elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-11-25 23:11:24 +01:00
Code Issues Packages Projects Releases Wiki Activity

IMP(5.4.1.1-3): add tests and rename some variables

Browse Source
This commit is contained in:
Thibault Ayanides 2020-10-30 09:39:42 +01:00
parent 9aac4c3504
commit 17e43753b9
6 changed files with 93 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
bin/hardening/5.4.1.1_set_password_exp_days.sh
View File

@ -15,7 +15,7 @@ HARDENING_LEVEL=3
DESCRIPTION="Set password expiration days." DESCRIPTION="Set password expiration days."
PACKAGE='login' PACKAGE='login'
OPTIONS='PASS_MAX_DAYS=90' OPTIONS=''
FILE='/etc/login.defs' FILE='/etc/login.defs'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
@ -25,10 +25,10 @@ audit () {
crit "$PACKAGE is not installed!" crit "$PACKAGE is not installed!"
else else
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
for SSH_OPTION in $OPTIONS; do for SHADOW_OPTION in $OPTIONS; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1) SHADOW_PARAM=$(echo $SHADOW_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2) SHADOW_VALUE=$(echo $SHADOW_OPTION | cut -d= -f 2)
PATTERN="^$SSH_PARAM[[:space:]]*$SSH_VALUE" PATTERN="^$SHADOW_PARAM[[:space:]]*$SHADOW_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN" does_pattern_exist_in_file $FILE "$PATTERN"
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
@ -48,26 +48,36 @@ apply () {
crit "$PACKAGE is absent, installing it" crit "$PACKAGE is absent, installing it"
apt_install $PACKAGE apt_install $PACKAGE
fi fi
for SSH_OPTION in $OPTIONS; do for SHADOW_OPTION in $OPTIONS; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1) SHADOW_PARAM=$(echo $SHADOW_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2) SHADOW_VALUE=$(echo $SHADOW_OPTION | cut -d= -f 2)
PATTERN="^$SSH_PARAM[[:space:]]*$SSH_VALUE" PATTERN="^$SHADOW_PARAM[[:space:]]*$SHADOW_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN" does_pattern_exist_in_file $FILE "$PATTERN"
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
else else
warn "$PATTERN is not present in $FILE, adding it" warn "$PATTERN is not present in $FILE, adding it"
does_pattern_exist_in_file $FILE "^$SSH_PARAM" does_pattern_exist_in_file $FILE "^$SHADOW_PARAM"
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
add_end_of_file $FILE "$SSH_PARAM $SSH_VALUE" add_end_of_file $FILE "$SHADOW_PARAM $SHADOW_VALUE"
else else
info "Parameter $SSH_PARAM is present but with the wrong value -- Fixing" info "Parameter $SHADOW_PARAM is present but with the wrong value -- Fixing"
replace_in_file $FILE "^$SSH_PARAM[[:space:]]*.*" "$SSH_PARAM $SSH_VALUE" replace_in_file $FILE "^$SHADOW_PARAM[[:space:]]*.*" "$SHADOW_PARAM $SHADOW_VALUE"
fi fi
fi fi
done done
} }
# This function will create the config file for this check with default values
create_config() {
cat << EOF
# shellcheck disable=2034
status=audit
# Put here your protocol for shadow
OPTIONS='PASS_MAX_DAYS=90'
EOF
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :

36
bin/hardening/5.4.1.2_set_password_min_days_change.sh
View File

@ -15,7 +15,7 @@ HARDENING_LEVEL=3
DESCRIPTION="Set password change minimum number of days." DESCRIPTION="Set password change minimum number of days."
PACKAGE='login' PACKAGE='login'
OPTIONS='PASS_MIN_DAYS=7' OPTIONS=''
FILE='/etc/login.defs' FILE='/etc/login.defs'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
@ -25,10 +25,10 @@ audit () {
crit "$PACKAGE is not installed!" crit "$PACKAGE is not installed!"
else else
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
for SSH_OPTION in $OPTIONS; do for SHADOW_OPTION in $OPTIONS; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1) SHADOW_PARAM=$(echo $SHADOW_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2) SHADOW_VALUE=$(echo $SHADOW_OPTION | cut -d= -f 2)
PATTERN="^$SSH_PARAM[[:space:]]*$SSH_VALUE" PATTERN="^$SHADOW_PARAM[[:space:]]*$SHADOW_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN" does_pattern_exist_in_file $FILE "$PATTERN"
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
@ -48,26 +48,36 @@ apply () {
crit "$PACKAGE is absent, installing it" crit "$PACKAGE is absent, installing it"
apt_install $PACKAGE apt_install $PACKAGE
fi fi
for SSH_OPTION in $OPTIONS; do for SHADOW_OPTION in $OPTIONS; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1) SHADOW_PARAM=$(echo $SHADOW_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2) SHADOW_VALUE=$(echo $SHADOW_OPTION | cut -d= -f 2)
PATTERN="^$SSH_PARAM[[:space:]]*$SSH_VALUE" PATTERN="^$SHADOW_PARAM[[:space:]]*$SHADOW_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN" does_pattern_exist_in_file $FILE "$PATTERN"
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
else else
warn "$PATTERN is not present in $FILE, adding it" warn "$PATTERN is not present in $FILE, adding it"
does_pattern_exist_in_file $FILE "^$SSH_PARAM" does_pattern_exist_in_file $FILE "^$SHADOW_PARAM"
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
add_end_of_file $FILE "$SSH_PARAM $SSH_VALUE" add_end_of_file $FILE "$SHADOW_PARAM $SHADOW_VALUE"
else else
info "Parameter $SSH_PARAM is present but with the wrong value -- Fixing" info "Parameter $SHADOW_PARAM is present but with the wrong value -- Fixing"
replace_in_file $FILE "^$SSH_PARAM[[:space:]]*.*" "$SSH_PARAM $SSH_VALUE" replace_in_file $FILE "^$SHADOW_PARAM[[:space:]]*.*" "$SHADOW_PARAM $SHADOW_VALUE"
fi fi
fi fi
done done
} }
# This function will create the config file for this check with default values
create_config() {
cat << EOF
# shellcheck disable=2034
status=audit
# Put here your protocol for shadow
OPTIONS='PASS_MIN_DAYS=7'
EOF
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :

36
bin/hardening/5.4.1.3_set_password_exp_warning_days.sh
View File

@ -15,7 +15,7 @@ HARDENING_LEVEL=3
DESCRIPTION="Set password expiration warning days." DESCRIPTION="Set password expiration warning days."
PACKAGE='login' PACKAGE='login'
OPTIONS='PASS_WARN_AGE=7' OPTIONS=''
FILE='/etc/login.defs' FILE='/etc/login.defs'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
@ -25,10 +25,10 @@ audit () {
crit "$PACKAGE is not installed!" crit "$PACKAGE is not installed!"
else else
ok "$PACKAGE is installed" ok "$PACKAGE is installed"
for SSH_OPTION in $OPTIONS; do for SHADOW_OPTION in $OPTIONS; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1) SHADOW_PARAM=$(echo $SHADOW_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2) SHADOW_VALUE=$(echo $SHADOW_OPTION | cut -d= -f 2)
PATTERN="^$SSH_PARAM[[:space:]]*$SSH_VALUE" PATTERN="^$SHADOW_PARAM[[:space:]]*$SHADOW_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN" does_pattern_exist_in_file $FILE "$PATTERN"
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
@ -48,21 +48,21 @@ apply () {
crit "$PACKAGE is absent, installing it" crit "$PACKAGE is absent, installing it"
apt_install $PACKAGE apt_install $PACKAGE
fi fi
for SSH_OPTION in $OPTIONS; do for SHADOW_OPTION in $OPTIONS; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1) SHADOW_PARAM=$(echo $SHADOW_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2) SHADOW_VALUE=$(echo $SHADOW_OPTION | cut -d= -f 2)
PATTERN="^$SSH_PARAM[[:space:]]*$SSH_VALUE" PATTERN="^$SHADOW_PARAM[[:space:]]*$SHADOW_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN" does_pattern_exist_in_file $FILE "$PATTERN"
if [ $FNRET = 0 ]; then if [ $FNRET = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
else else
warn "$PATTERN is not present in $FILE, adding it" warn "$PATTERN is not present in $FILE, adding it"
does_pattern_exist_in_file $FILE "^$SSH_PARAM" does_pattern_exist_in_file $FILE "^$SHADOW_PARAM"
if [ $FNRET != 0 ]; then if [ $FNRET != 0 ]; then
add_end_of_file $FILE "$SSH_PARAM $SSH_VALUE" add_end_of_file $FILE "$SHADOW_PARAM $SHADOW_VALUE"
else else
info "Parameter $SSH_PARAM is present but with the wrong value -- Fixing" info "Parameter $SHADOW_PARAM is present but with the wrong value -- Fixing"
replace_in_file $FILE "^$SSH_PARAM[[:space:]]*.*" "$SSH_PARAM $SSH_VALUE" replace_in_file $FILE "^$SHADOW_PARAM[[:space:]]*.*" "$SHADOW_PARAM $SHADOW_VALUE"
fi fi
fi fi
done done
@ -73,6 +73,16 @@ check_config() {
: :
} }
# This function will create the config file for this check with default values
create_config() {
cat << EOF
# shellcheck disable=2034
status=audit
# Put here your protocol for shadow
OPTIONS='PASS_WARN_AGE=7'
EOF
}
# Source Root Dir Parameter # Source Root Dir Parameter
if [ -r /etc/default/cis-hardening ]; then if [ -r /etc/default/cis-hardening ]; then
. /etc/default/cis-hardening . /etc/default/cis-hardening

9
tests/hardening/5.4.1.1_set_password_exp_days.sh
View File

@ -6,5 +6,12 @@ test_audit() {
# shellcheck disable=2154 # shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests describe Correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "[ OK ] ^PASS_MAX_DAYS[[:space:]]*90 is present in /etc/login.defs"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
} }

9
tests/hardening/5.4.1.2_set_password_min_days_change.sh
View File

@ -6,5 +6,12 @@ test_audit() {
# shellcheck disable=2154 # shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests describe Correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "[ OK ] ^PASS_MIN_DAYS[[:space:]]*7 is present in /etc/login.defs"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
} }

9
tests/hardening/5.4.1.3_set_password_exp_warning_days.sh
View File

@ -6,5 +6,12 @@ test_audit() {
# shellcheck disable=2154 # shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests describe Correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "[ OK ] ^PASS_WARN_AGE[[:space:]]*7 is present in /etc/login.defs"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
} }