tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-31 01:24:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add methods for check outbound and input is set to accept.

Browse Source
This commit is contained in:
Samson-W 2019-04-11 14:50:30 -04:00
parent ee9f4dfff4
commit d31530f2a6
1 changed files with 56 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
lib/utils.sh
View File

@ -16,6 +16,16 @@ is_debian_9()
fi
}
is_debian_10()
{
if $(cat /etc/debian_version | grep -q "^10.[0-9]"); then
debug "Debian version is 9.*."
FNRET=0
else
debug "Debian version is not 9.*."
FNRET=1
fi
}
#
# Sysctl
#
@ -754,3 +764,49 @@ ensure_lo_traffic_other_if_input_is_deny()
fi
}
#Ensure is set accept for all outbound
check_outbound_connect_is_accept()
{
PATTERN="\-\-state NEW,ESTABLISHED \-j ACCEPT"
IPS4=$(which iptables)
IPS6=$(which ip6tables)
# $1 maybe is: tcp udp icmp
proto=$1
if [ $(${IPS4} -S | grep "^\-A OUTPUT" | grep "\-p ${proto}" | grep -c "$PATTERN") -eq 0 ]; then
crit "Iptables: Protocol $proto outbound is not configured!"
if [ $(${IPS6} -S | grep "^\-A OUTPUT" | grep "\-p ${proto}" | grep -c "$PATTERN") -eq 0 ]; then
crit "Ip6tables: Protocol $proto outbound is not configured!"
FNRET=1
else
ok "Ip6tables: Protocol $proto outbound is not configured!"
FNRET=0
fi
else
ok "Iptables: Protocol $proto outbound is not configured!"
FNRET=0
fi
}
#Ensure is set accept for input with ESTABLISHED
check_input_with_established_is_accept()
{
PATTERN="\-\-state ESTABLISHED \-j ACCEPT"
IPS4=$(which iptables)
IPS6=$(which ip6tables)
# $1 maybe is: tcp udp icmp
proto=$1
if [ $(${IPS4} -S | grep "^\-A INPUT" | grep "\-p ${proto}" | grep -c "$PATTERN") -eq 0 ]; then
crit "Iptables: Protocol $proto INPUT is not configured!"
if [ $(${IPS6} -S | grep "^\-A INPUT" | grep "\-p ${proto}" | grep -c "$PATTERN") -eq 0 ]; then
crit "Ip6tables: Protocol $proto INPUT is not configured!"
FNRET=1
else
ok "Ip6tables: Protocol $proto INPUT is not configured!"
FNRET=0
fi
else
ok "Iptables: Protocol $proto INPUT is not configured!"
FNRET=0
fi
}