Skip to content

Commit a65bd7e

Browse files
author
damien cavagnini
committed
feat: add debian12 scripts
- pam_unix_nullok_absent.sh -> 5.3.3.4.1 - pam_unix_remember_absent.sh -> 5.3.3.4.2 - pam_use_authtok_enabled.sh -> 5.3.3.4.4 - find_suid_and_sgid_files.sh -> 7.1.13 This is the concatenation of existing find_suid_files.sh and find_sgid_files.sh - auditd_running_config_same_on_disk.sh -> 6.3.3.21
1 parent 15c4df1 commit a65bd7e

11 files changed

+619
-1
lines changed

‎bin/hardening/auditd_running_config_same_on_disk.sh‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure the running and on disk configuration is the same (Manual)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
# shellcheck disable=2034
18+
DESCRIPTION="Ensure the running and on disk configuration is the same"
19+
20+
# This function will be called if the script status is on enabled / audit mode
21+
# shellcheck disable=2120
22+
audit() {
23+
# Ensure that all rules in /etc/audit/rules.d have been merged into /etc/audit/audit.rules
24+
AUDIT_RULES_UPTODATE=0
25+
BINARY_PATH="/usr/sbin"
26+
27+
# the day we clean debian 11, don't forget the sudo rules
28+
if [ "$DEB_MAJ_VER" -eq 11 ]; then
29+
BINARY_PATH="/sbin"
30+
fi
31+
32+
local result
33+
result=$($SUDO_CMD "$BINARY_PATH"/augenrules --check)
34+
# /usr/sbin/augenrules: No change
35+
# or
36+
# /usr/sbin/augenrules: Rules have changed and should be updated
37+
if grep -q "updated" <<<"$result"; then
38+
AUDIT_RULES_UPTODATE=1
39+
fi
40+
41+
if [ "$AUDIT_RULES_UPTODATE" -eq 0 ]; then
42+
ok "audit rules are merged"
43+
else
44+
crit "audit rules need to be merged"
45+
fi
46+
47+
}
48+
49+
# This function will be called if the script status is on enabled mode
50+
apply() {
51+
if [ "$AUDIT_RULES_UPTODATE" -eq 1 ]; then
52+
info "merging audit rules"
53+
"$BINARY_PATH"/augenrules --load
54+
fi
55+
56+
info "check if reboot is required"
57+
local reboot_required=0
58+
reboot_required=$($SUDO_CMD "$BINARY_PATH"/auditctl -s | awk '/enabled/ {print $2}')
59+
if [ "$reboot_required" -eq 2 ]; then
60+
info "Reboot required to load rules"
61+
fi
62+
}
63+
64+
# This function will check config parameters required
65+
check_config() {
66+
:
67+
}
68+
69+
# Source Root Dir Parameter
70+
if [ -r /etc/default/cis-hardening ]; then
71+
# shellcheck source=../../debian/default
72+
. /etc/default/cis-hardening
73+
fi
74+
if [ -z "$CIS_LIB_DIR" ]; then
75+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
76+
echo "Cannot source CIS_LIB_DIR variable, aborting."
77+
exit 128
78+
fi
79+
80+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
81+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
82+
# shellcheck source=../../lib/main.sh
83+
. "${CIS_LIB_DIR}"/main.sh
84+
else
85+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
86+
exit 128
87+
fi

‎bin/hardening/find_suid_and_sgid_files.sh‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Audit SUID and SGID executables (Manual)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=2
17+
# shellcheck disable=2034
18+
DESCRIPTION="Find SUID and SGID system executables."
19+
IGNORED_PATH=''
20+
21+
# find emits following error if directory or file disappear during
22+
# tree traversal: find: ‘/tmp/xxx’: No such file or directory
23+
FIND_IGNORE_NOSUCHFILE_ERR=false
24+
25+
# This function will be called if the script status is on enabled / audit mode
26+
audit() {
27+
info "Checking if there are suid files"
28+
if [ -n "$IGNORED_PATH" ]; then
29+
# maybe IGNORED_PATH allow us to filter out some FS
30+
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}' | grep -vE "$IGNORED_PATH")
31+
32+
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set +e
33+
# shellcheck disable=2086
34+
FOUND_BINARIES=$($SUDO_CMD find $FS_NAMES -xdev -ignore_readdir_race -type f \( -perm -4000 -o -perm -2000 \) -regextype 'egrep' ! -regex $IGNORED_PATH -print)
35+
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set -e
36+
else
37+
FS_NAMES=$(df --local -P | awk '{if (NR!=1) print $6}')
38+
39+
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set +e
40+
# shellcheck disable=2086
41+
FOUND_BINARIES=$($SUDO_CMD find $FS_NAMES -xdev -ignore_readdir_race -type f \( -perm -4000 -o -perm -2000 \) -print)
42+
[ "${FIND_IGNORE_NOSUCHFILE_ERR}" = true ] && set -e
43+
fi
44+
45+
BAD_BINARIES=""
46+
for BINARY in $FOUND_BINARIES; do
47+
if grep -qw "$BINARY" <<<"$EXCEPTIONS"; then
48+
debug "$BINARY is confirmed as an exception"
49+
else
50+
BAD_BINARIES="$BAD_BINARIES $BINARY"
51+
fi
52+
done
53+
if [ -n "$BAD_BINARIES" ]; then
54+
crit "Some suid / sgid files are present"
55+
# shellcheck disable=SC2001
56+
FORMATTED_RESULT=$(sed "s/ /\n/g" <<<"$BAD_BINARIES" | sort | uniq | tr '\n' ' ')
57+
crit "$FORMATTED_RESULT"
58+
else
59+
ok "No unknown suid / sgid files found"
60+
fi
61+
}
62+
63+
# This function will be called if the script status is on enabled mode
64+
apply() {
65+
info "please review manually the binaries in the output"
66+
}
67+
68+
# This function will create the config file for this check with default values
69+
create_config() {
70+
cat <<EOF
71+
status=audit
72+
# Put Here your valid suid binaries so that they do not appear during the audit
73+
EXCEPTIONS="/bin/mount /bin/ping /bin/ping6 /bin/su /bin/umount /sbin/unix_chkpwd /usr/bin/at /usr/bin/bsd-write /usr/bin/chage /usr/bin/chfn /usr/bin/chsh /usr/bin/crontab /usr/bin/dotlockfile /usr/bin/expiry /usr/bin/fping /usr/bin/fping6 /usr/bin/gpasswd /usr/bin/mail-lock /usr/bin/mail-touchlock /usr/bin/mail-unlock /usr/bin/mount /usr/bin/mtr /usr/bin/mutt_dotlock /usr/bin/newgrp /usr/bin/passwd /usr/bin/ping /usr/bin/ping6 /usr/bin/screen /usr/bin/ssh-agent /usr/bin/su /usr/bin/sudo /usr/bin/sudoedit /usr/bin/umount /usr/bin/wall /usr/lib/openssh/ssh-keysign /usr/lib/pt_chown /usr/sbin/postdrop /usr/sbin/postqueue /usr/sbin/unix_chkpwd"
74+
EOF
75+
}
76+
77+
# This function will check config parameters required
78+
check_config() {
79+
# No param for this function
80+
:
81+
}
82+
83+
# Source Root Dir Parameter
84+
if [ -r /etc/default/cis-hardening ]; then
85+
# shellcheck source=../../debian/default
86+
. /etc/default/cis-hardening
87+
fi
88+
if [ -z "$CIS_LIB_DIR" ]; then
89+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
90+
echo "Cannot source CIS_LIB_DIR variable, aborting."
91+
exit 128
92+
fi
93+
94+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
95+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
96+
# shellcheck source=../../lib/main.sh
97+
. "${CIS_LIB_DIR}"/main.sh
98+
else
99+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
100+
exit 128
101+
fi

‎bin/hardening/pam_unix_nullok_absent.sh‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure pam_unix does not include nullok (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
DESCRIPTION="Ensure pam_unix does not include nullok"
18+
19+
# The nullok argument overrides the default action of pam_unix.so to not permit the user access to a service if their official password is blank.
20+
21+
# This function will be called if the script status is on enabled / audit mode
22+
audit() {
23+
PAM_INVALID_FILES=""
24+
25+
if grep "pam_unix\.so" /etc/pam.d/common-{password,auth,account,session,session-noninteractive} >/dev/null; then
26+
PAM_INVALID_FILES=$(grep -HP -- '^\h*^\h*[^#\n\r]+\h+pam_unix\.so\b' /etc/pam.d/common-{password,auth,account,session,session-noninteractive} | awk -F ':' '/nullok/ {print $1}')
27+
fi
28+
29+
for file in $PAM_INVALID_FILES; do
30+
crit "$file contains nullok"
31+
done
32+
}
33+
34+
# This function will be called if the script status is on enabled mode
35+
apply() {
36+
if [ -n "$PAM_INVALID_FILES" ]; then
37+
info "editing pam-config files to remove nullok"
38+
sed -i 's/nullok//g' /usr/share/pam-configs/*
39+
40+
# if custom files are being used, the corresponding files in /etc/pam.d/ would need
41+
# to be edited directly, and the pam-auth-update --enable <EDITED_PROFILE_NAME>
42+
# command skipped
43+
# -> so we edit directly also the pam.d files
44+
for file in $PAM_INVALID_FILES; do
45+
info "editing $file to remove nullok"
46+
sed -i 's/nullok//g' "$file"
47+
done
48+
fi
49+
50+
}
51+
52+
# This function will check config parameters required
53+
check_config() {
54+
:
55+
}
56+
57+
# Source Root Dir Parameter
58+
if [ -r /etc/default/cis-hardening ]; then
59+
# shellcheck source=../../debian/default
60+
. /etc/default/cis-hardening
61+
fi
62+
if [ -z "$CIS_LIB_DIR" ]; then
63+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
64+
echo "Cannot source CIS_LIB_DIR variable, aborting."
65+
exit 128
66+
fi
67+
68+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
69+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
70+
# shellcheck source=../../lib/main.sh
71+
. "${CIS_LIB_DIR}"/main.sh
72+
else
73+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
74+
exit 128
75+
fi

‎bin/hardening/pam_unix_remember_absent.sh‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
#!/bin/bash
2+
3+
# run-shellcheck
4+
#
5+
# CIS Debian Hardening
6+
#
7+
8+
#
9+
# Ensure pam_unix does not include remember (Automated)
10+
#
11+
12+
set -e # One error, it's over
13+
set -u # One variable unset, it's over
14+
15+
# shellcheck disable=2034
16+
HARDENING_LEVEL=3
17+
DESCRIPTION="Ensure pam_unix does not include remember"
18+
19+
# The remember=n argument saves the last n passwords for each user in
20+
# /etc/security/opasswd in order to force password change history and keep the user
21+
# from alternating between the same password too frequently. The MD5 password hash
22+
# algorithm is used for storing the old passwords. Instead of this option the pam_pwhistory
23+
# module should be used. The pam_pwhistory module saves the last n passwords for
24+
# each user in /etc/security/opasswd using the password hash algorithm set on the
25+
# pam_unix module. This allows for the yescrypt or sha512 hash algorithm to be used.
26+
27+
# This function will be called if the script status is on enabled / audit mode
28+
audit() {
29+
PAM_INVALID_FILES=""
30+
31+
if grep "pam_unix\.so" /etc/pam.d/common-{password,auth,account,session,session-noninteractive} >/dev/null; then
32+
PAM_INVALID_FILES=$(grep -HP -- '^\h*^\h*[^#\n\r]+\h+pam_unix\.so\b' /etc/pam.d/common-{password,auth,account,session,session-noninteractive} | awk -F ':' '/remember/ {print $1}')
33+
fi
34+
35+
for file in $PAM_INVALID_FILES; do
36+
crit "$file contains remember"
37+
done
38+
39+
if [ -n "$PAM_INVALID_FILES" ]; then
40+
warn "'apply' will remove 'remember' from /etc/pam.d, you should ensure the 'pam_pwhistory' module is configured"
41+
fi
42+
}
43+
44+
# This function will be called if the script status is on enabled mode
45+
apply() {
46+
if [ -n "$PAM_INVALID_FILES" ]; then
47+
info "editing pam-config files to remove remember"
48+
sed -i 's/remember=[0-9]*//g' /usr/share/pam-configs/*
49+
50+
# if custom files are being used, the corresponding files in /etc/pam.d/ would need
51+
# to be edited directly, and the pam-auth-update --enable <EDITED_PROFILE_NAME>
52+
# command skipped
53+
# -> so we edit directly also the pam.d files
54+
for file in $PAM_INVALID_FILES; do
55+
info "editing $file to remove remember"
56+
sed -i 's/remember=[0-9]*//g' "$file"
57+
done
58+
fi
59+
60+
}
61+
62+
# This function will check config parameters required
63+
check_config() {
64+
:
65+
}
66+
67+
# Source Root Dir Parameter
68+
if [ -r /etc/default/cis-hardening ]; then
69+
# shellcheck source=../../debian/default
70+
. /etc/default/cis-hardening
71+
fi
72+
if [ -z "$CIS_LIB_DIR" ]; then
73+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
74+
echo "Cannot source CIS_LIB_DIR variable, aborting."
75+
exit 128
76+
fi
77+
78+
# Main function, will call the proper functions given the configuration (audit, enabled, disabled)
79+
if [ -r "${CIS_LIB_DIR}"/main.sh ]; then
80+
# shellcheck source=../../lib/main.sh
81+
. "${CIS_LIB_DIR}"/main.sh
82+
else
83+
echo "Cannot find main.sh, have you correctly defined your root directory? Current value is $CIS_LIB_DIR in /etc/default/cis-hardening"
84+
exit 128
85+
fi

0 commit comments

Comments
 (0)