IMP(8.2.5): find multiline pattern in files (syslog)

Add func to find pattern in file that spreads over multiple lines
The func will remove commented lines (that begin with '#')
and consider the file as one long line.
Thus, this is not possible to look for pattern at beginning of line
with this func ('^' and '$')

Improved pattern in 8.2.5

Add syslog-ng to installed dependencies in Dockerfiles

Fixed multifile arguments when looking for pattern that got broken
in d2bbf754 due to "nocase" and _does_pattern_exist_in_file wrapper
Please note that you can only look for pattern in ONE FILE at once
Fixed 8.2.5 and 8.3.2 with for loop on files and 'FOUND' flag
You now need to specify each and every file to look for or embed a
'find' command as follow :
`FILES="$SYSLOG_BASEDIR/syslog-ng.conf $(find $SYSLOG_BASEDIR/conf.d/)"`

Improved test files
Applied shellcheck recommendations

bin/hardening/8.2.5_syslog-ng_remote_host.sh

@@ -14,27 +14,40 @@ set -u # One variable unset, it's over
 HARDENING_LEVEL=3
 DESCRIPTION="Configure syslog-ng to send logs to a remote log host."
 
-PATTERN='^destination.*(tcp|udp)[[:space:]]*\([[:space:]]*\".*\"[[:space:]]*\)'
+PATTERN='destination[[:alnum:][:space:]*{]+(tcp|udp)[[:space:]]*\(\"[[:alnum:].]+\".'
 
 # This function will be called if the script status is on enabled / audit mode
 audit () {
-    FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*"
-    does_pattern_exist_in_file "$FILES" "$PATTERN"
-    if [ $FNRET != 0 ]; then
-        crit "$PATTERN is not present in $FILES"
-    else
+    FOUND=0
+    FILES="$SYSLOG_BASEDIR/syslog-ng.conf $(find $SYSLOG_BASEDIR/conf.d/)"
+    for FILE in $FILES; do
+       does_pattern_exist_in_file_multiline "$FILE" "$PATTERN"
+        if [ $FNRET == 0 ]; then
+            FOUND=1
+        fi
+    done
+
+    if [ $FOUND == 1 ]; then
         ok "$PATTERN is present in $FILES"
-    fi 
+    else
+        crit "$PATTERN is not present in $FILES"
+    fi
 }
 
 # This function will be called if the script status is on enabled mode
 apply () {
-    FILES="$SYSLOG_BASEDIR/syslog-ng.conf $SYSLOG_BASEDIR/conf.d/*"
-    does_pattern_exist_in_file "$FILES" "$PATTERN"
-    if [ $FNRET != 0 ]; then
-        crit "$PATTERN is not present in $FILES, please set a remote host to send your logs"
-    else
+    FOUND=0
+    FILES="$SYSLOG_BASEDIR/syslog-ng.conf $(find $SYSLOG_BASEDIR/conf.d/ -type f)"
+    for FILE in $FILES; do
+       does_pattern_exist_in_file_multiline "$FILE" "$PATTERN"
+        if [ $FNRET == 0 ]; then
+            FOUND=1
+        fi
+    done
+    if [ $FOUND == 1 ]; then
         ok "$PATTERN is present in $FILES"
+    else
+        crit "$PATTERN is not present in $FILES, please set a remote host to send your logs"
     fi
 }
 
@@ -48,7 +61,7 @@ EOF
 
 # This function will check config parameters required
 check_config() {
-    :    
+    :
 }
 
 # Source Root Dir Parameter

bin/hardening/8.3.2_tripwire_cron.sh

@@ -1,5 +1,6 @@
 #!/bin/bash
 
+# run-shellcheck
 #
 # CIS Debian Hardening
 #
@@ -11,26 +12,34 @@
 set -e # One error, it's over
 set -u # One variable unset, it's over
 
+# shellcheck disable=2034
 HARDENING_LEVEL=4
+# shellcheck disable=2034
 DESCRIPTION="Implemet periodic execution of file integrity."
 
-FILES='/etc/crontab /etc/cron.d/*'
+FILES="/etc/crontab $(find /etc/cron.d/ -type f)"
 PATTERN='tripwire --check'
 
 # This function will be called if the script status is on enabled / audit mode
 audit () {
-    does_pattern_exist_in_file "$FILES" "$PATTERN"
-    if [ $FNRET != 0 ]; then
-        crit "$PATTERN is not present in $FILES"
-    else
+    FOUND=0
+    for FILE in $FILES; do
+        does_pattern_exist_in_file "$FILE" "$PATTERN"
+        if [ "$FNRET" == 0 ]; then
+            FOUND=1
+        fi
+    done
+    if [ $FOUND == 1 ]; then
         ok "$PATTERN is present in $FILES"
+    else
+        crit "$PATTERN is not present in $FILES"
     fi
 }
 
 # This function will be called if the script status is on enabled mode
 apply () {
     does_pattern_exist_in_file "$FILES" "$PATTERN"
-    if [ $FNRET != 0 ]; then
+    if [ "$FNRET" != 0 ]; then
         warn "$PATTERN is not present in $FILES, setting tripwire cron"
         echo "0 10 * * * root /usr/sbin/tripwire --check > /dev/shm/tripwire_check 2>&1 " > /etc/cron.d/CIS_8.3.2_tripwire
     else
@@ -54,8 +63,9 @@ if [ -z "$CIS_ROOT_DIR" ]; then
 fi
 
 # Main function, will call the proper functions given the configuration (audit, enabled, disabled)
-if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then
-    . $CIS_ROOT_DIR/lib/main.sh
+if [ -r "$CIS_ROOT_DIR"/lib/main.sh ]; then
+    # shellcheck source=/opt/debian-cis/lib/main.sh
+    . "$CIS_ROOT_DIR"/lib/main.sh
 else
     echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_ROOT_DIR in /etc/default/cis-hardening"
     exit 128