From 57121f116cd9d29a5d6ee10528da9e76ce4d0c23 Mon Sep 17 00:00:00 2001 From: "thibault.dewailly" Date: Mon, 18 Apr 2016 11:16:05 +0200 Subject: [PATCH] 99.1_timeout_tty.sh 99.2_disable_usb_devices.sh --- bin/hardening.sh | 107 +++++++++++++++++++++- bin/hardening/10.4_default_umask.sh | 6 +- bin/hardening/99.1_timeout_tty.sh | 63 +++++++++++++ bin/hardening/99.2_disable_usb_devices.sh | 72 +++++++++++++++ etc/conf.d/99.1_timeout_tty.cfg | 2 + etc/conf.d/99.2_disable_usb_devices.cfg | 2 + 6 files changed, 244 insertions(+), 8 deletions(-) mode change 100644 => 100755 bin/hardening.sh create mode 100755 bin/hardening/99.1_timeout_tty.sh create mode 100755 bin/hardening/99.2_disable_usb_devices.sh create mode 100644 etc/conf.d/99.1_timeout_tty.cfg create mode 100644 etc/conf.d/99.2_disable_usb_devices.cfg diff --git a/bin/hardening.sh b/bin/hardening.sh old mode 100644 new mode 100755 index e76d52d..b853bd7 --- a/bin/hardening.sh +++ b/bin/hardening.sh @@ -1,6 +1,5 @@ #!/bin/bash -# CIs Deb # # CIS Debian 7 Hardening # Authors : Thibault Dewailly, OVH @@ -15,8 +14,106 @@ # ls | sort -V -cd /opt/cis-hardening/bin/hardening -for i in $(ls | sort -V); do -echo "$i" -./$i --audit +LONG_SCRIPT_NAME=$(basename $0) +SCRIPT_NAME=${LONG_SCRIPT_NAME%.sh} +DISABLED_CHECKS=0 +PASSED_CHECKS=0 +FAILED_CHECKS=0 +TOTAL_CHECKS=0 +TOTAL_TREATED_CHECKS=0 +AUDIT=0 +APPLY=0 + +usage() { + cat << EOF +$LONG_SCRIPT_NAME ( --apply | -- audit ) < -h | --help > + --apply : Apply hardening if told in configuration + --audit : If script not disabled, audit configuration only + -h|--help : this help +EOF + exit 0 +} + +if [ $# = 0 ]; then + usage +fi + +# Arguments parsing +while [[ $# > 0 ]]; do + ARG="$1" + case $ARG in + --audit) + AUDIT=1 + ;; + --apply) + APPLY=1 + ;; + -h|--help) + usage + ;; + *) + usage + ;; + esac + shift done + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +[ -r $CIS_ROOT_DIR/lib/constants.sh ] && . $CIS_ROOT_DIR/lib/constants.sh +[ -r $CIS_ROOT_DIR/etc/hardening.cfg ] && . $CIS_ROOT_DIR/etc/hardening.cfg +[ -r $CIS_ROOT_DIR/lib/common.sh ] && . $CIS_ROOT_DIR/lib/common.sh +[ -r $CIS_ROOT_DIR/lib/utils.sh ] && . $CIS_ROOT_DIR/lib/utils.sh + +# Parse every scripts and execute them in the required mode +for SCRIPT in $(ls $CIS_ROOT_DIR/bin/hardening | sort -V); do + info "Treating $SCRIPT" + + if [ $AUDIT = 1 ]; then + debug "$CIS_ROOT_DIR/bin/hardening/$SCRIPT --audit" + $CIS_ROOT_DIR/bin/hardening/$SCRIPT --audit + elif [ $APPLY = 1 ]; then + debug "$CIS_ROOT_DIR/bin/hardening/$SCRIPT" + $CIS_ROOT_DIR/bin/hardening/$SCRIPT + fi + + SCRIPT_EXITCODE=$? + + debug "Script $SCRIPT finished with exit code $SCRIPT_EXITCODE" + case $SCRIPT_EXITCODE in + 0) + debug "$SCRIPT passed" + PASSED_CHECKS=$((PASSED_CHECKS+1)) + ;; + 1) + debug "$SCRIPT failed" + FAILED_CHECKS=$((FAILED_CHECKS+1)) + ;; + 2) + debug "$SCRIPT is disabled" + DISABLED_CHECKS=$((DISABLED_CHECKS+1)) + ;; + esac + + TOTAL_CHECKS=$((TOTAL_CHECKS+1)) + +done + +TOTAL_TREATED_CHECKS=$((TOTAL_CHECKS-DISABLED_CHECKS)) + +printf "%40s\n" "################### SUMMARY ###################" +printf "%30s %s\n" "Total Available Checks :" "$TOTAL_CHECKS" +printf "%30s %s\n" "Total Runned Checks :" "$TOTAL_TREATED_CHECKS" +printf "%30s [ %7s ]\n" "Total Passed Checks :" "$PASSED_CHECKS/$TOTAL_TREATED_CHECKS" +printf "%30s [ %7s ]\n" "Total Failed Checks :" "$FAILED_CHECKS/$TOTAL_TREATED_CHECKS" +printf "%30s %.2f %%\n" "Enabled Checks Percentage :" "$( echo "($TOTAL_TREATED_CHECKS/$TOTAL_CHECKS) * 100" | bc -l)" +printf "%30s %.2f %%\n" "Conformity Percentage :" "$( echo "($PASSED_CHECKS/$TOTAL_TREATED_CHECKS) * 100" | bc -l)" diff --git a/bin/hardening/10.4_default_umask.sh b/bin/hardening/10.4_default_umask.sh index 5e09853..343cf59 100755 --- a/bin/hardening/10.4_default_umask.sh +++ b/bin/hardening/10.4_default_umask.sh @@ -13,8 +13,8 @@ set -e # One error, it's over set -u # One variable unset, it's over USER='root' -PATTERN='umask 644' -FILES_TO_SEARCH='/etc/bash.bashrc /etc/profile.d/*' +PATTERN='umask 077' +FILES_TO_SEARCH='/etc/bash.bashrc /etc/profile.d/* /etc/profile' FILE='/etc/profile.d/CIS_10.4_umask.sh' # This function will be called if the script status is on enabled / audit mode @@ -33,7 +33,7 @@ apply () { if [ $FNRET != 0 ]; then warn "$PATTERN not present in $FILES_TO_SEARCH" touch $FILE - chmod 700 $FILE + chmod 644 $FILE add_end_of_file $FILE "$PATTERN" else ok "$PATTERN present in $FILES_TO_SEARCH" diff --git a/bin/hardening/99.1_timeout_tty.sh b/bin/hardening/99.1_timeout_tty.sh new file mode 100755 index 0000000..d4bcfb1 --- /dev/null +++ b/bin/hardening/99.1_timeout_tty.sh @@ -0,0 +1,63 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening /!\ Not in the Guide +# Authors : Thibault Dewailly, OVH +# + +# +# 99.1 Set Timeout on ttys +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +USER='root' +PATTERN='^TMOUT=' +VALUE='600' +FILES_TO_SEARCH='/etc/bash.bashrc /etc/profile.d/* /etc/profile' +FILE='/etc/profile.d/CIS_99.1_timeout.sh' + +# This function will be called if the script status is on enabled / audit mode +audit () { + does_pattern_exists_in_file "$FILES_TO_SEARCH" "^$PATTERN" + if [ $FNRET != 0 ]; then + crit "$PATTERN not present in $FILES_TO_SEARCH" + else + ok "$PATTERN present in $FILES_TO_SEARCH" + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + does_pattern_exists_in_file "$FILES_TO_SEARCH" "^$PATTERN" + if [ $FNRET != 0 ]; then + warn "$PATTERN not present in $FILES_TO_SEARCH" + touch $FILE + chmod 644 $FILE + add_end_of_file $FILE "$PATTERN$VALUE" + add_end_of_file $FILE "readonly TMOUT" + add_end_of_file $FILE "export TMOUT" + else + ok "$PATTERN present in $FILES_TO_SEARCH" + fi +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/99.2_disable_usb_devices.sh b/bin/hardening/99.2_disable_usb_devices.sh new file mode 100755 index 0000000..97077ae --- /dev/null +++ b/bin/hardening/99.2_disable_usb_devices.sh @@ -0,0 +1,72 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening /!\ Not in the Guide +# Authors : Thibault Dewailly, OVH +# + +# +# 99.2 Disable USB Devices +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +USER='root' +PATTERN='ACTION=="add", SUBSYSTEMS=="usb", TEST=="authorized_default", ATTR{authorized_default}="0"' # We do test disabled by default, whitelist is up to you +FILES_TO_SEARCH='/etc/udev/rules.d/*' +FILE='/etc/udev/rules.d/10-CIS_99.2_usb_devices.sh' + +# This function will be called if the script status is on enabled / audit mode +audit () { + does_pattern_exists_in_file "$FILES_TO_SEARCH" "^$PATTERN" + if [ $FNRET != 0 ]; then + crit "$PATTERN not present in $FILES_TO_SEARCH" + else + ok "$PATTERN present in $FILES_TO_SEARCH" + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + does_pattern_exists_in_file "$FILES_TO_SEARCH" "^$PATTERN" + if [ $FNRET != 0 ]; then + warn "$PATTERN not present in $FILES_TO_SEARCH" + touch $FILE + chmod 644 $FILE + add_end_of_file $FILE ' +# By default, disable all. +ACTION=="add", SUBSYSTEMS=="usb", TEST=="authorized_default", ATTR{authorized_default}="0" + +# Enable hub devices. +ACTION=="add", ATTR{bDeviceClass}=="09", TEST=="authorized", ATTR{authorized}="1" + +# Enables keyboard devices +ACTION=="add", ATTR{product}=="*[Kk]eyboard*", TEST=="authorized", ATTR{authorized}="1" + +# PS2-USB converter +ACTION=="add", ATTR{product}=="*Thinnet TM*", TEST=="authorized", ATTR{authorized}="1" +' + else + ok "$PATTERN present in $FILES_TO_SEARCH" + fi +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/etc/conf.d/99.1_timeout_tty.cfg b/etc/conf.d/99.1_timeout_tty.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/99.1_timeout_tty.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/99.2_disable_usb_devices.cfg b/etc/conf.d/99.2_disable_usb_devices.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/99.2_disable_usb_devices.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled