mirror of
https://github.com/ovh/debian-cis.git
synced 2025-07-03 07:49:49 +02:00
Damcava35/set version (#257)
* feat: add "--set-version" option This feature will allow to chose a specific cis version to run, like debian 11 or debian 12 * chore: configure current repository as a version And use it as default version. To this end, the scripts in bin/hardening have been made generic by removing the associated recommendation number. Only impact is if you are used to execute scripts directly from bin/hardening. In this case, please use the "bin/hardening.sh" wrapper as intended. I had to rename 2.3.1_disable_nis.sh to uninstall_nis.sh, as it was conflicting with 2.3.1_disable_nis.sh Also, there was a doublon between 1.1.1.8_disable_cramfs.sh and 99.1.1.1_disable_cramfs.sh ; the former was kept * chore: remove CIS recommendation numbers from bin/hardening scripts * fix: some tests are failing find_ungrouped_files.sh and find_unowned_files.sh tests can not be executed multiple times: - test repository is not cleaned - configuration is updated multiple times Those tests are also failing, because: - the sed to change the status in the configuration was also changing the test folder path. - missing /proc in EXCLUDED paths - the EXCLUDED configuration doesn't have the correct format for egrep --------- Co-authored-by: Damien Cavagnini <damien.cavagnini@corp.ovh.com>
This commit is contained in:
damcav35
@ -29,6 +29,7 @@ BATCH_MODE=''
|
||||
SUMMARY_JSON=''
|
||||
ASK_LOGLEVEL=''
|
||||
ALLOW_UNSUPPORTED_DISTRIBUTION=0
|
||||
USED_VERSION="default"
|
||||
|
||||
usage() {
|
||||
cat <<EOF
|
||||
@ -105,6 +106,13 @@ OPTIONS:
|
||||
This option sets LOGLEVEL, you can choose : info, warning, error, ok, debug or silent.
|
||||
Default value is : info
|
||||
|
||||
--set-version <version>
|
||||
This option allows to run the scripts as defined for a specific CIS debian version.
|
||||
Supported version are the folders listed in the "versions" folder.
|
||||
examples:
|
||||
--set-version debian_11
|
||||
--set-version ovh_legacy
|
||||
|
||||
--summary-json
|
||||
While performing system audit, this option sets LOGLEVEL to silent and
|
||||
only output a json summary at the end
|
||||
@ -163,6 +171,10 @@ while [[ $# -gt 0 ]]; do
|
||||
ASK_LOGLEVEL=$2
|
||||
shift
|
||||
;;
|
||||
--set-version)
|
||||
USED_VERSION=$2
|
||||
shift
|
||||
;;
|
||||
--only)
|
||||
TEST_LIST[${#TEST_LIST[@]}]="$2"
|
||||
shift
|
||||
@ -217,9 +229,20 @@ if [ "$ASK_LOGLEVEL" ]; then LOGLEVEL=$ASK_LOGLEVEL; fi
|
||||
# shellcheck source=../lib/constants.sh
|
||||
[ -r "${CIS_LIB_DIR}"/constants.sh ] && . "${CIS_LIB_DIR}"/constants.sh
|
||||
|
||||
# ensure the CIS version exists
|
||||
does_file_exist "$CIS_VERSIONS_DIR/$USED_VERSION"
|
||||
if [ "$FNRET" -ne 0 ]; then
|
||||
echo "$USED_VERSION is not a valid version"
|
||||
echo "Please use '--set-version' with one of $(ls "$CIS_VERSIONS_DIR" --hide=default -m)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# If we're on a unsupported platform and there is no flag --allow-unsupported-distribution
|
||||
# print warning, otherwise quit
|
||||
|
||||
# update path for the remaining of the script
|
||||
CIS_CHECKS_DIR="$CIS_VERSIONS_DIR/$USED_VERSION"
|
||||
|
||||
if [ "$DISTRIBUTION" != "debian" ]; then
|
||||
echo "Your distribution has been identified as $DISTRIBUTION which is not debian"
|
||||
if [ "$ALLOW_UNSUPPORTED_DISTRIBUTION" -eq 0 ]; then
|
||||
|
||||
@ -1,68 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# run-shellcheck
|
||||
#
|
||||
# CIS Debian Hardening Bonus Check
|
||||
#
|
||||
|
||||
#
|
||||
# 99.1.1.1 Ensure mounting of cramfs filesystems is disabled (Not Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
set -u # One variable unset, it's over
|
||||
|
||||
# shellcheck disable=2034
|
||||
HARDENING_LEVEL=2
|
||||
# shellcheck disable=2034
|
||||
DESCRIPTION="Disable mounting of cramfs filesystems."
|
||||
|
||||
KERNEL_OPTION="CONFIG_CRAMFS"
|
||||
MODULE_NAME="cramfs"
|
||||
|
||||
# This function will be called if the script status is on enabled / audit mode
|
||||
audit() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
crit "$KERNEL_OPTION is enabled!"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled"
|
||||
fi
|
||||
:
|
||||
}
|
||||
|
||||
# This function will be called if the script status is on enabled mode
|
||||
apply() {
|
||||
is_kernel_option_enabled "$KERNEL_OPTION"
|
||||
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
|
||||
warn "I cannot fix $KERNEL_OPTION enabled, recompile your kernel please"
|
||||
else
|
||||
ok "$KERNEL_OPTION is disabled, nothing to do"
|
||||
fi
|
||||
:
|
||||
}
|
||||
|
||||
# This function will check config parameters required
|
||||
check_config() {
|
||||
:
|
||||
}
|
||||
|
||||
# Source Root Dir Parameter
|
||||
if [ -r /etc/default/cis-hardening ]; then
|
||||
# shellcheck source=../../debian/default
|
||||
. /etc/default/cis-hardening
|
||||
fi
|
||||
if [ -z "$CIS_LIB_DIR" ]; then
|
||||
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
|
||||
echo "Cannot source CIS_LIB_DIR variable, aborting."
|
||||
exit 128
|
||||
fi
|
||||
|
||||
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
|
||||
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
|
||||
# shellcheck source=../../lib/main.sh
|
||||
. "${CIS_LIB_DIR}"/main.sh
|
||||
else
|
||||
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
|
||||
exit 128
|
||||
fi
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 99.5.4.5.1 Check that any password that will be created will use sha512crypt (or yescrypt for Debian 11+)
|
||||
# Check that any password that will be created will use sha512crypt (or yescrypt for Debian 11+)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.3.4 Ensure password hashing algorithm is SHA-512 (Scored)
|
||||
# Ensure password hashing algorithm is SHA-512 (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 99.5.4.5.2 Check that passwords in /etc/shadow are sha512crypt (or yescrypt for Debian 11+) hashed and salted
|
||||
# Check that passwords in /etc/shadow are sha512crypt (or yescrypt for Debian 11+) hashed and salted
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 99.1.3 Check there are no carte-blanche authorization in sudoers file(s).
|
||||
# Check there are no carte-blanche authorization in sudoers file(s).
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 4.1.1.4 Ensure audit_backlog_limit is sufficient (Scored)
|
||||
# Ensure audit_backlog_limit is sufficient (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 4.1.1.3 Ensure auditing for processes that start prior to auditd is enabled (Scored)
|
||||
# Ensure auditing for processes that start prior to auditd is enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 4.1.2.1 Ensure audit log storage size is configured (Scored)
|
||||
# Ensure audit log storage size is configured (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 1.5.1 Ensure permissions on bootloader config are configured (Scored)
|
||||
# Ensure permissions on bootloader config are configured (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 1.5.2 Ensure bootloader password is set (Scored)
|
||||
# Ensure bootloader password is set (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 99.99 Ensure that the distribution version is debian and that the version is 9 or 10
|
||||
# Ensure that the distribution version is debian and that the version is 9 or 10
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 6.2.17 Ensure no duplicate GIDs exist (Scored)
|
||||
# Ensure no duplicate GIDs exist (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 6.2.19 Ensure no duplicate group names exist (Scored)
|
||||
# Ensure no duplicate group names exist (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 6.2.16 Ensure no duplicate UIDs exist (Scored)
|
||||
# Ensure no duplicate UIDs exist (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 6.2.18 Ensure no duplicate user names exist (Scored)
|
||||
# Ensure no duplicate user names exist (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 6.2.8 Ensure users' home directories permissions are 750 or more restrictive (Scored
|
||||
# Ensure users' home directories permissions are 750 or more restrictive (Scored
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 6.2.10 Ensure users' dot files are not group or world writable (Scored)
|
||||
# Ensure users' dot files are not group or world writable (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.1.3 Ensure chrony is configured (Scored)
|
||||
# Ensure chrony is configured (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 4.3 Ensure logrotate is configured (Not Scored)
|
||||
# Ensure logrotate is configured (Not Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.1.2 Ensure ntp is configured (Scored)
|
||||
# Ensure ntp is configured (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.2.22 Ensure SSH MaxStartups is configured (Scored)
|
||||
# Ensure SSH MaxStartups is configured (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 4.2.1.3 Configure /etc/syslog-ng/syslog-ng.conf (Not Scored)
|
||||
# Configure /etc/syslog-ng/syslog-ng.conf (Not Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.1.2 Ensure systemd-timesyncd is configured (Not Scored)
|
||||
# Ensure systemd-timesyncd is configured (Not Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.1.7 Ensure permissions on /etc/cron.d are configured (Scored)
|
||||
# Ensure permissions on /etc/cron.d are configured (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.1.4 Ensure permissions on /etc/cron.daily are configured (Scored)
|
||||
# Ensure permissions on /etc/cron.daily are configured (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.1.3 Ensure permissions on /etc/cron.hourly are configured (Scored)
|
||||
# Ensure permissions on /etc/cron.hourly are configured (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.1.6 Ensure permissions on /etc/cron.monthly are configured (Scored)
|
||||
# Ensure permissions on /etc/cron.monthly are configured (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.1.8 Ensure at/cron is restricted to authorized users (Scored)
|
||||
# Ensure at/cron is restricted to authorized users (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.1.5 Ensure permissions on /etc/cron.weekly are configured (Scored)
|
||||
# Ensure permissions on /etc/cron.weekly are configured (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.1.2 Ensure permissions on /etc/crontab are configured (Scored)
|
||||
# Ensure permissions on /etc/crontab are configured (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.4.3 Ensure default group for the root account is GID 0 (Scored)
|
||||
# Ensure default group for the root account is GID 0 (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.4.4 Ensure default usershell timeout is 900 seconds or less
|
||||
# Ensure default usershell timeout is 900 seconds or less
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.4.4 Ensure default user umask is 027 or more restrictive (Scored)
|
||||
# Ensure default user umask is 027 or more restrictive (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 1.6.3.1 Ensure apport is disabled (Scored)
|
||||
# Ensure apport is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 1.1.22 Disable Automounting (Scored)
|
||||
# Disable Automounting (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.3 Ensure Avahi Server is not enabled (Scored)
|
||||
# Ensure Avahi Server is not enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.1.2 Ensure bsd-inetd is not enabled (Scored)
|
||||
# Ensure bsd-inetd is not enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 1.1.1.1 Ensure Mounting of cramfs filesystems is disabled (Scored)
|
||||
# Ensure Mounting of cramfs filesystems is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 3.4.1 Ensure DCCP is disabled (Not Scored)
|
||||
# Ensure DCCP is disabled (Not Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.5 Ensure DHCP Server is not enabled (Scored)
|
||||
# Ensure DHCP Server is not enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.8 Ensure DNS Server is not enabled (Scored)
|
||||
# Ensure DNS Server is not enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 1.1.1.1 Ensure Mounting of freevxfs filesystems is disabled (Scored)
|
||||
# Ensure Mounting of freevxfs filesystems is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.9 Ensure FTP Server is not enabled (Scored)
|
||||
# Ensure FTP Server is not enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 1.1.1.3 Ensure mounting of hfs filesystems is disabled (Scored)
|
||||
# Ensure mounting of hfs filesystems is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 1.1.1.4 Ensure mounting of hfsplus filesystems is disabled (Scored)
|
||||
# Ensure mounting of hfsplus filesystems is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.13 Ensure HTTP Proxy Server is not enabled (Scored)
|
||||
# Ensure HTTP Proxy Server is not enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.10 Ensure HTTP Server is not enabled (Scored)
|
||||
# Ensure HTTP Server is not enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 3.3.2 Ensure ICMP redirects are not accepted (Scored)
|
||||
# Ensure ICMP redirects are not accepted (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.11 Ensure IMAP and POP server is not installed (Scored)
|
||||
# Ensure IMAP and POP server is not installed (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 3.2.2 Ensure IP forwarding is disabled (Scored)
|
||||
# Ensure IP forwarding is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 3.1.1 Disable IPv6 (Not Scored)
|
||||
# Disable IPv6 (Not Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 3.3.9 Ensure IPv6 router advertisements are not accepted (Scored)
|
||||
# Ensure IPv6 router advertisements are not accepted (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 1.1.1.2 Esnure mounting of jffs2 filesystems is disabled (Scored)
|
||||
# Esnure mounting of jffs2 filesystems is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.6 Ensure LDAP server is not enabled (Scored)
|
||||
# Ensure LDAP server is not enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.3.5 Ensure LDAP client is not installed (Scored)
|
||||
# Ensure LDAP client is not installed (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.7 Ensure NFS and RPC are not enabled (Scored)
|
||||
# Ensure NFS and RPC are not enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.17 Ensure NIS Server is not enabled (Scored)
|
||||
# Ensure NIS Server is not enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 1.6.3 Ensure prelink is disabled (Scored)
|
||||
# Ensure prelink is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.4 Ensure CUPS is not enabled (Scored)
|
||||
# Ensure CUPS is not enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 3.4.3 Ensure SCTP is disabled (Not Scored)
|
||||
# Ensure SCTP is disabled (Not Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.2.10 Ensure SSH root login is disabled (Scored)
|
||||
# Ensure SSH root login is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.3.2 Ensure rsh client is not installed (Scored)
|
||||
# Ensure rsh client is not installed (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.16 Ensure rsync service is not enabled (Scored)
|
||||
# Ensure rsync service is not enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.12 Ensure Samba is not enabled (Scored)
|
||||
# Ensure Samba is not enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 3.4.2 Ensure SCTP is disabled (Not Scored)
|
||||
# Ensure SCTP is disabled (Not Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 3.3.3 Ensure secure ICMP redirects are not accepted (Scored)
|
||||
# Ensure secure ICMP redirects are not accepted (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 3.2.1 Ensure packet redirect sending is disabled (Scored)
|
||||
# Ensure packet redirect sending is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.14 Ensure SNMP Server is not enabled (Scored)
|
||||
# Ensure SNMP Server is not enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 3.3.1 Ensure source routed packets are not accepted (Scored)
|
||||
# Ensure source routed packets are not accepted (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 1.1.1.5 Ensure mounting of squashfs filesystems is disabled (Scored)
|
||||
# Ensure mounting of squashfs filesystems is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.2.21 Ensure SSH AllowTCPForwarding is disabled (Scored)
|
||||
# Ensure SSH AllowTCPForwarding is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.2.9 Ensure SSH HostbasedAuthentication is disabled (Scored)
|
||||
# Ensure SSH HostbasedAuthentication is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.2.11 Ensure SSH PermitEmptyPasswords is disabled (Scored)
|
||||
# Ensure SSH PermitEmptyPasswords is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.2.12 Ensure SSH PermitUserEnvironment is disabled (Scored)
|
||||
# Ensure SSH PermitUserEnvironment is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.4.2 Ensure system accounts are non-login (Scored)
|
||||
# Ensure system accounts are non-login (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.3.3 Ensure talk client is not installed (Scored)
|
||||
# Ensure talk client is not installed (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.3.4 Ensure telnet client is not installed (Scored)
|
||||
# Ensure telnet client is not installed (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 99.2.2 Ensure telnet server is not enabled (Scored)
|
||||
# Ensure telnet server is not enabled (Scored)
|
||||
#
|
||||
|
||||
# Note: this check is not anymore in CIS hardening but we decided to keep it anyway
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 3.4.4 Ensure TIPC is disabled (Not Scored)
|
||||
# Ensure TIPC is disabled (Not Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 1.1.1.6 Ensure mounting of udf filesystems is disabled (Scored)
|
||||
# Ensure mounting of udf filesystems is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 99.1.1.23 Disable USB Devices
|
||||
# Disable USB Devices
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 1.1.23 Disable USB storage (Scored)
|
||||
# Disable USB storage (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 3.1.2 Ensure wireless interfaces are disabled (Not Scored)
|
||||
# Ensure wireless interfaces are disabled (Not Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.2.6 Ensure SSH X11 forwarding is disabled (Scored)
|
||||
# Ensure SSH X11 forwarding is disabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.1.1 Ensure xinetd is not enabled (Scored)
|
||||
# Ensure xinetd is not enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 2.2.2 Ensure the X Window system is not installed (Scored)
|
||||
# Ensure the X Window system is not installed (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 1.7.2.2 Ensure AppArmor is enabled in the bootloader configuration (Scored)
|
||||
# Ensure AppArmor is enabled in the bootloader configuration (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 4.1.1.2 Ensure auditd service is enabled (Scored)
|
||||
# Ensure auditd service is enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 99.4.0 Ensure CONFIG_AUDIT is enabled in your running kernel
|
||||
# Ensure CONFIG_AUDIT is enabled in your running kernel
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 3.3.6 Ensure bogus ICMP responses are ignored (Scored)
|
||||
# Ensure bogus ICMP responses are ignored (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.1.1 Ensure cron daemon is enabled (Scored)
|
||||
# Ensure cron daemon is enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 3.5.1.1 Ensure Firewall is active (Scored)
|
||||
# Ensure Firewall is active (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.3.2 Ensure lockout for failed password attempts is configured (Scored)
|
||||
# Ensure lockout for failed password attempts is configured (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 1.6.1 Ensure XD/NX support is enabled (Not Scored)
|
||||
# Ensure XD/NX support is enabled (Not Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.3.1 Ensure password creation requirements are configured (Scored)
|
||||
# Ensure password creation requirements are configured (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 1.6.2 Ensure address space layout randomization (ASLR) is enabled (Scored)
|
||||
# Ensure address space layout randomization (ASLR) is enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 3.3.7 Ensure Reverse Path Filtering is enabled (Scored)
|
||||
# Ensure Reverse Path Filtering is enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.2.20 Ensure SSH PAM is enabled (Scored)
|
||||
# Ensure SSH PAM is enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
@ -6,7 +6,7 @@
|
||||
#
|
||||
|
||||
#
|
||||
# 5.2.8 Ensure SSH IgnoreRhosts is enabled (Scored)
|
||||
# Ensure SSH IgnoreRhosts is enabled (Scored)
|
||||
#
|
||||
|
||||
set -e # One error, it's over
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user