elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-11-21 21:17:00 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(6.2.9): Start from UID 1000 for home ownership check (#164)

Browse Source 
Rename 6.2.3 and 6.2.9 checks to be more accurate
Remove home existence check from 6.2.9 as it's handled by 6.2.3
Update tests accordingly
Fixes #163

Signed-off-by: Tarik Megzari <tarik.megzari@corp.ovh.com>

Signed-off-by: Tarik Megzari <tarik.megzari@corp.ovh.com>
This commit is contained in:
Tarik Megzari 2022-09-30 10:28:48 +02:00 committed by GitHub
parent e478a89bad
commit 82a217032d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 2 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

0
bin/hardening/6.2.3_users_valid_homedir.sh → bin/hardening/6.2.3_users_homedir_exist.sh
View File

19
bin/hardening/6.2.9_users_valid_homedir.sh → bin/hardening/6.2.9_users_homedir_ownership.sh
View File

@ -23,30 +23,13 @@ ERRORS=0
# This function will be called if the script status is on enabled / audit mode
audit() {
debug "Checking homedir exists"
RESULT=$(get_db passwd | awk -F: '{ print $1 ":" $3 ":" $6 }')
for LINE in $RESULT; do
debug "Working on $LINE"
USER=$(awk -F: '{print $1}' <<<"$LINE")
USERID=$(awk -F: '{print $2}' <<<"$LINE")
DIR=$(awk -F: '{print $3}' <<<"$LINE")
if [ "$USERID" -ge 1000 ] && [ ! -d "$DIR" ] && [ "$USER" != "nfsnobody" ] && [ "$USER" != "nobody" ] && [ "$DIR" != "/nonexistent" ]; then
crit "The home directory ($DIR) of user $USER does not exist."
ERRORS=$((ERRORS + 1))
fi
done
if [ "$ERRORS" = 0 ]; then
ok "All home directories exists"
fi
debug "Checking homedir ownership"
RESULT=$(awk -F: '{ print $1 ":" $3 ":" $6 }' /etc/passwd)
for LINE in $RESULT; do
debug "Working on $LINE"
USER=$(awk -F: '{print $1}' <<<"$LINE")
USERID=$(awk -F: '{print $2}' <<<"$LINE")
DIR=$(awk -F: '{print $3}' <<<"$LINE")
if [ "$USERID" -ge 500 ] && [ -d "$DIR" ] && [ "$USER" != "nfsnobody" ]; then
if [ "$USERID" -ge 1000 ] && [ -d "$DIR" ] && [ "$USER" != "nfsnobody" ]; then
OWNER=$(stat -L -c "%U" "$DIR")
if [ "$OWNER" != "$USER" ]; then
EXCEP_FOUND=0

1
tests/hardening/6.2.3_users_valid_homedir.sh → tests/hardening/6.2.3_users_homedir_exist.sh
View File

@ -3,7 +3,6 @@
test_audit() {
describe Running on blank host
register_test retvalshouldbe 0
dismiss_count_for_test
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all

8
tests/hardening/6.2.9_users_valid_homedir.sh → tests/hardening/6.2.9_users_homedir_ownership.sh
View File

@ -1,14 +1,8 @@
# shellcheck shell=bash
# run-shellcheck
test_audit() {
describe Running void to generate the conf file that will later be edited
# shellcheck disable=2154
/opt/debian-cis/bin/hardening/"${script}".sh || true
echo "EXCEPTIONS=\"/:systemd-coredump:root\"" >>/opt/debian-cis/etc/conf.d/"${script}".cfg
describe Running on blank host
register_test retvalshouldbe 0
dismiss_count_for_test
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
@ -22,7 +16,7 @@ test_audit() {
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
echo "EXCEPTIONS=\"/:systemd-coredump:root /home/$test_user:$test_user:root\"" >/opt/debian-cis/etc/conf.d/"${script}".cfg
echo "EXCEPTIONS=\"/home/$test_user:$test_user:root\"" >/opt/debian-cis/etc/conf.d/"${script}".cfg
describe Checking resolved state
register_test retvalshouldbe 0