debian-cis/lib/main.sh

# shellcheck shell=bash
# run-shellcheck

LONG_SCRIPT_NAME=$(basename $0)
SCRIPT_NAME=${LONG_SCRIPT_NAME%.sh}
# Variable initialization, to avoid crash
CRITICAL_ERRORS_NUMBER=0 # This will be used to see if a script failed, or passed
BATCH_MODE=0
BATCH_OUTPUT=""
status=""
forcedstatus=""
SUDO_CMD=""

[ -r $CIS_ROOT_DIR/lib/constants.sh  ] && . $CIS_ROOT_DIR/lib/constants.sh
[ -r $CIS_ROOT_DIR/etc/hardening.cfg ] && . $CIS_ROOT_DIR/etc/hardening.cfg
[ -r $CIS_ROOT_DIR/lib/common.sh     ] && . $CIS_ROOT_DIR/lib/common.sh
[ -r $CIS_ROOT_DIR/lib/utils.sh      ] && . $CIS_ROOT_DIR/lib/utils.sh

# Environment Sanitizing
export PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'

# Arguments parsing
while [[ $# > 0 ]]; do
    ARG="$1"
    case $ARG in
        --audit-all)
            debug "Audit all specified, setting status to audit regardless of configuration"
            forcedstatus=auditall
        ;;
        --audit)
        if [ "$status" != 'disabled' -a "$status" != 'false' ]; then
            debug "Audit argument detected, setting status to audit"
            forcedstatus=audit
        else
            info "Audit argument passed but script is disabled"
        fi
        ;;
        --create-config-files-only)
            debug "Create config files"
            forcedstatus=createconfig
        ;;
        --sudo)
        SUDO_CMD="sudo_wrapper"
        ;;
        --batch)
            debug "Auditing in batch mode, will limit output by setting LOGLEVEL to 'ok'."
            BATCH_MODE=1
            LOGLEVEL=ok
            [ -r $CIS_ROOT_DIR/lib/common.sh     ] && . $CIS_ROOT_DIR/lib/common.sh
        ;;
        *)
            debug "Unknown option passed"
        ;;
    esac
    shift
done

info "Working on $SCRIPT_NAME"
info "[DESCRIPTION] $DESCRIPTION"

# Source specific configuration file
if ! [ -r $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg ] ; then
    # If it doesn't exist, create it with default values
    echo "# Configuration for $SCRIPT_NAME, created from default values on `date`" > $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg
    # If create_config is a defined function, execute it.
    # Otherwise, just disable the test by default.
    if type -t create_config | grep -qw function ; then
        create_config >> $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg
    else
        echo "status=audit" >> $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg
    fi

fi

if [ "$forcedstatus" = "createconfig" ] ; then
    debug "$CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg has been created"
    exit 0
fi

[ -r $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg ] && . $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg

# Now check configured value for status, and potential cmdline parameter
if [ "$forcedstatus" = "auditall" ] ; then
    # We want to audit even disabled script, so override config value in any case
    status=audit
elif [ "$forcedstatus" = "audit" ] ; then
    # We want to audit only enabled scripts
    if [ "$status" != 'disabled' -a "$status" != 'false' ]; then
        debug "Audit argument detected, setting status to audit"
        status=audit
    else
        info "Audit argument passed but script is disabled"
    fi
fi

if [ -z $status ]; then
    crit "Could not find status variable for $SCRIPT_NAME, considered as disabled"

    exit 2
fi


case $status in
    enabled | true )
        info "Checking Configuration"
        check_config
        info "Performing audit"
        audit # Perform audit
        info "Applying Hardening"
        apply # Perform hardening
        ;;
    audit )
        info "Checking Configuration"
        check_config
        info "Performing audit"
        audit # Perform audit
        ;;
    disabled | false )
        info "$SCRIPT_NAME is disabled, ignoring"
        exit 2 # Means unknown status
        ;;
    *)
        warn "Wrong value for status : $status. Must be [ enabled | true | audit | disabled | false ]"
        ;;
esac

if [ $CRITICAL_ERRORS_NUMBER -eq 0 ]; then
    if [ $BATCH_MODE -eq 1 ]; then
        BATCH_OUTPUT="OK $SCRIPT_NAME $BATCH_OUTPUT"
        becho $BATCH_OUTPUT
    else
        ok "Check Passed"
    fi
    exit 0 # Means ok status
else
    if [ $BATCH_MODE -eq 1 ]; then
        BATCH_OUTPUT="KO $SCRIPT_NAME $BATCH_OUTPUT"
        becho $BATCH_OUTPUT
    else
        crit "Check Failed"
    fi
    exit 1 # Means critical status
fi