tyler.durden/harbian-audit
1
0
Fork 0
mirror of https://github.com/hardenedlinux/harbian-audit.git synced 2025-07-27 15:44:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

Modify the compatibility of check_password_by_pam function.

Browse Source
This commit is contained in:
Samson-W 2018-10-16 07:53:08 +08:00
parent 28ae3cb88f
commit efd22bfbc6
13 changed files with 51 additions and 47 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
bin/hardening/10.1.9_set_fail_delay_seconds.sh
View File

@ -1,22 +1,29 @@
#!/bin/bash #!/bin/bash
# #
# harbian audit 9 Hardening # harbian audit 7/8/9 Hardening
# #
# #
# 10.1.9 Set FAIL_DELAY to wait to allow login when the last login failed (Scored) # 10.1.9 Set FAIL_DELAY Parameters Using pam_faildelay (Scored)
# Authors : Samson wen, Samson <sccxboy@gmail.com> # Authors : Samson wen, Samson <sccxboy@gmail.com>
# #
set -e # One error, it's over set -e # One error, it's over
set -u # One variable unset, it's over set -u # One variable unset, it's over
HARDENING_LEVEL=3 HARDENING_LEVEL=2
PACKAGE='login'
OPTIONS='FAIL_DELAY=4' PACKAGE='libpam-modules'
FILE='/etc/login.defs' PAMLIBNAME='pam_faildelay.so'
PATTERN='^auth.*pam_faildelay.so'
FILE='/etc/pam.d/login'
OPTIONNAME='delay'
# condition (microseconds)
CONDT_VAL=4000000
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
@ -26,43 +33,39 @@ audit () {
FNRET=1 FNRET=1
else else
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
for SSH_OPTION in $OPTIONS; do does_pattern_exist_in_file $FILE $PATTERN
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2)
PATTERN="^$SSH_PARAM[[:space:]]*"
does_pattern_exist_in_file $FILE "$PATTERN"
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
if [ $(sed -e '/^#/d' -e '/^[ \t][ \t]*#/d' -e 's/#.*$//' -e '/^$/d' /etc/login.defs | grep FAIL_DELAY | awk '{print $2}') -lt $SSH_VALUE ]; then check_password_by_pam $FILE $PAMLIBNAME $OPTIONNAME ge $CONDT_VAL
crit "$SSH_PARAM value is less than $SSH_VALUE" if [ $FNRET = 0 ]; then
FNRET=3 ok "$OPTIONNAME set condition is $CONDT_VAL"
else else
ok "$SSH_PARAM value is equal or greater to $SSH_VALUE" crit "$OPTIONNAME set condition is not $CONDT_VAL"
FNRET=0
fi fi
else else
crit "$PATTERN is not present in $FILE" crit "$PATTERN is not present in $FILE"
FNRET=2 FNRET=2
fi fi
done
fi fi
} }
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2)
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "FAIL_DELAY is set" ok "$PACKAGE is installed"
elif [ $FNRET = 1 ]; then elif [ $FNRET = 1 ]; then
crit "$PACKAGE is absent, installing it" crit "$PACKAGE is absent, installing it"
apt_install $PACKAGE apt_install $PACKAGE
elif [ $FNRET = 2 ]; then elif [ $FNRET = 2 ]; then
warn "$SSH_PARAM is not present in $FILE, adding it" crit "$PATTERN is not present in $FILE, add default config to $FILE"
add_end_of_file $FILE "$SSH_PARAM $SSH_VALUE" add_line_file_before_pattern $FILE "auth optional pam_faildelay.so delay=4000000" "# Outputs an issue file prior to each login prompt (Replaces the"
elif [ $FNRET = 3 ]; then elif [ $FNRET = 3 ]; then
info "Parameter $SSH_PARAM is present but with the wrong value -- Fixing" crit "$OPTIONNAME set is not match legally, reset it to $CONDT_VAL"
replace_in_file $FILE "^$SSH_PARAM[[:space:]]*.*" "$SSH_PARAM $SSH_VALUE" reset_option_to_password_check $FILE $PAMLIBNAME "$OPTIONNAME" "$CONDT_VAL"
elif [ $FNRET = 4 ]; then
crit "444"
elif [ $FNRET = 5 ]; then
crit "555555555555"
fi fi
} }

2
bin/hardening/9.2.10_enable_maxclassrepeat_cracklib.sh
View File

@ -35,7 +35,7 @@ audit () {
does_pattern_exist_in_file $FILE $PATTERN does_pattern_exist_in_file $FILE $PATTERN
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
check_password_by_pam $PAMLIBNAME $OPTIONNAME le $CONDT_VAL check_password_by_pam $FILE $PAMLIBNAME $OPTIONNAME le $CONDT_VAL
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL" ok "$OPTIONNAME set condition is $CONDT_VAL"
else else

2
bin/hardening/9.2.12_limit_password_reuse.sh
View File

@ -31,7 +31,7 @@ audit () {
does_pattern_exist_in_file $FILE $PATTERN does_pattern_exist_in_file $FILE $PATTERN
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
check_password_by_pam $KEYWORD $OPTIONNAME ge $CONDT_VAL check_password_by_pam $FILE $KEYWORD $OPTIONNAME ge $CONDT_VAL
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition to $CONDT_VAL is ok" ok "$OPTIONNAME set condition to $CONDT_VAL is ok"
else else

2
bin/hardening/9.2.1_enable_retry_cracklib.sh
View File

@ -35,7 +35,7 @@ audit () {
does_pattern_exist_in_file $FILE $PATTERN does_pattern_exist_in_file $FILE $PATTERN
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
check_password_by_pam $PAMLIBNAME $OPTIONNAME le $CONDT_VAL check_password_by_pam $FILE $PAMLIBNAME $OPTIONNAME le $CONDT_VAL
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL" ok "$OPTIONNAME set condition is $CONDT_VAL"
else else

2
bin/hardening/9.2.2_enable_minlen_cracklib.sh
View File

@ -35,7 +35,7 @@ audit () {
does_pattern_exist_in_file $FILE $PATTERN does_pattern_exist_in_file $FILE $PATTERN
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
check_password_by_pam $PAMLIBNAME $OPTIONNAME ge $CONDT_VAL check_password_by_pam $FILE $PAMLIBNAME $OPTIONNAME ge $CONDT_VAL
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL" ok "$OPTIONNAME set condition is $CONDT_VAL"
else else

2
bin/hardening/9.2.3_enable_dcredit_cracklib.sh
View File

@ -35,7 +35,7 @@ audit () {
does_pattern_exist_in_file $FILE $PATTERN does_pattern_exist_in_file $FILE $PATTERN
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
check_password_by_pam $PAMLIBNAME $OPTIONNAME le $CONDT_VAL check_password_by_pam $FILE $PAMLIBNAME $OPTIONNAME le $CONDT_VAL
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL" ok "$OPTIONNAME set condition is $CONDT_VAL"
else else

2
bin/hardening/9.2.4_enable_ucredit_cracklib.sh
View File

@ -35,7 +35,7 @@ audit () {
does_pattern_exist_in_file $FILE $PATTERN does_pattern_exist_in_file $FILE $PATTERN
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
check_password_by_pam $PAMLIBNAME $OPTIONNAME le $CONDT_VAL check_password_by_pam $FILE $PAMLIBNAME $OPTIONNAME le $CONDT_VAL
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL" ok "$OPTIONNAME set condition is $CONDT_VAL"
else else

2
bin/hardening/9.2.5_enable_ocredit_cracklib.sh
View File

@ -35,7 +35,7 @@ audit () {
does_pattern_exist_in_file $FILE $PATTERN does_pattern_exist_in_file $FILE $PATTERN
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
check_password_by_pam $PAMLIBNAME $OPTIONNAME le $CONDT_VAL check_password_by_pam $FILE $PAMLIBNAME $OPTIONNAME le $CONDT_VAL
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL" ok "$OPTIONNAME set condition is $CONDT_VAL"
else else

2
bin/hardening/9.2.6_enable_lcredit_cracklib.sh
View File

@ -35,7 +35,7 @@ audit () {
does_pattern_exist_in_file $FILE $PATTERN does_pattern_exist_in_file $FILE $PATTERN
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
check_password_by_pam $PAMLIBNAME $OPTIONNAME le $CONDT_VAL check_password_by_pam $FILE $PAMLIBNAME $OPTIONNAME le $CONDT_VAL
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL" ok "$OPTIONNAME set condition is $CONDT_VAL"
else else

2
bin/hardening/9.2.7_enable_difok_cracklib.sh
View File

@ -35,7 +35,7 @@ audit () {
does_pattern_exist_in_file $FILE $PATTERN does_pattern_exist_in_file $FILE $PATTERN
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
check_password_by_pam $PAMLIBNAME $OPTIONNAME ge $CONDT_VAL check_password_by_pam $FILE $PAMLIBNAME $OPTIONNAME ge $CONDT_VAL
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL" ok "$OPTIONNAME set condition is $CONDT_VAL"
else else

2
bin/hardening/9.2.8_enable_minclass_cracklib.sh
View File

@ -35,7 +35,7 @@ audit () {
does_pattern_exist_in_file $FILE $PATTERN does_pattern_exist_in_file $FILE $PATTERN
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
check_password_by_pam $PAMLIBNAME $OPTIONNAME ge $CONDT_VAL check_password_by_pam $FILE $PAMLIBNAME $OPTIONNAME ge $CONDT_VAL
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL" ok "$OPTIONNAME set condition is $CONDT_VAL"
else else

2
bin/hardening/9.2.9_enable_maxrepeat_cracklib.sh
View File

@ -35,7 +35,7 @@ audit () {
does_pattern_exist_in_file $FILE $PATTERN does_pattern_exist_in_file $FILE $PATTERN
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
check_password_by_pam $PAMLIBNAME $OPTIONNAME le $CONDT_VAL check_password_by_pam $FILE $PAMLIBNAME $OPTIONNAME le $CONDT_VAL
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$OPTIONNAME set condition is $CONDT_VAL" ok "$OPTIONNAME set condition is $CONDT_VAL"
else else

13
lib/utils.sh
View File

@ -443,14 +443,15 @@ verify_integrity_all_packages()
check_password_by_pam() check_password_by_pam()
{ {
KEYWORD=$1 LOCATION=$1
OPTION=$2 KEYWORD=$2
COMPARE=$3 OPTION=$3
CONDITION=$4 COMPARE=$4
CONDITION=$5
LOCATION="/etc/pam.d/common-password"
#Example: #Example:
#LOCATION="/etc/pam.d/common-password"
#LOCATION="/etc/pam.d/login"
#KEYWORD="pam_cracklib.so" #KEYWORD="pam_cracklib.so"
#OPTION="ocredit" #OPTION="ocredit"
#COMPARE="gt" #COMPARE="gt"