From d91fdbf84bcc68c5e644824d6364e1bab52e5a5f Mon Sep 17 00:00:00 2001 From: Charles Herlin Date: Mon, 21 Oct 2019 14:45:25 +0200 Subject: [PATCH] Add missing tests CUPS, telnet and LDAP new file: bin/hardening/2.2.4_disable_print_server.sh new file: bin/hardening/2.3.4_telnet_client_not_installed.sh new file: bin/hardening/2.3.5_ldap_client_not_installed.sh new file: tests/hardening/2.2.4_disable_print_server.sh new file: tests/hardening/2.3.4_telnet_client_not_installed.sh new file: tests/hardening/2.3.5_ldap_client_not_installed.sh --- bin/hardening/2.2.4_disable_print_server.sh | 67 +++++++++++++++++++ .../2.3.4_telnet_client_not_installed.sh | 66 ++++++++++++++++++ .../2.3.5_ldap_client_not_installed.sh | 66 ++++++++++++++++++ tests/hardening/2.2.4_disable_print_server.sh | 10 +++ .../2.3.4_telnet_client_not_installed.sh | 10 +++ .../2.3.5_ldap_client_not_installed.sh | 10 +++ 6 files changed, 229 insertions(+) create mode 100755 bin/hardening/2.2.4_disable_print_server.sh create mode 100755 bin/hardening/2.3.4_telnet_client_not_installed.sh create mode 100755 bin/hardening/2.3.5_ldap_client_not_installed.sh create mode 100644 tests/hardening/2.2.4_disable_print_server.sh create mode 100644 tests/hardening/2.3.4_telnet_client_not_installed.sh create mode 100644 tests/hardening/2.3.5_ldap_client_not_installed.sh diff --git a/bin/hardening/2.2.4_disable_print_server.sh b/bin/hardening/2.2.4_disable_print_server.sh new file mode 100755 index 0000000..4e484e0 --- /dev/null +++ b/bin/hardening/2.2.4_disable_print_server.sh @@ -0,0 +1,67 @@ +#!/bin/bash + +# +# CIS Debian Hardening +# + +# +# 2.2.4 Ensure CUPS is not enabled (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +HARDENING_LEVEL=3 +DESCRIPTION="Ensure print server (Common Unix Print System) is not enabled." +HARDENING_EXCEPTION=cups + +PACKAGES='libcups2 libcupscgi1 libcupsimage2 libcupsmime1 libcupsppdc1 cups-common cups-client cups-ppdc libcupsfilters1 cups-filters cups' + +# This function will be called if the script status is on enabled / audit mode +audit () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + crit "$PACKAGE is installed!" + else + ok "$PACKAGE is absent" + fi + done +} + +# This function will be called if the script status is on enabled mode +apply () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + crit "$PACKAGE is installed, purging it" + apt-get purge $PACKAGE -y + apt-get autoremove + else + ok "$PACKAGE is absent" + fi + done +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ -r /etc/default/cis-hardening ]; then + . /etc/default/cis-hardening +fi +if [ -z "$CIS_ROOT_DIR" ]; then + echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment." + echo "Cannot source CIS_ROOT_DIR variable, aborting." + exit 128 +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then + . $CIS_ROOT_DIR/lib/main.sh +else + echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_ROOT_DIR in /etc/default/cis-hardening" + exit 128 +fi diff --git a/bin/hardening/2.3.4_telnet_client_not_installed.sh b/bin/hardening/2.3.4_telnet_client_not_installed.sh new file mode 100755 index 0000000..d6336b4 --- /dev/null +++ b/bin/hardening/2.3.4_telnet_client_not_installed.sh @@ -0,0 +1,66 @@ +#!/bin/bash + +# +# CIS Debian Hardening +# + +# +# 2.3.4 Ensure telnet client is not installed (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +HARDENING_LEVEL=2 +DESCRIPTION="Ensure talk client is not installed." + +PACKAGES='telnet' + +# This function will be called if the script status is on enabled / audit mode +audit () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + crit "$PACKAGE is installed" + else + ok "$PACKAGE is absent" + fi + done +} + +# This function will be called if the script status is on enabled mode +apply () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + warn "$PACKAGE is installed, purging" + apt-get purge $PACKAGE -y + apt-get autoremove + else + ok "$PACKAGE is absent" + fi + done +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ -r /etc/default/cis-hardening ]; then + . /etc/default/cis-hardening +fi +if [ -z "$CIS_ROOT_DIR" ]; then + echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment." + echo "Cannot source CIS_ROOT_DIR variable, aborting." + exit 128 +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then + . $CIS_ROOT_DIR/lib/main.sh +else + echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_ROOT_DIR in /etc/default/cis-hardening" + exit 128 +fi diff --git a/bin/hardening/2.3.5_ldap_client_not_installed.sh b/bin/hardening/2.3.5_ldap_client_not_installed.sh new file mode 100755 index 0000000..e2c7b94 --- /dev/null +++ b/bin/hardening/2.3.5_ldap_client_not_installed.sh @@ -0,0 +1,66 @@ +#!/bin/bash + +# +# CIS Debian Hardening +# + +# +# 2.3.5 Ensure LDAP client is not installed (Scored) +# + +set -e # One error, it's over +set -u # One variable unset, it's over + +HARDENING_LEVEL=2 +DESCRIPTION="Ensure talk client is not installed." + +PACKAGES='ldap-utils' + +# This function will be called if the script status is on enabled / audit mode +audit () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + crit "$PACKAGE is installed" + else + ok "$PACKAGE is absent" + fi + done +} + +# This function will be called if the script status is on enabled mode +apply () { + for PACKAGE in $PACKAGES; do + is_pkg_installed $PACKAGE + if [ $FNRET = 0 ]; then + warn "$PACKAGE is installed, purging" + apt-get purge $PACKAGE -y + apt-get autoremove + else + ok "$PACKAGE is absent" + fi + done +} + +# This function will check config parameters required +check_config() { + : +} + +# Source Root Dir Parameter +if [ -r /etc/default/cis-hardening ]; then + . /etc/default/cis-hardening +fi +if [ -z "$CIS_ROOT_DIR" ]; then + echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment." + echo "Cannot source CIS_ROOT_DIR variable, aborting." + exit 128 +fi + +# Main function, will call the proper functions given the configuration (audit, enabled, disabled) +if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then + . $CIS_ROOT_DIR/lib/main.sh +else + echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_ROOT_DIR in /etc/default/cis-hardening" + exit 128 +fi diff --git a/tests/hardening/2.2.4_disable_print_server.sh b/tests/hardening/2.2.4_disable_print_server.sh new file mode 100644 index 0000000..b333419 --- /dev/null +++ b/tests/hardening/2.2.4_disable_print_server.sh @@ -0,0 +1,10 @@ +# run-shellcheck +test_audit() { + describe Running on blank host + register_test retvalshouldbe 0 + dismiss_count_for_test + # shellcheck disable=2154 + run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + # TODO fill comprehensive tests +} diff --git a/tests/hardening/2.3.4_telnet_client_not_installed.sh b/tests/hardening/2.3.4_telnet_client_not_installed.sh new file mode 100644 index 0000000..b333419 --- /dev/null +++ b/tests/hardening/2.3.4_telnet_client_not_installed.sh @@ -0,0 +1,10 @@ +# run-shellcheck +test_audit() { + describe Running on blank host + register_test retvalshouldbe 0 + dismiss_count_for_test + # shellcheck disable=2154 + run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + # TODO fill comprehensive tests +} diff --git a/tests/hardening/2.3.5_ldap_client_not_installed.sh b/tests/hardening/2.3.5_ldap_client_not_installed.sh new file mode 100644 index 0000000..b333419 --- /dev/null +++ b/tests/hardening/2.3.5_ldap_client_not_installed.sh @@ -0,0 +1,10 @@ +# run-shellcheck +test_audit() { + describe Running on blank host + register_test retvalshouldbe 0 + dismiss_count_for_test + # shellcheck disable=2154 + run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + # TODO fill comprehensive tests +}