $USER $GROUP - if [ $FNRET = 0 ]; then - ok "$FILE has correct ownership" - else - crit "$FILE ownership was not set to $USER:$GROUP" - fi -} - -# This function will be called if the script status is on enabled mode -apply () { - has_file_correct_ownership $FILE $USER $GROUP - if [ $FNRET = 0 ]; then - ok "$FILE has correct ownership" - else - info "fixing $FILE ownership to $USER:$GROUP" - chown $USER:$GROUP $FILE - fi -} - -# This function will check config parameters required -check_config() { - does_user_exist $USER - if [ $FNRET != 0 ]; then - crit "$USER does not exist" - exit 128 - fi - does_group_exist $GROUP - if [ $FNRET != 0 ]; then - crit "$GROUP does not exist" - exit 128 - fi - does_file_exist $FILE - if [ $FNRET != 0 ]; then - crit "$FILE does not exist" - exit 128 - fi -} - -# Source Root Dir Parameter -if [ -r /etc/default/cis-hardening ]; then - . /etc/default/cis-hardening -fi -if [ -z "$CIS_ROOT_DIR" ]; then - echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment." - echo "Cannot source CIS_ROOT_DIR variable, aborting." - exit 128 -fi - -# Main function, will call the proper functions given the configuration (audit, enabled, disabled) -if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then - . $CIS_ROOT_DIR/lib/main.sh -else - echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_ROOT_DIR in /etc/default/cis-hardening" - exit 128 -fi diff --git a/bin/hardening/12.5_etc_shadow_ownership.sh b/bin/hardening/12.5_etc_shadow_ownership.sh deleted file mode 100755 index 6a6ed5a..0000000 --- a/bin/hardening/12.5_etc_shadow_ownership.sh +++ /dev/null @@ -1,76 +0,0 @@ -#!/bin/bash - -# -# harbian audit 7/8/9 Hardening -# - -# -# 12.5 Verify User/Group Ownership on /etc/shadow (Scored) -# - -set -e # One error, it's over -set -u # One variable unset, it's over - -HARDENING_LEVEL=1 - -FILE='/etc/shadow' -USER='root' -GROUP='shadow' - -# This function will be called if the script status is on enabled / audit mode -audit () { - has_file_correct_ownership $FILE $USER $GROUP - if [ $FNRET = 0 ]; then - ok "$FILE has correct ownership" - else - crit "$FILE ownership was not set to $USER:$GROUP" - fi -} - -# This function will be called if the script status is on enabled mode -apply () { - has_file_correct_ownership $FILE $USER $GROUP - if [ $FNRET = 0 ]; then - ok "$FILE has correct ownership" - else - info "fixing $FILE ownership to $USER:$GROUP" - chown $USER:$GROUP $FILE - fi -} - -# This function will check config parameters required -check_config() { - does_user_exist $USER - if [ $FNRET != 0 ]; then - crit "$USER does not exist" - exit 128 - fi - does_group_exist $GROUP - if [ $FNRET != 0 ]; then - crit "$GROUP does not exist" - exit 128 - fi - does_file_exist $FILE - if [ $FNRET != 0 ]; then - crit "$FILE does not exist" - exit 128 - fi -} - -# Source Root Dir Parameter -if [ -r /etc/default/cis-hardening ]; then - . /etc/default/cis-hardening -fi -if [ -z "$CIS_ROOT_DIR" ]; then - echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment." - echo "Cannot source CIS_ROOT_DIR variable, aborting." - exit 128 -fi - -# Main function, will call the proper functions given the configuration (audit, enabled, disabled) -if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then - . $CIS_ROOT_DIR/lib/main.sh -else - echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_ROOT_DIR in /etc/default/cis-hardening" - exit 128 -fi diff --git a/bin/hardening/12.6_etc_group_ownership.sh b/bin/hardening/12.6_etc_group_ownership.sh deleted file mode 100755 index 4885869..0000000 --- a/bin/hardening/12.6_etc_group_ownership.sh +++ /dev/null @@ -1,76 +0,0 @@ -#!/bin/bash - -# -# harbian audit 7/8/9 Hardening -# - -# -# 12.6 Verify User/Group Ownership on /etc/group (Scored) -# - -set -e # One error, it's over -set -u # One variable unset, it's over - -HARDENING_LEVEL=1 - -FILE='/etc/group' -USER='root' -GROUP='root' - -# This function will be called if the script status is on enabled / audit mode -audit () { - has_file_correct_ownership $FILE $USER $GROUP - if [ $FNRET = 0 ]; then - ok "$FILE has correct ownership" - else - crit "$FILE ownership was not set to $USER:$GROUP" - fi -} - -# This function will be called if the script status is on enabled mode -apply () { - has_file_correct_ownership $FILE $USER $GROUP - if [ $FNRET = 0 ]; then - ok "$FILE has correct ownership" - else - info "fixing $FILE ownership to $USER:$GROUP" - chown $USER:$GROUP $FILE - fi -} - -# This function will check config parameters required -check_config() { - does_user_exist $USER - if [ $FNRET != 0 ]; then - crit "$USER does not exist" - exit 128 - fi - does_group_exist $GROUP - if [ $FNRET != 0 ]; then - crit "$GROUP does not exist" - exit 128 - fi - does_file_exist $FILE - if [ $FNRET != 0 ]; then - crit "$FILE does not exist" - exit 128 - fi -} - -# Source Root Dir Parameter -if [ -r /etc/default/cis-hardening ]; then - . /etc/default/cis-hardening -fi -if [ -z "$CIS_ROOT_DIR" ]; then - echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment." - echo "Cannot source CIS_ROOT_DIR variable, aborting." - exit 128 -fi - -# Main function, will call the proper functions given the configuration (audit, enabled, disabled) -if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then - . $CIS_ROOT_DIR/lib/main.sh -else - echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_ROOT_DIR in /etc/default/cis-hardening" - exit 128 -fi