From 6c93b453bcc261d4d8a6e7378b386f6307ab58d1 Mon Sep 17 00:00:00 2001
From: damien cavagnini <damien.cavagnini@corp.ovh.com>
Date: Thu, 31 Jul 2025 12:16:03 +0200
Subject: [PATCH] feat: add debian12 scripts

- aide_daliy_check				-> 6.1.2
- journald_is_enabled.sh 			-> 6.2.1.1.1
- systemd_journald_remote_is_installed.sh 	-> 6.2.1.2.1
- systemd_journal_upload_is_enabled.sh -	-> 6.2.1.2.3
- systemd_journal_remote_is_disabled.sh 	-> 6.2.1.2.4
---
 .pre-commit-config.yaml                       |   7 ++
 bin/hardening/aide_daily_check.sh             |  81 +++++++++++++
 bin/hardening/journald_is_enabled.sh          |  80 +++++++++++++
 bin/hardening/network_services_listening.sh   |  86 +++++++++++++
 .../systemd_journal_remote_is_disabled.sh     | 113 ++++++++++++++++++
 .../systemd_journal_remote_is_installed.sh    |  66 ++++++++++
 .../systemd_journal_upload_is_enabled.sh      |  80 +++++++++++++
 cisharden.sudoers                             |   5 +-
 hooks/check_is_executable.sh                  |   7 ++
 tests/hardening/aide_daily_check.sh           |  10 ++
 tests/hardening/journald_is_enabled.sh        |  11 ++
 .../systemd_journal_remote_is_disabled.sh     |  11 ++
 .../systemd_journal_remote_is_installed.sh    |  23 ++++
 .../systemd_journal_upload_is_enabled.sh      |  11 ++
 14 files changed, 590 insertions(+), 1 deletion(-)
 create mode 100755 bin/hardening/aide_daily_check.sh
 create mode 100755 bin/hardening/journald_is_enabled.sh
 create mode 100755 bin/hardening/network_services_listening.sh
 create mode 100755 bin/hardening/systemd_journal_remote_is_disabled.sh
 create mode 100755 bin/hardening/systemd_journal_remote_is_installed.sh
 create mode 100755 bin/hardening/systemd_journal_upload_is_enabled.sh
 create mode 100755 hooks/check_is_executable.sh
 create mode 100644 tests/hardening/aide_daily_check.sh
 create mode 100644 tests/hardening/journald_is_enabled.sh
 create mode 100644 tests/hardening/systemd_journal_remote_is_disabled.sh
 create mode 100644 tests/hardening/systemd_journal_remote_is_installed.sh
 create mode 100644 tests/hardening/systemd_journal_upload_is_enabled.sh

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index f98f44e..dbb73cc 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -22,3 +22,10 @@ repos:
         language: script
         pass_filenames: true
         files: "^(bin|tests)/hardening/"
+      - id: check_is_executable
+        name: check_is_executable.sh
+        description: Ensure checks are executables
+        entry: hooks/check_is_executable.sh
+        language: script
+        pass_filenames: true
+        files: "^bin/hardening/"
diff --git a/bin/hardening/aide_daily_check.sh b/bin/hardening/aide_daily_check.sh
new file mode 100755
index 0000000..a316ddf
--- /dev/null
+++ b/bin/hardening/aide_daily_check.sh
@@ -0,0 +1,81 @@
+#!/bin/bash
+
+# run-shellcheck
+#
+# CIS Debian Hardening
+#
+
+#
+# Ensure AIDE daily checks (Automated)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+# shellcheck disable=2034
+HARDENING_LEVEL=3
+# shellcheck disable=2034
+DESCRIPTION="Ensure AIDE daily checks"
+SERVICE="dailyaidecheck.service"
+TIMER="dailyaidecheck.timer"
+
+# This function will be called if the script status is on enabled / audit mode
+audit() {
+    SERVICE_ENABLED=1
+    TIMER_ENABLED=1
+
+    is_service_enabled "$SERVICE"
+    if [ "$FNRET" -eq 0 ]; then
+        SERVICE_ENABLED=0
+        ok "$SERVICE is enabled"
+    else
+        crit "$SERVICE is not enabled"
+    fi
+
+    is_timer_enabled "$TIMER"
+    if [ "$FNRET" -eq 0 ]; then
+        TIMER_ENABLED=0
+        ok "$TIMER is enabled"
+    else
+        crit "$TIMER is not enabled"
+    fi
+}
+
+# This function will be called if the script status is on enabled mode
+apply() {
+    audit
+    if [ "$SERVICE_ENABLED" -ne 0 ]; then
+        manage_service unmask "$SERVICE"
+        manage_service enable "$SERVICE"
+    fi
+
+    if [ "$TIMER_ENABLED" -ne 0 ]; then
+        manage_service unmask "$TIMER"
+        manage_service enable "$TIMER"
+    fi
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ -r /etc/default/cis-hardening ]; then
+    # shellcheck source=../../debian/default
+    . /etc/default/cis-hardening
+fi
+if [ -z "$CIS_LIB_DIR" ]; then
+    echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
+    echo "Cannot source CIS_LIB_DIR variable, aborting."
+    exit 128
+fi
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
+    # shellcheck source=../../lib/main.sh
+    . "${CIS_LIB_DIR}"/main.sh
+else
+    echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
+    exit 128
+fi
diff --git a/bin/hardening/journald_is_enabled.sh b/bin/hardening/journald_is_enabled.sh
new file mode 100755
index 0000000..896bddf
--- /dev/null
+++ b/bin/hardening/journald_is_enabled.sh
@@ -0,0 +1,80 @@
+#!/bin/bash
+
+# run-shellcheck
+#
+# CIS Debian Hardening
+#
+
+#
+# Ensure journald service is enabled and active (Automated)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+# shellcheck disable=2034
+HARDENING_LEVEL=3
+# shellcheck disable=2034
+DESCRIPTION="Ensure journald service is enabled and active"
+SERVICE="systemd-journald.service"
+
+# This function will be called if the script status is on enabled / audit mode
+audit() {
+    SERVICE_ENABLED=1
+    SERVICE_ACTIVE=1
+
+    is_service_enabled "$SERVICE"
+    if [ "$FNRET" -eq 0 ]; then
+        ok "$SERVICE is enabled"
+        SERVICE_ENABLED=0
+    else
+        crit "$SERVICE is not enabled"
+    fi
+
+    is_service_active "$SERVICE"
+    if [ "$FNRET" -eq 0 ]; then
+        ok "$SERVICE is active"
+        SERVICE_ACTIVE=0
+    else
+        crit "$SERVICE is not active"
+    fi
+}
+
+# This function will be called if the script status is on enabled mode
+apply() {
+    audit
+    if [ "$SERVICE_ENABLED" -ne 0 ]; then
+        manage_service unmask "$SERVICE"
+        manage_service enable "$SERVICE"
+    fi
+
+    if [ "$SERVICE_ACTIVE" -ne 0 ]; then
+        manage_service start "$SERVICE"
+    fi
+
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ -r /etc/default/cis-hardening ]; then
+    # shellcheck source=../../debian/default
+    . /etc/default/cis-hardening
+fi
+if [ -z "$CIS_LIB_DIR" ]; then
+    echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
+    echo "Cannot source CIS_LIB_DIR variable, aborting."
+    exit 128
+fi
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
+    # shellcheck source=../../lib/main.sh
+    . "${CIS_LIB_DIR}"/main.sh
+else
+    echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
+    exit 128
+fi
diff --git a/bin/hardening/network_services_listening.sh b/bin/hardening/network_services_listening.sh
new file mode 100755
index 0000000..78c6d0f
--- /dev/null
+++ b/bin/hardening/network_services_listening.sh
@@ -0,0 +1,86 @@
+#!/bin/bash
+
+# run-shellcheck
+#
+# CIS Debian Hardening
+#
+
+#
+# Ensure only approved services are listening on a network interface (Manual)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+# shellcheck disable=2034
+HARDENING_LEVEL=3
+# shellcheck disable=2034
+DESCRIPTION="Ensure only approved services are listening on a network interface"
+# socket
+# ex: "127.0.0.1:123 0.0.0.0:123"
+# we only care about the socket, as there may be different process for a same service
+# ex: ntp or chrony for time synchronization
+EXCEPTIONS=""
+
+# This function will be called if the script status is on enabled / audit mode
+audit() {
+    # shellcheck disable=2162
+    while read i; do
+        socket=$(echo "$i" | awk '{print $5}')
+        proc=$(echo "$i" | awk '{print $7}' | awk -F ',' '{print $1}' | sed 's/users:((//')
+        if [ -n "$socket" ]; then
+            info -e "$proc listening on \t$socket"
+
+            # output example :
+            # "ntpd" listening on 	127.0.0.1:123
+            # "ntpd" listening on 	0.0.0.0:123
+
+            if grep -w "$socket" <<<"$EXCEPTIONS" >/dev/null; then
+                debug "$socket" is an exception
+            else
+                crit "$socket" is not an exception
+            fi
+        fi
+
+    done <<<"$($SUDO_CMD ss -plntuH)"
+
+}
+
+# This function will be called if the script status is on enabled mode
+apply() {
+    info "This recommendation has to be reviewed and applied manually"
+}
+
+create_config() {
+    # we try to put as default all services that should be running according to the CIS recommendation
+    cat <<EOF
+status=audit
+# Put your custom configuration here
+EXCEPTIONS="127.0.0.1:123 0.0.0.0:123 0.0.0.0:22"
+EOF
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ -r /etc/default/cis-hardening ]; then
+    # shellcheck source=../../debian/default
+    . /etc/default/cis-hardening
+fi
+if [ -z "$CIS_LIB_DIR" ]; then
+    echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
+    echo "Cannot source CIS_LIB_DIR variable, aborting."
+    exit 128
+fi
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
+    # shellcheck source=../../lib/main.sh
+    . "${CIS_LIB_DIR}"/main.sh
+else
+    echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
+    exit 128
+fi
diff --git a/bin/hardening/systemd_journal_remote_is_disabled.sh b/bin/hardening/systemd_journal_remote_is_disabled.sh
new file mode 100755
index 0000000..c4773f0
--- /dev/null
+++ b/bin/hardening/systemd_journal_remote_is_disabled.sh
@@ -0,0 +1,113 @@
+#!/bin/bash
+
+# run-shellcheck
+#
+# CIS Debian Hardening
+#
+
+#
+# Ensure systemd-journal-remote service is not in use (Automated)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+# shellcheck disable=2034
+HARDENING_LEVEL=3
+# shellcheck disable=2034
+DESCRIPTION="Ensure systemd-journal-remote service is not in use"
+SERVICE="systemd-journal-remote.service"
+SOCKET="systemd-journal-remote.socket"
+
+# This function will be called if the script status is on enabled / audit mode
+audit() {
+    SERVICE_ENABLED=1
+    SERVICE_ACTIVE=1
+    SOCKET_ENABLED=1
+    SOCKET_ACTIVE=1
+
+    is_service_enabled "$SERVICE"
+    if [ "$FNRET" -eq 0 ]; then
+        crit "$SERVICE is enabled"
+        SERVICE_ENABLED=0
+    else
+        ok "$SERVICE is not enabled"
+    fi
+
+    is_service_active "$SERVICE"
+    if [ "$FNRET" -eq 0 ]; then
+        crit "$SERVICE is active"
+        SERVICE_ACTIVE=0
+    else
+        ok "$SERVICE is not active"
+    fi
+
+    is_socket_enabled "$SOCKET"
+    if [ "$FNRET" -eq 0 ]; then
+        crit "$SOCKET is enabled"
+        SOCKET_ENABLED=0
+    else
+        ok "$SOCKET is not enabled"
+    fi
+
+    is_socket_active "$SOCKET"
+    if [ "$FNRET" -eq 0 ]; then
+        crit "$SOCKET is active"
+        SOCKET_ACTIVE=0
+    else
+        ok "$SOCKET is not active"
+    fi
+
+}
+
+# This function will be called if the script status is on enabled mode
+apply() {
+    audit
+    if [ "$SERVICE_ENABLED" -eq 0 ]; then
+        info "Disabling and masking $SERVICE"
+        manage_service disable "$SERVICE"
+        manage_service mask "$SERVICE"
+    fi
+
+    if [ "$SERVICE_ACTIVE" -eq 0 ]; then
+        info "Stopping $SERVICE"
+        manage_service stop "$SERVICE"
+    fi
+
+    if [ "$SOCKET_ENABLED" -eq 0 ]; then
+        info "Disabling and masking $SOCKET"
+        manage_service disable "$SOCKET"
+        manage_service mask "$SOCKET"
+    fi
+
+    if [ "$SOCKET_ACTIVE" -eq 0 ]; then
+        info "Stopping $SOCKET"
+        manage_service stop "$SOCKET"
+    fi
+
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ -r /etc/default/cis-hardening ]; then
+    # shellcheck source=../../debian/default
+    . /etc/default/cis-hardening
+fi
+if [ -z "$CIS_LIB_DIR" ]; then
+    echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
+    echo "Cannot source CIS_LIB_DIR variable, aborting."
+    exit 128
+fi
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
+    # shellcheck source=../../lib/main.sh
+    . "${CIS_LIB_DIR}"/main.sh
+else
+    echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
+    exit 128
+fi
diff --git a/bin/hardening/systemd_journal_remote_is_installed.sh b/bin/hardening/systemd_journal_remote_is_installed.sh
new file mode 100755
index 0000000..50321d3
--- /dev/null
+++ b/bin/hardening/systemd_journal_remote_is_installed.sh
@@ -0,0 +1,66 @@
+#!/bin/bash
+
+# run-shellcheck
+#
+# CIS Debian Hardening
+#
+
+#
+# Ensure systemd-journal-remote is installed (Automated)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+# shellcheck disable=2034
+HARDENING_LEVEL=3
+# shellcheck disable=2034
+DESCRIPTION="Ensure systemd-journal-remote is installed"
+PACKAGE="systemd-journal-remote"
+
+# This function will be called if the script status is on enabled / audit mode
+audit() {
+    PACKAGE_INSTALLED=1
+    is_pkg_installed "$PACKAGE"
+    if [ "$FNRET" != 0 ]; then
+        crit "$PACKAGE is absent!"
+    else
+        PACKAGE_INSTALLED=0
+        ok "$PACKAGE is installed"
+    fi
+}
+
+# This function will be called if the script status is on enabled mode
+apply() {
+    audit
+    if [ "$PACKAGE_INSTALLED" -eq 1 ]; then
+        info "installing '$PACKAGE'"
+        apt_install "$PACKAGE"
+        info "'$PACKAGE' installed"
+    fi
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ -r /etc/default/cis-hardening ]; then
+    # shellcheck source=../../debian/default
+    . /etc/default/cis-hardening
+fi
+if [ -z "$CIS_LIB_DIR" ]; then
+    echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
+    echo "Cannot source CIS_LIB_DIR variable, aborting."
+    exit 128
+fi
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
+    # shellcheck source=../../lib/main.sh
+    . "${CIS_LIB_DIR}"/main.sh
+else
+    echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
+    exit 128
+fi
diff --git a/bin/hardening/systemd_journal_upload_is_enabled.sh b/bin/hardening/systemd_journal_upload_is_enabled.sh
new file mode 100755
index 0000000..efeeaf9
--- /dev/null
+++ b/bin/hardening/systemd_journal_upload_is_enabled.sh
@@ -0,0 +1,80 @@
+#!/bin/bash
+
+# run-shellcheck
+#
+# CIS Debian Hardening
+#
+
+#
+# Ensure systemd-journal-upload is enabled and active (Automated)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+# shellcheck disable=2034
+HARDENING_LEVEL=3
+# shellcheck disable=2034
+DESCRIPTION="Ensure systemd-journal-upload is enabled and active"
+SERVICE="systemd-journal-upload.service"
+
+# This function will be called if the script status is on enabled / audit mode
+audit() {
+    SERVICE_ENABLED=1
+    SERVICE_ACTIVE=1
+
+    is_service_enabled "$SERVICE"
+    if [ "$FNRET" -eq 0 ]; then
+        ok "$SERVICE is enabled"
+        SERVICE_ENABLED=0
+    else
+        crit "$SERVICE is not enabled"
+    fi
+
+    is_service_active "$SERVICE"
+    if [ "$FNRET" -eq 0 ]; then
+        ok "$SERVICE is active"
+        SERVICE_ACTIVE=0
+    else
+        crit "$SERVICE is not active"
+    fi
+}
+
+# This function will be called if the script status is on enabled mode
+apply() {
+    audit
+    if [ "$SERVICE_ENABLED" -ne 0 ]; then
+        manage_service unmask "$SERVICE"
+        manage_service enable "$SERVICE"
+    fi
+
+    if [ "$SERVICE_ACTIVE" -ne 0 ]; then
+        manage_service start "$SERVICE"
+    fi
+
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ -r /etc/default/cis-hardening ]; then
+    # shellcheck source=../../debian/default
+    . /etc/default/cis-hardening
+fi
+if [ -z "$CIS_LIB_DIR" ]; then
+    echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
+    echo "Cannot source CIS_LIB_DIR variable, aborting."
+    exit 128
+fi
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
+    # shellcheck source=../../lib/main.sh
+    . "${CIS_LIB_DIR}"/main.sh
+else
+    echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
+    exit 128
+fi
diff --git a/cisharden.sudoers b/cisharden.sudoers
index 5f35f5a..bcc95c9 100644
--- a/cisharden.sudoers
+++ b/cisharden.sudoers
@@ -24,6 +24,9 @@ Cmnd_Alias SCL_CMD =    /bin/grep ,\
                         /sbin/lsmod,\
                         /sbin/modprobe,\
                         /usr/sbin/modprobe -n -v*,\
-                        /usr/sbin/apparmor_status
+                        /usr/sbin/apparmor_status,\
+                        /usr/bin/ss *,\
+                        /bin/ss *,\
+                        /usr/bin/ps *
 
 cisharden ALL = (root) NOPASSWD: SCL_CMD
diff --git a/hooks/check_is_executable.sh b/hooks/check_is_executable.sh
new file mode 100755
index 0000000..f3ca2db
--- /dev/null
+++ b/hooks/check_is_executable.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+for script in "$@"; do
+    chmod +x "$script"
+done
+
+exit 0
diff --git a/tests/hardening/aide_daily_check.sh b/tests/hardening/aide_daily_check.sh
new file mode 100644
index 0000000..b9b529d
--- /dev/null
+++ b/tests/hardening/aide_daily_check.sh
@@ -0,0 +1,10 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    # running on a container, not much to test here
+    describe Running on blank host
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+}
diff --git a/tests/hardening/journald_is_enabled.sh b/tests/hardening/journald_is_enabled.sh
new file mode 100644
index 0000000..c2dc702
--- /dev/null
+++ b/tests/hardening/journald_is_enabled.sh
@@ -0,0 +1,11 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+
+    # not much to test here, we are running in a container, we wont check service state
+    describe Checking blank host
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+}
diff --git a/tests/hardening/systemd_journal_remote_is_disabled.sh b/tests/hardening/systemd_journal_remote_is_disabled.sh
new file mode 100644
index 0000000..7aefc09
--- /dev/null
+++ b/tests/hardening/systemd_journal_remote_is_disabled.sh
@@ -0,0 +1,11 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+
+    # not much to test here, we are running in a container, we wont check service state
+    describe Checking blank host
+    register_test retvalshouldbe 0
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+}
diff --git a/tests/hardening/systemd_journal_remote_is_installed.sh b/tests/hardening/systemd_journal_remote_is_installed.sh
new file mode 100644
index 0000000..09fd036
--- /dev/null
+++ b/tests/hardening/systemd_journal_remote_is_installed.sh
@@ -0,0 +1,23 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    describe set up failed check
+    apt remove -y systemd-journal-remote
+
+    describe Running failed test
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run failure "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe Fix situation
+    sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
+    "${CIS_CHECKS_DIR}/${script}.sh" --apply || true
+
+    describe running successfull audit
+    register_test retvalshouldbe 0
+    # shellcheck disable=2154
+    run success "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    apt remove -y systemd-journal-remote
+    apt autoremove -y
+}
diff --git a/tests/hardening/systemd_journal_upload_is_enabled.sh b/tests/hardening/systemd_journal_upload_is_enabled.sh
new file mode 100644
index 0000000..c2dc702
--- /dev/null
+++ b/tests/hardening/systemd_journal_upload_is_enabled.sh
@@ -0,0 +1,11 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+
+    # not much to test here, we are running in a container, we wont check service state
+    describe Checking blank host
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+}