cis-hardening (1.2-4) unstable; urgency=medium * changelog: update changelog * FIX(99.1): remove dot in files to search * FIX(13.15): fix code that did not show duplicated group * FIX(99.5.4): fix regex to allow other authkey options than "from" * FIX(batch): sed \n to space in batch echo -- Charles Herlin Thu, 04 Apr 2019 16:14:44 +0200 cis-hardening (1.2-3) unstable; urgency=medium * Debian release 1.2-3 * 99.5.4: add conf to check only listed users (bastions) -- Kevin Tanguy Wed, 06 Mar 2019 08:29:30 +0100 cis-hardening (1.2-2) unstable; urgency=medium * Debian release 1.2-2 * FIX(8.2.4): script crashed when touching a logfile in subdir of /var/log * IMP(8.2.4): add exceptions in check and apply * IMP(8.2.5): follow symlinks in find * FIX(8.3.2): add $SUDO_CMD to find * FIX(8.2.5): grep: x is a directory * FEAT(2.6.x): retrieve actual partition in case if bind mount * CHORE: replace `==` with `=` that is bash syntax * CHORE(test 8.2.5): removed useless cleanup line * FIX(9.3.2): dismiss test for initial after e7d9977 * FIX(12.1x): fix tests exception for mail after da6acb0b * CHORE(2.1x): use "readlink -e" instead of custom func * IMP(9.3.2): Comply with Debian9 guide: verbose ssh loglevel * IMP(13.13): improve exception detection * IMP(9.3.2): Add custom configuration management * IMP(13.13): Add exceptions for home directories not owned by owner * IMP(8.2.5): find multiline pattern in files (syslog) * IMP(2.1x): Retrieve actual partition when symlink * FIX(tests): change sed to audit in test skeleton after 81f9348 * FIX CONFIG_AUDIT test -- Kevin Tanguy Thu, 28 Feb 2019 12:55:15 +0100 cis-hardening (1.2-1) unstable; urgency=medium * CHORE(tests): cleanup test files * FIX(tests): change sed in conf file disabled->audit following d6172ad * CHORE(tests): Cleanup test files * FIX(tests): improve test cases and cleanup * FIX(99.2): add missing $SUDO_CMD * FIX(sudoers): add missing `test` * FIX(test): catch return values when retval differs to avoid runtime error * Add test stub for all audit checks, to tests root/sudo consistency * Rename dismiss_test to skip_tests since test won't even run in this case * dismiss_count will still report failed root/sudo consistency failure * properly purge remaining config files on purge * Change default status to audit for file with custom `create_config` * Change default status disabled -> audit when no conf file * FIX package name in example-cron.d-entry * Improve user management in test cases * IMP: enhance scripts that check duplicate UID * FIX: usage if no RUN_MODE, fix only that used to run too many checks * changelog: Update to 1.2-1 (go cds go) * Migrate generic checks from secaudit to cis-hardening * Add crontab * FIX: add becho to send batch output to syslog too * Update debian 7/8/9 in help files and remove in generic scripts * IMP: sort find result by name and version to ease reading * FIX: remove "exernal-sources" option when running shellcheck * Add shellcheck recommendation * FIX: add way of completely skipping test that bugged with jessie * Fix typo in test skeleton and add shellcheck comment * FIX: bug crashing for undeclared variable when consitency checks failed * IMP: tests readability and runtime error handling * IMP: new tag in file to tell that the script should pass shellcheck * FIX: tests return value that was always 255 * FIX: quotes in find command, misinterpreted shellcheck advice * FEAT: Add sudo_wrapper to catch unauthorized sudo commands * FEAT: automate shellcheck test with docker * FIX: sed that was too greedy * Add missing /usr/bin/su * FIX: add /usr/bin/* path for suid/guid allowed binaries * Adding batch mode to output just one line of text (no colors) in order to be parsed by computer tools * Change from CIS reco and only warn (no crit) if logfile does not exist * IMP(test): Add feature to run functional tests in docker instance * Improve --only option to perform only specified test and no other lookalike test number * Redirect stderr to avoid printing "no such file" error * resolve #SOC-30 Also check /etc/security/limits.d/ for core dump limit * Fix SOC-28, add test if file exist, if not issue error * Add sudo management in main and utils -- Kevin Tanguy Tue, 12 Feb 2019 11:39:44 +0100 cis-hardening (1.1-1) unstable; urgency=low * Add hardening templating and several enhancements * CIS_ROOT_DIR management * Update ciphers list in 9.3.11 with latest chacha20 and gcm ciphers * Debian packaging clean up -- Julien Delayen Fri, 02 Feb 2018 09:38:31 +0100 cis-hardening (1.0-11) jessie; urgency=low * fixed option name in 9.3.9_disable_sshd_permitemptypasswords.sh * [10.2] Fixed result parsing in case of spaces in passwd list * [Debian 8] Fixed comments for debian 8 compliance * [10.1.3] set the good value for $OPTIONS * set a fixed-size prefix for logger * handle ENOENT properly in does_pattern_exist_in_file\(\) -- Kevin Tanguy Mon, 05 Jun 2017 14:32:56 +0200 cis-hardening (1.0-10) wheezy; urgency=low * Script output should be useful with pipe or redirection -- Kevin Tanguy Wed, 18 May 2016 08:38:35 +0200 cis-hardening (1.0-9) wheezy; urgency=low * Fixed replace in file function with proper substitution * tripwire : fixed typo on postinstall helper * fix 99.1 Apply TMOUT Variable -- Kevin Tanguy Tue, 03 May 2016 12:31:59 +0200 cis-hardening (1.0-8) wheezy; urgency=low * phrasing reworked all over the place * added debian dependencies bash and bc -- Kevin Tanguy Tue, 26 Apr 2016 10:26:18 +0200 cis-hardening (1.0-7) wheezy; urgency=low * Fixed 6.15 netstat analysis -- Kevin Tanguy Mon, 25 Apr 2016 09:18:30 +0200 cis-hardening (1.0-6) wheezy; urgency=low * corrected README.md CIS website address * corrected conffiles: etc/hardening.cfg was missing -- Kevin Tanguy Fri, 22 Apr 2016 14:27:40 +0200 cis-hardening (1.0-5) wheezy; urgency=low * typo fix / phrasing reworked * Fixed default file error handling and quickstart * Fixed point 9.1.8 cron rights as a chmod 600 disabled the cron.allow features (file must be world readable) -- Kevin Tanguy Fri, 22 Apr 2016 10:15:55 +0200 cis-hardening (1.0-4) wheezy; urgency=low * added AUTHORS file * s/README/README.md/ with more details * manpage extracted from README -- Kevin Tanguy Thu, 21 Apr 2016 11:57:39 +0200 cis-hardening (1.0-3) wheezy; urgency=low * add --audit-all option * add --audit-all-enable-passed, add info in README and help * Added exit code to CIS_ROOT_DIR test def, optimized sed and sort * Fixed 8.2.4 check file exists before testing rights -- Kevin Tanguy Wed, 20 Apr 2016 12:37:58 +0200 cis-hardening (1.0-2) wheezy; urgency=low * add LICENSE * duplicate README in /opt and /usr/share/doc * patch conffiles for new correct configuration files names -- Kevin Tanguy Tue, 19 Apr 2016 14:31:03 +0200 cis-hardening (1.0-1) stable; urgency=low * Initial release. -- Kevin Tanguy Mon, 18 Apr 2016 17:13:07 +0200