Commit Graph

20 Commits

Author SHA1 Message Date
Charles Herlin
5f2803693e Change default status to audit for file with custom create_config 2019-02-14 14:33:21 +01:00
Charles Herlin
25eb91c411 Update debian 7/8/9 in help files and remove in generic scripts 2019-02-06 15:19:14 +01:00
Charles Herlin
bfbd410b19 FIX: quotes in find command, misinterpreted shellcheck advice 2019-01-23 16:55:48 +01:00
Charles Herlin
ec6b79e3c7 FEAT: Add sudo_wrapper to catch unauthorized sudo commands
As for now, if a sudo command was not allowed, check might sometimes
pass, resulting compliant state even if it actually is not.
Sudo wrapper first checks wether command is allowed before running it,
otherwise issues a crit message, setting check as not compliant

Fix script to make sudo_wrapper work, split "find" lines
Fix quotes in $@ and $* when running sudo command

Fixed quotes and curly braces with shellcheck report
2019-01-23 15:56:27 +01:00
Charles Herlin
001323f448 FIX: sed that was too greedy
Used to sed 's!/usr/bin/su!!' /usr/bin/sudo leaving only "do"
that lead to misinterpreting result

Change algorithm to avoid partial sed in the result list
Now the not compliant list is built out of the find results
instead of items being removed from them.
Allow better control of grep inside this list.

Chore: apply shellcheck recommendations
2019-01-23 13:49:29 +01:00
Charles Herlin
ed0c07d319 Add missing /usr/bin/su 2019-01-21 17:27:09 +01:00
Charles Herlin
03b6f1857a FIX: add /usr/bin/* path for suid/guid allowed binaries
Debian is still migrating /bin to /usr/bin so I added both path to the
allowed ones

 * mount
 * umount
 * ping
 * ping6
 * unix_chkpwd
2019-01-21 17:27:09 +01:00
Charles Herlin
106412149d Adding batch mode to output just one line of text (no colors) in order to be parsed by computer tools
Adding DESCRIPTION field in tests and [INFO] DESCRIPTION in main
Update README with --batch mode info
Add --batch mode in hardening.sh

Change summary to make it oneliner when batch mode
AUDIT_SUMMARY PASSED_CHECKS:95 RUN_CHECKS:191 TOTAL_CHECKS_AVAIL:191 CONFORMITY_PERCENTAGE:49.74
2019-01-21 17:20:18 +01:00
Charles Herlin
b41df080cf Add sudo management in main and utils
* perform readonly checks as a regular user
    * sudo -n is used for checks requiring root privileges
    * increase accountability by providing log of individual access to sensitive files
2018-03-13 10:38:25 +01:00
Charles Herlin
5b11b1628a Expand tabs to 4 spaces and trim trailing spaces 2017-11-17 15:13:27 +01:00
Charles Herlin
cbfd04272b Applying batch edit to all hardening/*.sh scripts for new CIS_ROOT_DIR management 2017-10-25 14:50:39 +02:00
Stéphane Lesimple
dfaf4c2093 add hardening templating and several enhancements 2017-06-13 18:30:29 +02:00
thibault.dewailly
0f11b08ffb [Debian 8] Fixed comments for debian 8 compliance 2017-03-14 15:42:08 +01:00
kevin.tanguy
8bbac84f7b debian dependencies fix, rephrasing, revision bump 1.0-8. 2016-04-26 14:02:17 +02:00
thibault.dewailly
7e951c020a Fixed default file error handling and quickstart 2016-04-22 08:34:28 +02:00
thibault.dewailly
c5b4aa220d Added exit code to CIS_ROOT_DIR test def, optimized sed and sort 2016-04-20 18:06:08 +02:00
thibault.dewailly
e9487bfb04 Corrected default file path 2016-04-18 17:39:14 +02:00
thibault.dewailly
091eec57ee All configuration defaults to disabled README updated 2016-04-18 13:25:09 +02:00
thibault.dewailly
fffd9842d6 12.11_find_sgid_files.sh 2016-04-16 12:57:24 +02:00
thibault.dewailly
d241ae57f9 12.10_find_suid_files.sh 12.1_etc_passwd_permissions.sh 12.2_etc_shadow_permissions.sh 12.3_etc_group_permissions.sh 12.4_etc_passwd_ownership.sh 12.5_etc_shadow_ownership.sh 12.6_etc_group_ownership.sh 12.7_find_world_writable_file.sh 12.8_find_unowned_files.sh 12.9_find_ungrouped_files.sh 2016-04-16 00:26:19 +02:00