diff --git a/bin/hardening/configure_systemd-timesyncd.sh b/bin/hardening/configure_systemd-timesyncd.sh index 9a71aca..af63d12 100755 --- a/bin/hardening/configure_systemd-timesyncd.sh +++ b/bin/hardening/configure_systemd-timesyncd.sh @@ -21,8 +21,8 @@ SERVICE_NAME="systemd-timesyncd" # This function will be called if the script status is on enabled / audit mode audit() { - status=$(systemctl is-enabled "$SERVICE_NAME") - if [ "$status" = "enabled" ]; then + is_service_enabled "$SERVICE_NAME" + if [ "$FNRET" -eq 0 ]; then ok "$SERVICE_NAME is enabled" else crit "$SERVICE_NAME is disabled" diff --git a/bin/hardening/disable_automounting.sh b/bin/hardening/disable_automounting.sh index 20082bc..66918ee 100755 --- a/bin/hardening/disable_automounting.sh +++ b/bin/hardening/disable_automounting.sh @@ -36,7 +36,7 @@ apply() { is_service_enabled "$SERVICE_NAME" if [ "$FNRET" = 0 ]; then info "Disabling $SERVICE_NAME" - update-rc.d "$SERVICE_NAME" remove >/dev/null 2>&1 + manage_service disable "$SERVICE_NAME" else ok "$SERVICE_NAME is disabled" fi diff --git a/bin/hardening/enable_auditd.sh b/bin/hardening/enable_auditd.sh index 2f9df99..51c1d12 100755 --- a/bin/hardening/enable_auditd.sh +++ b/bin/hardening/enable_auditd.sh @@ -50,8 +50,7 @@ apply() { ok "$SERVICE_NAME is enabled" else warn "$SERVICE_NAME is not enabled, enabling it" - update-rc.d "$SERVICE_NAME" remove >/dev/null 2>&1 - update-rc.d "$SERVICE_NAME" defaults >/dev/null 2>&1 + manage_service enable "$SERVICE_NAME" fi } diff --git a/bin/hardening/enable_cron.sh b/bin/hardening/enable_cron.sh index 37d1c97..a417c3b 100755 --- a/bin/hardening/enable_cron.sh +++ b/bin/hardening/enable_cron.sh @@ -47,8 +47,7 @@ apply() { is_service_enabled "$SERVICE_NAME" if [ "$FNRET" != 0 ]; then info "Enabling $SERVICE_NAME" - update-rc.d "$SERVICE_NAME" remove >/dev/null 2>&1 - update-rc.d "$SERVICE_NAME" defaults >/dev/null 2>&1 + manage_service enable "$SERVICE_NAME" else ok "$SERVICE_NAME is enabled" fi diff --git a/bin/hardening/enable_syslog-ng.sh b/bin/hardening/enable_syslog-ng.sh index 3800458..71feeb8 100755 --- a/bin/hardening/enable_syslog-ng.sh +++ b/bin/hardening/enable_syslog-ng.sh @@ -46,8 +46,7 @@ apply() { is_service_enabled "$SERVICE_NAME" if [ "$FNRET" != 0 ]; then info "Enabling $SERVICE_NAME" - update-rc.d "$SERVICE_NAME" remove >/dev/null 2>&1 - update-rc.d "$SERVICE_NAME" defaults >/dev/null 2>&1 + manage_service enable "$SERVICE_NAME" >/dev/null 2>&1 else ok "$SERVICE_NAME is enabled" fi diff --git a/tests/hardening/enable_auditd.sh b/tests/hardening/enable_auditd.sh index 421b1ce..32f0822 100644 --- a/tests/hardening/enable_auditd.sh +++ b/tests/hardening/enable_auditd.sh @@ -1,9 +1,11 @@ # shellcheck shell=bash # run-shellcheck test_audit() { + describe Prepare failing test + apt remove -y auditd + describe Running on blank host - register_test retvalshouldbe 0 - dismiss_count_for_test + register_test retvalshouldbe 1 # shellcheck disable=2154 run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all @@ -12,7 +14,8 @@ test_audit() { "${CIS_CHECKS_DIR}/${script}.sh" || true describe Checking resolved state - register_test retvalshouldbe 0 - register_test contain "[ OK ] auditd is enabled" + # service still wont be enabled due to tests running inside a docker container + register_test retvalshouldbe 1 + register_test contain "[ OK ] auditd is installed" run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all }