tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-27 07:44:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Minor cleanup

Browse Source
This commit is contained in:
Michael Boelen 2019-07-15 19:57:23 +02:00
parent 08cbc6fe2e
commit 7ec81715aa
No known key found for this signature in database
GPG Key ID: 26141F77A09D7F04
1 changed files with 18 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
include/tests_usb
View File

@ -130,7 +130,6 @@
# #
################################################################################# #################################################################################
# #
# Test : USB-3000 # Test : USB-3000
# Description : Perform USBGuard check # Description : Perform USBGuard check
Register --test-no USB-3000 --os Linux --weight L --network NO --category security --description "Check for presence of USBGuard" Register --test-no USB-3000 --os Linux --weight L --network NO --category security --description "Check for presence of USBGuard"
@ -141,8 +140,8 @@
AddHP 1 1 AddHP 1 1
LogText "Checking USBGuard configuration file" LogText "Checking USBGuard configuration file"
if [ -f /etc/usbguard/usbguard-daemon.conf ]; then if [ -f ${ROOTDIR}etc/usbguard/usbguard-daemon.conf ]; then
USBGUARD_CONFIG="/etc/usbguard/usbguard-daemon.conf" USBGUARD_CONFIG="${ROOTDIR}etc/usbguard/usbguard-daemon.conf"
else else
USBGUARD_CONFIG="" USBGUARD_CONFIG=""
fi fi
@ -160,7 +159,7 @@
"true") "true")
Display --indent 6 --text "- Restore controller device state" --result "${USBGUARD_RESTORE_POLICY}" --color YELLOW Display --indent 6 --text "- Restore controller device state" --result "${USBGUARD_RESTORE_POLICY}" --color YELLOW
LogText " Consider changing RestoreControllerDeviceState to \"false\"" LogText " Consider changing RestoreControllerDeviceState to \"false\""
# To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion # TODO: assign TEST_NO, create documentation, and enable the suggestion
# ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "RestoreControllerDeviceState (${USBGUARD_RESTORE_POLICY} --> false)" # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "RestoreControllerDeviceState (${USBGUARD_RESTORE_POLICY} --> false)"
AddHP 0 1 AddHP 0 1
;; ;;
@ -171,7 +170,7 @@
*) *)
LogText "Result: Invalid configuration for RestoreControllerDeviceState" LogText "Result: Invalid configuration for RestoreControllerDeviceState"
Display --indent 6 --text "- Restore controller device state" --result "Invalid" --color RED Display --indent 6 --text "- Restore controller device state" --result "Invalid" --color RED
# To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion # TODO: assign TEST_NO, create documentation, and enable the suggestion
# ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "RestoreControllerDeviceState invalid \"${USBGUARD_RESTORE_POLICY}\"" # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "RestoreControllerDeviceState invalid \"${USBGUARD_RESTORE_POLICY}\""
AddHP 0 1 AddHP 0 1
;; ;;
@ -188,21 +187,21 @@
if [ ! -z "${USBGUARD_CONTROLLER_POLICY}" ]; then if [ ! -z "${USBGUARD_CONTROLLER_POLICY}" ]; then
LogText "Result: PresentControllerPolicy = ${USBGUARD_CONTROLLER_POLICY}" LogText "Result: PresentControllerPolicy = ${USBGUARD_CONTROLLER_POLICY}"
case "${USBGUARD_CONTROLLER_POLICY}" in case "${USBGUARD_CONTROLLER_POLICY}" in
"allow"|"keep") "allow" | "keep")
Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "${USBGUARD_CONTROLLER_POLICY}" --color YELLOW Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "${USBGUARD_CONTROLLER_POLICY}" --color YELLOW
LogText " Consider changing PresentControllerPolicy to \"apply-policy\", \"block\" or \"reject\"" LogText " Consider changing PresentControllerPolicy to \"apply-policy\", \"block\" or \"reject\""
# To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion # TODO: assign TEST_NO, create documentation, and enable the suggestion
# ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "PresentControllerPolicy (${USBGUARD_CONTROLLER_POLICY} --> (apply-policy|block|reject)" # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "PresentControllerPolicy (${USBGUARD_CONTROLLER_POLICY} --> (apply-policy|block|reject)"
AddHP 0 1 AddHP 0 1
;; ;;
"apply-policy"|"block"|"reject") "apply-policy" | "block" | "reject")
Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "${USBGUARD_CONTROLLER_POLICY}" --color GREEN Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "${USBGUARD_CONTROLLER_POLICY}" --color GREEN
AddHP 1 1 AddHP 1 1
;; ;;
*) *)
LogText "Result: Invalid configuration for PresentControllerPolicy" LogText "Result: Invalid configuration for PresentControllerPolicy"
Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "Invalid" --color RED Display --indent 6 --text "- Rule for controllers connected before daemon starts" --result "Invalid" --color RED
# To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion # TODO: assign TEST_NO, create documentation, and enable the suggestion
# ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "PresentControllerPolicy invalid \"${USBGUARD_CONTROLLER_POLICY}\"" # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "PresentControllerPolicy invalid \"${USBGUARD_CONTROLLER_POLICY}\""
AddHP 0 1 AddHP 0 1
;; ;;
@ -218,21 +217,21 @@
if [ ! -z "${USBGUARD_DEVICE_POLICY}" ]; then if [ ! -z "${USBGUARD_DEVICE_POLICY}" ]; then
LogText "Result: PresentDevicePolicy = ${USBGUARD_DEVICE_POLICY}" LogText "Result: PresentDevicePolicy = ${USBGUARD_DEVICE_POLICY}"
case "${USBGUARD_DEVICE_POLICY}" in case "${USBGUARD_DEVICE_POLICY}" in
"allow"|"keep") "allow" | "keep")
Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "${USBGUARD_DEVICE_POLICY}" --color YELLOW Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "${USBGUARD_DEVICE_POLICY}" --color YELLOW
LogText " Consider changing PresentDevicePolicy to \"apply-policy\", \"block\" or \"reject\"" LogText " Consider changing PresentDevicePolicy to \"apply-policy\", \"block\" or \"reject\""
# To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion # TODO: assign TEST_NO, create documentation, and enable the suggestion
# ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "PresentDevicePolicy (${USBGUARD_DEVICE_POLICY} --> (apply-policy|block|reject)" # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "PresentDevicePolicy (${USBGUARD_DEVICE_POLICY} --> (apply-policy|block|reject)"
AddHP 0 1 AddHP 0 1
;; ;;
"apply-policy"|"block"|"reject") "apply-policy" | "block" | "reject")
Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "${USBGUARD_DEVICE_POLICY}" --color GREEN Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "${USBGUARD_DEVICE_POLICY}" --color GREEN
AddHP 1 1 AddHP 1 1
;; ;;
*) *)
LogText "Result: Invalid configuration for PresentDevicePolicy" LogText "Result: Invalid configuration for PresentDevicePolicy"
Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "Invalid" --color RED Display --indent 6 --text "- Rule for devices connected before daemon starts" --result "Invalid" --color RED
# To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion # TODO: assign TEST_NO, create documentation, and enable the suggestion
# ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "PresentDevicePolicy invalid \"${USBGUARD_DEVICE_POLICY}\"" # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "PresentDevicePolicy invalid \"${USBGUARD_DEVICE_POLICY}\""
AddHP 0 1 AddHP 0 1
;; ;;
@ -248,21 +247,21 @@
if [ ! -z "${USBGUARD_INSERTED_POLICY}" ]; then if [ ! -z "${USBGUARD_INSERTED_POLICY}" ]; then
LogText "Result: InsertedDevicePolicy = ${USBGUARD_INSERTED_POLICY}" LogText "Result: InsertedDevicePolicy = ${USBGUARD_INSERTED_POLICY}"
case "${USBGUARD_INSERTED_POLICY}" in case "${USBGUARD_INSERTED_POLICY}" in
"allow"|"keep") "allow" | "keep")
Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "${USBGUARD_INSERTED_POLICY}" --color YELLOW Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "${USBGUARD_INSERTED_POLICY}" --color YELLOW
LogText " Consider changing InsertedDevicePolicy to \"apply-policy\", \"block\" or \"reject\"" LogText " Consider changing InsertedDevicePolicy to \"apply-policy\", \"block\" or \"reject\""
# To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion # TODO: assign TEST_NO, create documentation, and enable the suggestion
# ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "InsertedDevicePolicy (${USBGUARD_INSERTED_POLICY} --> (apply-policy|block|reject)" # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "InsertedDevicePolicy (${USBGUARD_INSERTED_POLICY} --> (apply-policy|block|reject)"
AddHP 0 1 AddHP 0 1
;; ;;
"apply-policy"|"block"|"reject") "apply-policy" | "block" | "reject")
Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "${USBGUARD_INSERTED_POLICY}" --color GREEN Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "${USBGUARD_INSERTED_POLICY}" --color GREEN
AddHP 1 1 AddHP 1 1
;; ;;
*) *)
LogText "Result: Invalid configuration for InsertedDevicePolicy" LogText "Result: Invalid configuration for InsertedDevicePolicy"
Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "Invalid" --color RED Display --indent 6 --text "- Rule for devices inserted after daemon starts" --result "Invalid" --color RED
# To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion # TODO: assign TEST_NO, create documentation, and enable the suggestion
# ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "InsertedDevicePolicy invalid \"${USBGUARD_INSERTED_POLICY}\"" # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "InsertedDevicePolicy invalid \"${USBGUARD_INSERTED_POLICY}\""
AddHP 0 1 AddHP 0 1
;; ;;
@ -281,7 +280,7 @@
"allow") "allow")
Display --indent 6 --text "- Rule for devices not in RuleFile" --result "${USBGUARD_DEFAULT_POLICY}" --color YELLOW Display --indent 6 --text "- Rule for devices not in RuleFile" --result "${USBGUARD_DEFAULT_POLICY}" --color YELLOW
LogText " Consider changing ImplicitPolicyTarget to \"block\" or \"reject\"" LogText " Consider changing ImplicitPolicyTarget to \"block\" or \"reject\""
# To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion # TODO: assign TEST_NO, create documentation, and enable the suggestion
# ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "ImplicitPolicyTarget (${USBGUARD_DEFAULT_POLICY} --> (block|reject)" # ReportSuggestion ${TEST_NO} "Consider hardening USBGuard configuration" "ImplicitPolicyTarget (${USBGUARD_DEFAULT_POLICY} --> (block|reject)"
AddHP 0 1 AddHP 0 1
;; ;;
@ -292,7 +291,7 @@
*) *)
LogText "Result: Invalid configuration for ImplicitPolicyTarget" LogText "Result: Invalid configuration for ImplicitPolicyTarget"
Display --indent 6 --text "- Rule for devices not in RuleFile" --result "Invalid" --color RED Display --indent 6 --text "- Rule for devices not in RuleFile" --result "Invalid" --color RED
# To-Be-Added: assign TEST_NO, create documentation, and enable the suggestion # TODO: assign TEST_NO, create documentation, and enable the suggestion
# ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "ImplicitPolicyTarget invalid \"${USBGUARD_DEFAULT_POLICY}\"" # ReportSuggestion ${TEST_NO} "Fix USBGuard configuration" "ImplicitPolicyTarget invalid \"${USBGUARD_DEFAULT_POLICY}\""
AddHP 0 1 AddHP 0 1
;; ;;