elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-11-22 13:37:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add missing HARDENING_LEVEL (#44)

Browse Source 
Co-authored-by: GoldenKiwi <thibault.dewailly@corp.ovh.com>
This commit is contained in:
Thibault Ayanides 2021-02-17 11:51:51 +01:00 committed by GitHub
parent d1b371f410
commit 40fb536d4e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
8 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
bin/hardening/99.1.1.23_disable_usb_devices.sh
View File

@ -13,6 +13,9 @@ set -e # One error, it's over
set -u # One variable unset, it's over set -u # One variable unset, it's over
USER='root' USER='root'
# shellcheck disable=2034
HARDENING_LEVEL=2
# shellcheck disable=2034 # shellcheck disable=2034
DESCRIPTION="USB devices are disabled." DESCRIPTION="USB devices are disabled."

2
bin/hardening/99.1.3_acc_sudoers_no_all.sh
View File

@ -12,6 +12,8 @@
set -e # One error, it's over set -e # One error, it's over
set -u # One variable unset, it's over set -u # One variable unset, it's over
# shellcheck disable=2034
HARDENING_LEVEL=2
# shellcheck disable=2034 # shellcheck disable=2034
DESCRIPTION="Checks there are no carte-blanche authorization in sudoers file(s)." DESCRIPTION="Checks there are no carte-blanche authorization in sudoers file(s)."

1
bin/hardening/99.5.2.3_ssh_disable_features.sh
View File

@ -13,6 +13,7 @@ set -e # One error, it's over
set -u # One variable unset, it's over set -u # One variable unset, it's over
# shellcheck disable=2034 # shellcheck disable=2034
HARDENING_LEVEL=3
# shellcheck disable=2034 # shellcheck disable=2034
DESCRIPTION="Check all special features in sshd_config are disabled" DESCRIPTION="Check all special features in sshd_config are disabled"

2
bin/hardening/99.5.2.4_ssh_keys_from.sh
View File

@ -12,6 +12,8 @@
set -e # One error, it is over set -e # One error, it is over
set -u # One variable unset, it is over set -u # One variable unset, it is over
# shellcheck disable=2034
HARDENING_LEVEL=3
# shellcheck disable=2034 # shellcheck disable=2034
DESCRIPTION="Check <from> field in ssh authorized keys files for users with login shell, and allowed IP if available." DESCRIPTION="Check <from> field in ssh authorized keys files for users with login shell, and allowed IP if available."

2
bin/hardening/99.5.2.5_ssh_strict_modes.sh
View File

@ -12,6 +12,8 @@
set -e # One error, it's over set -e # One error, it's over
set -u # One variable unset, it's over set -u # One variable unset, it's over
# shellcheck disable=2034
HARDENING_LEVEL=2
# shellcheck disable=2034 # shellcheck disable=2034
DESCRIPTION="Ensure home directory and ssh sensitive files are verified (not publicly readable) before connecting." DESCRIPTION="Ensure home directory and ssh sensitive files are verified (not publicly readable) before connecting."

3
bin/hardening/99.5.2.7_ssh_sys_no_legacy.sh
View File

@ -12,8 +12,11 @@
set -e # One error, it's over set -e # One error, it's over
set -u # One variable unset, it's over set -u # One variable unset, it's over
# shellcheck disable=2034
HARDENING_LEVEL=3
# shellcheck disable=2034 # shellcheck disable=2034
DESCRIPTION="Ensure that legacy services rlogin, rlogind and rcp are disabled and not installed" DESCRIPTION="Ensure that legacy services rlogin, rlogind and rcp are disabled and not installed"
# shellcheck disable=2034 # shellcheck disable=2034
SERVICES="rlogin rlogind rcp" SERVICES="rlogin rlogind rcp"

6
bin/hardening/99.5.4.5.1_acc_logindefs_sha512.sh
View File

@ -6,14 +6,16 @@
# #
# #
# 99.5.4.5.1 Check that any password that may exist in /etc/shadow is SHA512 hashed and salted # 99.5.4.5.1 Check that any password that will be created will be SHA512 hashed and salted
# #
set -e # One error, it's over set -e # One error, it's over
set -u # One variable unset, it's over set -u # One variable unset, it's over
# shellcheck disable=2034 # shellcheck disable=2034
DESCRIPTION="Check that any password that may exist in /etc/shadow is SHA512 hashed and salted" HARDENING_LEVEL=2
# shellcheck disable=2034
DESCRIPTION="Check that any password that will be created will be SHA512 hashed and salted"
CONF_FILE="/etc/login.defs" CONF_FILE="/etc/login.defs"
CONF_LINE="ENCRYPT_METHOD SHA512" CONF_LINE="ENCRYPT_METHOD SHA512"

2
bin/hardening/99.5.4.5.2_acc_shadow_sha512.sh
View File

@ -12,6 +12,8 @@
set -e # One error, it's over set -e # One error, it's over
set -u # One variable unset, it's over set -u # One variable unset, it's over
# shellcheck disable=2034
HARDENING_LEVEL=2
# shellcheck disable=2034 # shellcheck disable=2034
DESCRIPTION="Check that any password that may exist in /etc/shadow is SHA512 hashed and salted" DESCRIPTION="Check that any password that may exist in /etc/shadow is SHA512 hashed and salted"
FILE="/etc/shadow" FILE="/etc/shadow"