Skip to content

Commit 674b770

Browse files
author
damien cavagnini
committed
feat: add debian12 scripts
- iptables_loopback.sh -> 4.3.2.2 - iptables_rules_them_all.sh -> 4.3.2.4 - iptables_outbound_established.sh -> 4.3.2.3 - ip6tables_loopback.sh -> 4.3.3.2 - ip6tables_outbound_established.sh -> 4.3.3.3 - ip6tables_rules_them_all.sh -> 4.3.3.4 - ip6tables_default_deny_policy.sh -> 4.3.3.1
1 parent 9bd1704 commit 674b770

17 files changed

+778
-60
lines changed

‎bin/hardening/ip6tables_default_deny_policy.sh

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure ip6tables default deny firewall policy (Manual)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure ip6tables default deny firewall policy"
19+
20+
# This function will be called if the script status is on enabled / audit mode
21+
audit() {
22+
INPUT_CHAIN_DROP=1
23+
OUTPUT_CHAIN_DROP=1
24+
FORWARD_CHAIN_DROP=1
25+
26+
local input_default=""
27+
local output_default=""
28+
local forward_default=""
29+
input_default=$($SUDO_CMD ip6tables -S INPUT | awk '/^-P/ {print $3}')
30+
output_default=$($SUDO_CMD ip6tables -S OUTPUT | awk '/^-P/ {print $3}')
31+
forward_default=$($SUDO_CMD ip6tables -S FORWARD | awk '/^-P/ {print $3}')
32+
33+
if [ "$input_default" != "DROP" ]; then
34+
crit "ip6tables 'INPUT' chain does not have 'DROP' has default policy"
35+
else
36+
ok "ip6tables 'input' chain has 'DROP' has default policy"
37+
INPUT_CHAIN_DROP=0
38+
fi
39+
40+
if [ "$output_default" != "DROP" ]; then
41+
crit "ip6tables 'OUTPUT' chain does not have 'DROP' has default policy"
42+
else
43+
ok "ip6tables 'OUTPUT' chain has 'DROP' has default policy"
44+
OUTPUT_CHAIN_DROP=0
45+
fi
46+
47+
if [ "$forward_default" != "DROP" ]; then
48+
crit "ip6tables 'FORWARD' chain does not have 'DROP' has default policy"
49+
else
50+
ok "ip6tables 'FORWARD' chain has 'DROP' has default policy"
51+
FORWARD_CHAIN_DROP=0
52+
fi
53+
54+
}
55+
56+
# This function will be called if the script status is on enabled mode
57+
apply() {
58+
if [ "$INPUT_CHAIN_DROP" -ne 0 ]; then
59+
info "Please review your ip6tables default 'INPUT' policy, we can't change it bindly"
60+
fi
61+
62+
if [ "$OUTPUT_CHAIN_DROP" -ne 0 ]; then
63+
info "Please review your ip6tables default 'OUTPUT' policy, we can't change it bindly"
64+
fi
65+
66+
if [ "$FORWARD_CHAIN_DROP" -ne 0 ]; then
67+
info "Please review your ip6tables default 'FORWARD' policy, we can't change it bindly"
68+
fi
69+
70+
}
71+
72+
# This function will check config parameters required
73+
check_config() {
74+
:
75+
}
76+
77+
# Source Root Dir Parameter
78+
if [ -r /etc/default/cis-hardening ]; then
79+
# shellcheck source=../../debian/default
80+
. /etc/default/cis-hardening
81+
fi
82+
83+
if [ -z "$CIS_LIB_DIR" ]; then
84+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
85+
echo "Cannot source CIS_LIB_DIR variable, aborting."
86+
exit 128
87+
fi
88+
89+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
90+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
91+
# shellcheck source=../../lib/main.sh
92+
. "${CIS_LIB_DIR}"/main.sh
93+
else
94+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
95+
exit 128
96+
fi

‎bin/hardening/ip6tables_loopback.sh

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure ip6tables loopback traffic is configured (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure ip6tables loopback traffic is configured"
19+
PACKAGE="iptables"
20+
21+
# This function will be called if the script status is on enabled / audit mode
22+
audit() {
23+
is_pkg_installed "$PACKAGE"
24+
if [ "$FNRET" -ne 0 ]; then
25+
crit "$PACKAGE is not installed"
26+
return
27+
fi
28+
29+
is_ipv6_enabled
30+
if [ "$FNRET" -ne 0 ]; then
31+
ok "ipv6 is not enabled"
32+
return
33+
fi
34+
35+
IPTABLES_LOOPBACK_INPUT=1
36+
IPTABLES_LOOPBACK_OUTPUT=1
37+
IPTABLES_LOOPBACK_DENY=1
38+
39+
local input_rules
40+
local output_rules
41+
input_rules=$($SUDO_CMD ip6tables -S INPUT 2>/dev/null)
42+
output_rules=$($SUDO_CMD ip6tables -S OUTPUT 2>/dev/null)
43+
44+
# the '.*' below is in case of comments
45+
# shellcheck disable=2086
46+
if grep "\-A INPUT -i lo.*-j ACCEPT" <<<$input_rules >/dev/null; then
47+
ok "loopback is configured in ip6tables input rules"
48+
IPTABLES_LOOPBACK_INPUT=0
49+
else
50+
crit "loopback is not configured in ip6tables input rules"
51+
fi
52+
53+
# shellcheck disable=2086
54+
if grep "\-A INPUT -s ::1 .*-j DROP" <<<$input_rules >/dev/null; then
55+
ok "::1 is dropped in ip6tables input rules"
56+
IPTABLES_LOOPBACK_DENY=0
57+
else
58+
crit "::1 is not dropped in ip6tables input rules"
59+
fi
60+
61+
# shellcheck disable=2086
62+
if grep "\-A OUTPUT -o lo.*-j ACCEPT" <<<$output_rules >/dev/null; then
63+
ok "loopback is configured in ip6tables output rules"
64+
IPTABLES_LOOPBACK_OUTPUT=0
65+
else
66+
crit "loopback is not configured in ip6tables output rules"
67+
fi
68+
69+
}
70+
71+
# This function will be called if the script status is on enabled mode
72+
apply() {
73+
if [ "$IPTABLES_LOOPBACK_INPUT" -ne 0 ]; then
74+
info "update ip6tables rules to allow loopback input"
75+
ip6tables -A INPUT -i lo -j ACCEPT
76+
fi
77+
78+
if [ "$IPTABLES_LOOPBACK_OUTPUT" -ne 0 ]; then
79+
info "update ip6tables rules to allow loopback" output
80+
ip6tables -A OUTPUT -o lo -j ACCEPT
81+
fi
82+
83+
if [ "$IPTABLES_LOOPBACK_DENY" -ne 0 ]; then
84+
info "update ip6tables rules to drop ::1 input"
85+
ip6tables -A INPUT -s ::1 -j DROP
86+
fi
87+
}
88+
89+
# This function will check config parameters required
90+
check_config() {
91+
:
92+
}
93+
94+
# Source Root Dir Parameter
95+
if [ -r /etc/default/cis-hardening ]; then
96+
# shellcheck source=../../debian/default
97+
. /etc/default/cis-hardening
98+
fi
99+
100+
if [ -z "$CIS_LIB_DIR" ]; then
101+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
102+
echo "Cannot source CIS_LIB_DIR variable, aborting."
103+
exit 128
104+
fi
105+
106+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
107+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
108+
# shellcheck source=../../lib/main.sh
109+
. "${CIS_LIB_DIR}"/main.sh
110+
else
111+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
112+
exit 128
113+
fi

‎bin/hardening/ip6tables_outbound_established.sh

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure ip6tables outbound and established connections are configured (Manual)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure ip6tables outbound and established connections are configured"
19+
PACKAGE="iptables"
20+
21+
# This function will be called if the script status is on enabled / audit mode
22+
audit() {
23+
is_pkg_installed "$PACKAGE"
24+
if [ "$FNRET" -ne 0 ]; then
25+
crit "$PACKAGE is not installed"
26+
return
27+
fi
28+
29+
is_ipv6_enabled
30+
if [ "$FNRET" -ne 0 ]; then
31+
ok "ipv6 is not enabled"
32+
return
33+
fi
34+
35+
INPUT_ESTABLISHED=1
36+
OUTPUT_ESTABLISHED=1
37+
38+
local output_established_rules
39+
40+
if $SUDO_CMD ip6tables -S INPUT | grep ESTABLISHED >/dev/null 2>&1; then
41+
INPUT_ESTABLISHED=0
42+
ok "INPUT ESTABLISHED connections are allowed"
43+
else
44+
crit "INPUT ESTABLISHED connections are not allowed"
45+
fi
46+
47+
if $SUDO_CMD ip6tables -S OUTPUT | grep state >/dev/null 2>&1; then
48+
output_established_rules=$($SUDO_CMD ip6tables -S OUTPUT | grep state)
49+
# shellcheck disable=2086
50+
if grep ESTABLISHED <<<$output_established_rules >/dev/null && grep NEW <<<$output_established_rules >/dev/null; then
51+
OUTPUT_ESTABLISHED=0
52+
ok "OUTPUT NEW and ESTABLISHED connections are allowed"
53+
else
54+
crit "OUTPUT NEW and ESTABLISHED connections are not allowed"
55+
fi
56+
else
57+
crit "OUTPUT NEW and ESTABLISHED connections are not allowed"
58+
fi
59+
}
60+
61+
# This function will be called if the script status is on enabled mode
62+
apply() {
63+
if [ "$INPUT_ESTABLISHED" -ne 0 ] || [ "$OUTPUT_ESTABLISHED" -ne 0 ]; then
64+
info "Please review manually your outbound and established connection, and update them accordingly to your site policies"
65+
fi
66+
}
67+
68+
# This function will check config parameters required
69+
check_config() {
70+
:
71+
}
72+
73+
# Source Root Dir Parameter
74+
if [ -r /etc/default/cis-hardening ]; then
75+
# shellcheck source=../../debian/default
76+
. /etc/default/cis-hardening
77+
fi
78+
79+
if [ -z "$CIS_LIB_DIR" ]; then
80+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
81+
echo "Cannot source CIS_LIB_DIR variable, aborting."
82+
exit 128
83+
fi
84+
85+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
86+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
87+
# shellcheck source=../../lib/main.sh
88+
. "${CIS_LIB_DIR}"/main.sh
89+
else
90+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
91+
exit 128
92+
fi

0 commit comments

Comments
 (0)