tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-29 16:54:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1561 from nser77/nser77-patch-1

Browse Source 
FIRE-4508 - Portability, hardening and output
This commit is contained in:
Michael Boelen 2024-10-16 12:27:04 +02:00 committed by GitHub
commit 3c9b37986a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 27 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
include/tests_firewalls
View File

@ -137,43 +137,43 @@
if [ "${IPTABLES_TABLE}" = "filter" ] || [ "${IPTABLES_TABLE}" = "security" ]; then if [ "${IPTABLES_TABLE}" = "filter" ] || [ "${IPTABLES_TABLE}" = "security" ]; then
if [ "${IPTABLES_CHAIN}" = "INPUT" ]; then if [ "${IPTABLES_CHAIN}" = "INPUT" ]; then
if [ "${IPTABLES_TARGET}" = "ACCEPT" ]; then if [ "${IPTABLES_TARGET}" = "ACCEPT" ]; then
IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE} ${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} YELLOW" IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} YELLOW 1 3"
AddHP 1 3
elif [ "${IPTABLES_TARGET}" = "DROP" ]; then elif [ "${IPTABLES_TARGET}" = "DROP" ]; then
IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE} ${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} GREEN" IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} GREEN 3 3"
AddHP 3 3
fi fi
fi fi
if [ "${IPTABLES_CHAIN}" = "INPUT" ] || [ "${IPTABLES_CHAIN}" = "FORWARD" ] || [ "${IPTABLES_CHAIN}" = "OUTPUT" ]; then if [ "${IPTABLES_CHAIN}" = "INPUT" ] || [ "${IPTABLES_CHAIN}" = "FORWARD" ] || [ "${IPTABLES_CHAIN}" = "OUTPUT" ]; then
if [ "${IPTABLES_TARGET}" = "NFQUEUE" ]; then if [ "${IPTABLES_TARGET}" = "NFQUEUE" ]; then
IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE} ${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} RED" IPTABLES_OUTPUT_QUEUE="${IPTABLES_OUTPUT_QUEUE}\n${IPTABLES_TABLE} ${IPTABLES_CHAIN} ${IPTABLES_TARGET} RED 0 3"
AddHP 0 3
fi fi
fi fi
fi fi
done done
# Sort output if sort tool is available if [ -n "${IPTABLES_OUTPUT_QUEUE}" ]; then
if [ -n "${SORTBINARY}" ]; then # Sort output if sort tool is available
LogText "Info: sorting output" if [ -n "${SORTBINARY}" ]; then
IPTABLES_OUTPUT="$(echo "${IPTABLES_OUTPUT_QUEUE}" | ${SORTBINARY} -u )" LogText "Info: sorting output"
else IPTABLES_OUTPUT="$(printf '%b' "${IPTABLES_OUTPUT_QUEUE}" | ${SORTBINARY} -u )"
IPTABLES_OUTPUT="${IPTABLES_OUTPUT_QUEUE}" else
fi IPTABLES_OUTPUT="$(printf '%b' "${IPTABLES_OUTPUT_QUEUE}")"
echo "${IPTABLES_OUTPUT}" | while IFS="$(printf '\n')" read -r IPTABLES_OUTPUT_LINE
do
if [ -n "$IPTABLES_OUTPUT_LINE" ]; then
set -- ${IPTABLES_OUTPUT_LINE}
while [ $# -gt 0 ]; do
LogText "Result: Found target '${3}' for chain '${2}' (table: ${1})"
Display --indent 6 --text "- Chain ${2} (table: ${1}, target: ${3})" --result "${3}" --color "${4}"
if [ "${3}" = "NFQUEUE" ]
then
ReportSuggestion "${TEST_NO}" "Consider avoid ${3} target if possible (iptables chain ${2}, table: ${1})"
fi
shift 4
done
fi fi
done printf '%b\n' "${IPTABLES_OUTPUT}" | while IFS="$(printf '\n')" read -r IPTABLES_OUTPUT_LINE
do
if [ -n "$IPTABLES_OUTPUT_LINE" ]; then
set -- ${IPTABLES_OUTPUT_LINE}
while [ $# -gt 0 ]; do
LogText "Result: Found target '${3}' for chain '${2}' (table: ${1})"
Display --indent 6 --text "- Chain ${2} (table: ${1}, target: ${3})" --result "${3}" --color "${4}"
if [ "${3}" = "NFQUEUE" ]
then
ReportSuggestion "${TEST_NO}" "Consider avoid ${3} target if possible (iptables chain ${2}, table: ${1})"
fi
AddHP "${5}" "${6}"
shift 6
done
fi
done
fi
} }
unset IPTABLES_TABLE unset IPTABLES_TABLE
done done