diff --git a/bin/hardening/10.1.8_set_fail_delay_seconds.sh b/bin/hardening/10.1.8_set_fail_delay_seconds.sh index c9d38be..b7de140 100755 --- a/bin/hardening/10.1.8_set_fail_delay_seconds.sh +++ b/bin/hardening/10.1.8_set_fail_delay_seconds.sh @@ -40,7 +40,7 @@ audit () { if [ $FNRET = 0 ]; then ok "$OPTIONNAME set condition is $CONDT_VAL" else - crit "$OPTIONNAME set condition is not $CONDT_VAL" + crit "$OPTIONNAME set condition is not equal or greater than $CONDT_VAL" fi else crit "$PATTERN is not present in $FILE" diff --git a/bin/hardening/12.12_etc_group_backup_permissions.sh b/bin/hardening/12.12_etc_group_backup_permissions.sh index 2d70e02..a778a6d 100755 --- a/bin/hardening/12.12_etc_group_backup_permissions.sh +++ b/bin/hardening/12.12_etc_group_backup_permissions.sh @@ -15,7 +15,7 @@ set -u # One variable unset, it's over HARDENING_LEVEL=1 FILE='/etc/group-' -PERMISSIONS='644' +PERMISSIONS='600' USER='root' GROUP='root' diff --git a/bin/hardening/12.13_etc_gshadow_backup_permissions.sh b/bin/hardening/12.13_etc_gshadow_backup_permissions.sh index 6df0b01..ce598cf 100755 --- a/bin/hardening/12.13_etc_gshadow_backup_permissions.sh +++ b/bin/hardening/12.13_etc_gshadow_backup_permissions.sh @@ -15,7 +15,7 @@ set -u # One variable unset, it's over HARDENING_LEVEL=1 FILE='/etc/gshadow-' -PERMISSIONS='640' +PERMISSIONS='600' USER='root' GROUP='shadow' diff --git a/bin/hardening/12.5_etc_passwd_backup_permissions.sh b/bin/hardening/12.5_etc_passwd_backup_permissions.sh index 0682f3a..a0bf0c9 100755 --- a/bin/hardening/12.5_etc_passwd_backup_permissions.sh +++ b/bin/hardening/12.5_etc_passwd_backup_permissions.sh @@ -15,7 +15,7 @@ set -u # One variable unset, it's over HARDENING_LEVEL=1 FILE='/etc/passwd-' -PERMISSIONS='644' +PERMISSIONS='600' USER='root' GROUP='root' diff --git a/bin/hardening/12.6_etc_shadow_backup_permissions.sh b/bin/hardening/12.6_etc_shadow_backup_permissions.sh index b82c236..6db3c56 100755 --- a/bin/hardening/12.6_etc_shadow_backup_permissions.sh +++ b/bin/hardening/12.6_etc_shadow_backup_permissions.sh @@ -15,7 +15,7 @@ set -u # One variable unset, it's over HARDENING_LEVEL=1 FILE='/etc/shadow-' -PERMISSIONS='640' +PERMISSIONS='600' USER='root' GROUP='shadow' diff --git a/bin/hardening/8.3.4_set_logfile_perm.sh b/bin/hardening/8.3.4_set_logfile_perm.sh index 3a0a165..2d89295 100755 --- a/bin/hardening/8.3.4_set_logfile_perm.sh +++ b/bin/hardening/8.3.4_set_logfile_perm.sh @@ -16,65 +16,78 @@ HARDENING_LEVEL=3 PERMISSIONS='640' USER='root' GROUP='adm' +SERVICE_NAME_R="rsyslog" # This function will be called if the script status is on enabled / audit mode audit () { - does_file_exist "$SYSLOG_BASEDIR/syslog-ng.conf" - if [ $FNRET != 0 ]; then - warn "$SYSLOG_BASEDIR/syslog-ng.conf is not exist! " - FNRET=1 + is_pkg_installed $SERVICE_NAME_R + if [ $FNRET = 0 ]; then + ok "$SERVICE_NAME_R has installed, so pass." + FNRET=0 else - FILES=$(grep "file(" $SYSLOG_BASEDIR/syslog-ng.conf | grep '"' | cut -d'"' -f 2) - for FILE in $FILES; do - does_file_exist $FILE - if [ $FNRET != 0 ]; then - crit "$FILE does not exist" - else - has_file_correct_ownership $FILE $USER $GROUP - if [ $FNRET = 0 ]; then - ok "$FILE has correct ownership" - else - crit "$FILE ownership was not set to $USER:$GROUP" - fi - has_file_correct_permissions $FILE $PERMISSIONS - if [ $FNRET = 0 ]; then - ok "$FILE has correct permissions" - else - crit "$FILE permissions were not set to $PERMISSIONS" - fi - fi - done + does_file_exist "$SYSLOG_BASEDIR/syslog-ng.conf" + if [ $FNRET != 0 ]; then + warn "$SYSLOG_BASEDIR/syslog-ng.conf is not exist! " + FNRET=1 + else + FILES=$(grep "file(" $SYSLOG_BASEDIR/syslog-ng.conf | grep '"' | cut -d'"' -f 2) + for FILE in $FILES; do + does_file_exist $FILE + if [ $FNRET != 0 ]; then + crit "$FILE does not exist" + else + has_file_correct_ownership $FILE $USER $GROUP + if [ $FNRET = 0 ]; then + ok "$FILE has correct ownership" + else + crit "$FILE ownership was not set to $USER:$GROUP" + fi + has_file_correct_permissions $FILE $PERMISSIONS + if [ $FNRET = 0 ]; then + ok "$FILE has correct permissions" + else + crit "$FILE permissions were not set to $PERMISSIONS" + fi + fi + done + fi fi } # This function will be called if the script status is on enabled mode apply () { - does_file_exist "$SYSLOG_BASEDIR/syslog-ng.conf" - if [ $FNRET != 0 ]; then - warn "$SYSLOG_BASEDIR/syslog-ng.conf is not exist! " + is_pkg_installed $SERVICE_NAME_R + if [ $FNRET = 0 ]; then + ok "$SERVICE_NAME_R has installed, so pass." + FNRET=0 else - FILES=$(grep "file(" $SYSLOG_BASEDIR/syslog-ng.conf | grep '"' | cut -d'"' -f 2) - for FILE in $FILES; do - does_file_exist $FILE - if [ $FNRET != 0 ]; then - info "$FILE does not exist, create $FILE" - extend_touch_file $FILE - fi - has_file_correct_ownership $FILE $USER $GROUP - if [ $FNRET = 0 ]; then - ok "$FILE has correct ownership" - else - warn "fixing $FILE ownership to $USER:$GROUP" - chown $USER:$GROUP $FILE - fi - has_file_correct_permissions $FILE $PERMISSIONS - if [ $FNRET = 0 ]; then - ok "$FILE has correct permissions" - else - info "fixing $FILE permissions to $PERMISSIONS" - chmod 0$PERMISSIONS $FILE - fi - done + does_file_exist "$SYSLOG_BASEDIR/syslog-ng.conf" + if [ $FNRET != 0 ]; then + warn "$SYSLOG_BASEDIR/syslog-ng.conf is not exist! " + else + FILES=$(grep "file(" $SYSLOG_BASEDIR/syslog-ng.conf | grep '"' | cut -d'"' -f 2) + for FILE in $FILES; do + does_file_exist $FILE + if [ $FNRET != 0 ]; then + info "$FILE does not exist, create $FILE" + extend_touch_file $FILE + fi + has_file_correct_ownership $FILE $USER $GROUP + if [ $FNRET = 0 ]; then + ok "$FILE has correct ownership" + else + warn "fixing $FILE ownership to $USER:$GROUP" + chown $USER:$GROUP $FILE + fi + has_file_correct_permissions $FILE $PERMISSIONS + if [ $FNRET = 0 ]; then + ok "$FILE has correct permissions" + else + info "fixing $FILE permissions to $PERMISSIONS" + chmod 0$PERMISSIONS $FILE + fi + done + fi fi } diff --git a/bin/hardening/8.3.5_syslog-ng_remote_host.sh b/bin/hardening/8.3.5_syslog-ng_remote_host.sh index 973146b..079f74b 100755 --- a/bin/hardening/8.3.5_syslog-ng_remote_host.sh +++ b/bin/hardening/8.3.5_syslog-ng_remote_host.sh @@ -5,44 +5,56 @@ # # -# 8.3.5 Configure rsyslog to Send Logs to a Remote Log Host (Not Scored) +# 8.3.5 Configure syslog-ng to Send Logs to a Remote Log Host (Not Scored) # set -e # One error, it's over set -u # One variable unset, it's over HARDENING_LEVEL=3 - +SERVICE_NAME_R="rsyslog" PATTERN='^destination.*(tcp|udp)[[:space:]]*\([[:space:]]*\".*\"[[:space:]]*\)' # This function will be called if the script status is on enabled / audit mode audit () { - if [ -d "$SYSLOG_BASEDIR" ]; then - FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*" - does_pattern_exist_in_file "$FILES" "$PATTERN" - if [ $FNRET != 0 ]; then - crit "$PATTERN is not present in $FILES" - else - ok "$PATTERN is present in $FILES" - fi + is_pkg_installed $SERVICE_NAME_R + if [ $FNRET = 0 ]; then + ok "$SERVICE_NAME_R has installed, so pass." + FNRET=0 else - warn "$SYSLOG_BASEDIR is not exist!" - FNRET=1 - fi + if [ -d "$SYSLOG_BASEDIR" ]; then + FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*" + does_pattern_exist_in_file "$FILES" "$PATTERN" + if [ $FNRET != 0 ]; then + crit "$PATTERN is not present in $FILES" + else + ok "$PATTERN is present in $FILES" + fi + else + warn "$SYSLOG_BASEDIR is not exist!" + FNRET=1 + fi + fi } # This function will be called if the script status is on enabled mode apply () { - if [ $FNRET = 1 ]; then - warn "$SYSLOG_BASEDIR is not exist!" + is_pkg_installed $SERVICE_NAME_R + if [ $FNRET = 0 ]; then + ok "$SERVICE_NAME_R has installed, so pass." + FNRET=0 else - FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*" - does_pattern_exist_in_file "$FILES" "$PATTERN" - if [ $FNRET != 0 ]; then - crit "$PATTERN is not present in $FILES, please set a remote host to send your logs" - else - ok "$PATTERN is present in $FILES" - fi + if [ $FNRET = 1 ]; then + warn "$SYSLOG_BASEDIR is not exist!" + else + FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*" + does_pattern_exist_in_file "$FILES" "$PATTERN" + if [ $FNRET != 0 ]; then + crit "$PATTERN is not present in $FILES, please set a remote host to send your logs" + else + ok "$PATTERN is present in $FILES" + fi + fi fi }