6.16_disable_rsync.sh

bin/hardening/1.1_install_updates.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.10_home_nodev.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.11_removable_device_nodev.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.12_removable_device_noexec.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.13_removable_device_nosuid.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.14_run_shm_nodev.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.15_run_shm_nosuid.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.16_run_shm_noexec.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.17_sticky_bit_world_writable_folder.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.18_disable_cramfs.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.19_disable_freevxfs.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.1_tmp_partition.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.20_disable_jffs2.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.21_disable_hfs.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.22_disable_hfsplus.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.23_disable_squashfs.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.24_disable_udf.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.25_disable_automounting.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.2_tmp_nodev.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.3_tmp_nosuid.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.4_tmp_noexec.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.5_var_partition.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.6.1_var_tmp_partition.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.6.2_var_tmp_nodev.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.6.3_var_tmp_nosuid.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.6.4_var_tmp_noexec.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.7_var_log_partition.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.8_var_log_audit_partition.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/2.9_home_partition.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/3.1_bootloader_ownership.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/3.2_bootloader_permissions.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/3.3_bootloader_password.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/3.4_root_password.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/4.1_restrict_core_dumps.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/4.2_enable_nx_support.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/4.3_enable_randomized_vm_placement.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/4.4_disable_prelink.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/4.5_enable_apparmor.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/5.1.1_disable_nis.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/5.1.2_disable_rsh.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/5.1.3_disable_rsh_client.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/5.1.4_disable_talk.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/5.1.5_disable_talk_client.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/5.1.6_disable_telnet_server.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/5.1.7_disable_tftp_server.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/5.1.8_disable_inetd.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/5.2_disable_chargen.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/5.3_disable_daytime.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/5.4_disable_echo.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/5.5_disable_discard.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/5.6_disable_time.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/6.10_disable_http_server.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/6.11_disable_imap_pop.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/6.12_disable_samba.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/6.13_diable_http_proxy.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/6.14_disable_snmp_server.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/6.15_mta_localhost.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/6.16_disable_rsync.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+
+#
+# CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
+#
+
+#
+# 6.16 Ensure rsync service is not enabled (Scored)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+PACKAGE='rsync'
+RSYNC_DEFAULT_PATTERN='RSYNC_ENABLE=false'
+RSYNC_DEFAULT_FILE='/etc/default/rsync'
+RSYNC_DEFAULT_PATTERN_TO_SEARCH='RSYNC_ENABLE=true'
+
+# This function will be called if the script status is on enabled / audit mode
+audit () {
+    is_pkg_installed $PACKAGE
+    if [ $FNRET != 0 ]; then
+        ok "$PACKAGE is not installed"
+    else
+        ok "$PACKAGE is installed, checking configuration"
+        does_pattern_exists_in_file $RSYNC_DEFAULT_FILE "^$RSYNC_DEFAULT_PATTERN"
+        if [ $FNRET != 0 ]; then
+            crit "$RSYNC_DEFAULT_PATTERN not found in $RSYNC_DEFAULT_FILE"
+        else
+            ok "$RSYNC_DEFAULT_PATTERN found in $RSYNC_DEFAULT_FILE"
+        fi
+    fi
+}
+
+# This function will be called if the script status is on enabled mode
+apply () {
+    is_pkg_installed $PACKAGE
+    if [ $FNRET != 0 ]; then
+        ok "$PACKAGE is not installed"
+    else
+        ok "$PACKAGE is installed, checking configuration"
+        does_pattern_exists_in_file $RSYNC_DEFAULT_FILE "^$RSYNC_DEFAULT_PATTERN"
+        if [ $FNRET != 0 ]; then
+            warn "$RSYNC_DEFAULT_PATTERN not found in $RSYNC_DEFAULT_FILE, adding it"
+            backup_file $RSYNC_DEFAULT_FILE
+            replace_in_file $RSYNC_DEFAULT_FILE $RSYNC_DEFAULT_PATTERN_TO_SEARCH $RSYNC_DEFAULT_PATTERN
+        else
+            ok "$RSYNC_DEFAULT_PATTERN found in $RSYNC_DEFAULT_FILE"
+        fi
+    fi
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ ! -r /etc/default/cis-hardenning ]; then
+    echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
+    exit 128
+else
+    . /etc/default/cis-hardenning
+    if [ -z $CIS_ROOT_DIR ]; then
+        echo "No CIS_ROOT_DIR variable, aborting"
+    fi
+fi 
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

bin/hardening/6.1_disable_xwindow_system.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/6.2_disable_avahi_server.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/6.3_disable_print_server.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/6.4_disable_dhcp.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/6.5_configure_ntp.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/6.6_diable_ldap.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/6.7_disable_nfs_rpc.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/6.8_disable_dns_server.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

bin/hardening/6.9_disable_ftp.sh

@@ -2,6 +2,7 @@
 
 #
 # CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
 #
 
 #

etc/conf.d/6.16_disable_rsync.cfg

@@ -0,0 +1,2 @@
+# Configuration for script of same name
+status=enabled

lib/utils.sh

@@ -117,6 +117,18 @@ add_line_file_before_pattern() {
     sed -i "/$PATTERN/i $LINE" $FILE
     FNRET=0
 }
+
+replace_in_file() {
+    local FILE=$1
+    local SOURCE=$2
+    local DESTINATION=$3
+
+    debug "Replacing $SOURCE to $DESTINATION in $FILE"
+    debug "sed -i 's/$SOURCE/$DESTINATION/g' $FILE"
+    sed -i "s/$SOURCE/$DESTINATION/g" $FILE
+    FNRET=0
+}
+
 #
 # User manipulation
 #