Skip to content

Commit 9483645

Browse files
author
damien cavagnini
committed
feat: add new debian12 scripts
- journald_log_file_access.sh -> 6.2.1.1.2 - journald_log_rotation.sh -> 6.2.1.1.3 - audit_log_user.sh -> 6.3.4.2 - audit_log_group.sh -> 6.3.4.3 - audit_log_directory_perms.sh -> 6.3.4.4 - audit_confs_perms.sh -> 6.3.4.5
1 parent 90597da commit 9483645

12 files changed

+772
-0
lines changed

‎bin/hardening/audit_confs_perms.sh

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure audit configuration files mode is configured (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="the audit configuration files have mode 640 or more restrictive"
19+
20+
AUDITD_CONF_DIR="/etc/audit"
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
AUDIT_CONF_PERMS_VALID=0
25+
26+
does_file_exist "$AUDITD_CONF_DIR"
27+
if [ "$FNRET" -eq 0 ]; then
28+
29+
AUDIT_INVALID_PERM_FILES=""
30+
AUDIT_INVALID_PERM_FILES=$($SUDO_CMD find "$AUDITD_CONF_DIR" -type f \( -name '*.conf' -o -name '*.rules' \) -exec stat -Lc "%n %a" {} + | grep -Pv -- '^\h*\H+\h*([0,2,4,6][0,4]0)\h*$')
31+
32+
# output example:
33+
# /etc/audit/auditd.conf 644
34+
# /etc/audit/audit.rules 644
35+
36+
if [ -n "$AUDIT_INVALID_PERM_FILES" ]; then
37+
crit "Some files have invalid permissions"
38+
AUDIT_CONF_PERMS_VALID=1
39+
for file in $AUDIT_INVALID_PERM_FILES; do
40+
info "$file"
41+
done
42+
fi
43+
44+
else
45+
info "$AUDITD_CONF_DIR does not exist"
46+
fi
47+
}
48+
49+
# This function will be called if the script status is on enabled mode
50+
apply() {
51+
if [ "$AUDIT_CONF_PERMS_VALID" -eq 1 ]; then
52+
for file in $AUDIT_INVALID_PERM_FILES; do
53+
file_path=$(awk '{print $1}' <<<"$file")
54+
info "Set perm 640 to $file_path"
55+
chmod 0640 "$file_path"
56+
done
57+
fi
58+
}
59+
60+
# This function will check config parameters required
61+
check_config() {
62+
:
63+
}
64+
65+
# Source Root Dir Parameter
66+
if [ -r /etc/default/cis-hardening ]; then
67+
# shellcheck source=../../debian/default
68+
. /etc/default/cis-hardening
69+
fi
70+
if [ -z "$CIS_LIB_DIR" ]; then
71+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
72+
echo "Cannot source CIS_LIB_DIR variable, aborting."
73+
exit 128
74+
fi
75+
76+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
77+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
78+
# shellcheck source=../../lib/main.sh
79+
. "${CIS_LIB_DIR}"/main.sh
80+
else
81+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
82+
exit 128
83+
fi

‎bin/hardening/audit_log_directory_perms.sh

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure the audit log directory mode is configured (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure the audit log directory mode is configured"
19+
20+
AUDITD_CONF_FILE="/etc/audit/auditd.conf"
21+
AUDIT_LOG_DIR_EXPECTED_PERM=""
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
AUDIT_LOG_DIR_PERMS=0
26+
27+
does_file_exist "$AUDITD_CONF_FILE"
28+
if [ "$FNRET" -eq 0 ]; then
29+
30+
AUDIT_LOG_DIRECTORY="$(dirname "$($SUDO_CMD grep -E "^\s*log_file" "$AUDITD_CONF_FILE" | awk -F"=" '{print $2}')")"
31+
local log_dir_perms
32+
log_dir_perms=$(stat -Lc %a "$AUDIT_LOG_DIRECTORY")
33+
34+
# 0750 will be output as 750 by stat
35+
# we add the missing 0 ourselves for easier comparison
36+
if [ "$(echo -n "$log_dir_perms" | wc -m)" -lt 4 ]; then
37+
log_dir_perms="0$log_dir_perms"
38+
fi
39+
40+
if [ "$log_dir_perms" != "$AUDIT_LOG_DIR_EXPECTED_PERM" ]; then
41+
crit "audit log directory '$AUDIT_LOG_DIRECTORY' permissions are '$log_dir_perms' instead of '$AUDIT_LOG_DIR_EXPECTED_PERM'"
42+
AUDIT_LOG_DIR_PERMS=1
43+
fi
44+
45+
else
46+
info "$AUDITD_CONF_FILE does not exist"
47+
fi
48+
}
49+
50+
# This function will be called if the script status is on enabled mode
51+
apply() {
52+
if [ "$AUDIT_LOG_DIR_PERMS" -eq 1 ]; then
53+
info "changing permission to on '$AUDIT_LOG_DIR_EXPECTED_PERM' '$AUDIT_LOG_DIRECTORY'"
54+
chmod "$AUDIT_LOG_DIR_EXPECTED_PERM" "$AUDIT_LOG_DIRECTORY"
55+
fi
56+
}
57+
58+
# This function will check config parameters required
59+
check_config() {
60+
:
61+
}
62+
63+
create_config() {
64+
cat <<EOF
65+
# shellcheck disable=2034
66+
status=audit
67+
# the expected permission for the directory owning the "log_file" directive in /etc/audit/auditd.conf
68+
# default is 0750, but can be less permissive
69+
AUDIT_LOG_DIR_EXPECTED_PERM="0750"
70+
EOF
71+
}
72+
73+
# Source Root Dir Parameter
74+
if [ -r /etc/default/cis-hardening ]; then
75+
# shellcheck source=../../debian/default
76+
. /etc/default/cis-hardening
77+
fi
78+
if [ -z "$CIS_LIB_DIR" ]; then
79+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
80+
echo "Cannot source CIS_LIB_DIR variable, aborting."
81+
exit 128
82+
fi
83+
84+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
85+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
86+
# shellcheck source=../../lib/main.sh
87+
. "${CIS_LIB_DIR}"/main.sh
88+
else
89+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
90+
exit 128
91+
fi

‎bin/hardening/audit_log_group.sh

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure only authorized groups are assigned ownership of audit log files (Automated
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure 'root' or 'adm' groups are assigned ownership of audit log files"
19+
AUDITD_CONF_FILE="/etc/audit/auditd.conf"
20+
AUDIT_LOG_GROUP=""
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
AUDIT_LOG_GROUP_VALID=0
25+
AUDIT_LOG_GROUP_CONF_VALID=0
26+
27+
does_file_exist "$AUDITD_CONF_FILE"
28+
if [ "$FNRET" -eq 0 ]; then
29+
local log_file
30+
log_file=$($SUDO_CMD grep -E "^\s*log_file" "$AUDITD_CONF_FILE" | awk -F "=" '{print $2}')
31+
log_group=$($SUDO_CMD grep -E "^\s*log_group" "$AUDITD_CONF_FILE" | awk -F "=" '{print $2}')
32+
# look for all files in the directory
33+
local invalid_logs
34+
invalid_logs=$(find "$(dirname "$log_file")" -type f ! -group "$AUDIT_LOG_GROUP" -a ! -group root -exec stat -Lc "%n %U" {} +)
35+
36+
if [ -n "$invalid_logs" ]; then
37+
AUDIT_LOG_GROUP_VALID=1
38+
crit "Some audit logs are not owned by group $AUDIT_LOG_GROUP nor root"
39+
info "$invalid_logs"
40+
fi
41+
42+
if [[ "$log_group" != "$AUDIT_LOG_GROUP" ]]; then
43+
crit "'log_group' is '$log_group' instead of '$AUDIT_LOG_GROUP' in $AUDITD_CONF_FILE"
44+
AUDIT_LOG_GROUP_CONF_VALID=1
45+
fi
46+
47+
else
48+
info "$AUDITD_CONF_FILE does not exist"
49+
fi
50+
}
51+
52+
# This function will be called if the script status is on enabled mode
53+
apply() {
54+
if [ "$AUDIT_LOG_GROUP_CONF_VALID" -eq 1 ]; then
55+
info "changing log_group to $AUDIT_LOG_GROUP in $AUDITD_CONF_FILE"
56+
sed -Ei "/\s*log_group/s/=.*$/=$AUDIT_LOG_GROUP/" "$AUDITD_CONF_FILE"
57+
fi
58+
59+
if [ "$AUDIT_LOG_GROUP_VALID" -eq 1 ]; then
60+
local log_file
61+
log_file=$($SUDO_CMD grep -E "^\s*log_file" "$AUDITD_CONF_FILE" | awk -F "=" '{print $2}')
62+
63+
info "Change group to '$AUDIT_LOG_GROUP' for files in '$(dirname "$log_file")'"
64+
find "$(dirname "$log_file")" -type f ! -group "$AUDIT_LOG_GROUP" -a ! -group root -exec chgrp "$AUDIT_LOG_GROUP" {} +
65+
fi
66+
}
67+
68+
# This function will check config parameters required
69+
check_config() {
70+
:
71+
}
72+
73+
create_config() {
74+
cat <<EOF
75+
# shellcheck disable=2034
76+
status=audit
77+
# put here the group name that maybe allowed to own audi log files
78+
# this is the one found under the "log_group" directive in /etc/audit/auditd.conf
79+
# the 'root' group is allowed in addition to this one
80+
AUDIT_LOG_GROUP='adm'
81+
EOF
82+
}
83+
84+
# Source Root Dir Parameter
85+
if [ -r /etc/default/cis-hardening ]; then
86+
# shellcheck source=../../debian/default
87+
. /etc/default/cis-hardening
88+
fi
89+
if [ -z "$CIS_LIB_DIR" ]; then
90+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
91+
echo "Cannot source CIS_LIB_DIR variable, aborting."
92+
exit 128
93+
fi
94+
95+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
96+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
97+
# shellcheck source=../../lib/main.sh
98+
. "${CIS_LIB_DIR}"/main.sh
99+
else
100+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
101+
exit 128
102+
fi

‎bin/hardening/audit_log_user.sh

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure only authorized users own audit log files (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="audit log files should be owned by the correct user"
19+
20+
AUDITD_CONF_FILE="/etc/audit/auditd.conf"
21+
AUDIT_LOG_USER=""
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
AUDIT_LOG_USER_VALID=0
26+
27+
does_file_exist "$AUDITD_CONF_FILE"
28+
if [ "$FNRET" -eq 0 ]; then
29+
local log_file
30+
log_file=$($SUDO_CMD grep -E "^\s*log_file" "$AUDITD_CONF_FILE" | awk -F "=" '{print $2}')
31+
# look for all files in the directory
32+
local invalid_logs
33+
invalid_logs=$(find "$(dirname "$log_file")" -type f ! -user "$AUDIT_LOG_USER" -exec stat -Lc "%n %U" {} +)
34+
35+
if [ -n "$invalid_logs" ]; then
36+
AUDIT_LOG_USER_VALID=1
37+
crit "Some audit logs are not owned by $AUDIT_LOG_USER"
38+
info "$invalid_logs"
39+
fi
40+
else
41+
info "$AUDITD_CONF_FILE does not exist"
42+
fi
43+
}
44+
45+
# This function will be called if the script status is on enabled mode
46+
apply() {
47+
if [ "$AUDIT_LOG_USER_VALID" -eq 1 ]; then
48+
local log_file
49+
log_file=$($SUDO_CMD grep -E "^\s*log_file" "$AUDITD_CONF_FILE" | awk -F "=" '{print $2}')
50+
51+
info "Change owner to '$AUDIT_LOG_USER' for files in '$(dirname "$log_file")'"
52+
find "$(dirname "$log_file")" -type f ! -user "$AUDIT_LOG_USER" -exec chown root {} +
53+
fi
54+
}
55+
56+
# This function will check config parameters required
57+
check_config() {
58+
:
59+
}
60+
61+
create_config() {
62+
cat <<EOF
63+
# shellcheck disable=2034
64+
status=audit
65+
AUDIT_LOG_USER='root'
66+
EOF
67+
}
68+
69+
# Source Root Dir Parameter
70+
if [ -r /etc/default/cis-hardening ]; then
71+
# shellcheck source=../../debian/default
72+
. /etc/default/cis-hardening
73+
fi
74+
if [ -z "$CIS_LIB_DIR" ]; then
75+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
76+
echo "Cannot source CIS_LIB_DIR variable, aborting."
77+
exit 128
78+
fi
79+
80+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
81+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
82+
# shellcheck source=../../lib/main.sh
83+
. "${CIS_LIB_DIR}"/main.sh
84+
else
85+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
86+
exit 128
87+
fi

0 commit comments

Comments
 (0)