diff --git a/bin/hardening/4.2.1.5_syslog-ng_remote_host.sh b/bin/hardening/4.2.1.5_syslog-ng_remote_host.sh index 59a8463..195724b 100755 --- a/bin/hardening/4.2.1.5_syslog-ng_remote_host.sh +++ b/bin/hardening/4.2.1.5_syslog-ng_remote_host.sh @@ -16,10 +16,9 @@ set -u # One variable unset, it's over HARDENING_LEVEL=3 # shellcheck disable=2034 DESCRIPTION="Configure syslog-ng to send logs to a remote log host." - PACKAGE='syslog-ng' - -PATTERN='destination[[:alnum:][:space:]*{]+(tcp|udp)[[:space:]]*\(\"[[:alnum:].]+\".' +SYSLOG_BASEDIR='/etc/syslog-ng' +PATTERN='destination[[:alnum:][:space:]*_*{]+(tcp|network|udp)[[:space:]]*\([[:space:]]*\"?[[:alnum:]\-.]+\"?.' # This function will be called if the script status is on enabled / audit mode audit() { diff --git a/bin/hardening/4.2.1.6_remote_syslog-ng_acl.sh b/bin/hardening/4.2.1.6_remote_syslog-ng_acl.sh index 9db6856..fcdabda 100755 --- a/bin/hardening/4.2.1.6_remote_syslog-ng_acl.sh +++ b/bin/hardening/4.2.1.6_remote_syslog-ng_acl.sh @@ -18,9 +18,9 @@ HARDENING_LEVEL=3 DESCRIPTION="Configure syslog to accept remote syslog messages only on designated log hosts." PACKAGE='syslog-ng' - +SYSLOG_BASEDIR='/etc/syslog-ng' REMOTE_HOST="" -PATTERN='source[[:alnum:][:space:]*{]+(tcp|udp)[[:space:]]*\(\"[[:alnum:].]+\".' +PATTERN='source[[:alnum:][:space:]*_*{]+(tcp|network|udp)[[:space:]]*\([[:space:]]*\"?[[:alnum:]\-.]+\"?.' # This function will be called if the script status is on enabled / audit mode audit() { @@ -37,7 +37,7 @@ audit() { fi done - if [[ "$REMOTE_HOST" ]]; then + if [[ "$REMOTE_HOST" ]] && [[ "$REMOTE_HOST" != 'false' ]]; then info "This is the remote host, checking that it only accepts logs from specified zone" if [ "$FOUND" = 1 ]; then ok "$PATTERN is present in $FILES" @@ -70,7 +70,7 @@ apply() { fi done - if [[ "$REMOTE_HOST" ]]; then + if [[ "$REMOTE_HOST" ]] && [[ "$REMOTE_HOST" != 'false' ]]; then info "This is the remote host, checking that it only accepts logs from specified zone" if [ "$FOUND" = 1 ]; then ok "$PATTERN is present in $FILES"