From 5a72d986ea75dee4fd3bfd8c83943c180d620463 Mon Sep 17 00:00:00 2001 From: Thibault Ayanides Date: Thu, 21 Jan 2021 11:02:08 +0100 Subject: [PATCH] IMP(3.1-3.x): add comprehensive tests --- tests/hardening/3.1.1_disable_ipv6.sh | 20 +++++++++++++- .../3.2.1_disable_send_packet_redirects.sh | 20 +++++++++++++- .../3.3.1_disable_source_routed_packets.sh | 27 ++++++++++++++++++- .../hardening/3.3.2_disable_icmp_redirect.sh | 27 ++++++++++++++++++- .../3.3.3_disable_secure_icmp_redirect.sh | 23 +++++++++++++++- tests/hardening/3.3.4_log_martian_packets.sh | 23 +++++++++++++++- .../3.3.5_ignore_broadcast_requests.sh | 21 ++++++++++++++- ...3.6_enable_bad_error_message_protection.sh | 21 ++++++++++++++- .../3.3.7_enable_source_route_validation.sh | 23 +++++++++++++++- .../hardening/3.3.8_enable_tcp_syn_cookies.sh | 22 ++++++++++++++- ...3.3.9_disable_ipv6_router_advertisement.sh | 23 +++++++++++++++- 11 files changed, 239 insertions(+), 11 deletions(-) diff --git a/tests/hardening/3.1.1_disable_ipv6.sh b/tests/hardening/3.1.1_disable_ipv6.sh index f85b20d..78c6caf 100644 --- a/tests/hardening/3.1.1_disable_ipv6.sh +++ b/tests/hardening/3.1.1_disable_ipv6.sh @@ -7,5 +7,23 @@ test_audit() { # shellcheck disable=2154 run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all - # TODO fill comprehensive tests + if [ -f "/.dockerenv" ]; then + skip "SKIPPED on docker" + else + describe Tests purposely failing + sysctl -w net.ipv6.conf.all.disable_ipv6=0 2>/dev/null + register_test retvalshouldbe 1 + register_test contain "net.ipv6.conf.all.disable_ipv6 was not set to 1" + run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + describe correcting situation + sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg + /opt/debian-cis/bin/hardening/"${script}".sh --apply || true + + describe Checking resolved state + register_test retvalshouldbe 0 + register_test contain "correctly set to 1" + register_test contain "net.ipv6.conf.all.disable_ipv6 correctly set to 0" + run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + fi } diff --git a/tests/hardening/3.2.1_disable_send_packet_redirects.sh b/tests/hardening/3.2.1_disable_send_packet_redirects.sh index f85b20d..9c90955 100644 --- a/tests/hardening/3.2.1_disable_send_packet_redirects.sh +++ b/tests/hardening/3.2.1_disable_send_packet_redirects.sh @@ -7,5 +7,23 @@ test_audit() { # shellcheck disable=2154 run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all - # TODO fill comprehensive tests + if [ -f "/.dockerenv" ]; then + skip "SKIPPED on docker" + else + describe Tests purposely failing + sysctl -w net.ipv4.conf.all.send_redirects=1 2>/dev/null + register_test retvalshouldbe 1 + register_test contain "net.ipv4.conf.all.send_redirects was not set to 0" + run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + describe correcting situation + sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg + /opt/debian-cis/bin/hardening/"${script}".sh --apply || true + + describe Checking resolved state + register_test retvalshouldbe 0 + register_test contain "correctly set to 0" + register_test contain "net.ipv4.conf.all.send_redirects correctly set to 0" + run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + fi } diff --git a/tests/hardening/3.3.1_disable_source_routed_packets.sh b/tests/hardening/3.3.1_disable_source_routed_packets.sh index f85b20d..ba30f84 100644 --- a/tests/hardening/3.3.1_disable_source_routed_packets.sh +++ b/tests/hardening/3.3.1_disable_source_routed_packets.sh @@ -7,5 +7,30 @@ test_audit() { # shellcheck disable=2154 run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all - # TODO fill comprehensive tests + if [ -f "/.dockerenv" ]; then + skip "SKIPPED on docker" + else + describe Tests purposely failing + sysctl -w net.ipv4.conf.all.accept_source_route=1 net.ipv4.conf.default.accept_source_route=1 net.ipv6.conf.all.accept_source_route=1 net.ipv6.conf.default.accept_source_route=1 2>/dev/null + register_test retvalshouldbe 1 + register_test contain "net.ipv4.conf.all.accept_source_route was not set to 0" + register_test contain "net.ipv4.conf.default.accept_source_route was not set to 0" + register_test contain "net.ipv6.conf.all.accept_source_route was not set to 0" + register_test contain "net.ipv6.conf.default.accept_source was not set to 0" + + run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + describe correcting situation + sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg + /opt/debian-cis/bin/hardening/"${script}".sh --apply || true + + describe Checking resolved state + register_test retvalshouldbe 0 + register_test contain "correctly set to 0" + register_test contain "net.ipv4.conf.all.accept_source_route correctly set to 0" + register_test contain "net.ipv4.conf.default.accept_source_route correctly set to 0" + register_test contain "net.ipv6.conf.all.accept_source_route correctly set to 0" + register_test contain "net.ipv6.conf.default.accept_source correctly set to 0" + run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + fi } diff --git a/tests/hardening/3.3.2_disable_icmp_redirect.sh b/tests/hardening/3.3.2_disable_icmp_redirect.sh index f85b20d..c83cbaa 100644 --- a/tests/hardening/3.3.2_disable_icmp_redirect.sh +++ b/tests/hardening/3.3.2_disable_icmp_redirect.sh @@ -7,5 +7,30 @@ test_audit() { # shellcheck disable=2154 run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all - # TODO fill comprehensive tests + if [ -f "/.dockerenv" ]; then + skip "SKIPPED on docker" + else + describe Tests purposely failing + sysctl -w net.ipv4.conf.all.accept_redirects=1 net.ipv4.conf.default.accept_redirects=1 net.ipv6.conf.all.accept_redirects=1 net.ipv6.conf.default.accept_redirects=1 2>/dev/null + register_test retvalshouldbe 1 + register_test contain "net.ipv4.conf.all.accept_redirects was not set to 0" + register_test contain "net.ipv4.conf.default.accept_redirects was not set to 0" + register_test contain "net.ipv6.conf.all.accept_redirects was not set to 0" + register_test contain "net.ipv6.conf.default.accept_redirects was not set to 0" + + run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + describe correcting situation + sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg + /opt/debian-cis/bin/hardening/"${script}".sh --apply || true + + describe Checking resolved state + register_test retvalshouldbe 0 + register_test contain "correctly set to 0" + register_test contain "net.ipv4.conf.all.accept_redirects correctly set to 0" + register_test contain "net.ipv4.conf.default.accept_redirects correctly set to 0" + register_test contain "net.ipv6.conf.all.accept_redirects correctly set to 0" + register_test contain "net.ipv6.conf.default.accept_redirects correctly set to 0" + run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + fi } diff --git a/tests/hardening/3.3.3_disable_secure_icmp_redirect.sh b/tests/hardening/3.3.3_disable_secure_icmp_redirect.sh index f85b20d..688137a 100644 --- a/tests/hardening/3.3.3_disable_secure_icmp_redirect.sh +++ b/tests/hardening/3.3.3_disable_secure_icmp_redirect.sh @@ -7,5 +7,26 @@ test_audit() { # shellcheck disable=2154 run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all - # TODO fill comprehensive tests + if [ -f "/.dockerenv" ]; then + skip "SKIPPED on docker" + else + describe Tests purposely failing + sysctl -w net.ipv4.conf.all.secure_redirects=1 net.ipv4.conf.default.secure_redirects=1 2>/dev/null + register_test retvalshouldbe 1 + register_test contain "net.ipv4.conf.all.secure_redirects was not set to 0" + register_test contain "net.ipv4.conf.default.secure_redirects=0 was not set to 0" + + run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + describe correcting situation + sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg + /opt/debian-cis/bin/hardening/"${script}".sh --apply || true + + describe Checking resolved state + register_test retvalshouldbe 0 + register_test contain "correctly set to 0" + register_test contain "net.ipv4.conf.all.secure_redirects correctly set to 0" + register_test contain "net.ipv4.conf.default.secure_redirects correctly set to 0" + run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + fi } diff --git a/tests/hardening/3.3.4_log_martian_packets.sh b/tests/hardening/3.3.4_log_martian_packets.sh index f85b20d..4dbbafe 100644 --- a/tests/hardening/3.3.4_log_martian_packets.sh +++ b/tests/hardening/3.3.4_log_martian_packets.sh @@ -7,5 +7,26 @@ test_audit() { # shellcheck disable=2154 run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all - # TODO fill comprehensive tests + if [ -f "/.dockerenv" ]; then + skip "SKIPPED on docker" + else + describe Tests purposely failing + sysctl -w net.ipv4.conf.all.log_martians=0 net.ipv4.conf.default.log_martians=0 2>/dev/null + register_test retvalshouldbe 1 + register_test contain "net.ipv4.conf.all.log_martians was not set to 1" + register_test contain "net.ipv4.conf.default.log_martians was not set to 1" + + run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + describe correcting situation + sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg + /opt/debian-cis/bin/hardening/"${script}".sh --apply || true + + describe Checking resolved state + register_test retvalshouldbe 0 + register_test contain "correctly set to 1" + register_test contain "net.ipv4.conf.all.log_martians correctly set to 1" + register_test contain " net.ipv4.conf.default.log_martians correctly set to 1" + run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + fi } diff --git a/tests/hardening/3.3.5_ignore_broadcast_requests.sh b/tests/hardening/3.3.5_ignore_broadcast_requests.sh index f85b20d..a88ac4a 100644 --- a/tests/hardening/3.3.5_ignore_broadcast_requests.sh +++ b/tests/hardening/3.3.5_ignore_broadcast_requests.sh @@ -7,5 +7,24 @@ test_audit() { # shellcheck disable=2154 run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all - # TODO fill comprehensive tests + if [ -f "/.dockerenv" ]; then + skip "SKIPPED on docker" + else + describe Tests purposely failing + sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=0 2>/dev/null + register_test retvalshouldbe 1 + register_test contain "net.ipv4.icmp_echo_ignore_broadcasts was not set to 1" + + run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + describe correcting situation + sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg + /opt/debian-cis/bin/hardening/"${script}".sh --apply || true + + describe Checking resolved state + register_test retvalshouldbe 0 + register_test contain "correctly set to 1" + register_test contain "net.ipv4.icmp_echo_ignore_broadcasts correctly set to 1" + run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + fi } diff --git a/tests/hardening/3.3.6_enable_bad_error_message_protection.sh b/tests/hardening/3.3.6_enable_bad_error_message_protection.sh index f85b20d..1aa17eb 100644 --- a/tests/hardening/3.3.6_enable_bad_error_message_protection.sh +++ b/tests/hardening/3.3.6_enable_bad_error_message_protection.sh @@ -7,5 +7,24 @@ test_audit() { # shellcheck disable=2154 run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all - # TODO fill comprehensive tests + if [ -f "/.dockerenv" ]; then + skip "SKIPPED on docker" + else + describe Tests purposely failing + sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=0 2>/dev/null + register_test retvalshouldbe 1 + register_test contain "net.ipv4.icmp_ignore_bogus_error_responses was not set to 1" + + run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + describe correcting situation + sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg + /opt/debian-cis/bin/hardening/"${script}".sh --apply || true + + describe Checking resolved state + register_test retvalshouldbe 0 + register_test contain "correctly set to 0" + register_test contain "net.ipv4.icmp_ignore_bogus_error_responses correctly set to 0" + run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + fi } diff --git a/tests/hardening/3.3.7_enable_source_route_validation.sh b/tests/hardening/3.3.7_enable_source_route_validation.sh index f85b20d..16c04d7 100644 --- a/tests/hardening/3.3.7_enable_source_route_validation.sh +++ b/tests/hardening/3.3.7_enable_source_route_validation.sh @@ -7,5 +7,26 @@ test_audit() { # shellcheck disable=2154 run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all - # TODO fill comprehensive tests + if [ -f "/.dockerenv" ]; then + skip "SKIPPED on docker" + else + describe Tests purposely failing + sysctl -w net.ipv4.conf.all.rp_filter=0 net.ipv4.conf.default.rp_filter=0 2>/dev/null + register_test retvalshouldbe 1 + register_test contain "net.ipv4.conf.all.rp_filter was not set to 1" + register_test contain "net.ipv4.conf.default.rp_filter was not set to 1" + + run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + describe correcting situation + sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg + /opt/debian-cis/bin/hardening/"${script}".sh --apply || true + + describe Checking resolved state + register_test retvalshouldbe 0 + register_test contain "correctly set to 1" + register_test contain "net.ipv4.conf.all.rp_filter correctly set to 1" + register_test contain "net.ipv4.conf.default.rp_filter correctly set to 1" + run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + fi } diff --git a/tests/hardening/3.3.8_enable_tcp_syn_cookies.sh b/tests/hardening/3.3.8_enable_tcp_syn_cookies.sh index f85b20d..a45c03d 100644 --- a/tests/hardening/3.3.8_enable_tcp_syn_cookies.sh +++ b/tests/hardening/3.3.8_enable_tcp_syn_cookies.sh @@ -7,5 +7,25 @@ test_audit() { # shellcheck disable=2154 run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all - # TODO fill comprehensive tests + if [ -f "/.dockerenv" ]; then + skip "SKIPPED on docker" + else + describe Tests purposely failing + sysctl -w net.ipv4.tcp_syncookies=0 2>/dev/null + register_test retvalshouldbe 1 + register_test contain "net.ipv4.tcp_syncookies was not set to 1" + + run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + describe correcting situation + sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg + /opt/debian-cis/bin/hardening/"${script}".sh --apply || true + + describe Checking resolved state + register_test retvalshouldbe 0 + register_test contain "correctly set to 1" + register_test contain "net.ipv4.tcp_syncookies correctly set to 1" + + run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + fi } diff --git a/tests/hardening/3.3.9_disable_ipv6_router_advertisement.sh b/tests/hardening/3.3.9_disable_ipv6_router_advertisement.sh index f85b20d..f424d6e 100644 --- a/tests/hardening/3.3.9_disable_ipv6_router_advertisement.sh +++ b/tests/hardening/3.3.9_disable_ipv6_router_advertisement.sh @@ -7,5 +7,26 @@ test_audit() { # shellcheck disable=2154 run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all - # TODO fill comprehensive tests + if [ -f "/.dockerenv" ]; then + skip "SKIPPED on docker" + else + describe Tests purposely failing + sysctl -w net.ipv6.conf.all.accept_ra=1 net.ipv6.conf.default.accept_ra=1 2>/dev/null + register_test retvalshouldbe 1 + register_test contain " net.ipv6.conf.all.accept_ra was not set to 0" + register_test contain "net.ipv6.conf.default.accept_ra was not set to 0" + + run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + describe correcting situation + sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg + /opt/debian-cis/bin/hardening/"${script}".sh --apply || true + + describe Checking resolved state + register_test retvalshouldbe 0 + register_test contain "correctly set to 0" + register_test contain "net.ipv6.conf.all.accept_ra correctly set to 0" + register_test contain "net.ipv6.conf.default.accept_ra correctly set to 0" + run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + fi }