tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-27 15:44:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix some bugs.

Browse Source
This commit is contained in:
Samson-W 2019-05-21 11:43:16 +08:00
parent 7305b2c770
commit cfd14ce818
7 changed files with 101 additions and 76 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bin/hardening/10.1.8_set_fail_delay_seconds.sh
View File

@ -40,7 +40,7 @@ audit () {
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL" ok "$OPTIONNAME set condition is $CONDT_VAL"
else else
crit "$OPTIONNAME set condition is not $CONDT_VAL" crit "$OPTIONNAME set condition is not equal or greater than $CONDT_VAL"
fi fi
else else
crit "$PATTERN is not present in $FILE" crit "$PATTERN is not present in $FILE"

2
bin/hardening/12.12_etc_group_backup_permissions.sh
View File

@ -15,7 +15,7 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=1 HARDENING_LEVEL=1
FILE='/etc/group-' FILE='/etc/group-'
PERMISSIONS='644' PERMISSIONS='600'
USER='root' USER='root'
GROUP='root' GROUP='root'

2
bin/hardening/12.13_etc_gshadow_backup_permissions.sh
View File

@ -15,7 +15,7 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=1 HARDENING_LEVEL=1
FILE='/etc/gshadow-' FILE='/etc/gshadow-'
PERMISSIONS='640' PERMISSIONS='600'
USER='root' USER='root'
GROUP='shadow' GROUP='shadow'

2
bin/hardening/12.5_etc_passwd_backup_permissions.sh
View File

@ -15,7 +15,7 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=1 HARDENING_LEVEL=1
FILE='/etc/passwd-' FILE='/etc/passwd-'
PERMISSIONS='644' PERMISSIONS='600'
USER='root' USER='root'
GROUP='root' GROUP='root'

2
bin/hardening/12.6_etc_shadow_backup_permissions.sh
View File

@ -15,7 +15,7 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=1 HARDENING_LEVEL=1
FILE='/etc/shadow-' FILE='/etc/shadow-'
PERMISSIONS='640' PERMISSIONS='600'
USER='root' USER='root'
GROUP='shadow' GROUP='shadow'

111
bin/hardening/8.3.4_set_logfile_perm.sh
View File

@ -16,65 +16,78 @@ HARDENING_LEVEL=3
PERMISSIONS='640' PERMISSIONS='640'
USER='root' USER='root'
GROUP='adm' GROUP='adm'
SERVICE_NAME_R="rsyslog"
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
does_file_exist "$SYSLOG_BASEDIR/syslog-ng.conf" is_pkg_installed $SERVICE_NAME_R
if [ $FNRET != 0 ]; then if [ $FNRET = 0 ]; then
warn "$SYSLOG_BASEDIR/syslog-ng.conf is not exist! " ok "$SERVICE_NAME_R has installed, so pass."
FNRET=1 FNRET=0
else else
FILES=$(grep "file(" $SYSLOG_BASEDIR/syslog-ng.conf | grep '"' | cut -d'"' -f 2) does_file_exist "$SYSLOG_BASEDIR/syslog-ng.conf"
for FILE in $FILES; do if [ $FNRET != 0 ]; then
does_file_exist $FILE warn "$SYSLOG_BASEDIR/syslog-ng.conf is not exist! "
if [ $FNRET != 0 ]; then FNRET=1
crit "$FILE does not exist" else
else FILES=$(grep "file(" $SYSLOG_BASEDIR/syslog-ng.conf | grep '"' | cut -d'"' -f 2)
has_file_correct_ownership $FILE $USER $GROUP for FILE in $FILES; do
if [ $FNRET = 0 ]; then does_file_exist $FILE
ok "$FILE has correct ownership" if [ $FNRET != 0 ]; then
else crit "$FILE does not exist"
crit "$FILE ownership was not set to $USER:$GROUP" else
fi has_file_correct_ownership $FILE $USER $GROUP
has_file_correct_permissions $FILE $PERMISSIONS if [ $FNRET = 0 ]; then
if [ $FNRET = 0 ]; then ok "$FILE has correct ownership"
ok "$FILE has correct permissions" else
else crit "$FILE ownership was not set to $USER:$GROUP"
crit "$FILE permissions were not set to $PERMISSIONS" fi
fi has_file_correct_permissions $FILE $PERMISSIONS
fi if [ $FNRET = 0 ]; then
done ok "$FILE has correct permissions"
else
crit "$FILE permissions were not set to $PERMISSIONS"
fi
fi
done
fi
fi fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
does_file_exist "$SYSLOG_BASEDIR/syslog-ng.conf" is_pkg_installed $SERVICE_NAME_R
if [ $FNRET != 0 ]; then if [ $FNRET = 0 ]; then
warn "$SYSLOG_BASEDIR/syslog-ng.conf is not exist! " ok "$SERVICE_NAME_R has installed, so pass."
FNRET=0
else else
FILES=$(grep "file(" $SYSLOG_BASEDIR/syslog-ng.conf | grep '"' | cut -d'"' -f 2) does_file_exist "$SYSLOG_BASEDIR/syslog-ng.conf"
for FILE in $FILES; do if [ $FNRET != 0 ]; then
does_file_exist $FILE warn "$SYSLOG_BASEDIR/syslog-ng.conf is not exist! "
if [ $FNRET != 0 ]; then else
info "$FILE does not exist, create $FILE" FILES=$(grep "file(" $SYSLOG_BASEDIR/syslog-ng.conf | grep '"' | cut -d'"' -f 2)
extend_touch_file $FILE for FILE in $FILES; do
fi does_file_exist $FILE
has_file_correct_ownership $FILE $USER $GROUP if [ $FNRET != 0 ]; then
if [ $FNRET = 0 ]; then info "$FILE does not exist, create $FILE"
ok "$FILE has correct ownership" extend_touch_file $FILE
else fi
warn "fixing $FILE ownership to $USER:$GROUP" has_file_correct_ownership $FILE $USER $GROUP
chown $USER:$GROUP $FILE if [ $FNRET = 0 ]; then
fi ok "$FILE has correct ownership"
has_file_correct_permissions $FILE $PERMISSIONS else
if [ $FNRET = 0 ]; then warn "fixing $FILE ownership to $USER:$GROUP"
ok "$FILE has correct permissions" chown $USER:$GROUP $FILE
else fi
info "fixing $FILE permissions to $PERMISSIONS" has_file_correct_permissions $FILE $PERMISSIONS
chmod 0$PERMISSIONS $FILE if [ $FNRET = 0 ]; then
fi ok "$FILE has correct permissions"
done else
info "fixing $FILE permissions to $PERMISSIONS"
chmod 0$PERMISSIONS $FILE
fi
done
fi
fi fi
} }

54
bin/hardening/8.3.5_syslog-ng_remote_host.sh
View File

@ -5,44 +5,56 @@
# #
# #
# 8.3.5 Configure rsyslog to Send Logs to a Remote Log Host (Not Scored) # 8.3.5 Configure syslog-ng to Send Logs to a Remote Log Host (Not Scored)
# #
set -e # One error, it's over set -e # One error, it's over
set -u # One variable unset, it's over set -u # One variable unset, it's over
HARDENING_LEVEL=3 HARDENING_LEVEL=3
SERVICE_NAME_R="rsyslog"
PATTERN='^destination.*(tcp|udp)[[:space:]]*\([[:space:]]*\".*\"[[:space:]]*\)' PATTERN='^destination.*(tcp|udp)[[:space:]]*\([[:space:]]*\".*\"[[:space:]]*\)'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
if [ -d "$SYSLOG_BASEDIR" ]; then is_pkg_installed $SERVICE_NAME_R
FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*" if [ $FNRET = 0 ]; then
does_pattern_exist_in_file "$FILES" "$PATTERN" ok "$SERVICE_NAME_R has installed, so pass."
if [ $FNRET != 0 ]; then FNRET=0
crit "$PATTERN is not present in $FILES"
else
ok "$PATTERN is present in $FILES"
fi
else else
warn "$SYSLOG_BASEDIR is not exist!" if [ -d "$SYSLOG_BASEDIR" ]; then
FNRET=1 FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*"
does_pattern_exist_in_file "$FILES" "$PATTERN"
if [ $FNRET != 0 ]; then
crit "$PATTERN is not present in $FILES"
else
ok "$PATTERN is present in $FILES"
fi
else
warn "$SYSLOG_BASEDIR is not exist!"
FNRET=1
fi
fi fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
if [ $FNRET = 1 ]; then is_pkg_installed $SERVICE_NAME_R
warn "$SYSLOG_BASEDIR is not exist!" if [ $FNRET = 0 ]; then
ok "$SERVICE_NAME_R has installed, so pass."
FNRET=0
else else
FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*" if [ $FNRET = 1 ]; then
does_pattern_exist_in_file "$FILES" "$PATTERN" warn "$SYSLOG_BASEDIR is not exist!"
if [ $FNRET != 0 ]; then else
crit "$PATTERN is not present in $FILES, please set a remote host to send your logs" FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*"
else does_pattern_exist_in_file "$FILES" "$PATTERN"
ok "$PATTERN is present in $FILES" if [ $FNRET != 0 ]; then
fi crit "$PATTERN is not present in $FILES, please set a remote host to send your logs"
else
ok "$PATTERN is present in $FILES"
fi
fi
fi fi
} }