-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathlinux.sh
executable file
·138 lines (126 loc) · 7.68 KB
/
linux.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
#!/usr/bin/env -S bats -p
#
# (c) 2020 ZibaSec Inc
#
# Audits a Linux System for sane security defaults
#
if [[ `whoami` != "root" ]]; then
echo "Must run with sudo or as root" >&2
exit 1
fi
@test "Disk encryption is enabled" {
# Checks for at least one encrypted volume
result="$(blkid | grep crypt)"
[[ ! -z "$result" ]]
}
@test "Firewall is present" {
# iptables should be present on Linux by default
result="$(iptables -L)"
[[ ! -z "$result" ]]
}
@test "FTP is not running" {
run systemctl status ftpd
[[ "$status" -eq 4 ]]
}
@test "Remote shell is not installed" {
# Fix by uninstalling any of the packages present
run command -v rsh-server
[[ "$status" -eq 1 ]]
run command -v openssh-server
[[ "$status" -eq 1 ]]
run command -v rsh-redone-server
[[ "$status" -eq 1 ]]
run command -v sbrsh
[[ "$status" -eq 1 ]]
run command -v sbrshd
[[ "$status" -eq 1 ]]
}
@test "SMB is not installed" {
# Fix by uninstalling any of the packages present
run command -v smbnetfx
[[ "$status" -eq 1 ]]
run command -v smb4k
[[ "$status" -eq 1 ]]
run command -v sambda-vfs-modules
[[ "$status" -eq 1 ]]
}
@test "New terminal session must re-prompt for sudo password" {
# Fix by adding 'Defaults tty_tickets' to /etc/sudoers
# if you run into complaints that your user is not in the sudoers file, you can add '<yourusername> ALL=(ALL) ALL' to the file
# Make sure that the 'Defaults tty_tickets' is declared before the line adding your user.
result="$(grep tty_tickets /etc/sudoers)"
[[ ${result} =~ ^Defaults.*tty_tickets$ ]]
}
@test "Auditing is configured and active" {
# Fix by installing auditd: `sudo apt install auditd`
result="$(systemctl status auditd | grep Active)"
[[ ${result} == *"Active: active (running)"* ]]
}
@test "Audit issues warning to syslog at 75 MB of space left" {
# Fix by adding `space_left = 75` to /etc/audit/auditd.conf
result="$(grep -c 'space_left = 75' /etc/audit/auditd.conf)"
[[ ${result} == "1" ]]
# Fix by adding `space_left_action = SYSLOG` to /etc/audit/auditd.conf
result="$(grep -c 'space_left_action = SYSLOG' /etc/audit/auditd.conf)"
[[ ${result} == "1" ]]
}
@test "Audit admin-level actions (kernel modules, etc)" {
# Fix by adding `-w /etc/sudoers -p wa -k actions` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-w /etc/sudoers -p wa -k actions' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
# Fix by adding `-w /etc/sudoers.d/ -p wa -k actions` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-w /etc/sudoers.d/ -p wa -k actions' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
}
@test "Audit access restriction enforcement" {
# Fix by adding `-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
# Fix by adding `-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=unset -F key=perm_mod' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
# Fix by adding `-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
# Fix by adding `-a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>=1000 -F auid!=unset -F key=perm_mod' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
# Fix by adding `-a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
# Fix by adding `-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=unset -F key=perm_mod' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
# Fix by adding `-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
# Fix by adding `-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
# Fix by adding `-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
# Fix by adding `-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
}
@test "Audit login/access type actions" {
# Fix by adding `-w /var/log/tallylog -p wa -k logins` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-w /var/log/tallylog -p wa -k logins' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
# Fix by adding `-w /var/run/faillock/ -p wa -k logins` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-w /var/run/faillock/ -p wa -k logins' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
# Fix by adding `-w /var/log/lastlog -p wa -k logins` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-w /var/log/lastlog -p wa -k logins' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
# Fix by adding `-w /var/run/utmp -p wa -k session` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-w /var/run/utmp -p wa -k session' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
# Fix by adding `-w /var/log/btmp -p wa -k session` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-w /var/log/btmp -p wa -k session' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
# Fix by adding `-w /var/log/wtmp -p wa -k session` to /etc/audit/rules.d/audit.rules
result="$(grep -i '\-w /var/log/wtmp -p wa -k session' /etc/audit/audit.rules)"
[[ ! -z "$result" ]]
}