mirror of
https://github.com/ovh/debian-cis.git
synced 2025-07-15 21:32:17 +02:00
68f629ed36
- "users_homedir_is_configured.sh" is a concatenation of different existing scripts:
- [users_homedir_exist.sh](https://github.com/ovh/debian-cis/blob/master/bin/hardening/users_homedir_exist.sh)
- [users_homedir_ownership.sh](https://github.com/ovh/debian-cis/blob/master/bin/hardening/users_homedir_ownership.sh)
- [check_user_dir_perm.sh](https://github.com/ovh/debian-cis/blob/master/bin/hardening/check_user_dir_perm.sh)
And so is its test
It will be mapped as 7.2.9 for debian 12
- The following scripts are a split from [5.3.1_enable_pwquality.sh](https://github.com/ovh/debian-cis/blob/master/bin/hardening/enable_pwquality.sh):
- enable_libpam_pwquality.sh -> will be mapped as 5.3.2.3
- install_libpam_pwquality.sh -> will be mapped as 5.3.1.3
- password_complexity.sh -> will be mapped as 5.3.3.2.3
- password_min_length.sh -> will be mapped as 5.3.3.2.2
The others are scripts are new.
They will be mapped as follow for debian 12 CIS :
- apt_gpg_is_configured.sh -> 1.2.1.1
- dev_shm_separate_partition.sh -> 1.2.2.1
- install_iptables.sh -> 4.3.1.1
- install_nftables.sh -> 4.2.1
- password_consecutive_characters.sh -> 5.3.3.2.4
- password_max_sequential_characters.sh -> 5.3.3.2.5
89 lines
2.9 KiB
Bash
89 lines
2.9 KiB
Bash
# shellcheck shell=bash
|
|
# run-shellcheck
|
|
test_audit() {
|
|
local no_home_test_user="userwithouthome"
|
|
local owner_test_user="testhomeuser"
|
|
local perm_test_user="testhomepermuser"
|
|
|
|
describe Running on blank host
|
|
register_test retvalshouldbe 0
|
|
# shellcheck disable=2154
|
|
run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
|
|
|
|
home_dir_missing "$no_home_test_user"
|
|
home_dir_ownership "$owner_test_user"
|
|
home_dir_perm "$perm_test_user"
|
|
|
|
fix_home "$no_home_test_user" "$owner_test_user" "$perm_test_user"
|
|
|
|
describe Checking resolved state
|
|
register_test retvalshouldbe 0
|
|
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
|
|
|
|
cleanup "$no_home_test_user" "$owner_test_user" "$perm_test_user"
|
|
}
|
|
|
|
home_dir_missing() {
|
|
local test_user="$1"
|
|
|
|
useradd -d /home/"$test_user" "$test_user"
|
|
describe Tests purposely failing that a homdedir does not exists
|
|
register_test retvalshouldbe 1
|
|
register_test contain "does not exist."
|
|
run noncompliant "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
|
|
}
|
|
|
|
home_dir_ownership() {
|
|
local test_user="$1"
|
|
|
|
describe Test purposely failing that a user does not own its home
|
|
useradd -d /home/"$test_user" -m "$test_user"
|
|
chown root:root /home/"$test_user"
|
|
chmod 0750 /home/"$test_user"
|
|
register_test retvalshouldbe 1
|
|
register_test contain "[ KO ] The home directory (/home/$test_user) of user $test_user is owned by root"
|
|
run noncompliant "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
|
|
}
|
|
|
|
home_dir_perm() {
|
|
local test_user="$1"
|
|
|
|
describe Tests purposely failing for wrong permissions on home
|
|
useradd -d /home/"$test_user" --create-home "$test_user"
|
|
chmod 777 /home/"$test_user"
|
|
register_test retvalshouldbe 1
|
|
register_test contain "Group Write permission set on directory"
|
|
register_test contain "Other Read permission set on directory"
|
|
register_test contain "Other Write permission set on directory"
|
|
register_test contain "Other Execute permission set on directory"
|
|
|
|
run noncompliant "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
|
|
}
|
|
|
|
fix_home() {
|
|
local missing_home_test_user="$1"
|
|
local owner_test_user="$2"
|
|
local perm_test_user="$3"
|
|
|
|
describe correcting situation for missing home
|
|
install -d -m 0750 -o "$missing_home_test_user" /home/"$missing_home_test_user"
|
|
|
|
describe correcting situation for ownership
|
|
# we don't want to erase default configurations, or others checks could fail
|
|
# shellcheck disable=2086
|
|
sed -i '/^HOME_OWNER_EXCEPTIONS/s|HOME_OWNER_EXCEPTIONS=\"|HOME_OWNER_EXCEPTIONS=\"/home/'$owner_test_user':'$owner_test_user':root |' ${CIS_CONF_DIR}/conf.d/${script}.cfg
|
|
|
|
describe correcting situation for permissions
|
|
chmod 0750 /home/"$perm_test_user"
|
|
|
|
}
|
|
|
|
cleanup() {
|
|
local users="$*"
|
|
for user in $users; do
|
|
# owner_test_user del will fail as its home is owned by another user
|
|
userdel -r "$user" || true
|
|
rm -rf /home/"${user:?}" || true
|
|
done
|
|
}
|