IMP(8.2.5): find multiline pattern in files (syslog)

Add func to find pattern in file that spreads over multiple lines
The func will remove commented lines (that begin with '#')
and consider the file as one long line.
Thus, this is not possible to look for pattern at beginning of line
with this func ('^' and '$')

Improved pattern in 8.2.5

Add syslog-ng to installed dependencies in Dockerfiles

Fixed multifile arguments when looking for pattern that got broken
in d2bbf754 due to "nocase" and _does_pattern_exist_in_file wrapper
Please note that you can only look for pattern in ONE FILE at once
Fixed 8.2.5 and 8.3.2 with for loop on files and 'FOUND' flag
You now need to specify each and every file to look for or embed a
'find' command as follow :
`FILES="$SYSLOG_BASEDIR/syslog-ng.conf $(find $SYSLOG_BASEDIR/conf.d/)"`

Improved test files
Applied shellcheck recommendations
This commit is contained in:
Charles Herlin
2019-02-22 12:39:41 +01:00
parent 7408216957
commit 80a1146af7
8 changed files with 123 additions and 30 deletions

View File

@ -14,27 +14,40 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=3
DESCRIPTION="Configure syslog-ng to send logs to a remote log host."
PATTERN='^destination.*(tcp|udp)[[:space:]]*\([[:space:]]*\".*\"[[:space:]]*\)'
PATTERN='destination[[:alnum:][:space:]*{]+(tcp|udp)[[:space:]]*\(\"[[:alnum:].]+\".'
# This function will be called if the script status is on enabled / audit mode
audit () {
FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*"
does_pattern_exist_in_file "$FILES" "$PATTERN"
if [ $FNRET != 0 ]; then
crit "$PATTERN is not present in $FILES"
else
FOUND=0
FILES="$SYSLOG_BASEDIR/syslog-ng.conf $(find $SYSLOG_BASEDIR/conf.d/)"
for FILE in $FILES; do
does_pattern_exist_in_file_multiline "$FILE" "$PATTERN"
if [ $FNRET == 0 ]; then
FOUND=1
fi
done
if [ $FOUND == 1 ]; then
ok "$PATTERN is present in $FILES"
fi
else
crit "$PATTERN is not present in $FILES"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*"
does_pattern_exist_in_file "$FILES" "$PATTERN"
if [ $FNRET != 0 ]; then
crit "$PATTERN is not present in $FILES, please set a remote host to send your logs"
else
FOUND=0
FILES="$SYSLOG_BASEDIR/syslog-ng.conf $(find $SYSLOG_BASEDIR/conf.d/ -type f)"
for FILE in $FILES; do
does_pattern_exist_in_file_multiline "$FILE" "$PATTERN"
if [ $FNRET == 0 ]; then
FOUND=1
fi
done
if [ $FOUND == 1 ]; then
ok "$PATTERN is present in $FILES"
else
crit "$PATTERN is not present in $FILES, please set a remote host to send your logs"
fi
}
@ -48,7 +61,7 @@ EOF
# This function will check config parameters required
check_config() {
:
:
}
# Source Root Dir Parameter

View File

@ -1,5 +1,6 @@
#!/bin/bash
# run-shellcheck
#
# CIS Debian Hardening
#
@ -11,26 +12,34 @@
set -e # One error, it's over
set -u # One variable unset, it's over
# shellcheck disable=2034
HARDENING_LEVEL=4
# shellcheck disable=2034
DESCRIPTION="Implemet periodic execution of file integrity."
FILES='/etc/crontab /etc/cron.d/*'
FILES="/etc/crontab $(find /etc/cron.d/ -type f)"
PATTERN='tripwire --check'
# This function will be called if the script status is on enabled / audit mode
audit () {
does_pattern_exist_in_file "$FILES" "$PATTERN"
if [ $FNRET != 0 ]; then
crit "$PATTERN is not present in $FILES"
else
FOUND=0
for FILE in $FILES; do
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" == 0 ]; then
FOUND=1
fi
done
if [ $FOUND == 1 ]; then
ok "$PATTERN is present in $FILES"
else
crit "$PATTERN is not present in $FILES"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
does_pattern_exist_in_file "$FILES" "$PATTERN"
if [ $FNRET != 0 ]; then
if [ "$FNRET" != 0 ]; then
warn "$PATTERN is not present in $FILES, setting tripwire cron"
echo "0 10 * * * root /usr/sbin/tripwire --check > /dev/shm/tripwire_check 2>&1 " > /etc/cron.d/CIS_8.3.2_tripwire
else
@ -54,8 +63,9 @@ if [ -z "$CIS_ROOT_DIR" ]; then
fi
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then
. $CIS_ROOT_DIR/lib/main.sh
if [ -r "$CIS_ROOT_DIR"/lib/main.sh ]; then
# shellcheck source=/opt/debian-cis/lib/main.sh
. "$CIS_ROOT_DIR"/lib/main.sh
else
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_ROOT_DIR in /etc/default/cis-hardening"
exit 128