8.2.1_install_syslog-ng.sh 8.2.2_enable_syslog-ng.sh 8.2.3_configure_syslog-ng.sh 8.2.4_set_logfile_perm.sh

bin/hardening/2.25_disable_automounting.sh

@@ -31,7 +31,7 @@ apply () {
     is_service_enabled $SERVICE_NAME
     if [ $FNRET = 0 ]; then
         info "Disabling $SERVICE_NAME"
-        update-rc.d $SERVICE_NAME disable > /dev/null 2>&1
+        update-rc.d $SERVICE_NAME remove > /dev/null 2>&1
     else
         ok "$SERVICE_NAME is disabled"
     fi

bin/hardening/3.2_bootloader_permissions.sh

@@ -40,7 +40,6 @@ apply () {
 
 # This function will check config parameters required
 check_config() {
-
     is_pkg_installed "grub-pc"
     if [ $FNRET != 0 ]; then
         warn "grub-pc is not installed, not handling configuration"

bin/hardening/8.2.1_install_syslog-ng.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+
+#
+# CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
+#
+
+#
+# 8.2.1 Install the syslog-ng package (Scored)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+# NB : in CIS, rsyslog has been chosen, however we chose syslog-ng
+PACKAGE='syslog-ng'
+
+# This function will be called if the script status is on enabled / audit mode
+audit () {
+    is_pkg_installed $PACKAGE
+    if [ $FNRET != 0 ]; then
+        crit "$PACKAGE is not installed !"
+    else
+        ok "$PACKAGE is installed"
+    fi
+}
+
+# This function will be called if the script status is on enabled mode
+apply () {
+        is_pkg_installed $PACKAGE
+        if [ $FNRET = 0 ]; then
+            ok "$PACKAGE is installed"
+        else
+            crit "$PACKAGE is absent, installing it"
+            apt_install $PACKAGE
+        fi
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ ! -r /etc/default/cis-hardenning ]; then
+    echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
+    exit 128
+else
+    . /etc/default/cis-hardenning
+    if [ -z $CIS_ROOT_DIR ]; then
+        echo "No CIS_ROOT_DIR variable, aborting"
+    fi
+fi 
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

bin/hardening/8.2.2_enable_syslog-ng.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+
+#
+# CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
+#
+
+#
+# 8.2.2 Ensure the syslog-ng Service is activated (Scored)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+SERVICE_NAME="syslog-ng"
+
+# This function will be called if the script status is on enabled / audit mode
+audit () {
+    info "Checking if $SERVICE_NAME is enabled"
+    is_service_enabled $SERVICE_NAME
+    if [ $FNRET = 0 ]; then
+        ok "$SERVICE_NAME is enabled"
+    else
+        crit "$SERVICE_NAME is disabled"
+    fi
+}
+
+# This function will be called if the script status is on enabled mode
+apply () {
+    info "Checking if $SERVICE_NAME is enabled"
+    is_service_enabled $SERVICE_NAME
+    if [ $FNRET != 0 ]; then
+        info "Enabling $SERVICE_NAME"
+        update-rc.d $SERVICE_NAME remove > /dev/null 2>&1
+        update-rc.d $SERVICE_NAME defaults > /dev/null 2>&1
+    else
+        ok "$SERVICE_NAME is enabled"
+    fi
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ ! -r /etc/default/cis-hardenning ]; then
+    echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
+    exit 128
+else
+    . /etc/default/cis-hardenning
+    if [ -z $CIS_ROOT_DIR ]; then
+        echo "No CIS_ROOT_DIR variable, aborting"
+    fi
+fi 
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

bin/hardening/8.2.3_configure_syslog-ng.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+
+#
+# CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
+#
+
+#
+# 8.2.3 Configure /etc/syslog-ng/syslog-ng.conf (Not Scored)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+SERVICE_NAME="syslog-ng"
+
+# This function will be called if the script status is on enabled / audit mode
+audit () {
+    info "Ensure default and local facilities are preserved on the system"
+    info "No measure here, please review the file by yourself"
+}
+
+# This function will be called if the script status is on enabled mode
+apply () {
+    info "Ensure default and local facilities are preserved on the system"
+    info "No measure here, please review the file by yourself"
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ ! -r /etc/default/cis-hardenning ]; then
+    echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
+    exit 128
+else
+    . /etc/default/cis-hardenning
+    if [ -z $CIS_ROOT_DIR ]; then
+        echo "No CIS_ROOT_DIR variable, aborting"
+    fi
+fi 
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

bin/hardening/8.2.4_set_logfile_perm.sh

@@ -0,0 +1,89 @@
+#!/bin/bash
+
+#
+# CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
+#
+
+#
+# 8.2.4 Create and Set Permissions on rsyslog Log Files (Scored)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+FILES=$(grep "file(" /etc/syslog-ng/syslog-ng.conf | grep '"' | cut -d'"' -f 2)
+PERMISSIONS='640'
+USER='root'
+GROUP='adm'
+
+# This function will be called if the script status is on enabled / audit mode
+audit () {
+    for FILE in $FILES; do
+        has_file_correct_ownership $FILE $USER $GROUP
+        if [ $FNRET = 0 ]; then
+            ok "$FILE has correct ownership"
+        else
+            crit "$FILE is not $USER:$GROUP ownership set"
+        fi
+        has_file_correct_permissions $FILE $PERMISSIONS
+        if [ $FNRET = 0 ]; then
+            ok "$FILE has correct permissions"
+        else
+            crit "$FILE has not $PERMISSIONS permissions set"
+        fi 
+    done
+}
+
+# This function will be called if the script status is on enabled mode
+apply () {
+    for FILE in $FILES; do
+        does_file_exist $FILE
+        if [ $FNRET != 0 ]; then
+            info "$FILE does not exist"
+            touch $FILE
+        fi
+        has_file_correct_ownership $FILE $USER $GROUP
+        if [ $FNRET = 0 ]; then
+            ok "$FILE has correct ownership"
+        else
+            warn "$FILE is not $USER:$GROUP ownership set"
+            chown $USER:$GROUP $FILE
+        fi
+        has_file_correct_permissions $FILE $PERMISSIONS
+        if [ $FNRET = 0 ]; then
+            ok "$FILE has correct permissions"
+        else
+            info "fixing $FILE permissions to $PERMISSIONS"
+            chmod 0$PERMISSIONS $FILE
+        fi
+    done
+}
+
+# This function will check config parameters required
+check_config() {
+    does_user_exist $USER
+    if [ $FNRET != 0 ]; then
+        crit "$USER does not exist"
+        exit 128
+    fi
+    does_group_exist $GROUP
+    if [ $FNRET != 0 ]; then
+        crit "$GROUP does not exist"
+        exit 128
+    fi
+}
+
+# Source Root Dir Parameter
+if [ ! -r /etc/default/cis-hardenning ]; then
+    echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
+    exit 128
+else
+    . /etc/default/cis-hardenning
+    if [ -z $CIS_ROOT_DIR ]; then
+        echo "No CIS_ROOT_DIR variable, aborting"
+    fi
+fi 
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

etc/conf.d/8.2.1_install_syslog-ng.cfg

@@ -0,0 +1,2 @@
+# Configuration for script of same name
+status=enabled

etc/conf.d/8.2.2_enable_syslog-ng.cfg

@@ -0,0 +1,2 @@
+# Configuration for script of same name
+status=enabled

etc/conf.d/8.2.3_configure_syslog-ng.cfg

@@ -0,0 +1,2 @@
+# Configuration for script of same name
+status=enabled

etc/conf.d/8.2.4_set_logfile_perm.cfg

@@ -0,0 +1,2 @@
+# Configuration for script of same name
+status=enabled

lib/utils.sh

@@ -86,9 +86,9 @@ has_file_correct_ownership() {
     local USER=$2
     local GROUP=$3
     local USERID=$(id -u $USER)
-    local GROUPID=$(id -u $GROUP)
+    local GROUPID=$(getent group $GROUP | cut -d: -f3)
-
+    debug "stat -c '%u %g' $FILE"
-    if [ "$(stat -c "%u %g" $1)" = "$USERID $GROUPID" ]; then
+    if [ "$(stat -c "%u %g" $FILE)" = "$USERID $GROUPID" ]; then
         FNRET=0
     else
         FNRET=1