From 5f2803693ee29603015b1125689003a66e5ef56b Mon Sep 17 00:00:00 2001
From: Charles Herlin <charles.herlin@corp.ovh.com>
Date: Thu, 14 Feb 2019 14:33:21 +0100
Subject: [PATCH] Change default status to audit for file with custom
 `create_config`

---
 bin/hardening/10.2_disable_system_accounts.sh     | 2 +-
 bin/hardening/12.10_find_suid_files.sh            | 2 +-
 bin/hardening/12.11_find_sgid_files.sh            | 2 +-
 bin/hardening/13.14_check_duplicate_uid.sh        | 2 +-
 bin/hardening/13.5_find_0_uid_non_root_account.sh | 2 +-
 bin/hardening/13.7_check_user_dir_perm.sh         | 2 +-
 bin/hardening/8.2.4_set_logfile_perm.sh           | 2 +-
 bin/hardening/8.2.5_syslog-ng_remote_host.sh      | 2 +-
 bin/hardening/9.3.12_sshd_idle_timeout.sh         | 2 +-
 bin/hardening/9.3.13_sshd_limit_access.sh         | 2 +-
 bin/hardening/9.3.14_ssh_banner.sh                | 2 +-
 bin/hardening/99.3.2_acc_sudoers_no_all.sh        | 2 +-
 bin/hardening/99.5.2.1_ssh_cry_kex.sh             | 2 +-
 bin/hardening/99.5.2.2_ssh_cry_mac.sh             | 2 +-
 bin/hardening/99.5.4_ssh_keys_from.sh             | 2 +-
 15 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/bin/hardening/10.2_disable_system_accounts.sh b/bin/hardening/10.2_disable_system_accounts.sh
index 5a5791a..4573a6f 100755
--- a/bin/hardening/10.2_disable_system_accounts.sh
+++ b/bin/hardening/10.2_disable_system_accounts.sh
@@ -76,7 +76,7 @@ apply () {
 # This function will create the config file for this check with default values
 create_config() {
     cat <<EOF
-status=disabled
+status=audit
 # Put here your exceptions concerning admin accounts shells separated by spaces
 EXCEPTIONS=""
 EOF
diff --git a/bin/hardening/12.10_find_suid_files.sh b/bin/hardening/12.10_find_suid_files.sh
index b40e7fe..5acea74 100755
--- a/bin/hardening/12.10_find_suid_files.sh
+++ b/bin/hardening/12.10_find_suid_files.sh
@@ -46,7 +46,7 @@ apply () {
 # This function will create the config file for this check with default values
 create_config() {
     cat <<EOF
-status=disabled
+status=audit
 # Put Here your valid suid binaries so that they do not appear during the audit
 EXCEPTIONS="/bin/mount /usr/bin/mount /bin/ping /usr/bin/ping /bin/ping6 /usr/bin/ping6 /bin/su /usr/bin/su /bin/umount /usr/bin/umount /usr/bin/chfn /usr/bin/chsh /usr/bin/fping /usr/bin/fping6 /usr/bin/gpasswd /usr/bin/mtr /usr/bin/newgrp /usr/bin/passwd /usr/bin/sudo /usr/bin/sudoedit /usr/lib/openssh/ssh-keysign /usr/lib/pt_chown /usr/bin/at"
 EOF
diff --git a/bin/hardening/12.11_find_sgid_files.sh b/bin/hardening/12.11_find_sgid_files.sh
index a637704..17ddedf 100755
--- a/bin/hardening/12.11_find_sgid_files.sh
+++ b/bin/hardening/12.11_find_sgid_files.sh
@@ -46,7 +46,7 @@ apply () {
 # This function will create the config file for this check with default values
 create_config() {
     cat <<EOF
-status=disabled
+status=audit
 # Put here valid binaries with sgid enabled separated by spaces
 EXCEPTIONS="/sbin/unix_chkpwd /usr/sbin/unix_chkpwd /usr/bin/bsd-write /usr/bin/chage /usr/bin/crontab /usr/bin/expiry /usr/bin/mutt_dotlock /usr/bin/screen /usr/bin/ssh-agent /usr/bin/wall /usr/sbin/postdrop /usr/sbin/postqueue /usr/bin/at /usr/bin/dotlockfile /usr/bin/mail-lock /usr/bin/mail-touchlock /usr/bin/mail-unlock"
 EOF
diff --git a/bin/hardening/13.14_check_duplicate_uid.sh b/bin/hardening/13.14_check_duplicate_uid.sh
index 592409d..df5ab37 100755
--- a/bin/hardening/13.14_check_duplicate_uid.sh
+++ b/bin/hardening/13.14_check_duplicate_uid.sh
@@ -53,7 +53,7 @@ apply () {
 # This function will create the config file for this check with default values
 create_config() {
     cat <<EOF
-status=disabled
+status=audit
 # Put here valid UIDs for which multiple usernames are accepted
 EXCEPTIONS=""
 EOF
diff --git a/bin/hardening/13.5_find_0_uid_non_root_account.sh b/bin/hardening/13.5_find_0_uid_non_root_account.sh
index 68e91c9..8043bd3 100755
--- a/bin/hardening/13.5_find_0_uid_non_root_account.sh
+++ b/bin/hardening/13.5_find_0_uid_non_root_account.sh
@@ -52,7 +52,7 @@ apply () {
 # This function will create the config file for this check with default values
 create_config() {
     cat <<EOF
-status=disabled
+status=audit
 # Put here valid accounts with uid 0 separated by spaces
 EXCEPTIONS=""
 EOF
diff --git a/bin/hardening/13.7_check_user_dir_perm.sh b/bin/hardening/13.7_check_user_dir_perm.sh
index 5234eac..48f5170 100755
--- a/bin/hardening/13.7_check_user_dir_perm.sh
+++ b/bin/hardening/13.7_check_user_dir_perm.sh
@@ -92,7 +92,7 @@ apply () {
 # This function will create the config file for this check with default values
 create_config() {
     cat <<EOF
-status=disabled
+status=audit
 # Put here user home directories exceptions, separated by spaces
 EXCEPTIONS=""
 EOF
diff --git a/bin/hardening/8.2.4_set_logfile_perm.sh b/bin/hardening/8.2.4_set_logfile_perm.sh
index eda3f64..7d0ed25 100755
--- a/bin/hardening/8.2.4_set_logfile_perm.sh
+++ b/bin/hardening/8.2.4_set_logfile_perm.sh
@@ -70,7 +70,7 @@ apply () {
 # This function will create the config file for this check with default values
 create_config() {
     cat <<EOF
-status=disabled
+status=audit
 SYSLOG_BASEDIR='/etc/syslog-ng'
 EOF
 }
diff --git a/bin/hardening/8.2.5_syslog-ng_remote_host.sh b/bin/hardening/8.2.5_syslog-ng_remote_host.sh
index 1742718..03ca7f3 100755
--- a/bin/hardening/8.2.5_syslog-ng_remote_host.sh
+++ b/bin/hardening/8.2.5_syslog-ng_remote_host.sh
@@ -41,7 +41,7 @@ apply () {
 # This function will create the config file for this check with default values
 create_config() {
     cat <<EOF
-status=disabled
+status=audit
 SYSLOG_BASEDIR='/etc/syslog-ng'
 EOF
 }
diff --git a/bin/hardening/9.3.12_sshd_idle_timeout.sh b/bin/hardening/9.3.12_sshd_idle_timeout.sh
index 74ed9d0..98aaa4d 100755
--- a/bin/hardening/9.3.12_sshd_idle_timeout.sh
+++ b/bin/hardening/9.3.12_sshd_idle_timeout.sh
@@ -73,7 +73,7 @@ apply () {
 # This function will create the config file for this check with default values
 create_config() {
     cat <<EOF
-status=disabled
+status=audit
 # In seconds, value of ClientAliveInterval, ClientAliveCountMax bedoing set to 0
 # Settles sshd idle timeout
 SSHD_TIMEOUT=900
diff --git a/bin/hardening/9.3.13_sshd_limit_access.sh b/bin/hardening/9.3.13_sshd_limit_access.sh
index dbeaa4c..a4d75ad 100755
--- a/bin/hardening/9.3.13_sshd_limit_access.sh
+++ b/bin/hardening/9.3.13_sshd_limit_access.sh
@@ -74,7 +74,7 @@ apply () {
 # This function will create the config file for this check with default values
 create_config() {
     cat <<EOF
-status=disabled
+status=audit
 # Put here ssh user hardening list, there is a default in script to not break your configuration
 # However, it can erase current configuration
 ALLOWED_USERS=''
diff --git a/bin/hardening/9.3.14_ssh_banner.sh b/bin/hardening/9.3.14_ssh_banner.sh
index 9aeb2e2..5f52511 100755
--- a/bin/hardening/9.3.14_ssh_banner.sh
+++ b/bin/hardening/9.3.14_ssh_banner.sh
@@ -70,7 +70,7 @@ apply () {
 # This function will create the config file for this check with default values
 create_config() {
     cat <<EOF
-status=disabled
+status=audit
 # Put here banner file, defaults to /etc/issue.net
 BANNER_FILE=""
 EOF
diff --git a/bin/hardening/99.3.2_acc_sudoers_no_all.sh b/bin/hardening/99.3.2_acc_sudoers_no_all.sh
index 233076c..d57f681 100755
--- a/bin/hardening/99.3.2_acc_sudoers_no_all.sh
+++ b/bin/hardening/99.3.2_acc_sudoers_no_all.sh
@@ -69,7 +69,7 @@ apply () {
 # This function will create the config file for this check with default values
 create_config() {
     cat <<EOF
-status=disabled
+status=audit
 # Put EXCEPTION account names here, space separated
 EXCEPT="root %root %sudo %wheel"
 EOF
diff --git a/bin/hardening/99.5.2.1_ssh_cry_kex.sh b/bin/hardening/99.5.2.1_ssh_cry_kex.sh
index baf3953..faa1bae 100755
--- a/bin/hardening/99.5.2.1_ssh_cry_kex.sh
+++ b/bin/hardening/99.5.2.1_ssh_cry_kex.sh
@@ -85,7 +85,7 @@ create_config() {
     fi
     set -u
     cat <<EOF
-status=disabled
+status=audit
 # Put your KexAlgorithms
 OPTIONS="KexAlgorithms=$KEX"
 EOF
diff --git a/bin/hardening/99.5.2.2_ssh_cry_mac.sh b/bin/hardening/99.5.2.2_ssh_cry_mac.sh
index 255de11..bf6e0b9 100755
--- a/bin/hardening/99.5.2.2_ssh_cry_mac.sh
+++ b/bin/hardening/99.5.2.2_ssh_cry_mac.sh
@@ -76,7 +76,7 @@ apply () {
 # This function will create the config file for this check with default values
 create_config() {
     cat <<EOF
-status=disabled
+status=audit
 # Put your MACs
 OPTIONS="MACs=umac-128-etm@openssh.com,umac-64-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128@openssh.com,umac-64@openssh.com,hmac-sha2-512,hmac-sha2-256"
 EOF
diff --git a/bin/hardening/99.5.4_ssh_keys_from.sh b/bin/hardening/99.5.4_ssh_keys_from.sh
index f504708..b0f4b20 100755
--- a/bin/hardening/99.5.4_ssh_keys_from.sh
+++ b/bin/hardening/99.5.4_ssh_keys_from.sh
@@ -143,7 +143,7 @@ apply () {
 
 create_config() {
     cat <<EOF
-status=disabled
+status=audit
 # Put authorized IPs you want to allow in "from" field of authorized_keys
 ALLOWED_IPS=""
 EOF