Skip to content

Commit f4a7caa

Browse files
author
damien cavagnini
committed
feat: add new debian12 scripts
- journald_log_file_access.sh -> 6.2.1.1.2 - journald_log_rotation.sh -> 6.2.1.1.3 - audit_log_user.sh -> 6.3.4.2 - audit_log_group.sh -> 6.3.4.3 - audit_log_directory_perms.sh -> 6.3.4.4 - audit_confs_perms.sh -> 6.3.4.5
1 parent 06067b0 commit f4a7caa

12 files changed

+775
-0
lines changed

‎bin/hardening/audit_confs_perms.sh

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure audit configuration files mode is configured (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="the audit configuration files have mode 640 or more restrictive"
19+
20+
AUDITD_CONF_DIR="/etc/audit"
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
AUDIT_CONF_PERMS_VALID=0
25+
26+
does_file_exist "$AUDITD_CONF_DIR"
27+
if [ "$FNRET" -eq 0 ]; then
28+
29+
AUDIT_INVALID_PERM_FILES=""
30+
if $SUDO_CMD find "$AUDITD_CONF_DIR" -type f \( -name '*.conf' -o -name '*.rules' \) -exec stat -Lc "%n %a" {} + | grep -Pv -- '^\h*\H+\h*([0,2,4,6][0,4]0)\h*$'; then
31+
AUDIT_INVALID_PERM_FILES=$($SUDO_CMD find "$AUDITD_CONF_DIR" -type f \( -name '*.conf' -o -name '*.rules' \) -exec stat -Lc "%n %a" {} + | grep -Pv -- '^\h*\H+\h*([0,2,4,6][0,4]0)\h*$')
32+
fi
33+
34+
# output example:
35+
# /etc/audit/auditd.conf 644
36+
# /etc/audit/audit.rules 644
37+
38+
if [ -n "$AUDIT_INVALID_PERM_FILES" ]; then
39+
crit "Some files have invalid permissions"
40+
AUDIT_CONF_PERMS_VALID=1
41+
for file in $AUDIT_INVALID_PERM_FILES; do
42+
info "$file"
43+
done
44+
fi
45+
46+
else
47+
info "$AUDITD_CONF_DIR does not exist"
48+
fi
49+
}
50+
51+
# This function will be called if the script status is on enabled mode
52+
apply() {
53+
if [ "$AUDIT_CONF_PERMS_VALID" -eq 1 ]; then
54+
for file in $AUDIT_INVALID_PERM_FILES; do
55+
file_path=$(awk '{print $1}' <<<"$file")
56+
info "Set perm 640 to $file_path"
57+
chmod 0640 "$file_path"
58+
done
59+
fi
60+
}
61+
62+
# This function will check config parameters required
63+
check_config() {
64+
:
65+
}
66+
67+
# Source Root Dir Parameter
68+
if [ -r /etc/default/cis-hardening ]; then
69+
# shellcheck source=../../debian/default
70+
. /etc/default/cis-hardening
71+
fi
72+
if [ -z "$CIS_LIB_DIR" ]; then
73+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
74+
echo "Cannot source CIS_LIB_DIR variable, aborting."
75+
exit 128
76+
fi
77+
78+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
79+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
80+
# shellcheck source=../../lib/main.sh
81+
. "${CIS_LIB_DIR}"/main.sh
82+
else
83+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
84+
exit 128
85+
fi

‎bin/hardening/audit_log_directory_perms.sh

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure the audit log directory mode is configured (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure the audit log directory mode is configured"
19+
20+
AUDITD_CONF_FILE="/etc/audit/auditd.conf"
21+
AUDIT_LOG_DIR_EXPECTED_PERM=""
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
AUDIT_LOG_DIR_PERMS=0
26+
27+
does_file_exist "$AUDITD_CONF_FILE"
28+
if [ "$FNRET" -eq 0 ]; then
29+
30+
AUDIT_LOG_DIRECTORY="$(dirname "$($SUDO_CMD grep -E "^\s*log_file" "$AUDITD_CONF_FILE" | awk -F"=" '{print $2}')")"
31+
local log_dir_perms
32+
log_dir_perms=$(stat -Lc %a "$AUDIT_LOG_DIRECTORY")
33+
34+
# 0750 will be output as 750 by stat
35+
# we add the missing 0 ourselves for easier comparison
36+
if [ "$(echo -n "$log_dir_perms" | wc -m)" -lt 4 ]; then
37+
log_dir_perms="0$log_dir_perms"
38+
fi
39+
40+
if [ "$log_dir_perms" != "$AUDIT_LOG_DIR_EXPECTED_PERM" ]; then
41+
crit "audit log directory '$AUDIT_LOG_DIRECTORY' permissions are '$log_dir_perms' instead of '$AUDIT_LOG_DIR_EXPECTED_PERM'"
42+
AUDIT_LOG_DIR_PERMS=1
43+
fi
44+
45+
else
46+
info "$AUDITD_CONF_FILE does not exist"
47+
fi
48+
}
49+
50+
# This function will be called if the script status is on enabled mode
51+
apply() {
52+
if [ "$AUDIT_LOG_DIR_PERMS" -eq 1 ]; then
53+
info "changing permission to on '$AUDIT_LOG_DIR_EXPECTED_PERM' '$AUDIT_LOG_DIRECTORY'"
54+
chmod "$AUDIT_LOG_DIR_EXPECTED_PERM" "$AUDIT_LOG_DIRECTORY"
55+
fi
56+
}
57+
58+
# This function will check config parameters required
59+
check_config() {
60+
:
61+
}
62+
63+
create_config() {
64+
cat <<EOF
65+
# shellcheck disable=2034
66+
status=audit
67+
# the expected permission for the directory owning the "log_file" directive in /etc/audit/auditd.conf
68+
# default is 0750, but can be less permissive
69+
AUDIT_LOG_DIR_EXPECTED_PERM="0750"
70+
EOF
71+
}
72+
73+
# Source Root Dir Parameter
74+
if [ -r /etc/default/cis-hardening ]; then
75+
# shellcheck source=../../debian/default
76+
. /etc/default/cis-hardening
77+
fi
78+
if [ -z "$CIS_LIB_DIR" ]; then
79+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
80+
echo "Cannot source CIS_LIB_DIR variable, aborting."
81+
exit 128
82+
fi
83+
84+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
85+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
86+
# shellcheck source=../../lib/main.sh
87+
. "${CIS_LIB_DIR}"/main.sh
88+
else
89+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
90+
exit 128
91+
fi

‎bin/hardening/audit_log_group.sh

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure only authorized groups are assigned ownership of audit log files (Automated
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure 'root' or 'adm' groups are assigned ownership of audit log files"
19+
AUDITD_CONF_FILE="/etc/audit/auditd.conf"
20+
AUDIT_LOG_GROUP=""
21+
22+
# This function will be called if the script status is on enabled / audit mode
23+
audit() {
24+
AUDIT_LOG_GROUP_VALID=0
25+
AUDIT_INVALID_LOGS=""
26+
27+
does_file_exist "$AUDITD_CONF_FILE"
28+
if [ "$FNRET" -eq 0 ]; then
29+
local log_file
30+
log_file=$($SUDO_CMD grep -E "^\s*log_file" "$AUDITD_CONF_FILE" | awk -F "=" '{print $2}')
31+
log_group=$($SUDO_CMD grep -E "^\s*log_group" "$AUDITD_CONF_FILE" | awk -F "=" '{print $2}')
32+
# look for all files in the directory
33+
AUDIT_INVALID_LOGS=$(find "$(dirname "$log_file")" -type f ! -group "$AUDIT_LOG_GROUP" -a ! -group root -exec stat -Lc "%n %U" {} +)
34+
35+
if [ -n "$AUDIT_INVALID_LOGS" ]; then
36+
crit "Some audit logs are not owned by group $AUDIT_LOG_GROUP nor root"
37+
for file in $AUDIT_INVALID_LOGS; do
38+
info "$file"
39+
done
40+
fi
41+
42+
if [[ "$log_group" != "$AUDIT_LOG_GROUP" ]]; then
43+
crit "'log_group' is '$log_group' instead of '$AUDIT_LOG_GROUP' in $AUDITD_CONF_FILE"
44+
AUDIT_LOG_GROUP_VALID=1
45+
fi
46+
47+
else
48+
info "$AUDITD_CONF_FILE does not exist"
49+
fi
50+
}
51+
52+
# This function will be called if the script status is on enabled mode
53+
apply() {
54+
if [ "$AUDIT_LOG_GROUP_VALID" -eq 1 ]; then
55+
info "changing log_group to $AUDIT_LOG_GROUP in $AUDITD_CONF_FILE"
56+
sed -Ei "/\s*log_group/s/=.*$/=$AUDIT_LOG_GROUP/" "$AUDITD_CONF_FILE"
57+
fi
58+
59+
if [ -n "$AUDIT_INVALID_LOGS" ]; then
60+
for file in $AUDIT_INVALID_LOGS; do
61+
file_path=$(awk '{print $1}' <<<"$file")
62+
info "Change group to '$AUDIT_LOG_GROUP' for '$file_path'"
63+
done
64+
fi
65+
}
66+
67+
# This function will check config parameters required
68+
check_config() {
69+
:
70+
}
71+
72+
create_config() {
73+
cat <<EOF
74+
# shellcheck disable=2034
75+
status=audit
76+
# put here the group name that maybe allowed to own audi log files
77+
# this is the one found under the "log_group" directive in /etc/audit/auditd.conf
78+
# the 'root' group is allowed in addition to this one
79+
AUDIT_LOG_GROUP='adm'
80+
EOF
81+
}
82+
83+
# Source Root Dir Parameter
84+
if [ -r /etc/default/cis-hardening ]; then
85+
# shellcheck source=../../debian/default
86+
. /etc/default/cis-hardening
87+
fi
88+
if [ -z "$CIS_LIB_DIR" ]; then
89+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
90+
echo "Cannot source CIS_LIB_DIR variable, aborting."
91+
exit 128
92+
fi
93+
94+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
95+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
96+
# shellcheck source=../../lib/main.sh
97+
. "${CIS_LIB_DIR}"/main.sh
98+
else
99+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
100+
exit 128
101+
fi

‎bin/hardening/audit_log_user.sh

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure only authorized users own audit log files (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="audit log files should be owned by the correct user"
19+
20+
AUDITD_CONF_FILE="/etc/audit/auditd.conf"
21+
AUDIT_LOG_USER=""
22+
23+
# This function will be called if the script status is on enabled / audit mode
24+
audit() {
25+
AUDIT_INVALID_LOGS=""
26+
27+
does_file_exist "$AUDITD_CONF_FILE"
28+
if [ "$FNRET" -eq 0 ]; then
29+
local log_file
30+
log_file=$($SUDO_CMD grep -E "^\s*log_file" "$AUDITD_CONF_FILE" | awk -F "=" '{print $2}')
31+
# look for all files in the directory
32+
AUDIT_INVALID_LOGS=$(find "$(dirname "$log_file")" -type f ! -user "$AUDIT_LOG_USER" -exec stat -Lc "%n %U" {} +)
33+
34+
if [ -n "$AUDIT_INVALID_LOGS" ]; then
35+
crit "Some audit logs are not owned by $AUDIT_LOG_USER"
36+
for file in $AUDIT_INVALID_LOGS; do
37+
info "$file"
38+
done
39+
fi
40+
else
41+
info "$AUDITD_CONF_FILE does not exist"
42+
fi
43+
}
44+
45+
# This function will be called if the script status is on enabled mode
46+
apply() {
47+
if [ -n "$AUDIT_INVALID_LOGS" ]; then
48+
49+
for file in $AUDIT_INVALID_LOGS; do
50+
file_path=$(awk '{print $1}' <<<"$file")
51+
info "Change owner to '$AUDIT_LOG_USER' for '$file_path'"
52+
chown "$AUDIT_LOG_USER" "$file_path"
53+
done
54+
55+
fi
56+
}
57+
58+
# This function will check config parameters required
59+
check_config() {
60+
:
61+
}
62+
63+
create_config() {
64+
cat <<EOF
65+
# shellcheck disable=2034
66+
status=audit
67+
AUDIT_LOG_USER='root'
68+
EOF
69+
}
70+
71+
# Source Root Dir Parameter
72+
if [ -r /etc/default/cis-hardening ]; then
73+
# shellcheck source=../../debian/default
74+
. /etc/default/cis-hardening
75+
fi
76+
if [ -z "$CIS_LIB_DIR" ]; then
77+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
78+
echo "Cannot source CIS_LIB_DIR variable, aborting."
79+
exit 128
80+
fi
81+
82+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
83+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
84+
# shellcheck source=../../lib/main.sh
85+
. "${CIS_LIB_DIR}"/main.sh
86+
else
87+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
88+
exit 128
89+
fi

0 commit comments

Comments
 (0)