elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2025-06-22 02:33:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: timeout of 99.1.3 (#168)

Browse Source 
The 99.1.3_acc_sudoers_no_all.sh script can sometimes timeout
on servers where /etc/sudoers.d/ has thousands of files.
This patch makes it run roughly 5x faster, as tested on a
server with 1500 files in sudoers.d/.

Closes #167.

Signed-off-by: Stephane Lesimple <stephane.lesimple@corp.ovh.com>

Signed-off-by: Stephane Lesimple <stephane.lesimple@corp.ovh.com>
This commit is contained in:
Stéphane Lesimple
2022-12-22 09:47:35 +01:00
committed by GitHub
parent 82a217032d
commit dc952b90df
2 changed files with 46 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
tests/hardening/99.1.3_acc_sudoers_no_all.sh
View File

@ -28,6 +28,19 @@ test_audit() {
register_test contain "[ OK ] jeantestuser ALL = (ALL) NOPASSWD:ALL is present in /etc/sudoers.d/jeantestuser but was EXCUSED because jeantestuser is part of exceptions"
run userexcept /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
# testing the MAX_FILES_TO_LOG config option
echo 'MAX_FILES_TO_LOG=1' >>/opt/debian-cis/etc/conf.d/"${script}".cfg
describe Testing with MAX_FILES_TO_LOG=1
register_test retvalshouldbe 0
register_test contain "won't log every file we check"
run maxlogfiles_1 /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
echo 'MAX_FILES_TO_LOG=9999' >>/opt/debian-cis/etc/conf.d/"${script}".cfg
describe Testing with MAX_FILES_TO_LOG=9999
register_test retvalshouldbe 0
register_test contain "There is no carte-blanche sudo permission in"
run maxlogfiles_9999 /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
rm -f /etc/sudoers.d/jeantestuser
userdel jeantestuser
}