Skip to content

Commit f46dc89

Browse files
author
damien cavagnini
committed
feat: add debian12 scripts
- etc_shells_permissions.sh -> 7.1.9 - etc_security_opasswd_permissions.sh -> 7.1.10
1 parent 0a8a408 commit f46dc89

File tree

4 files changed

+321
-0
lines changed

4 files changed

+321
-0
lines changed

‎bin/hardening/etc_security_opasswd_permissions.sh

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure permissions on /etc/security/opasswd are configured (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=1
17+
# shellcheck disable=2034
18+
DESCRIPTION="verify /etc/security/opasswd and /etc/security/opasswd.old are mode 600 or more restrictive, Uid is 0/root and Gid is
19+
0/root"
20+
21+
FILES='/etc/security/opasswd /etc/security/opasswd.old'
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
# we treat both files as one for simplicity
26+
PERMS_VALID=0
27+
UID_VALID=0
28+
GID_VALID=0
29+
30+
VALID_FILES=""
31+
for file in $FILES; do
32+
does_file_exist "$file"
33+
if [ "$FNRET" -eq 0 ]; then
34+
VALID_FILES="$VALID_FILES $file"
35+
fi
36+
done
37+
38+
for file in $VALID_FILES; do
39+
40+
file_stats=$(stat -Lc '%a %u %g' "$file")
41+
42+
if ! grep "[0-6]00" <<<"$(awk '{print $1}' <<<"$file_stats")" >/dev/null; then
43+
crit "$file 's perms are not 600 or less"
44+
PERMS_VALID=1
45+
fi
46+
47+
if [ "$(awk '{print $2}' <<<"$file_stats")" -ne 0 ]; then
48+
crit "$file owner's uid is not 0"
49+
UID_VALID=1
50+
fi
51+
52+
if [ "$(awk '{print $3}' <<<"$file_stats")" -ne 0 ]; then
53+
crit "$file group's gid is not 0"
54+
GID_VALID=1
55+
fi
56+
57+
done
58+
59+
}
60+
61+
# This function will be called if the script status is on enabled mode
62+
apply() {
63+
if [ "$PERMS_VALID" -eq 1 ]; then
64+
for file in $VALID_FILES; do
65+
info "changing permission to 600 on $file"
66+
chmod 600 "$file"
67+
done
68+
fi
69+
70+
if [ "$UID_VALID" -eq 1 ]; then
71+
for file in $VALID_FILES; do
72+
info "changing owner to 0 on $file"
73+
chown 0 "$file"
74+
done
75+
fi
76+
77+
if [ "$GID_VALID" -eq 1 ]; then
78+
for file in $VALID_FILES; do
79+
info "changing group to 0 on $file"
80+
chgrp 0 "$file"
81+
done
82+
fi
83+
}
84+
85+
# This function will check config parameters required
86+
check_config() {
87+
:
88+
}
89+
90+
# Source Root Dir Parameter
91+
if [ -r /etc/default/cis-hardening ]; then
92+
# shellcheck source=../../debian/default
93+
. /etc/default/cis-hardening
94+
fi
95+
if [ -z "$CIS_LIB_DIR" ]; then
96+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
97+
echo "Cannot source CIS_LIB_DIR variable, aborting."
98+
exit 128
99+
fi
100+
101+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
102+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
103+
# shellcheck source=../../lib/main.sh
104+
. "${CIS_LIB_DIR}"/main.sh
105+
else
106+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
107+
exit 128
108+
fi

‎bin/hardening/etc_shells_permissions.sh

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure permissions on /etc/shells are configured (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=1
17+
# shellcheck disable=2034
18+
DESCRIPTION="verify /etc/shells is mode 644 or more restrictive, Uid is 0/root and Gid is 0/root"
19+
20+
FILE='/etc/shells'
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
PERMS_VALID=0
25+
UID_VALID=0
26+
GID_VALID=0
27+
28+
does_file_exist "$FILE"
29+
if [ "$FNRET" -eq 0 ]; then
30+
file_stats=$(stat -Lc '%a %u %g' "$FILE")
31+
32+
if ! grep "[0-6][0-4][0-4]" <<<"$(awk '{print $1}' <<<"$file_stats")" >/dev/null; then
33+
crit "$FILE 's perms are not 644 or less"
34+
PERMS_VALID=1
35+
fi
36+
37+
if [ "$(awk '{print $2}' <<<"$file_stats")" -ne 0 ]; then
38+
crit "$FILE owner's uid is not 0"
39+
UID_VALID=1
40+
fi
41+
42+
if [ "$(awk '{print $3}' <<<"$file_stats")" -ne 0 ]; then
43+
crit "$FILE group's gid is not 0"
44+
GID_VALID=1
45+
fi
46+
47+
else
48+
info "$FILE is missing"
49+
fi
50+
51+
}
52+
53+
# This function will be called if the script status is on enabled mode
54+
apply() {
55+
if [ "$PERMS_VALID" -eq 1 ]; then
56+
info "changing permission to 644 on $FILE"
57+
chmod 644 "$FILE"
58+
fi
59+
60+
if [ "$UID_VALID" -eq 1 ]; then
61+
info "changing owner to 0 on $FILE"
62+
chown 0 "$FILE"
63+
fi
64+
65+
if [ "$GID_VALID" -eq 1 ]; then
66+
info "changing group to 0 on $FILE"
67+
chgrp 0 "$FILE"
68+
fi
69+
}
70+
71+
# This function will check config parameters required
72+
check_config() {
73+
:
74+
}
75+
76+
# Source Root Dir Parameter
77+
if [ -r /etc/default/cis-hardening ]; then
78+
# shellcheck source=../../debian/default
79+
. /etc/default/cis-hardening
80+
fi
81+
if [ -z "$CIS_LIB_DIR" ]; then
82+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
83+
echo "Cannot source CIS_LIB_DIR variable, aborting."
84+
exit 128
85+
fi
86+
87+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
88+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
89+
# shellcheck source=../../lib/main.sh
90+
. "${CIS_LIB_DIR}"/main.sh
91+
else
92+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
93+
exit 128
94+
fi

‎tests/hardening/etc_security_opasswd_permissions.sh

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# shellcheck shell=bash
2+
# run-shellcheck
3+
test_audit() {
4+
for file in /etc/security/opasswd /etc/security/opasswd.old; do
5+
if [ -e "$file" ]; then
6+
7+
describe prepare failing test
8+
chmod 644 "$file"
9+
10+
describe On purpose failing test
11+
register_test retvalshouldbe 1
12+
# shellcheck disable=2154
13+
run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
14+
15+
describe correcting situation
16+
sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
17+
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
18+
19+
describe resolved test
20+
register_test retvalshouldbe 0
21+
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
22+
23+
describe ensure more restrictive is allowed
24+
chmod 400 "$file"
25+
26+
describe successful test
27+
register_test retvalshouldbe 0
28+
run successful "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
29+
30+
describe failling at uid
31+
chown 500 "$file"
32+
33+
describe On purpose failing test
34+
register_test retvalshouldbe 1
35+
# shellcheck disable=2154
36+
run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
37+
38+
describe correcting situation
39+
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
40+
41+
describe resolved test
42+
register_test retvalshouldbe 0
43+
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
44+
45+
describe failling at gid
46+
chown 500 "$file"
47+
48+
describe On purpose failing test
49+
register_test retvalshouldbe 1
50+
# shellcheck disable=2154
51+
run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
52+
53+
describe correcting situation
54+
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
55+
56+
describe resolved test
57+
register_test retvalshouldbe 0
58+
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
59+
60+
fi
61+
62+
done
63+
}

‎tests/hardening/etc_shells_permissions.sh

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# shellcheck shell=bash
2+
# run-shellcheck
3+
test_audit() {
4+
describe prepare failing test
5+
chmod 646 /etc/shells
6+
7+
describe On purpose failing test
8+
register_test retvalshouldbe 1
9+
# shellcheck disable=2154
10+
run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
11+
12+
describe correcting situation
13+
sed -i 's/audit/enabled/' "${CIS_CONF_DIR}/conf.d/${script}.cfg"
14+
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
15+
16+
describe resolved test
17+
register_test retvalshouldbe 0
18+
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
19+
20+
describe ensure more restrictive is allowed
21+
chmod 440 /etc/shells
22+
23+
describe successful test
24+
register_test retvalshouldbe 0
25+
run successful "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
26+
27+
describe failling at uid
28+
chown 500 /etc/shells
29+
30+
describe On purpose failing test
31+
register_test retvalshouldbe 1
32+
# shellcheck disable=2154
33+
run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
34+
35+
describe correcting situation
36+
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
37+
38+
describe resolved test
39+
register_test retvalshouldbe 0
40+
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
41+
42+
describe failling at gid
43+
chown 500 /etc/shells
44+
45+
describe On purpose failing test
46+
register_test retvalshouldbe 1
47+
# shellcheck disable=2154
48+
run failed "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
49+
50+
describe correcting situation
51+
"${CIS_CHECKS_DIR}/${script}.sh" --apply || true
52+
53+
describe resolved test
54+
register_test retvalshouldbe 0
55+
run resolved "${CIS_CHECKS_DIR}/${script}.sh" --audit-all
56+
}

0 commit comments

Comments
 (0)