elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2025-06-22 02:33:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

ADD(6.1.3, 6.1.6-9): add new checks

Browse Source 
Renamed some checks, add new checks that check permissions and ownership on /etc/passwd, /etc/shadow, ...
Add new function in utils that checks that check that the file ownership is one of the authrized ownership.

	renamed:    bin/hardening/6.1.5_etc_passwd_permissions.sh -> bin/hardening/6.1.2_etc_passwd_permissions.sh
	new file:   bin/hardening/6.1.3_etc_gshadow-_permissions.sh
	renamed:    bin/hardening/6.1.6_etc_shadow_permissions.sh -> bin/hardening/6.1.4_etc_shadow_permissions.sh
	renamed:    bin/hardening/6.1.7_etc_group_permissions.sh -> bin/hardening/6.1.5_etc_group_permissions.sh
	new file:   bin/hardening/6.1.6_etc_passwd-_permissions.sh
	new file:   bin/hardening/6.1.7_etc_shadow-_permissions.sh
	new file:   bin/hardening/6.1.8_etc_group-_permissions.sh
	new file:   bin/hardening/6.1.9_etc_gshadow_permissions.sh
	modified:   lib/utils.sh
	renamed:    tests/hardening/6.1.5_etc_passwd_permissions.sh -> tests/hardening/6.1.2_etc_passwd_permissions.sh
	new file:   tests/hardening/6.1.3_etc_gshadow-_permissions.sh
	renamed:    tests/hardening/6.1.6_etc_shadow_permissions.sh -> tests/hardening/6.1.4_etc_shadow_permissions.sh
	renamed:    tests/hardening/6.1.7_etc_group_permissions.sh -> tests/hardening/6.1.5_etc_group_permissions.sh
	new file:   tests/hardening/6.1.6_etc_passwd-_permissions.sh
	new file:   tests/hardening/6.1.7_etc_shadow-_permissions.sh
	new file:   tests/hardening/6.1.8_etc_group-_permissions.sh
	new file:   tests/hardening/6.1.9_etc_gshadow_permissions.sh
This commit is contained in:
Thibault Ayanides
2020-12-21 10:02:52 +01:00
parent 233f75023a
commit a2adf0f15c
17 changed files with 655 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
lib/utils.sh
View File

@ -88,6 +88,37 @@ has_file_correct_ownership() {
fi
}
has_file_one_of_ownership() {
local FILE=$1
local USERS_OK=$2
local GROUPS_OK=$3
local USEROK=1
local GROUPOK=1
for USER in $USERS_OK; do
local USERID
USERID=$(id -u "$USER")
if [ "$($SUDO_CMD stat -c "%u" "$FILE")" = "$USERID" ]; then
USEROK=0
fi
done
for GROUP in $GROUPS_OK; do
local GROUPID
GROUPID=$(getent group "$GROUP" | cut -d: -f3)
if [ "$($SUDO_CMD stat -c "%g" "$FILE")" = "$GROUPID" ]; then
GROUPOK=0
fi
done
if [[ "$GROUPOK" = 0 ]] && [[ "$USEROK" = 0 ]]; then
FNRET=0
else
FNRET=1
fi
}
has_file_correct_permissions() {
local FILE=$1
local PERMISSIONS=$2