elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2025-06-22 02:33:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

ADD(6.1.3, 6.1.6-9): add new checks

Browse Source 
Renamed some checks, add new checks that check permissions and ownership on /etc/passwd, /etc/shadow, ...
Add new function in utils that checks that check that the file ownership is one of the authrized ownership.

	renamed:    bin/hardening/6.1.5_etc_passwd_permissions.sh -> bin/hardening/6.1.2_etc_passwd_permissions.sh
	new file:   bin/hardening/6.1.3_etc_gshadow-_permissions.sh
	renamed:    bin/hardening/6.1.6_etc_shadow_permissions.sh -> bin/hardening/6.1.4_etc_shadow_permissions.sh
	renamed:    bin/hardening/6.1.7_etc_group_permissions.sh -> bin/hardening/6.1.5_etc_group_permissions.sh
	new file:   bin/hardening/6.1.6_etc_passwd-_permissions.sh
	new file:   bin/hardening/6.1.7_etc_shadow-_permissions.sh
	new file:   bin/hardening/6.1.8_etc_group-_permissions.sh
	new file:   bin/hardening/6.1.9_etc_gshadow_permissions.sh
	modified:   lib/utils.sh
	renamed:    tests/hardening/6.1.5_etc_passwd_permissions.sh -> tests/hardening/6.1.2_etc_passwd_permissions.sh
	new file:   tests/hardening/6.1.3_etc_gshadow-_permissions.sh
	renamed:    tests/hardening/6.1.6_etc_shadow_permissions.sh -> tests/hardening/6.1.4_etc_shadow_permissions.sh
	renamed:    tests/hardening/6.1.7_etc_group_permissions.sh -> tests/hardening/6.1.5_etc_group_permissions.sh
	new file:   tests/hardening/6.1.6_etc_passwd-_permissions.sh
	new file:   tests/hardening/6.1.7_etc_shadow-_permissions.sh
	new file:   tests/hardening/6.1.8_etc_group-_permissions.sh
	new file:   tests/hardening/6.1.9_etc_gshadow_permissions.sh
This commit is contained in:
Thibault Ayanides
2020-12-21 10:02:52 +01:00
parent 233f75023a
commit a2adf0f15c
17 changed files with 655 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

0
tests/hardening/6.1.5_etc_passwd_permissions.sh → tests/hardening/6.1.2_etc_passwd_permissions.sh
View File

42
tests/hardening/6.1.3_etc_gshadow-_permissions.sh Executable file
View File

@ -0,0 +1,42 @@
# shellcheck shell=bash
# run-shellcheck
test_audit() {
describe Running on blank host
register_test retvalshouldbe 0
dismiss_count_for_test
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
local test_user="testetcgshadow-user"
local test_file="/etc/gshadow-"
describe Tests purposely failing
chmod 777 "$test_file"
register_test retvalshouldbe 1
register_test contain "permissions were not set to"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Tests purposely failing
useradd "$test_user"
chown "$test_user":"$test_user" "$test_file"
register_test retvalshouldbe 1
register_test contain "ownership was not set to"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "has correct permissions"
register_test contain "has correct ownership"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# Cleanup
userdel "$test_user"
}

0
tests/hardening/6.1.6_etc_shadow_permissions.sh → tests/hardening/6.1.4_etc_shadow_permissions.sh
View File

0
tests/hardening/6.1.7_etc_group_permissions.sh → tests/hardening/6.1.5_etc_group_permissions.sh
View File

42
tests/hardening/6.1.6_etc_passwd-_permissions.sh Executable file
View File

@ -0,0 +1,42 @@
# shellcheck shell=bash
# run-shellcheck
test_audit() {
describe Running on blank host
register_test retvalshouldbe 0
dismiss_count_for_test
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
local test_user="testetcpasswd-user"
local test_file="/etc/passwd-"
describe Tests purposely failing
chmod 777 "$test_file"
register_test retvalshouldbe 1
register_test contain "permissions were not set to"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Tests purposely failing
useradd "$test_user"
chown "$test_user":"$test_user" "$test_file"
register_test retvalshouldbe 1
register_test contain "ownership was not set to"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "has correct permissions"
register_test contain "has correct ownership"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# Cleanup
userdel "$test_user"
}

42
tests/hardening/6.1.7_etc_shadow-_permissions.sh Executable file
View File

@ -0,0 +1,42 @@
# shellcheck shell=bash
# run-shellcheck
test_audit() {
describe Running on blank host
register_test retvalshouldbe 0
dismiss_count_for_test
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
local test_user="testetcshadow-user"
local test_file="/etc/shadow-"
describe Tests purposely failing
chmod 777 "$test_file"
register_test retvalshouldbe 1
register_test contain "permissions were not set to"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Tests purposely failing
useradd "$test_user"
chown "$test_user":"$test_user" "$test_file"
register_test retvalshouldbe 1
register_test contain "ownership was not set to"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "has correct permissions"
register_test contain "has correct ownership"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# Cleanup
userdel "$test_user"
}

42
tests/hardening/6.1.8_etc_group-_permissions.sh Executable file
View File

@ -0,0 +1,42 @@
# shellcheck shell=bash
# run-shellcheck
test_audit() {
describe Running on blank host
register_test retvalshouldbe 0
dismiss_count_for_test
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
local test_user="testetcgroup--user"
local test_file="/etc/group-"
describe Tests purposely failing
chmod 777 "$test_file"
register_test retvalshouldbe 1
register_test contain "permissions were not set to"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Tests purposely failing
useradd "$test_user"
chown "$test_user":"$test_user" "$test_file"
register_test retvalshouldbe 1
register_test contain "ownership was not set to"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "has correct permissions"
register_test contain "has correct ownership"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# Cleanup
userdel "$test_user"
}

42
tests/hardening/6.1.9_etc_gshadow_permissions.sh Executable file
View File

@ -0,0 +1,42 @@
# shellcheck shell=bash
# run-shellcheck
test_audit() {
describe Running on blank host
register_test retvalshouldbe 0
dismiss_count_for_test
# shellcheck disable=2154
run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
local test_user="testetcgshadowuser"
local test_file="/etc/gshadow"
describe Tests purposely failing
chmod 777 "$test_file"
register_test retvalshouldbe 1
register_test contain "permissions were not set to"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Tests purposely failing
useradd "$test_user"
chown "$test_user":"$test_user" "$test_file"
register_test retvalshouldbe 1
register_test contain "ownership was not set to"
run noncompliant /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
describe correcting situation
sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg
/opt/debian-cis/bin/hardening/"${script}".sh --apply || true
describe Checking resolved state
register_test retvalshouldbe 0
register_test contain "has correct permissions"
register_test contain "has correct ownership"
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# Cleanup
userdel "$test_user"
}