elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-11-21 21:17:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

IMP(3.1-3.x): add comprehensive tests

Browse Source
This commit is contained in:
Thibault Ayanides 2021-01-21 11:02:08 +01:00 committed by Thibault Serti
parent c51513e083
commit 5a72d986ea
11 changed files with 239 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
tests/hardening/3.1.1_disable_ipv6.sh
View File

@ -7,5 +7,23 @@ test_audit() {
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests
if [ -f "/.dockerenv" ]; then
skip "SKIPPED on docker"
else
describe Tests purposely failing
sysctl -w net.ipv6.conf.all.disable_ipv6=0 2>/dev/null
register_test retvalshouldbe 1
register_test contain "net.ipv6.conf.all.disable_ipv6 was not set to 1"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "correctly set to 1"
register_test contain "net.ipv6.conf.all.disable_ipv6 correctly set to 0"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
fi
}

20
tests/hardening/3.2.1_disable_send_packet_redirects.sh
View File

@ -7,5 +7,23 @@ test_audit() {
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests
if [ -f "/.dockerenv" ]; then
skip "SKIPPED on docker"
else
describe Tests purposely failing
sysctl -w net.ipv4.conf.all.send_redirects=1 2>/dev/null
register_test retvalshouldbe 1
register_test contain "net.ipv4.conf.all.send_redirects was not set to 0"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "correctly set to 0"
register_test contain "net.ipv4.conf.all.send_redirects correctly set to 0"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
fi
}

27
tests/hardening/3.3.1_disable_source_routed_packets.sh
View File

@ -7,5 +7,30 @@ test_audit() {
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests
if [ -f "/.dockerenv" ]; then
skip "SKIPPED on docker"
else
describe Tests purposely failing
sysctl -w net.ipv4.conf.all.accept_source_route=1 net.ipv4.conf.default.accept_source_route=1 net.ipv6.conf.all.accept_source_route=1 net.ipv6.conf.default.accept_source_route=1 2>/dev/null
register_test retvalshouldbe 1
register_test contain "net.ipv4.conf.all.accept_source_route was not set to 0"
register_test contain "net.ipv4.conf.default.accept_source_route was not set to 0"
register_test contain "net.ipv6.conf.all.accept_source_route was not set to 0"
register_test contain "net.ipv6.conf.default.accept_source was not set to 0"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "correctly set to 0"
register_test contain "net.ipv4.conf.all.accept_source_route correctly set to 0"
register_test contain "net.ipv4.conf.default.accept_source_route correctly set to 0"
register_test contain "net.ipv6.conf.all.accept_source_route correctly set to 0"
register_test contain "net.ipv6.conf.default.accept_source correctly set to 0"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
fi
}

27
tests/hardening/3.3.2_disable_icmp_redirect.sh
View File

@ -7,5 +7,30 @@ test_audit() {
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests
if [ -f "/.dockerenv" ]; then
skip "SKIPPED on docker"
else
describe Tests purposely failing
sysctl -w net.ipv4.conf.all.accept_redirects=1 net.ipv4.conf.default.accept_redirects=1 net.ipv6.conf.all.accept_redirects=1 net.ipv6.conf.default.accept_redirects=1 2>/dev/null
register_test retvalshouldbe 1
register_test contain "net.ipv4.conf.all.accept_redirects was not set to 0"
register_test contain "net.ipv4.conf.default.accept_redirects was not set to 0"
register_test contain "net.ipv6.conf.all.accept_redirects was not set to 0"
register_test contain "net.ipv6.conf.default.accept_redirects was not set to 0"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "correctly set to 0"
register_test contain "net.ipv4.conf.all.accept_redirects correctly set to 0"
register_test contain "net.ipv4.conf.default.accept_redirects correctly set to 0"
register_test contain "net.ipv6.conf.all.accept_redirects correctly set to 0"
register_test contain "net.ipv6.conf.default.accept_redirects correctly set to 0"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
fi
}

23
tests/hardening/3.3.3_disable_secure_icmp_redirect.sh
View File

@ -7,5 +7,26 @@ test_audit() {
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests
if [ -f "/.dockerenv" ]; then
skip "SKIPPED on docker"
else
describe Tests purposely failing
sysctl -w net.ipv4.conf.all.secure_redirects=1 net.ipv4.conf.default.secure_redirects=1 2>/dev/null
register_test retvalshouldbe 1
register_test contain "net.ipv4.conf.all.secure_redirects was not set to 0"
register_test contain "net.ipv4.conf.default.secure_redirects=0 was not set to 0"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "correctly set to 0"
register_test contain "net.ipv4.conf.all.secure_redirects correctly set to 0"
register_test contain "net.ipv4.conf.default.secure_redirects correctly set to 0"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
fi
}

23
tests/hardening/3.3.4_log_martian_packets.sh
View File

@ -7,5 +7,26 @@ test_audit() {
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests
if [ -f "/.dockerenv" ]; then
skip "SKIPPED on docker"
else
describe Tests purposely failing
sysctl -w net.ipv4.conf.all.log_martians=0 net.ipv4.conf.default.log_martians=0 2>/dev/null
register_test retvalshouldbe 1
register_test contain "net.ipv4.conf.all.log_martians was not set to 1"
register_test contain "net.ipv4.conf.default.log_martians was not set to 1"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "correctly set to 1"
register_test contain "net.ipv4.conf.all.log_martians correctly set to 1"
register_test contain " net.ipv4.conf.default.log_martians correctly set to 1"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
fi
}

21
tests/hardening/3.3.5_ignore_broadcast_requests.sh
View File

@ -7,5 +7,24 @@ test_audit() {
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests
if [ -f "/.dockerenv" ]; then
skip "SKIPPED on docker"
else
describe Tests purposely failing
sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=0 2>/dev/null
register_test retvalshouldbe 1
register_test contain "net.ipv4.icmp_echo_ignore_broadcasts was not set to 1"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "correctly set to 1"
register_test contain "net.ipv4.icmp_echo_ignore_broadcasts correctly set to 1"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
fi
}

21
tests/hardening/3.3.6_enable_bad_error_message_protection.sh
View File

@ -7,5 +7,24 @@ test_audit() {
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests
if [ -f "/.dockerenv" ]; then
skip "SKIPPED on docker"
else
describe Tests purposely failing
sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=0 2>/dev/null
register_test retvalshouldbe 1
register_test contain "net.ipv4.icmp_ignore_bogus_error_responses was not set to 1"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "correctly set to 0"
register_test contain "net.ipv4.icmp_ignore_bogus_error_responses correctly set to 0"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
fi
}

23
tests/hardening/3.3.7_enable_source_route_validation.sh
View File

@ -7,5 +7,26 @@ test_audit() {
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests
if [ -f "/.dockerenv" ]; then
skip "SKIPPED on docker"
else
describe Tests purposely failing
sysctl -w net.ipv4.conf.all.rp_filter=0 net.ipv4.conf.default.rp_filter=0 2>/dev/null
register_test retvalshouldbe 1
register_test contain "net.ipv4.conf.all.rp_filter was not set to 1"
register_test contain "net.ipv4.conf.default.rp_filter was not set to 1"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "correctly set to 1"
register_test contain "net.ipv4.conf.all.rp_filter correctly set to 1"
register_test contain "net.ipv4.conf.default.rp_filter correctly set to 1"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
fi
}

22
tests/hardening/3.3.8_enable_tcp_syn_cookies.sh
View File

@ -7,5 +7,25 @@ test_audit() {
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests
if [ -f "/.dockerenv" ]; then
skip "SKIPPED on docker"
else
describe Tests purposely failing
sysctl -w net.ipv4.tcp_syncookies=0 2>/dev/null
register_test retvalshouldbe 1
register_test contain "net.ipv4.tcp_syncookies was not set to 1"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "correctly set to 1"
register_test contain "net.ipv4.tcp_syncookies correctly set to 1"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
fi
}

23
tests/hardening/3.3.9_disable_ipv6_router_advertisement.sh
View File

@ -7,5 +7,26 @@ test_audit() {
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests
if [ -f "/.dockerenv" ]; then
skip "SKIPPED on docker"
else
describe Tests purposely failing
sysctl -w net.ipv6.conf.all.accept_ra=1 net.ipv6.conf.default.accept_ra=1 2>/dev/null
register_test retvalshouldbe 1
register_test contain " net.ipv6.conf.all.accept_ra was not set to 0"
register_test contain "net.ipv6.conf.default.accept_ra was not set to 0"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "correctly set to 0"
register_test contain "net.ipv6.conf.all.accept_ra correctly set to 0"
register_test contain "net.ipv6.conf.default.accept_ra correctly set to 0"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
fi
}