bump to 3.5-1 (#152)

Signed-off-by: Tarik Megzari <tarik.megzari@corp.ovh.com>

.github/workflows/compile-manual.yml

@@ -10,7 +10,7 @@ jobs:
         uses: actions/checkout@v3
       - name: Produce debian man
         run: 'docker run --rm --volume "`pwd`:/data" --user `id -u`:`id -g` pandoc/latex:2.6 MANUAL.md -s -t man > debian/cis-hardening.8'
-      - uses: EndBug/add-and-commit@v8.0.2
+      - uses: EndBug/add-and-commit@v9
         with:
           add: 'debian/cis-hardening.8'
           message: 'Regenerate man pages (Github action)'

bin/hardening/3.5.4.1.1_net_fw_default_policy_drop.sh

@@ -21,6 +21,7 @@ PACKAGE="iptables"
 FW_CHAINS="INPUT FORWARD"
 FW_POLICY="DROP"
 FW_CMD="iptables"
+FW_TIMEOUT="10"
 
 # This function will be called if the script status is on enabled / audit mode
 audit() {
@@ -28,7 +29,7 @@ audit() {
     if [ "$FNRET" != 0 ]; then
         crit "$PACKAGE is not installed!"
     else
-        ipt=$($SUDO_CMD "$FW_CMD" -nL 2>/dev/null || true)
+        ipt=$($SUDO_CMD "$FW_CMD" -w "$FW_TIMEOUT" -nL 2>/dev/null || true)
         if [[ -z "$ipt" ]]; then
             crit "Empty return from $FW_CMD command. Aborting..."
             return

bin/hardening/6.1.6_etc_passwd-_permissions.sh

@@ -19,6 +19,7 @@ DESCRIPTION="Check 600 permissions and root:root ownership on /etc/passwd-"
 
 FILE='/etc/passwd-'
 PERMISSIONS='600'
+PERMISSIONSOK='644 640 600'
 USER='root'
 GROUP='root'
 
@@ -28,7 +29,7 @@ audit() {
     if [ "$FNRET" != 0 ]; then
         ok "$FILE does not exist"
     else
-        has_file_correct_permissions "$FILE" "$PERMISSIONS"
+        has_file_one_of_permissions "$FILE" "$PERMISSIONSOK"
         if [ "$FNRET" = 0 ]; then
             ok "$FILE has correct permissions"
         else

bin/hardening/6.1.7_etc_shadow-_permissions.sh

@@ -19,6 +19,7 @@ DESCRIPTION="Check 600 permissions and root:shadow ownership on /etc/shadow-"
 
 FILE='/etc/shadow-'
 PERMISSIONS='600'
+PERMISSIONSOK='640 600'
 USER='root'
 GROUP='shadow'
 
@@ -28,7 +29,7 @@ audit() {
     if [ "$FNRET" != 0 ]; then
         ok "$FILE does not exist"
     else
-        has_file_correct_permissions "$FILE" "$PERMISSIONS"
+        has_file_one_of_permissions "$FILE" "$PERMISSIONSOK"
         if [ "$FNRET" = 0 ]; then
             ok "$FILE has correct permissions"
         else

bin/hardening/6.1.8_etc_group-_permissions.sh

@@ -19,6 +19,7 @@ DESCRIPTION="Check 600 permissions and root:root ownership on /etc/group-"
 
 FILE='/etc/group-'
 PERMISSIONS='600'
+PERMISSIONSOK='644 640 600'
 USER='root'
 GROUP='root'
 
@@ -28,7 +29,7 @@ audit() {
     if [ "$FNRET" != 0 ]; then
         ok "$FILE does not exist"
     else
-        has_file_correct_permissions "$FILE" "$PERMISSIONS"
+        has_file_one_of_permissions "$FILE" "$PERMISSIONSOK"
         if [ "$FNRET" = 0 ]; then
             ok "$FILE has correct permissions"
         else

debian/changelog

@@ -1,3 +1,15 @@
+cis-hardening (3.5-1) unstable; urgency=medium
+
+  * fix: add 10s wait timeout on iptables command (#151)
+
+ -- Tarik Megzari <tarik.megzari@corp.ovh.com>  Wed, 23 Mar 2022 17:28:08 +0100
+
+cis-hardening (3.4-1) unstable; urgency=medium
+
+  * fix: allow passwd-, group- and shadow- debian default permissions (#149)
+
+ -- Thibault Dewailly <thibault.dewailly@ovhcloud.com>  Fri, 18 Mar 2022 15:43:24 +0000
+
 cis-hardening (3.3-1) unstable; urgency=medium
 
   * fix: missing shadowtools backup files is ok (#132)

tests/hardening/6.1.6_etc_passwd-_permissions.sh

@@ -10,6 +10,13 @@ test_audit() {
     local test_user="testetcpasswd-user"
     local test_file="/etc/passwd-"
 
+    describe Debian default right shall be accepted
+    chmod 644 "$test_file"
+    chown root:root "$test_file"
+    register_test retvalshouldbe 0
+    register_test contain "has correct permissions"
+    run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
     describe Tests purposely failing
     chmod 777 "$test_file"
     register_test retvalshouldbe 1

tests/hardening/6.1.7_etc_shadow-_permissions.sh

@@ -10,6 +10,13 @@ test_audit() {
     local test_user="testetcshadow-user"
     local test_file="/etc/shadow-"
 
+    describe Debian default right shall be accepted
+    chmod 640 "$test_file"
+    chown root:shadow "$test_file"
+    register_test retvalshouldbe 0
+    register_test contain "has correct permissions"
+    run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
     describe Tests purposely failing
     chmod 777 "$test_file"
     register_test retvalshouldbe 1

tests/hardening/6.1.8_etc_group-_permissions.sh

@@ -10,6 +10,13 @@ test_audit() {
     local test_user="testetcgroup--user"
     local test_file="/etc/group-"
 
+    describe Debian default right shall be accepted
+    chmod 644 "$test_file"
+    chown root:root "$test_file"
+    register_test retvalshouldbe 0
+    register_test contain "has correct permissions"
+    run resolved /opt/debian-cis/bin/hardening/"${script}".sh --audit-all
+
     describe Tests purposely failing
     chmod 777 "$test_file"
     register_test retvalshouldbe 1