elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-12-22 14:05:23 +01:00
Code Issues Packages Projects Releases Wiki Activity

IMP(shellcheck): quote variables

Browse Source
This commit is contained in:
Thibault Ayanides 2020-12-10 09:50:33 +01:00
parent 16cc2bef71
commit dee0ebc821
91 changed files with 263 additions and 263 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
bin/hardening.sh
View File

@ -180,15 +180,15 @@ if [ -z "$CIS_ROOT_DIR" ]; then
exit 128
fi
# shellcheck source=../lib/constants.sh
[ -r $CIS_ROOT_DIR/lib/constants.sh ] && . $CIS_ROOT_DIR/lib/constants.sh
[ -r "$CIS_ROOT_DIR"/lib/constants.sh ] && . "$CIS_ROOT_DIR"/lib/constants.sh
# shellcheck source=../etc/hardening.cfg
[ -r $CIS_ROOT_DIR/etc/hardening.cfg ] && . $CIS_ROOT_DIR/etc/hardening.cfg
[ -r "$CIS_ROOT_DIR"/etc/hardening.cfg ] && . "$CIS_ROOT_DIR"/etc/hardening.cfg
# shellcheck source=../lib/common.sh
[ -r $CIS_ROOT_DIR/lib/common.sh ] && . $CIS_ROOT_DIR/lib/common.sh
[ -r "$CIS_ROOT_DIR"/lib/common.sh ] && . "$CIS_ROOT_DIR"/lib/common.sh
# shellcheck source=../lib/utils.sh
[ -r $CIS_ROOT_DIR/lib/utils.sh ] && . $CIS_ROOT_DIR/lib/utils.sh
[ -r "$CIS_ROOT_DIR"/lib/utils.sh ] && . "$CIS_ROOT_DIR"/lib/utils.sh
if [ $BATCH_MODE ]; then MACHINE_LOG_LEVEL=3; fi
if [ "$BATCH_MODE" ]; then MACHINE_LOG_LEVEL=3; fi
# If --allow-service-list is specified, don't run anything, just list the supported services
if [ "$ALLOW_SERVICE_LIST" = 1 ]; then
@ -223,7 +223,7 @@ if [ -n "$SET_HARDENING_LEVEL" ] && [ "$SET_HARDENING_LEVEL" != 0 ]; then
exit 0
fi
if [ $CREATE_CONFIG = 1 ] && [ "$EUID" -ne 0 ]; then
if [ "$CREATE_CONFIG" = 1 ] && [ "$EUID" -ne 0 ]; then
echo "For --create-config-files-only, please run as root"
exit 1
fi

2
bin/hardening/1.1.1.3_disable_hfs.sh
View File

@ -22,7 +22,7 @@ MODULE_FILE="hfs"
# This function will be called if the script status is on enabled / audit mode
audit() {
is_kernel_option_enabled "$KERNEL_OPTION" $MODULE_FILE
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_FILE"
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
crit "$KERNEL_OPTION is enabled!"
else

2
bin/hardening/1.1.1.4_disable_hfsplus.sh
View File

@ -22,7 +22,7 @@ MODULE_FILE="hfsplus"
# This function will be called if the script status is on enabled / audit mode
audit() {
is_kernel_option_enabled "$KERNEL_OPTION" $MODULE_FILE
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_FILE"
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
crit "$KERNEL_OPTION is enabled!"
else

2
bin/hardening/1.1.1.5_disable_udf.sh
View File

@ -22,7 +22,7 @@ MODULE_FILE="udf"
# This function will be called if the script status is on enabled / audit mode
audit() {
is_kernel_option_enabled "$KERNEL_OPTION" $MODULE_FILE
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_FILE"
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
crit "$KERNEL_OPTION is enabled!"
else

2
bin/hardening/1.1.1.7_disable_squashfs.sh
View File

@ -22,7 +22,7 @@ MODULE_FILE="squashfs"
# This function will be called if the script status is on enabled / audit mode
audit() {
is_kernel_option_enabled "$KERNEL_OPTION" $MODULE_FILE
is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_FILE"
if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
crit "$KERNEL_OPTION is enabled!"
else

2
bin/hardening/1.1.10_var_tmp_noexec.sh
View File

@ -56,7 +56,7 @@ apply() {
crit "$PARTITION is not a partition, correct this by yourself, I cannot help you here"
elif [ "$FNRET" = 1 ]; then
info "Adding $OPTION to fstab"
add_option_to_fstab $PARTITION $OPTION
add_option_to_fstab "$PARTITION" "$OPTION"
info "Remounting $PARTITION from fstab"
remount_partition "$PARTITION"
elif [ "$FNRET" = 3 ]; then

2
bin/hardening/1.1.14_home_nodev.sh
View File

@ -56,7 +56,7 @@ apply() {
crit "$PARTITION is not a partition, correct this by yourself, I cannot help you here"
elif [ "$FNRET" = 1 ]; then
info "Adding $OPTION to fstab"
add_option_to_fstab $PARTITION $OPTION
add_option_to_fstab "$PARTITION" "$OPTION"
info "Remounting $PARTITION from fstab"
remount_partition "$PARTITION"
elif [ "$FNRET" = 3 ]; then

2
bin/hardening/1.1.22_disable_automounting.sh
View File

@ -36,7 +36,7 @@ apply() {
is_service_enabled "$SERVICE_NAME"
if [ "$FNRET" = 0 ]; then
info "Disabling $SERVICE_NAME"
update-rc.d $SERVICE_NAME remove >/dev/null 2>&1
update-rc.d "$SERVICE_NAME" remove >/dev/null 2>&1
else
ok "$SERVICE_NAME is disabled"
fi

2
bin/hardening/1.1.3_tmp_nodev.sh
View File

@ -56,7 +56,7 @@ apply() {
crit "$PARTITION is not a partition, correct this by yourself, I cannot help you here"
elif [ "$FNRET" = 1 ]; then
info "Adding $OPTION to fstab"
add_option_to_fstab $PARTITION $OPTION
add_option_to_fstab "$PARTITION" "$OPTION"
info "Remounting $PARTITION from fstab"
remount_partition "$PARTITION"
elif [ "$FNRET" = 3 ]; then

2
bin/hardening/1.1.4_tmp_nosuid.sh
View File

@ -56,7 +56,7 @@ apply() {
crit "$PARTITION is not a partition, correct this by yourself, I cannot help you here"
elif [ "$FNRET" = 1 ]; then
info "Adding $OPTION to fstab"
add_option_to_fstab $PARTITION $OPTION
add_option_to_fstab "$PARTITION" "$OPTION"
info "Remounting $PARTITION from fstab"
remount_partition "$PARTITION"
elif [ "$FNRET" = 3 ]; then

2
bin/hardening/1.1.5_tmp_noexec.sh
View File

@ -56,7 +56,7 @@ apply() {
crit "$PARTITION is not a partition, correct this by yourself, I cannot help you here"
elif [ "$FNRET" = 1 ]; then
info "Adding $OPTION to fstab"
add_option_to_fstab $PARTITION $OPTION
add_option_to_fstab "$PARTITION" "$OPTION"
info "Remounting $PARTITION from fstab"
remount_partition "$PARTITION"
elif [ "$FNRET" = 3 ]; then

2
bin/hardening/1.1.8_var_tmp_nodev.sh
View File

@ -56,7 +56,7 @@ apply() {
crit "$PARTITION is not a partition, correct this by yourself, I cannot help you here"
elif [ "$FNRET" = 1 ]; then
info "Adding $OPTION to fstab"
add_option_to_fstab $PARTITION $OPTION
add_option_to_fstab "$PARTITION" "$OPTION"
info "Remounting $PARTITION from fstab"
remount_partition "$PARTITION"
elif [ "$FNRET" = 3 ]; then

2
bin/hardening/1.1.9_var_tmp_nosuid.sh
View File

@ -56,7 +56,7 @@ apply() {
crit "$PARTITION is not a partition, correct this by yourself, I cannot help you here"
elif [ "$FNRET" = 1 ]; then
info "Adding $OPTION to fstab"
add_option_to_fstab $PARTITION $OPTION
add_option_to_fstab "$PARTITION" "$OPTION"
info "Remounting $PARTITION from fstab"
remount_partition "$PARTITION"
elif [ "$FNRET" = 3 ]; then

6
bin/hardening/1.4.1_bootloader_ownership.sh
View File

@ -68,17 +68,17 @@ check_config() {
warn "Grub is not installed, not handling configuration"
exit 128
fi
does_user_exist $USER
does_user_exist "$USER"
if [ "$FNRET" != 0 ]; then
crit "$USER does not exist"
exit 128
fi
does_group_exist $GROUP
does_group_exist "$GROUP"
if [ "$FNRET" != 0 ]; then
crit "$GROUP does not exist"
exit 128
fi
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
crit "$FILE does not exist"
exit 128

8
bin/hardening/1.4.2_bootloader_password.sh
View File

@ -23,13 +23,13 @@ PWD_PATTERN="^password_pbkdf2"
# This function will be called if the script status is on enabled / audit mode
audit() {
does_pattern_exist_in_file $FILE "$USER_PATTERN"
does_pattern_exist_in_file "$FILE" "$USER_PATTERN"
if [ "$FNRET" != 0 ]; then
crit "$USER_PATTERN not present in $FILE"
else
ok "$USER_PATTERN is present in $FILE"
fi
does_pattern_exist_in_file $FILE "$PWD_PATTERN"
does_pattern_exist_in_file "$FILE" "$PWD_PATTERN"
if [ "$FNRET" != 0 ]; then
crit "$PWD_PATTERN not present in $FILE"
else
@ -39,13 +39,13 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_pattern_exist_in_file $FILE "$USER_PATTERN"
does_pattern_exist_in_file "$FILE" "$USER_PATTERN"
if [ "$FNRET" != 0 ]; then
warn "$USER_PATTERN not present in $FILE, please configure password for grub"
else
ok "$USER_PATTERN is present in $FILE"
fi
does_pattern_exist_in_file $FILE "$PWD_PATTERN"
does_pattern_exist_in_file "$FILE" "$PWD_PATTERN"
if [ "$FNRET" != 0 ]; then
warn "$PWD_PATTERN not present in $FILE, please configure password for grub"
else

6
bin/hardening/1.5.1_restrict_core_dumps.sh
View File

@ -28,7 +28,7 @@ audit() {
SEARCH_RES=0
LIMIT_FILES=""
if $SUDO_CMD [ -d "$LIMIT_DIR" ]; then
for file in $($SUDO_CMD ls $LIMIT_DIR/*.conf 2>/dev/null); do
for file in $($SUDO_CMD ls "$LIMIT_DIR"/*.conf 2>/dev/null); do
LIMIT_FILES="$LIMIT_FILES $LIMIT_DIR/$file"
done
fi
@ -43,7 +43,7 @@ audit() {
break
fi
done
if [ $SEARCH_RES = 0 ]; then
if [ "$SEARCH_RES" = 0 ]; then
crit "$LIMIT_PATTERN is not present in $LIMIT_FILE $LIMIT_FILES"
fi
has_sysctl_param_expected_result "$SYSCTL_PARAM" "$SYSCTL_EXP_RESULT"
@ -68,7 +68,7 @@ apply() {
has_sysctl_param_expected_result "$SYSCTL_PARAM" "$SYSCTL_EXP_RESULT"
if [ "$FNRET" != 0 ]; then
warn "$SYSCTL_PARAM was not set to $SYSCTL_EXP_RESULT -- Fixing"
set_sysctl_param $SYSCTL_PARAM $SYSCTL_EXP_RESULT
set_sysctl_param "$SYSCTL_PARAM" "$SYSCTL_EXP_RESULT"
elif [ "$FNRET" = 255 ]; then
warn "$SYSCTL_PARAM does not exist -- Typo?"
else

2
bin/hardening/1.5.3_enable_randomized_vm_placement.sh
View File

@ -37,7 +37,7 @@ apply() {
has_sysctl_param_expected_result "$SYSCTL_PARAM" "$SYSCTL_EXP_RESULT"
if [ "$FNRET" != 0 ]; then
warn "$SYSCTL_PARAM was not set to $SYSCTL_EXP_RESULT -- Fixing"
set_sysctl_param $SYSCTL_PARAM $SYSCTL_EXP_RESULT
set_sysctl_param "$SYSCTL_PARAM" "$SYSCTL_EXP_RESULT"
elif [ "$FNRET" = 255 ]; then
warn "$SYSCTL_PARAM does not exist -- Typo?"
else

4
bin/hardening/1.6.2.1_enable_apparmor.sh
View File

@ -36,13 +36,13 @@ audit() {
c_IFS=$'\n'
IFS=$c_IFS
for line in $RESULT; do
if [[ ! $line =~ "apparmor=1" ]] || [[ ! $line =~ "security=apparmor" ]]; then
if [[ ! "$line" =~ "apparmor=1" ]] || [[ ! "$line" =~ "security=apparmor" ]]; then
crit "$line is not configured"
ERROR=1
fi
done
IFS=$d_IFS
if [ $ERROR = 0 ]; then
if [ "$ERROR" = 0 ]; then
ok "$PACKAGE is configured"
fi

6
bin/hardening/1.7.1.1_remove_os_info_motd.sh
View File

@ -22,7 +22,7 @@ PATTERN='(\\v|\\r|\\m|\\s)'
# This function will be called if the script status is on enabled / audit mode
audit() {
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
crit "$PATTERN is present in $FILE"
else
@ -32,10 +32,10 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
warn "$PATTERN is present in $FILE"
delete_line_in_file $FILE $PATTERN
delete_line_in_file "$FILE" "$PATTERN"
else
ok "$PATTERN is not present in $FILE"
fi

4
bin/hardening/1.7.1.2_remove_os_info_issue.sh
View File

@ -22,7 +22,7 @@ PATTERN='(\\v|\\r|\\m|\\s)'
# This function will be called if the script status is on enabled / audit mode
audit() {
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
crit "$PATTERN is present in $FILE"
else
@ -35,7 +35,7 @@ apply() {
does_pattern_exist_in_file $FILE "$PATTERN"
if [ "$FNRET" = 0 ]; then
warn "$PATTERN is present in $FILE"
delete_line_in_file $FILE $PATTERN
delete_line_in_file "$FILE" "$PATTERN"
else
ok "$PATTERN is not present in $FILE"
fi

6
bin/hardening/1.7.1.3_remove_os_info_issue_net.sh
View File

@ -22,7 +22,7 @@ PATTERN='(\\v|\\r|\\m|\\s)'
# This function will be called if the script status is on enabled / audit mode
audit() {
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
crit "$PATTERN is present in $FILE"
else
@ -32,10 +32,10 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
warn "$PATTERN is present in $FILE"
delete_line_in_file $FILE $PATTERN
delete_line_in_file "$FILE" "$PATTERN"
else
ok "$PATTERN is not present in $FILE"
fi

6
bin/hardening/1.7.1.4_motd_perms.sh
View File

@ -24,7 +24,7 @@ FILE='/etc/motd'
# This function will be called if the script status is on enabled / audit mode
audit() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
crit "$FILE does not exist"
else
@ -45,10 +45,10 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
info "$FILE does not exist"
touch $FILE
touch "$FILE"
fi
has_file_correct_ownership "$FILE" "$USER" "$GROUP"
if [ "$FNRET" = 0 ]; then

6
bin/hardening/1.7.1.5_etc_issue_perms.sh
View File

@ -24,7 +24,7 @@ FILE='/etc/issue'
# This function will be called if the script status is on enabled / audit mode
audit() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
crit "$FILE does not exist"
else
@ -45,10 +45,10 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
info "$FILE does not exist"
touch $FILE
touch "$FILE"
fi
has_file_correct_ownership "$FILE" "$USER" "$GROUP"
if [ "$FNRET" = 0 ]; then

6
bin/hardening/1.7.1.6_etc_issue_net_perms.sh
View File

@ -24,7 +24,7 @@ FILE='/etc/issue.net'
# This function will be called if the script status is on enabled / audit mode
audit() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
crit "$FILE does not exist"
else
@ -45,10 +45,10 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
info "$FILE does not exist"
touch $FILE
touch "$FILE"
fi
has_file_correct_ownership "$FILE" "$USER" "$GROUP"
if [ "$FNRET" = 0 ]; then

10
bin/hardening/2.2.1.2_configure_ntp.sh
View File

@ -60,16 +60,16 @@ apply() {
does_pattern_exist_in_file "$NTP_CONF_FILE" "$NTP_CONF_DEFAULT_PATTERN"
if [ "$FNRET" != 0 ]; then
warn "$NTP_CONF_DEFAULT_PATTERN not found in $NTP_CONF_FILE, adding it"
backup_file $NTP_CONF_FILE
add_end_of_file $NTP_CONF_FILE "restrict -4 default kod notrap nomodify nopeer noquery"
backup_file "$NTP_CONF_FILE"
add_end_of_file "$NTP_CONF_FILE" "restrict -4 default kod notrap nomodify nopeer noquery"
else
ok "$NTP_CONF_DEFAULT_PATTERN found in $NTP_CONF_FILE"
fi
does_pattern_exist_in_file $NTP_INIT_FILE "^$NTP_INIT_PATTERN"
does_pattern_exist_in_file "$NTP_INIT_FILE" "^$NTP_INIT_PATTERN"
if [ "$FNRET" != 0 ]; then
warn "$NTP_INIT_PATTERN not found in $NTP_INIT_FILE, adding it"
backup_file $NTP_INIT_FILE
add_line_file_before_pattern $NTP_INIT_FILE $NTP_INIT_PATTERN "^UGID"
backup_file "$NTP_INIT_FILE"
add_line_file_before_pattern "$NTP_INIT_FILE" "$NTP_INIT_PATTERN" "^UGID"
else
ok "$NTP_INIT_PATTERN found in $NTP_INIT_FILE"
fi

2
bin/hardening/2.2.1.3_configure_chrony.sh
View File

@ -30,7 +30,7 @@ audit() {
crit "$PACKAGE is not installed!"
else
ok "$PACKAGE is installed, checking configuration"
does_pattern_exist_in_file $CONF_FILE $CONF_DEFAULT_PATTERN
does_pattern_exist_in_file "$CONF_FILE" "$CONF_DEFAULT_PATTERN"
if [ "$FNRET" != 0 ]; then
crit "$CONF_DEFAULT_PATTERN not found in $CONF_FILE"
else

6
bin/hardening/2.2.12_disable_samba.sh
View File

@ -32,7 +32,7 @@ audit() {
ok "$PACKAGE is absent"
fi
done
is_service_enabled $SERVICE
is_service_enabled "$SERVICE"
if [ "$FNRET" = 0 ]; then
crit "Service $SERVICE is enabled!"
else
@ -52,10 +52,10 @@ apply() {
ok "$PACKAGE is absent"
fi
done
is_service_enabled $SERVICE
is_service_enabled "$SERVICE"
if [ "$FNRET" = 0 ]; then
crit "Service $SERVICE is enabled!"
systemctl disable $SERVICE
systemctl disable "$SERVICE"
else
ok "Service $SERVICE is disabled"
fi

8
bin/hardening/2.2.16_disable_rsync.sh
View File

@ -31,7 +31,7 @@ audit() {
ok "$PACKAGE is not installed"
else
ok "$PACKAGE is installed, checking configuration"
does_pattern_exist_in_file $RSYNC_DEFAULT_FILE "^$RSYNC_DEFAULT_PATTERN"
does_pattern_exist_in_file "$RSYNC_DEFAULT_FILE" "^$RSYNC_DEFAULT_PATTERN"
if [ "$FNRET" != 0 ]; then
crit "$RSYNC_DEFAULT_PATTERN not found in $RSYNC_DEFAULT_FILE"
else
@ -47,11 +47,11 @@ apply() {
ok "$PACKAGE is not installed"
else
ok "$PACKAGE is installed, checking configuration"
does_pattern_exist_in_file $RSYNC_DEFAULT_FILE "^$RSYNC_DEFAULT_PATTERN"
does_pattern_exist_in_file "$RSYNC_DEFAULT_FILE" "^$RSYNC_DEFAULT_PATTERN"
if [ "$FNRET" != 0 ]; then
warn "$RSYNC_DEFAULT_PATTERN not found in $RSYNC_DEFAULT_FILE, adding it"
backup_file $RSYNC_DEFAULT_FILE
replace_in_file $RSYNC_DEFAULT_FILE $RSYNC_DEFAULT_PATTERN_TO_SEARCH $RSYNC_DEFAULT_PATTERN
backup_file "$RSYNC_DEFAULT_FILE"
replace_in_file "$RSYNC_DEFAULT_FILE" "$RSYNC_DEFAULT_PATTERN_TO_SEARCH" "$RSYNC_DEFAULT_PATTERN"
else
ok "$RSYNC_DEFAULT_PATTERN found in $RSYNC_DEFAULT_FILE"
fi

10
bin/hardening/2.2.18_disable_telnet_server.sh
View File

@ -30,11 +30,11 @@ audit() {
is_pkg_installed "$PACKAGE"
if [ "$FNRET" = 0 ]; then
warn "$PACKAGE is installed, checking configuration"
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
ok "$FILE does not exist"
else
does_pattern_exist_in_file $FILE $PATTERN
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
crit "$PATTERN exists, $PACKAGE services are enabled!"
else
@ -58,18 +58,18 @@ apply() {
else
ok "$PACKAGE is absent"
fi
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
ok "$FILE does not exist"
else
info "$FILE exists, checking patterns"
does_pattern_exist_in_file $FILE $PATTERN
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
warn "$PATTERN is present in $FILE, purging it"
backup_file $FILE
# shellcheck disable=SC2001
ESCAPED_PATTERN=$(sed "s/|\|(\|)/\\\&/g" <<<$PATTERN)
sed -ie "s/$ESCAPED_PATTERN/#&/g" $FILE
sed -ie "s/$ESCAPED_PATTERN/#&/g" "$FILE"
else
ok "$PATTERN is not present in $FILE"
fi

2
bin/hardening/3.2.2_disable_icmp_redirect.sh
View File

@ -23,7 +23,7 @@ SYSCTL_PARAMS=''
audit() {
for SYSCTL_VALUES in $SYSCTL_PARAMS; do
does_sysctl_param_exists "net.ipv6"
if [ "$FNRET" = 0 ] || [[ ! $SYSCTL_VALUES =~ .*ipv6.* ]]; then # IPv6 is enabled or SYSCTL_VALUES doesn't contain ipv6
if [ "$FNRET" = 0 ] || [[ ! "$SYSCTL_VALUES" =~ .*ipv6.* ]]; then # IPv6 is enabled or SYSCTL_VALUES doesn't contain ipv6
SYSCTL_PARAM=$(echo "$SYSCTL_VALUES" | cut -d= -f 1)
SYSCTL_EXP_RESULT=$(echo "$SYSCTL_VALUES" | cut -d= -f 2)
debug "$SYSCTL_PARAM should be set to $SYSCTL_EXP_RESULT"

4
bin/hardening/3.2.6_enable_bad_error_message_protection.sh
View File

@ -39,8 +39,8 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
for SYSCTL_VALUES in $SYSCTL_PARAMS; do
SYSCTL_PARAM=$(echo $SYSCTL_VALUES | cut -d= -f 1)
SYSCTL_EXP_RESULT=$(echo $SYSCTL_VALUES | cut -d= -f 2)
SYSCTL_PARAM=$(echo "$SYSCTL_VALUES" | cut -d= -f 1)
SYSCTL_EXP_RESULT=$(echo "$SYSCTL_VALUES" | cut -d= -f 2)
debug "$SYSCTL_PARAM should be set to $SYSCTL_EXP_RESULT"
has_sysctl_param_expected_result "$SYSCTL_PARAM" "$SYSCTL_EXP_RESULT"
if [ "$FNRET" != 0 ]; then

4
bin/hardening/3.2.8_enable_tcp_syn_cookies.sh
View File

@ -39,8 +39,8 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
for SYSCTL_VALUES in $SYSCTL_PARAMS; do
SYSCTL_PARAM=$(echo $SYSCTL_VALUES | cut -d= -f 1)
SYSCTL_EXP_RESULT=$(echo $SYSCTL_VALUES | cut -d= -f 2)
SYSCTL_PARAM=$(echo "$SYSCTL_VALUES" | cut -d= -f 1)
SYSCTL_EXP_RESULT=$(echo "$SYSCTL_VALUES" | cut -d= -f 2)
debug "$SYSCTL_PARAM should be set to $SYSCTL_EXP_RESULT"
has_sysctl_param_expected_result "$SYSCTL_PARAM" "$SYSCTL_EXP_RESULT"
if [ "$FNRET" != 0 ]; then

6
bin/hardening/3.3.2_hosts_allow.sh
View File

@ -21,7 +21,7 @@ FILE='/etc/hosts.allow'
# This function will be called if the script status is on enabled / audit mode
audit() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
crit "$FILE does not exist"
else
@ -31,10 +31,10 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
warn "$FILE does not exist, creating it"
touch $FILE
touch "$FILE"
warn "You may want to fill it with allowed networks"
else
ok "$FILE exist"

12
bin/hardening/3.3.3_hosts_deny.sh
View File

@ -22,12 +22,12 @@ PATTERN='ALL: ALL'
# This function will be called if the script status is on enabled / audit mode
audit() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
crit "$FILE does not exist"
else
ok "$FILE exists, checking configuration"
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" != 0 ]; then
crit "$PATTERN is not present in $FILE, we have to deny everything"
else
@ -38,17 +38,17 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
warn "$FILE does not exist, creating it"
touch $FILE
touch "$FILE"
else
ok "$FILE exists"
fi
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" != 0 ]; then
crit "$PATTERN is not present in $FILE, we have to deny everything"
add_end_of_file $FILE "$PATTERN"
add_end_of_file "$FILE" "$PATTERN"
warn "YOU MAY HAVE CUT YOUR ACCESS, CHECK BEFORE DISCONNECTING"
else
ok "$PATTERN is present in $FILE"

8
bin/hardening/3.5.1.1_net_fw_default_policy_drop.sh
View File

@ -27,17 +27,17 @@ audit() {
if [ "$FNRET" != 0 ]; then
crit "$PACKAGE is not installed!"
else
ipt=$($SUDO_CMD $PACKAGE -nL 2>/dev/null || true)
if [[ -z $ipt ]]; then
ipt=$($SUDO_CMD "$PACKAGE" -nL 2>/dev/null || true)
if [[ -z "$ipt" ]]; then
crit "Empty return from $PACKAGE command. Aborting..."
return
fi
for chain in $FW_CHAINS; do
regex="Chain $chain \(policy ([A-Z]+)\)"
# previous line will capture actual policy
if [[ $ipt =~ $regex ]]; then
if [[ "$ipt" =~ $regex ]]; then
actual_policy=${BASH_REMATCH[1]}
if [[ $actual_policy = "$FW_POLICY" ]]; then
if [[ "$actual_policy" = "$FW_POLICY" ]]; then
ok "Policy correctly set to $FW_POLICY for chain $chain"
else
crit "Policy set to $actual_policy for chain $chain, should be ${FW_POLICY}."

10
bin/hardening/4.1.1.1_audit_log_storage.sh
View File

@ -23,12 +23,12 @@ VALUE=5
# This function will be called if the script status is on enabled / audit mode
audit() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
crit "$FILE does not exist"
else
ok "$FILE exists, checking configuration"
does_pattern_exist_in_file $FILE "^${PATTERN}[[:space:]]"
does_pattern_exist_in_file "$FILE" "^${PATTERN}[[:space:]]"
if [ "$FNRET" != 0 ]; then
crit "$PATTERN is not present in $FILE"
else
@ -39,17 +39,17 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
warn "$FILE does not exist, creating it"
touch $FILE
else
ok "$FILE exists"
fi
does_pattern_exist_in_file $FILE "^${PATTERN}[[:space:]]"
does_pattern_exist_in_file "$FILE" "^${PATTERN}[[:space:]]"
if [ "$FNRET" != 0 ]; then
warn "$PATTERN is not present in $FILE, adding it"
add_end_of_file $FILE "$PATTERN = $VALUE"
add_end_of_file "$FILE" "$PATTERN = $VALUE"
else
ok "$PATTERN is present in $FILE"
fi

6
bin/hardening/4.1.1.2_halt_when_audit_log_full.sh
View File

@ -22,7 +22,7 @@ OPTIONS=''
# This function will be called if the script status is on enabled / audit mode
audit() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
crit "$FILE does not exist"
else
@ -44,7 +44,7 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
warn "$FILE does not exist, creating it"
touch $FILE
@ -56,7 +56,7 @@ apply() {
AUDIT_VALUE=$(echo "$AUDIT_OPTION" | cut -d= -f 2)
debug "$AUDIT_PARAM should be set to $AUDIT_VALUE"
PATTERN="^${AUDIT_PARAM}[[:space:]]*=[[:space:]]*$AUDIT_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" != 0 ]; then
warn "$PATTERN is not present in $FILE, adding it"
does_pattern_exist_in_file "$FILE" "^$AUDIT_PARAM"

20
bin/hardening/4.1.1.3_keep_all_audit_logs.sh
View File

@ -22,17 +22,17 @@ OPTIONS='max_log_file_action=keep_logs'
# This function will be called if the script status is on enabled / audit mode
audit() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
crit "$FILE does not exist"
else
ok "$FILE exists, checking configuration"
for AUDIT_OPTION in $OPTIONS; do
AUDIT_PARAM=$(echo $AUDIT_OPTION | cut -d= -f 1)
AUDIT_VALUE=$(echo $AUDIT_OPTION | cut -d= -f 2)
AUDIT_PARAM=$(echo "$AUDIT_OPTION" | cut -d= -f 1)
AUDIT_VALUE=$(echo "$AUDIT_OPTION" | cut -d= -f 2)
PATTERN="^${AUDIT_PARAM}[[:space:]]*=[[:space:]]*$AUDIT_VALUE"
debug "$AUDIT_PARAM should be set to $AUDIT_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" != 0 ]; then
crit "$PATTERN is not present in $FILE"
else
@ -44,7 +44,7 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
warn "$FILE does not exist, creating it"
touch $FILE
@ -52,20 +52,20 @@ apply() {
ok "$FILE exists"
fi
for AUDIT_OPTION in $OPTIONS; do
AUDIT_PARAM=$(echo $AUDIT_OPTION | cut -d= -f 1)
AUDIT_VALUE=$(echo $AUDIT_OPTION | cut -d= -f 2)
AUDIT_PARAM=$(echo "$AUDIT_OPTION" | cut -d= -f 1)
AUDIT_VALUE=$(echo "$AUDIT_OPTION" | cut -d= -f 2)
debug "$AUDIT_PARAM should be set to $AUDIT_VALUE"
PATTERN="^${AUDIT_PARAM}[[:space:]]*=[[:space:]]*$AUDIT_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN"
if [ "$FNRET" != 0 ]; then
warn "$PATTERN is not present in $FILE, adding it"
does_pattern_exist_in_file $FILE "^$AUDIT_PARAM"
does_pattern_exist_in_file "$FILE" "^$AUDIT_PARAM"
if [ "$FNRET" != 0 ]; then
info "Parameter $AUDIT_PARAM seems absent from $FILE, adding at the end"
add_end_of_file $FILE "$AUDIT_PARAM = $AUDIT_VALUE"
add_end_of_file "$FILE" "$AUDIT_PARAM = $AUDIT_VALUE"
else
info "Parameter $AUDIT_PARAM is present but with the wrong value -- Fixing"
replace_in_file $FILE "^${AUDIT_PARAM}[[:space:]]*=.*" "$AUDIT_PARAM = $AUDIT_VALUE"
replace_in_file "$FILE" "^${AUDIT_PARAM}[[:space:]]*=.*" "$AUDIT_PARAM = $AUDIT_VALUE"
fi
else
ok "$PATTERN is present in $FILE"

4
bin/hardening/4.1.2_enable_auditd.sh
View File

@ -50,8 +50,8 @@ apply() {
ok "$SERVICE_NAME is enabled"
else
warn "$SERVICE_NAME is not enabled, enabling it"
update-rc.d $SERVICE_NAME remove >/dev/null 2>&1
update-rc.d $SERVICE_NAME defaults >/dev/null 2>&1
update-rc.d "$SERVICE_NAME" remove >/dev/null 2>&1
update-rc.d "$SERVICE_NAME" defaults >/dev/null 2>&1
fi
}

4
bin/hardening/4.1.3_audit_bootloader.sh
View File

@ -22,7 +22,7 @@ OPTIONS='GRUB_CMDLINE_LINUX="audit=1"'
# This function will be called if the script status is on enabled / audit mode
audit() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
crit "$FILE does not exist"
else
@ -44,7 +44,7 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
warn "$FILE does not exist, creating it"
touch "$FILE"

4
bin/hardening/4.2.2.1_enable_syslog-ng.sh
View File

@ -36,8 +36,8 @@ apply() {
is_service_enabled "$SERVICE_NAME"
if [ "$FNRET" != 0 ]; then
info "Enabling $SERVICE_NAME"
update-rc.d $SERVICE_NAME remove >/dev/null 2>&1
update-rc.d $SERVICE_NAME defaults >/dev/null 2>&1
update-rc.d "$SERVICE_NAME" remove >/dev/null 2>&1
update-rc.d "$SERVICE_NAME" defaults >/dev/null 2>&1
else
ok "$SERVICE_NAME is enabled"
fi

8
bin/hardening/4.2.2.4_syslog-ng_remote_host.sh
View File

@ -22,7 +22,7 @@ PATTERN='destination[[:alnum:][:space:]*{]+(tcp|udp)[[:space:]]*\(\"[[:alnum:].]
# This function will be called if the script status is on enabled / audit mode
audit() {
FOUND=0
FILES="$SYSLOG_BASEDIR/syslog-ng.conf $($SUDO_CMD find -L $SYSLOG_BASEDIR/conf.d/ -type f)"
FILES="$SYSLOG_BASEDIR/syslog-ng.conf $($SUDO_CMD find -L "$SYSLOG_BASEDIR"/conf.d/ -type f)"
for FILE in $FILES; do
does_pattern_exist_in_file_multiline "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
@ -30,7 +30,7 @@ audit() {
fi
done
if [ $FOUND = 1 ]; then
if [ "$FOUND" = 1 ]; then
ok "$PATTERN is present in $FILES"
else
crit "$PATTERN is not present in $FILES"
@ -40,14 +40,14 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
FOUND=0
FILES="$SYSLOG_BASEDIR/syslog-ng.conf $(find -L $SYSLOG_BASEDIR/conf.d/ -type f)"
FILES="$SYSLOG_BASEDIR/syslog-ng.conf $(find -L "$SYSLOG_BASEDIR"/conf.d/ -type f)"
for FILE in $FILES; do
does_pattern_exist_in_file_multiline "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
FOUND=1
fi
done
if [ $FOUND = 1 ]; then
if [ "$FOUND" = 1 ]; then
ok "$PATTERN is present in $FILES"
else
crit "$PATTERN is not present in $FILES, please set a remote host to send your logs"

4
bin/hardening/5.1.1_enable_cron.sh
View File

@ -47,8 +47,8 @@ apply() {
is_service_enabled "$SERVICE_NAME"
if [ "$FNRET" != 0 ]; then
info "Enabling $SERVICE_NAME"
update-rc.d $SERVICE_NAME remove >/dev/null 2>&1
update-rc.d $SERVICE_NAME defaults >/dev/null 2>&1
update-rc.d "$SERVICE_NAME" remove >/dev/null 2>&1
update-rc.d "$SERVICE_NAME" defaults >/dev/null 2>&1
else
ok "$SERVICE_NAME is enabled"
fi

8
bin/hardening/5.1.2_crontab_perm_ownership.sh
View File

@ -40,10 +40,10 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
info "$FILE does not exist"
touch $FILE
touch "$FILE"
fi
has_file_correct_ownership "$FILE" "$USER" "$GROUP"
if [ "$FNRET" = 0 ]; then
@ -63,12 +63,12 @@ apply() {
# This function will check config parameters required
check_config() {
does_user_exist $USER
does_user_exist "$USER"
if [ "$FNRET" != 0 ]; then
crit "$USER does not exist"
exit 128
fi
does_group_exist $GROUP
does_group_exist "$GROUP"
if [ "$FNRET" != 0 ]; then
crit "$GROUP does not exist"
exit 128

8
bin/hardening/5.1.3_cron_hourly_perm_ownership.sh
View File

@ -40,10 +40,10 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
info "$FILE does not exist"
touch $FILE
touch "$FILE"
fi
has_file_correct_ownership "$FILE" "$USER" "$GROUP"
if [ "$FNRET" = 0 ]; then
@ -63,12 +63,12 @@ apply() {
# This function will check config parameters required
check_config() {
does_user_exist $USER
does_user_exist "$USER"
if [ "$FNRET" != 0 ]; then
crit "$USER does not exist"
exit 128
fi
does_group_exist $GROUP
does_group_exist "$GROUP"
if [ "$FNRET" != 0 ]; then
crit "$GROUP does not exist"
exit 128

8
bin/hardening/5.1.4_cron_daily_perm_ownership.sh
View File

@ -40,10 +40,10 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
info "$FILE does not exist"
touch $FILE
touch "$FILE"
fi
has_file_correct_ownership "$FILE" "$USER" "$GROUP"
if [ "$FNRET" = 0 ]; then
@ -63,12 +63,12 @@ apply() {
# This function will check config parameters required
check_config() {
does_user_exist $USER
does_user_exist "$USER"
if [ "$FNRET" != 0 ]; then
crit "$USER does not exist"
exit 128
fi
does_group_exist $GROUP
does_group_exist "$GROUP"
if [ "$FNRET" != 0 ]; then
crit "$GROUP does not exist"
exit 128

8
bin/hardening/5.1.5_cron_weekly_perm_ownership.sh
View File

@ -40,10 +40,10 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
info "$FILE does not exist"
touch $FILE
touch "$FILE"
fi
has_file_correct_ownership "$FILE" "$USER" "$GROUP"
if [ "$FNRET" = 0 ]; then
@ -63,12 +63,12 @@ apply() {
# This function will check config parameters required
check_config() {
does_user_exist $USER
does_user_exist "$USER"
if [ "$FNRET" != 0 ]; then
crit "$USER does not exist"
exit 128
fi
does_group_exist $GROUP
does_group_exist "$GROUP"
if [ "$FNRET" != 0 ]; then
crit "$GROUP does not exist"
exit 128

8
bin/hardening/5.1.6_cron_monthly_perm_ownership.sh
View File

@ -40,10 +40,10 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
info "$FILE does not exist"
touch $FILE
touch "$FILE"
fi
has_file_correct_ownership "$FILE" "$USER" "$GROUP"
if [ "$FNRET" = 0 ]; then
@ -63,12 +63,12 @@ apply() {
# This function will check config parameters required
check_config() {
does_user_exist $USER
does_user_exist "$USER"
if [ "$FNRET" != 0 ]; then
crit "$USER does not exist"
exit 128
fi
does_group_exist $GROUP
does_group_exist "$GROUP"
if [ "$FNRET" != 0 ]; then
crit "$GROUP does not exist"
exit 128

8
bin/hardening/5.1.7_cron_d_perm_ownership.sh
View File

@ -40,10 +40,10 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
info "$FILE does not exist"
touch $FILE
touch "$FILE"
fi
has_file_correct_ownership "$FILE" "$USER" "$GROUP"
if [ "$FNRET" = 0 ]; then
@ -63,12 +63,12 @@ apply() {
# This function will check config parameters required
check_config() {
does_user_exist $USER
does_user_exist "$USER"
if [ "$FNRET" != 0 ]; then
crit "$USER does not exist"
exit 128
fi
does_group_exist $GROUP
does_group_exist "$GROUP"
if [ "$FNRET" != 0 ]; then
crit "$GROUP does not exist"
exit 128

4
bin/hardening/5.1.8_cron_users.sh
View File

@ -90,12 +90,12 @@ apply() {
# This function will check config parameters required
check_config() {
does_user_exist $USER
does_user_exist "$USER"
if [ "$FNRET" != 0 ]; then
crit "$USER does not exist"
exit 128
fi
does_group_exist $GROUP
does_group_exist "$GROUP"
if [ "$FNRET" != 0 ]; then
crit "$GROUP does not exist"
exit 128

2
bin/hardening/5.2.10_disable_root_login.sh
View File

@ -55,7 +55,7 @@ apply() {
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else

2
bin/hardening/5.2.12_disable_sshd_setenv.sh
View File

@ -60,7 +60,7 @@ apply() {
ok "$PATTERN is present in $FILE"
else
warn "$PATTERN is not present in $FILE, adding it"
does_pattern_exist_in_file $FILE "^${SSH_PARAM}"
does_pattern_exist_in_file "$FILE" "^${SSH_PARAM}"
if [ "$FNRET" != 0 ]; then
add_end_of_file "$FILE" "$SSH_PARAM $SSH_VALUE"
else

2
bin/hardening/5.2.13_sshd_ciphers.sh
View File

@ -55,7 +55,7 @@ apply() {
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else

2
bin/hardening/5.2.14_ssh_cry_mac.sh
View File

@ -55,7 +55,7 @@ apply() {
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file_nocase $FILE "$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else

2
bin/hardening/5.2.15_ssh_cry_kex.sh
View File

@ -55,7 +55,7 @@ apply() {
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file_nocase $FILE "$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else

2
bin/hardening/5.2.18_sshd_limit_access.sh
View File

@ -34,7 +34,7 @@ audit() {
# shellcheck disable=SC2001
SSH_VALUE=$(sed "s/'//g" <<<"$SSH_VALUE")
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else

4
bin/hardening/5.2.19_ssh_banner.sh
View File

@ -31,7 +31,7 @@ audit() {
for SSH_OPTION in $OPTIONS; do
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
PATTERN="^${SSH_PARAM}[[:space:]]*"
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
@ -54,7 +54,7 @@ apply() {
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else

8
bin/hardening/5.2.1_sshd_conf_perm_ownership.sh
View File

@ -40,10 +40,10 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_file_exist $FILE
does_file_exist "$FILE"
if [ "$FNRET" != 0 ]; then
info "$FILE does not exist"
touch $FILE
touch "$FILE"
fi
has_file_correct_ownership "$FILE" "$USER" "$GROUP"
if [ "$FNRET" = 0 ]; then
@ -63,12 +63,12 @@ apply() {
# This function will check config parameters required
check_config() {
does_user_exist $USER
does_user_exist "$USER"
if [ "$FNRET" != 0 ]; then
crit "$USER does not exist"
exit 128
fi
does_group_exist $GROUP
does_group_exist "$GROUP"
if [ "$FNRET" != 0 ]; then
crit "$GROUP does not exist"
exit 128

4
bin/hardening/5.2.2_ssh_host_private_keys_perm_ownership.sh
View File

@ -83,12 +83,12 @@ apply() {
# This function will check config parameters required
check_config() {
does_user_exist $USER
does_user_exist "$USER"
if [ "$FNRET" != 0 ]; then
crit "$USER does not exist"
exit 128
fi
does_group_exist $GROUP
does_group_exist "$GROUP"
if [ "$FNRET" != 0 ]; then
crit "$GROUP does not exist"
exit 128

4
bin/hardening/5.2.3_ssh_host_public_keys_perm_ownership.sh
View File

@ -103,12 +103,12 @@ apply() {
# This function will check config parameters required
check_config() {
does_user_exist $USER
does_user_exist "$USER"
if [ "$FNRET" != 0 ]; then
crit "$USER does not exist"
exit 128
fi
does_group_exist $GROUP
does_group_exist "$GROUP"
if [ "$FNRET" != 0 ]; then
crit "$GROUP does not exist"
exit 128

2
bin/hardening/5.2.5_sshd_loglevel.sh
View File

@ -56,7 +56,7 @@ apply() {
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file_nocase $FILE "$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else

2
bin/hardening/5.2.6_disable_x11_forwarding.sh
View File

@ -55,7 +55,7 @@ apply() {
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else

2
bin/hardening/5.2.7_sshd_maxauthtries.sh
View File

@ -55,7 +55,7 @@ apply() {
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else

2
bin/hardening/5.2.8_enable_sshd_ignorerhosts.sh
View File

@ -55,7 +55,7 @@ apply() {
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else

2
bin/hardening/5.2.9_disable_sshd_hostbasedauthentication.sh
View File

@ -55,7 +55,7 @@ apply() {
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else

2
bin/hardening/5.3.1_enable_pwquality.sh
View File

@ -67,7 +67,7 @@ apply() {
ok "$PATTERN_COMMON is present in $FILE_COMMON"
else
warn "$PATTERN_COMMON is not present in $FILE_COMMON"
add_line_file_before_pattern $FILE_COMMON "password requisite pam_pwquality.so retry=3" "# pam-auth-update(8) for details."
add_line_file_before_pattern "$FILE_COMMON" "password requisite pam_pwquality.so retry=3" "# pam-auth-update(8) for details."
fi
for PW_OPT in $OPTIONS; do

12
bin/hardening/5.3.2_enable_lockout_failed_password.sh
View File

@ -30,13 +30,13 @@ audit() {
crit "$PACKAGE is not installed!"
else
ok "$PACKAGE is installed"
does_pattern_exist_in_file $FILE_AUTH "$PATTERN_AUTH"
does_pattern_exist_in_file "$FILE_AUTH" "$PATTERN_AUTH"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN_AUTH is present in $FILE_AUTH"
else
crit "$PATTERN_AUTH is not present in $FILE_AUTH"
fi
does_pattern_exist_in_file $FILE_ACCOUNT "$PATTERN_ACCOUNT"
does_pattern_exist_in_file "$FILE_ACCOUNT" "$PATTERN_ACCOUNT"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN_ACCOUNT is present in $FILE_ACCOUNT"
else
@ -54,19 +54,19 @@ apply() {
crit "$PACKAGE is absent, installing it"
apt_install "$PACKAGE"
fi
does_pattern_exist_in_file $FILE_AUTH "$PATTERN_AUTH"
does_pattern_exist_in_file "$FILE_AUTH" "$PATTERN_AUTH"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN_AUTH is present in $FILE_AUTH"
else
warn "$PATTERN_AUTH is not present in $FILE_AUTH, adding it"
add_line_file_before_pattern $FILE_AUTH "auth required pam_tally2.so onerr=fail audit silent deny=5 unlock_time=900" "# pam-auth-update(8) for details."
add_line_file_before_pattern "$FILE_AUTH" "auth required pam_tally2.so onerr=fail audit silent deny=5 unlock_time=900" "# pam-auth-update(8) for details."
fi
does_pattern_exist_in_file $FILE_ACCOUNT "$PATTERN_ACCOUNT"
does_pattern_exist_in_file "$FILE_ACCOUNT" "$PATTERN_ACCOUNT"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN_ACCOUNT is present in $FILE_ACCOUNT"
else
warn "$PATTERN_ACCOUNT is not present in $FILE_ACCOUNT, adding it"
add_line_file_before_pattern $FILE_ACCOUNT "account required pam_tally.so" "# pam-auth-update(8) for details."
add_line_file_before_pattern "$FILE_ACCOUNT" "account required pam_tally.so" "# pam-auth-update(8) for details."
fi
}

6
bin/hardening/5.3.3_limit_password_reuse.sh
View File

@ -28,7 +28,7 @@ audit() {
crit "$PACKAGE is not installed!"
else
ok "$PACKAGE is installed"
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
@ -46,12 +46,12 @@ apply() {
crit "$PACKAGE is absent, installing it"
apt_install "$PACKAGE"
fi
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
warn "$PATTERN is not present in $FILE, adding it"
add_line_file_before_pattern $FILE "password [success=1 default=ignore] pam_unix.so obscure sha512 remember=5" "# pam-auth-update(8) for details."
add_line_file_before_pattern "$FILE" "password [success=1 default=ignore] pam_unix.so obscure sha512 remember=5" "# pam-auth-update(8) for details."
fi
}

10
bin/hardening/5.3.4_acc_pam_sha512.sh
View File

@ -21,11 +21,11 @@ CONF_LINE="^\s*password\s.+\s+pam_unix\.so\s+.*sha512"
# This function will be called if the script status is on enabled / audit mode
audit() {
# Check conf file for default SHA512 hash
if $SUDO_CMD [ ! -r $CONF_FILE ]; then
if $SUDO_CMD [ ! -r "$CONF_FILE" ]; then
crit "$CONF_FILE is not readable"
else
# shellcheck disable=SC2001
does_pattern_exist_in_file $CONF_FILE "$(sed 's/ /[[:space:]]+/g' <<<"$CONF_LINE")"
does_pattern_exist_in_file "$CONF_FILE" "$(sed 's/ /[[:space:]]+/g' <<<"$CONF_LINE")"
if [ "$FNRET" = 0 ]; then
ok "$CONF_LINE is present in $CONF_FILE"
else
@ -36,16 +36,16 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
if $SUDO_CMD [ ! -r $CONF_FILE ]; then
if $SUDO_CMD [ ! -r "$CONF_FILE" ]; then
crit "$CONF_FILE is not readable"
else
# shellcheck disable=SC2001
does_pattern_exist_in_file $CONF_FILE "$(sed 's/ /[[:space:]]+/g' <<<"$CONF_LINE")"
does_pattern_exist_in_file "$CONF_FILE" "$(sed 's/ /[[:space:]]+/g' <<<"$CONF_LINE")"
if [ "$FNRET" = 0 ]; then
ok "$CONF_LINE is present in $CONF_FILE"
else
warn "$CONF_LINE is not present in $CONF_FILE"
add_line_file_before_pattern $CONF_FILE "password [success=1 default=ignore] pam_unix.so sha512" "# pam-auth-update(8) for details."
add_line_file_before_pattern "$CONF_FILE" "password [success=1 default=ignore] pam_unix.so sha512" "# pam-auth-update(8) for details."
fi
fi
}

2
bin/hardening/5.4.1.2_set_password_min_days_change.sh
View File

@ -60,7 +60,7 @@ apply() {
ok "$PATTERN is present in $FILE"
else
warn "$PATTERN is not present in $FILE, adding it"
does_pattern_exist_in_file $FILE "^${SHADOW_PARAM}"
does_pattern_exist_in_file "$FILE" "^${SHADOW_PARAM}"
if [ "$FNRET" != 0 ]; then
add_end_of_file "$FILE" "$SHADOW_PARAM $SHADOW_VALUE"
else

4
bin/hardening/5.4.1.3_set_password_exp_warning_days.sh
View File

@ -32,7 +32,7 @@ audit() {
SHADOW_PARAM=$(echo "$SHADOW_OPTION" | cut -d= -f 1)
SHADOW_VALUE=$(echo "$SHADOW_OPTION" | cut -d= -f 2)
PATTERN="^${SHADOW_PARAM}[[:space:]]*$SHADOW_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
@ -55,7 +55,7 @@ apply() {
SHADOW_PARAM=$(echo "$SHADOW_OPTION" | cut -d= -f 1)
SHADOW_VALUE=$(echo "$SHADOW_OPTION" | cut -d= -f 2)
PATTERN="^${SHADOW_PARAM}[[:space:]]*$SHADOW_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN"
does_pattern_exist_in_file "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else

4
bin/hardening/5.4.2_disable_system_accounts.sh
View File

@ -27,7 +27,7 @@ ACCEPTED_SHELLS_GREP=''
audit() {
shells_to_grep_helper
info "Checking if admin accounts have a login shell different than $ACCEPTED_SHELLS"
RESULT=$(grep -Ev "^\+" $FILE | awk -F: '($1!="root" && $1!="sync" && $1!="shutdown" && $1!="halt" && $3<1000 ) {print}' | grep -v $ACCEPTED_SHELLS_GREP || true)
RESULT=$(grep -Ev "^\+" "$FILE" | awk -F: '($1!="root" && $1!="sync" && $1!="shutdown" && $1!="halt" && $3<1000 ) {print}' | grep -v $ACCEPTED_SHELLS_GREP || true)
IFS_BAK=$IFS
IFS=$'\n'
for LINE in $RESULT; do
@ -55,7 +55,7 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
RESULT=$(grep -Ev "^\+" $FILE | awk -F: '($1!="root" && $1!="sync" && $1!="shutdown" && $1!="halt" && $3<1000 ) {print}' | grep -v $ACCEPTED_SHELLS_GREP || true)
RESULT=$(grep -Ev "^\+" "$FILE" | awk -F: '($1!="root" && $1!="sync" && $1!="shutdown" && $1!="halt" && $3<1000 ) {print}' | grep -v $ACCEPTED_SHELLS_GREP || true)
IFS_BAK=$IFS
IFS=$'\n'
for LINE in $RESULT; do

2
bin/hardening/6.1.10_find_world_writable_file.sh
View File

@ -25,7 +25,7 @@ audit() {
if [ -n "$RESULT" ]; then
crit "Some world writable files are present"
# shellcheck disable=SC2001
FORMATTED_RESULT=$(sed "s/ /\n/g" <<<$RESULT | sort | uniq | tr '\n' ' ')
FORMATTED_RESULT=$(sed "s/ /\n/g" <<<"$RESULT" | sort | uniq | tr '\n' ' ')
crit "$FORMATTED_RESULT"
else
ok "No world writable files found"

4
bin/hardening/6.1.11_find_unowned_files.sh
View File

@ -32,7 +32,7 @@ audit() {
if [ -n "$RESULT" ]; then
crit "Some unowned files are present"
# shellcheck disable=SC2001
FORMATTED_RESULT=$(sed "s/ /\n/g" <<<$RESULT | sort | uniq | tr '\n' ' ')
FORMATTED_RESULT=$(sed "s/ /\n/g" <<<"$RESULT" | sort | uniq | tr '\n' ' ')
crit "$FORMATTED_RESULT"
else
ok "No unowned files found"
@ -48,7 +48,7 @@ apply() {
fi
if [ -n "$RESULT" ]; then
warn "Applying chown on all unowned files in the system"
df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -nouser -print 2>/dev/null | xargs chown $USER
df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -nouser -print 2>/dev/null | xargs chown "$USER"
else
ok "No unowned files found, nothing to apply"
fi

2
bin/hardening/6.1.12_find_ungrouped_files.sh
View File

@ -48,7 +48,7 @@ apply() {
fi
if [ -n "$RESULT" ]; then
warn "Applying chgrp on all ungrouped files in the system"
df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -nogroup -print 2>/dev/null | xargs chgrp $GROUP
df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -nogroup -print 2>/dev/null | xargs chgrp "$GROUP"
else
ok "No ungrouped files found, nothing to apply"
fi

4
bin/hardening/6.2.3_remove_legacy_shadow_entries.sh
View File

@ -34,8 +34,8 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
if grep '^+:' $FILE -q; then
RESULT=$(grep '^+:' $FILE)
if grep '^+:' "$FILE" -q; then
RESULT=$(grep '^+:' "$FILE")
warn "Some accounts have a legacy password entry"
for LINE in $RESULT; do
info "Removing $LINE from $FILE"

10
bin/hardening/99.1_timeout_tty.sh
View File

@ -26,7 +26,7 @@ FILE='/etc/profile.d/CIS_99.1_timeout.sh'
audit() {
SEARCH_RES=0
for FILE_SEARCHED in $FILES_TO_SEARCH; do
if [ $SEARCH_RES = 1 ]; then break; fi
if [ "$SEARCH_RES" = 1 ]; then break; fi
if test -d "$FILE_SEARCHED"; then
debug "$FILE_SEARCHED is a directory"
# shellcheck disable=2044
@ -59,7 +59,7 @@ audit() {
apply() {
SEARCH_RES=0
for FILE_SEARCHED in $FILES_TO_SEARCH; do
if [ $SEARCH_RES = 1 ]; then break; fi
if [ "$SEARCH_RES" = 1 ]; then break; fi
if test -d "$FILE_SEARCHED"; then
debug "$FILE_SEARCHED is a directory"
# shellcheck disable=2044
@ -87,9 +87,9 @@ apply() {
warn "$PATTERN is not present in $FILES_TO_SEARCH"
touch "$FILE"
chmod 644 "$FILE"
add_end_of_file $FILE "$PATTERN$VALUE"
add_end_of_file $FILE "readonly TMOUT"
add_end_of_file $FILE "export TMOUT"
add_end_of_file "$FILE" "$PATTERN$VALUE"
add_end_of_file "$FILE" "readonly TMOUT"
add_end_of_file "$FILE" "export TMOUT"
else
ok "$PATTERN is present in $FILES_TO_SEARCH"
fi

10
bin/hardening/99.2_disable_usb_devices.sh
View File

@ -24,8 +24,8 @@ FILE='/etc/udev/rules.d/10-CIS_99.2_usb_devices.sh'
audit() {
SEARCH_RES=0
for FILE_SEARCHED in $FILES_TO_SEARCH; do
if [ $SEARCH_RES = 1 ]; then break; fi
if $SUDO_CMD test -d $FILE_SEARCHED; then
if [ "$SEARCH_RES" = 1 ]; then break; fi
if $SUDO_CMD test -d "$FILE_SEARCHED"; then
debug "$FILE_SEARCHED is a directory"
for file_in_dir in $($SUDO_CMD ls $FILE_SEARCHED); do
does_pattern_exist_in_file "$FILE_SEARCHED/$file_in_dir" "^$PATTERN"
@ -56,8 +56,8 @@ audit() {
apply() {
SEARCH_RES=0
for FILE_SEARCHED in $FILES_TO_SEARCH; do
if [ $SEARCH_RES = 1 ]; then break; fi
if test -d $FILE_SEARCHED; then
if [ "$SEARCH_RES" = 1 ]; then break; fi
if test -d "$FILE_SEARCHED"; then
debug "$FILE_SEARCHED is a directory"
for file_in_dir in $(ls $FILE_SEARCHED); do
does_pattern_exist_in_file "$FILE_SEARCHED/$file_in_dir" "^$PATTERN"
@ -83,7 +83,7 @@ apply() {
warn "$PATTERN is not present in $FILES_TO_SEARCH"
touch "$FILE"
chmod 644 "$FILE"
add_end_of_file $FILE '
add_end_of_file "$FILE" '
# By default, disable all.
ACTION=="add", SUBSYSTEMS=="usb", TEST=="authorized_default", ATTR{authorized_default}="0"

8
bin/hardening/99.3.4_acc_logindefs_sha512.sh
View File

@ -21,10 +21,10 @@ CONF_LINE="ENCRYPT_METHOD SHA512"
# This function will be called if the script status is on enabled / audit mode
audit() {
# Check conf file for default SHA512 hash
if $SUDO_CMD [ ! -r $CONF_FILE ]; then
if $SUDO_CMD [ ! -r "$CONF_FILE" ]; then
crit "$CONF_FILE is not readable"
else
does_pattern_exist_in_file $CONF_FILE "^ *${CONF_LINE/ /[[:space:]]+}"
does_pattern_exist_in_file "$CONF_FILE" "^ *${CONF_LINE/ /[[:space:]]+}"
if [ "$FNRET" = 0 ]; then
ok "$CONF_LINE is present in $CONF_FILE"
else
@ -35,14 +35,14 @@ audit() {
# This function will be called if the script status is on enabled mode
apply() {
does_pattern_exist_in_file $CONF_FILE "^ *${CONF_LINE/ /[[:space:]]+}"
does_pattern_exist_in_file "$CONF_FILE" "^ *${CONF_LINE/ /[[:space:]]+}"
if [ "$FNRET" = 0 ]; then
ok "$CONF_LINE is present in $CONF_FILE"
else
warn "$CONF_LINE is not present in $CONF_FILE, adding it"
does_pattern_exist_in_file "$CONF_FILE" "^$(echo "$CONF_LINE" | cut -d ' ' -f1)"
if [ "$FNRET" != 0 ]; then
add_end_of_file $CONF_FILE "$CONF_LINE"
add_end_of_file "$CONF_FILE" "$CONF_LINE"
else
info "Parameter $SSH_PARAM is present but with the wrong value -- Fixing"
replace_in_file "$CONF_FILE" "^$(echo "$CONF_LINE" | cut -d ' ' -f1)[[:space:]]*.*" "$CONF_LINE"

6
bin/hardening/99.5.1_ssh_auth_pubk_only.sh
View File

@ -32,7 +32,7 @@ audit() {
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]+$SSH_VALUE"
does_pattern_exist_in_file_nocase $FILE "$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
@ -60,9 +60,9 @@ apply() {
ok "$PATTERN is present in $FILE"
else
warn "$PATTERN is not present in $FILE, adding it"
does_pattern_exist_in_file_nocase $FILE "^${SSH_PARAM}"
does_pattern_exist_in_file_nocase "$FILE" "^${SSH_PARAM}"
if [ "$FNRET" != 0 ]; then
add_end_of_file $FILE "$SSH_PARAM $SSH_VALUE"
add_end_of_file "$FILE" "$SSH_PARAM $SSH_VALUE"
else
info "Parameter $SSH_PARAM is present but with the wrong value -- Fixing"
replace_in_file $FILE "^${SSH_PARAM}[[:space:]]+.*" "$SSH_PARAM $SSH_VALUE"

18
bin/hardening/99.5.2.3_ssh_cry_rekey.sh
View File

@ -44,10 +44,10 @@ audit() {
else
ok "$PACKAGE is installed"
for SSH_OPTION in $OPTIONS; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2)
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file_nocase $FILE "$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
@ -67,22 +67,22 @@ apply() {
apt_install "$PACKAGE"
fi
for SSH_OPTION in $OPTIONS; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2)
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file_nocase $FILE "$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
warn "$PATTERN is not present in $FILE, adding it"
does_pattern_exist_in_file_nocase $FILE "^${SSH_PARAM}"
does_pattern_exist_in_file_nocase "$FILE" "^${SSH_PARAM}"
if [ "$FNRET" != 0 ]; then
# shellcheck disable=SC2001
SSH_VALUE=$(sed 's/\\s+/ /' <<<"$SSH_VALUE")
add_end_of_file $FILE "$SSH_PARAM $SSH_VALUE"
add_end_of_file "$FILE" "$SSH_PARAM $SSH_VALUE"
else
info "Parameter $SSH_PARAM is present but with the wrong value -- Fixing"
replace_in_file $FILE "^${SSH_PARAM}[[:space:]]*.*" "$SSH_PARAM $SSH_VALUE"
replace_in_file "$FILE" "^${SSH_PARAM}[[:space:]]*.*" "$SSH_PARAM $SSH_VALUE"
fi
/etc/init.d/ssh reload >/dev/null 2>&1
fi

10
bin/hardening/99.5.3_ssh_disable_features.sh
View File

@ -31,7 +31,7 @@ audit() {
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file_nocase $FILE "$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
@ -54,17 +54,17 @@ apply() {
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file_nocase $FILE "$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
warn "$PATTERN is not present in $FILE, adding it"
does_pattern_exist_in_file_nocase $FILE "^${SSH_PARAM}"
does_pattern_exist_in_file_nocase "$FILE" "^${SSH_PARAM}"
if [ "$FNRET" != 0 ]; then
add_end_of_file $FILE "$SSH_PARAM $SSH_VALUE"
add_end_of_file "$FILE" "$SSH_PARAM $SSH_VALUE"
else
info "Parameter $SSH_PARAM is present but with the wrong value -- Fixing"
replace_in_file $FILE "^${SSH_PARAM}[[:space:]]*.*" "$SSH_PARAM $SSH_VALUE"
replace_in_file "$FILE" "^${SSH_PARAM}[[:space:]]*.*" "$SSH_PARAM $SSH_VALUE"
fi
/etc/init.d/ssh reload >/dev/null 2>&1
fi

8
bin/hardening/99.5.4_ssh_keys_from.sh
View File

@ -55,13 +55,13 @@ check_ip() {
ok_ips=$(sed 's/ $//' <<<"${ok_ips_allowed}")
# shellcheck disable=SC2001
bad_ips=$(sed 's/ $//' <<<"${bad_ips}")
if [[ -z $bad_ips ]]; then
if [[ -n $ok_ips ]]; then
if [[ -z "$bad_ips" ]]; then
if [[ -n "$ok_ips" ]]; then
ok "Line $linum of $file allows ssh access only from allowed IPs ($ok_ips)."
fi
else
crit "Line $linum of $file allows ssh access from (${bad_ips}) that are not allowed."
if [[ -n $ok_ips ]]; then
if [[ -n "$ok_ips" ]]; then
ok "Line $linum of $file allows ssh access from at least allowed IPs ($ok_ips)."
fi
fi
@ -143,7 +143,7 @@ audit() {
continue
fi
check_dir /home/"${user}"
if [ $FOUND_AUTHKF = 0 ]; then
if [ "$FOUND_AUTHKF" = 0 ]; then
warn "$user has a valid shell but no authorized_keys file"
fi
fi

16
bin/hardening/99.5.5_ssh_strict_modes.sh
View File

@ -27,10 +27,10 @@ audit() {
else
ok "$PACKAGE is installed"
for SSH_OPTION in $OPTIONS; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2)
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file_nocase $FILE "$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
@ -50,20 +50,20 @@ apply() {
apt_install "$PACKAGE"
fi
for SSH_OPTION in $OPTIONS; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2)
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file_nocase $FILE "$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
warn "$PATTERN is not present in $FILE, adding it"
does_pattern_exist_in_file_nocase $FILE "^${SSH_PARAM}"
if [ "$FNRET" != 0 ]; then
add_end_of_file $FILE "$SSH_PARAM $SSH_VALUE"
add_end_of_file "$FILE" "$SSH_PARAM $SSH_VALUE"
else
info "Parameter $SSH_PARAM is present but with the wrong value -- Fixing"
replace_in_file $FILE "^${SSH_PARAM}[[:space:]]*.*" "$SSH_PARAM $SSH_VALUE"
replace_in_file "$FILE" "^${SSH_PARAM}[[:space:]]*.*" "$SSH_PARAM $SSH_VALUE"
fi
/etc/init.d/ssh reload >/dev/null 2>&1
fi

10
bin/hardening/99.5.6_ssh_sys_accept_env.sh
View File

@ -28,7 +28,7 @@ audit() {
crit "$PACKAGE is not installed!"
else
ok "$PACKAGE is installed"
does_pattern_exist_in_file_nocase $FILE "$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
@ -46,19 +46,19 @@ apply() {
crit "$PACKAGE is absent, installing it"
apt_install "$PACKAGE"
fi
does_pattern_exist_in_file_nocase $FILE "$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
warn "$PATTERN is not present in $FILE, adding it"
does_pattern_exist_in_file_nocase $FILE "^$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "^$PATTERN"
# shellcheck disable=SC2001
PATTERN=$(sed 's/\^//' <<<"$PATTERN" | sed -r 's/\\s\*//' | sed -r 's/\\s\+/ /g' | sed 's/\\//g')
if [ "$FNRET" != 0 ]; then
add_end_of_file $FILE "$PATTERN"
add_end_of_file "$FILE" "$PATTERN"
else
info "Parameter $SSH_PARAM is present but with the wrong value -- Fixing"
replace_in_file $FILE "^${SSH_PARAM}[[:space:]]*.*" "$PATTERN"
replace_in_file "$FILE" "^${SSH_PARAM}[[:space:]]*.*" "$PATTERN"
fi
/etc/init.d/ssh reload >/dev/null 2>&1
fi

18
bin/hardening/99.5.8_ssh_sys_sandbox.sh
View File

@ -29,10 +29,10 @@ audit() {
else
ok "$PACKAGE is installed"
for SSH_OPTION in $OPTIONS; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2)
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file_nocase $FILE "$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
@ -52,20 +52,20 @@ apply() {
apt_install "$PACKAGE"
fi
for SSH_OPTION in $OPTIONS; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2)
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file_nocase $FILE "$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
warn "$PATTERN is not present in $FILE, adding it"
does_pattern_exist_in_file_nocase $FILE "^${SSH_PARAM}"
does_pattern_exist_in_file_nocase "$FILE" "^${SSH_PARAM}"
if [ "$FNRET" != 0 ]; then
add_end_of_file $FILE "$SSH_PARAM $SSH_VALUE"
add_end_of_file "$FILE" "$SSH_PARAM $SSH_VALUE"
else
info "Parameter $SSH_PARAM is present but with the wrong value -- Fixing"
replace_in_file $FILE "^${SSH_PARAM}[[:space:]]*.*" "$SSH_PARAM $SSH_VALUE"
replace_in_file "$FILE" "^${SSH_PARAM}[[:space:]]*.*" "$SSH_PARAM $SSH_VALUE"
fi
/etc/init.d/ssh reload >/dev/null 2>&1
fi

18
bin/hardening/99.5.9_ssh_loglevel.sh
View File

@ -29,10 +29,10 @@ audit() {
else
ok "$PACKAGE is installed"
for SSH_OPTION in $OPTIONS; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2)
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file_nocase $FILE "$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
@ -52,20 +52,20 @@ apply() {
apt_install "$PACKAGE"
fi
for SSH_OPTION in $OPTIONS; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2)
SSH_PARAM=$(echo "$SSH_OPTION" | cut -d= -f 1)
SSH_VALUE=$(echo "$SSH_OPTION" | cut -d= -f 2)
PATTERN="^${SSH_PARAM}[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file_nocase $FILE "$PATTERN"
does_pattern_exist_in_file_nocase "$FILE" "$PATTERN"
if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE"
else
warn "$PATTERN is not present in $FILE, adding it"
does_pattern_exist_in_file_nocase $FILE "^${SSH_PARAM}"
does_pattern_exist_in_file_nocase "$FILE" "^${SSH_PARAM}"
if [ "$FNRET" != 0 ]; then
add_end_of_file $FILE "$SSH_PARAM $SSH_VALUE"
add_end_of_file "$FILE" "$SSH_PARAM $SSH_VALUE"
else
info "Parameter $SSH_PARAM is present but with the wrong value -- Fixing"
replace_in_file $FILE "^${SSH_PARAM}[[:space:]]*.*" "$SSH_PARAM $SSH_VALUE"
replace_in_file "$FILE" "^${SSH_PARAM}[[:space:]]*.*" "$SSH_PARAM $SSH_VALUE"
fi
/etc/init.d/ssh reload >/dev/null 2>&1
fi

6
lib/common.sh
View File

@ -70,7 +70,7 @@ crit() {
if [ "${BATCH_MODE:-0}" -eq 1 ]; then
BATCH_OUTPUT="$BATCH_OUTPUT KO{$*}"
else
if [ $MACHINE_LOG_LEVEL -ge 1 ]; then _logger "$BRED" "[ KO ] $*"; fi
if [ "$MACHINE_LOG_LEVEL" -ge 1 ]; then _logger "$BRED" "[ KO ] $*"; fi
fi
# This variable incrementation is used to measure failure or success in tests
CRITICAL_ERRORS_NUMBER=$((CRITICAL_ERRORS_NUMBER + 1))
@ -80,7 +80,7 @@ warn() {
if [ "${BATCH_MODE:-0}" -eq 1 ]; then
BATCH_OUTPUT="$BATCH_OUTPUT WARN{$*}"
else
if [ $MACHINE_LOG_LEVEL -ge 2 ]; then _logger "$BYELLOW" "[WARN] $*"; fi
if [ "$MACHINE_LOG_LEVEL" -ge 2 ]; then _logger "$BYELLOW" "[WARN] $*"; fi
fi
}
@ -88,7 +88,7 @@ ok() {
if [ "${BATCH_MODE:-0}" -eq 1 ]; then
BATCH_OUTPUT="$BATCH_OUTPUT OK{$*}"
else
if [ $MACHINE_LOG_LEVEL -ge 3 ]; then _logger "$BGREEN" "[ OK ] $*"; fi
if [ "$MACHINE_LOG_LEVEL" -ge 3 ]; then _logger "$BGREEN" "[ OK ] $*"; fi
fi
}

2
lib/main.sh
View File

@ -128,7 +128,7 @@ disabled | false)
esac
if [ "$CRITICAL_ERRORS_NUMBER" -eq 0 ]; then
if [ $BATCH_MODE -eq 1 ]; then
if [ "$BATCH_MODE" -eq 1 ]; then
BATCH_OUTPUT="OK $SCRIPT_NAME $BATCH_OUTPUT"
becho "$BATCH_OUTPUT"
else

10
lib/utils.sh
View File

@ -13,7 +13,7 @@ has_sysctl_param_expected_result() {
if [ "$($SUDO_CMD sysctl "$SYSCTL_PARAM" 2>/dev/null)" = "$SYSCTL_PARAM = $EXP_RESULT" ]; then
FNRET=0
elif [ $? = 255 ]; then
elif [ "$?" = 255 ]; then
debug "$SYSCTL_PARAM does not exist"
FNRET=255
else
@ -147,7 +147,7 @@ does_pattern_exist_in_file_multiline() {
debug "Checking if multiline pattern: $PATTERN is present in $FILE"
if $SUDO_CMD [ -r "$FILE" ]; then
debug "$SUDO_CMD grep -v '^[[:space:]]*#' $FILE | tr '\n' ' ' | grep -Pq -- "$PATTERN""
debug "$SUDO_CMD grep -v '^[[:space:]]*#' $FILE | tr '\n' ' ' | grep -Pq -- $PATTERN"
if $SUDO_CMD grep -v '^[[:space:]]*#' "$FILE" | tr '\n' ' ' | grep -Pq -- "$PATTERN"; then
debug "Pattern found in $FILE"
FNRET=0
@ -239,7 +239,7 @@ does_group_exist() {
is_service_enabled() {
local SERVICE=$1
if [ $($SUDO_CMD find /etc/rc?.d/ -name "S*$SERVICE" -print | wc -l) -gt 0 ]; then
if [ "$($SUDO_CMD find /etc/rc?.d/ -name "S*$SERVICE" -print | wc -l)" -gt 0 ]; then
debug "Service $SERVICE is enabled"
FNRET=0
else
@ -385,7 +385,7 @@ apt_update_if_needed() {
if [ -e /var/cache/apt/pkgcache.bin ]; then
UPDATE_AGE=$(($(date +%s) - $(stat -c '%Y' /var/cache/apt/pkgcache.bin)))
if [ $UPDATE_AGE -gt 21600 ]; then
if [ "$UPDATE_AGE" -gt 21600 ]; then
# update too old, refresh database
$SUDO_CMD apt-get update -y >/dev/null 2>/dev/null
fi
@ -438,7 +438,7 @@ is_pkg_installed() {
get_debian_major_version() {
DEB_MAJ_VER=""
does_file_exist /etc/debian_version
if [ $FNRET ]; then
if [ "$FNRET" = 0 ]; then
DEB_MAJ_VER=$(cut -d '.' -f1 /etc/debian_version)
else
# shellcheck disable=2034

2
shellcheck/launch_shellcheck.sh
View File

@ -5,7 +5,7 @@
files=""
retval=0
if [ $# -eq 0 ]; then
if [ "$#" -eq 0 ]; then
files=$(find . -name "*.sh" | sort -V)
else
files="$*"