elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-11-22 13:37:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

IMP(3.2.1-2): set sysctl params in config file

Browse Source
This commit is contained in:
Charles Herlin 2019-10-30 15:20:30 +01:00 committed by Thibault Ayanides
parent 625a6206c7
commit d4bbc786a6
2 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
bin/hardening/3.2.1_disable_source_routed_packets.sh
View File

@ -13,8 +13,8 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=2 HARDENING_LEVEL=2
DESCRIPTION="Disable source routed packet acceptance." DESCRIPTION="Disable source routed packet acceptance."
# set in config file
SYSCTL_PARAMS='net.ipv4.conf.all.accept_source_route=0 net.ipv4.conf.default.accept_source_route=0 net.ipv6.conf.all.accept_source_route=0 net.ipv6.conf.default.accept_source_route=0' SYSCTL_PARAMS=''
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
@ -52,6 +52,14 @@ apply () {
done done
} }
# This function will create the config file for this check with default values
create_config() {
cat <<EOF
status=audit
# Specify system parameters to audit, space separated
SYSCTL_PARAMS="net.ipv4.conf.all.accept_source_route=0 net.ipv4.conf.default.accept_source_route=0 net.ipv6.conf.all.accept_source_route=0 net.ipv6.conf.default.accept_source_route=0"
EOF
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :

12
bin/hardening/3.2.2_disable_icmp_redirect.sh
View File

@ -13,8 +13,8 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=2 HARDENING_LEVEL=2
DESCRIPTION="Disable ICMP redirect acceptance to prevent routing table corruption." DESCRIPTION="Disable ICMP redirect acceptance to prevent routing table corruption."
# set in config file
SYSCTL_PARAMS='net.ipv4.conf.all.accept_redirects=0 net.ipv4.conf.default.accept_redirects=0 net.ipv6.conf.all.accept_redirects=0 net.ipv6.conf.default.accept_redirects=0' SYSCTL_PARAMS=''
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
audit () { audit () {
@ -52,6 +52,14 @@ apply () {
done done
} }
# This function will create the config file for this check with default values
create_config() {
cat <<EOF
status=audit
# Specify system parameters to audit, space separated
SYSCTL_PARAMS="net.ipv4.conf.all.accept_redirects=0 net.ipv4.conf.default.accept_redirects=0 net.ipv6.conf.all.accept_redirects=0 net.ipv6.conf.default.accept_redirects=0"
EOF
}
# This function will check config parameters required # This function will check config parameters required
check_config() { check_config() {
: :