elie/debian-cis
1
0
Fork 0
mirror of https://github.com/ovh/debian-cis.git synced 2024-11-22 21:47:02 +01:00
Code Issues Packages Projects Releases Wiki Activity
554 Commits 4 Branches 39 Tags 2.2 MiB
6079b16611
Commit Graph

41 Commits

Author SHA1 Message Date
GoldenKiwi
3bd4078e70
fix: allow set-hardening-level option usage (#232) 
Was broken since 2020, fixes #230
 2024-02-01 17:09:35 +01:00
GoldenKiwi
c391723fe5
fix: Allow --only option to be called multiple times (#225) 
--only option was affected with a grep bug since 2017.
the regex was not able to parse more than the first passed argument.

fixes #224
 2023-12-26 17:08:53 +01:00
P-EB
32886d3a3d
Replace CIS_ROOT_DIR by a more flexible system (#204) 
* Replace CIS_ROOT_DIR by a more flexible system

* Try to adapt the logic change to the functional tests
 2023-09-25 14:24:01 +02:00
GoldenKiwi
27edec6d5f
fix: chore, debug logs print correctly now (#197) 2023-08-31 14:40:27 +02:00
Sebastien BLAISOT
7266ec7cb4
Honor --set-log-level parameter (#127) 
Co-authored-by: GoldenKiwi <thibault.dewailly@corp.ovh.com>
 2021-11-30 18:42:33 +01:00
Sebastien BLAISOT
ad192c9457
Add silent mode and json summary (#128) 
Co-authored-by: GoldenKiwi <thibault.dewailly@corp.ovh.com>
 2021-10-20 13:22:59 +02:00
Thibault Ayanides
6ae05f3fa2
Add dealing with debian 11 
* ADD: add dockerfile for debian11
* FIX: fix crontab file not found on debian11 blank
* Add workflow for debian11
* FIX: fix debian version func to manage debian11
* Add dealing with unsupported version and distro
* Add 99.99 check that check if distro version is supported
* Use global var for debian major and distro

fix #26
 2021-02-08 13:54:24 +01:00
jeremydenoun
0b6ea0d97e
IMP: add multiple Improvements 
* add new kernel module detection (enable & listing)  with detection of monolithic kernel
* change way to detect if file system type is disabled
* add global IS_CONTAINER variable
* disable test for 3.4.x to be consistent with others
* add cli options to override configuration loglevel
 2021-02-04 16:21:49 +01:00
Thibault Serti
6efefa07ac
Update shellcheck workflow 
fix #34
 2021-01-22 14:45:01 +01:00
jeremydenoun
0edb837f80
Remove bc dependency 
Co-authored-by: Jeremy Denoun <jeremy.denoun@iguanesolutions.com>
 2021-01-22 09:31:53 +01:00
Thibault Ayanides
65bdb42eb3 IMP(shellcheck): replace ls by find (SC2045) 2020-12-14 15:08:18 +01:00
Thibault Ayanides
dee0ebc821 IMP(shellcheck): quote variables 2020-12-10 09:50:33 +01:00
Thibault Ayanides
b9e129d8fe IMP(shellcheck): disable sed replacement (SC2001) 
Shellcheck recommands to replace sed by shell expansions in 'simple' cases.
However, the replacement here is likely to lead to erros, so we disable this rule.
Moreover, it does'nt really add readability.
 2020-12-10 08:34:57 +01:00
Thibault Ayanides
e2f7426664 IMP(shellcheck): quoting variables 2020-12-07 15:53:14 +01:00
Thibault Ayanides
8012234096 IMP(shellcheck): fix harmless warnings 2020-12-07 14:53:10 +01:00
Thibault Ayanides
addd48c4dd IMP(shellcheck): add prefix to follow scripts (SC1090) 2020-12-07 13:26:51 +01:00
Thibault Ayanides
72bb3e2b84 IMP(shellcheck): replace -a in condition by && (SC2166) 2020-12-04 15:29:19 +01:00
Thibault Ayanides
3a342b784a IMP(shfmt): add shell formatter 2020-12-04 14:08:01 +01:00
Thibault Ayanides
cccc0881e9 IMP(shellcheck): add run-shellcheck prefix 2020-11-23 17:10:37 +01:00
Thibault Ayanides
d40a85085d FIX: fix issue, we had to run audit twice 
First one as root to create conf files with good owner and permissions, and then with secaudit.
Now first run with --create-config-files-only and the normally with --audit.
 2020-11-20 10:05:14 +01:00
Thibault Ayanides
a0b025deac Fix final printf command 
The final printf bugs on non US system.
A fix is to truncate the percentage to 2 decimals with bc and not with
printf.
	modifié :         bin/hardening.sh
 2020-10-30 14:56:27 +01:00
Charles Herlin
09ae131de9 FIX: usage if no RUN_MODE, fix only that used to run too many checks 
If no RUN_MODE passed as arguments, display usage and exits

Fix --only option to run only specific check
Found bug that used to run 2.2 and 2.24 when launching --only 2.24
 2019-02-13 17:11:28 +01:00
Charles Herlin
d014405e1f FIX: add becho to send batch output to syslog too 
becho stands for batch echo
formats the log line for syslog

Also logs audit summary into syslog (in batch mode only)
 2019-02-06 17:25:16 +01:00
Charles Herlin
6cea326921 Update debian 7/8/9 in help files and remove in generic scripts 2019-02-06 15:19:14 +01:00
Charles Herlin
67df4da781 Adding batch mode to output just one line of text (no colors) in order to be parsed by computer tools 
Adding DESCRIPTION field in tests and [INFO] DESCRIPTION in main
Update README with --batch mode info
Add --batch mode in hardening.sh

Change summary to make it oneliner when batch mode
AUDIT_SUMMARY PASSED_CHECKS:95 RUN_CHECKS:191 TOTAL_CHECKS_AVAIL:191 CONFORMITY_PERCENTAGE:49.74
 2017-10-31 17:44:15 +01:00
Charles Herlin
4fc79c133f Improve --only option to perform only specified test and no other lookalike test number 
Before modification "--only 8.2.1" performed tests 8.2.1 and 2.1
 2018-03-15 12:03:10 +01:00
Charles Herlin
b1f85d3f99 Add sudo management in main and utils 
* perform readonly checks as a regular user
    * sudo -n is used for checks requiring root privileges
    * increase accountability by providing log of individual access to sensitive files
 2017-11-09 15:45:42 +01:00
Charles Herlin
d2a8b2cb28 Remove unnecessary CIS_ROOT_DIR empty assignation 2017-10-25 17:44:56 +02:00
Charles Herlin
119d532a7f Changing CIS_ROOT_DIR management in env in bin/hardening.sh 2017-10-25 14:48:54 +02:00
Stéphane Lesimple
676b17c54f add hardening templating and several enhancements 2017-05-18 18:40:09 +02:00
thibault.dewailly
3e1df0cdf9 [Debian 8] Fixed comments for debian 8 compliance 2017-03-10 17:46:39 +01:00
thibault.dewailly
3ece442743 Added exit code to CIS_ROOT_DIR test def, optimized sed and sort 2016-04-20 11:29:44 +02:00
Stéphane Lesimple
1d7865dd68 add --audit-all-enable-passed, add info in README and help 2016-04-19 20:16:47 +02:00
Stéphane Lesimple
8d84f38c97 add --audit-all option 2016-04-19 19:26:04 +02:00
thibault.dewailly
6019dd9078 Corrected default file path 2016-04-18 17:39:14 +02:00
thibault.dewailly
b1b96cf4e3 log format correction, loglevel defaults to info 2016-04-18 14:01:03 +02:00
thibault.dewailly
e79a03095c All configuration defaults to disabled README updated 2016-04-18 13:19:46 +02:00
thibault.dewailly
7eaf124fc0 99.1_timeout_tty.sh 99.2_disable_usb_devices.sh 2016-04-18 11:16:05 +02:00
thibault.dewailly
628fe96666 Fixed disabled features, headers and preparing main script 2016-04-17 23:19:41 +02:00
thibault.dewailly
39e9c794e4 13.10_find_user_rhosts_files.sh 2016-04-16 18:55:44 +02:00
thibault.dewailly
db91df2296 13.7_check_user_dir_perm.sh 2016-04-16 18:11:53 +02:00