Skip to content

Commit 51b7a3c

Browse files
author
damien cavagnini
committed
feat: add new debian12 scripts
- journald_log_file_access.sh -> 6.2.1.1.2 - journald_log_rotation.sh -> 6.2.1.1.3 - audit_log_user.sh -> 6.3.4.2 - audit_log_group.sh -> 6.3.4.3 - audit_log_directory_perms.sh -> 6.3.4.4
1 parent 9bd1704 commit 51b7a3c

10 files changed

+655
-0
lines changed

‎bin/hardening/audit_log_directory_perms.sh

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure the audit log directory mode is configured (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure the audit log directory mode is configured"
19+
20+
AUDITD_CONF_FILE="/etc/audit/auditd.conf"
21+
AUDIT_LOG_DIR_EXPECTED_PERM=""
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
AUDIT_LOG_DIR_PERMS=0
26+
27+
does_file_exist "$AUDITD_CONF_FILE"
28+
if [ "$FNRET" -eq 0 ]; then
29+
30+
AUDIT_LOG_DIRECTORY="$(dirname "$($SUDO_CMD grep -E "^\s*log_file" "$AUDITD_CONF_FILE" | awk -F"=" '{print $2}')")"
31+
local log_dir_perms
32+
log_dir_perms=$(stat -Lc %a "$AUDIT_LOG_DIRECTORY")
33+
34+
# 0750 will be output as 750 by stat
35+
# we add the missing 0 ourselves for easier comparison
36+
if [ "$(echo -n "$log_dir_perms" | wc -m)" -lt 4 ]; then
37+
log_dir_perms="0$log_dir_perms"
38+
fi
39+
40+
if [ "$log_dir_perms" != "$AUDIT_LOG_DIR_EXPECTED_PERM" ]; then
41+
crit "audit log directory '$AUDIT_LOG_DIRECTORY' permissions are '$log_dir_perms' instead of '$AUDIT_LOG_DIR_EXPECTED_PERM'"
42+
fi
43+
44+
else
45+
info "$AUDITD_CONF_FILE does not exist"
46+
fi
47+
}
48+
49+
# This function will be called if the script status is on enabled mode
50+
apply() {
51+
if [ "$AUDIT_LOG_DIR_PERMS" -eq 1 ]; then
52+
info "changing permission to on '$AUDIT_LOG_DIR_EXPECTED_PERM' '$AUDIT_LOG_DIRECTORY'"
53+
chmod "$AUDIT_LOG_DIR_EXPECTED_PERM" "$AUDIT_LOG_DIRECTORY"
54+
fi
55+
}
56+
57+
# This function will check config parameters required
58+
check_config() {
59+
:
60+
}
61+
62+
create_config() {
63+
cat <<EOF
64+
# shellcheck disable=2034
65+
status=audit
66+
# the expected permission for the directory owning the "log_file" directive in /etc/audit/auditd.conf
67+
# default is 0750, but can be less permissive
68+
AUDIT_LOG_DIR_EXPECTED_PERM="0750"
69+
EOF
70+
}
71+
72+
# Source Root Dir Parameter
73+
if [ -r /etc/default/cis-hardening ]; then
74+
# shellcheck source=../../debian/default
75+
. /etc/default/cis-hardening
76+
fi
77+
if [ -z "$CIS_LIB_DIR" ]; then
78+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
79+
echo "Cannot source CIS_LIB_DIR variable, aborting."
80+
exit 128
81+
fi
82+
83+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
84+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
85+
# shellcheck source=../../lib/main.sh
86+
. "${CIS_LIB_DIR}"/main.sh
87+
else
88+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
89+
exit 128
90+
fi

‎bin/hardening/audit_log_group.sh

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure only authorized groups are assigned ownership of audit log files (Automated
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure 'root' or 'adm' groups are assigned ownership of audit log files"
19+
AUDITD_CONF_FILE="/etc/audit/auditd.conf"
20+
AUDIT_LOG_GROUP=""
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
AUDIT_LOG_GROUP_VALID=0
25+
AUDIT_LOG_GROUP_CONF_VALID=0
26+
27+
does_file_exist "$AUDITD_CONF_FILE"
28+
if [ "$FNRET" -eq 0 ]; then
29+
local log_file
30+
log_file=$($SUDO_CMD grep -E "^\s*log_file" "$AUDITD_CONF_FILE" | awk -F "=" '{print $2}')
31+
log_group=$($SUDO_CMD grep -E "^\s*log_group" "$AUDITD_CONF_FILE" | awk -F "=" '{print $2}')
32+
# look for all files in the directory
33+
local invalid_logs
34+
invalid_logs=$(find "$(dirname "$log_file")" -type f ! -group "$AUDIT_LOG_GROUP" -a ! -group root -exec stat -Lc "%n %U" {} +)
35+
36+
if [ -n "$invalid_logs" ]; then
37+
AUDIT_LOG_GROUP_VALID=1
38+
crit "Some audit logs are not owned by group $AUDIT_LOG_GROUP nor root"
39+
info "$invalid_logs"
40+
fi
41+
42+
if [[ "$log_group" != "$AUDIT_LOG_GROUP" ]]; then
43+
crit "'log_group' is '$log_group' instead of '$AUDIT_LOG_GROUP' in $AUDITD_CONF_FILE"
44+
AUDIT_LOG_GROUP_CONF_VALID=1
45+
fi
46+
47+
else
48+
info "$AUDITD_CONF_FILE does not exist"
49+
fi
50+
}
51+
52+
# This function will be called if the script status is on enabled mode
53+
apply() {
54+
if [ "$AUDIT_LOG_GROUP_CONF_VALID" -eq 1 ]; then
55+
info "changing log_group to $AUDIT_LOG_GROUP in $AUDITD_CONF_FILE"
56+
sed -Ei "/\s*log_group/s/=.*$/=$AUDIT_LOG_GROUP/" "$AUDITD_CONF_FILE"
57+
fi
58+
59+
if [ "$AUDIT_LOG_GROUP_VALID" -eq 1 ]; then
60+
local log_file
61+
log_file=$($SUDO_CMD grep -E "^\s*log_file" "$AUDITD_CONF_FILE" | awk -F "=" '{print $2}')
62+
63+
info "Change group to '$AUDIT_LOG_GROUP' for files in '$(dirname "$log_file")'"
64+
find "$(dirname "$log_file")" -type f ! -group "$AUDIT_LOG_GROUP" -a ! -group root -exec chgrp "$AUDIT_LOG_GROUP" {} +
65+
fi
66+
}
67+
68+
# This function will check config parameters required
69+
check_config() {
70+
:
71+
}
72+
73+
create_config() {
74+
cat <<EOF
75+
# shellcheck disable=2034
76+
status=audit
77+
# put here the group name that maybe allowed to own audi log files
78+
# this is the one found under the "log_group" directive in /etc/audit/auditd.conf
79+
# the 'root' group is allowed in addition to this one
80+
AUDIT_LOG_GROUP='adm'
81+
EOF
82+
}
83+
84+
# Source Root Dir Parameter
85+
if [ -r /etc/default/cis-hardening ]; then
86+
# shellcheck source=../../debian/default
87+
. /etc/default/cis-hardening
88+
fi
89+
if [ -z "$CIS_LIB_DIR" ]; then
90+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
91+
echo "Cannot source CIS_LIB_DIR variable, aborting."
92+
exit 128
93+
fi
94+
95+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
96+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
97+
# shellcheck source=../../lib/main.sh
98+
. "${CIS_LIB_DIR}"/main.sh
99+
else
100+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
101+
exit 128
102+
fi

‎bin/hardening/audit_log_user.sh

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure only authorized users own audit log files (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="audit log files should be owned by the correct user"
19+
20+
AUDITD_CONF_FILE="/etc/audit/auditd.conf"
21+
AUDIT_LOG_USER=""
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
AUDIT_LOG_USER_VALID=0
26+
27+
does_file_exist "$AUDITD_CONF_FILE"
28+
if [ "$FNRET" -eq 0 ]; then
29+
local log_file
30+
log_file=$($SUDO_CMD grep -E "^\s*log_file" "$AUDITD_CONF_FILE" | awk -F "=" '{print $2}')
31+
# look for all files in the directory
32+
local invalid_logs
33+
invalid_logs=$(find "$(dirname "$log_file")" -type f ! -user "$AUDIT_LOG_USER" -exec stat -Lc "%n %U" {} +)
34+
35+
if [ -n "$invalid_logs" ]; then
36+
AUDIT_LOG_USER_VALID=1
37+
crit "Some audit logs are not owned by $AUDIT_LOG_USER"
38+
info "$invalid_logs"
39+
fi
40+
else
41+
info "$AUDITD_CONF_FILE does not exist"
42+
fi
43+
}
44+
45+
# This function will be called if the script status is on enabled mode
46+
apply() {
47+
if [ "$AUDIT_LOG_USER_VALID" -eq 1 ]; then
48+
local log_file
49+
log_file=$($SUDO_CMD grep -E "^\s*log_file" "$AUDITD_CONF_FILE" | awk -F "=" '{print $2}')
50+
51+
info "Change owner to '$AUDIT_LOG_USER' for files in '$(dirname "$log_file")'"
52+
find "$(dirname "$log_file")" -type f ! -user "$AUDIT_LOG_USER" -exec chown root {} +
53+
fi
54+
}
55+
56+
# This function will check config parameters required
57+
check_config() {
58+
:
59+
}
60+
61+
create_config() {
62+
cat <<EOF
63+
# shellcheck disable=2034
64+
status=audit
65+
AUDIT_LOG_USER='root'
66+
EOF
67+
}
68+
69+
# Source Root Dir Parameter
70+
if [ -r /etc/default/cis-hardening ]; then
71+
# shellcheck source=../../debian/default
72+
. /etc/default/cis-hardening
73+
fi
74+
if [ -z "$CIS_LIB_DIR" ]; then
75+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
76+
echo "Cannot source CIS_LIB_DIR variable, aborting."
77+
exit 128
78+
fi
79+
80+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
81+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
82+
# shellcheck source=../../lib/main.sh
83+
. "${CIS_LIB_DIR}"/main.sh
84+
else
85+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
86+
exit 128
87+
fi

‎bin/hardening/journald_log_file_access.sh

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure journald log file access is configured (Manual)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure journald log file access is configured"
19+
20+
JOURNALD_FOLDER_PERMS=""
21+
JOURNALD_FILE_PERMS=""
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
# honestly this check is not very useful and will probably always lead to a "crit" state, unless
26+
# setting a long list of perms acceptable for file, which is not very useful either
27+
JOURNALD_ACCESS_VALID=0
28+
# /etc/tmpfiles.d/systemd.conf will override all default settings as defined in /usr/lib/tmpfiles.d/systemd.conf
29+
local file_to_check="/usr/lib/tmpfiles.d/systemd.conf"
30+
does_file_exist /etc/tmpfiles.d/systemd.conf
31+
if [ "$FNRET" -eq 0 ]; then
32+
file_to_check="/etc/tmpfiles.d/systemd.conf"
33+
fi
34+
35+
while read -r line; do
36+
file_type=$(echo "$line" | awk '{print $1}')
37+
file_mode=$(echo "$line" | awk '{print $3}')
38+
39+
if [ "$file_type" == "d" ]; then
40+
if [ "$file_mode" -ne "$JOURNALD_FOLDER_PERMS" ]; then
41+
JOURNALD_ACCESS_VALID=1
42+
break
43+
fi
44+
elif [ "$file_mode" -ne "$JOURNALD_FILE_PERMS" ]; then
45+
JOURNALD_ACCESS_VALID=1
46+
break
47+
fi
48+
done < <($SUDO_CMD grep -v ^# "$file_to_check" | sed '/^$/d')
49+
50+
if [ "$JOURNALD_ACCESS_VALID" -eq 0 ]; then
51+
ok "All files in $file_to_check are correctly configured"
52+
else
53+
crit "Some files in $file_to_check are not correctly configured"
54+
fi
55+
56+
}
57+
58+
# This function will be called if the script status is on enabled mode
59+
apply() {
60+
if [ "$JOURNALD_ACCESS_VALID" -ne 0 ]; then
61+
info "Please review manually the file according to your site policy"
62+
fi
63+
}
64+
65+
# This function will check config parameters required
66+
check_config() {
67+
:
68+
}
69+
70+
create_config() {
71+
cat <<EOF
72+
# shellcheck disable=2034
73+
status=audit
74+
# Put here the root login boolean for ssh
75+
JOURNALD_FOLDER_PERMS=0750
76+
JOURNALD_FILE_PERMS=0640
77+
EOF
78+
}
79+
80+
# Source Root Dir Parameter
81+
if [ -r /etc/default/cis-hardening ]; then
82+
# shellcheck source=../../debian/default
83+
. /etc/default/cis-hardening
84+
fi
85+
if [ -z "$CIS_LIB_DIR" ]; then
86+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
87+
echo "Cannot source CIS_LIB_DIR variable, aborting."
88+
exit 128
89+
fi
90+
91+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
92+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
93+
# shellcheck source=../../lib/main.sh
94+
. "${CIS_LIB_DIR}"/main.sh
95+
else
96+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
97+
exit 128
98+
fi

0 commit comments

Comments
 (0)