tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-31 01:24:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add audit and apply methods for 7.7.5: Ensure IPv6 loopback traffic is configured. (Include ipv4 and ip6)

Browse Source
This commit is contained in:
Samson-W 2019-04-09 04:29:36 +08:00
parent 3be3101d13
commit ea03f5f7e5
1 changed files with 22 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
bin/hardening/7.7.5_ensure_loopback_traffic_is_configured.sh
View File

@ -22,10 +22,9 @@ IPS6=$(which ip6tables)
audit () { audit () {
if [ $(${IPS4} -S | grep -c "^\-A INPUT \-i lo \-j ACCEPT") -eq 0 -o $(${IPS4} -S | grep -c "^\-A INPUT \-i 127.0.0.1 \-j ACCEPT") -eq 0 ]; then if [ $(${IPS4} -S | grep -c "^\-A INPUT \-i lo \-j ACCEPT") -eq 0 -o $(${IPS4} -S | grep -c "^\-A INPUT \-i 127.0.0.1 \-j ACCEPT") -eq 0 ]; then
crit "Ip4tables: loopback traffic INPUT is not configured!" crit "Ip4tables: loopback traffic INPUT is not configured!"
if [ $(${IPS6} -S | grep -c "^\-A INPUT \-i lo \-j ACCEPT") -eq 0 -o $(${IPS6} -S | grep -c "^\-A INPUT \-i 127.0.0.1 \-j ACCEPT") -eq 0 ]; then if [ $(${IPS6} -S | grep -c "^\-A INPUT \-i lo \-j ACCEPT") -eq 0 -o $(${IPS6} -S | grep -c "^\-A INPUT \-i ::/0 \-j ACCEPT") -eq 0 ]; then
crit "Ip6tables: loopback traffic INPUT is not configured!" crit "Ip6tables: loopback traffic INPUT is not configured!"
FNRET=1 FNRET=1
return $FNRET
else else
ok "Ip6tables loopback traffic INPUT has configured!" ok "Ip6tables loopback traffic INPUT has configured!"
FNRET=0 FNRET=0
@ -35,33 +34,31 @@ audit () {
FNRET=0 FNRET=0
fi fi
if [ $(${IPS4} -S | grep -c "^\-A INPUT \-i lo \-j ACCEPT") -eq 0 -o $(${IPS4} -S | grep -c "^\-A INPUT \-i 127.0.0.1 \-j ACCEPT") -eq 0 ]; then if [ $(${IPS4} -S | grep -c "^\-A OUTPUT \-o lo \-j ACCEPT") -eq 0 -o $(${IPS4} -S | grep -c "^\-A OUTPUT \-o 127.0.0.1 \-j ACCEPT") -eq 0 ]; then
crit "Ip4tables: loopback traffic INPUT is not configured!" crit "Ip4tables: loopback traffic OUTPUT is not configured!"
if [ $(${IPS6} -S | grep -c "^\-A INPUT \-i lo \-j ACCEPT") -eq 0 -o $(${IPS6} -S | grep -c "^\-A INPUT \-i 127.0.0.1 \-j ACCEPT") -eq 0 ]; then if [ $(${IPS6} -S | grep -c "^\-A OUTPUT \-o lo \-j ACCEPT") -eq 0 -o $(${IPS6} -S | grep -c "^\-A OUTPUT \-o ::/0 \-j ACCEPT") -eq 0 ]; then
crit "Ip6tables: loopback traffic INPUT is not configured!" crit "Ip6tables: loopback traffic OUTPUT is not configured!"
FNRET=1 FNRET=2
return $FNRET
else else
ok "Ip6tables loopback traffic INPUT has configured!" ok "Ip6tables loopback traffic OUTPUT has configured!"
FNRET=0 FNRET=0
fi fi
else else
ok "Ip4tables loopback traffic INPUT has configured!" ok "Ip4tables loopback traffic OUTPUT has configured!"
FNRET=0 FNRET=0
fi fi
if [ $(${IPS4} -S | grep -c "^\-A INPUT \-i lo \-j ACCEPT") -eq 0 -o $(${IPS4} -S | grep -c "^\-A INPUT \-i 127.0.0.1 \-j ACCEPT") -eq 0 ]; then if [ $(${IPS4} -S | grep -c "^\-A INPUT \-s 127.0.0.0/8 \-j ACCEPT") -eq 0 ]; then
crit "Ip4tables: loopback traffic INPUT is not configured!" crit "Ip4tables: loopback traffic INPUT deny from 127.0.0.0/8 is not configured!"
if [ $(${IPS6} -S | grep -c "^\-A INPUT \-i lo \-j ACCEPT") -eq 0 -o $(${IPS6} -S | grep -c "^\-A INPUT \-i 127.0.0.1 \-j ACCEPT") -eq 0 ]; then if [ $(${IPS6} -S | grep -c "^\-A INPUT \-s ::1 \-j ACCEPT") -eq 0 ]; then
crit "Ip6tables: loopback traffic INPUT is not configured!" crit "Ip6tables: loopback traffic INPUT deny from ::1 is not configured!"
FNRET=1 FNRET=3
return $FNRET
else else
ok "Ip6tables loopback traffic INPUT has configured!" ok "Ip6tables loopback traffic INPUT deny from ::1 has configured!"
FNRET=0 FNRET=0
fi fi
else else
ok "Ip4tables loopback traffic INPUT has configured!" ok "Ip4tables loopback traffic INPUT deny from 127.0.0.0/8 has configured!"
FNRET=0 FNRET=0
fi fi
} }
@ -69,9 +66,13 @@ audit () {
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "Iptables/Ip6tables has set default deny for firewall policy!" ok "Iptables/Ip6tables loopback traffic has configured!"
else elif [ $FNRET = 1 ]; then
warn "Iptables/Ip6tables is not set default deny for firewall policy! need the administrator to manually add it. Howto set: iptables/ip6tables -P INPUT DROP; iptables/ip6tables -P OUTPUT DROP; iptables/ip6tables -P FORWARD DROP." warn "Iptables/Ip6tables loopback traffic INPUT is not configured! need the administrator to manually add it. Howto set: iptables/ip6tables -A INPUT -i lo -j ACCEPT"
elif [ $FNRET = 2 ]; then
warn "Iptables/Ip6tables loopback traffic OUTPUT is not configured! need the administrator to manually add it. Howto set: iptables/ip6tables -A OUTPUT -o lo -j ACCEPT"
elif [ $FNRET = 3 ]; then
warn "Iptables/Ip6tables loopback traffic INPUT deny from 127.0.0.0/8 is not configured! need the administrator to manually add it. Howto set: iptables/ip6tables -A INPUT -s 127.0.0.0/8 -j DROP"
fi fi
} }