From a60ed7fc45f3b113579f9318fccf3f3753cf672e Mon Sep 17 00:00:00 2001 From: "thibault.dewailly" Date: Mon, 11 Apr 2016 17:42:31 +0200 Subject: [PATCH] 5.1.2_disable_rsh.sh 5.1.3_disable_rsh_client.sh --- bin/hardening/4.1_restrict_core_dumps.sh | 2 +- bin/hardening/4.2_enable_nx_support.sh | 2 +- .../4.3_enable_randomized_vm_placement.sh | 2 +- bin/hardening/5.1.2_disable_rsh.sh | 83 +++++++++++++++++++ bin/hardening/5.1.3_disable_rsh_client.sh | 58 +++++++++++++ etc/conf.d/4.2_enable_nx_support.cfg | 2 +- .../4.3_enable_randomized_vm_placement.cfg | 2 +- etc/conf.d/4.4_disable_prelink.cfg | 2 +- etc/conf.d/4.5_enable_apparmor.cfg | 2 +- etc/conf.d/5.1.1_disable_nis.cfg | 2 +- etc/conf.d/5.1.2_disable_rsh.cfg | 2 + etc/conf.d/5.1.3_disable_rsh_client.cfg | 2 + 12 files changed, 153 insertions(+), 8 deletions(-) create mode 100755 bin/hardening/5.1.2_disable_rsh.sh create mode 100755 bin/hardening/5.1.3_disable_rsh_client.sh create mode 100644 etc/conf.d/5.1.2_disable_rsh.cfg create mode 100644 etc/conf.d/5.1.3_disable_rsh_client.cfg diff --git a/bin/hardening/4.1_restrict_core_dumps.sh b/bin/hardening/4.1_restrict_core_dumps.sh index 66fd715..7f6a4b6 100755 --- a/bin/hardening/4.1_restrict_core_dumps.sh +++ b/bin/hardening/4.1_restrict_core_dumps.sh @@ -5,7 +5,7 @@ # # -# Hardening script skeleton replace this line with proper point treated +# 4.1 Restrict Core Dumps (Scored) # set -e # One error, it's over diff --git a/bin/hardening/4.2_enable_nx_support.sh b/bin/hardening/4.2_enable_nx_support.sh index 4ca2292..d5c4962 100755 --- a/bin/hardening/4.2_enable_nx_support.sh +++ b/bin/hardening/4.2_enable_nx_support.sh @@ -5,7 +5,7 @@ # # -# Hardening script skeleton replace this line with proper point treated +# 4.2 Enable XD/NX Support on 32-bit x86 Systems (Not Scored) # set -e # One error, it's over diff --git a/bin/hardening/4.3_enable_randomized_vm_placement.sh b/bin/hardening/4.3_enable_randomized_vm_placement.sh index c7204aa..ded11c1 100755 --- a/bin/hardening/4.3_enable_randomized_vm_placement.sh +++ b/bin/hardening/4.3_enable_randomized_vm_placement.sh @@ -5,7 +5,7 @@ # # -# Hardening script skeleton replace this line with proper point treated +# 4.3 Enable Randomized Virtual Memory Region Placement (Scored) # set -e # One error, it's over diff --git a/bin/hardening/5.1.2_disable_rsh.sh b/bin/hardening/5.1.2_disable_rsh.sh new file mode 100755 index 0000000..cf319fd --- /dev/null +++ b/bin/hardening/5.1.2_disable_rsh.sh @@ -0,0 +1,83 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# + +# +# 5.1.2 Ensure rsh server is not enabled (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +PACKAGE='rsh-server' +FILE='/etc/inetd.conf' +PATTERN='^(shell|login|exec)' + +# This function will be called if the script status is on enabled / audit mode +audit () { + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + warn "$PACKAGE is installed, checking configuration" + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + crit "$PATTERN exists, $PACKAGE services are enabled !" + else + ok "$PATTERN not present in $FILE" + fi + fi + else + ok "$PACKAGE is absent" + fi + : +} + +# This function will be called if the script status is on enabled mode +apply () { + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + crit "$PACKAGE is installed, purging it" + apt-get purge $PACKAGE -y + else + ok "$PACKAGE is absent" + fi + does_file_exist $FILE + if [ $FNRET != 0 ]; then + ok "$FILE does not exist" + else + info "$FILE exists, checking patterns" + does_pattern_exists_in_file $FILE $PATTERN + if [ $FNRET = 0 ]; then + warn "$PATTERN present in $FILE, purging it" + backup_file $FILE + ESCAPED_PATTERN=$(sed "s/|\|(\|)/\\\&/g" <<< $PATTERN) + sed -ie "s/$ESCAPED_PATTERN/#&/g" $FILE + else + ok "$PATTERN not present in $FILE" + fi + fi +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/5.1.3_disable_rsh_client.sh b/bin/hardening/5.1.3_disable_rsh_client.sh new file mode 100755 index 0000000..72fcfa9 --- /dev/null +++ b/bin/hardening/5.1.3_disable_rsh_client.sh @@ -0,0 +1,58 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# + +# +# 5.1.3 Ensure rsh client is not installed (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +PACKAGES='rsh-client rsh-redone-client' + +# This function will be called if the script status is on enabled / audit mode +audit () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + crit "$PACKAGE is installed" + else + ok "$PACKAGE is absent" + fi + done +} + +# This function will be called if the script status is on enabled mode +apply () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + warn "$PACKAGE is installed, purging" + apt-get purge $PACKAGE -y + else + ok "$PACKAGE is absent" + fi + done +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/etc/conf.d/4.2_enable_nx_support.cfg b/etc/conf.d/4.2_enable_nx_support.cfg index e1e4502..acee522 100644 --- a/etc/conf.d/4.2_enable_nx_support.cfg +++ b/etc/conf.d/4.2_enable_nx_support.cfg @@ -1,2 +1,2 @@ # Configuration for script of same name -status=enabled +status=disabled diff --git a/etc/conf.d/4.3_enable_randomized_vm_placement.cfg b/etc/conf.d/4.3_enable_randomized_vm_placement.cfg index e1e4502..acee522 100644 --- a/etc/conf.d/4.3_enable_randomized_vm_placement.cfg +++ b/etc/conf.d/4.3_enable_randomized_vm_placement.cfg @@ -1,2 +1,2 @@ # Configuration for script of same name -status=enabled +status=disabled diff --git a/etc/conf.d/4.4_disable_prelink.cfg b/etc/conf.d/4.4_disable_prelink.cfg index e1e4502..acee522 100644 --- a/etc/conf.d/4.4_disable_prelink.cfg +++ b/etc/conf.d/4.4_disable_prelink.cfg @@ -1,2 +1,2 @@ # Configuration for script of same name -status=enabled +status=disabled diff --git a/etc/conf.d/4.5_enable_apparmor.cfg b/etc/conf.d/4.5_enable_apparmor.cfg index e1e4502..acee522 100644 --- a/etc/conf.d/4.5_enable_apparmor.cfg +++ b/etc/conf.d/4.5_enable_apparmor.cfg @@ -1,2 +1,2 @@ # Configuration for script of same name -status=enabled +status=disabled diff --git a/etc/conf.d/5.1.1_disable_nis.cfg b/etc/conf.d/5.1.1_disable_nis.cfg index e1e4502..acee522 100644 --- a/etc/conf.d/5.1.1_disable_nis.cfg +++ b/etc/conf.d/5.1.1_disable_nis.cfg @@ -1,2 +1,2 @@ # Configuration for script of same name -status=enabled +status=disabled diff --git a/etc/conf.d/5.1.2_disable_rsh.cfg b/etc/conf.d/5.1.2_disable_rsh.cfg new file mode 100644 index 0000000..acee522 --- /dev/null +++ b/etc/conf.d/5.1.2_disable_rsh.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=disabled diff --git a/etc/conf.d/5.1.3_disable_rsh_client.cfg b/etc/conf.d/5.1.3_disable_rsh_client.cfg new file mode 100644 index 0000000..acee522 --- /dev/null +++ b/etc/conf.d/5.1.3_disable_rsh_client.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=disabled