skeleton

README

@@ -1 +1,2 @@
 # CIS Debian 7 Hardening git repository
+# This is the code base which will be used to fill CIS hardening requirements

bin/hardening/1.1_Install_Updates.sh

@@ -5,7 +5,7 @@
 #
 
 #
-# Hardening script skeleton replace this line with proper point treated
+# 1.1 Install Updates, Patches and Additional Security Software (Not Scored)
 #
 
 set -e # One error, it's over
@@ -21,11 +21,12 @@ apply () {
     :
 }
 
-# Environment Sanitizing
+# This function will check config parameters required
-export PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
+check_config() {
+    :
+}
 
 # Source Root Dir Parameter
-
 if [ ! -r /etc/default/cis-hardenning ]; then
     echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
     exit 128
@@ -36,39 +37,4 @@ else
     fi
 fi 
 
-LONG_SCRIPT_NAME=$(basename $0)
+[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh
-SCRIPT_NAME=${LONG_SCRIPT_NAME%.sh}
-# Variable initialization, to avoid crash
-status=""
-params=""
-
-[ -r $CIS_ROOT_DIR/lib/constants.sh ] && . $CIS_ROOT_DIR/lib/constants.sh
-[ -r $CIS_ROOT_DIR/lib/utils.sh     ] && . $CIS_ROOT_DIR/lib/utils.sh
-[ -r $CIS_ROOT_DIR/lib/common.sh    ] && . $CIS_ROOT_DIR/lib/common.sh
-
-# Source general configuration file and Specific configuration file if exist
-
-[ -r $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg ] && . $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg
-
-logger "Working on $SCRIPT_NAME"
-
-if [ -z $status ]; then
-    logger "Could not find status variable for $SCRIPT_NAME, considered as disabled"
-    exit 0
-fi
-
-case $status in
-    enabled | true ) 
-        audit $params # Perform audit
-        apply $params # Perform hardening
-        ;;
-    audit )
-        audit $params # Perform audit
-        ;;
-    disabled | false )
-        logger "$SCRIPT_NAME is disabled, ignoring"
-        ;;
-    *)
-        logger "Wrong value for status : $status. Must be [ enabled | true | audit | disabled | false ]"
-        ;;
-esac

etc/conf.d/.gitignore

@@ -1 +0,0 @@
-*.cfg

etc/conf.d/1.1_Install_Updates.cfg

@@ -0,0 +1,2 @@
+# Configuration for script of same name
+status=disabled

etc/hardening.cfg

@@ -1,5 +1,5 @@
 # CIS Debian 7 Hardening
 # Main Configuration File, put here global variables
 
-# Valid values are verbose info warning error
+# Valid values are debug info warning error
-LOGLEVEL=verbose
+LOGLEVEL=debug

lib/common.sh

@@ -1,7 +1,50 @@
 # CIS Debian 7 Hardening common functions
 
-logger() {
+# Logging functions
+
+case $LOGLEVEL in
+    error )
+        MACHINE_LOG_LEVEL=1
+        ;;
+    warning )
+        MACHINE_LOG_LEVEL=2
+        ;;
+    info )
+        MACHINE_LOG_LEVEL=3
+        ;;
+    debug )
+        MACHINE_LOG_LEVEL=4
+        ;;
+    *)
+        MACHINE_LOG_LEVEL=3 ## Default loglevel value to info
+esac
+
+_logger() {
+    COLOR=$1
+    shift
     test -z "$SCRIPT_NAME" && SCRIPT_NAME=$(basename $0)
-    /usr/bin/logger -i -t "$SCRIPT_NAME" -p "user.info" "$*"
+    /usr/bin/logger -t "[CIS_Hardening] $SCRIPT_NAME" -p "user.info" "$*"
-    test -t 1 && echo "$*"
+    test -t 1 && cecho $COLOR "$SCRIPT_NAME $*"
+}
+
+cecho () {
+    COLOR=$1
+    shift
+    echo -e "${COLOR}$*${NC}"
+}
+
+info () { 
+    [ $MACHINE_LOG_LEVEL -ge 3 ] && _logger $BWHITE "[INFO] $*"
+}
+
+warn () {
+    [ $MACHINE_LOG_LEVEL -ge 2 ] && _logger $BYELLOW "[WARN] $*"
+}
+
+crit () {
+    [ $MACHINE_LOG_LEVEL -ge 1 ] && _logger $BRED "[ KO ] $*"
+}
+
+debug () {
+    [ $MACHINE_LOG_LEVEL -ge 4 ] && _logger $GRAY "[DBG ] $*"
 }

lib/constants.sh

@@ -21,13 +21,15 @@
 
 # Reset Color (for syslog)
 NC='\033[0m'
-
+WHITE='\033[0m'
 # Colors
-RED='\033[1;31m'
+RED='\033[0;31m'
-GREEN='\033[1;32m'
+GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
+YELLOW='\033[0;33m'
+GRAY='\033[0;40m'        # Gray
 
 # Bold
 BRED='\033[1;31m'         # Red
 BGREEN='\033[1;32m'       # Green
 BYELLOW='\033[1;33m'      # Yellow
+BWHITE='\033[1;37m'       # White

lib/main.sh

@@ -0,0 +1,41 @@
+LONG_SCRIPT_NAME=$(basename $0)
+SCRIPT_NAME=${LONG_SCRIPT_NAME%.sh}
+# Variable initialization, to avoid crash
+status=""
+
+[ -r $CIS_ROOT_DIR/lib/constants.sh  ] && . $CIS_ROOT_DIR/lib/constants.sh
+[ -r $CIS_ROOT_DIR/etc/hardening.cfg ] && . $CIS_ROOT_DIR/etc/hardening.cfg
+[ -r $CIS_ROOT_DIR/lib/common.sh     ] && . $CIS_ROOT_DIR/lib/common.sh
+[ -r $CIS_ROOT_DIR/lib/utils.sh      ] && . $CIS_ROOT_DIR/lib/utils.sh
+
+# Source specific configuration file
+[ -r $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg ] && . $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg
+
+# Environment Sanitizing
+export PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
+
+info "Working on $SCRIPT_NAME"
+
+if [ -z $status ]; then
+    crit "Could not find status variable for $SCRIPT_NAME, considered as disabled"
+    exit 0
+fi
+
+case $status in
+    enabled | true ) 
+        info "Performing audit"
+        audit # Perform audit
+        info "Applying Hardening"
+        apply # Perform hardening
+        ;;
+    audit )
+        info "Performing audit"
+        audit # Perform audit
+        ;;
+    disabled | false )
+        info "$SCRIPT_NAME is disabled, ignoring"
+        ;;
+    *)
+        warn "Wrong value for status : $status. Must be [ enabled | true | audit | disabled | false ]"
+        ;;
+esac

src/skel

@@ -0,0 +1,41 @@
+#!/bin/bash
+
+#
+# CIS Debian 7 Hardening
+#
+
+#
+# Hardening script skeleton replace this line with proper point treated
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+# This function will be called if the script status is on enabled / audit mode
+audit () {
+    :
+}
+
+# This function will be called if the script status is on enabled mode
+apply () {
+    :
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ ! -r /etc/default/cis-hardenning ]; then
+    echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
+    exit 128
+else
+    . /etc/default/cis-hardenning
+    if [ -z $CIS_ROOT_DIR ]; then
+        echo "No CIS_ROOT_DIR variable, aborting"
+    fi
+fi 
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

src/skel.sh

@@ -1,74 +0,0 @@
-#!/bin/bash
-
-#
-# CIS Debian 7 Hardening
-#
-
-#
-# Hardening script skeleton replace this line with proper point treated
-#
-
-set -e # One error, it's over
-set -u # One variable unset, it's over
-
-# This function will be called if the script status is on enabled / audit mode
-audit () {
-    :
-}
-
-# This function will be called if the script status is on enabled mode
-apply () {
-    :
-}
-
-# Environment Sanitizing
-export PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
-
-# Source Root Dir Parameter
-
-if [ ! -r /etc/default/cis-hardenning ]; then
-    echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
-    exit 128
-else
-    . /etc/default/cis-hardenning
-    if [ -z $CIS_ROOT_DIR ]; then
-        echo "No CIS_ROOT_DIR variable, aborting"
-    fi
-fi 
-
-LONG_SCRIPT_NAME=$(basename $0)
-SCRIPT_NAME=${LONG_SCRIPT_NAME%.sh}
-# Variable initialization, to avoid crash
-status=""
-params=""
-
-[ -r $CIS_ROOT_DIR/lib/constants.sh ] && . $CIS_ROOT_DIR/lib/constants.sh
-[ -r $CIS_ROOT_DIR/lib/utils.sh     ] && . $CIS_ROOT_DIR/lib/utils.sh
-[ -r $CIS_ROOT_DIR/lib/common.sh    ] && . $CIS_ROOT_DIR/lib/common.sh
-[ -r $CIS_ROOT_DIR/etc/hardening.cfg ] && . $CIS_ROOT_DIR/etc/hardening.cfg
-# Source general configuration file and Specific configuration file if exist
-
-[ -r $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg ] && . $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg
-
-logger "Working on $SCRIPT_NAME"
-
-if [ -z $status ]; then
-    logger "Could not find status variable for $SCRIPT_NAME, considered as disabled"
-    exit 0
-fi
-
-case $status in
-    enabled | true ) 
-        audit $params # Perform audit
-        apply $params # Perform hardening
-        ;;
-    audit )
-        audit $params # Perform audit
-        ;;
-    disabled | false )
-        logger "$SCRIPT_NAME is disabled, ignoring"
-        ;;
-    *)
-        logger "Wrong value for status : $status. Must be [ enabled | true | audit | disabled | false ]"
-        ;;
-esac