tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-27 07:34:50 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix some bugs.

Browse Source
This commit is contained in:
Samson-W 2019-05-21 11:43:16 +08:00
parent 7305b2c770
commit cfd14ce818
7 changed files with 101 additions and 76 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bin/hardening/10.1.8_set_fail_delay_seconds.sh
View File

@ -40,7 +40,7 @@ audit () {
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL" ok "$OPTIONNAME set condition is $CONDT_VAL"
else else
crit "$OPTIONNAME set condition is not $CONDT_VAL" crit "$OPTIONNAME set condition is not equal or greater than $CONDT_VAL"
fi fi
else else
crit "$PATTERN is not present in $FILE" crit "$PATTERN is not present in $FILE"

2
bin/hardening/12.12_etc_group_backup_permissions.sh
View File

@ -15,7 +15,7 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=1 HARDENING_LEVEL=1
FILE='/etc/group-' FILE='/etc/group-'
PERMISSIONS='644' PERMISSIONS='600'
USER='root' USER='root'
GROUP='root' GROUP='root'

2
bin/hardening/12.13_etc_gshadow_backup_permissions.sh
View File

@ -15,7 +15,7 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=1 HARDENING_LEVEL=1
FILE='/etc/gshadow-' FILE='/etc/gshadow-'
PERMISSIONS='640' PERMISSIONS='600'
USER='root' USER='root'
GROUP='shadow' GROUP='shadow'

2
bin/hardening/12.5_etc_passwd_backup_permissions.sh
View File

@ -15,7 +15,7 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=1 HARDENING_LEVEL=1
FILE='/etc/passwd-' FILE='/etc/passwd-'
PERMISSIONS='644' PERMISSIONS='600'
USER='root' USER='root'
GROUP='root' GROUP='root'

2
bin/hardening/12.6_etc_shadow_backup_permissions.sh
View File

@ -15,7 +15,7 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=1 HARDENING_LEVEL=1
FILE='/etc/shadow-' FILE='/etc/shadow-'
PERMISSIONS='640' PERMISSIONS='600'
USER='root' USER='root'
GROUP='shadow' GROUP='shadow'

13
bin/hardening/8.3.4_set_logfile_perm.sh
View File

@ -16,9 +16,15 @@ HARDENING_LEVEL=3
PERMISSIONS='640' PERMISSIONS='640'
USER='root' USER='root'
GROUP='adm' GROUP='adm'
SERVICE_NAME_R="rsyslog"
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
is_pkg_installed $SERVICE_NAME_R
if [ $FNRET = 0 ]; then
ok "$SERVICE_NAME_R has installed, so pass."
FNRET=0
else
does_file_exist "$SYSLOG_BASEDIR/syslog-ng.conf" does_file_exist "$SYSLOG_BASEDIR/syslog-ng.conf"
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
warn "$SYSLOG_BASEDIR/syslog-ng.conf is not exist! " warn "$SYSLOG_BASEDIR/syslog-ng.conf is not exist! "
@ -45,10 +51,16 @@ audit () {
fi fi
done done
fi fi
fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
is_pkg_installed $SERVICE_NAME_R
if [ $FNRET = 0 ]; then
ok "$SERVICE_NAME_R has installed, so pass."
FNRET=0
else
does_file_exist "$SYSLOG_BASEDIR/syslog-ng.conf" does_file_exist "$SYSLOG_BASEDIR/syslog-ng.conf"
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
warn "$SYSLOG_BASEDIR/syslog-ng.conf is not exist! " warn "$SYSLOG_BASEDIR/syslog-ng.conf is not exist! "
@ -76,6 +88,7 @@ apply () {
fi fi
done done
fi fi
fi
} }
# This function will create the config file for this check with default values # This function will create the config file for this check with default values

16
bin/hardening/8.3.5_syslog-ng_remote_host.sh
View File

@ -5,18 +5,23 @@
# #
# #
# 8.3.5 Configure rsyslog to Send Logs to a Remote Log Host (Not Scored) # 8.3.5 Configure syslog-ng to Send Logs to a Remote Log Host (Not Scored)
# #
set -e # One error, it's over set -e # One error, it's over
set -u # One variable unset, it's over set -u # One variable unset, it's over
HARDENING_LEVEL=3 HARDENING_LEVEL=3
SERVICE_NAME_R="rsyslog"
PATTERN='^destination.*(tcp|udp)[[:space:]]*\([[:space:]]*\".*\"[[:space:]]*\)' PATTERN='^destination.*(tcp|udp)[[:space:]]*\([[:space:]]*\".*\"[[:space:]]*\)'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
is_pkg_installed $SERVICE_NAME_R
if [ $FNRET = 0 ]; then
ok "$SERVICE_NAME_R has installed, so pass."
FNRET=0
else
if [ -d "$SYSLOG_BASEDIR" ]; then if [ -d "$SYSLOG_BASEDIR" ]; then
FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*" FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*"
does_pattern_exist_in_file "$FILES" "$PATTERN" does_pattern_exist_in_file "$FILES" "$PATTERN"
@ -29,10 +34,16 @@ audit () {
warn "$SYSLOG_BASEDIR is not exist!" warn "$SYSLOG_BASEDIR is not exist!"
FNRET=1 FNRET=1
fi fi
fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
is_pkg_installed $SERVICE_NAME_R
if [ $FNRET = 0 ]; then
ok "$SERVICE_NAME_R has installed, so pass."
FNRET=0
else
if [ $FNRET = 1 ]; then if [ $FNRET = 1 ]; then
warn "$SYSLOG_BASEDIR is not exist!" warn "$SYSLOG_BASEDIR is not exist!"
else else
@ -44,6 +55,7 @@ apply () {
ok "$PATTERN is present in $FILES" ok "$PATTERN is present in $FILES"
fi fi
fi fi
fi
} }
# This function will create the config file for this check with default values # This function will create the config file for this check with default values