From f9c5a21dffd433d056b3c23259ac03cb1ecdeafd Mon Sep 17 00:00:00 2001 From: Samson-W Date: Tue, 9 Apr 2019 04:59:31 -0400 Subject: [PATCH] Fix some bug for 7.7.4 and 7.7.5 --- .../7.7.4_ensure_default_deny_firewall_policy.sh | 4 ++-- .../7.7.5_ensure_loopback_traffic_is_configured.sh | 13 +++++++------ 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/bin/hardening/7.7.4_ensure_default_deny_firewall_policy.sh b/bin/hardening/7.7.4_ensure_default_deny_firewall_policy.sh index 20b6cb9..5bb422b 100755 --- a/bin/hardening/7.7.4_ensure_default_deny_firewall_policy.sh +++ b/bin/hardening/7.7.4_ensure_default_deny_firewall_policy.sh @@ -20,9 +20,9 @@ IPS6=$(which ip6tables) # This function will be called if the script status is on enabled / audit mode audit () { - if [ $(${IPS4} -S | egrep "\-P") -eq 0 ]; then + if [ $(${IPS4} -S | grep -c "\-P") -eq 0 ]; then crit "Ip4tables: Firewall policy is not default deny!" - if [ $(${IPS6} -S | egrep "\-P") -eq 0 ]; then + if [ $(${IPS6} -S | grep -c "\-P") -eq 0 ]; then crit "Ip6tables: Firewall policy is not default deny!" FNRET=1 else diff --git a/bin/hardening/7.7.5_ensure_loopback_traffic_is_configured.sh b/bin/hardening/7.7.5_ensure_loopback_traffic_is_configured.sh index 01e38b2..8ed451d 100755 --- a/bin/hardening/7.7.5_ensure_loopback_traffic_is_configured.sh +++ b/bin/hardening/7.7.5_ensure_loopback_traffic_is_configured.sh @@ -15,13 +15,14 @@ set -u # One variable unset, it's over HARDENING_LEVEL=2 -IPS4=$(which iptables) -IPS6=$(which ip6tables) - +INPUT_ACCEPT=1 +OUTPUT_ACCEPT=1 +INPUT_DENY=1 + # This function will be called if the script status is on enabled / audit mode audit () { # Check the loopback interface to accept INPUT traffic. - ensure_lo_traffic_input_is_accept() + ensure_lo_traffic_input_is_accept if [ $FNRET = 0 ]; then INPUT_ACCEPT=0 ok "Iptables loopback traffic INPUT has configured!" @@ -30,7 +31,7 @@ audit () { crit "Iptables: loopback traffic INPUT is not configured!" fi # Check the loopback interface to accept OUTPUT traffic. - ensure_lo_traffic_output_is_accept() + ensure_lo_traffic_output_is_accept if [ $FNRET = 0 ]; then OUTPUT_ACCEPT=0 ok "Iptables loopback traffic OUTPUT has configured!" @@ -39,7 +40,7 @@ audit () { crit "Iptables: loopback traffic OUTPUT is not configured!" fi # all other interfaces to deny traffic to the loopback network. - ensure_lo_traffic_other_if_input_is_deny() + ensure_lo_traffic_other_if_input_is_deny if [ $FNRET = 0 ]; then INPUT_DENY=0 ok "Iptables loopback traffic INPUT deny from other interfaces has configured!"