tyler.durden
/
harbian-audit
mirror of https://github.com/hardenedlinux/harbian-audit.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix some bugs for CentOS8.

This commit is contained in:
Samson-W 2019-12-28 04:28:09 +08:00
parent 912ba677ff
commit fa9d907985
9 changed files with 77 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bin/hardening/10.2_disable_system_accounts.sh
View File

@ -20,7 +20,7 @@ RESULT=''
# This function will be called if the script status is on enabled / audit mode
audit () {
info "Checking if admin accounts have a login shell different than $SHELL"
RESULT=$(egrep -v "^\+" $FILE | awk -F: '($1!="root" && $1!="sync" && $1!="shutdown" && $1!="halt" && $3<1000 && $7!="/usr/sbin/nologin" && $7!="/bin/false") {print}')
RESULT=$(egrep -v "^\+" $FILE | awk -F: '($1!="root" && $1!="sync" && $1!="shutdown" && $1!="halt" && $3<1000 && $7!="/usr/sbin/nologin" && $7!="/bin/false" && $7!="/sbin/nologin") {print}')
IFS=$'\n'
for LINE in $RESULT; do
debug "line : $LINE"

2
bin/hardening/11.2_remove_os_info_warning_banners.sh
View File

@ -14,7 +14,7 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=3
FILES='/etc/motd /etc/issue /etc/issue.net'
PATTERN='(\\v|\\r|\\m|\\s|Debian)'
PATTERN='(\\v|\\r|\\m|\\s|Debian|CentOS)'
# This function will be called if the script status is on enabled / audit mode
audit () {

8
bin/hardening/12.10_find_suid_files.sh
View File

@ -28,14 +28,20 @@ audit () {
crit "Some suid files are present"
FORMATTED_RESULT=$(sed "s/ /\n/g" <<< $RESULT | sort | uniq | tr '\n' ' ')
crit "$FORMATTED_RESULT"
FNRET=1
else
ok "No unknown suid files found"
FNRET=0
fi
}
# This function will be called if the script status is on enabled mode
apply () {
warn "Removing suid on valid binary may seriously harm your system, report only here, need a manual fix."
if [ $FNRET = 1 ]; then
warn "Removing suid on valid binary may seriously harm your system, report only here, need a manual fix."
else
ok "No unknown suid files found"
fi
}
# This function will create the config file for this check with default values

8
bin/hardening/12.11_find_sgid_files.sh
View File

@ -29,14 +29,20 @@ audit () {
crit "Some sgid files are present"
FORMATTED_RESULT=$(sed "s/ /\n/g" <<< $RESULT | sort | uniq | tr '\n' ' ')
crit "$FORMATTED_RESULT"
FNRET=1
else
ok "No unknown sgid files found"
FNRET=0
fi
}
# This function will be called if the script status is on enabled mode
apply () {
info "Removing sgid on valid binary may seriously harm your system, report only here"
if [ $FNRET = 1 ]; then
warn "Removing sgid on valid binary may seriously harm your system, report only here"
else
ok "No unknown sgid files found"
fi
}
# This function will create the config file for this check with default values

14
bin/hardening/12.13_etc_gshadow_backup_permissions.sh
View File

@ -16,11 +16,19 @@ HARDENING_LEVEL=1
FILE='/etc/gshadow-'
PERMISSIONS='600'
PERMISSIONS_REDHAT='0000'
USER='root'
GROUP='shadow'
GROUP_REDHAT='root'
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 2 ]; then
PERMISSIONS=$PERMISSIONS_REDHAT
GROUP=$GROUP_REDHAT
else
:
fi
has_file_correct_ownership $FILE $USER $GROUP
if [ $FNRET = 0 ]; then
ok "$FILE has correct ownership"
@ -37,6 +45,12 @@ audit () {
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 2 ]; then
PERMISSIONS=$PERMISSIONS_REDHAT
GROUP=$GROUP_REDHAT
else
:
fi
has_file_correct_ownership $FILE $USER $GROUP
if [ $FNRET = 0 ]; then
ok "$FILE has correct ownership"

14
bin/hardening/12.2_etc_shadow_permissions.sh
View File

@ -16,11 +16,19 @@ HARDENING_LEVEL=1
FILE='/etc/shadow'
PERMISSIONS='640'
PERMISSIONS_REDHAT='0000'
USER='root'
GROUP='shadow'
GROUP_REDHAT='root'
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 2 ]; then
PERMISSIONS=$PERMISSIONS_REDHAT
GROUP=$GROUP_REDHAT
else
:
fi
has_file_correct_ownership $FILE $USER $GROUP
if [ $FNRET = 0 ]; then
ok "$FILE has correct ownership"
@ -37,6 +45,12 @@ audit () {
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 2 ]; then
PERMISSIONS=$PERMISSIONS_REDHAT
GROUP=$GROUP_REDHAT
else
:
fi
has_file_correct_ownership $FILE $USER $GROUP
if [ $FNRET = 0 ]; then
ok "$FILE has correct ownership"

14
bin/hardening/12.4_etc_gshadow_permissions.sh
View File

@ -16,11 +16,19 @@ HARDENING_LEVEL=1
FILE='/etc/gshadow'
PERMISSIONS='640'
PERMISSIONS_REDHAT='0000'
USER='root'
GROUP='shadow'
GROUP_REDHAT='root'
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 2 ]; then
PERMISSIONS=$PERMISSIONS_REDHAT
GROUP=$GROUP_REDHAT
else
:
fi
has_file_correct_ownership $FILE $USER $GROUP
if [ $FNRET = 0 ]; then
ok "$FILE has correct ownership"
@ -37,6 +45,12 @@ audit () {
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 2 ]; then
PERMISSIONS=$PERMISSIONS_REDHAT
GROUP=$GROUP_REDHAT
else
:
fi
has_file_correct_ownership $FILE $USER $GROUP
if [ $FNRET = 0 ]; then
ok "$FILE has correct ownership"

14
bin/hardening/12.6_etc_shadow_backup_permissions.sh
View File

@ -16,11 +16,19 @@ HARDENING_LEVEL=1
FILE='/etc/shadow-'
PERMISSIONS='600'
PERMISSIONS_REDHAT='0000'
USER='root'
GROUP='shadow'
GROUP_REDHAT='root'
# This function will be called if the script status is on enabled / audit mode
audit () {
if [ $OS_RELEASE -eq 2 ]; then
PERMISSIONS=$PERMISSIONS_REDHAT
GROUP=$GROUP_REDHAT
else
:
fi
has_file_correct_ownership $FILE $USER $GROUP
if [ $FNRET = 0 ]; then
ok "$FILE has correct ownership"
@ -37,6 +45,12 @@ audit () {
# This function will be called if the script status is on enabled mode
apply () {
if [ $OS_RELEASE -eq 2 ]; then
PERMISSIONS=$PERMISSIONS_REDHAT
GROUP=$GROUP_REDHAT
else
:
fi
has_file_correct_ownership $FILE $USER $GROUP
if [ $FNRET = 0 ]; then
ok "$FILE has correct ownership"

6
bin/hardening/13.6_sanitize_root_path.sh
View File

@ -62,7 +62,11 @@ audit () {
# This function will be called if the script status is on enabled mode
apply () {
warn "Editing items from PATH may seriously harm your system, report only here, need a manual fix."
if [ $ERRORS = 0 ]; then
ok "root PATH is secure"
else
warn "Editing items from PATH may seriously harm your system, report only here, need a manual fix."
fi
}
# This function will check config parameters required