From 9ee7b646bf2eaf0407c8ee7fc5dda97cd5355839 Mon Sep 17 00:00:00 2001 From: "thibault.dewailly" Date: Tue, 12 Apr 2016 08:31:41 +0200 Subject: [PATCH] 5.1.5_disable_talk_client.sh 5.1.6_disable_telnet_server.sh 5.1.7_disable_tftp_server.sh 5.1.8_disable_inetd.sh 5.2_disable_chargen.sh 5.3_disable_daytime.sh 5.4_disable_echo.sh 5.5_disable_discard.sh 5.6_disable_time.sh 6.1_disable_xwindow_system.sh --- .../2.17_sticky_bit_world_writable_folder.sh | 2 +- bin/hardening/3.4_root_password.sh | 2 +- bin/hardening/5.1.2_disable_rsh.sh | 73 ++++++++-------- bin/hardening/5.1.4_disable_talk.sh | 75 ++++++++-------- bin/hardening/5.1.5_disable_talk_client.sh | 58 +++++++++++++ bin/hardening/5.1.6_disable_telnet_server.sh | 86 ++++++++++++++++++ bin/hardening/5.1.7_disable_tftp_server.sh | 87 +++++++++++++++++++ bin/hardening/5.1.8_disable_inetd.sh | 58 +++++++++++++ bin/hardening/5.2_disable_chargen.sh | 68 +++++++++++++++ bin/hardening/5.3_disable_daytime.sh | 68 +++++++++++++++ bin/hardening/5.4_disable_echo.sh | 68 +++++++++++++++ bin/hardening/5.5_disable_discard.sh | 68 +++++++++++++++ bin/hardening/5.6_disable_time.sh | 68 +++++++++++++++ bin/hardening/6.1_disable_xwindow_system.sh | 58 +++++++++++++ etc/conf.d/5.1.2_disable_rsh.cfg | 2 +- etc/conf.d/5.1.5_disable_talk_client.cfg | 2 + etc/conf.d/5.1.6_disable_telnet_server.cfg | 2 + etc/conf.d/5.1.7_disable_tftp_server.cfg | 2 + etc/conf.d/5.1.8_disable_inetd.cfg | 2 + etc/conf.d/5.2_disable_chargen.cfg | 2 + etc/conf.d/5.3_disable_daytime.cfg | 2 + etc/conf.d/5.4_disable_echo.cfg | 2 + etc/conf.d/5.5_disable_discard.cfg | 2 + etc/conf.d/5.6_disable_time.cfg | 2 + etc/conf.d/6.1_disable_xwindow_system.cfg | 2 + 25 files changed, 787 insertions(+), 74 deletions(-) create mode 100755 bin/hardening/5.1.5_disable_talk_client.sh create mode 100755 bin/hardening/5.1.6_disable_telnet_server.sh create mode 100755 bin/hardening/5.1.7_disable_tftp_server.sh create mode 100755 bin/hardening/5.1.8_disable_inetd.sh create mode 100755 bin/hardening/5.2_disable_chargen.sh create mode 100755 bin/hardening/5.3_disable_daytime.sh create mode 100755 bin/hardening/5.4_disable_echo.sh create mode 100755 bin/hardening/5.5_disable_discard.sh create mode 100755 bin/hardening/5.6_disable_time.sh create mode 100755 bin/hardening/6.1_disable_xwindow_system.sh create mode 100644 etc/conf.d/5.1.5_disable_talk_client.cfg create mode 100644 etc/conf.d/5.1.6_disable_telnet_server.cfg create mode 100644 etc/conf.d/5.1.7_disable_tftp_server.cfg create mode 100644 etc/conf.d/5.1.8_disable_inetd.cfg create mode 100644 etc/conf.d/5.2_disable_chargen.cfg create mode 100644 etc/conf.d/5.3_disable_daytime.cfg create mode 100644 etc/conf.d/5.4_disable_echo.cfg create mode 100644 etc/conf.d/5.5_disable_discard.cfg create mode 100644 etc/conf.d/5.6_disable_time.cfg create mode 100644 etc/conf.d/6.1_disable_xwindow_system.cfg diff --git a/bin/hardening/2.17_sticky_bit_world_writable_folder.sh b/bin/hardening/2.17_sticky_bit_world_writable_folder.sh index 99d8025..0183a36 100755 --- a/bin/hardening/2.17_sticky_bit_world_writable_folder.sh +++ b/bin/hardening/2.17_sticky_bit_world_writable_folder.sh @@ -5,7 +5,7 @@ # # -# Hardening script skeleton replace this line with proper point treated +# 2.17 Set Sticky Bit on All World-Writable Directories (Scored) # set -e # One error, it's over diff --git a/bin/hardening/3.4_root_password.sh b/bin/hardening/3.4_root_password.sh index af38c63..f37bfb0 100755 --- a/bin/hardening/3.4_root_password.sh +++ b/bin/hardening/3.4_root_password.sh @@ -5,7 +5,7 @@ # # -# Hardening script skeleton replace this line with proper point treated +# 3.4 Require Authentication for Single-User Mode (Scored) # set -e # One error, it's over diff --git a/bin/hardening/5.1.2_disable_rsh.sh b/bin/hardening/5.1.2_disable_rsh.sh index cf319fd..d86a588 100755 --- a/bin/hardening/5.1.2_disable_rsh.sh +++ b/bin/hardening/5.1.2_disable_rsh.sh @@ -11,56 +11,59 @@ set -e # One error, it's over set -u # One variable unset, it's over -PACKAGE='rsh-server' +PACKAGES='rsh-server rsh-redone-server' FILE='/etc/inetd.conf' PATTERN='^(shell|login|exec)' # This function will be called if the script status is on enabled / audit mode audit () { - is_pkg_installed $PACKAGE - if [ $FNRET = 0 ]; then - warn "$PACKAGE is installed, checking configuration" - does_file_exist $FILE - if [ $FNRET != 0 ]; then - ok "$FILE does not exist" - else - does_pattern_exists_in_file $FILE $PATTERN - if [ $FNRET = 0 ]; then - crit "$PATTERN exists, $PACKAGE services are enabled !" + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + warn "$PACKAGE is installed, checking configuration" + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" else - ok "$PATTERN not present in $FILE" + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + crit "$PATTERN exists, $PACKAGE services are enabled !" + else + ok "$PATTERN not present in $FILE" + fi fi + else + ok "$PACKAGE is absent" fi - else - ok "$PACKAGE is absent" - fi - : + done } # This function will be called if the script status is on enabled mode apply () { - is_pkg_installed $PACKAGE - if [ $FNRET = 0 ]; then - crit "$PACKAGE is installed, purging it" - apt-get purge $PACKAGE -y - else - ok "$PACKAGE is absent" - fi - does_file_exist $FILE - if [ $FNRET != 0 ]; then - ok "$FILE does not exist" - else - info "$FILE exists, checking patterns" - does_pattern_exists_in_file $FILE $PATTERN + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE if [ $FNRET = 0 ]; then - warn "$PATTERN present in $FILE, purging it" - backup_file $FILE - ESCAPED_PATTERN=$(sed "s/|\|(\|)/\\\&/g" <<< $PATTERN) - sed -ie "s/$ESCAPED_PATTERN/#&/g" $FILE + crit "$PACKAGE is installed, purging it" + apt-get purge $PACKAGE -y else - ok "$PATTERN not present in $FILE" + ok "$PACKAGE is absent" fi - fi + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + info "$FILE exists, checking patterns" + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + warn "$PATTERN present in $FILE, purging it" + backup_file $FILE + ESCAPED_PATTERN=$(sed "s/|\|(\|)/\\\&/g" <<< $PATTERN) + sed -ie "s/$ESCAPED_PATTERN/#&/g" $FILE + else + ok "$PATTERN not present in $FILE" + fi + fi + done } # This function will check config parameters required diff --git a/bin/hardening/5.1.4_disable_talk.sh b/bin/hardening/5.1.4_disable_talk.sh index 8bf4b9b..1f5e83a 100755 --- a/bin/hardening/5.1.4_disable_talk.sh +++ b/bin/hardening/5.1.4_disable_talk.sh @@ -5,62 +5,65 @@ # # -# 5.1.2 Ensure rsh server is not enabled (Scored) +# 5.1.4 Ensure talk server is not enabled (Scored) # set -e # One error, it's over set -u # One variable unset, it's over -PACKAGE='inetutils-talk' +PACKAGES='inetutils-talkd talkd' FILE='/etc/inetd.conf' PATTERN='^(talk|ntalk)' # This function will be called if the script status is on enabled / audit mode audit () { - is_pkg_installed $PACKAGE - if [ $FNRET = 0 ]; then - warn "$PACKAGE is installed, checking configuration" - does_file_exist $FILE - if [ $FNRET != 0 ]; then - ok "$FILE does not exist" - else - does_pattern_exists_in_file $FILE $PATTERN - if [ $FNRET = 0 ]; then - crit "$PATTERN exists, $PACKAGE services are enabled !" + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + warn "$PACKAGE is installed, checking configuration" + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" else - ok "$PATTERN not present in $FILE" + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + crit "$PATTERN exists, $PACKAGE services are enabled !" + else + ok "$PATTERN not present in $FILE" + fi fi + else + ok "$PACKAGE is absent" fi - else - ok "$PACKAGE is absent" - fi - : + done } # This function will be called if the script status is on enabled mode apply () { - is_pkg_installed $PACKAGE - if [ $FNRET = 0 ]; then - crit "$PACKAGE is installed, purging it" - apt-get purge $PACKAGE -y - else - ok "$PACKAGE is absent" - fi - does_file_exist $FILE - if [ $FNRET != 0 ]; then - ok "$FILE does not exist" - else - info "$FILE exists, checking patterns" - does_pattern_exists_in_file $FILE $PATTERN + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE if [ $FNRET = 0 ]; then - warn "$PATTERN present in $FILE, purging it" - backup_file $FILE - ESCAPED_PATTERN=$(sed "s/|\|(\|)/\\\&/g" <<< $PATTERN) - sed -ie "s/$ESCAPED_PATTERN/#&/g" $FILE + crit "$PACKAGE is installed, purging it" + apt-get purge $PACKAGE -y else - ok "$PATTERN not present in $FILE" + ok "$PACKAGE is absent" fi - fi + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + info "$FILE exists, checking patterns" + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + warn "$PATTERN present in $FILE, purging it" + backup_file $FILE + ESCAPED_PATTERN=$(sed "s/|\|(\|)/\\\&/g" <<< $PATTERN) + sed -ie "s/$ESCAPED_PATTERN/#&/g" $FILE + else + ok "$PATTERN not present in $FILE" + fi + fi + done } # This function will check config parameters required diff --git a/bin/hardening/5.1.5_disable_talk_client.sh b/bin/hardening/5.1.5_disable_talk_client.sh new file mode 100755 index 0000000..7bb9a5f --- /dev/null +++ b/bin/hardening/5.1.5_disable_talk_client.sh @@ -0,0 +1,58 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# + +# +# 5.1.5 Ensure talk client is not installed (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +PACKAGES='talk inetutils-talk' + +# This function will be called if the script status is on enabled / audit mode +audit () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + crit "$PACKAGE is installed" + else + ok "$PACKAGE is absent" + fi + done +} + +# This function will be called if the script status is on enabled mode +apply () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + warn "$PACKAGE is installed, purging" + apt-get purge $PACKAGE -y + else + ok "$PACKAGE is absent" + fi + done +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/5.1.6_disable_telnet_server.sh b/bin/hardening/5.1.6_disable_telnet_server.sh new file mode 100755 index 0000000..cd89e14 --- /dev/null +++ b/bin/hardening/5.1.6_disable_telnet_server.sh @@ -0,0 +1,86 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# + +# +# 5.1.6 Ensure telnet server is not enabled (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +PACKAGES='telnetd inetutils-telnetd telnetd-ssl' +FILE='/etc/inetd.conf' +PATTERN='^telnet' + +# This function will be called if the script status is on enabled / audit mode +audit () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + warn "$PACKAGE is installed, checking configuration" + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + crit "$PATTERN exists, $PACKAGE services are enabled !" + else + ok "$PATTERN not present in $FILE" + fi + fi + else + ok "$PACKAGE is absent" + fi + done +} + +# This function will be called if the script status is on enabled mode +apply () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + crit "$PACKAGE is installed, purging it" + apt-get purge $PACKAGE -y + else + ok "$PACKAGE is absent" + fi + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + info "$FILE exists, checking patterns" + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + warn "$PATTERN present in $FILE, purging it" + backup_file $FILE + ESCAPED_PATTERN=$(sed "s/|\|(\|)/\\\&/g" <<< $PATTERN) + sed -ie "s/$ESCAPED_PATTERN/#&/g" $FILE + else + ok "$PATTERN not present in $FILE" + fi + fi + done +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/5.1.7_disable_tftp_server.sh b/bin/hardening/5.1.7_disable_tftp_server.sh new file mode 100755 index 0000000..8f9c2e9 --- /dev/null +++ b/bin/hardening/5.1.7_disable_tftp_server.sh @@ -0,0 +1,87 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# + +# +# 5.1.7 Ensure tftp-server is not enabled (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +PACKAGES='tftpd tftpd-hpa atftpd' +FILE='/etc/inetd.conf' +PATTERN='^tftp' + +# This function will be called if the script status is on enabled / audit mode +audit () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + warn "$PACKAGE is installed, checking configuration" + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + crit "$PATTERN exists, $PACKAGE services are enabled !" + else + ok "$PATTERN not present in $FILE" + fi + fi + else + ok "$PACKAGE is absent" + fi + done +} + +# This function will be called if the script status is on enabled mode +apply () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + crit "$PACKAGE is installed, purging it" + apt-get purge $PACKAGE -y + else + ok "$PACKAGE is absent" + fi + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + info "$FILE exists, checking patterns" + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + warn "$PATTERN present in $FILE, purging it" + backup_file $FILE + ESCAPED_PATTERN=$(sed "s/|\|(\|)/\\\&/g" <<< $PATTERN) + sed -ie "s/$ESCAPED_PATTERN/#&/g" $FILE + echo "coucou" + else + ok "$PATTERN not present in $FILE" + fi + fi + done +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/5.1.8_disable_inetd.sh b/bin/hardening/5.1.8_disable_inetd.sh new file mode 100755 index 0000000..f290e68 --- /dev/null +++ b/bin/hardening/5.1.8_disable_inetd.sh @@ -0,0 +1,58 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# + +# +# 5.1.8 Ensure xinetd is not enabled (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +PACKAGES='openbsd-inetd xinetd rlinetd' + +# This function will be called if the script status is on enabled / audit mode +audit () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + crit "$PACKAGE is installed" + else + ok "$PACKAGE is absent" + fi + done +} + +# This function will be called if the script status is on enabled mode +apply () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + warn "$PACKAGE is installed, purging" + apt-get purge $PACKAGE -y + else + ok "$PACKAGE is absent" + fi + done +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/5.2_disable_chargen.sh b/bin/hardening/5.2_disable_chargen.sh new file mode 100755 index 0000000..2ce2870 --- /dev/null +++ b/bin/hardening/5.2_disable_chargen.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# + +# +# 5.2 Ensure chargen is not enabled (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +FILE='/etc/inetd.conf' +PATTERN='^chargen' + +# This function will be called if the script status is on enabled / audit mode +audit () { + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + crit "$PATTERN exists, chargen services are enabled !" + else + ok "$PATTERN not present in $FILE" + fi + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + info "$FILE exists, checking patterns" + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + warn "$PATTERN present in $FILE, purging it" + backup_file $FILE + ESCAPED_PATTERN=$(sed "s/|\|(\|)/\\\&/g" <<< $PATTERN) + sed -ie "s/$ESCAPED_PATTERN/#&/g" $FILE + else + ok "$PATTERN not present in $FILE" + fi + fi +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/5.3_disable_daytime.sh b/bin/hardening/5.3_disable_daytime.sh new file mode 100755 index 0000000..cb12750 --- /dev/null +++ b/bin/hardening/5.3_disable_daytime.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# + +# +# 5.3 Ensure daytime is not enabled (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +FILE='/etc/inetd.conf' +PATTERN='^daytime' + +# This function will be called if the script status is on enabled / audit mode +audit () { + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + crit "$PATTERN exists, chargen services are enabled !" + else + ok "$PATTERN not present in $FILE" + fi + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + info "$FILE exists, checking patterns" + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + warn "$PATTERN present in $FILE, purging it" + backup_file $FILE + ESCAPED_PATTERN=$(sed "s/|\|(\|)/\\\&/g" <<< $PATTERN) + sed -ie "s/$ESCAPED_PATTERN/#&/g" $FILE + else + ok "$PATTERN not present in $FILE" + fi + fi +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/5.4_disable_echo.sh b/bin/hardening/5.4_disable_echo.sh new file mode 100755 index 0000000..d899e8f --- /dev/null +++ b/bin/hardening/5.4_disable_echo.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# + +# +# 5.4 Ensure echo is not enabled (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +FILE='/etc/inetd.conf' +PATTERN='^echo' + +# This function will be called if the script status is on enabled / audit mode +audit () { + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + crit "$PATTERN exists, chargen services are enabled !" + else + ok "$PATTERN not present in $FILE" + fi + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + info "$FILE exists, checking patterns" + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + warn "$PATTERN present in $FILE, purging it" + backup_file $FILE + ESCAPED_PATTERN=$(sed "s/|\|(\|)/\\\&/g" <<< $PATTERN) + sed -ie "s/$ESCAPED_PATTERN/#&/g" $FILE + else + ok "$PATTERN not present in $FILE" + fi + fi +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/5.5_disable_discard.sh b/bin/hardening/5.5_disable_discard.sh new file mode 100755 index 0000000..0fce91d --- /dev/null +++ b/bin/hardening/5.5_disable_discard.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# + +# +# 5.5 Ensure discard is not enabled (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +FILE='/etc/inetd.conf' +PATTERN='^discard' + +# This function will be called if the script status is on enabled / audit mode +audit () { + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + crit "$PATTERN exists, chargen services are enabled !" + else + ok "$PATTERN not present in $FILE" + fi + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + info "$FILE exists, checking patterns" + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + warn "$PATTERN present in $FILE, purging it" + backup_file $FILE + ESCAPED_PATTERN=$(sed "s/|\|(\|)/\\\&/g" <<< $PATTERN) + sed -ie "s/$ESCAPED_PATTERN/#&/g" $FILE + else + ok "$PATTERN not present in $FILE" + fi + fi +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/5.6_disable_time.sh b/bin/hardening/5.6_disable_time.sh new file mode 100755 index 0000000..0267904 --- /dev/null +++ b/bin/hardening/5.6_disable_time.sh @@ -0,0 +1,68 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# + +# +# 5.6 Ensure time is not enabled (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +FILE='/etc/inetd.conf' +PATTERN='^time' + +# This function will be called if the script status is on enabled / audit mode +audit () { + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + crit "$PATTERN exists, chargen services are enabled !" + else + ok "$PATTERN not present in $FILE" + fi + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + info "$FILE exists, checking patterns" + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + warn "$PATTERN present in $FILE, purging it" + backup_file $FILE + ESCAPED_PATTERN=$(sed "s/|\|(\|)/\\\&/g" <<< $PATTERN) + sed -ie "s/$ESCAPED_PATTERN/#&/g" $FILE + else + ok "$PATTERN not present in $FILE" + fi + fi +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/6.1_disable_xwindow_system.sh b/bin/hardening/6.1_disable_xwindow_system.sh new file mode 100755 index 0000000..e95ff77 --- /dev/null +++ b/bin/hardening/6.1_disable_xwindow_system.sh @@ -0,0 +1,58 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# + +# +# 6.1 Ensure the X Window system is not installed (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +PACKAGES='xserver-xorg-core xserver-xorg-core-dbg xserver-common' + +# This function will be called if the script status is on enabled / audit mode +audit () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + crit "$PACKAGE is installed !" + else + ok "$PACKAGE is absent" + fi + done +} + +# This function will be called if the script status is on enabled mode +apply () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + crit "$PACKAGE is installed, purging it" + apt-get purge $PACKAGE -y + else + ok "$PACKAGE is absent" + fi + done +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/etc/conf.d/5.1.2_disable_rsh.cfg b/etc/conf.d/5.1.2_disable_rsh.cfg index acee522..e1e4502 100644 --- a/etc/conf.d/5.1.2_disable_rsh.cfg +++ b/etc/conf.d/5.1.2_disable_rsh.cfg @@ -1,2 +1,2 @@ # Configuration for script of same name -status=disabled +status=enabled diff --git a/etc/conf.d/5.1.5_disable_talk_client.cfg b/etc/conf.d/5.1.5_disable_talk_client.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/5.1.5_disable_talk_client.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/5.1.6_disable_telnet_server.cfg b/etc/conf.d/5.1.6_disable_telnet_server.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/5.1.6_disable_telnet_server.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/5.1.7_disable_tftp_server.cfg b/etc/conf.d/5.1.7_disable_tftp_server.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/5.1.7_disable_tftp_server.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/5.1.8_disable_inetd.cfg b/etc/conf.d/5.1.8_disable_inetd.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/5.1.8_disable_inetd.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/5.2_disable_chargen.cfg b/etc/conf.d/5.2_disable_chargen.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/5.2_disable_chargen.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/5.3_disable_daytime.cfg b/etc/conf.d/5.3_disable_daytime.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/5.3_disable_daytime.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/5.4_disable_echo.cfg b/etc/conf.d/5.4_disable_echo.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/5.4_disable_echo.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/5.5_disable_discard.cfg b/etc/conf.d/5.5_disable_discard.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/5.5_disable_discard.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/5.6_disable_time.cfg b/etc/conf.d/5.6_disable_time.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/5.6_disable_time.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/6.1_disable_xwindow_system.cfg b/etc/conf.d/6.1_disable_xwindow_system.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/6.1_disable_xwindow_system.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled