From d241ae57f97e082de837eb9be3234e4401939004 Mon Sep 17 00:00:00 2001 From: "thibault.dewailly" Date: Sat, 16 Apr 2016 00:26:19 +0200 Subject: [PATCH] 12.10_find_suid_files.sh 12.1_etc_passwd_permissions.sh 12.2_etc_shadow_permissions.sh 12.3_etc_group_permissions.sh 12.4_etc_passwd_ownership.sh 12.5_etc_shadow_ownership.sh 12.6_etc_group_ownership.sh 12.7_find_world_writable_file.sh 12.8_find_unowned_files.sh 12.9_find_ungrouped_files.sh --- bin/hardening/12.10_find_suid_files.sh | 58 +++++++++++++++ bin/hardening/12.1_etc_passwd_permissions.sh | 56 +++++++++++++++ bin/hardening/12.2_etc_shadow_permissions.sh | 56 +++++++++++++++ bin/hardening/12.3_etc_group_permissions.sh | 56 +++++++++++++++ bin/hardening/12.4_etc_passwd_ownership.sh | 71 +++++++++++++++++++ bin/hardening/12.5_etc_shadow_ownership.sh | 71 +++++++++++++++++++ bin/hardening/12.6_etc_group_ownership.sh | 71 +++++++++++++++++++ .../12.7_find_world_writable_file.sh | 57 +++++++++++++++ bin/hardening/12.8_find_unowned_files.sh | 59 +++++++++++++++ bin/hardening/12.9_find_ungrouped_files.sh | 59 +++++++++++++++ etc/conf.d/12.10_find_suid_files.cfg | 5 ++ etc/conf.d/12.1_etc_passwd_permissions.cfg | 2 + etc/conf.d/12.2_etc_shadow_permissions.cfg | 2 + etc/conf.d/12.3_etc_group_permissions.cfg | 2 + etc/conf.d/12.4_etc_passwd_ownership.cfg | 2 + etc/conf.d/12.5_etc_shadow_ownership.cfg | 2 + etc/conf.d/12.6_etc_group_ownership.cfg | 2 + etc/conf.d/12.7_find_world_writable_file.cfg | 2 + etc/conf.d/12.8_find_unowned_files.cfg | 2 + etc/conf.d/12.9_find_ungrouped_files.cfg | 2 + 20 files changed, 637 insertions(+) create mode 100755 bin/hardening/12.10_find_suid_files.sh create mode 100755 bin/hardening/12.1_etc_passwd_permissions.sh create mode 100755 bin/hardening/12.2_etc_shadow_permissions.sh create mode 100755 bin/hardening/12.3_etc_group_permissions.sh create mode 100755 bin/hardening/12.4_etc_passwd_ownership.sh create mode 100755 bin/hardening/12.5_etc_shadow_ownership.sh create mode 100755 bin/hardening/12.6_etc_group_ownership.sh create mode 100755 bin/hardening/12.7_find_world_writable_file.sh create mode 100755 bin/hardening/12.8_find_unowned_files.sh create mode 100755 bin/hardening/12.9_find_ungrouped_files.sh create mode 100644 etc/conf.d/12.10_find_suid_files.cfg create mode 100644 etc/conf.d/12.1_etc_passwd_permissions.cfg create mode 100644 etc/conf.d/12.2_etc_shadow_permissions.cfg create mode 100644 etc/conf.d/12.3_etc_group_permissions.cfg create mode 100644 etc/conf.d/12.4_etc_passwd_ownership.cfg create mode 100644 etc/conf.d/12.5_etc_shadow_ownership.cfg create mode 100644 etc/conf.d/12.6_etc_group_ownership.cfg create mode 100644 etc/conf.d/12.7_find_world_writable_file.cfg create mode 100644 etc/conf.d/12.8_find_unowned_files.cfg create mode 100644 etc/conf.d/12.9_find_ungrouped_files.cfg diff --git a/bin/hardening/12.10_find_suid_files.sh b/bin/hardening/12.10_find_suid_files.sh new file mode 100755 index 0000000..c6566f1 --- /dev/null +++ b/bin/hardening/12.10_find_suid_files.sh @@ -0,0 +1,58 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# Authors : Thibault Dewailly, OVH +# + +# +# 12.10 Find SUID System Executables (Not Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +# This function will be called if the script status is on enabled / audit mode +audit () { + info "Checking if there is suid files" + RESULT=$(df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type f -perm -4000 -print) + for BINARY in $RESULT; do + if grep -q $BINARY <<< "$EXCEPTIONS"; then + debug "$BINARY is confirmed as an exception" + + RESULT=$(sed '!'"$BINARY"'!d' <<< $RESULT) + fi + done + if [ ! -z "$RESULT" ]; then + crit "Some world writable file are present" + FORMATTED_RESULT=$(sed "s/ /\n/g" <<< $RESULT | sort | uniq | tr '\n' ' ') + crit "$FORMATTED_RESULT" + else + ok "No world writable files found" + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + info "Removing suid on valid binary may seriously harm your system, report only here" +} + +# This function will check config parameters required +check_config() { + # No param for this function + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/12.1_etc_passwd_permissions.sh b/bin/hardening/12.1_etc_passwd_permissions.sh new file mode 100755 index 0000000..3b6ffc4 --- /dev/null +++ b/bin/hardening/12.1_etc_passwd_permissions.sh @@ -0,0 +1,56 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# Authors : Thibault Dewailly, OVH +# + +# +# 12.1 Verify Permissions on /etc/passwd (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +FILE='/etc/passwd' +PERMISSIONS='644' + +# This function will be called if the script status is on enabled / audit mode +audit () { + has_file_correct_permissions $FILE $PERMISSIONS + if [ $FNRET = 0 ]; then + ok "$FILE has correct permissions" + else + crit "$FILE has not $PERMISSIONS permissions set" + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + has_file_correct_permissions $FILE $PERMISSIONS + if [ $FNRET = 0 ]; then + ok "$FILE has correct permissions" + else + info "fixing $FILE permissions to $PERMISSIONS" + chmod 0$PERMISSIONS $FILE + fi +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/12.2_etc_shadow_permissions.sh b/bin/hardening/12.2_etc_shadow_permissions.sh new file mode 100755 index 0000000..774b470 --- /dev/null +++ b/bin/hardening/12.2_etc_shadow_permissions.sh @@ -0,0 +1,56 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# Authors : Thibault Dewailly, OVH +# + +# +# 12.2 Verify Permissions on /etc/shadow (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +FILE='/etc/shadow' +PERMISSIONS='640' + +# This function will be called if the script status is on enabled / audit mode +audit () { + has_file_correct_permissions $FILE $PERMISSIONS + if [ $FNRET = 0 ]; then + ok "$FILE has correct permissions" + else + crit "$FILE has not $PERMISSIONS permissions set" + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + has_file_correct_permissions $FILE $PERMISSIONS + if [ $FNRET = 0 ]; then + ok "$FILE has correct permissions" + else + info "fixing $FILE permissions to $PERMISSIONS" + chmod 0$PERMISSIONS $FILE + fi +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/12.3_etc_group_permissions.sh b/bin/hardening/12.3_etc_group_permissions.sh new file mode 100755 index 0000000..acfbb87 --- /dev/null +++ b/bin/hardening/12.3_etc_group_permissions.sh @@ -0,0 +1,56 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# Authors : Thibault Dewailly, OVH +# + +# +# 12.3 Verify Permissions on /etc/group (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +FILE='/etc/group' +PERMISSIONS='644' + +# This function will be called if the script status is on enabled / audit mode +audit () { + has_file_correct_permissions $FILE $PERMISSIONS + if [ $FNRET = 0 ]; then + ok "$FILE has correct permissions" + else + crit "$FILE has not $PERMISSIONS permissions set" + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + has_file_correct_permissions $FILE $PERMISSIONS + if [ $FNRET = 0 ]; then + ok "$FILE has correct permissions" + else + info "fixing $FILE permissions to $PERMISSIONS" + chmod 0$PERMISSIONS $FILE + fi +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/12.4_etc_passwd_ownership.sh b/bin/hardening/12.4_etc_passwd_ownership.sh new file mode 100755 index 0000000..e33312d --- /dev/null +++ b/bin/hardening/12.4_etc_passwd_ownership.sh @@ -0,0 +1,71 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# Authors : Thibault Dewailly, OVH +# + +# +# 12.4 Verify User/Group Ownership on /etc/passwd (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +FILE='/etc/passwd' +USER='root' +GROUP='root' + +# This function will be called if the script status is on enabled / audit mode +audit () { + has_file_correct_ownership $FILE $USER $GROUP + if [ $FNRET = 0 ]; then + ok "$FILE has correct ownership" + else + crit "$FILE is not $USER:$GROUP ownership set" + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + has_file_correct_ownership $FILE $USER $GROUP + if [ $FNRET = 0 ]; then + ok "$FILE has correct ownership" + else + info "fixing $FILE ownership to $USER:$GROUP" + chown $USER:$GROUP $FILE + fi +} + +# This function will check config parameters required +check_config() { + does_user_exist $USER + if [ $FNRET != 0 ]; then + crit "$USER does not exist" + exit 128 + fi + does_group_exist $GROUP + if [ $FNRET != 0 ]; then + crit "$GROUP does not exist" + exit 128 + fi + does_file_exist $FILE + if [ $FNRET != 0 ]; then + crit "$FILE does not exist" + exit 128 + fi +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/12.5_etc_shadow_ownership.sh b/bin/hardening/12.5_etc_shadow_ownership.sh new file mode 100755 index 0000000..e7c26cd --- /dev/null +++ b/bin/hardening/12.5_etc_shadow_ownership.sh @@ -0,0 +1,71 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# Authors : Thibault Dewailly, OVH +# + +# +# 12.5 Verify User/Group Ownership on /etc/shadow (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +FILE='/etc/shadow' +USER='root' +GROUP='shadow' + +# This function will be called if the script status is on enabled / audit mode +audit () { + has_file_correct_ownership $FILE $USER $GROUP + if [ $FNRET = 0 ]; then + ok "$FILE has correct ownership" + else + crit "$FILE is not $USER:$GROUP ownership set" + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + has_file_correct_ownership $FILE $USER $GROUP + if [ $FNRET = 0 ]; then + ok "$FILE has correct ownership" + else + info "fixing $FILE ownership to $USER:$GROUP" + chown $USER:$GROUP $FILE + fi +} + +# This function will check config parameters required +check_config() { + does_user_exist $USER + if [ $FNRET != 0 ]; then + crit "$USER does not exist" + exit 128 + fi + does_group_exist $GROUP + if [ $FNRET != 0 ]; then + crit "$GROUP does not exist" + exit 128 + fi + does_file_exist $FILE + if [ $FNRET != 0 ]; then + crit "$FILE does not exist" + exit 128 + fi +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/12.6_etc_group_ownership.sh b/bin/hardening/12.6_etc_group_ownership.sh new file mode 100755 index 0000000..c2c0a88 --- /dev/null +++ b/bin/hardening/12.6_etc_group_ownership.sh @@ -0,0 +1,71 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# Authors : Thibault Dewailly, OVH +# + +# +# 12.6 Verify User/Group Ownership on /etc/group (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +FILE='/etc/group' +USER='root' +GROUP='root' + +# This function will be called if the script status is on enabled / audit mode +audit () { + has_file_correct_ownership $FILE $USER $GROUP + if [ $FNRET = 0 ]; then + ok "$FILE has correct ownership" + else + crit "$FILE is not $USER:$GROUP ownership set" + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + has_file_correct_ownership $FILE $USER $GROUP + if [ $FNRET = 0 ]; then + ok "$FILE has correct ownership" + else + info "fixing $FILE ownership to $USER:$GROUP" + chown $USER:$GROUP $FILE + fi +} + +# This function will check config parameters required +check_config() { + does_user_exist $USER + if [ $FNRET != 0 ]; then + crit "$USER does not exist" + exit 128 + fi + does_group_exist $GROUP + if [ $FNRET != 0 ]; then + crit "$GROUP does not exist" + exit 128 + fi + does_file_exist $FILE + if [ $FNRET != 0 ]; then + crit "$FILE does not exist" + exit 128 + fi +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/12.7_find_world_writable_file.sh b/bin/hardening/12.7_find_world_writable_file.sh new file mode 100755 index 0000000..f530dd6 --- /dev/null +++ b/bin/hardening/12.7_find_world_writable_file.sh @@ -0,0 +1,57 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# Authors : Thibault Dewailly, OVH +# + +# +# 12.7 Find World Writable Files (Not Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +# This function will be called if the script status is on enabled / audit mode +audit () { + info "Checking if there is world writable files" + RESULT=$(df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type f -perm -0002 -print 2>/dev/null) + if [ ! -z "$RESULT" ]; then + crit "Some world writable file are present" + FORMATTED_RESULT=$(sed "s/ /\n/g" <<< $RESULT | sort | uniq | tr '\n' ' ') + crit "$FORMATTED_RESULT" + else + ok "No world writable files found" + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + RESULT=$(df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type f -perm -0002 -print 2>/dev/null) + if [ ! -z "$RESULT" ]; then + warn "chmoding o-w all files in the system" + df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type f -perm -0002 -print 2>/dev/null| xargs chmod o-w + else + ok "No world writable files found, nothing to apply" + fi +} + +# This function will check config parameters required +check_config() { + # No param for this function + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/12.8_find_unowned_files.sh b/bin/hardening/12.8_find_unowned_files.sh new file mode 100755 index 0000000..7b1936c --- /dev/null +++ b/bin/hardening/12.8_find_unowned_files.sh @@ -0,0 +1,59 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# Authors : Thibault Dewailly, OVH +# + +# +# 12.8 Find Un-owned Files and Directories (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +USER='root' + +# This function will be called if the script status is on enabled / audit mode +audit () { + info "Checking if there is unowned files" + RESULT=$(df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -nouser -print 2>/dev/null) + if [ ! -z "$RESULT" ]; then + crit "Some world writable file are present" + FORMATTED_RESULT=$(sed "s/ /\n/g" <<< $RESULT | sort | uniq | tr '\n' ' ') + crit "$FORMATTED_RESULT" + else + ok "No world writable files found" + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + RESULT=$(df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -nouser -ls 2>/dev/null) + if [ ! -z "$RESULT" ]; then + warn "chmowing all unowned files in the system" + df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -nouser -print 2>/dev/null | xargs chown $USER + else + ok "No world writable files found, nothing to apply" + fi +} + +# This function will check config parameters required +check_config() { + # No param for this function + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/bin/hardening/12.9_find_ungrouped_files.sh b/bin/hardening/12.9_find_ungrouped_files.sh new file mode 100755 index 0000000..3ccb671 --- /dev/null +++ b/bin/hardening/12.9_find_ungrouped_files.sh @@ -0,0 +1,59 @@ +#!/bin/bash + +# +# CIS Debian 7 Hardening +# Authors : Thibault Dewailly, OVH +# + +# +# 12.9 Find Un-grouped Files and Directories (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +GROUP='root' + +# This function will be called if the script status is on enabled / audit mode +audit () { + info "Checking if there is unowned files" + RESULT=$(df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -nogroup -print 2>/dev/null) + if [ ! -z "$RESULT" ]; then + crit "Some world writable file are present" + FORMATTED_RESULT=$(sed "s/ /\n/g" <<< $RESULT | sort | uniq | tr '\n' ' ') + crit "$FORMATTED_RESULT" + else + ok "No world writable files found" + fi +} + +# This function will be called if the script status is on enabled mode +apply () { + RESULT=$(df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -nogroup -ls 2>/dev/null) + if [ ! -z "$RESULT" ]; then + warn "chmowing all ungrouped files in the system" + df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -nogroup -print 2>/dev/null | xargs chgrp $GROUP + else + ok "No world writable files found, nothing to apply" + fi +} + +# This function will check config parameters required +check_config() { + # No param for this function + : +} + +# Source Root Dir Parameter +if [ ! -r /etc/default/cis-hardenning ]; then + echo "There is no /etc/default/cis-hardenning file, cannot source CIS_ROOT_DIR variable, aborting" + exit 128 +else + . /etc/default/cis-hardenning + if [ -z $CIS_ROOT_DIR ]; then + echo "No CIS_ROOT_DIR variable, aborting" + fi +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh diff --git a/etc/conf.d/12.10_find_suid_files.cfg b/etc/conf.d/12.10_find_suid_files.cfg new file mode 100644 index 0000000..329e0ff --- /dev/null +++ b/etc/conf.d/12.10_find_suid_files.cfg @@ -0,0 +1,5 @@ +# Configuration for script of same name +status=enabled + +# Put Here your valid suid binaries so that they do not appear during the audit +EXCEPTIONS="/bin/mount /bin/ping /bin/ping6 /bin/su /bin/umount /usr/bin/chfn /usr/bin/chsh /usr/bin/fping /usr/bin/fping6 /usr/bin/gpasswd /usr/bin/mtr /usr/bin/newgrp /usr/bin/passwd /usr/bin/sudo /usr/bin/sudoedit /usr/lib/openssh/ssh-keysign /usr/lib/pt_chown" diff --git a/etc/conf.d/12.1_etc_passwd_permissions.cfg b/etc/conf.d/12.1_etc_passwd_permissions.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/12.1_etc_passwd_permissions.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/12.2_etc_shadow_permissions.cfg b/etc/conf.d/12.2_etc_shadow_permissions.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/12.2_etc_shadow_permissions.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/12.3_etc_group_permissions.cfg b/etc/conf.d/12.3_etc_group_permissions.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/12.3_etc_group_permissions.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/12.4_etc_passwd_ownership.cfg b/etc/conf.d/12.4_etc_passwd_ownership.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/12.4_etc_passwd_ownership.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/12.5_etc_shadow_ownership.cfg b/etc/conf.d/12.5_etc_shadow_ownership.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/12.5_etc_shadow_ownership.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/12.6_etc_group_ownership.cfg b/etc/conf.d/12.6_etc_group_ownership.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/12.6_etc_group_ownership.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/12.7_find_world_writable_file.cfg b/etc/conf.d/12.7_find_world_writable_file.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/12.7_find_world_writable_file.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/12.8_find_unowned_files.cfg b/etc/conf.d/12.8_find_unowned_files.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/12.8_find_unowned_files.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled diff --git a/etc/conf.d/12.9_find_ungrouped_files.cfg b/etc/conf.d/12.9_find_ungrouped_files.cfg new file mode 100644 index 0000000..e1e4502 --- /dev/null +++ b/etc/conf.d/12.9_find_ungrouped_files.cfg @@ -0,0 +1,2 @@ +# Configuration for script of same name +status=enabled