elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-11-22 13:37:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

IMP(9.3.2): Comply with Debian9 guide: verbose ssh loglevel

Browse Source
This commit is contained in:
Charles Herlin 2019-02-25 15:16:02 +01:00
parent 43c1dcf85b
commit e7d9977afb
2 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
bin/hardening/9.3.2_sshd_loglevel.sh
View File

@ -19,6 +19,7 @@ DESCRIPTION="Set LogLevel to INFO for SSH."
PACKAGE='openssh-server' PACKAGE='openssh-server'
OPTIONS='' OPTIONS=''
OPTIONS_TO_APPLY=''
FILE='/etc/ssh/sshd_config' FILE='/etc/ssh/sshd_config'
# This function will be called if the script status is on enabled / audit mode # This function will be called if the script status is on enabled / audit mode
@ -32,7 +33,7 @@ audit () {
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1) SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2) SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2)
PATTERN="^$SSH_PARAM[[:space:]]*$SSH_VALUE" PATTERN="^$SSH_PARAM[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN" does_pattern_exist_in_file_nocase $FILE "$PATTERN"
if [ "$FNRET" = 0 ]; then if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
else else
@ -51,11 +52,11 @@ apply () {
crit "$PACKAGE is absent, installing it" crit "$PACKAGE is absent, installing it"
apt_install $PACKAGE apt_install $PACKAGE
fi fi
for SSH_OPTION in $OPTIONS; do for SSH_OPTION in $OPTIONS_TO_APPLY; do
SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1) SSH_PARAM=$(echo $SSH_OPTION | cut -d= -f 1)
SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2) SSH_VALUE=$(echo $SSH_OPTION | cut -d= -f 2)
PATTERN="^$SSH_PARAM[[:space:]]*$SSH_VALUE" PATTERN="^$SSH_PARAM[[:space:]]*$SSH_VALUE"
does_pattern_exist_in_file $FILE "$PATTERN" does_pattern_exist_in_file_nocase $FILE "$PATTERN"
if [ "$FNRET" = 0 ]; then if [ "$FNRET" = 0 ]; then
ok "$PATTERN is present in $FILE" ok "$PATTERN is present in $FILE"
else else
@ -78,7 +79,8 @@ create_config() {
# shellcheck disable=2034 # shellcheck disable=2034
status=audit status=audit
# Put here your loglevel for ssh # Put here your loglevel for ssh
OPTIONS='LogLevel=INFO' OPTIONS='LogLevel=(INFO|VERBOSE)'
OPTIONS_TO_APPLY='LogLevel=VERBOSE'
EOF EOF
} }

2
tests/hardening/9.3.2_sshd_loglevel.sh
View File

@ -14,7 +14,7 @@ test_audit() {
run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
echo "OPTIONS='LogLevel=DEBUG'" >> /opt/debian-cis/etc/conf.d/"${script}".cfg echo "OPTIONS='LogLevel=DEBUG'" >> /opt/debian-cis/etc/conf.d/"${script}".cfg
sed -i 's/LogLevel INFO/LogLevel DEBUG/' /etc/ssh/sshd_config sed -i 's/LogLevel VERBOSE/LogLevel DEBUG/' /etc/ssh/sshd_config
describe Checking custom conf describe Checking custom conf
register_test retvalshouldbe 0 register_test retvalshouldbe 0