mirror of
https://github.com/ovh/debian-cis.git
synced 2025-06-21 18:23:42 +02:00
ADD(6.1.3, 6.1.6-9): add new checks
Renamed some checks, add new checks that check permissions and ownership on /etc/passwd, /etc/shadow, ... Add new function in utils that checks that check that the file ownership is one of the authrized ownership. renamed: bin/hardening/6.1.5_etc_passwd_permissions.sh -> bin/hardening/6.1.2_etc_passwd_permissions.sh new file: bin/hardening/6.1.3_etc_gshadow-_permissions.sh renamed: bin/hardening/6.1.6_etc_shadow_permissions.sh -> bin/hardening/6.1.4_etc_shadow_permissions.sh renamed: bin/hardening/6.1.7_etc_group_permissions.sh -> bin/hardening/6.1.5_etc_group_permissions.sh new file: bin/hardening/6.1.6_etc_passwd-_permissions.sh new file: bin/hardening/6.1.7_etc_shadow-_permissions.sh new file: bin/hardening/6.1.8_etc_group-_permissions.sh new file: bin/hardening/6.1.9_etc_gshadow_permissions.sh modified: lib/utils.sh renamed: tests/hardening/6.1.5_etc_passwd_permissions.sh -> tests/hardening/6.1.2_etc_passwd_permissions.sh new file: tests/hardening/6.1.3_etc_gshadow-_permissions.sh renamed: tests/hardening/6.1.6_etc_shadow_permissions.sh -> tests/hardening/6.1.4_etc_shadow_permissions.sh renamed: tests/hardening/6.1.7_etc_group_permissions.sh -> tests/hardening/6.1.5_etc_group_permissions.sh new file: tests/hardening/6.1.6_etc_passwd-_permissions.sh new file: tests/hardening/6.1.7_etc_shadow-_permissions.sh new file: tests/hardening/6.1.8_etc_group-_permissions.sh new file: tests/hardening/6.1.9_etc_gshadow_permissions.sh
This commit is contained in:
31
lib/utils.sh
31
lib/utils.sh
@ -88,6 +88,37 @@ has_file_correct_ownership() {
|
||||
fi
|
||||
}
|
||||
|
||||
has_file_one_of_ownership() {
|
||||
local FILE=$1
|
||||
local USERS_OK=$2
|
||||
local GROUPS_OK=$3
|
||||
|
||||
local USEROK=1
|
||||
local GROUPOK=1
|
||||
|
||||
for USER in $USERS_OK; do
|
||||
local USERID
|
||||
USERID=$(id -u "$USER")
|
||||
if [ "$($SUDO_CMD stat -c "%u" "$FILE")" = "$USERID" ]; then
|
||||
USEROK=0
|
||||
fi
|
||||
done
|
||||
|
||||
for GROUP in $GROUPS_OK; do
|
||||
local GROUPID
|
||||
GROUPID=$(getent group "$GROUP" | cut -d: -f3)
|
||||
if [ "$($SUDO_CMD stat -c "%g" "$FILE")" = "$GROUPID" ]; then
|
||||
GROUPOK=0
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ "$GROUPOK" = 0 ]] && [[ "$USEROK" = 0 ]]; then
|
||||
FNRET=0
|
||||
else
|
||||
FNRET=1
|
||||
fi
|
||||
}
|
||||
|
||||
has_file_correct_permissions() {
|
||||
local FILE=$1
|
||||
local PERMISSIONS=$2
|
||||
|
Reference in New Issue
Block a user