Skip to content

Commit d48f508

Browse files
author
damien cavagnini
committed
feat: add new debian12 scripts
- audit_conf_owner.sh -> 6.3.4.6 - audif_conf_group.sh -> 6.3.4.7 - audit_tools_perms.sh -> 6.3.4.8
1 parent 06067b0 commit d48f508

File tree

6 files changed

+340
-0
lines changed

6 files changed

+340
-0
lines changed

‎bin/hardening/audit_conf_group.sh‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure audit configuration files belong to group root (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure audit configuration files belong to group root"
19+
20+
AUDITD_CONF_DIR="/etc/audit"
21+
AUDIT_CONF_GROUP=""
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
AUDIT_INVALID_FILES=""
26+
27+
does_file_exist "$AUDITD_CONF_DIR"
28+
if [ "$FNRET" -eq 0 ]; then
29+
30+
AUDIT_INVALID_FILES=$($SUDO_CMD find "$AUDITD_CONF_DIR" -type f \( -name '*.conf' -o -name '*.rules' \) ! -group "$AUDIT_CONF_GROUP")
31+
32+
if [ -n "$AUDIT_INVALID_FILES" ]; then
33+
crit "Some files in $AUDITD_CONF_DIR are not owned by group $AUDIT_CONF_GROUP"
34+
fi
35+
36+
else
37+
info "$AUDITD_CONF_DIR does not exist"
38+
fi
39+
}
40+
41+
# This function will be called if the script status is on enabled mode
42+
apply() {
43+
if [ -n "$AUDIT_INVALID_FILES" ]; then
44+
for file in $AUDIT_INVALID_FILES; do
45+
info "changing owner to $AUDIT_CONF_GROUP for $file"
46+
chgrp "$AUDIT_CONF_GROUP" "$file"
47+
done
48+
fi
49+
}
50+
51+
# This function will check config parameters required
52+
check_config() {
53+
:
54+
}
55+
56+
create_config() {
57+
cat <<EOF
58+
# shellcheck disable=2034
59+
status=audit
60+
# group of the audit configuration files
61+
AUDIT_CONF_GROUP='root'
62+
EOF
63+
}
64+
65+
# Source Root Dir Parameter
66+
if [ -r /etc/default/cis-hardening ]; then
67+
# shellcheck source=../../debian/default
68+
. /etc/default/cis-hardening
69+
fi
70+
if [ -z "$CIS_LIB_DIR" ]; then
71+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
72+
echo "Cannot source CIS_LIB_DIR variable, aborting."
73+
exit 128
74+
fi
75+
76+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
77+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
78+
# shellcheck source=../../lib/main.sh
79+
. "${CIS_LIB_DIR}"/main.sh
80+
else
81+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
82+
exit 128
83+
fi

‎bin/hardening/audit_conf_owner.sh‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure audit configuration files are owned by root (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure audit configuration files are owned by root"
19+
20+
AUDITD_CONF_DIR="/etc/audit"
21+
AUDIT_CONF_OWNER=""
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
AUDIT_INVALID_FILES=""
26+
27+
does_file_exist "$AUDITD_CONF_DIR"
28+
if [ "$FNRET" -eq 0 ]; then
29+
30+
AUDIT_INVALID_FILES=$($SUDO_CMD find "$AUDITD_CONF_DIR" -type f \( -name '*.conf' -o -name '*.rules' \) ! -user "$AUDIT_CONF_OWNER")
31+
32+
if [ -n "$AUDIT_INVALID_FILES" ]; then
33+
crit "Some files in $AUDITD_CONF_DIR are not owned by $AUDIT_CONF_OWNER"
34+
fi
35+
36+
else
37+
info "$AUDITD_CONF_DIR does not exist"
38+
fi
39+
}
40+
41+
# This function will be called if the script status is on enabled mode
42+
apply() {
43+
if [ -n "$AUDIT_INVALID_FILES" ]; then
44+
for file in $AUDIT_INVALID_FILES; do
45+
info "changing owner to $AUDIT_CONF_OWNER for $file"
46+
chown "$AUDIT_CONF_OWNER" "$file"
47+
done
48+
fi
49+
}
50+
51+
# This function will check config parameters required
52+
check_config() {
53+
:
54+
}
55+
56+
create_config() {
57+
cat <<EOF
58+
# shellcheck disable=2034
59+
status=audit
60+
# owner of the audit configuration files
61+
AUDIT_CONF_OWNER='root'
62+
EOF
63+
}
64+
65+
# Source Root Dir Parameter
66+
if [ -r /etc/default/cis-hardening ]; then
67+
# shellcheck source=../../debian/default
68+
. /etc/default/cis-hardening
69+
fi
70+
if [ -z "$CIS_LIB_DIR" ]; then
71+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
72+
echo "Cannot source CIS_LIB_DIR variable, aborting."
73+
exit 128
74+
fi
75+
76+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
77+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
78+
# shellcheck source=../../lib/main.sh
79+
. "${CIS_LIB_DIR}"/main.sh
80+
else
81+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
82+
exit 128
83+
fi

‎bin/hardening/audit_tools_perms.sh‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure audit tools mode is configured (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure audit tools mode is configured"
19+
20+
AUDITD_TOOLS="/sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/augenrules"
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
AUDIT_INVALID_FILES=""
25+
local result
26+
27+
for file in $AUDITD_TOOLS; do
28+
29+
does_file_exist "$file"
30+
if [ "$FNRET" -eq 0 ]; then
31+
result=$(stat -Lc "%n %a" "$file" | grep -Pv -- '^\h*\H+\h+([0-7][0,1,4,5][0,1,4,5])\h*$')
32+
if [ -n "$result" ]; then
33+
crit "wrong permission $result"
34+
AUDIT_INVALID_FILES="$AUDIT_INVALID_FILES $(awk '{print $1}' <<<"$result")"
35+
fi
36+
37+
else
38+
info "$file missing"
39+
fi
40+
41+
done
42+
43+
}
44+
45+
# This function will be called if the script status is on enabled mode
46+
apply() {
47+
if [ -n "$AUDIT_INVALID_FILES" ]; then
48+
for file in $AUDIT_INVALID_FILES; do
49+
info "changing permission to 755 for $file"
50+
chmod 755 "$file"
51+
done
52+
fi
53+
}
54+
55+
# This function will check config parameters required
56+
check_config() {
57+
:
58+
}
59+
60+
# Source Root Dir Parameter
61+
if [ -r /etc/default/cis-hardening ]; then
62+
# shellcheck source=../../debian/default
63+
. /etc/default/cis-hardening
64+
fi
65+
if [ -z "$CIS_LIB_DIR" ]; then
66+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
67+
echo "Cannot source CIS_LIB_DIR variable, aborting."
68+
exit 128
69+
fi
70+
71+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
72+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
73+
# shellcheck source=../../lib/main.sh
74+
. "${CIS_LIB_DIR}"/main.sh
75+
else
76+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
77+
exit 128
78+
fi

‎tests/hardening/audit_conf_group.sh‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# shellcheck shell=bash
2+
# run-shellcheck
3+
test_audit() {
4+
local test_install_package=1
5+
if ! dpkg -s auditd 2>/dev/null | grep -q '^Status: install '; then
6+
apt install -y auditd
7+
test_install_package=0
8+
fi
9+
10+
describe prepare failing test
11+
touch /etc/audit/foo.rules
12+
chgrp secaudit /etc/audit/foo.rules
13+
14+
describe Checking failed state
15+
register_test retvalshouldbe 1
16+
# shellcheck disable=2154
17+
run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
18+
19+
describe Correcting situation
20+
sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
21+
"${CIS_CHECKS_DIR}/${script}.sh" || true
22+
23+
describe Checking resolved state
24+
register_test retvalshouldbe 0
25+
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
26+
27+
describe clean test
28+
rm -f /etc/audit/foo.rules
29+
30+
if [ "$test_install_package" -eq 0 ]; then
31+
apt remove -y auditd
32+
fi
33+
}

‎tests/hardening/audit_conf_owner.sh‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# shellcheck shell=bash
2+
# run-shellcheck
3+
test_audit() {
4+
local test_install_package=1
5+
if ! dpkg -s auditd 2>/dev/null | grep -q '^Status: install '; then
6+
apt install -y auditd
7+
test_install_package=0
8+
fi
9+
10+
describe prepare failing test
11+
touch /etc/audit/foo.rules
12+
chown secaudit /etc/audit/foo.rules
13+
14+
describe Checking failed state
15+
register_test retvalshouldbe 1
16+
# shellcheck disable=2154
17+
run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
18+
19+
describe Correcting situation
20+
sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
21+
"${CIS_CHECKS_DIR}/${script}.sh" || true
22+
23+
describe Checking resolved state
24+
register_test retvalshouldbe 0
25+
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
26+
27+
describe clean test
28+
rm -f /etc/audit/foo.rules
29+
30+
if [ "$test_install_package" -eq 0 ]; then
31+
apt remove -y auditd
32+
fi
33+
}

‎tests/hardening/audit_tools_perms.sh‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# shellcheck shell=bash
2+
# run-shellcheck
3+
test_audit() {
4+
local test_install_package=1
5+
if ! dpkg -s auditd 2>/dev/null | grep -q '^Status: install '; then
6+
apt install -y auditd
7+
test_install_package=0
8+
fi
9+
10+
describe prepare failing test
11+
chmod 777 /sbin/auditctl
12+
13+
describe Checking failed state
14+
register_test retvalshouldbe 1
15+
# shellcheck disable=2154
16+
run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
17+
18+
describe Correcting situation
19+
sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
20+
"${CIS_CHECKS_DIR}/${script}.sh" || true
21+
22+
describe Checking resolved state
23+
register_test retvalshouldbe 0
24+
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
25+
26+
describe clean test
27+
if [ "$test_install_package" -eq 0 ]; then
28+
apt remove -y auditd
29+
fi
30+
}

0 commit comments

Comments
 (0)