diff --git a/bin/hardening/13.13_check_user_homedir_ownership.sh b/bin/hardening/13.13_check_user_homedir_ownership.sh deleted file mode 100755 index 2812b8b..0000000 --- a/bin/hardening/13.13_check_user_homedir_ownership.sh +++ /dev/null @@ -1,99 +0,0 @@ -#!/bin/bash - -# run-shellcheck -# -# CIS Debian Hardening -# - -# -# 13.13 Check User Home Directory Ownership (Scored) -# - -set -e # One error, it's over -set -u # One variable unset, it's over - -# shellcheck disable=2034 -HARDENING_LEVEL=2 -# shellcheck disable=2034 -DESCRIPTION="Check user home directory ownership." -EXCEPTIONS="" - -ERRORS=0 - -# This function will be called if the script status is on enabled / audit mode -audit () { - RESULT=$(awk -F: '{ print $1 ":" $3 ":" $6 }' /etc/passwd ) - for LINE in $RESULT; do - debug "Working on $LINE" - USER=$(awk -F: '{print $1}' <<< "$LINE") - USERID=$(awk -F: '{print $2}' <<< "$LINE") - DIR=$(awk -F: '{print $3}' <<< "$LINE") - if [ "$USERID" -ge 500 ] && [ -d "$DIR" ] && [ "$USER" != "nfsnobody" ]; then - OWNER=$(stat -L -c "%U" "$DIR") - if [ "$OWNER" != "$USER" ]; then - EXCEP_FOUND=0 - for excep in $EXCEPTIONS; do - if [ "$DIR:$USER:$OWNER" = "$excep" ]; then - ok "The home directory ($DIR) of user $USER is owned by $OWNER but is part of exceptions ($DIR:$USER:$OWNER)." - EXCEP_FOUND=1 - break - fi - done - if [ "$EXCEP_FOUND" -eq 0 ]; then - crit "The home directory ($DIR) of user $USER is owned by $OWNER." - ERRORS=$((ERRORS+1)) - fi - fi - fi - done - - if [ $ERRORS = 0 ]; then - ok "All home directories have correct ownership" - fi -} - -# This function will be called if the script status is on enabled mode -apply () { - awk -F: '{ print $1 " " $3 " " $6 }' /etc/passwd | while read -r USER USERID DIR; do - if [ "$USERID" -ge 500 ] && [ -d "$DIR" ] && [ "$USER" != "nfsnobody" ]; then - OWNER=$(stat -L -c "%U" "$DIR") - if [ "$OWNER" != "$USER" ]; then - warn "The home directory ($DIR) of user $USER is owned by $OWNER." - chown "$USER" "$DIR" - fi - fi - done -} - -# This function will create the config file for this check with default values -create_config() { - cat <> /opt/debian-cis/etc/conf.d/"${script}".cfg - sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg - - describe Added exceptions - register_test retvalshouldbe 0 - run exceptions /opt/debian-cis/bin/hardening/"${script}".sh --audit-all - - # Cleanup - userdel testhomeuser -} diff --git a/tests/hardening/6.2.9_users_valid_homedir.sh b/tests/hardening/6.2.9_users_valid_homedir.sh index b333419..4ff8de4 100644 --- a/tests/hardening/6.2.9_users_valid_homedir.sh +++ b/tests/hardening/6.2.9_users_valid_homedir.sh @@ -2,9 +2,23 @@ test_audit() { describe Running on blank host register_test retvalshouldbe 0 - dismiss_count_for_test # shellcheck disable=2154 run blank /opt/debian-cis/bin/hardening/"${script}".sh --audit-all - # TODO fill comprehensive tests + useradd -m testhomeuser + chown root:root /home/testhomeuser + + describe Wrong home owner + register_test retvalshouldbe 1 + run wronghomeowner /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + echo "EXCEPTIONS=\"/home/testhomeuser:testhomeuser:root\"" >> /opt/debian-cis/etc/conf.d/"${script}".cfg + sed -i 's/audit/enabled/' /opt/debian-cis/etc/conf.d/"${script}".cfg + + describe Added exceptions + register_test retvalshouldbe 0 + run exceptions /opt/debian-cis/bin/hardening/"${script}".sh --audit-all + + # Cleanup + userdel testhomeuser }