Skip to content

Commit ddd069a

Browse files
author
damien cavagnini
committed
feat: add debian12 scripts
- etc_shells_permissions.sh -> 7.1.9 - etc_security_opasswd_permissions.sh -> 7.1.10 - passwd_accounts_use_shadow.sh -> 7.2.1
1 parent 0a8a408 commit ddd069a

File tree

6 files changed

+426
-0
lines changed

6 files changed

+426
-0
lines changed

‎bin/hardening/etc_security_opasswd_permissions.sh

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure permissions on /etc/security/opasswd are configured (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=1
17+
# shellcheck disable=2034
18+
DESCRIPTION="verify /etc/security/opasswd and /etc/security/opasswd.old are mode 600 or more restrictive, Uid is 0/root and Gid is
19+
0/root"
20+
21+
FILES='/etc/security/opasswd /etc/security/opasswd.old'
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
# we treat both files as one for simplicity
26+
PERMS_VALID=0
27+
UID_VALID=0
28+
GID_VALID=0
29+
30+
VALID_FILES=""
31+
for file in $FILES; do
32+
does_file_exist "$file"
33+
if [ "$FNRET" -eq 0 ]; then
34+
VALID_FILES="$VALID_FILES $file"
35+
fi
36+
done
37+
38+
for file in $VALID_FILES; do
39+
40+
file_stats=$(stat -Lc '%a %u %g' "$file")
41+
42+
if ! grep "[0-6]00" <<<"$(awk '{print $1}' <<<"$file_stats")" >/dev/null; then
43+
crit "$file 's perms are not 600 or less"
44+
PERMS_VALID=1
45+
fi
46+
47+
if [ "$(awk '{print $2}' <<<"$file_stats")" -ne 0 ]; then
48+
crit "$file owner's uid is not 0"
49+
UID_VALID=1
50+
fi
51+
52+
if [ "$(awk '{print $3}' <<<"$file_stats")" -ne 0 ]; then
53+
crit "$file group's gid is not 0"
54+
GID_VALID=1
55+
fi
56+
57+
done
58+
59+
}
60+
61+
# This function will be called if the script status is on enabled mode
62+
apply() {
63+
if [ "$PERMS_VALID" -eq 1 ]; then
64+
for file in $VALID_FILES; do
65+
info "changing permission to 600 on $file"
66+
chmod 600 "$file"
67+
done
68+
fi
69+
70+
if [ "$UID_VALID" -eq 1 ]; then
71+
for file in $VALID_FILES; do
72+
info "changing owner to 0 on $file"
73+
chown 0 "$file"
74+
done
75+
fi
76+
77+
if [ "$GID_VALID" -eq 1 ]; then
78+
for file in $VALID_FILES; do
79+
info "changing group to 0 on $file"
80+
chgrp 0 "$file"
81+
done
82+
fi
83+
}
84+
85+
# This function will check config parameters required
86+
check_config() {
87+
:
88+
}
89+
90+
# Source Root Dir Parameter
91+
if [ -r /etc/default/cis-hardening ]; then
92+
# shellcheck source=../../debian/default
93+
. /etc/default/cis-hardening
94+
fi
95+
if [ -z "$CIS_LIB_DIR" ]; then
96+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
97+
echo "Cannot source CIS_LIB_DIR variable, aborting."
98+
exit 128
99+
fi
100+
101+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
102+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
103+
# shellcheck source=../../lib/main.sh
104+
. "${CIS_LIB_DIR}"/main.sh
105+
else
106+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
107+
exit 128
108+
fi

‎bin/hardening/etc_shells_permissions.sh

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure permissions on /etc/shells are configured (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=1
17+
# shellcheck disable=2034
18+
DESCRIPTION="verify /etc/shells is mode 644 or more restrictive, Uid is 0/root and Gid is 0/root"
19+
20+
FILE='/etc/shells'
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
PERMS_VALID=0
25+
UID_VALID=0
26+
GID_VALID=0
27+
28+
does_file_exist "$FILE"
29+
if [ "$FNRET" -eq 0 ]; then
30+
file_stats=$(stat -Lc '%a %u %g' "$FILE")
31+
32+
if ! grep "[0-6][0-4][0-4]" <<<"$(awk '{print $1}' <<<"$file_stats")" >/dev/null; then
33+
crit "$FILE 's perms are not 644 or less"
34+
PERMS_VALID=1
35+
fi
36+
37+
if [ "$(awk '{print $2}' <<<"$file_stats")" -ne 0 ]; then
38+
crit "$FILE owner's uid is not 0"
39+
UID_VALID=1
40+
fi
41+
42+
if [ "$(awk '{print $3}' <<<"$file_stats")" -ne 0 ]; then
43+
crit "$FILE group's gid is not 0"
44+
GID_VALID=1
45+
fi
46+
47+
else
48+
info "$FILE is missing"
49+
fi
50+
51+
}
52+
53+
# This function will be called if the script status is on enabled mode
54+
apply() {
55+
if [ "$PERMS_VALID" -eq 1 ]; then
56+
info "changing permission to 644 on $FILE"
57+
chmod 644 "$FILE"
58+
fi
59+
60+
if [ "$UID_VALID" -eq 1 ]; then
61+
info "changing owner to 0 on $FILE"
62+
chown 0 "$FILE"
63+
fi
64+
65+
if [ "$GID_VALID" -eq 1 ]; then
66+
info "changing group to 0 on $FILE"
67+
chgrp 0 "$FILE"
68+
fi
69+
}
70+
71+
# This function will check config parameters required
72+
check_config() {
73+
:
74+
}
75+
76+
# Source Root Dir Parameter
77+
if [ -r /etc/default/cis-hardening ]; then
78+
# shellcheck source=../../debian/default
79+
. /etc/default/cis-hardening
80+
fi
81+
if [ -z "$CIS_LIB_DIR" ]; then
82+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
83+
echo "Cannot source CIS_LIB_DIR variable, aborting."
84+
exit 128
85+
fi
86+
87+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
88+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
89+
# shellcheck source=../../lib/main.sh
90+
. "${CIS_LIB_DIR}"/main.sh
91+
else
92+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
93+
exit 128
94+
fi

‎bin/hardening/passwd_accounts_use_shadow.sh

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure accounts in /etc/passwd use shadowed passwords (Manual)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=1
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure accounts in /etc/passwd use shadowed passwords"
19+
EXCEPTIONS=""
20+
21+
# This function will be called if the script status is on enabled / audit mode
22+
audit() {
23+
INVALID_USERS=""
24+
# Accounts with a shadowed password have an x in the second field in /etc/passwd.
25+
INVALID_USERS=$(awk -F: '($2 != "x" ) { print $1}' /etc/passwd)
26+
27+
if [ -n "$INVALID_USERS" ]; then
28+
for user in $INVALID_USERS; do
29+
if [ -n "$EXCEPTIONS" ]; then
30+
if ! grep -w "$user" <<<"$EXCEPTIONS" >/dev/null; then
31+
crit "$user does not use a shadow password"
32+
fi
33+
else
34+
crit "$user does not use a shadow password"
35+
fi
36+
done
37+
fi
38+
39+
}
40+
41+
# This function will be called if the script status is on enabled mode
42+
apply() {
43+
# the CIS recommendation is to do it in an automated way, while also "Investigate to determine if the account is logged in and what it is being used for, to
44+
# determine if it needs to be forced off"
45+
# so we do this manually
46+
info "Please review the faulty accounts and update their password configuration, or set them as exceptions in the configuration"
47+
}
48+
49+
# This function will check config parameters required
50+
check_config() {
51+
:
52+
}
53+
54+
# maybe someone is gonna have a legit use case....
55+
create_config() {
56+
cat <<EOF
57+
# shellcheck disable=2034
58+
status=audit
59+
# Put here the accounts that should keep their non shadowed password
60+
EXCEPTIONS=''
61+
EOF
62+
}
63+
64+
# Source Root Dir Parameter
65+
if [ -r /etc/default/cis-hardening ]; then
66+
# shellcheck source=../../debian/default
67+
. /etc/default/cis-hardening
68+
fi
69+
if [ -z "$CIS_LIB_DIR" ]; then
70+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
71+
echo "Cannot source CIS_LIB_DIR variable, aborting."
72+
exit 128
73+
fi
74+
75+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
76+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
77+
# shellcheck source=../../lib/main.sh
78+
. "${CIS_LIB_DIR}"/main.sh
79+
else
80+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
81+
exit 128
82+
fi

‎tests/hardening/etc_security_opasswd_permissions.sh

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# shellcheck shell=bash
2+
# run-shellcheck
3+
test_audit() {
4+
for file in /etc/security/opasswd /etc/security/opasswd.old; do
5+
if [ -e "$file" ]; then
6+
7+
describe prepare failing test
8+
chmod 644 "$file"
9+
10+
describe On purpose failing test
11+
register_test retvalshouldbe 1
12+
# shellcheck disable=2154
13+
run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
14+
15+
describe correcting situation
16+
sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
17+
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
18+
19+
describe resolved test
20+
register_test retvalshouldbe 0
21+
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
22+
23+
describe ensure more restrictive is allowed
24+
chmod 400 "$file"
25+
26+
describe successful test
27+
register_test retvalshouldbe 0
28+
run successful "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
29+
30+
describe failling at uid
31+
chown 500 "$file"
32+
33+
describe On purpose failing test
34+
register_test retvalshouldbe 1
35+
# shellcheck disable=2154
36+
run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
37+
38+
describe correcting situation
39+
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
40+
41+
describe resolved test
42+
register_test retvalshouldbe 0
43+
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
44+
45+
describe failling at gid
46+
chown 500 "$file"
47+
48+
describe On purpose failing test
49+
register_test retvalshouldbe 1
50+
# shellcheck disable=2154
51+
run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
52+
53+
describe correcting situation
54+
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
55+
56+
describe resolved test
57+
register_test retvalshouldbe 0
58+
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
59+
60+
fi
61+
62+
done
63+
}

0 commit comments

Comments
 (0)