elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-12-22 14:05:23 +01:00
Code Issues Packages Projects Releases Wiki Activity

13.16_check_duplicate_username.sh 13.17_check_duplicate_groupname.sh 13.18_find_user_netrc_files.sh 13.19_find_user_forward_files.sh 13.20_shadow_group_empty.sh

Browse Source
This commit is contained in:
thibault.dewailly 2016-04-17 22:30:20 +02:00
parent dbeca2fba3
commit f829cdacf2
12 changed files with 312 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
bin/hardening/13.10_find_user_rhosts_files.sh
View File

@ -13,12 +13,13 @@ set -e # One error, it's over
set -u # One variable unset, it's over
ERRORS=0
FILENAME=".rhosts"
# This function will be called if the script status is on enabled / audit mode
audit () {
for DIR in $(cat /etc/passwd | egrep -v '(root|halt|sync|shutdown)' | awk -F: '($7 != "/usr/sbin/nologin" && $7 != "/bin/false" && $7 !="/nonexistent" ) { print $6 }'); do
debug "Working on $DIR"
for FILE in $DIR/.rhosts; do
for FILE in $DIR/$FILENAME; do
if [ ! -h "$FILE" -a -f "$FILE" ]; then
crit "$FILE present"
ERRORS=$((ERRORS+1))
@ -27,7 +28,7 @@ audit () {
done
if [ $ERRORS = 0 ]; then
ok "No .rhosts present in users files"
ok "No $FILENAME present in users files"
fi
}

4
bin/hardening/13.15_check_duplicate_gid.sh
View File

@ -24,12 +24,12 @@ audit () {
if [ $OCC_NUMBER -gt 1 ]; then
USERS=$(awk -F: '($3 == n) { print $1 }' n=$GROUPID /etc/passwd | xargs)
ERRORS=$((ERRORS+1))
crit "Duplicate UID ($GROUPID): ${USERS}"
crit "Duplicate GID ($GROUPID): ${USERS}"
fi
done
if [ $ERRORS = 0 ]; then
ok "No duplicate GIDss"
ok "No duplicate GIDs"
fi
}

58
bin/hardening/13.16_check_duplicate_username.sh Executable file
View File

@ -0,0 +1,58 @@
#!/bin/bash
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#
# 13.16 Check for Duplicate User Names (Scored)
#
set -e # One error, it's over
set -u # One variable unset, it's over
ERRORS=0
# This function will be called if the script status is on enabled / audit mode
audit () {
RESULT=$(cat /etc/passwd | cut -f1 -d":" | sort -n | uniq -c | awk {'print $1":"$2'} )
for LINE in $RESULT; do
debug "Working on line $LINE"
OCC_NUMBER=$(awk -F: {'print $1'} <<< $LINE)
USERNAME=$(awk -F: {'print $2'} <<< $LINE)
if [ $OCC_NUMBER -gt 1 ]; then
USERS=$(awk -F: '($3 == n) { print $1 }' n=$USERNAME /etc/passwd | xargs)
ERRORS=$((ERRORS+1))
crit "Duplicate username $USERNAME"
fi
done
if [ $ERRORS = 0 ]; then
ok "No duplicate usernames"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
info "Editing automatically username may seriously harm your system, report only here"
}
# This function will check config parameters required
check_config() {
:
}
# Source Root Dir Parameter
if [ ! -r /etc/default/cis-hardenning ]; then
echo "There is no /etc/default/cis-hardenning FILE, cannot source CIS_ROOT_DIR variable, aborting"
exit 128
else
. /etc/default/cis-hardenning
if [ -z $CIS_ROOT_DIR ]; then
echo "No CIS_ROOT_DIR variable, aborting"
fi
fi
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

58
bin/hardening/13.17_check_duplicate_groupname.sh Executable file
View File

@ -0,0 +1,58 @@
#!/bin/bash
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#
# 13.17 Check for Duplicate Group Names (Scored)
#
set -e # One error, it's over
set -u # One variable unset, it's over
ERRORS=0
# This function will be called if the script status is on enabled / audit mode
audit () {
RESULT=$(cat /etc/group | cut -f1 -d":" | sort -n | uniq -c | awk {'print $1":"$2'} )
for LINE in $RESULT; do
debug "Working on line $LINE"
OCC_NUMBER=$(awk -F: {'print $1'} <<< $LINE)
GROUPNAME=$(awk -F: {'print $2'} <<< $LINE)
if [ $OCC_NUMBER -gt 1 ]; then
USERS=$(awk -F: '($3 == n) { print $1 }' n=$GROUPNAME /etc/passwd | xargs)
ERRORS=$((ERRORS+1))
crit "Duplicate groupname $GROUPNAME"
fi
done
if [ $ERRORS = 0 ]; then
ok "No duplicate groupnames"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
info "Editing automatically groupname may seriously harm your system, report only here"
}
# This function will check config parameters required
check_config() {
:
}
# Source Root Dir Parameter
if [ ! -r /etc/default/cis-hardenning ]; then
echo "There is no /etc/default/cis-hardenning FILE, cannot source CIS_ROOT_DIR variable, aborting"
exit 128
else
. /etc/default/cis-hardenning
if [ -z $CIS_ROOT_DIR ]; then
echo "No CIS_ROOT_DIR variable, aborting"
fi
fi
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

57
bin/hardening/13.18_find_user_netrc_files.sh Executable file
View File

@ -0,0 +1,57 @@
#!/bin/bash
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#
# 13.18 Check for Presence of User .netrc Files (Scored)
#
set -e # One error, it's over
set -u # One variable unset, it's over
ERRORS=0
FILENAME='.netrc'
# This function will be called if the script status is on enabled / audit mode
audit () {
for DIR in $(cat /etc/passwd | egrep -v '(root|halt|sync|shutdown)' | awk -F: '($7 != "/usr/sbin/nologin" && $7 != "/bin/false" && $7 !="/nonexistent" ) { print $6 }'); do
debug "Working on $DIR"
for FILE in $DIR/$FILENAME; do
if [ ! -h "$FILE" -a -f "$FILE" ]; then
crit "$FILE present"
ERRORS=$((ERRORS+1))
fi
done
done
if [ $ERRORS = 0 ]; then
ok "No $FILENAME present in users files"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
info "If the audit returns something, please check with the user why he has this file"
}
# This function will check config parameters required
check_config() {
:
}
# Source Root Dir Parameter
if [ ! -r /etc/default/cis-hardenning ]; then
echo "There is no /etc/default/cis-hardenning FILE, cannot source CIS_ROOT_DIR variable, aborting"
exit 128
else
. /etc/default/cis-hardenning
if [ -z $CIS_ROOT_DIR ]; then
echo "No CIS_ROOT_DIR variable, aborting"
fi
fi
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

57
bin/hardening/13.19_find_user_forward_files.sh Executable file
View File

@ -0,0 +1,57 @@
#!/bin/bash
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#
# 13.18 Check for Presence of User .netrc Files (Scored)
#
set -e # One error, it's over
set -u # One variable unset, it's over
ERRORS=0
FILENAME='.forward'
# This function will be called if the script status is on enabled / audit mode
audit () {
for DIR in $(cat /etc/passwd | egrep -v '(root|halt|sync|shutdown)' | awk -F: '($7 != "/usr/sbin/nologin" && $7 != "/bin/false" && $7 !="/nonexistent" ) { print $6 }'); do
debug "Working on $DIR"
for FILE in $DIR/$FILENAME; do
if [ ! -h "$FILE" -a -f "$FILE" ]; then
crit "$FILE present"
ERRORS=$((ERRORS+1))
fi
done
done
if [ $ERRORS = 0 ]; then
ok "No $FILENAME present in users files"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
info "If the audit returns something, please check with the user why he has this file"
}
# This function will check config parameters required
check_config() {
:
}
# Source Root Dir Parameter
if [ ! -r /etc/default/cis-hardenning ]; then
echo "There is no /etc/default/cis-hardenning FILE, cannot source CIS_ROOT_DIR variable, aborting"
exit 128
else
. /etc/default/cis-hardenning
if [ -z $CIS_ROOT_DIR ]; then
echo "No CIS_ROOT_DIR variable, aborting"
fi
fi
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

67
bin/hardening/13.20_shadow_group_empty.sh Executable file
View File

@ -0,0 +1,67 @@
#!/bin/bash
#
# CIS Debian 7 Hardening
# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
#
#
# 13.18 Check for Presence of User .netrc Files (Scored)
#
set -e # One error, it's over
set -u # One variable unset, it's over
ERRORS=0
FILEGROUP='/etc/group'
PATTERN='^shadow:x:[[:digit:]]+:'
# This function will be called if the script status is on enabled / audit mode
audit () {
does_pattern_exists_in_file $FILEGROUP $PATTERN
if [ $FNRET = 0 ]; then
info "shadow group exists"
RESULT=$(grep -E "$PATTERN" $FILEGROUP | cut -d: -f4)
GROUPID=$(getent group shadow | cut -d: -f3)
debug "$RESULT $GROUPID"
if [ ! -z "$RESULT" ]; then
crit "Some user belong to shadow group : $RESULT"
else
ok "No one belongs to shadow group"
fi
info "Checking if a user has $GROUPID as primary group"
RESULT=$(awk -F: '($4 == shadowid) { print $1 }' shadowid=$GROUPID /etc/passwd)
if [ ! -z "$RESULT" ]; then
crit "Some user have shadow id to their primary group : $RESULT"
else
ok "No one have shadow id to their primary group"
fi
else
crit "shadow group doesn't exist"
fi
}
# This function will be called if the script status is on enabled mode
apply () {
info "If the audit returns something, please check with the user why he has this file"
}
# This function will check config parameters required
check_config() {
:
}
# Source Root Dir Parameter
if [ ! -r /etc/default/cis-hardenning ]; then
echo "There is no /etc/default/cis-hardenning FILE, cannot source CIS_ROOT_DIR variable, aborting"
exit 128
else
. /etc/default/cis-hardenning
if [ -z $CIS_ROOT_DIR ]; then
echo "No CIS_ROOT_DIR variable, aborting"
fi
fi
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

2
etc/conf.d/13.16_check_duplicate_username.cfg Normal file
View File

@ -0,0 +1,2 @@
# Configuration for script of same name
status=enabled

2
etc/conf.d/13.17_check_duplicate_groupname.cfg Normal file
View File

@ -0,0 +1,2 @@
# Configuration for script of same name
status=enabled

2
etc/conf.d/13.18_find_user_netrc_files.cfg Normal file
View File

@ -0,0 +1,2 @@
# Configuration for script of same name
status=enabled

2
etc/conf.d/13.19_find_user_forward_files.cfg Normal file
View File

@ -0,0 +1,2 @@
# Configuration for script of same name
status=enabled

2
etc/conf.d/13.20_shadow_group_empty.cfg Normal file
View File

@ -0,0 +1,2 @@
# Configuration for script of same name
status=enabled