tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Modified 2.2 2.3 2.4 to be compatible with CentOS.

This commit is contained in:
Samson-W 2019-08-01 12:10:41 +08:00
parent 674e034324
commit f4633c21af
3 changed files with 48 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
bin/hardening/2.2_tmp_nodev.sh
View File

@ -47,10 +47,10 @@ audit () {
else
warn "$PARTITION is not partition in /etc/fstab, check tmp.mount service"
if [ -e $SERVICEPATH -o -e $REDHAT_SERVICEPATH ]; then
if [ $OS_RELEASE -eq 1 ]; then
has_mount_option_systemd $SERVICEPATH $OPTION
elif [ $OS_RELEASE -eq 2 ]; then
has_mount_option_systemd $REDHAT_SERVICEPATH $OPTION
if [ $OS_RELEASE -eq 2 ]; then
has_mount_option_systemd $REDHAT_SERVICEPATH $OPTION
else
has_mount_option_systemd $SERVICEPATH $OPTION
fi
if [ $FNRET -gt 0 ]; then
crit "$PARTITION has no option $OPTION in systemd service!"
@ -67,10 +67,10 @@ audit () {
fi
fi
else
if [ $OS_RELEASE -eq 1 ]; then
crit "$SERVICEPATH is not exist!"
elif [ $OS_RELEASE -eq 2 ]; then
crit "$REDHAT_SERVICEPATH is not exist!"
if [ $OS_RELEASE -eq 2 ]; then
crit "$REDHAT_SERVICEPATH is not exist!"
else
crit "$SERVICEPATH is not exist!"
fi
FNRET=2
fi
@ -95,10 +95,10 @@ apply () {
fi
elif [ $FNRET = 3 ]; then
info "Adding $OPTION to systemd"
if [ $OS_RELEASE -eq 1 ]; then
add_option_to_systemd $SERVICEPATH $OPTION $SERVICENAME
elif [ $OS_RELEASE -eq 2 ]; then
add_option_to_systemd $REDHAT_SERVICEPATH $OPTION $SERVICENAME
if [ $OS_RELEASE -eq 2 ]; then
add_option_to_systemd $REDHAT_SERVICEPATH $OPTION $SERVICENAME
else
add_option_to_systemd $SERVICEPATH $OPTION $SERVICENAME
fi
remount_partition_by_systemd $SERVICENAME $PARTITION
elif [ $FNRET = 4 ]; then

23
bin/hardening/2.3_tmp_nosuid.sh
View File

@ -1,7 +1,7 @@
#!/bin/bash
#
# harbian audit Debian 7/8/9 Hardening
# harbian audit Debian 7/8/9/10 or CentOS Hardening
# Modify by: Samson-W (sccxboy@gmail.com)
#
@ -19,6 +19,7 @@ PARTITION="/tmp"
OPTION="nosuid"
SERVICEPATH="/usr/share/systemd/tmp.mount"
SERVICENAME="tmp.mount"
REDHAT_SERVICEPATH="/usr/lib/systemd/system/tmp.mount"
# This function will be called if the script status is on enabled / audit mode
audit () {
@ -45,8 +46,12 @@ audit () {
fi
else
warn "$PARTITION is not partition in /etc/fstab, check tmp.mount service"
if [ -e $SERVICEPATH ]; then
has_mount_option_systemd $SERVICEPATH $OPTION
if [ -e $SERVICEPATH -o -e $REDHAT_SERVICEPATH ]; then
if [ $OS_RELEASE -eq 2 ]; then
has_mount_option_systemd $REDHAT_SERVICEPATH $OPTION
else
has_mount_option_systemd $SERVICEPATH $OPTION
fi
if [ $FNRET -gt 0 ]; then
crit "$PARTITION has no option $OPTION in systemd service!"
FNRET=3
@ -62,7 +67,11 @@ audit () {
fi
fi
else
crit "$TMPMOUNTO is not exist!"
if [ $OS_RELEASE -eq 2 ]; then
crit "$REDHAT_SERVICEPATH is not exist!"
else
crit "$SERVICEPATH is not exist!"
fi
FNRET=2
fi
fi
@ -86,7 +95,11 @@ apply () {
fi
elif [ $FNRET = 3 ]; then
info "Adding $OPTION to systemd"
add_option_to_systemd $SERVICEPATH $OPTION $SERVICENAME
if [ $OS_RELEASE -eq 2 ]; then
add_option_to_systemd $REDHAT_SERVICEPATH $OPTION $SERVICENAME
else
add_option_to_systemd $SERVICEPATH $OPTION $SERVICENAME
fi
remount_partition_by_systemd $SERVICENAME $PARTITION
elif [ $FNRET = 4 ]; then
info "Remounting $PARTITION from fstab"

23
bin/hardening/2.4_tmp_noexec.sh
View File

@ -1,7 +1,7 @@
#!/bin/bash
#
# harbian audit Debian 7/8/9 Hardening
# harbian audit Debian 7/8/9/10 or CentOS Hardening
# Modify by: Samson-W (sccxboy@gmail.com)
#
@ -19,6 +19,7 @@ PARTITION="/tmp"
OPTION="noexec"
SERVICEPATH="/usr/share/systemd/tmp.mount"
SERVICENAME="tmp.mount"
REDHAT_SERVICEPATH="/usr/lib/systemd/system/tmp.mount"
# This function will be called if the script status is on enabled / audit mode
audit () {
@ -45,8 +46,12 @@ audit () {
fi
else
warn "$PARTITION is not partition in /etc/fstab, check tmp.mount service"
if [ -e $SERVICEPATH ]; then
has_mount_option_systemd $SERVICEPATH $OPTION
if [ -e $SERVICEPATH -o -e $REDHAT_SERVICEPATH ]; then
if [ $OS_RELEASE -eq 2 ]; then
has_mount_option_systemd $REDHAT_SERVICEPATH $OPTION
else
has_mount_option_systemd $SERVICEPATH $OPTION
fi
if [ $FNRET -gt 0 ]; then
crit "$PARTITION has no option $OPTION in systemd service!"
FNRET=3
@ -62,7 +67,11 @@ audit () {
fi
fi
else
crit "$TMPMOUNTO is not exist!"
if [ $OS_RELEASE -eq 2 ]; then
crit "$REDHAT_SERVICEPATH is not exist!"
else
crit "$SERVICEPATH is not exist!"
fi
FNRET=2
fi
fi
@ -86,7 +95,11 @@ apply () {
fi
elif [ $FNRET = 3 ]; then
info "Adding $OPTION to systemd"
add_option_to_systemd $SERVICEPATH $OPTION $SERVICENAME
if [ $OS_RELEASE -eq 2 ]; then
add_option_to_systemd $REDHAT_SERVICEPATH $OPTION $SERVICENAME
else
add_option_to_systemd $SERVICEPATH $OPTION $SERVICENAME
fi
remount_partition_by_systemd $SERVICENAME $PARTITION
elif [ $FNRET = 4 ]; then
info "Remounting $PARTITION from fstab"