debian-cis/debian/changelog

cis-hardening (1.3-4) unstable; urgency=medium

  * ADD(1.3.1): Install Ossec
  * ADD(4.2.3): Syslog-ng install
  * ADD(4.2.4): Logs permissions
  * ADD(5.2.2, 5.2.3): SSH host keys permissions and ownership
  * ADD(5.2.17): SSHD login grace time


 -- Thibault AYANIDES <tayanide@ovhcloud.com>  Mon, 19 Oct 2020 16:31:48 +0200

cis-hardening (1.3-3) unstable; urgency=medium

  * changelog: update changelog
  * IMP(12.8,12.9,12.10,12.11): be able to exclude some paths

 -- Benjamin MONTHOUËL <benjamin.monthouel@ovhcloud.com>  Mon, 30 Mar 2020 19:12:03 +0200

cis-hardening (1.3-2) unstable; urgency=medium

  * IMP(test/13.12): ignore the phony '/nonexistent' home folder

 -- Stéphane Lesimple <stephane.lesimple@corp.ovh.com>  Tue, 22 Oct 2019 15:15:34 +0200

cis-hardening (1.3-1) unstable; urgency=medium

  * Change of version numbering

 -- Charles Herlin <charles.herlin@corp.ovh.com>  Wed, 28 Aug 2019 14:57:33 +0200

cis-hardening (1.2-6) unstable; urgency=medium

  * FIX(test/10.2): backup and restore /etc/passwd after test
  * IMP(99.3.1): improve check with disabled passwords
  * FIX(10.2): improve test to check multiple login shells

 -- Charles Herlin <charles.herlin@corp.ovh.com>  Wed, 28 Aug 2019 12:34:52 +0200

cis-hardening (1.2-5) unstable; urgency=medium

  * fix(99.4): do not stderr iptables warning on buster

 -- Kevin Tanguy <kevin.tanguy@ovh.net>  Wed, 14 Aug 2019 10:34:15 +0200

cis-hardening (1.2-4) unstable; urgency=medium

  * changelog: update changelog
  * FIX(99.1): remove dot in files to search
  * FIX(13.15): fix code that did not show duplicated group
  * FIX(99.5.4): fix regex to allow other authkey options than "from"
  * FIX(batch): sed \n to space in batch echo

 -- Charles Herlin <charles.herlin@corp.ovh.com>  Thu, 04 Apr 2019 16:14:44 +0200

cis-hardening (1.2-3) unstable; urgency=medium

  * Debian release 1.2-3
  * 99.5.4: add conf to check only listed users (bastions)

 -- Kevin Tanguy <kevin.tanguy@ovh.net>  Wed, 06 Mar 2019 08:29:30 +0100

cis-hardening (1.2-2) unstable; urgency=medium

  * Debian release 1.2-2
  * FIX(8.2.4): script crashed when touching a logfile in subdir of /var/log
  * IMP(8.2.4): add exceptions in check and apply
  * IMP(8.2.5): follow symlinks in find
  * FIX(8.3.2): add $SUDO_CMD to find
  * FIX(8.2.5): grep: x is a directory
  * FEAT(2.6.x): retrieve actual partition in case if bind mount
  * CHORE: replace `==` with `=` that is bash syntax
  * CHORE(test 8.2.5): removed useless cleanup line
  * FIX(9.3.2): dismiss test for initial after e7d9977
  * FIX(12.1x): fix tests exception for mail after da6acb0b
  * CHORE(2.1x): use "readlink -e" instead of custom func
  * IMP(9.3.2): Comply with Debian9 guide: verbose ssh loglevel
  * IMP(13.13): improve exception detection
  * IMP(9.3.2): Add custom configuration management
  * IMP(13.13): Add exceptions for home directories not owned by owner
  * IMP(8.2.5): find multiline pattern in files (syslog)
  * IMP(2.1x): Retrieve actual partition when symlink
  * FIX(tests): change sed to audit in test skeleton after 81f9348
  * FIX CONFIG_AUDIT test

 -- Kevin Tanguy <kevin.tanguy@ovh.net>  Thu, 28 Feb 2019 12:55:15 +0100

cis-hardening (1.2-1) unstable; urgency=medium

  * CHORE(tests): cleanup test files
  * FIX(tests): change sed in conf file disabled->audit following d6172ad
  * CHORE(tests): Cleanup test files
  * FIX(tests): improve test cases and cleanup
  * FIX(99.2): add missing $SUDO_CMD
  * FIX(sudoers): add missing `test`
  * FIX(test): catch return values when retval differs to avoid runtime error
  * Add test stub for all audit checks, to tests root/sudo consistency
  * Rename dismiss_test to skip_tests since test won't even run in this case
  * dismiss_count will still report failed root/sudo consistency failure
  * properly purge remaining config files on purge
  * Change default status to audit for file with custom `create_config`
  * Change default status disabled -> audit when no conf file
  * FIX package name in example-cron.d-entry
  * Improve user management in test cases
  * IMP: enhance scripts that check duplicate UID
  * FIX: usage if no RUN_MODE, fix only that used to run too many checks
  * changelog: Update to 1.2-1 (go cds go)
  * Migrate generic checks from secaudit to cis-hardening
  * Add crontab
  * FIX: add becho to send batch output to syslog too
  * Update debian 7/8/9 in help files and remove in generic scripts
  * IMP: sort find result by name and version to ease reading
  * FIX: remove "exernal-sources" option when running shellcheck
  * Add shellcheck recommendation
  * FIX: add way of completely skipping test that bugged with jessie
  * Fix typo in test skeleton and add shellcheck comment
  * FIX: bug crashing for undeclared variable when consitency checks failed
  * IMP: tests readability and runtime error handling
  * IMP: new tag in file to tell that the script should pass shellcheck
  * FIX: tests return value that was always 255
  * FIX: quotes in find command, misinterpreted shellcheck advice
  * FEAT: Add sudo_wrapper to catch unauthorized sudo commands
  * FEAT: automate shellcheck test with docker
  * FIX: sed that was too greedy
  * Add missing /usr/bin/su
  * FIX: add /usr/bin/* path for suid/guid allowed binaries
  * Adding batch mode to output just one line of text (no colors) in order to be parsed by computer tools
  * Change from CIS reco and only warn (no crit) if logfile does not exist
  * IMP(test): Add feature to run functional tests in docker instance
  * Improve --only option to perform only specified test and no other lookalike test number
  * Redirect stderr to avoid printing "no such file" error
  * resolve #SOC-30 Also check /etc/security/limits.d/ for core dump limit
  * Fix SOC-28, add test if file exist, if not issue error
  * Add sudo management in main and utils

 -- Kevin Tanguy <kevin.tanguy@ovh.net>  Tue, 12 Feb 2019 11:39:44 +0100

cis-hardening (1.1-1) unstable; urgency=low

  * Add hardening templating and several enhancements
  * CIS_ROOT_DIR management
  * Update ciphers list in 9.3.11 with latest chacha20 and gcm ciphers
  * Debian packaging clean up

 -- Julien Delayen <julien.delayen@corp.ovh.com>  Fri, 02 Feb 2018 09:38:31 +0100

cis-hardening (1.0-11) jessie; urgency=low

  * fixed option name in 9.3.9_disable_sshd_permitemptypasswords.sh
  * [10.2] Fixed result parsing in case of spaces in passwd list
  * [Debian 8] Fixed comments for debian 8 compliance
  * [10.1.3] set the good value for $OPTIONS
  * set a fixed-size prefix for logger
  * handle ENOENT properly in does_pattern_exist_in_file\(\)

 -- Kevin Tanguy <kevin.tanguy@ovh.net>  Mon, 05 Jun 2017 14:32:56 +0200

cis-hardening (1.0-10) wheezy; urgency=low

  * Script output should be useful with pipe or redirection

 -- Kevin Tanguy <kevin.tanguy@ovh.net>  Wed, 18 May 2016 08:38:35 +0200

cis-hardening (1.0-9) wheezy; urgency=low

  * Fixed replace in file function with proper substitution
  * tripwire : fixed typo on postinstall helper
  * fix 99.1 Apply TMOUT Variable

 -- Kevin Tanguy <kevin.tanguy@ovh.net>  Tue, 03 May 2016 12:31:59 +0200

cis-hardening (1.0-8) wheezy; urgency=low

  * phrasing reworked all over the place
  * added debian dependencies bash and bc

 -- Kevin Tanguy <kevin.tanguy@ovh.net>  Tue, 26 Apr 2016 10:26:18 +0200

cis-hardening (1.0-7) wheezy; urgency=low

  * Fixed 6.15 netstat analysis

 -- Kevin Tanguy <kevin.tanguy@ovh.net>  Mon, 25 Apr 2016 09:18:30 +0200

cis-hardening (1.0-6) wheezy; urgency=low

  * corrected README.md CIS website address
  * corrected conffiles: etc/hardening.cfg was missing

 -- Kevin Tanguy <kevin.tanguy@ovh.net>  Fri, 22 Apr 2016 14:27:40 +0200

cis-hardening (1.0-5) wheezy; urgency=low

  * typo fix / phrasing reworked
  * Fixed default file error handling and quickstart
  * Fixed point 9.1.8 cron rights as a chmod 600 disabled the cron.allow
    features (file must be world readable)

 -- Kevin Tanguy <kevin.tanguy@ovh.net>  Fri, 22 Apr 2016 10:15:55 +0200

cis-hardening (1.0-4) wheezy; urgency=low

  * added AUTHORS file
  * s/README/README.md/ with more details
  * manpage extracted from README

 -- Kevin Tanguy <kevin.tanguy@ovh.net>  Thu, 21 Apr 2016 11:57:39 +0200

cis-hardening (1.0-3) wheezy; urgency=low

  * add --audit-all option
  * add --audit-all-enable-passed, add info in README and help
  * Added exit code to CIS_ROOT_DIR test def, optimized sed and sort
  * Fixed 8.2.4 check file exists before testing rights

 -- Kevin Tanguy <kevin.tanguy@ovh.net>  Wed, 20 Apr 2016 12:37:58 +0200

cis-hardening (1.0-2) wheezy; urgency=low

  * add LICENSE
  * duplicate README in /opt and /usr/share/doc
  * patch conffiles for new correct configuration files names

 -- Kevin Tanguy <kevin.tanguy@ovh.net>  Tue, 19 Apr 2016 14:31:03 +0200

cis-hardening (1.0-1) stable; urgency=low

  * Initial release.

 -- Kevin Tanguy <kevin.tanguy@ovh.net>  Mon, 18 Apr 2016 17:13:07 +0200