elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2025-06-22 02:33:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: add nftables to firewall software allow list (#203)

Browse Source 
* feat: add nftables to firewall software allow list

fixes #191

* fix: enhance 3.5.4.1.1_net_fw_default_policy_drop.sh iptables output check, disable associated test
This commit is contained in:
GoldenKiwi
2023-09-07 14:36:08 +02:00
committed by GitHub
parent 9d3fb18e6b
commit 5370ec2ef6
4 changed files with 37 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
tests/hardening/3.5.1.1_enable_firewall.sh
View File

@ -2,10 +2,18 @@
# run-shellcheck
test_audit() {
describe Running on blank host
register_test retvalshouldbe 0
register_test retvalshouldbe 1
dismiss_count_for_test
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests
describe Correcting situation
apt-get update
apt-get install -y iptables
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "provides firewalling feature"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
}

5
tests/hardening/3.5.4.1.1_net_fw_default_policy_drop.sh
View File

@ -4,8 +4,7 @@ test_audit() {
describe Running on blank host
register_test retvalshouldbe 0
dismiss_count_for_test
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# Do not run any check, iptables do not work in a docker
#run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests
}