mirror of
https://github.com/ovh/debian-cis.git
synced 2025-07-15 21:32:17 +02:00
68f629ed36
- "users_homedir_is_configured.sh" is a concatenation of different existing scripts:
- [users_homedir_exist.sh](https://github.com/ovh/debian-cis/blob/master/bin/hardening/users_homedir_exist.sh)
- [users_homedir_ownership.sh](https://github.com/ovh/debian-cis/blob/master/bin/hardening/users_homedir_ownership.sh)
- [check_user_dir_perm.sh](https://github.com/ovh/debian-cis/blob/master/bin/hardening/check_user_dir_perm.sh)
And so is its test
It will be mapped as 7.2.9 for debian 12
- The following scripts are a split from [5.3.1_enable_pwquality.sh](https://github.com/ovh/debian-cis/blob/master/bin/hardening/enable_pwquality.sh):
- enable_libpam_pwquality.sh -> will be mapped as 5.3.2.3
- install_libpam_pwquality.sh -> will be mapped as 5.3.1.3
- password_complexity.sh -> will be mapped as 5.3.3.2.3
- password_min_length.sh -> will be mapped as 5.3.3.2.2
The others are scripts are new.
They will be mapped as follow for debian 12 CIS :
- apt_gpg_is_configured.sh -> 1.2.1.1
- dev_shm_separate_partition.sh -> 1.2.2.1
- install_iptables.sh -> 4.3.1.1
- install_nftables.sh -> 4.2.1
- password_consecutive_characters.sh -> 5.3.3.2.4
- password_max_sequential_characters.sh -> 5.3.3.2.5
41 lines
1.4 KiB
Bash
41 lines
1.4 KiB
Bash
# shellcheck shell=bash
|
|
# run-shellcheck
|
|
test_audit() {
|
|
local APT_KEY_FILE="/etc/apt/trusted.gpg"
|
|
local APT_KEY_PATH="/etc/apt/trusted.gpg.d"
|
|
local unsecure_source="/etc/apt/sources.list.d/unsecure.list"
|
|
local unsecure_conf_file="/etc/apt/apt.conf.d/unsecure"
|
|
|
|
# make sure we don't have any key
|
|
[ -f "$APT_KEY_FILE" ] && mv "$APT_KEY_FILE" /tmp
|
|
[ -d "$APT_KEY_PATH" ] && mv "$APT_KEY_PATH" /tmp
|
|
|
|
describe Running non compliant missing keys
|
|
register_test retvalshouldbe 1
|
|
# shellcheck disable=2154
|
|
run noncompliant "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
|
|
|
|
# fix the situation
|
|
[ -d /tmp/trusted.gpg.d ] && mv /tmp/trusted.gpg.d /etc/apt/
|
|
[ -f /tmp/trusted.gpg ] && mv /tmp/trusted.gpg /etc/apt/
|
|
|
|
describe Checking resolved state
|
|
register_test retvalshouldbe 0
|
|
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
|
|
|
|
echo 'deb [allow-insecure=yes] http://deb.debian.org/debian bookworm main' >"$unsecure_source"
|
|
describe Running non compliant unsecure option in sources list
|
|
register_test retvalshouldbe 1
|
|
run noncompliant "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
|
|
|
|
rm -f "$unsecure_source"
|
|
|
|
echo 'Acquire::AllowInsecureRepositories=true' >"$unsecure_conf_file"
|
|
describe Running non compliant unsecure option in apt conf
|
|
register_test retvalshouldbe 1
|
|
run noncompliant "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
|
|
|
|
rm -f "$unsecure_conf_file"
|
|
|
|
}
|