elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-12-22 14:05:23 +01:00
Code Issues Packages Projects Releases Wiki Activity

6.10_disable_http_server.sh 6.11_disable_imap_pop.sh 6.12_disable_samba.sh 6.13_diable_http_proxy.sh 6.14_disable_snmp_server.sh 6.15_mta_localhost.sh 6.9_disable_ftp.sh

Browse Source
This commit is contained in:
thibault.dewailly 2016-04-12 17:59:17 +02:00
parent 4d5ccf1f58
commit c32c985bb7
24 changed files with 451 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
bin/hardening/5.1.2_disable_rsh.sh
View File

@ -11,7 +11,8 @@
set -e # One error, it's over
set -u # One variable unset, it's over
PACKAGES='rsh-server rsh-redone-server'
# Based on aptitude search '~Prsh-server'
PACKAGES='rsh-server rsh-redone-server heimdal-servers'
FILE='/etc/inetd.conf'
PATTERN='^(shell|login|exec)'

3
bin/hardening/5.1.3_disable_rsh_client.sh
View File

@ -11,7 +11,8 @@
set -e # One error, it's over
set -u # One variable unset, it's over
PACKAGES='rsh-client rsh-redone-client'
# Based on aptitude search '~Prsh-client', exluding ssh-client OFC
PACKAGES='rsh-client rsh-redone-client heimdal-clients'
# This function will be called if the script status is on enabled / audit mode
audit () {

3
bin/hardening/5.1.6_disable_telnet_server.sh
View File

@ -11,7 +11,8 @@
set -e # One error, it's over
set -u # One variable unset, it's over
PACKAGES='telnetd inetutils-telnetd telnetd-ssl'
# Based on aptitude search '~Ptelnet-server'
PACKAGES='telnetd inetutils-telnetd telnetd-ssl krb5-telnetd heimdal-servers'
FILE='/etc/inetd.conf'
PATTERN='^telnet'

60
bin/hardening/6.10_disable_http_server.sh Executable file
View File

@ -0,0 +1,60 @@
#!/bin/bash
#
# CIS Debian 7 Hardening
#
#
# 6.10 Ensure HTTP Server is not enabled (Not Scored)
#
set -e # One error, it's over
set -u # One variable unset, it's over
# Based on aptitude search '~Phttpd'
PACKAGES='nginx apache2 lighttpd micro-httpd mini-httpd yaws boa bozohttpd'
# This function will be called if the script status is on enabled / audit mode
audit () {
for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed !"
else
ok "$PACKAGE is absent"
fi
done
}
# This function will be called if the script status is on enabled mode
apply () {
for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed, purging it"
apt-get purge $PACKAGE -y
apt-get autoremove
else
ok "$PACKAGE is absent"
fi
done
}
# This function will check config parameters required
check_config() {
:
}
# Source Root Dir Parameter
if [ ! -r /etc/default/cis-hardenning ]; then
echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
exit 128
else
. /etc/default/cis-hardenning
if [ -z $CIS_ROOT_DIR ]; then
echo "No CIS_ROOT_DIR variable, aborting"
fi
fi
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

60
bin/hardening/6.11_disable_imap_pop.sh Executable file
View File

@ -0,0 +1,60 @@
#!/bin/bash
#
# CIS Debian 7 Hardening
#
#
# 6.11 Ensure IMAP and POP server is not enabled (Not Scored)
#
set -e # One error, it's over
set -u # One variable unset, it's over
# Based on aptitude search '~Pimap-server' and aptitude search '~Ppop3-server'
PACKAGES='citadel-server courier-imap cyrus-imapd-2.4 dovecot-imapd mailutils-imap4d courier-pop cyrus-pop3d-2.4 dovecot-pop3d heimdal-servers mailutils-pop3d popa3d solid-pop3d xmail'
# This function will be called if the script status is on enabled / audit mode
audit () {
for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed !"
else
ok "$PACKAGE is absent"
fi
done
}
# This function will be called if the script status is on enabled mode
apply () {
for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed, purging it"
apt-get purge $PACKAGE -y
apt-get autoremove
else
ok "$PACKAGE is absent"
fi
done
}
# This function will check config parameters required
check_config() {
:
}
# Source Root Dir Parameter
if [ ! -r /etc/default/cis-hardenning ]; then
echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
exit 128
else
. /etc/default/cis-hardenning
if [ -z $CIS_ROOT_DIR ]; then
echo "No CIS_ROOT_DIR variable, aborting"
fi
fi
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

59
bin/hardening/6.12_disable_samba.sh Executable file
View File

@ -0,0 +1,59 @@
#!/bin/bash
#
# CIS Debian 7 Hardening
#
#
# 6.12 Ensure Samba is not enabled (Not Scored)
#
set -e # One error, it's over
set -u # One variable unset, it's over
PACKAGES='samba'
# This function will be called if the script status is on enabled / audit mode
audit () {
for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed !"
else
ok "$PACKAGE is absent"
fi
done
}
# This function will be called if the script status is on enabled mode
apply () {
for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed, purging it"
apt-get purge $PACKAGE -y
apt-get autoremove
else
ok "$PACKAGE is absent"
fi
done
}
# This function will check config parameters required
check_config() {
:
}
# Source Root Dir Parameter
if [ ! -r /etc/default/cis-hardenning ]; then
echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
exit 128
else
. /etc/default/cis-hardenning
if [ -z $CIS_ROOT_DIR ]; then
echo "No CIS_ROOT_DIR variable, aborting"
fi
fi
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

59
bin/hardening/6.13_diable_http_proxy.sh Executable file
View File

@ -0,0 +1,59 @@
#!/bin/bash
#
# CIS Debian 7 Hardening
#
#
# 6.13 Ensure HTTP Proxy Server is not enabled (Not Scored)
#
set -e # One error, it's over
set -u # One variable unset, it's over
PACKAGES='squid3 squid'
# This function will be called if the script status is on enabled / audit mode
audit () {
for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed !"
else
ok "$PACKAGE is absent"
fi
done
}
# This function will be called if the script status is on enabled mode
apply () {
for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed, purging it"
apt-get purge $PACKAGE -y
apt-get autoremove
else
ok "$PACKAGE is absent"
fi
done
}
# This function will check config parameters required
check_config() {
:
}
# Source Root Dir Parameter
if [ ! -r /etc/default/cis-hardenning ]; then
echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
exit 128
else
. /etc/default/cis-hardenning
if [ -z $CIS_ROOT_DIR ]; then
echo "No CIS_ROOT_DIR variable, aborting"
fi
fi
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

59
bin/hardening/6.14_disable_snmp_server.sh Executable file
View File

@ -0,0 +1,59 @@
#!/bin/bash
#
# CIS Debian 7 Hardening
#
#
# 6.14 Ensure SNMP Server is not enabled (Not Scored)
#
set -e # One error, it's over
set -u # One variable unset, it's over
PACKAGES='snmpd'
# This function will be called if the script status is on enabled / audit mode
audit () {
for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed !"
else
ok "$PACKAGE is absent"
fi
done
}
# This function will be called if the script status is on enabled mode
apply () {
for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed, purging it"
apt-get purge $PACKAGE -y
apt-get autoremove
else
ok "$PACKAGE is absent"
fi
done
}
# This function will check config parameters required
check_config() {
:
}
# Source Root Dir Parameter
if [ ! -r /etc/default/cis-hardenning ]; then
echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
exit 128
else
. /etc/default/cis-hardenning
if [ -z $CIS_ROOT_DIR ]; then
echo "No CIS_ROOT_DIR variable, aborting"
fi
fi
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

66
bin/hardening/6.15_mta_localhost.sh Executable file
View File

@ -0,0 +1,66 @@
#!/bin/bash
#
# CIS Debian 7 Hardening
#
#
# 6.15 Configure Mail Transfer Agent for Local-Only Mode (Scored)
#
set -e # One error, it's over
set -u # One variable unset, it's over
# This function will be called if the script status is on enabled / audit mode
audit () {
info "Checking netport ports opened"
eval 'RESULT=$(netstat -an | grep LIST | grep ":25[[:space:]]")'
debug "Result is $RESULT"
if [ -z "$RESULT" ]; then
ok "Nothing listens on 25 port, probably unix socket configured"
else
info "Checking $RESULT"
if $(grep -q "127.0.0.1" <<< $RESULT); then
ok "MTA is configured to localhost only"
else
crit "MTA listens worldwide"
fi
fi
}
# This function will be called if the script status is on enabled mode
apply () {
info "Checking netport ports opened"
eval 'RESULT=$(netstat -an | grep LIST | grep ":25[[:space:]]")'
debug "Result is $RESULT"
if [ -z "$RESULT" ]; then
ok "Nothing listens on 25 port, probably unix socket configured"
else
info "Checking $RESULT"
if $(grep -q "127.0.0.1" <<< $RESULT); then
ok "MTA is configured to localhost only"
else
warn "MTA listens worldwide, correct this considering your MTA"
fi
fi
:
}
# This function will check config parameters required
check_config() {
:
}
# Source Root Dir Parameter
if [ ! -r /etc/default/cis-hardenning ]; then
echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
exit 128
else
. /etc/default/cis-hardenning
if [ -z $CIS_ROOT_DIR ]; then
echo "No CIS_ROOT_DIR variable, aborting"
fi
fi
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

3
bin/hardening/6.1_disable_xwindow_system.sh
View File

@ -11,7 +11,8 @@
set -e # One error, it's over
set -u # One variable unset, it's over
PACKAGES='xserver-xorg-core xserver-xorg-core-dbg xserver-common'
# Based on aptitude search '~Pxserver'
PACKAGES='xserver-xorg-core xserver-xorg-core-dbg xserver-common xserver-xephyr xserver-xfbdev tightvncserver vnc4server fglrx-driver xvfb xserver-xorg-video-nvidia-legacy-173xx xserver-xorg-video-nvidia-legacy-96xx xnest'
# This function will be called if the script status is on enabled / audit mode
audit () {

2
bin/hardening/6.2_disable_avahi_server.sh
View File

@ -32,7 +32,7 @@ apply () {
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed, purging it"
apt-get purge $PACKAGE -y
apt-get autoremove
apt-get autoremove
else
ok "$PACKAGE is absent"
fi

2
bin/hardening/6.3_disable_print_server.sh
View File

@ -32,7 +32,7 @@ apply () {
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed, purging it"
apt-get purge $PACKAGE -y
apt-get autoremove
apt-get autoremove
else
ok "$PACKAGE is absent"
fi

2
bin/hardening/6.4_disable_dhcp.sh
View File

@ -32,7 +32,7 @@ apply () {
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed, purging it"
apt-get purge $PACKAGE -y
apt-get autoremove
apt-get autoremove
else
ok "$PACKAGE is absent"
fi

2
bin/hardening/6.6_diable_ldap.sh
View File

@ -32,7 +32,7 @@ apply () {
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed, purging it"
apt-get purge $PACKAGE -y
apt-get autoremove
apt-get autoremove
else
ok "$PACKAGE is absent"
fi

2
bin/hardening/6.7_disable_nfs_rpc.sh
View File

@ -32,7 +32,7 @@ apply () {
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed, purging it"
apt-get purge $PACKAGE -y
apt-get autoremove
apt-get autoremove
else
ok "$PACKAGE is absent"
fi

2
bin/hardening/6.8_disable_dns_server.sh
View File

@ -32,7 +32,7 @@ apply () {
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed, purging it"
apt-get purge $PACKAGE -y
apt-get autoremove
apt-get autoremove
else
ok "$PACKAGE is absent"
fi

60
bin/hardening/6.9_disable_ftp.sh Executable file
View File

@ -0,0 +1,60 @@
#!/bin/bash
#
# CIS Debian 7 Hardening
#
#
# 6.9 Ensure FTP Server is not enabled (Not Scored)
#
set -e # One error, it's over
set -u # One variable unset, it's over
# Based on aptitude search '~Pftp-server'
PACKAGES='ftpd ftpd-ssl heimdal-servers inetutils-ftpd krb5-ftpd muddleftpd proftpd-basic pure-ftpd pure-ftpd-ldap pure-ftpd-mysql pure-ftpd-postgresql twoftpd-run vsftpd wzdftpd'
# This function will be called if the script status is on enabled / audit mode
audit () {
for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed !"
else
ok "$PACKAGE is absent"
fi
done
}
# This function will be called if the script status is on enabled mode
apply () {
for PACKAGE in $PACKAGES; do
is_pkg_installed $PACKAGE
if [ $FNRET = 0 ]; then
crit "$PACKAGE is installed, purging it"
apt-get purge $PACKAGE -y
apt-get autoremove
else
ok "$PACKAGE is absent"
fi
done
}
# This function will check config parameters required
check_config() {
:
}
# Source Root Dir Parameter
if [ ! -r /etc/default/cis-hardenning ]; then
echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting"
exit 128
else
. /etc/default/cis-hardenning
if [ -z $CIS_ROOT_DIR ]; then
echo "No CIS_ROOT_DIR variable, aborting"
fi
fi
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

2
etc/conf.d/6.10_disable_http_server.cfg Normal file
View File

@ -0,0 +1,2 @@
# Configuration for script of same name
status=enabled

2
etc/conf.d/6.11_disable_imap_pop.cfg Normal file
View File

@ -0,0 +1,2 @@
# Configuration for script of same name
status=enabled

2
etc/conf.d/6.12_disable_samba.cfg Normal file
View File

@ -0,0 +1,2 @@
# Configuration for script of same name
status=enabled

2
etc/conf.d/6.13_diable_http_proxy.cfg Normal file
View File

@ -0,0 +1,2 @@
# Configuration for script of same name
status=enabled

2
etc/conf.d/6.14_disable_snmp_server.cfg Normal file
View File

@ -0,0 +1,2 @@
# Configuration for script of same name
status=enabled

2
etc/conf.d/6.15_mta_localhost.cfg Normal file
View File

@ -0,0 +1,2 @@
# Configuration for script of same name
status=enabled

2
etc/conf.d/6.9_disable_ftp.cfg Normal file
View File

@ -0,0 +1,2 @@
# Configuration for script of same name
status=enabled