tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix some bugs.

This commit is contained in:
Samson-W 2019-05-21 11:43:16 +08:00
parent 7305b2c770
commit cfd14ce818
7 changed files with 101 additions and 76 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bin/hardening/10.1.8_set_fail_delay_seconds.sh
View File

@ -40,7 +40,7 @@ audit () {
if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL"
else
crit "$OPTIONNAME set condition is not $CONDT_VAL"
crit "$OPTIONNAME set condition is not equal or greater than $CONDT_VAL"
fi
else
crit "$PATTERN is not present in $FILE"

2
bin/hardening/12.12_etc_group_backup_permissions.sh
View File

@ -15,7 +15,7 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=1
FILE='/etc/group-'
PERMISSIONS='644'
PERMISSIONS='600'
USER='root'
GROUP='root'

2
bin/hardening/12.13_etc_gshadow_backup_permissions.sh
View File

@ -15,7 +15,7 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=1
FILE='/etc/gshadow-'
PERMISSIONS='640'
PERMISSIONS='600'
USER='root'
GROUP='shadow'

2
bin/hardening/12.5_etc_passwd_backup_permissions.sh
View File

@ -15,7 +15,7 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=1
FILE='/etc/passwd-'
PERMISSIONS='644'
PERMISSIONS='600'
USER='root'
GROUP='root'

2
bin/hardening/12.6_etc_shadow_backup_permissions.sh
View File

@ -15,7 +15,7 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=1
FILE='/etc/shadow-'
PERMISSIONS='640'
PERMISSIONS='600'
USER='root'
GROUP='shadow'

111
bin/hardening/8.3.4_set_logfile_perm.sh
View File

@ -16,65 +16,78 @@ HARDENING_LEVEL=3
PERMISSIONS='640'
USER='root'
GROUP='adm'
SERVICE_NAME_R="rsyslog"
# This function will be called if the script status is on enabled / audit mode
audit () {
does_file_exist "$SYSLOG_BASEDIR/syslog-ng.conf"
if [ $FNRET != 0 ]; then
warn "$SYSLOG_BASEDIR/syslog-ng.conf is not exist! "
FNRET=1
is_pkg_installed $SERVICE_NAME_R
if [ $FNRET = 0 ]; then
ok "$SERVICE_NAME_R has installed, so pass."
FNRET=0
else
FILES=$(grep "file(" $SYSLOG_BASEDIR/syslog-ng.conf | grep '"' | cut -d'"' -f 2)
for FILE in $FILES; do
does_file_exist $FILE
if [ $FNRET != 0 ]; then
crit "$FILE does not exist"
else
has_file_correct_ownership $FILE $USER $GROUP
if [ $FNRET = 0 ]; then
ok "$FILE has correct ownership"
else
crit "$FILE ownership was not set to $USER:$GROUP"
fi
has_file_correct_permissions $FILE $PERMISSIONS
if [ $FNRET = 0 ]; then
ok "$FILE has correct permissions"
else
crit "$FILE permissions were not set to $PERMISSIONS"
fi
fi
done
does_file_exist "$SYSLOG_BASEDIR/syslog-ng.conf"
if [ $FNRET != 0 ]; then
warn "$SYSLOG_BASEDIR/syslog-ng.conf is not exist! "
FNRET=1
else
FILES=$(grep "file(" $SYSLOG_BASEDIR/syslog-ng.conf | grep '"' | cut -d'"' -f 2)
for FILE in $FILES; do
does_file_exist $FILE
if [ $FNRET != 0 ]; then
crit "$FILE does not exist"
else
has_file_correct_ownership $FILE $USER $GROUP
if [ $FNRET = 0 ]; then
ok "$FILE has correct ownership"
else
crit "$FILE ownership was not set to $USER:$GROUP"
fi
has_file_correct_permissions $FILE $PERMISSIONS
if [ $FNRET = 0 ]; then
ok "$FILE has correct permissions"
else
crit "$FILE permissions were not set to $PERMISSIONS"
fi
fi
done
fi
fi
}
# This function will be called if the script status is on enabled mode
apply () {
does_file_exist "$SYSLOG_BASEDIR/syslog-ng.conf"
if [ $FNRET != 0 ]; then
warn "$SYSLOG_BASEDIR/syslog-ng.conf is not exist! "
is_pkg_installed $SERVICE_NAME_R
if [ $FNRET = 0 ]; then
ok "$SERVICE_NAME_R has installed, so pass."
FNRET=0
else
FILES=$(grep "file(" $SYSLOG_BASEDIR/syslog-ng.conf | grep '"' | cut -d'"' -f 2)
for FILE in $FILES; do
does_file_exist $FILE
if [ $FNRET != 0 ]; then
info "$FILE does not exist, create $FILE"
extend_touch_file $FILE
fi
has_file_correct_ownership $FILE $USER $GROUP
if [ $FNRET = 0 ]; then
ok "$FILE has correct ownership"
else
warn "fixing $FILE ownership to $USER:$GROUP"
chown $USER:$GROUP $FILE
fi
has_file_correct_permissions $FILE $PERMISSIONS
if [ $FNRET = 0 ]; then
ok "$FILE has correct permissions"
else
info "fixing $FILE permissions to $PERMISSIONS"
chmod 0$PERMISSIONS $FILE
fi
done
does_file_exist "$SYSLOG_BASEDIR/syslog-ng.conf"
if [ $FNRET != 0 ]; then
warn "$SYSLOG_BASEDIR/syslog-ng.conf is not exist! "
else
FILES=$(grep "file(" $SYSLOG_BASEDIR/syslog-ng.conf | grep '"' | cut -d'"' -f 2)
for FILE in $FILES; do
does_file_exist $FILE
if [ $FNRET != 0 ]; then
info "$FILE does not exist, create $FILE"
extend_touch_file $FILE
fi
has_file_correct_ownership $FILE $USER $GROUP
if [ $FNRET = 0 ]; then
ok "$FILE has correct ownership"
else
warn "fixing $FILE ownership to $USER:$GROUP"
chown $USER:$GROUP $FILE
fi
has_file_correct_permissions $FILE $PERMISSIONS
if [ $FNRET = 0 ]; then
ok "$FILE has correct permissions"
else
info "fixing $FILE permissions to $PERMISSIONS"
chmod 0$PERMISSIONS $FILE
fi
done
fi
fi
}

56
bin/hardening/8.3.5_syslog-ng_remote_host.sh
View File

@ -5,44 +5,56 @@
#
#
# 8.3.5 Configure rsyslog to Send Logs to a Remote Log Host (Not Scored)
# 8.3.5 Configure syslog-ng to Send Logs to a Remote Log Host (Not Scored)
#
set -e # One error, it's over
set -u # One variable unset, it's over
HARDENING_LEVEL=3
SERVICE_NAME_R="rsyslog"
PATTERN='^destination.*(tcp|udp)[[:space:]]*\([[:space:]]*\".*\"[[:space:]]*\)'
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ -d "$SYSLOG_BASEDIR" ]; then
FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*"
does_pattern_exist_in_file "$FILES" "$PATTERN"
if [ $FNRET != 0 ]; then
crit "$PATTERN is not present in $FILES"
else
ok "$PATTERN is present in $FILES"
fi
is_pkg_installed $SERVICE_NAME_R
if [ $FNRET = 0 ]; then
ok "$SERVICE_NAME_R has installed, so pass."
FNRET=0
else
warn "$SYSLOG_BASEDIR is not exist!"
FNRET=1
fi
if [ -d "$SYSLOG_BASEDIR" ]; then
FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*"
does_pattern_exist_in_file "$FILES" "$PATTERN"
if [ $FNRET != 0 ]; then
crit "$PATTERN is not present in $FILES"
else
ok "$PATTERN is present in $FILES"
fi
else
warn "$SYSLOG_BASEDIR is not exist!"
FNRET=1
fi
fi
}
# This function will be called if the script status is on enabled mode
apply () {
if [ $FNRET = 1 ]; then
warn "$SYSLOG_BASEDIR is not exist!"
is_pkg_installed $SERVICE_NAME_R
if [ $FNRET = 0 ]; then
ok "$SERVICE_NAME_R has installed, so pass."
FNRET=0
else
FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*"
does_pattern_exist_in_file "$FILES" "$PATTERN"
if [ $FNRET != 0 ]; then
crit "$PATTERN is not present in $FILES, please set a remote host to send your logs"
else
ok "$PATTERN is present in $FILES"
fi
if [ $FNRET = 1 ]; then
warn "$SYSLOG_BASEDIR is not exist!"
else
FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*"
does_pattern_exist_in_file "$FILES" "$PATTERN"
if [ $FNRET != 0 ]; then
crit "$PATTERN is not present in $FILES, please set a remote host to send your logs"
else
ok "$PATTERN is present in $FILES"
fi
fi
fi
}