Skip to content

Commit ed1b24f

Browse files
author
damien cavagnini
committed
feat: add debian12 scripts
- etc_shells_permissions.sh -> 7.1.9 - etc_security_opasswd_permissions.sh -> 7.1.10 - passwd_accounts_use_shadow.sh -> 7.2.1
1 parent 0a8a408 commit ed1b24f

File tree

6 files changed

+421
-0
lines changed

6 files changed

+421
-0
lines changed

‎bin/hardening/etc_security_opasswd_permissions.sh

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure permissions on /etc/security/opasswd are configured (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=1
17+
# shellcheck disable=2034
18+
DESCRIPTION="verify /etc/security/opasswd and /etc/security/opasswd.old are mode 600 or more restrictive, Uid is 0/root and Gid is
19+
0/root"
20+
21+
FILES='/etc/security/opasswd /etc/security/opasswd.old'
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
# we treat both files as one for simplicity
26+
PERMS_VALID=0
27+
UID_VALID=0
28+
GID_VALID=0
29+
30+
VALID_FILES=""
31+
for file in $FILES; do
32+
does_file_exist "$file"
33+
if [ "$FNRET" -eq 0 ]; then
34+
VALID_FILES="$VALID_FILES $file"
35+
fi
36+
done
37+
38+
for file in $VALID_FILES; do
39+
40+
file_stats=$(stat -Lc '%a %u %g' "$file")
41+
42+
if ! grep "[0-6]00" <<<"$(awk '{print $1}' <<<"$file_stats")" >/dev/null; then
43+
crit "$file 's perms are not 600 or less"
44+
PERMS_VALID=1
45+
fi
46+
47+
if [ "$(awk '{print $2}' <<<"$file_stats")" -ne 0 ]; then
48+
crit "$file owner's uid is not 0"
49+
UID_VALID=1
50+
fi
51+
52+
if [ "$(awk '{print $3}' <<<"$file_stats")" -ne 0 ]; then
53+
crit "$file group's gid is not 0"
54+
GID_VALID=1
55+
fi
56+
57+
done
58+
59+
}
60+
61+
# This function will be called if the script status is on enabled mode
62+
apply() {
63+
if [ "$PERMS_VALID" -eq 1 ]; then
64+
for file in $VALID_FILES; do
65+
info "changing permission to 600 on $file"
66+
chmod 600 "$file"
67+
done
68+
fi
69+
70+
if [ "$UID_VALID" -eq 1 ]; then
71+
for file in $VALID_FILES; do
72+
info "changing owner to 0 on $file"
73+
chown 0 "$file"
74+
done
75+
fi
76+
77+
if [ "$GID_VALID" -eq 1 ]; then
78+
for file in $VALID_FILES; do
79+
info "changing group to 0 on $file"
80+
chgrp 0 "$file"
81+
done
82+
fi
83+
}
84+
85+
# This function will check config parameters required
86+
check_config() {
87+
:
88+
}
89+
90+
# Source Root Dir Parameter
91+
if [ -r /etc/default/cis-hardening ]; then
92+
# shellcheck source=../../debian/default
93+
. /etc/default/cis-hardening
94+
fi
95+
if [ -z "$CIS_LIB_DIR" ]; then
96+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
97+
echo "Cannot source CIS_LIB_DIR variable, aborting."
98+
exit 128
99+
fi
100+
101+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
102+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
103+
# shellcheck source=../../lib/main.sh
104+
. "${CIS_LIB_DIR}"/main.sh
105+
else
106+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
107+
exit 128
108+
fi

‎bin/hardening/etc_shells_permissions.sh

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure permissions on /etc/shells are configured (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=1
17+
# shellcheck disable=2034
18+
DESCRIPTION="verify /etc/shells is mode 644 or more restrictive, Uid is 0/root and Gid is 0/root"
19+
20+
FILE='/etc/shells'
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
PERMS_VALID=0
25+
UID_VALID=0
26+
GID_VALID=0
27+
28+
does_file_exist "$FILE"
29+
if [ "$FNRET" -eq 0 ]; then
30+
file_stats=$(stat -Lc '%a %u %g' "$FILE")
31+
32+
if ! grep "[0-6][0-4][0-4]" <<<"$(awk '{print $1}' <<<"$file_stats")" >/dev/null; then
33+
crit "$FILE 's perms are not 644 or less"
34+
PERMS_VALID=1
35+
fi
36+
37+
if [ "$(awk '{print $2}' <<<"$file_stats")" -ne 0 ]; then
38+
crit "$FILE owner's uid is not 0"
39+
UID_VALID=1
40+
fi
41+
42+
if [ "$(awk '{print $3}' <<<"$file_stats")" -ne 0 ]; then
43+
crit "$FILE group's gid is not 0"
44+
GID_VALID=1
45+
fi
46+
47+
else
48+
info "$FILE is missing"
49+
fi
50+
51+
}
52+
53+
# This function will be called if the script status is on enabled mode
54+
apply() {
55+
if [ "$PERMS_VALID" -eq 1 ]; then
56+
info "changing permission to 644 on $FILE"
57+
chmod 644 "$FILE"
58+
fi
59+
60+
if [ "$UID_VALID" -eq 1 ]; then
61+
info "changing owner to 0 on $FILE"
62+
chown 0 "$FILE"
63+
fi
64+
65+
if [ "$GID_VALID" -eq 1 ]; then
66+
info "changing group to 0 on $FILE"
67+
chgrp 0 "$FILE"
68+
fi
69+
}
70+
71+
# This function will check config parameters required
72+
check_config() {
73+
:
74+
}
75+
76+
# Source Root Dir Parameter
77+
if [ -r /etc/default/cis-hardening ]; then
78+
# shellcheck source=../../debian/default
79+
. /etc/default/cis-hardening
80+
fi
81+
if [ -z "$CIS_LIB_DIR" ]; then
82+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
83+
echo "Cannot source CIS_LIB_DIR variable, aborting."
84+
exit 128
85+
fi
86+
87+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
88+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
89+
# shellcheck source=../../lib/main.sh
90+
. "${CIS_LIB_DIR}"/main.sh
91+
else
92+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
93+
exit 128
94+
fi

‎bin/hardening/passwd_accounts_use_shadow.sh

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure accounts in /etc/passwd use shadowed passwords (Manual)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=1
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure accounts in /etc/passwd use shadowed passwords (Automated)"
19+
EXCEPTIONS=""
20+
21+
# This function will be called if the script status is on enabled / audit mode
22+
audit() {
23+
INVALID_USERS=""
24+
# Accounts with a shadowed password have an x in the second field in /etc/passwd.
25+
INVALID_USERS=$(awk -F: '($2 != "x" ) { print $1}' /etc/passwd)
26+
27+
if [ -n "$INVALID_USERS" ]; then
28+
for user in $INVALID_USERS; do
29+
if ! grep -w "$user" "$EXCEPTIONS" >/dev/null; then
30+
crit "$user does not use a shadow password"
31+
fi
32+
done
33+
fi
34+
35+
}
36+
37+
# This function will be called if the script status is on enabled mode
38+
apply() {
39+
# the CIS recommendation is to do it in an automated way, while also "Investigate to determine if the account is logged in and what it is being used for, to
40+
# determine if it needs to be forced off"
41+
# so we do this manually
42+
info "Please review the faulty accounts and update their password configuration, or set them as exceptions in the configuration"
43+
}
44+
45+
# This function will check config parameters required
46+
check_config() {
47+
:
48+
}
49+
50+
# maybe someone is gonna have a legit use case....
51+
create_config() {
52+
cat <<EOF
53+
# shellcheck disable=2034
54+
status=audit
55+
# Put here the accounts that should keep their non shadowed password
56+
EXCEPTIONS=''
57+
EOF
58+
}
59+
60+
# Source Root Dir Parameter
61+
if [ -r /etc/default/cis-hardening ]; then
62+
# shellcheck source=../../debian/default
63+
. /etc/default/cis-hardening
64+
fi
65+
if [ -z "$CIS_LIB_DIR" ]; then
66+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
67+
echo "Cannot source CIS_LIB_DIR variable, aborting."
68+
exit 128
69+
fi
70+
71+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
72+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
73+
# shellcheck source=../../lib/main.sh
74+
. "${CIS_LIB_DIR}"/main.sh
75+
else
76+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
77+
exit 128
78+
fi

‎tests/hardening/etc_security_opasswd_permissions.sh

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# shellcheck shell=bash
2+
# run-shellcheck
3+
test_audit() {
4+
for file in /etc/security/opasswd /etc/security/opasswd.old; do
5+
if [ -e "$file" ]; then
6+
7+
describe prepare failing test
8+
chmod 644 "$file"
9+
10+
describe On purpose failing test
11+
register_test retvalshouldbe 1
12+
# shellcheck disable=2154
13+
run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
14+
15+
describe correcting situation
16+
sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
17+
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
18+
19+
describe resolved test
20+
register_test retvalshouldbe 0
21+
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
22+
23+
describe ensure more restrictive is allowed
24+
chmod 400 "$file"
25+
26+
describe successful test
27+
register_test retvalshouldbe 0
28+
run successful "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
29+
30+
describe failling at uid
31+
chown 500 "$file"
32+
33+
describe On purpose failing test
34+
register_test retvalshouldbe 1
35+
# shellcheck disable=2154
36+
run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
37+
38+
describe correcting situation
39+
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
40+
41+
describe resolved test
42+
register_test retvalshouldbe 0
43+
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
44+
45+
describe failling at gid
46+
chown 500 "$file"
47+
48+
describe On purpose failing test
49+
register_test retvalshouldbe 1
50+
# shellcheck disable=2154
51+
run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
52+
53+
describe correcting situation
54+
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
55+
56+
describe resolved test
57+
register_test retvalshouldbe 0
58+
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
59+
60+
fi
61+
62+
done
63+
}

0 commit comments

Comments
 (0)