From 3ac82210f0e16a284a9686a5ee108da10fb4d1ad Mon Sep 17 00:00:00 2001 From: "thibault.dewailly" Date: Wed, 13 Apr 2016 14:54:35 +0200 Subject: [PATCH] 7.1.1_disable_ip_forwarding.sh 7.1.2_disable_send_packet_redirects.sh --- bin/hardening/7.1.1_disable_ip_forwarding.sh | 61 ++++++++++++++++ .../7.1.2_disable_send_packet_redirects.sh | 71 +++++++++++++++++++ etc/conf.d/7.1.1_disable_ip_forwarding.cfg | 2 + .../7.1.2_disable_send_packet_redirects.cfg | 2 + lib/utils.sh | 2 +- 5 files changed, 137 insertions(+), 1 deletion(-) create mode 100755 bin/hardening/7.1.1_disable_ip_forwarding.sh create mode 100755 bin/hardening/7.1.2_disable_send_packet_redirects.sh create mode 100644 etc/conf.d/7.1.1_disable_ip_forwarding.cfg create mode 100644 etc/conf.d/7.1.2_disable_send_packet_redirects.cfg diff --git a/bin/hardening/7.1.1_disable_ip_forwarding.sh b/bin/hardening/7.1.1_disable_ip_forwarding.sh new file mode 100755 index 0000000..47ef9d9 --- /dev/null +++ b/bin/hardening/7.1.1_disable_ip_forwarding.sh @@ -0,0 +1,61 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# Authors : Thibault Dewailly, OVH +# + +# +# 7.1.1 Disable IP Forwarding (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +SYSCTL_PARAM='net.ipv4.ip_forward' +SYSCTL_EXP_RESULT=0 + +# This function will be called if the script status is on enabled / audit mode +audit () { + has_sysctl_param_expected_result $SYSCTL_PARAM $SYSCTL_EXP_RESULT + if [ $FNRET != 0 ]; then + crit "$SYSCTL_PARAM has not $SYSCTL_EXP_RESULT value !" + elif [ $FNRET = 255 ]; then + warn "$SYSCTL_PARAM does not exist, typo ?" + else + ok "$SYSCTL_PARAM correctly set to $SYSCTL_EXP_RESULT" + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + has_sysctl_param_expected_result $SYSCTL_PARAM $SYSCTL_EXP_RESULT + if [ $FNRET != 0 ]; then + warn "$SYSCTL_PARAM has not $SYSCTL_EXP_RESULT value, correcting it" + set_sysctl_param $SYSCTL_PARAM $SYSCTL_EXP_RESULT + sysctl -w net.ipv4.route.flush=1 > /dev/null + elif [ $FNRET = 255 ]; then + warn "$SYSCTL_PARAM does not exist, typo ?" + else + ok "$SYSCTL_PARAM correctly set to $SYSCTL_EXP_RESULT" + fi +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/7.1.2_disable_send_packet_redirects.sh b/bin/hardening/7.1.2_disable_send_packet_redirects.sh new file mode 100755 index 0000000..2fcd772 --- /dev/null +++ b/bin/hardening/7.1.2_disable_send_packet_redirects.sh @@ -0,0 +1,71 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# Authors : Thibault Dewailly, OVH +# + +# +# 7.1.2 Disable Send Packet Redirects (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over +#net.ipv4.conf.all.send_redirects = 0 +#net.ipv4.conf.default.send_redirects = 0 +SYSCTL_PARAMS='net.ipv4.conf.all.send_redirects=0 net.ipv4.conf.default.send_redirects=0' + +# This function will be called if the script status is on enabled / audit mode +audit () { + for SYSCTL_VALUES in $SYSCTL_PARAMS; do + SYSCTL_PARAM=$(echo $SYSCTL_VALUES | cut -d= -f 1) + SYSCTL_EXP_RESULT=$(echo $SYSCTL_VALUES | cut -d= -f 2) + debug "$SYSCTL_PARAM must have $SYSCTL_EXP_RESULT" + has_sysctl_param_expected_result $SYSCTL_PARAM $SYSCTL_EXP_RESULT + if [ $FNRET != 0 ]; then + crit "$SYSCTL_PARAM has not $SYSCTL_EXP_RESULT value !" + elif [ $FNRET = 255 ]; then + warn "$SYSCTL_PARAM does not exist, typo ?" + else + ok "$SYSCTL_PARAM correctly set to $SYSCTL_EXP_RESULT" + fi + done +} + +# This function will be called if the script status is on enabled mode +apply () { + for SYSCTL_VALUES in $SYSCTL_PARAMS; do + SYSCTL_PARAM=$(echo $SYSCTL_VALUES | cut -d= -f 1) + SYSCTL_EXP_RESULT=$(echo $SYSCTL_VALUES | cut -d= -f 2) + debug "$SYSCTL_PARAM must have $SYSCTL_EXP_RESULT" + has_sysctl_param_expected_result $SYSCTL_PARAM $SYSCTL_EXP_RESULT + if [ $FNRET != 0 ]; then + warn "$SYSCTL_PARAM has not $SYSCTL_EXP_RESULT value, correcting it" + set_sysctl_param $SYSCTL_PARAM $SYSCTL_EXP_RESULT + sysctl -w net.ipv4.route.flush=1 > /dev/null + elif [ $FNRET = 255 ]; then + warn "$SYSCTL_PARAM does not exist, typo ?" + else + ok "$SYSCTL_PARAM correctly set to $SYSCTL_EXP_RESULT" + fi + done +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/etc/conf.d/7.1.1_disable_ip_forwarding.cfg b/etc/conf.d/7.1.1_disable_ip_forwarding.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/7.1.1_disable_ip_forwarding.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/7.1.2_disable_send_packet_redirects.cfg b/etc/conf.d/7.1.2_disable_send_packet_redirects.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/7.1.2_disable_send_packet_redirects.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/lib/utils.sh b/lib/utils.sh index 781e045..db46e5d 100644 --- a/lib/utils.sh +++ b/lib/utils.sh @@ -25,7 +25,7 @@ set_sysctl_param() { debug "Setting $SYSCTL_PARAM to $VALUE" if [ "$(sysctl -w $SYSCTL_PARAM=$VALUE 2>/dev/null)" = "$SYSCTL_PARAM = $VALUE" ]; then FNRET=0 - elif [ $? != 0 ]; then + elif [ $? = 255 ]; then debug "$SYSCTL_PARAM does not exist" FNRET=255 else