fix: ipv6_is_enabled related checks

fix issue #251 : https://github.com/ovh/debian-cis/issues/251

the 'is_ipv6_enabled' function was doing some 'crit' actions, which is not the expected behaviour: we don't want to fail if ipv6 is enabled, it is just an infor that checks are going to use.

Also, it was overriding the SYSCTL_PARAMS that could have been defined in the checks.

.github/workflows/functionnal-tests.yml

@@ -4,6 +4,13 @@ on:
   - pull_request
   - push
 jobs:
+  functionnal-tests-docker-debian10:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+      - name: Run the tests debian10
+        run: ./tests/docker_build_and_run_tests.sh debian10
   functionnal-tests-docker-debian11:
     runs-on: ubuntu-latest
     steps:

MANUAL.md

@@ -4,7 +4,7 @@
 
 # NAME
 
-cis-hardening - CIS Debian 11/12 Hardening
+cis-hardening - CIS Debian 10/11/12 Hardening
 
 # SYNOPSIS
 
@@ -12,7 +12,7 @@ cis-hardening - CIS Debian 11/12 Hardening
 
 # DESCRIPTION
 
-Modular Debian 11/12 security hardening scripts based on the CIS (https://www.cisecurity.org) recommendations.
+Modular Debian 10/11/12 security hardening scripts based on the CIS (https://www.cisecurity.org) recommendations.
 
 We use it at OVHcloud (https://www.ovhcloud.com) to harden our PCI-DSS infrastructure.
 

README.md

@@ -1,4 +1,4 @@
-# :lock: CIS Debian 11/12 Hardening
+# :lock: CIS Debian 10/11/12 Hardening
 
 
 <p align="center">
@@ -13,7 +13,7 @@
 ![License](https://img.shields.io/github/license/ovh/debian-cis)
 ---
 
-Modular Debian 11/12 security hardening scripts based on [cisecurity.org](https://www.cisecurity.org)
+Modular Debian 10/11/12 security hardening scripts based on [cisecurity.org](https://www.cisecurity.org)
 recommendations. We use it at [OVHcloud](https://www.ovhcloud.com) to harden our PCI-DSS infrastructure.
 
 NB : Although Debian 12 CIS Hardening guide is still in development, we do use this set of scripts
@@ -174,7 +174,7 @@ Functional tests are available. They are to be run in a Docker environment.
 $ ./tests/docker_build_and_run_tests.sh <target> [name of test script...]
 ```
 
-With `target` being like `debian11` or `debian12`.
+With `target` being like `debian10` or `debian11`.
 
 Running without script arguments will run all tests in `./tests/hardening/` directory.
 Or you can specify one or several test script to be run.

bin/hardening.sh

@@ -254,7 +254,7 @@ if [ "$DISTRIBUTION" != "debian" ]; then
         echo "You can deactivate this message by setting the LOGLEVEL variable in /etc/hardening.cfg"
     fi
 else
-    if [ "$DEB_MAJ_VER" -gt "$HIGHEST_SUPPORTED_DEBIAN_VERSION" ]; then
+    if [ "$DEB_MAJ_VER" = "sid" ] || [ "$DEB_MAJ_VER" -gt "$HIGHEST_SUPPORTED_DEBIAN_VERSION" ]; then
         echo "Your debian version is too recent and is not supported yet because there is no official CIS PDF for this version yet."
         if [ "$ALLOW_UNSUPPORTED_DISTRIBUTION" -eq 0 ]; then
             echo "If you want to run it anyway, you can use the flag --allow-unsupported-distribution"

bin/hardening/acc_logindefs_sha512.sh

@@ -59,9 +59,17 @@ check_config() {
     :
 }
 
+# As we use DEB_MAJ_VER, which is set by constants.sh, itself sourced by main.sh below,
+# We need to call this in the subs called by main.sh when it is sourced, otherwise it would
+# either be too soon (DEB_MAJ_VER not defined) or too late (test has already been run)
 _set_vars_jit() {
-    CONF_LINE_REGEX="ENCRYPT_METHOD (SHA512|yescrypt|YESCRYPT)"
+    if [ "$DEB_MAJ_VER" = "sid" ] || [ "$DEB_MAJ_VER" -ge "11" ]; then
-    CONF_LINE="ENCRYPT_METHOD YESCRYPT"
+        CONF_LINE_REGEX="ENCRYPT_METHOD (SHA512|yescrypt|YESCRYPT)"
+        CONF_LINE="ENCRYPT_METHOD YESCRYPT"
+    else
+        CONF_LINE_REGEX="ENCRYPT_METHOD SHA512"
+        CONF_LINE="ENCRYPT_METHOD SHA512"
+    fi
 }
 
 # Source Root Dir Parameter

bin/hardening/acc_pam_sha512.sh

@@ -49,7 +49,11 @@ apply() {
             ok "$CONF_LINE is present in $CONF_FILE"
         else
             warn "$CONF_LINE is not present in $CONF_FILE"
-            add_line_file_before_pattern "$CONF_FILE" "password [success=1 default=ignore] pam_unix.so yescrypt" "# pam-auth-update(8) for details."
+            if [ "$DEB_MAJ_VER" = "sid" ] || [ "$DEB_MAJ_VER" -ge "11" ]; then
+                add_line_file_before_pattern "$CONF_FILE" "password [success=1 default=ignore] pam_unix.so yescrypt" "# pam-auth-update(8) for details."
+            else
+                add_line_file_before_pattern "$CONF_FILE" "password [success=1 default=ignore] pam_unix.so sha512" "# pam-auth-update(8) for details."
+            fi
         fi
     fi
 }
@@ -63,7 +67,11 @@ check_config() {
 # We need to call this in the subs called by main.sh when it is sourced, otherwise it would
 # either be too soon (DEB_MAJ_VER not defined) or too late (test has already been run)
 _set_vars_jit() {
-    CONF_LINE="^\s*password\s.+\s+pam_unix\.so\s+.*(sha512|yescrypt)" # https://github.com/ovh/debian-cis/issues/158
+    if [ "$DEB_MAJ_VER" = "sid" ] || [ "$DEB_MAJ_VER" -ge "11" ]; then
+        CONF_LINE="^\s*password\s.+\s+pam_unix\.so\s+.*(sha512|yescrypt)" # https://github.com/ovh/debian-cis/issues/158
+    else
+        CONF_LINE="^\s*password\s.+\s+pam_unix\.so\s+.*sha512"
+    fi
 }
 
 # Source Root Dir Parameter

bin/hardening/acc_shadow_sha512.sh

@@ -37,7 +37,7 @@ audit() {
             pw_found+="$user "
             ok "User $user has a disabled password."
         # yescrypt: Check password against $y$<salt>$<base64>
-        elif [[ $passwd =~ ^\$y\$[./A-Za-z0-9]+\$[./A-Za-z0-9]{,86}\$[./A-Za-z0-9]{43} ]]; then
+        elif [ "$DEB_MAJ_VER" -ge "11" ] && [[ $passwd =~ ^\$y\$[./A-Za-z0-9]+\$[./A-Za-z0-9]{,86}\$[./A-Za-z0-9]{43} ]]; then
             pw_found+="$user "
             ok "User $user has suitable yescrypt hashed password."
         # sha512: Check password against $6$<salt>$<base64>, see `man 3 crypt`
@@ -46,7 +46,11 @@ audit() {
             ok "User $user has suitable sha512crypt hashed password."
         else
             pw_found+="$user "
-            crit "User $user has a password that is not sha512crypt nor yescrypt hashed."
+            if [ "$DEB_MAJ_VER" -ge "11" ]; then
+                crit "User $user has a password that is not sha512crypt nor yescrypt hashed."
+            else
+                crit "User $user has a password that is not sha512crypt hashed."
+            fi
         fi
     done
     if [[ -z "$users_reviewed" ]]; then

bin/hardening/check_distribution.sh

@@ -6,7 +6,7 @@
 #
 
 #
-# Ensure that the distribution version is debian and supported
+# Ensure that the distribution version is debian and that the version is 9 or 10
 #
 
 set -e # One error, it's over
@@ -22,7 +22,7 @@ audit() {
     if [ "$DISTRIBUTION" != "debian" ]; then
         crit "Your distribution has been identified as $DISTRIBUTION which is not debian"
     else
-        if [ "$DEB_MAJ_VER" -gt "$HIGHEST_SUPPORTED_DEBIAN_VERSION" ]; then
+        if [ "$DEB_MAJ_VER" = "sid" ] || [ "$DEB_MAJ_VER" -gt "$HIGHEST_SUPPORTED_DEBIAN_VERSION" ]; then
             crit "Your distribution is too recent and is not yet supported."
         elif [ "$DEB_MAJ_VER" -lt "$SMALLEST_SUPPORTED_DEBIAN_VERSION" ]; then
             crit "Your distribution is debian but is deprecated. Consider upgrading to a supported version."

bin/hardening/disable_cramfs.sh

@@ -26,25 +26,11 @@ audit() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing or disable this check!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$MODULE_NAME is loaded!"
+            crit "$MODULE_NAME is enabled!"
         else
-            ok "$MODULE_NAME is not loaded"
+            ok "$MODULE_NAME is disabled"
-        fi
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 0 ]; then
-                ok "$MODULE_NAME is disabled in the modprobe configuration"
-            else
-                is_kernel_module_available "$KERNEL_OPTION"
-                if [ "$FNRET" -eq 0 ]; then
-                    crit "$MODULE_NAME is available in some kernel config, but not disabled"
-                else
-                    ok "$MODULE_NAME is not available in any kernel config"
-                fi
-            fi
         fi
     fi
 }
@@ -55,18 +41,11 @@ apply() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$LOADED_MODULE_NAME is loaded!"
+            warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
-            warn "I wont unload the module, unload it manually or recompile the kernel if needed"
+        else
-        fi
+            ok "$MODULE_NAME is disabled"
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 1 ]; then
-                echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
-                info "$MODULE_NAME has been disabled in the modprobe configuration"
-            fi
         fi
     fi
 }

bin/hardening/disable_dccp.sh

@@ -28,25 +28,11 @@ audit() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing or disable this check!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$MODULE_NAME is loaded!"
+            crit "$MODULE_NAME is enabled!"
         else
-            ok "$MODULE_NAME is not loaded"
+            ok "$MODULE_NAME is disabled"
-        fi
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 0 ]; then
-                ok "$MODULE_NAME is disabled in the modprobe configuration"
-            else
-                is_kernel_module_available "$KERNEL_OPTION"
-                if [ "$FNRET" -eq 0 ]; then
-                    crit "$MODULE_NAME is available in some kernel config, but not disabled"
-                else
-                    ok "$MODULE_NAME is not available in any kernel config"
-                fi
-            fi
         fi
     fi
 }
@@ -57,18 +43,11 @@ apply() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$LOADED_MODULE_NAME is loaded!"
+            warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
-            warn "I wont unload the module, unload it manually or recompile the kernel if needed"
+        else
-        fi
+            ok "$MODULE_NAME is disabled"
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 1 ]; then
-                echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
-                info "$MODULE_NAME has been disabled in the modprobe configuration"
-            fi
         fi
     fi
 }

bin/hardening/disable_freevxfs.sh

@@ -26,25 +26,11 @@ audit() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing or disable this check!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$MODULE_NAME is loaded!"
+            crit "$MODULE_NAME is enabled!"
         else
-            ok "$MODULE_NAME is not loaded"
+            ok "$MODULE_NAME is disabled"
-        fi
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 0 ]; then
-                ok "$MODULE_NAME is disabled in the modprobe configuration"
-            else
-                is_kernel_module_available "$KERNEL_OPTION"
-                if [ "$FNRET" -eq 0 ]; then
-                    crit "$MODULE_NAME is available in some kernel config, but not disabled"
-                else
-                    ok "$MODULE_NAME is not available in any kernel config"
-                fi
-            fi
         fi
     fi
 }
@@ -55,18 +41,11 @@ apply() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$LOADED_MODULE_NAME is loaded!"
+            warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
-            warn "I wont unload the module, unload it manually or recompile the kernel if needed"
+        else
-        fi
+            ok "$MODULE_NAME is disabled"
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 1 ]; then
-                echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
-                info "$MODULE_NAME has been disabled in the modprobe configuration"
-            fi
         fi
     fi
 }

bin/hardening/disable_hfs.sh

@@ -26,25 +26,11 @@ audit() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing or disable this check!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$MODULE_NAME is loaded!"
+            crit "$MODULE_NAME is enabled!"
         else
-            ok "$MODULE_NAME is not loaded"
+            ok "$MODULE_NAME is disabled"
-        fi
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 0 ]; then
-                ok "$MODULE_NAME is disabled in the modprobe configuration"
-            else
-                is_kernel_module_available "$KERNEL_OPTION"
-                if [ "$FNRET" -eq 0 ]; then
-                    crit "$MODULE_NAME is available in some kernel config, but not disabled"
-                else
-                    ok "$MODULE_NAME is not available in any kernel config"
-                fi
-            fi
         fi
     fi
 }
@@ -55,18 +41,11 @@ apply() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$LOADED_MODULE_NAME is loaded!"
+            warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
-            warn "I wont unload the module, unload it manually or recompile the kernel if needed"
+        else
-        fi
+            ok "$MODULE_NAME is disabled"
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 1 ]; then
-                echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
-                info "$MODULE_NAME has been disabled in the modprobe configuration"
-            fi
         fi
     fi
 }

bin/hardening/disable_hfsplus.sh

@@ -26,25 +26,11 @@ audit() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing or disable this check!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$MODULE_NAME is loaded!"
+            crit "$MODULE_NAME is enabled!"
         else
-            ok "$MODULE_NAME is not loaded"
+            ok "$MODULE_NAME is disabled"
-        fi
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 0 ]; then
-                ok "$MODULE_NAME is disabled in the modprobe configuration"
-            else
-                is_kernel_module_available "$KERNEL_OPTION"
-                if [ "$FNRET" -eq 0 ]; then
-                    crit "$MODULE_NAME is available in some kernel config, but not disabled"
-                else
-                    ok "$MODULE_NAME is not available in any kernel config"
-                fi
-            fi
         fi
     fi
 }
@@ -55,18 +41,11 @@ apply() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$LOADED_MODULE_NAME is loaded!"
+            warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
-            warn "I wont unload the module, unload it manually or recompile the kernel if needed"
+        else
-        fi
+            ok "$MODULE_NAME is disabled"
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 1 ]; then
-                echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
-                info "$MODULE_NAME has been disabled in the modprobe configuration"
-            fi
         fi
     fi
 }

bin/hardening/disable_jffs2.sh

@@ -26,25 +26,11 @@ audit() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing or disable this check!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$MODULE_NAME is loaded!"
+            crit "$MODULE_NAME is enabled!"
         else
-            ok "$MODULE_NAME is not loaded"
+            ok "$MODULE_NAME is disabled"
-        fi
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 0 ]; then
-                ok "$MODULE_NAME is disabled in the modprobe configuration"
-            else
-                is_kernel_module_available "$KERNEL_OPTION"
-                if [ "$FNRET" -eq 0 ]; then
-                    crit "$MODULE_NAME is available in some kernel config, but not disabled"
-                else
-                    ok "$MODULE_NAME is not available in any kernel config"
-                fi
-            fi
         fi
     fi
 }
@@ -55,18 +41,11 @@ apply() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$LOADED_MODULE_NAME is loaded!"
+            warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
-            warn "I wont unload the module, unload it manually or recompile the kernel if needed"
+        else
-        fi
+            ok "$MODULE_NAME is disabled"
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 1 ]; then
-                echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
-                info "$MODULE_NAME has been disabled in the modprobe configuration"
-            fi
         fi
     fi
 }

bin/hardening/disable_rds.sh

@@ -28,25 +28,11 @@ audit() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing or disable this check!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$MODULE_NAME is loaded!"
+            crit "$MODULE_NAME is enabled!"
         else
-            ok "$MODULE_NAME is not loaded"
+            ok "$MODULE_NAME is disabled"
-        fi
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 0 ]; then
-                ok "$MODULE_NAME is disabled in the modprobe configuration"
-            else
-                is_kernel_module_available "$KERNEL_OPTION"
-                if [ "$FNRET" -eq 0 ]; then
-                    crit "$MODULE_NAME is available in some kernel config, but not disabled"
-                else
-                    ok "$MODULE_NAME is not available in any kernel config"
-                fi
-            fi
         fi
     fi
 }
@@ -57,18 +43,11 @@ apply() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$LOADED_MODULE_NAME is loaded!"
+            warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
-            warn "I wont unload the module, unload it manually or recompile the kernel if needed"
+        else
-        fi
+            ok "$MODULE_NAME is disabled"
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 1 ]; then
-                echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
-                info "$MODULE_NAME has been disabled in the modprobe configuration"
-            fi
         fi
     fi
 }

bin/hardening/disable_sctp.sh

@@ -28,25 +28,11 @@ audit() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing or disable this check!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$MODULE_NAME is loaded!"
+            crit "$MODULE_NAME is enabled!"
         else
-            ok "$MODULE_NAME is not loaded"
+            ok "$MODULE_NAME is disabled"
-        fi
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 0 ]; then
-                ok "$MODULE_NAME is disabled in the modprobe configuration"
-            else
-                is_kernel_module_available "$KERNEL_OPTION"
-                if [ "$FNRET" -eq 0 ]; then
-                    crit "$MODULE_NAME is available in some kernel config, but not disabled"
-                else
-                    ok "$MODULE_NAME is not available in any kernel config"
-                fi
-            fi
         fi
     fi
 }
@@ -57,18 +43,11 @@ apply() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$LOADED_MODULE_NAME is loaded!"
+            warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
-            warn "I wont unload the module, unload it manually or recompile the kernel if needed"
+        else
-        fi
+            ok "$MODULE_NAME is disabled"
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 1 ]; then
-                echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
-                info "$MODULE_NAME has been disabled in the modprobe configuration"
-            fi
         fi
     fi
 }

bin/hardening/disable_squashfs.sh

@@ -26,25 +26,11 @@ audit() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing or disable this check!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$MODULE_NAME is loaded!"
+            crit "$MODULE_NAME is enabled!"
         else
-            ok "$MODULE_NAME is not loaded"
+            ok "$MODULE_NAME is disabled"
-        fi
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 0 ]; then
-                ok "$MODULE_NAME is disabled in the modprobe configuration"
-            else
-                is_kernel_module_available "$KERNEL_OPTION"
-                if [ "$FNRET" -eq 0 ]; then
-                    crit "$MODULE_NAME is available in some kernel config, but not disabled"
-                else
-                    ok "$MODULE_NAME is not available in any kernel config"
-                fi
-            fi
         fi
     fi
 }
@@ -55,18 +41,11 @@ apply() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$LOADED_MODULE_NAME is loaded!"
+            warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
-            warn "I wont unload the module, unload it manually or recompile the kernel if needed"
+        else
-        fi
+            ok "$MODULE_NAME is disabled"
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 1 ]; then
-                echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
-                info "$MODULE_NAME has been disabled in the modprobe configuration"
-            fi
         fi
     fi
 }

bin/hardening/disable_tipc.sh

@@ -28,25 +28,11 @@ audit() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing or disable this check!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$MODULE_NAME is loaded!"
+            crit "$MODULE_NAME is enabled!"
         else
-            ok "$MODULE_NAME is not loaded"
+            ok "$MODULE_NAME is disabled"
-        fi
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 0 ]; then
-                ok "$MODULE_NAME is disabled in the modprobe configuration"
-            else
-                is_kernel_module_available "$KERNEL_OPTION"
-                if [ "$FNRET" -eq 0 ]; then
-                    crit "$MODULE_NAME is available in some kernel config, but not disabled"
-                else
-                    ok "$MODULE_NAME is not available in any kernel config"
-                fi
-            fi
         fi
     fi
 }
@@ -57,18 +43,11 @@ apply() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$LOADED_MODULE_NAME is loaded!"
+            warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
-            warn "I wont unload the module, unload it manually or recompile the kernel if needed"
+        else
-        fi
+            ok "$MODULE_NAME is disabled"
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 1 ]; then
-                echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
-                info "$MODULE_NAME has been disabled in the modprobe configuration"
-            fi
         fi
     fi
 }

bin/hardening/disable_udf.sh

@@ -26,25 +26,11 @@ audit() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing or disable this check!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$MODULE_NAME is loaded!"
+            crit "$MODULE_NAME is enabled!"
         else
-            ok "$MODULE_NAME is not loaded"
+            ok "$MODULE_NAME is disabled"
-        fi
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 0 ]; then
-                ok "$MODULE_NAME is disabled in the modprobe configuration"
-            else
-                is_kernel_module_available "$KERNEL_OPTION"
-                if [ "$FNRET" -eq 0 ]; then
-                    crit "$MODULE_NAME is available in some kernel config, but not disabled"
-                else
-                    ok "$MODULE_NAME is not available in any kernel config"
-                fi
-            fi
         fi
     fi
 }
@@ -55,18 +41,11 @@ apply() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME" "($MODULE_NAME|install)"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$LOADED_MODULE_NAME is loaded!"
+            warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
-            warn "I wont unload the module, unload it manually or recompile the kernel if needed"
+        else
-        fi
+            ok "$MODULE_NAME is disabled"
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 1 ]; then
-                echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
-                info "$MODULE_NAME has been disabled in the modprobe configuration"
-            fi
         fi
     fi
 }

bin/hardening/disable_usb_storage.sh

@@ -20,10 +20,7 @@ DESCRIPTION="Disable USB storage."
 # Note: we check /proc/config.gz to be compliant with both monolithic and modular kernels
 
 KERNEL_OPTION="CONFIG_USB_STORAGE"
-# name as used for "modprobe"
 MODULE_NAME="usb-storage"
-# name as returned by "modinfo -F name <module_file.ko>"
-LOADED_MODULE_NAME="usb_storage"
 
 # This function will be called if the script status is on enabled / audit mode
 audit() {
@@ -31,25 +28,11 @@ audit() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing or disable this check!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$LOADED_MODULE_NAME is loaded!"
+            crit "$MODULE_NAME is enabled!"
         else
-            ok "$LOADED_MODULE_NAME is not loaded"
+            ok "$MODULE_NAME is disabled"
-        fi
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 0 ]; then
-                ok "$MODULE_NAME is disabled in the modprobe configuration"
-            else
-                is_kernel_module_available "$KERNEL_OPTION"
-                if [ "$FNRET" -eq 0 ]; then
-                    crit "$MODULE_NAME is available in some kernel config, but not disabled"
-                else
-                    ok "$MODULE_NAME is not available in any kernel config"
-                fi
-            fi
         fi
     fi
 }
@@ -60,18 +43,11 @@ apply() {
         # In an unprivileged container, the kernel modules are host dependent, so you should consider enforcing it
         ok "Container detected, consider host enforcing!"
     else
-        is_kernel_module_loaded "$KERNEL_OPTION" "$LOADED_MODULE_NAME"
+        is_kernel_option_enabled "$KERNEL_OPTION" "$MODULE_NAME"
-        if [ "$FNRET" -eq 0 ]; then # 0 means true in bash, so it IS activated
+        if [ "$FNRET" = 0 ]; then # 0 means true in bash, so it IS activated
-            crit "$LOADED_MODULE_NAME is loaded!"
+            warn "I cannot fix $MODULE_NAME, recompile your kernel or blacklist module $MODULE_NAME (/etc/modprobe.d/blacklist.conf : +install $MODULE_NAME /bin/true)"
-            warn "I wont unload the module, unload it manually or recompile the kernel if needed"
+        else
-        fi
+            ok "$MODULE_NAME is disabled"
-
-        if [ "$IS_MONOLITHIC_KERNEL" -eq 1 ]; then
-            is_kernel_module_disabled "$MODULE_NAME"
-            if [ "$FNRET" -eq 1 ]; then
-                echo "install $MODULE_NAME /bin/true" >>/etc/modprobe.d/"$MODULE_NAME".conf
-                info "$MODULE_NAME has been disabled in the modprobe configuration"
-            fi
         fi
     fi
 }

bin/hardening/enable_lockout_failed_password.sh

@@ -59,14 +59,23 @@ apply() {
         ok "$PATTERN_AUTH is present in $FILE_AUTH"
     else
         warn "$PATTERN_AUTH is not present in $FILE_AUTH, adding it"
-        add_line_file_before_pattern "$FILE_AUTH" "auth required pam_faillock.so onerr=fail audit silent deny=5 unlock_time=900" "# pam-auth-update(8) for details."
+        if [ 10 -ge "$DEB_MAJ_VER" ]; then
+            add_line_file_before_pattern "$FILE_AUTH" "auth required pam_tally2.so onerr=fail audit silent deny=5 unlock_time=900" "# pam-auth-update(8) for details."
+        else
+            add_line_file_before_pattern "$FILE_AUTH" "auth required pam_faillock.so onerr=fail audit silent deny=5 unlock_time=900" "# pam-auth-update(8) for details."
+        fi
     fi
     does_pattern_exist_in_file "$FILE_ACCOUNT" "$PATTERN_ACCOUNT"
     if [ "$FNRET" = 0 ]; then
         ok "$PATTERN_ACCOUNT is present in $FILE_ACCOUNT"
     else
         warn "$PATTERN_ACCOUNT is not present in $FILE_ACCOUNT, adding it"
-        add_line_file_before_pattern "$FILE_ACCOUNT" "account required pam_faillock.so" "# pam-auth-update(8) for details."
+        if [ 10 -ge "$DEB_MAJ_VER" ]; then
+            add_line_file_before_pattern "$FILE_ACCOUNT" "account required pam_tally2.so" "# pam-auth-update(8) for details."
+        else
+            add_line_file_before_pattern "$FILE_ACCOUNT" "account required pam_faillock.so" "# pam-auth-update(8) for details."
+        fi
+
     fi
 }
 

bin/hardening/ssh_cry_kex.sh

@@ -73,7 +73,14 @@ apply() {
 }
 
 create_config() {
-    KEX='curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256'
+    set +u
+    debug "Debian version : $DEB_MAJ_VER "
+    if [[ "$DEB_MAJ_VER" -le 7 ]]; then
+        KEX='diffie-hellman-group-exchange-sha256'
+    else
+        KEX='curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256'
+    fi
+    set -u
     cat <<EOF
 status=audit
 # Put your KexAlgorithms

bin/hardening/ssh_cry_rekey.sh

@@ -30,7 +30,11 @@ audit() {
         crit "Cannot get Debian version. Aborting..."
         return
     fi
-
+    if [[ "${DEB_MAJ_VER}" != "sid" ]] && [[ "${DEB_MAJ_VER}" -lt "8" ]]; then
+        set -u
+        warn "Debian version too old (${DEB_MAJ_VER}), check does not apply, you should disable this check."
+        return
+    fi
     set -u
     is_pkg_installed "$PACKAGE"
     if [ "$FNRET" != 0 ]; then

debian/changelog

@@ -1,12 +1,3 @@
-cis-hardening (4.1-5) unstable; urgency=medium
-
-  * drop debian10 and below support
-  * fix: ipv6_is_enabled (#251)
-  * fix: record_mac_edit.sh (#195)
-  * add --set-version to manage multiple cis versions in the future
-
- -- Damien Cavagnini <damien.cavagnini@ovhcloud.com>  Fri, 04 Jul 2025 10:27:18 +0200
-
 cis-hardening (4.1-4) unstable; urgency=medium
 
   * allow multiple users in 5.2.18 (#228)

debian/cis-hardening.8

@@ -4,13 +4,13 @@
 .hy
 .SH NAME
 .PP
-cis-hardening - CIS Debian 11/12 Hardening
+cis-hardening - CIS Debian 10/11/12 Hardening
 .SH SYNOPSIS
 .PP
 \f[B]hardening.sh\f[R] RUN_MODE OPTIONS
 .SH DESCRIPTION
 .PP
-Modular Debian 11/12 security hardening scripts based on the CIS
+Modular Debian 10/11/12 security hardening scripts based on the CIS
 (https://www.cisecurity.org) recommendations.
 .PP
 We use it at OVHcloud (https://www.ovhcloud.com) to harden our PCI-DSS

lib/constants.sh

@@ -57,6 +57,6 @@ get_distribution
 get_debian_major_version
 
 # shellcheck disable=SC2034
-SMALLEST_SUPPORTED_DEBIAN_VERSION=11
+SMALLEST_SUPPORTED_DEBIAN_VERSION=10
 # shellcheck disable=SC2034
 HIGHEST_SUPPORTED_DEBIAN_VERSION=12

lib/utils.sh

@@ -319,109 +319,95 @@ is_service_enabled() {
 #
 # Kernel Options checks
 #
-is_kernel_monolithic() {
-    debug "Detect if /proc/modules is available, otherwise consider as a monolithic kernel"
-    if $SUDO_CMD ls /proc/modules >/dev/null 2>&1; then
-        IS_MONOLITHIC_KERNEL=1
-    else
-        IS_MONOLITHIC_KERNEL=0
-    fi
-}
 
 is_kernel_option_enabled() {
-    # check if kernel option is configured for the running kernel
     local KERNEL_OPTION="$1"
+    local MODULE_NAME=""
+    local MODPROBE_FILTER=""
     local RESULT=""
+    local IS_MONOLITHIC_KERNEL=1
+    local DEF_MODULE=""
 
-    is_kernel_monolithic
+    if [ $# -ge 2 ]; then
-
+        MODULE_NAME="$2"
-    if [ "$IS_MONOLITHIC_KERNEL" -eq 0 ] && $SUDO_CMD [ -r "/proc/config.gz" ]; then
-        RESULT=$($SUDO_CMD zgrep "^$KERNEL_OPTION=" /proc/config.gz) || :
     fi
 
-    # modular kernel, or no configuration found in /proc
+    if [ $# -ge 3 ]; then
-    if [[ "$RESULT" == "" ]]; then
+        MODPROBE_FILTER="$3"
-        if $SUDO_CMD [ -r "/boot/config-$(uname -r)" ]; then
+    fi
+
+    debug "Detect if lsmod is available and does not return an error code (otherwise consider as a monolithic kernel"
+    if $SUDO_CMD lsmod >/dev/null 2>&1; then
+        IS_MONOLITHIC_KERNEL=0
+    fi
+
+    if [ $IS_MONOLITHIC_KERNEL -eq 1 ]; then
+        if $SUDO_CMD [ -r "/proc/config.gz" ]; then
+            RESULT=$($SUDO_CMD zgrep "^$KERNEL_OPTION=" /proc/config.gz) || :
+        elif $SUDO_CMD [ -r "/boot/config-$(uname -r)" ]; then
             RESULT=$($SUDO_CMD grep "^$KERNEL_OPTION=" "/boot/config-$(uname -r)") || :
         else
-            info "No information about kernel configuration found"
+            debug "No information about kernel found, you're probably in a container"
             FNRET=127
             return
         fi
-    fi
 
-    local ANSWER=""
+        ANSWER=$(cut -d = -f 2 <<<"$RESULT")
-    ANSWER=$(cut -d = -f 2 <<<"$RESULT")
+        if [ "$ANSWER" = "y" ]; then
-    if [ "$ANSWER" = "y" ]; then
+            debug "Kernel option $KERNEL_OPTION enabled"
-        debug "Kernel option $KERNEL_OPTION enabled"
+            FNRET=0
-        FNRET=0
+        elif [ "$ANSWER" = "n" ]; then
-    elif [ "$ANSWER" = "n" ]; then
+            debug "Kernel option $KERNEL_OPTION disabled"
-        debug "Kernel option $KERNEL_OPTION disabled"
+            FNRET=1
-        FNRET=1
+        else
+            debug "Kernel option $KERNEL_OPTION not found"
+            FNRET=2 # Not found
+        fi
+
+        if $SUDO_CMD [ "$FNRET" -ne 0 ] && [ -n "$MODULE_NAME" ] && [ -d "/lib/modules/$(uname -r)" ]; then
+            # also check in modules, because even if not =y, maybe
+            # the admin compiled it separately later (or out-of-tree)
+            # as a module (regardless of the fact that we have =m or not)
+            debug "Checking if we have $MODULE_NAME.ko"
+            local modulefile
+            modulefile=$($SUDO_CMD find "/lib/modules/$(uname -r)/" -type f -name "$MODULE_NAME.ko")
+            if $SUDO_CMD [ -n "$modulefile" ]; then
+                debug "We do have $modulefile!"
+                # ... but wait, maybe it's blacklisted? check files in /etc/modprobe.d/ for "blacklist xyz"
+                if grep -qRE "^\s*blacklist\s+$MODULE_NAME\s*$" /etc/modprobe.d/*.conf; then
+                    debug "... but it's blacklisted!"
+                    FNRET=1 # Not found (found but blacklisted)
+                fi
+                # ... but wait, maybe it's override ? check files in /etc/modprobe.d/ for "install xyz /bin/(true|false)"
+                if grep -aRE "^\s*install\s+$MODULE_NAME\s+/bin/(true|false)\s*$" /etc/modprobe.d/*.conf; then
+                    debug "... but it's override!"
+                    FNRET=1 # Not found (found but override)
+                fi
+                FNRET=0 # Found!
+            fi
+        fi
     else
-        debug "Kernel option $KERNEL_OPTION not found"
+        if [ "$MODPROBE_FILTER" != "" ]; then
-        FNRET=2 # Not found
+            DEF_MODULE="$($SUDO_CMD modprobe -n -v "$MODULE_NAME" 2>/dev/null | grep -E "$MODPROBE_FILTER" | tail -1 | xargs)"
-    fi
+        else
-}
+            DEF_MODULE="$($SUDO_CMD modprobe -n -v "$MODULE_NAME" 2>/dev/null | tail -1 | xargs)"
-is_kernel_module_disabled() {
+        fi
-    # check if a kernel module is disabled in the modprobe configuration
-    local MODULE_NAME="$1"
-    FNRET=1
 
-    local module_is_disabled=0
+        if [ "$DEF_MODULE" == "install /bin/true" ] || [ "$DEF_MODULE" == "install /bin/false" ]; then
-    # is it blacklisted ?
+            debug "$MODULE_NAME is disabled (blacklist with override)"
-    if grep -qE "\s?+[^#]?blacklist\s+$MODULE_NAME\s?$" /etc/modprobe.d/*.conf; then
+            FNRET=1
-        debug "$MODULE_NAME is blacklisted"
+        elif [ "$DEF_MODULE" == "" ]; then
-        module_is_disabled=1
+            debug "$MODULE_NAME is disabled"
-    # maybe it is overriden ? check files in /etc/modprobe.d/ for "install xyz /bin/(true|false)"
+            FNRET=1
-    elif grep -qE "\s?+[^#]?install\s+$MODULE_NAME\s+/bin/(true|false)\s?$" /etc/modprobe.d/*.conf; then
+        else
-        debug "$MODULE_NAME is disabled"
+            debug "$MODULE_NAME is enabled"
-        module_is_disabled=1
-    fi
-
-    if [ "$module_is_disabled" -eq 1 ]; then
-        debug "$MODULE_NAME is disabled in modprobe config"
-        FNRET=0
-    fi
-}
-
-is_kernel_module_available() {
-    # check if a kernel module is loadable, in a non monolithic kernel
-
-    local KERNEL_OPTION="$1"
-    FNRET=1
-
-    is_kernel_monolithic
-    if [ "$IS_MONOLITHIC_KERNEL" -eq 0 ]; then
-        info "your kernel is monolithic, no need to check for module availability"
-        return
-    fi
-
-    # look if a module is present as a loadable module in ANY available kernel, per CIS recommendation
-    # shellcheck disable=2013
-    for config_file in $($SUDO_CMD grep -l "^$KERNEL_OPTION=" /boot/config-*); do
-        module_config=$($SUDO_CMD grep "^$KERNEL_OPTION=" "$config_file" | cut -d= -f 2)
-        if [ "$module_config" == 'm' ]; then
-            debug "\"${KERNEL_OPTION}=m\" found in $config_file as module"
             FNRET=0
         fi
-    done
-}
 
-is_kernel_module_loaded() {
+        if [ "$($SUDO_CMD lsmod | grep -E "$MODULE_NAME" 2>/dev/null)" != "" ]; then
-    # check if a kernel module is actually loaded
+            debug "$MODULE_NAME is enabled"
-    local KERNEL_OPTION="$1"
+            FNRET=0
-    local LOADED_MODULE_NAME="$2"
+        fi
-    FNRET=1
-
-    is_kernel_monolithic
-    if [ "$IS_MONOLITHIC_KERNEL" -eq 0 ]; then
-        # check if module is compiled
-        # if yes, then it is loaded
-        is_kernel_option_enabled "$KERNEL_OPTION"
-    elif $SUDO_CMD grep -w "$LOADED_MODULE_NAME" /proc/modules >/dev/null 2>&1; then
-        debug "$LOADED_MODULE_NAME is loaded in the running kernel in /proc/modules"
-        FNRET=0 # Found!
     fi
 }
 
@@ -586,7 +572,11 @@ get_debian_major_version() {
     DEB_MAJ_VER=""
     does_file_exist /etc/debian_version
     if [ "$FNRET" = 0 ]; then
-        DEB_MAJ_VER=$(cut -d '.' -f1 /etc/debian_version)
+        if grep -q "sid" /etc/debian_version; then
+            DEB_MAJ_VER="sid"
+        else
+            DEB_MAJ_VER=$(cut -d '.' -f1 /etc/debian_version)
+        fi
     else
         # shellcheck disable=2034
         DEB_MAJ_VER=$(lsb_release -r | cut -f2 | cut -d '.' -f 1)

tests/docker/Dockerfile.debian10

@@ -0,0 +1,22 @@
+FROM debian:buster
+
+LABEL vendor="OVH"
+LABEL project="debian-cis"
+LABEL url="https://github.com/ovh/debian-cis"
+LABEL description="This image is used to run tests"
+
+RUN groupadd -g 500 secaudit && useradd  -u 500 -g 500 -s /bin/bash secaudit && install -m 700 -o secaudit -g secaudit -d /home/secaudit
+
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y openssh-server sudo syslog-ng net-tools auditd
+
+COPY --chown=500:500 . /opt/debian-cis/
+
+COPY debian/default /etc/default/cis-hardening
+RUN sed -i 's#cis-hardening#debian-cis#' /etc/default/cis-hardening
+
+COPY cisharden.sudoers /etc/sudoers.d/secaudit
+RUN sed -i 's#cisharden#secaudit#' /etc/sudoers.d/secaudit
+
+
+ENTRYPOINT ["/opt/debian-cis/tests/launch_tests.sh"]
+

tests/hardening/acc_logindefs_sha512.sh

@@ -36,4 +36,35 @@ test_audit() {
     register_test contain "is present in /etc/login.defs"
     run sha512pass "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
 
+    # DEB_MAJ_VER cannot be overwritten here;
+    # therefore we need to trick get_debian_major_version
+    ORIGINAL_DEB_VER="$(cat /etc/debian_version)"
+    echo "sid" >/etc/debian_version
+
+    describe Running on blank host as sid
+    register_test retvalshouldbe 0
+    register_test contain "(SHA512|yescrypt|YESCRYPT)"
+    # shellcheck disable=2154
+    run blanksid "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    cp /etc/login.defs /tmp/login.defs.bak
+    sed -ir 's/ENCRYPT_METHOD[[:space:]]\+.*/ENCRYPT_METHOD MD5/' /etc/login.defs
+
+    describe Fail: wrong hash function configuration as sid
+    register_test retvalshouldbe 1
+    register_test contain "(SHA512|yescrypt|YESCRYPT)"
+    run wrongconfsid "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe Correcting situation as sid
+    sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
+    "${CIS_CHECKS_DIR}/${script}.sh" || true
+
+    describe Checking resolved state as sid
+    register_test retvalshouldbe 0
+    register_test contain "(SHA512|yescrypt|YESCRYPT)"
+    run sha512passsid "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    # Cleanup
+    echo -n "$ORIGINAL_DEB_VER" >/etc/debian_version
+    unset ORIGINAL_DEB_VER
 }

tests/hardening/acc_pam_sha512.sh

@@ -21,6 +21,35 @@ test_audit() {
     describe Checking resolved state
     register_test retvalshouldbe 0
     register_test contain "is present in /etc/pam.d/common-password"
-    run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+    run solvedsid "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
 
+    # DEB_MAJ_VER cannot be overwritten here;
+    # therefore we need to trick get_debian_major_version
+    ORIGINAL_DEB_VER="$(cat /etc/debian_version)"
+    echo "sid" >/etc/debian_version
+
+    describe Running on blank host as sid
+    register_test retvalshouldbe 0
+    register_test contain "(sha512|yescrypt)"
+    run blanksid "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe Tests purposely failing as sid
+    sed -i '/pam_unix.so/ s/sha512/sha256/' "/etc/pam.d/common-password"   # Debian 10
+    sed -i '/pam_unix.so/ s/yescrypt/sha256/' "/etc/pam.d/common-password" # Debian 11+
+    register_test retvalshouldbe 1
+    register_test contain "is not present"
+    run noncompliantsid "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    describe correcting situation as sid
+    sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
+    "${CIS_CHECKS_DIR}/${script}.sh" --apply || true
+
+    describe Checking resolved state as sid
+    register_test retvalshouldbe 0
+    register_test contain "is present in /etc/pam.d/common-password"
+    run solvedsid "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
+
+    # Cleanup
+    echo -n "$ORIGINAL_DEB_VER" >/etc/debian_version
+    unset ORIGINAL_DEB_VER
 }