Update changelog

The bug (introduced in 2.1-2) leaded to an error in the test that evaluates forcedstatus

bin/hardening/5.2.3_ssh_host_public_keys_perm_ownership.sh

@@ -32,8 +32,13 @@ audit () {
             if [ $FNRET = 0 ]; then
                 ok "$FILE permissions were set to $PERMISSIONS"
             else
-                ERRORS=$((ERRORS+1))
+                has_file_correct_permissions $FILE 600
-                crit "$FILE permissions were not set to $PERMISSIONS"
+                if [ $FNRET = 0 ]; then
+                    ok "$FILE permissions were set to $PERMISSIONS"
+                else
+                    ERRORS=$((ERRORS+1))
+                    crit "$FILE permissions were not set to $PERMISSIONS"
+                fi
             fi
         fi
 
@@ -73,8 +78,13 @@ apply () {
             if [ $FNRET = 0 ]; then
                 ok "$FILE permissions were set to $PERMISSIONS"
             else
-                warn "fixing $DIR SSH public keys permissions to $USER:$GROUP"
+                has_file_correct_permissions $FILE 600
-                chmod 0$PERMISSIONS $FILE
+                if [ $FNRET = 0 ]; then
+                    ok "$FILE permissions were set to $PERMISSIONS"
+                else
+                    warn "fixing $DIR SSH public keys permissions to $USER:$GROUP"
+                    chmod 0$PERMISSIONS $FILE
+                fi
             fi
         fi
     done

debian/changelog

@@ -1,3 +1,10 @@
+cis-hardening (2.1-3) unstable; urgency=medium
+
+  * Fix permissions on 5.2.3 (authorize 600)
+  * Fix minor bug with --create-config-files-only
+
+ -- Thibault Ayanides <tayanide@ovhcloud.com>  Mon, 30 Nov 2020 15:14:17 +0100
+
 cis-hardening (2.1-2) unstable; urgency=medium
 
   * Add --create-config-files-only mode that only create config files without running audit

lib/main.sh

@@ -69,7 +69,7 @@ if ! [ -r $CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg ] ; then
 
 fi
 
-if [ $forcedstatus = "createconfig" ]; then
+if [ "$forcedstatus" = "createconfig" ] ; then
     debug "$CIS_ROOT_DIR/etc/conf.d/$SCRIPT_NAME.cfg has been created"
     exit 0
 fi