elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-11-22 13:37:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

Syslog-ng fixes and enhancements (#226)

Browse Source 
* syslog-ng : fix remote host test and enhance Regex

fixes #124

* enh: add test for 4.2.1.6
This commit is contained in:
GoldenKiwi 2023-12-27 10:27:06 +01:00 committed by GitHub
parent c391723fe5
commit 73616af4eb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 37 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
bin/hardening/4.2.1.5_syslog-ng_remote_host.sh
View File

@ -16,10 +16,9 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=3 HARDENING_LEVEL=3
# shellcheck disable=2034 # shellcheck disable=2034
DESCRIPTION="Configure syslog-ng to send logs to a remote log host." DESCRIPTION="Configure syslog-ng to send logs to a remote log host."
PACKAGE='syslog-ng' PACKAGE='syslog-ng'
SYSLOG_BASEDIR='/etc/syslog-ng'
PATTERN='destination[[:alnum:][:space:]*{]+(tcp|udp)[[:space:]]*\(\"[[:alnum:].]+\".' PATTERN='destination[[:alnum:][:space:]*_*{]+(tcp|network|udp)[[:space:]]*\([[:space:]]*\"?[[:alnum:]\-.]+\"?.'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit() { audit() {

8
bin/hardening/4.2.1.6_remote_syslog-ng_acl.sh
View File

@ -18,9 +18,9 @@ HARDENING_LEVEL=3
DESCRIPTION="Configure syslog to accept remote syslog messages only on designated log hosts." DESCRIPTION="Configure syslog to accept remote syslog messages only on designated log hosts."
PACKAGE='syslog-ng' PACKAGE='syslog-ng'
SYSLOG_BASEDIR='/etc/syslog-ng'
REMOTE_HOST="" REMOTE_HOST=""
PATTERN='source[[:alnum:][:space:]*{]+(tcp|udp)[[:space:]]*\(\"[[:alnum:].]+\".' PATTERN='source[[:alnum:][:space:]*_*{]+(tcp|network|udp)[[:space:]]*\([[:space:]]*\"?[[:alnum:]\-.]+\"?.'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit() { audit() {
@ -37,7 +37,7 @@ audit() {
fi fi
done done
if [[ "$REMOTE_HOST" ]]; then if [[ "$REMOTE_HOST" ]] && [[ "$REMOTE_HOST" != 'false' ]]; then
info "This is the remote host, checking that it only accepts logs from specified zone" info "This is the remote host, checking that it only accepts logs from specified zone"
if [ "$FOUND" = 1 ]; then if [ "$FOUND" = 1 ]; then
ok "$PATTERN is present in $FILES" ok "$PATTERN is present in $FILES"
@ -70,7 +70,7 @@ apply() {
fi fi
done done
if [[ "$REMOTE_HOST" ]]; then if [[ "$REMOTE_HOST" ]] && [[ "$REMOTE_HOST" != 'false' ]]; then
info "This is the remote host, checking that it only accepts logs from specified zone" info "This is the remote host, checking that it only accepts logs from specified zone"
if [ "$FOUND" = 1 ]; then if [ "$FOUND" = 1 ]; then
ok "$PATTERN is present in $FILES" ok "$PATTERN is present in $FILES"

2
tests/hardening/4.2.1.5_syslog-ng_remote_host.sh
View File

@ -38,6 +38,6 @@ EOF
run subfile "${CIS_CHECKS_DIR}/${script}.sh" --audit-all run subfile "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
# Cleanup # Cleanup
rm /etc/syslog-ng/conf.d/1_tcp_destination rm -f /etc/syslog-ng/conf.d/1_tcp_destination
} }

33
tests/hardening/4.2.1.6_remote_syslog-ng_acl.sh
View File

@ -2,10 +2,37 @@
# run-shellcheck # run-shellcheck
test_audit() { test_audit() {
describe Running on blank host describe Running on blank host
register_test retvalshouldbe 0 register_test retvalshouldbe 1
dismiss_count_for_test
# shellcheck disable=2154 # shellcheck disable=2154
echo 'REMOTE_HOST="true"' >>"${CIS_CONF_DIR}/conf.d/${script}.cfg"
run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
# TODO fill comprehensive tests cp -a /etc/syslog-ng/syslog-ng.conf /tmp/syslog-ng.conf.bak
echo "source mySyslog tcp (\"127.0.0.1\")" >>/etc/syslog-ng/syslog-ng.conf
describe Checking one line conf
register_test retvalshouldbe 0
run oneline "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
cp -a /tmp/syslog-ng.conf.bak /etc/syslog-ng/syslog-ng.conf
cat >>/etc/syslog-ng/syslog-ng.conf <<EOF
source mySyslog {
tcp ("127.0.0.1"),
port(1234),
EOF
describe Checking mutliline conf
register_test retvalshouldbe 0
run multiline "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
mv /tmp/syslog-ng.conf.bak /etc/syslog-ng/syslog-ng.conf
echo "source mySyslog tcp (\"127.0.0.1\")" >>/etc/syslog-ng/conf.d/1_tcp_source
cat /etc/syslog-ng/conf.d/1_tcp_source
describe Checking file in subdirectory
register_test retvalshouldbe 0
run subfile "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
rm -f /etc/syslog-ng/conf.d/1_tcp_source
} }