diff --git a/bin/hardening/8.2.4_set_logfile_perm.sh b/bin/hardening/8.2.4_set_logfile_perm.sh deleted file mode 100755 index e2815ff..0000000 --- a/bin/hardening/8.2.4_set_logfile_perm.sh +++ /dev/null @@ -1,161 +0,0 @@ -#!/bin/bash - -# run-shellcheck -# -# CIS Debian Hardening -# - -# -# 8.2.4 Create and Set Permissions on syslog-ng Log Files (Scored) -# - -set -e # One error, it's over -set -u # One variable unset, it's over - -# shellcheck disable=2034 -HARDENING_LEVEL=3 -# shellcheck disable=2034 -DESCRIPTION="Create and set permissions on syslog-ng logfiles." - -PERMISSIONS='' -USER='' -GROUP='' -EXCEPTIONS='' - -# This function will be called if the script status is on enabled / audit mode -audit () { - FILES=$(grep "file(" "$SYSLOG_BASEDIR"/syslog-ng.conf | grep '"' | cut -d'"' -f 2) - for FILE in $FILES; do - does_file_exist "$FILE" - if [ "$FNRET" != 0 ]; then - warn "$FILE does not exist" - else - FOUND_EXC=0 - if grep -q "$FILE" <(tr ' ' '\n' <<< "$EXCEPTIONS" | cut -d ":" -f 1); then - debug "$FILE is found in exceptions" - debug "Setting special user:group:perm" - FOUND_EXC=1 - local user_bak="$USER" - local group_bak="$GROUP" - local perm_bak="$PERMISSIONS" - USER="$(tr ' ' '\n' <<< "$EXCEPTIONS" | grep "$FILE" | cut -d':' -f 2)" - GROUP="$(tr ' ' '\n' <<< "$EXCEPTIONS" | grep "$FILE" | cut -d':' -f 3)" - PERMISSIONS="$(tr ' ' '\n' <<< "$EXCEPTIONS" | grep "$FILE" | cut -d':' -f 4)" - fi - has_file_correct_ownership "$FILE" "$USER" "$GROUP" - if [ "$FNRET" = 0 ]; then - ok "$FILE has correct ownership ($USER:$GROUP)" - else - crit "$FILE ownership was not set to $USER:$GROUP" - fi - has_file_correct_permissions "$FILE" "$PERMISSIONS" - if [ "$FNRET" = 0 ]; then - ok "$FILE has correct permissions ($PERMISSIONS)" - else - crit "$FILE permissions were not set to $PERMISSIONS" - fi - if [ "$FOUND_EXC" = 1 ]; then - debug "Resetting user:group:perm" - USER="$user_bak" - GROUP="$group_bak" - PERMISSIONS="$perm_bak" - fi - fi - done -} - -# This function will be called if the script status is on enabled mode -apply () { - for FILE in $FILES; do - does_file_exist "$FILE" - if [ "$FNRET" != 0 ]; then - info "$FILE does not exist" - filedir=$(dirname "${FILE#/var/log/}") - if [ ! "$filedir" = "." ] && [ ! -d /var/log/"$filedir" ]; then - debug "Creating /var/log/$filedir for $FILE" - debug "mkdir -p /var/log/$filedir" - mkdir -p /var/log/"$filedir" - fi - touch "$FILE" - fi - FOUND_EXC=0 - if grep "$FILE" <(tr ' ' '\n' <<< "$EXCEPTIONS" | cut -d ":" -f 1); then - debug "$FILE is found in exceptions" - debug "Setting special user:group:perm" - FOUND_EXC=1 - local user_bak="$USER" - local group_bak="$GROUP" - local perm_bak="$PERMISSIONS" - USER="$(tr ' ' '\n' <<< "$EXCEPTIONS" | grep "$FILE" | cut -d':' -f 2)" - GROUP="$(tr ' ' '\n' <<< "$EXCEPTIONS" | grep "$FILE" | cut -d':' -f 3)" - PERMISSIONS="$(tr ' ' '\n' <<< "$EXCEPTIONS" | grep "$FILE" | cut -d':' -f 4)" - fi - has_file_correct_ownership "$FILE" "$USER" "$GROUP" - if [ "$FNRET" = 0 ]; then - ok "$FILE has correct ownership" - else - warn "fixing $FILE ownership to $USER:$GROUP" - chown "$USER":"$GROUP" "$FILE" - fi - has_file_correct_permissions "$FILE" "$PERMISSIONS" - if [ "$FNRET" = 0 ]; then - ok "$FILE has correct permissions" - else - info "fixing $FILE permissions to $PERMISSIONS" - chmod 0"$PERMISSIONS" "$FILE" - fi - if [ "$FOUND_EXC" = 1 ]; then - debug "Resetting user:group:perm" - USER="$user_bak" - GROUP="$group_bak" - PERMISSIONS="$perm_bak" - fi - done -} - -# This function will create the config file for this check with default values -create_config() { - cat <