tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Modify apply method for 9.2.11

This commit is contained in:
Samson-W 2018-11-02 23:56:44 +08:00
parent b06e8890e4
commit daaf9d8a24
2 changed files with 24 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
bin/hardening/9.2.11_enable_lockout_failed_password.sh
View File

@ -5,8 +5,9 @@
#
#
# 9.2.11 Set Lockout for Failed Password Attempts (Not Scored)
# 9.2.11 Set Lockout for Failed Password Attempts (Scored)
# The number in the original document is 9.2.2
# for login and ssh service
#
set -e # One error, it's over
@ -15,8 +16,8 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=3
PACKAGE='libpam-modules-bin'
PATTERN='^auth[[:space:]]*required[[:space:]]*pam_tally[2]?.so'
FILE='/etc/pam.d/login'
AUTHPATTERN='^auth[[:space:]]*required[[:space:]]*pam_tally[2]?.so'
AUTHFILE='/etc/pam.d/common-auth'
# This function will be called if the script status is on enabled / audit mode
audit () {
@ -26,12 +27,12 @@ audit () {
FNRET=1
else
ok "$PACKAGE is installed"
does_pattern_exist_in_file $FILE $PATTERN
does_pattern_exist_in_file $AUTHFILE $AUTHPATTERN
if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE"
FNRET=0
ok "$AUTHPATTERN is present in $AUTHFILE."
FNRET=0
else
crit "$PATTERN is not present in $FILE"
crit "$AUTHPATTERN is not present in $AUTHFILE"
FNRET=2
fi
fi
@ -42,11 +43,11 @@ apply () {
if [ $FNRET = 0 ]; then
ok "installed"
elif [ $FNRET = 1 ]; then
crit "Apply:$PACKAGE is absent, installing it"
warn "Apply:$PACKAGE is absent, installing it"
apt_install $PACKAGE
elif [ $FNRET = 2 ]; then
crit "Apply:$PATTERN is not present in $FILE"
add_line_file_before_pattern $FILE "auth required pam_tally2.so onerr=fail deny=6 unlock_time=1800" "# Uncomment and edit /etc/security/time.conf if you need to set"
warn "Apply:$AUTHPATTERN is not present in $AUTHFILE"
add_line_file_after_pattern $AUTHFILE "auth required pam_tally2.so audit deny=3 unlock_time=900" "# pam-auth-update(8) for details."
fi
}

13
lib/utils.sh
View File

@ -136,6 +136,19 @@ add_line_file_before_pattern() {
FNRET=0
}
add_line_file_after_pattern() {
local FILE=$1
local LINE=$2
local PATTERN=$3
backup_file "$FILE"
debug "Inserting $LINE before $PATTERN in $FILE"
PATTERN=$(sed 's@/@\\\/@g' <<< $PATTERN)
debug "sed -i '/$PATTERN/a $LINE' $FILE"
sed -i "/$PATTERN/a $LINE" $FILE
FNRET=0
}
replace_in_file() {
local FILE=$1
local SOURCE=$2