tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update how_to_creating_and_making_an_AMI_public.mkd and remove duplicate check for /var/log/sudo.log

This commit is contained in:
Samson-W 2019-09-04 02:03:53 +08:00
parent 07a363f1cb
commit c31073eb1e
2 changed files with 6 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
bin/hardening/8.1.16_record_sudo_usage.sh
View File

@ -14,7 +14,6 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=4
SUDOLOG='/var/log/sudo.log'
AUDIT_VALUE='-w /var/log/sudo.log -p wa -k sudoaction'
FILE='/etc/audit/rules.d/audit.rules'
@ -23,18 +22,12 @@ audit () {
# define custom IFS and save default one
d_IFS=$IFS
IFS=$'\n'
if [ -f $SUDOLOG ]; then
debug "$AUDIT_VALUE should be in file $FILE"
does_pattern_exist_in_file $FILE "$AUDIT_VALUE"
if [ $FNRET != 0 ]; then
crit "$AUDIT_VALUE is not in file $FILE"
FNRET=2
else
ok "$AUDIT_VALUE is present in $FILE"
fi
else
crit "file $SUDOLOG is not exist!"
does_pattern_exist_in_file $FILE "$AUDIT_VALUE"
if [ $FNRET != 0 ]; then
crit "$AUDIT_VALUE is not in file $FILE"
FNRET=1
else
ok "$AUDIT_VALUE is present in $FILE"
fi
IFS=$d_IFS
}
@ -45,15 +38,6 @@ apply () {
d_IFS=$IFS
IFS=$'\n'
if [ $FNRET = 1 ]; then
warn "file $SUDOLOG is not exist! Set default logfile path in /etc/sudoers."
sed -i '$aDefaults logfile="/var/log/sudo.log"' /etc/sudoers
does_pattern_exist_in_file $FILE "$AUDIT_VALUE"
if [ $FNRET != 0 ]; then
warn "$AUDIT_VALUE is not in file $FILE, adding it"
add_end_of_file $FILE $AUDIT_VALUE
check_auditd_is_immutable_mode
fi
elif [ $FNRET = 2 ]; then
warn "$AUDIT_VALUE is not in file $FILE, adding it"
add_end_of_file $FILE $AUDIT_VALUE
check_auditd_is_immutable_mode

2
docs/complianced_image/AMI/how_to_creating_and_making_an_AMI_public.mkd
View File

@ -59,7 +59,7 @@ admin@ip:/opt/harbian-audit-master$ sudo reboot
```
After reboot:
```
admin@ip:/opt/harbian-audit-master$ sudo bash ./docs/configurations/etc.iptables.rules.v4.sh
admin@ip:/opt/harbian-audit-master$ sudo bash /opt/harbian-audit-master/docs/configurations/etc.iptables.rules.v4.sh
admin@ip:/opt/harbian-audit-master$ sudo -s
admin@ip:/opt/harbian-audit-master# iptables-save > /etc/iptables/rules.v4
admin@ip:/opt/harbian-audit-master# ip6tables-save > /etc/iptables/rules.v6