13.16_check_duplicate_username.sh 13.17_check_duplicate_groupname.sh 13.18_find_user_netrc_files.sh 13.19_find_user_forward_files.sh 13.20_shadow_group_empty.sh

bin/hardening/13.10_find_user_rhosts_files.sh

@@ -13,12 +13,13 @@ set -e # One error, it's over
 set -u # One variable unset, it's over
 
 ERRORS=0
+FILENAME=".rhosts"
 
 # This function will be called if the script status is on enabled / audit mode
 audit () {
     for DIR in $(cat /etc/passwd | egrep -v '(root|halt|sync|shutdown)' | awk -F: '($7 != "/usr/sbin/nologin" && $7 != "/bin/false" && $7 !="/nonexistent" ) { print $6 }'); do
     debug "Working on $DIR"
-        for FILE in $DIR/.rhosts; do
+        for FILE in $DIR/$FILENAME; do
             if [ ! -h "$FILE" -a -f "$FILE" ]; then
                 crit "$FILE present"
                 ERRORS=$((ERRORS+1))
@@ -27,7 +28,7 @@ audit () {
     done
 
     if [ $ERRORS = 0 ]; then
-        ok "No .rhosts present in users files"
+        ok "No $FILENAME present in users files"
     fi 
 }
 

bin/hardening/13.15_check_duplicate_gid.sh

@@ -24,12 +24,12 @@ audit () {
         if [ $OCC_NUMBER -gt 1 ]; then
             USERS=$(awk -F: '($3 == n) { print $1 }' n=$GROUPID /etc/passwd | xargs)
             ERRORS=$((ERRORS+1))
-            crit "Duplicate UID ($GROUPID): ${USERS}"
+            crit "Duplicate GID ($GROUPID): ${USERS}"
         fi
     done 
 
     if [ $ERRORS = 0 ]; then
-        ok "No duplicate GIDss"
+        ok "No duplicate GIDs"
     fi 
 }
 

bin/hardening/13.16_check_duplicate_username.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+
+#
+# CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
+#
+
+#
+# 13.16 Check for Duplicate User Names (Scored)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+ERRORS=0
+
+# This function will be called if the script status is on enabled / audit mode
+audit () {
+    RESULT=$(cat /etc/passwd | cut -f1 -d":" | sort -n | uniq -c | awk {'print $1":"$2'} )
+    for LINE in $RESULT; do 
+        debug "Working on line $LINE"
+        OCC_NUMBER=$(awk -F: {'print $1'} <<< $LINE)
+        USERNAME=$(awk -F: {'print $2'} <<< $LINE) 
+        if [ $OCC_NUMBER -gt 1 ]; then
+            USERS=$(awk -F: '($3 == n) { print $1 }' n=$USERNAME /etc/passwd | xargs)
+            ERRORS=$((ERRORS+1))
+            crit "Duplicate username $USERNAME"
+        fi
+    done 
+
+    if [ $ERRORS = 0 ]; then
+        ok "No duplicate usernames"
+    fi 
+}
+
+# This function will be called if the script status is on enabled mode
+apply () {
+    info "Editing automatically username may seriously harm your system, report only here"
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ ! -r /etc/default/cis-hardenning ]; then
+    echo "There is no /etc/default/cis-hardenning FILE, cannot source CIS_ROOT_DIR variable, aborting"
+    exit 128
+else
+    . /etc/default/cis-hardenning
+    if [ -z $CIS_ROOT_DIR ]; then
+        echo "No CIS_ROOT_DIR variable, aborting"
+    fi
+fi 
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

bin/hardening/13.17_check_duplicate_groupname.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+
+#
+# CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
+#
+
+#
+# 13.17 Check for Duplicate Group Names (Scored)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+ERRORS=0
+
+# This function will be called if the script status is on enabled / audit mode
+audit () {
+    RESULT=$(cat /etc/group | cut -f1 -d":" | sort -n | uniq -c | awk {'print $1":"$2'} )
+    for LINE in $RESULT; do 
+        debug "Working on line $LINE"
+        OCC_NUMBER=$(awk -F: {'print $1'} <<< $LINE)
+        GROUPNAME=$(awk -F: {'print $2'} <<< $LINE) 
+        if [ $OCC_NUMBER -gt 1 ]; then
+            USERS=$(awk -F: '($3 == n) { print $1 }' n=$GROUPNAME /etc/passwd | xargs)
+            ERRORS=$((ERRORS+1))
+            crit "Duplicate groupname $GROUPNAME"
+        fi
+    done 
+
+    if [ $ERRORS = 0 ]; then
+        ok "No duplicate groupnames"
+    fi 
+}
+
+# This function will be called if the script status is on enabled mode
+apply () {
+    info "Editing automatically groupname may seriously harm your system, report only here"
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ ! -r /etc/default/cis-hardenning ]; then
+    echo "There is no /etc/default/cis-hardenning FILE, cannot source CIS_ROOT_DIR variable, aborting"
+    exit 128
+else
+    . /etc/default/cis-hardenning
+    if [ -z $CIS_ROOT_DIR ]; then
+        echo "No CIS_ROOT_DIR variable, aborting"
+    fi
+fi 
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

bin/hardening/13.18_find_user_netrc_files.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+
+#
+# CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
+#
+
+#
+# 13.18 Check for Presence of User .netrc Files (Scored)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+ERRORS=0
+FILENAME='.netrc'
+
+# This function will be called if the script status is on enabled / audit mode
+audit () {
+    for DIR in $(cat /etc/passwd | egrep -v '(root|halt|sync|shutdown)' | awk -F: '($7 != "/usr/sbin/nologin" && $7 != "/bin/false" && $7 !="/nonexistent" ) { print $6 }'); do
+    debug "Working on $DIR"
+        for FILE in $DIR/$FILENAME; do
+            if [ ! -h "$FILE" -a -f "$FILE" ]; then
+                crit "$FILE present"
+                ERRORS=$((ERRORS+1))
+            fi
+        done
+    done
+
+    if [ $ERRORS = 0 ]; then
+        ok "No $FILENAME present in users files"
+    fi 
+}
+
+# This function will be called if the script status is on enabled mode
+apply () {
+    info "If the audit returns something, please check with the user why he has this file"
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ ! -r /etc/default/cis-hardenning ]; then
+    echo "There is no /etc/default/cis-hardenning FILE, cannot source CIS_ROOT_DIR variable, aborting"
+    exit 128
+else
+    . /etc/default/cis-hardenning
+    if [ -z $CIS_ROOT_DIR ]; then
+        echo "No CIS_ROOT_DIR variable, aborting"
+    fi
+fi 
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

bin/hardening/13.19_find_user_forward_files.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+
+#
+# CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
+#
+
+#
+# 13.18 Check for Presence of User .netrc Files (Scored)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+ERRORS=0
+FILENAME='.forward'
+
+# This function will be called if the script status is on enabled / audit mode
+audit () {
+    for DIR in $(cat /etc/passwd | egrep -v '(root|halt|sync|shutdown)' | awk -F: '($7 != "/usr/sbin/nologin" && $7 != "/bin/false" && $7 !="/nonexistent" ) { print $6 }'); do
+    debug "Working on $DIR"
+        for FILE in $DIR/$FILENAME; do
+            if [ ! -h "$FILE" -a -f "$FILE" ]; then
+                crit "$FILE present"
+                ERRORS=$((ERRORS+1))
+            fi
+        done
+    done
+
+    if [ $ERRORS = 0 ]; then
+        ok "No $FILENAME present in users files"
+    fi 
+}
+
+# This function will be called if the script status is on enabled mode
+apply () {
+    info "If the audit returns something, please check with the user why he has this file"
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ ! -r /etc/default/cis-hardenning ]; then
+    echo "There is no /etc/default/cis-hardenning FILE, cannot source CIS_ROOT_DIR variable, aborting"
+    exit 128
+else
+    . /etc/default/cis-hardenning
+    if [ -z $CIS_ROOT_DIR ]; then
+        echo "No CIS_ROOT_DIR variable, aborting"
+    fi
+fi 
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

bin/hardening/13.20_shadow_group_empty.sh

@@ -0,0 +1,67 @@
+#!/bin/bash
+
+#
+# CIS Debian 7 Hardening
+# Authors : Thibault Dewailly, OVH <thibault.dewailly@corp.ovh.com>
+#
+
+#
+# 13.18 Check for Presence of User .netrc Files (Scored)
+#
+
+set -e # One error, it's over
+set -u # One variable unset, it's over
+
+ERRORS=0
+FILEGROUP='/etc/group'
+PATTERN='^shadow:x:[[:digit:]]+:'
+
+# This function will be called if the script status is on enabled / audit mode
+audit () {
+    does_pattern_exists_in_file $FILEGROUP $PATTERN
+    if [ $FNRET = 0 ]; then
+        info "shadow group exists"
+        RESULT=$(grep -E "$PATTERN" $FILEGROUP | cut -d: -f4)
+        GROUPID=$(getent group shadow | cut -d: -f3)
+        debug "$RESULT $GROUPID"
+        if [ ! -z "$RESULT" ]; then
+            crit "Some user belong to shadow group  : $RESULT"
+        else
+            ok "No one belongs to shadow group"
+        fi
+
+        info "Checking if a user has $GROUPID as primary group"
+        RESULT=$(awk -F: '($4 == shadowid) { print $1 }' shadowid=$GROUPID /etc/passwd)
+        if [ ! -z "$RESULT" ]; then
+            crit "Some user have shadow id to their primary group : $RESULT"
+        else
+            ok "No one have shadow id to their primary group"
+        fi
+    else
+        crit "shadow group doesn't exist"
+    fi
+}
+
+# This function will be called if the script status is on enabled mode
+apply () {
+    info "If the audit returns something, please check with the user why he has this file"
+}
+
+# This function will check config parameters required
+check_config() {
+    :
+}
+
+# Source Root Dir Parameter
+if [ ! -r /etc/default/cis-hardenning ]; then
+    echo "There is no /etc/default/cis-hardenning FILE, cannot source CIS_ROOT_DIR variable, aborting"
+    exit 128
+else
+    . /etc/default/cis-hardenning
+    if [ -z $CIS_ROOT_DIR ]; then
+        echo "No CIS_ROOT_DIR variable, aborting"
+    fi
+fi 
+
+# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
+[ -r $CIS_ROOT_DIR/lib/main.sh ] && . $CIS_ROOT_DIR/lib/main.sh

etc/conf.d/13.16_check_duplicate_username.cfg

@@ -0,0 +1,2 @@
+# Configuration for script of same name
+status=enabled

etc/conf.d/13.17_check_duplicate_groupname.cfg

@@ -0,0 +1,2 @@
+# Configuration for script of same name
+status=enabled

etc/conf.d/13.18_find_user_netrc_files.cfg

@@ -0,0 +1,2 @@
+# Configuration for script of same name
+status=enabled

etc/conf.d/13.19_find_user_forward_files.cfg

@@ -0,0 +1,2 @@
+# Configuration for script of same name
+status=enabled

etc/conf.d/13.20_shadow_group_empty.cfg

@@ -0,0 +1,2 @@
+# Configuration for script of same name
+status=enabled