tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Modify apply method for 9.2.11

This commit is contained in:
Samson-W 2018-11-02 23:56:44 +08:00
parent b06e8890e4
commit daaf9d8a24
2 changed files with 24 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
bin/hardening/9.2.11_enable_lockout_failed_password.sh
View File

@ -5,8 +5,9 @@
# #
# #
# 9.2.11 Set Lockout for Failed Password Attempts (Not Scored) # 9.2.11 Set Lockout for Failed Password Attempts (Scored)
# The number in the original document is 9.2.2 # The number in the original document is 9.2.2
# for login and ssh service
# #
set -e # One error, it's over set -e # One error, it's over
@ -15,8 +16,8 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=3 HARDENING_LEVEL=3
PACKAGE='libpam-modules-bin' PACKAGE='libpam-modules-bin'
PATTERN='^auth[[:space:]]*required[[:space:]]*pam_tally[2]?.so' AUTHPATTERN='^auth[[:space:]]*required[[:space:]]*pam_tally[2]?.so'
FILE='/etc/pam.d/login' AUTHFILE='/etc/pam.d/common-auth'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
@ -26,12 +27,12 @@ audit () {
FNRET=1 FNRET=1
else else
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
does_pattern_exist_in_file $FILE $PATTERN does_pattern_exist_in_file $AUTHFILE $AUTHPATTERN
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$AUTHPATTERN is present in $AUTHFILE."
FNRET=0 FNRET=0
else else
crit "$PATTERN is not present in $FILE" crit "$AUTHPATTERN is not present in $AUTHFILE"
FNRET=2 FNRET=2
fi fi
fi fi
@ -42,11 +43,11 @@ apply () {
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "installed" ok "installed"
elif [ $FNRET = 1 ]; then elif [ $FNRET = 1 ]; then
crit "Apply:$PACKAGE is absent, installing it" warn "Apply:$PACKAGE is absent, installing it"
apt_install $PACKAGE apt_install $PACKAGE
elif [ $FNRET = 2 ]; then elif [ $FNRET = 2 ]; then
crit "Apply:$PATTERN is not present in $FILE" warn "Apply:$AUTHPATTERN is not present in $AUTHFILE"
add_line_file_before_pattern $FILE "auth required pam_tally2.so onerr=fail deny=6 unlock_time=1800" "# Uncomment and edit /etc/security/time.conf if you need to set" add_line_file_after_pattern $AUTHFILE "auth required pam_tally2.so audit deny=3 unlock_time=900" "# pam-auth-update(8) for details."
fi fi
} }

13
lib/utils.sh
View File

@ -136,6 +136,19 @@ add_line_file_before_pattern() {
FNRET=0 FNRET=0
} }
add_line_file_after_pattern() {
local FILE=$1
local LINE=$2
local PATTERN=$3
backup_file "$FILE"
debug "Inserting $LINE before $PATTERN in $FILE"
PATTERN=$(sed 's@/@\\\/@g' <<< $PATTERN)
debug "sed -i '/$PATTERN/a $LINE' $FILE"
sed -i "/$PATTERN/a $LINE" $FILE
FNRET=0
}
replace_in_file() { replace_in_file() {
local FILE=$1 local FILE=$1
local SOURCE=$2 local SOURCE=$2