Implement the exception handling feature for the specified service.

bin/hardening/6.11_disable_imap_pop.sh

@@ -22,7 +22,11 @@ audit () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed!"
+            if [ $ISEXCEPTION -eq 1 ]; then
+                warn "$PACKAGE is installed! But Exception is set to 1, so it's pass!"
+            else
+                crit "$PACKAGE is installed!"
+            fi
         else
             ok "$PACKAGE is absent"
         fi
@@ -34,15 +38,28 @@ apply () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed, purging it"
+            if [ $ISEXCEPTION -eq 1 ]; then
-            apt-get purge $PACKAGE -y
+                warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
-            apt-get autoremove
+            else
+                crit "$PACKAGE is installed, purging it"
+                apt-get purge $PACKAGE -y
+                apt-get autoremove
+            fi
         else
             ok "$PACKAGE is absent"
         fi
     done
 }
 
+# This function will create the config file for this check with default values
+create_config() {
+cat <<EOF
+status=disabled
+# Put here exception to pass this case, if set is 1, don't need apply, let to pass.
+ISEXCEPTION=0
+EOF
+}
+
 # This function will check config parameters required
 check_config() {
     :

bin/hardening/6.12_disable_samba.sh

@@ -21,7 +21,11 @@ audit () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed!"
+            if [ $ISEXCEPTION -eq 1 ]; then
+                warn "$PACKAGE is installed! But Exception is set to 1, so it's pass!"
+            else
+                crit "$PACKAGE is installed!"
+            fi
         else
             ok "$PACKAGE is absent"
         fi
@@ -33,15 +37,29 @@ apply () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed, purging it"
+            if [ $ISEXCEPTION -eq 1 ]; then
-            apt-get purge $PACKAGE -y
+                warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
-            apt-get autoremove
+            else
+                crit "$PACKAGE is installed, purging it"
+                apt-get purge $PACKAGE -y
+                apt-get autoremove
+            fi
         else
             ok "$PACKAGE is absent"
         fi
     done
 }
 
+# This function will create the config file for this check with default values
+create_config() {
+cat <<EOF
+status=disabled
+# Put here exception to pass this case, if set is 1, don't need apply, let to pass.
+ISEXCEPTION=0
+EOF
+}
+
+
 # This function will check config parameters required
 check_config() {
     :

bin/hardening/6.13_disable_http_proxy.sh

@@ -21,7 +21,11 @@ audit () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed!"
+            if [ $ISEXCEPTION -eq 1 ]; then
+                warn "$PACKAGE is installed! But Exception is set to 1, so it's pass!"
+            else
+                crit "$PACKAGE is installed!"
+            fi
         else
             ok "$PACKAGE is absent"
         fi
@@ -33,15 +37,28 @@ apply () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed, purging it"
+            if [ $ISEXCEPTION -eq 1 ]; then
-            apt-get purge $PACKAGE -y
+                warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
-            apt-get autoremove
+            else
+                crit "$PACKAGE is installed, purging it"
+                apt-get purge $PACKAGE -y
+                apt-get autoremove
+           fi
         else
             ok "$PACKAGE is absent"
         fi
     done
 }
 
+# This function will create the config file for this check with default values
+create_config() {
+cat <<EOF
+status=disabled
+# Put here exception to pass this case, if set is 1, don't need apply, let to pass.
+ISEXCEPTION=0
+EOF
+}
+
 # This function will check config parameters required
 check_config() {
     :

bin/hardening/6.14_disable_snmp_server.sh

@@ -21,7 +21,11 @@ audit () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed!"
+            if [ $ISEXCEPTION -eq 1 ]; then
+                warn "$PACKAGE is installed! But Exception is set to 1, so it's pass!"
+            else
+                crit "$PACKAGE is installed!"
+            fi
         else
             ok "$PACKAGE is absent"
         fi
@@ -33,14 +37,27 @@ apply () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed, purging it"
+            if [ $ISEXCEPTION -eq 1 ]; then
-            apt-get purge $PACKAGE -y
+                warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
+            else
+                crit "$PACKAGE is installed, purging it"
+                apt-get purge $PACKAGE -y
+            fi
         else
             ok "$PACKAGE is absent"
         fi
     done
 }
 
+# This function will create the config file for this check with default values
+create_config() {
+cat <<EOF
+status=disabled
+# Put here exception to pass this case, if set is 1, don't need apply, let to pass.
+ISEXCEPTION=0
+EOF
+}
+
 # This function will check config parameters required
 check_config() {
     :

bin/hardening/6.2_disable_avahi_server.sh

@@ -12,6 +12,7 @@ set -e # One error, it's over
 set -u # One variable unset, it's over
 
 HARDENING_LEVEL=3
+HARDENING_EXCEPTION=dns
 
 PACKAGES='avahi-daemon libavahi-common-data libavahi-common3 libavahi-core7'
 
@@ -20,7 +21,11 @@ audit () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed!"
+            if [ $ISEXCEPTION -eq 1 ]; then
+                warn "$PACKAGE is installed! But Exception is set to 1, so it's pass!"
+            else
+                crit "$PACKAGE is installed!"
+            fi
         else
             ok "$PACKAGE is absent"
         fi
@@ -32,15 +37,28 @@ apply () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed, purging it"
+            if [ $ISEXCEPTION -eq 1 ]; then
-            apt-get purge $PACKAGE -y
+                warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
-            apt-get autoremove
+            else
+                crit "$PACKAGE is installed, purging it"
+                apt-get purge $PACKAGE -y
+                apt-get autoremove
+            fi
         else
             ok "$PACKAGE is absent"
         fi
     done
 }
 
+# This function will create the config file for this check with default values
+create_config() {
+cat <<EOF
+status=disabled
+# Put here exception to pass this case, if set is 1, don't need apply, let to pass.
+ISEXCEPTION=0
+EOF
+}
+
 # This function will check config parameters required
 check_config() {
     :

bin/hardening/6.3_disable_print_server.sh

@@ -21,7 +21,11 @@ audit () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed!"
+            if [ $ISEXCEPTION -eq 1 ]; then
+                warn "$PACKAGE is installed! But Exception is set to 1, so it's pass!"
+            else
+                crit "$PACKAGE is installed!"
+            fi
         else
             ok "$PACKAGE is absent"
         fi
@@ -33,15 +37,28 @@ apply () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed, purging it"
+            if [ $ISEXCEPTION -eq 1 ]; then
-            apt-get purge $PACKAGE -y
+                warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
-            apt-get autoremove
+            else
+                crit "$PACKAGE is installed, purging it"
+                apt-get purge $PACKAGE -y
+                apt-get autoremove
+            fi
         else
             ok "$PACKAGE is absent"
         fi
     done
 }
 
+# This function will create the config file for this check with default values
+create_config() {
+cat <<EOF
+status=disabled
+# Put here exception to pass this case, if set is 1, don't need apply, let to pass.
+ISEXCEPTION=0
+EOF
+}
+
 # This function will check config parameters required
 check_config() {
     :

bin/hardening/6.4_disable_dhcp.sh

@@ -21,7 +21,11 @@ audit () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed!"
+            if [ $ISEXCEPTION -eq 1 ]; then
+                warn "$PACKAGE is installed! But Exception is set to 1, so it's pass!"
+            else
+                crit "$PACKAGE is installed!"
+            fi
         else
             ok "$PACKAGE is absent"
         fi
@@ -33,15 +37,28 @@ apply () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed, purging it"
+            if [ $ISEXCEPTION -eq 1 ]; then
-            apt-get purge $PACKAGE -y
+                warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
-            apt-get autoremove
+            else
+                crit "$PACKAGE is installed, purging it"
+                apt-get purge $PACKAGE -y
+                apt-get autoremove
+            fi
         else
             ok "$PACKAGE is absent"
         fi
     done
 }
 
+# This function will create the config file for this check with default values
+create_config() {
+cat <<EOF
+status=disabled
+# Put here exception to pass this case, if set is 1, don't need apply, let to pass.
+ISEXCEPTION=0
+EOF
+}
+
 # This function will check config parameters required
 check_config() {
     :

bin/hardening/6.6_disable_ldap.sh

@@ -21,7 +21,11 @@ audit () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed!"
+            if [ $ISEXCEPTION -eq 1 ]; then
+                warn "$PACKAGE is installed! But Exception is set to 1, so it's pass!"
+            else
+                crit "$PACKAGE is installed!"
+            fi
         else
             ok "$PACKAGE is absent"
         fi
@@ -33,15 +37,29 @@ apply () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed, purging it"
+            if [ $ISEXCEPTION -eq 1 ]; then
-            apt-get purge $PACKAGE -y
+                warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
-            apt-get autoremove
+            else
+                crit "$PACKAGE is installed, purging it"
+                apt-get purge $PACKAGE -y
+                apt-get autoremove
+            fi
         else
             ok "$PACKAGE is absent"
         fi
     done
 }
 
+# This function will create the config file for this check with default values
+create_config() {
+cat <<EOF
+status=disabled
+# Put here exception to pass this case, if set is 1, don't need apply, let to pass.
+ISEXCEPTION=0
+EOF
+}
+
+
 # This function will check config parameters required
 check_config() {
     :

bin/hardening/6.7_disable_nfs_rpc.sh

@@ -21,7 +21,11 @@ audit () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed!"
+            if [ $ISEXCEPTION -eq 1 ]; then
+                warn "$PACKAGE is installed! But Exception is set to 1, so it's pass!"
+            else
+                crit "$PACKAGE is installed!"
+            fi
         else
             ok "$PACKAGE is absent"
         fi
@@ -33,15 +37,28 @@ apply () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed, purging it"
+            if [ $ISEXCEPTION -eq 1 ]; then
-            apt-get purge $PACKAGE -y
+                warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
-            apt-get autoremove
+            else
+                crit "$PACKAGE is installed, purging it"
+                apt-get purge $PACKAGE -y
+                apt-get autoremove
+            fi
         else
             ok "$PACKAGE is absent"
         fi
     done
 }
 
+# This function will create the config file for this check with default values
+create_config() {
+cat <<EOF
+status=disabled
+# Put here exception to pass this case, if set is 1, don't need apply, let to pass.
+ISEXCEPTION=0
+EOF
+}
+
 # This function will check config parameters required
 check_config() {
     :

bin/hardening/6.8_disable_dns_server.sh

@@ -21,7 +21,11 @@ audit () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed!"
+            if [ $ISEXCEPTION -eq 1 ]; then
+                warn "$PACKAGE is installed! But Exception is set to 1, so it's pass!"
+            else
+                crit "$PACKAGE is installed!"
+            fi
         else
             ok "$PACKAGE is absent"
         fi
@@ -33,15 +37,28 @@ apply () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed, purging it"
+            if [ $ISEXCEPTION -eq 1 ]; then
-            apt-get purge $PACKAGE -y
+                warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
-            apt-get autoremove
+            else
+                crit "$PACKAGE is installed, purging it"
+                apt-get purge $PACKAGE -y
+                apt-get autoremove
+            fi
         else
             ok "$PACKAGE is absent"
         fi
     done
 }
 
+# This function will create the config file for this check with default values
+create_config() {
+cat <<EOF
+status=disabled
+# Put here exception to pass this case, if set is 1, don't need apply, let to pass.
+ISEXCEPTION=0
+EOF
+}
+
 # This function will check config parameters required
 check_config() {
     :

bin/hardening/6.9_disable_ftp.sh

@@ -22,7 +22,11 @@ audit () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed!"
+            if [ $ISEXCEPTION -eq 1 ]; then
+                warn "$PACKAGE is installed! But Exception is set to 1, so it's pass!"
+            else
+                crit "$PACKAGE is installed!"
+            fi
         else
             ok "$PACKAGE is absent"
         fi
@@ -34,15 +38,28 @@ apply () {
     for PACKAGE in $PACKAGES; do
         is_pkg_installed $PACKAGE
         if [ $FNRET = 0 ]; then
-            crit "$PACKAGE is installed, purging it"
+            if [ $ISEXCEPTION -eq 1 ]; then
-            apt-get purge $PACKAGE -y
+                warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
-            apt-get autoremove
+            else
+                crit "$PACKAGE is installed, purging it"
+                apt-get purge $PACKAGE -y
+                apt-get autoremove
+            fi
         else
             ok "$PACKAGE is absent"
         fi
     done
 }
 
+# This function will create the config file for this check with default values
+create_config() {
+cat <<EOF
+status=disabled
+# Put here exception to pass this case, if set is 1, don't need apply, let to pass.
+ISEXCEPTION=0
+EOF
+}
+
 # This function will check config parameters required
 check_config() {
     :

bin/hardening/7.1.1_disable_ip_forwarding.sh

@@ -21,7 +21,11 @@ SYSCTL_EXP_RESULT=0
 audit () {
     has_sysctl_param_expected_result $SYSCTL_PARAM $SYSCTL_EXP_RESULT
     if [ $FNRET != 0 ]; then
-        crit "$SYSCTL_PARAM was not set to $SYSCTL_EXP_RESULT"
+        if [ $ISEXCEPTION -eq 1 ]; then
+            warn "$PACKAGE is installed! But Exception is set to 1, so it's pass!"
+        else
+            crit "$SYSCTL_PARAM was not set to $SYSCTL_EXP_RESULT"
+        fi
     elif [ $FNRET = 255 ]; then
         warn "$SYSCTL_PARAM does not exist -- Typo?"
     else
@@ -33,9 +37,13 @@ audit () {
 apply () {
     has_sysctl_param_expected_result $SYSCTL_PARAM $SYSCTL_EXP_RESULT
     if [ $FNRET != 0 ]; then
-        warn "$SYSCTL_PARAM was not set to $SYSCTL_EXP_RESULT -- Fixing"
+        if [ $ISEXCEPTION -eq 1 ]; then
-        set_sysctl_param $SYSCTL_PARAM $SYSCTL_EXP_RESULT
+            warn "$PACKAGE is installed! But the exception is set to true, so don't need any operate."
-        sysctl -w net.ipv4.route.flush=1 > /dev/null
+        else
+            warn "$SYSCTL_PARAM was not set to $SYSCTL_EXP_RESULT -- Fixing"
+            set_sysctl_param $SYSCTL_PARAM $SYSCTL_EXP_RESULT
+            sysctl -w net.ipv4.route.flush=1 > /dev/null
+        fi
     elif [ $FNRET = 255 ]; then
         warn "$SYSCTL_PARAM does not exist -- Typo?"
     else
@@ -43,6 +51,15 @@ apply () {
     fi
 }
 
+# This function will create the config file for this check with default values
+create_config() {
+cat <<EOF
+status=disabled
+# Put here exception to pass this case, if set is 1, don't need apply, let to pass.
+ISEXCEPTION=0
+EOF
+}
+
 # This function will check config parameters required
 check_config() {
     :