elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2025-09-03 13:18:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: add debian12 scripts

Browse Source 
- password_number_changed_chars.sh	-> 5.3.3.2.1
- password_dictcheck_enabled.sh 	-> 5.3.3.2.6
- password_quality_enforced.sh 		-> 5.3.3.2.7
- password_quality_enforced_for_root.sh -> 5.3.3.2.8
This commit is contained in:
damien cavagnini
2025-08-12 11:38:16 +02:00
parent 94f110d9b3
commit 3bbc6c435a
8 changed files with 506 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
tests/hardening/password_dictcheck_enabled.sh Normal file
View File

@@ -0,0 +1,28 @@
# shellcheck shell=bash
# run-shellcheck
test_audit() {
# prepare to fail
describe Prepare on purpose failed test
apt-get install -y libpam-pwquality
sed -E -i '/^[[:space:]]?dictcheck/d' /etc/security/pwquality.conf
echo "pam_pwquality.so dictcheck=0" >/usr/share/pam-configs/test_cis.conf
describe Running on purpose failed test
register_test retvalshouldbe 1
# shellcheck disable=2154
run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
describe correcting situation
sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
describe clean test
rm -f /usr/share/pam-configs/test_cis.conf
apt-get remove -y libpam-pwquality
}

28
tests/hardening/password_number_changed_chars.sh Normal file
View File

@@ -0,0 +1,28 @@
# shellcheck shell=bash
# run-shellcheck
test_audit() {
# prepare to fail
describe Prepare on purpose failed test
apt-get install -y libpam-pwquality
sed -E -i '/^[[:space:]]?difok/d' /etc/security/pwquality.conf
echo "pam_pwquality.so difok=1" >/usr/share/pam-configs/test_cis.conf
describe Running on purpose failed test
register_test retvalshouldbe 1
# shellcheck disable=2154
run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
describe correcting situation
sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
describe clean test
rm -f /usr/share/pam-configs/test_cis.conf
apt-get remove -y libpam-pwquality
}

29
tests/hardening/password_quality_enforced.sh Normal file
View File

@@ -0,0 +1,29 @@
# shellcheck shell=bash
# run-shellcheck
test_audit() {
# prepare to fail
describe Prepare on purpose failed test
apt-get install -y libpam-pwquality
sed -E -i '/^[[:space:]]?enforcing/d' /etc/security/pwquality.conf
echo "enforcing = 0" >>/etc/security/pwquality.conf
echo "pam_pwquality.so enforcing=0" >/usr/share/pam-configs/test_cis.conf
describe Running on purpose failed test
register_test retvalshouldbe 1
# shellcheck disable=2154
run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
describe correcting situation
sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
describe clean test
rm -f /usr/share/pam-configs/test_cis.conf
apt-get remove -y libpam-pwquality
}

26
tests/hardening/password_quality_enforced_for_root.sh Normal file
View File

@@ -0,0 +1,26 @@
# shellcheck shell=bash
# run-shellcheck
test_audit() {
# prepare to fail
describe Prepare on purpose failed test
apt-get install -y libpam-pwquality
sed -E -i '/^[[:space:]]?enforce_for_root/d' /etc/security/pwquality.conf
describe Running on purpose failed test
register_test retvalshouldbe 1
# shellcheck disable=2154
run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
describe correcting situation
sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
describe clean test
apt-get remove -y libpam-pwquality
}