elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-11-21 21:17:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

Syslog-ng fixes and enhancements (#226)

Browse Source 
* syslog-ng : fix remote host test and enhance Regex

fixes #124

* enh: add test for 4.2.1.6
This commit is contained in:
GoldenKiwi 2023-12-27 10:27:06 +01:00 committed by GitHub
parent c391723fe5
commit 73616af4eb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 37 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
bin/hardening/4.2.1.5_syslog-ng_remote_host.sh
View File

@ -16,10 +16,9 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=3
# shellcheck disable=2034
DESCRIPTION="Configure syslog-ng to send logs to a remote log host."
PACKAGE='syslog-ng'
PATTERN='destination[[:alnum:][:space:]*{]+(tcp|udp)[[:space:]]*\(\"[[:alnum:].]+\".'
SYSLOG_BASEDIR='/etc/syslog-ng'
PATTERN='destination[[:alnum:][:space:]*_*{]+(tcp|network|udp)[[:space:]]*\([[:space:]]*\"?[[:alnum:]\-.]+\"?.'
# This function will be called if the script status is on enabled / audit mode
audit() {

8
bin/hardening/4.2.1.6_remote_syslog-ng_acl.sh
View File

@ -18,9 +18,9 @@ HARDENING_LEVEL=3
DESCRIPTION="Configure syslog to accept remote syslog messages only on designated log hosts."
PACKAGE='syslog-ng'
SYSLOG_BASEDIR='/etc/syslog-ng'
REMOTE_HOST=""
PATTERN='source[[:alnum:][:space:]*{]+(tcp|udp)[[:space:]]*\(\"[[:alnum:].]+\".'
PATTERN='source[[:alnum:][:space:]*_*{]+(tcp|network|udp)[[:space:]]*\([[:space:]]*\"?[[:alnum:]\-.]+\"?.'
# This function will be called if the script status is on enabled / audit mode
audit() {
@ -37,7 +37,7 @@ audit() {
fi
done
if [[ "$REMOTE_HOST" ]]; then
if [[ "$REMOTE_HOST" ]] && [[ "$REMOTE_HOST" != 'false' ]]; then
info "This is the remote host, checking that it only accepts logs from specified zone"
if [ "$FOUND" = 1 ]; then
ok "$PATTERN is present in $FILES"
@ -70,7 +70,7 @@ apply() {
fi
done
if [[ "$REMOTE_HOST" ]]; then
if [[ "$REMOTE_HOST" ]] && [[ "$REMOTE_HOST" != 'false' ]]; then
info "This is the remote host, checking that it only accepts logs from specified zone"
if [ "$FOUND" = 1 ]; then
ok "$PATTERN is present in $FILES"

2
tests/hardening/4.2.1.5_syslog-ng_remote_host.sh
View File

@ -38,6 +38,6 @@ EOF
run subfile "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
# Cleanup
rm /etc/syslog-ng/conf.d/1_tcp_destination
rm -f /etc/syslog-ng/conf.d/1_tcp_destination
}

33
tests/hardening/4.2.1.6_remote_syslog-ng_acl.sh
View File

@ -2,10 +2,37 @@
# run-shellcheck
test_audit() {
describe Running on blank host
register_test retvalshouldbe 0
dismiss_count_for_test
register_test retvalshouldbe 1
# shellcheck disable=2154
echo 'REMOTE_HOST="true"' >>"${CIS_CONF_DIR}/conf.d/${script}.cfg"
run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
# TODO fill comprehensive tests
cp -a /etc/syslog-ng/syslog-ng.conf /tmp/syslog-ng.conf.bak
echo "source mySyslog tcp (\"127.0.0.1\")" >>/etc/syslog-ng/syslog-ng.conf
describe Checking one line conf
register_test retvalshouldbe 0
run oneline "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
cp -a /tmp/syslog-ng.conf.bak /etc/syslog-ng/syslog-ng.conf
cat >>/etc/syslog-ng/syslog-ng.conf <<EOF
source mySyslog {
tcp ("127.0.0.1"),
port(1234),
EOF
describe Checking mutliline conf
register_test retvalshouldbe 0
run multiline "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
mv /tmp/syslog-ng.conf.bak /etc/syslog-ng/syslog-ng.conf
echo "source mySyslog tcp (\"127.0.0.1\")" >>/etc/syslog-ng/conf.d/1_tcp_source
cat /etc/syslog-ng/conf.d/1_tcp_source
describe Checking file in subdirectory
register_test retvalshouldbe 0
run subfile "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
rm -f /etc/syslog-ng/conf.d/1_tcp_source
}