elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-11-22 13:37:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

FIX(10.2): improve test to check multiple login shells

Browse Source 
fix IFS bug
add test
This commit is contained in:
Charles Herlin 2019-08-28 11:47:49 +02:00
parent 89cf484cb9
commit 96f3b74334
2 changed files with 29 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
bin/hardening/10.2_disable_system_accounts.sh
View File

@ -14,14 +14,18 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=3 HARDENING_LEVEL=3
DESCRIPTION="Disable system accounts, preventing them from interactive login." DESCRIPTION="Disable system accounts, preventing them from interactive login."
SHELL='/bin/false' ACCEPTED_SHELLS='/bin/false /usr/sbin/nologin /sbin/nologin'
SHELL_TO_APPLY='/bin/false'
FILE='/etc/passwd' FILE='/etc/passwd'
RESULT='' RESULT=''
ACCEPTED_SHELLS_GREP=''
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
info "Checking if admin accounts have a login shell different than $SHELL" shells_to_grep_helper
RESULT=$(egrep -v "^\+" $FILE | awk -F: '($1!="root" && $1!="sync" && $1!="shutdown" && $1!="halt" && $3<1000 && $7!="/usr/sbin/nologin" && $7!="/bin/false") {print}') info "Checking if admin accounts have a login shell different than $ACCEPTED_SHELLS"
RESULT=$(egrep -v "^\+" $FILE | awk -F: '($1!="root" && $1!="sync" && $1!="shutdown" && $1!="halt" && $3<1000 ) {print}' | grep -v $ACCEPTED_SHELLS_GREP || true )
IFS_BAK=$IFS
IFS=$'\n' IFS=$'\n'
for LINE in $RESULT; do for LINE in $RESULT; do
debug "line : $LINE" debug "line : $LINE"
@ -36,8 +40,9 @@ audit () {
debug "$ACCOUNT not found in exceptions" debug "$ACCOUNT not found in exceptions"
fi fi
done done
IFS=$IFS_BAK
if [ ! -z "$RESULT" ]; then if [ ! -z "$RESULT" ]; then
crit "Some admin accounts don't have $SHELL as their login shell" crit "Some admin accounts don't have any of $ACCEPTED_SHELLS as their login shell"
crit "$RESULT" crit "$RESULT"
else else
ok "All admin accounts deactivated" ok "All admin accounts deactivated"
@ -46,7 +51,8 @@ audit () {
# This function will be called if the script status is on enabled mode # This function will be called if the script status is on enabled mode
apply () { apply () {
RESULT=$(egrep -v "^\+" $FILE | awk -F: '($1!="root" && $1!="sync" && $1!="shutdown" && $1!="halt" && $3<1000 && $7!="/usr/sbin/nologin" && $7!="/bin/false") {print}') RESULT=$(egrep -v "^\+" $FILE | awk -F: '($1!="root" && $1!="sync" && $1!="shutdown" && $1!="halt" && $3<1000 ) {print}' | grep -v $ACCEPTED_SHELLS_GREP || true )
IFS_BAK=$IFS
IFS=$'\n' IFS=$'\n'
for LINE in $RESULT; do for LINE in $RESULT; do
debug "line : $LINE" debug "line : $LINE"
@ -61,18 +67,25 @@ apply () {
debug "$ACCOUNT not found in exceptions" debug "$ACCOUNT not found in exceptions"
fi fi
done done
IFS=$IFS_BAK
if [ ! -z "$RESULT" ]; then if [ ! -z "$RESULT" ]; then
warn "Some admin accounts don't have $SHELL as their login shell -- Fixing" warn "Some admin accounts don't have any of $ACCEPTED_SHELLS as their login shell -- Fixing"
warn "$RESULT" warn "$RESULT"
for USER in $( echo "$RESULT" | cut -d: -f 1 ); do for USER in $( echo "$RESULT" | cut -d: -f 1 ); do
info "Setting $SHELL as $USER login shell" info "Setting $SHELL_TO_APPLY as $USER login shell"
usermod -s $SHELL $USER usermod -s "$SHELL_TO_APPLY" "$USER"
done done
else else
ok "All admin accounts deactivated, nothing to apply" ok "All admin accounts deactivated, nothing to apply"
fi fi
} }
shells_to_grep_helper(){
for shell in $ACCEPTED_SHELLS; do
ACCEPTED_SHELLS_GREP+=" -e $shell"
done
}
# This function will create the config file for this check with default values # This function will create the config file for this check with default values
create_config() { create_config() {
cat <<EOF cat <<EOF

11
tests/hardening/10.2_disable_system_accounts.sh
View File

@ -1,10 +1,15 @@
# run-shellcheck # run-shellcheck
test_audit() { test_audit() {
describe Running on blank host describe Running on blank host
register_test retvalshouldbe 0 register_test retvalshouldbe 1
dismiss_count_for_test
# shellcheck disable=2154 # shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# TODO fill comprehensive tests describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
} }