feat: add debian12 scripts

- aide_daliy_check				-> 6.1.2
- journald_is_enabled.sh 			-> 6.2.1.1.1
- systemd_journald_remote_is_installed.sh 	-> 6.2.1.2.1
- systemd_journal_upload_is_enabled.sh -	-> 6.2.1.2.3
- systemd_journal_remote_is_disabled.sh 	-> 6.2.1.2.4

.pre-commit-config.yaml

@@ -22,3 +22,10 @@ repos:
         language: script
         pass_filenames: true
         files: "^(bin|tests)/hardening/"
+      - id: check_is_executable
+        name: check_is_executable.sh
+        description: Ensure checks are executables
+        entry: hooks/check_is_executable.sh
+        language: script
+        pass_filenames: true
+        files: "^bin/hardening/"

bin/hardening/aide_daily_check.sh

@@ -0,0 +1,81 @@
+#!/bin/bash
+
+# run-shellcheck
+#
+# CIS Debian Hardening
+#
+
+#
+# Ensure AIDE daily checks (Automated)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+# shellcheck disable=2034
+HARDENING_LEVEL=3
+# shellcheck disable=2034
+DESCRIPTION="Ensure AIDE daily checks"
+SERVICE="dailyaidecheck.service"
+TIMER="dailyaidecheck.timer"
+
+# This function will be called if the script status is on enabled / audit mode
+audit() {
+    SERVICE_ENABLED=1
+    TIMER_ENABLED=1
+
+    is_service_enabled "$SERVICE"
+    if [ "$FNRET" -eq 0 ]; then
+        SERVICE_ENABLED=0
+        ok "$SERVICE is enabled"
+    else
+        crit "$SERVICE is not enabled"
+    fi
+
+    is_timer_enabled "$TIMER"
+    if [ "$FNRET" -eq 0 ]; then
+        TIMER_ENABLED=0
+        ok "$TIMER is enabled"
+    else
+        crit "$TIMER is not enabled"
+    fi
+}
+
+# This function will be called if the script status is on enabled mode
+apply() {
+    audit
+    if [ "$SERVICE_ENABLED" -ne 0 ]; then
+        manage_service unmask "$SERVICE"
+        manage_service enable "$SERVICE"
+    fi
+
+    if [ "$TIMER_ENABLED" -ne 0 ]; then
+        manage_service unmask "$TIMER"
+        manage_service enable "$TIMER"
+    fi
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ -r /etc/default/cis-hardening ]; then
+    # shellcheck source=../../debian/default
+    . /etc/default/cis-hardening
+fi
+if [ -z "$CIS_LIB_DIR" ]; then
+    echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
+    echo "Cannot source CIS_LIB_DIR variable, aborting."
+    exit 128
+fi
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
+    # shellcheck source=../../lib/main.sh
+    . "${CIS_LIB_DIR}"/main.sh
+else
+    echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
+    exit 128
+fi

bin/hardening/journald_is_enabled.sh

@@ -0,0 +1,80 @@
+#!/bin/bash
+
+# run-shellcheck
+#
+# CIS Debian Hardening
+#
+
+#
+# Ensure journald service is enabled and active (Automated)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+# shellcheck disable=2034
+HARDENING_LEVEL=3
+# shellcheck disable=2034
+DESCRIPTION="Ensure journald service is enabled and active"
+SERVICE="systemd-journald.service"
+
+# This function will be called if the script status is on enabled / audit mode
+audit() {
+    SERVICE_ENABLED=1
+    SERVICE_ACTIVE=1
+
+    is_service_enabled "$SERVICE"
+    if [ "$FNRET" -eq 0 ]; then
+        ok "$SERVICE is enabled"
+        SERVICE_ENABLED=0
+    else
+        crit "$SERVICE is not enabled"
+    fi
+
+    is_service_active "$SERVICE"
+    if [ "$FNRET" -eq 0 ]; then
+        ok "$SERVICE is active"
+        SERVICE_ACTIVE=0
+    else
+        crit "$SERVICE is not active"
+    fi
+}
+
+# This function will be called if the script status is on enabled mode
+apply() {
+    audit
+    if [ "$SERVICE_ENABLED" -ne 0 ]; then
+        manage_service unmask "$SERVICE"
+        manage_service enable "$SERVICE"
+    fi
+
+    if [ "$SERVICE_ACTIVE" -ne 0 ]; then
+        manage_service start "$SERVICE"
+    fi
+
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ -r /etc/default/cis-hardening ]; then
+    # shellcheck source=../../debian/default
+    . /etc/default/cis-hardening
+fi
+if [ -z "$CIS_LIB_DIR" ]; then
+    echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
+    echo "Cannot source CIS_LIB_DIR variable, aborting."
+    exit 128
+fi
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
+    # shellcheck source=../../lib/main.sh
+    . "${CIS_LIB_DIR}"/main.sh
+else
+    echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
+    exit 128
+fi

bin/hardening/network_services_listening.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+
+# run-shellcheck
+#
+# CIS Debian Hardening
+#
+
+#
+# Ensure only approved services are listening on a network interface (Manual)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+# shellcheck disable=2034
+HARDENING_LEVEL=3
+# shellcheck disable=2034
+DESCRIPTION="Ensure only approved services are listening on a network interface"
+# socket
+# ex: "127.0.0.1:123 0.0.0.0:123"
+# we only care about the socket, as there may be different process for a same service
+# ex: ntp or chrony for time synchronization
+EXCEPTIONS=""
+
+# This function will be called if the script status is on enabled / audit mode
+audit() {
+    # shellcheck disable=2162
+    while read i; do
+        socket=$(echo "$i" | awk '{print $5}')
+        proc=$(echo "$i" | awk '{print $7}' | awk -F ',' '{print $1}' | sed 's/users:((//')
+        if [ -n "$socket" ]; then
+            info -e "$proc listening on \t$socket"
+
+            # output example :
+            # "ntpd" listening on 	127.0.0.1:123
+            # "ntpd" listening on 	0.0.0.0:123
+
+            if grep -w "$socket" <<<"$EXCEPTIONS" >/dev/null; then
+                debug "$socket" is an exception
+            else
+                crit "$socket" is not an exception
+            fi
+        fi
+
+    done <<<"$($SUDO_CMD ss -plntuH)"
+
+}
+
+# This function will be called if the script status is on enabled mode
+apply() {
+    info "This recommendation has to be reviewed and applied manually"
+}
+
+create_config() {
+    # we try to put as default all services that should be running according to the CIS recommendation
+    cat <<EOF
+status=audit
+# Put your custom configuration here
+EXCEPTIONS="127.0.0.1:123 0.0.0.0:123 0.0.0.0:22"
+EOF
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ -r /etc/default/cis-hardening ]; then
+    # shellcheck source=../../debian/default
+    . /etc/default/cis-hardening
+fi
+if [ -z "$CIS_LIB_DIR" ]; then
+    echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
+    echo "Cannot source CIS_LIB_DIR variable, aborting."
+    exit 128
+fi
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
+    # shellcheck source=../../lib/main.sh
+    . "${CIS_LIB_DIR}"/main.sh
+else
+    echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
+    exit 128
+fi

bin/hardening/systemd_journal_remote_is_disabled.sh

@@ -0,0 +1,113 @@
+#!/bin/bash
+
+# run-shellcheck
+#
+# CIS Debian Hardening
+#
+
+#
+# Ensure systemd-journal-remote service is not in use (Automated)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+# shellcheck disable=2034
+HARDENING_LEVEL=3
+# shellcheck disable=2034
+DESCRIPTION="Ensure systemd-journal-remote service is not in use"
+SERVICE="systemd-journal-remote.service"
+SOCKET="systemd-journal-remote.socket"
+
+# This function will be called if the script status is on enabled / audit mode
+audit() {
+    SERVICE_ENABLED=1
+    SERVICE_ACTIVE=1
+    SOCKET_ENABLED=1
+    SOCKET_ACTIVE=1
+
+    is_service_enabled "$SERVICE"
+    if [ "$FNRET" -eq 0 ]; then
+        crit "$SERVICE is enabled"
+        SERVICE_ENABLED=0
+    else
+        ok "$SERVICE is not enabled"
+    fi
+
+    is_service_active "$SERVICE"
+    if [ "$FNRET" -eq 0 ]; then
+        crit "$SERVICE is active"
+        SERVICE_ACTIVE=0
+    else
+        ok "$SERVICE is not active"
+    fi
+
+    is_socket_enabled "$SOCKET"
+    if [ "$FNRET" -eq 0 ]; then
+        crit "$SOCKET is enabled"
+        SOCKET_ENABLED=0
+    else
+        ok "$SOCKET is not enabled"
+    fi
+
+    is_socket_active "$SOCKET"
+    if [ "$FNRET" -eq 0 ]; then
+        crit "$SOCKET is active"
+        SOCKET_ACTIVE=0
+    else
+        ok "$SOCKET is not active"
+    fi
+
+}
+
+# This function will be called if the script status is on enabled mode
+apply() {
+    audit
+    if [ "$SERVICE_ENABLED" -eq 0 ]; then
+        info "Disabling and masking $SERVICE"
+        manage_service disable "$SERVICE"
+        manage_service mask "$SERVICE"
+    fi
+
+    if [ "$SERVICE_ACTIVE" -eq 0 ]; then
+        info "Stopping $SERVICE"
+        manage_service stop "$SERVICE"
+    fi
+
+    if [ "$SOCKET_ENABLED" -eq 0 ]; then
+        info "Disabling and masking $SOCKET"
+        manage_service disable "$SOCKET"
+        manage_service mask "$SOCKET"
+    fi
+
+    if [ "$SOCKET_ACTIVE" -eq 0 ]; then
+        info "Stopping $SOCKET"
+        manage_service stop "$SOCKET"
+    fi
+
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ -r /etc/default/cis-hardening ]; then
+    # shellcheck source=../../debian/default
+    . /etc/default/cis-hardening
+fi
+if [ -z "$CIS_LIB_DIR" ]; then
+    echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
+    echo "Cannot source CIS_LIB_DIR variable, aborting."
+    exit 128
+fi
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
+    # shellcheck source=../../lib/main.sh
+    . "${CIS_LIB_DIR}"/main.sh
+else
+    echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
+    exit 128
+fi

bin/hardening/systemd_journal_remote_is_installed.sh

@@ -0,0 +1,66 @@
+#!/bin/bash
+
+# run-shellcheck
+#
+# CIS Debian Hardening
+#
+
+#
+# Ensure systemd-journal-remote is installed (Automated)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+# shellcheck disable=2034
+HARDENING_LEVEL=3
+# shellcheck disable=2034
+DESCRIPTION="Ensure systemd-journal-remote is installed"
+PACKAGE="systemd-journal-remote"
+
+# This function will be called if the script status is on enabled / audit mode
+audit() {
+    PACKAGE_INSTALLED=1
+    is_pkg_installed "$PACKAGE"
+    if [ "$FNRET" != 0 ]; then
+        crit "$PACKAGE is absent!"
+    else
+        PACKAGE_INSTALLED=0
+        ok "$PACKAGE is installed"
+    fi
+}
+
+# This function will be called if the script status is on enabled mode
+apply() {
+    audit
+    if [ "$PACKAGE_INSTALLED" -eq 1 ]; then
+        info "installing '$PACKAGE'"
+        apt_install "$PACKAGE"
+        info "'$PACKAGE' installed"
+    fi
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ -r /etc/default/cis-hardening ]; then
+    # shellcheck source=../../debian/default
+    . /etc/default/cis-hardening
+fi
+if [ -z "$CIS_LIB_DIR" ]; then
+    echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
+    echo "Cannot source CIS_LIB_DIR variable, aborting."
+    exit 128
+fi
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
+    # shellcheck source=../../lib/main.sh
+    . "${CIS_LIB_DIR}"/main.sh
+else
+    echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
+    exit 128
+fi

bin/hardening/systemd_journal_upload_is_enabled.sh

@@ -0,0 +1,80 @@
+#!/bin/bash
+
+# run-shellcheck
+#
+# CIS Debian Hardening
+#
+
+#
+# Ensure systemd-journal-upload is enabled and active (Automated)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+# shellcheck disable=2034
+HARDENING_LEVEL=3
+# shellcheck disable=2034
+DESCRIPTION="Ensure systemd-journal-upload is enabled and active"
+SERVICE="systemd-journal-upload.service"
+
+# This function will be called if the script status is on enabled / audit mode
+audit() {
+    SERVICE_ENABLED=1
+    SERVICE_ACTIVE=1
+
+    is_service_enabled "$SERVICE"
+    if [ "$FNRET" -eq 0 ]; then
+        ok "$SERVICE is enabled"
+        SERVICE_ENABLED=0
+    else
+        crit "$SERVICE is not enabled"
+    fi
+
+    is_service_active "$SERVICE"
+    if [ "$FNRET" -eq 0 ]; then
+        ok "$SERVICE is active"
+        SERVICE_ACTIVE=0
+    else
+        crit "$SERVICE is not active"
+    fi
+}
+
+# This function will be called if the script status is on enabled mode
+apply() {
+    audit
+    if [ "$SERVICE_ENABLED" -ne 0 ]; then
+        manage_service unmask "$SERVICE"
+        manage_service enable "$SERVICE"
+    fi
+
+    if [ "$SERVICE_ACTIVE" -ne 0 ]; then
+        manage_service start "$SERVICE"
+    fi
+
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ -r /etc/default/cis-hardening ]; then
+    # shellcheck source=../../debian/default
+    . /etc/default/cis-hardening
+fi
+if [ -z "$CIS_LIB_DIR" ]; then
+    echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
+    echo "Cannot source CIS_LIB_DIR variable, aborting."
+    exit 128
+fi
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
+    # shellcheck source=../../lib/main.sh
+    . "${CIS_LIB_DIR}"/main.sh
+else
+    echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
+    exit 128
+fi

cisharden.sudoers

@@ -24,6 +24,9 @@ Cmnd_Alias SCL_CMD =    /bin/grep ,\
                         /sbin/lsmod,\
                         /sbin/modprobe,\
                         /usr/sbin/modprobe -n -v*,\
-                        /usr/sbin/apparmor_status
+                        /usr/sbin/apparmor_status,\
+                        /usr/bin/ss *,\
+                        /bin/ss *,\
+                        /usr/bin/ps *
 
 cisharden ALL = (root) NOPASSWD: SCL_CMD

hooks/check_is_executable.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+for script in "$@"; do
+    chmod +x "$script"
+done
+
+exit 0

tests/hardening/aide_daily_check.sh

@@ -0,0 +1,10 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    # running on a container, not much to test here
+    describe Running on blank host
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+}

tests/hardening/journald_is_enabled.sh

@@ -0,0 +1,11 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+
+    # not much to test here, we are running in a container, we wont check service state
+    describe Checking blank host
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+}

tests/hardening/systemd_journal_remote_is_disabled.sh

@@ -0,0 +1,11 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+
+    # not much to test here, we are running in a container, we wont check service state
+    describe Checking blank host
+    register_test retvalshouldbe 0
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+}

tests/hardening/systemd_journal_remote_is_installed.sh

@@ -0,0 +1,23 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+    describe set up failed check
+    apt remove -y systemd-journal-remote
+
+    describe Running failed test
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run failure "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe Fix situation
+    sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
+    "${CIS_CHECKS_DIR}/${script}.sh" --apply || true
+
+    describe running successfull audit
+    register_test retvalshouldbe 0
+    # shellcheck disable=2154
+    run success "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    apt remove -y systemd-journal-remote
+    apt autoremove -y
+}

tests/hardening/systemd_journal_upload_is_enabled.sh

@@ -0,0 +1,11 @@
+# shellcheck shell=bash
+# run-shellcheck
+test_audit() {
+
+    # not much to test here, we are running in a container, we wont check service state
+    describe Checking blank host
+    register_test retvalshouldbe 1
+    # shellcheck disable=2154
+    run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+}