Skip to content

Commit 9c4eef5

Browse files
Samson-WSamson-W
authored
Merge pull request #56 from Samson-W/master
Add CIS-compliant Debian 13 support
2 parents 4d2a248 + 2c1a6ce commit 9c4eef5

94 files changed

Lines changed: 1127 additions & 123 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎README-CN.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# harbian-audit审计与加固
22

33
## 简介
4-
此项目是一个Debian GNU/Linux及CentOS 8及Ubuntu发行版加固的审计工具。主要的测试环境是基于Debian GNU/Linux 9/10/11/12及CentOS 8及Ubuntu22，其它版本未充分测试。此项目主要是针对服务器版本，对桌面版本的项没有实现。
4+
此项目是一个Debian GNU/Linux及CentOS 8及Ubuntu发行版加固的审计工具。主要的测试环境是基于Debian GNU/Linux 9/10/11/12/13及CentOS 8及Ubuntu22，其它版本未充分测试。此项目主要是针对服务器版本，对桌面版本的项没有实现。
55
此项目的框架基于[OVH-debian-cis](https://github.com/ovh/debian-cis)，根据Debian GNU/Linux 9的一些特性进行了优化，并根据安全部署合规STIG（[STIG Red_Hat_Enterprise_Linux_7_V2R5](redhat-STIG-DOCs/U_Red_Hat_Enterprise_Linux_7_V2R5_STIG.zip)及[STIG Ubuntu V1R2](https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Canonical_Ubuntu_16-04_LTS_V1R2_STIG.zip)）及CIS（[cisecurity.org](https://www.cisecurity.org/)）进行了安全检查项的添加，同时也根据HardenedLinux社区就具体生产环境添加了一些安全检查项的审计功能的实现。此项目不仅具有安全项的审计功能，同时也有自动修改的功能。
66

77
审计功能的使用示例：

‎README.md‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
44

55
Hardened Debian GNU/Linux and CentOS 8 distro auditing.
66

7-
The main test environment is in debian GNU/Linux 9/10/11/12 and CentOS 8 and ubuntu 22, and other versions are not fully tested. There are no implementations of desktop related items in this release.
7+
The main test environment is in debian GNU/Linux 9/10/11/12/13 and CentOS 8 and ubuntu 22, and other versions are not fully tested. There are no implementations of desktop related items in this release.
88

9-
The code framework is based on the [OVH-debian-cis](https://github.com/ovh/debian-cis) project, Modified some of the original implementations according to the features of Debian 9/10/11/12 and CentOS 8, added and implemented check items for [STIG Red_Hat_Enterprise_Linux_7_V2R5](https://github.com/hardenedlinux/STIG-OS-mirror/blob/master/redhat-STIG-DOCs/U_Red_Hat_Enterprise_Linux_7_V2R5_STIG.zip) [STIG Ubuntu V1R2](https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Canonical_Ubuntu_16-04_LTS_V1R2_STIG.zip) and [cisecurity.org](https://www.cisecurity.org/) recommendations, and also added and implemented some check items by the HardenedLinux community. The audit and apply functions of the infrastructure are implemented, and the automatic fix function is implemented for the items that can be automatically fixed.
9+
The code framework is based on the [OVH-debian-cis](https://github.com/ovh/debian-cis) project, Modified some of the original implementations according to the features of Debian 9/10/11/12/13 and CentOS 8, added and implemented check items for [STIG Red_Hat_Enterprise_Linux_7_V2R5](https://github.com/hardenedlinux/STIG-OS-mirror/blob/master/redhat-STIG-DOCs/U_Red_Hat_Enterprise_Linux_7_V2R5_STIG.zip) [STIG Ubuntu V1R2](https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Canonical_Ubuntu_16-04_LTS_V1R2_STIG.zip) and [cisecurity.org](https://www.cisecurity.org/) recommendations, and also added and implemented some check items by the HardenedLinux community. The audit and apply functions of the infrastructure are implemented, and the automatic fix function is implemented for the items that can be automatically fixed.
1010

1111

1212
```console
@@ -47,12 +47,12 @@ hardening [INFO] Treating /home/test/harbian-audit/bin/hardening
4747
1.1_install_updates [ OK ] Check Passed
4848
[...]
4949
################### SUMMARY ###################
50-
Total Available Checks : 270
51-
Total Runned Checks : 270
52-
Total Passed Checks : [ 226/270 ]
53-
Total Failed Checks : [ 44/270 ]
50+
Total Available Checks : 284
51+
Total Runned Checks : 284
52+
Total Passed Checks : [ 260/284 ]
53+
Total Failed Checks : [ 24/284 ]
5454
Enabled Checks Percentage : 100.00 %
55-
Conformity Percentage : 83.70 %
55+
Conformity Percentage : 91.55 %
5656
# bin/hardening.sh --set-hardening-level 5
5757
# bin/hardening.sh --apply
5858
hardening [INFO] Treating /home/test/harbian-audit/bin/hardening/1.1_install_updates.sh
@@ -181,7 +181,7 @@ Set the corresponding firewall rules according to the applications used. Hardene
181181

182182
### Iptabels format rules:
183183
[etc.iptables.rules.v4.sh](https://github.com/hardenedlinux/harbian-audit/blob/master/docs/configurations/etc.iptables.rules.v4.sh)
184-
to do the following:
184+
First install the iptables-persistent package, then to do the following:
185185
```
186186
$ INTERFACENAME="your network interfacename(Example eth0)"
187187
# bash docs/configurations/etc.iptables.rules.v4.sh $INTERFACENAME

‎bin/hardening.sh‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -240,6 +240,8 @@ elif [ $OS_RELEASE -eq 11 ]; then
240240
info "Start auditing for Debian11."
241241
elif [ $OS_RELEASE -eq 12 ]; then
242242
info "Start auditing for Debian12."
243+
elif [ $OS_RELEASE -eq 13 ]; then
244+
info "Start auditing for Debian13."
243245
elif [ $OS_RELEASE -eq 2 ]; then
244246
info "Start auditing for redhat/CentOS."
245247
elif [ $OS_RELEASE -eq 3 ]; then
@@ -276,7 +278,12 @@ if [ $FINAL_G_CONFIG -eq 1 ]; then
276278
aide --init
277279
else
278280
aide --config /etc/aide/aide.conf --init
279-
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
281+
is_debian_13
282+
if [ $FNRET -eq 0 ]; then
283+
:
284+
else
285+
mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
286+
fi
280287
fi
281288
exit 0
282289
fi

‎bin/hardening/1.1_install_updates.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#!/bin/bash
22

33
#
4-
# harbian-audit for Debian GNU/Linux Debian 9/10/11/12 or CentOS 8 Hardening
4+
# harbian-audit for Debian GNU/Linux Debian 9/10/11/12/13 or CentOS 8 Hardening
55
# Modify by: Samson-W (samson@hardenedlinux.org)
66
#
77

‎bin/hardening/1.2_enable_verify_sign_packages_from_repository.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#!/bin/bash
22

33
#
4-
# harbian-audit for Debian GNU/Linux Debian 9/10/11/12 or CentOS 8 Hardening
4+
# harbian-audit for Debian GNU/Linux Debian 9/10/11/12/13 or CentOS 8 Hardening
55
#
66

77
#

‎bin/hardening/1.3_enable_verify_sign_of_local_packages.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#!/bin/bash
22

33
#
4-
# harbian-audit for Debian GNU/Linux Debian 9/10/11/12 or CentOS 8 Hardening
4+
# harbian-audit for Debian GNU/Linux Debian 9/10/11/12/13 or CentOS 8 Hardening
55
#
66

77
#

‎bin/hardening/1.4_set_no_allow_insecure_repository_by_apt.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#!/bin/bash
22

33
#
4-
# harbian-audit for Debian GNU/Linux Debian 9/10/11/12 or CentOS 8 Hardening
4+
# harbian-audit for Debian GNU/Linux Debian 9/10/11/12/13 or CentOS 8 Hardening
55
#
66

77
#

‎bin/hardening/1.5.11_ensure_core_file_size_configured.sh‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#!/bin/bash
2+
3+
#
4+
# harbian-audit for Debian GNU/Linux 13
5+
#
6+
7+
#
8+
# 1.5.11 Ensure core file size is configured
9+
#
10+
11+
set -e
12+
set -u
13+
14+
HARDENING_LEVEL=2
15+
16+
17+
18+
19+
audit () {
20+
is_debian_ge_13
21+
if [ $FNRET = 0 ]; then
22+
file_limit_check '* hard core 0'
23+
else
24+
ok "Rule is not applicable to OS versions prior to Debian 13."
25+
FNRET=0
26+
fi
27+
}
28+
29+
apply () {
30+
# The main framework automatically calls audit() first to set FNRET based on the current system state.
31+
# Therefore, we just use the existing $FNRET instead of calling is_debian_ge_13 again which would clobber it.
32+
if [ $FNRET = 0 ]; then
33+
ok "Already compliant. Nothing to apply for 1.5.11 Ensure core file size is configured."
34+
elif [ $FNRET != 0 ]; then
35+
is_debian_ge_13
36+
local is_supported=$FNRET
37+
if [ $is_supported = 0 ]; then
38+
file_limit_apply '* hard core 0'
39+
else
40+
ok "Rule is not applicable to OS versions prior to Debian 13."
41+
fi
42+
fi
43+
}
44+
45+
check_config() {
46+
:
47+
}
48+
49+
if [ -r /etc/default/cis-hardening ]; then
50+
. /etc/default/cis-hardening
51+
fi
52+
if [ -z "$CIS_ROOT_DIR" ]; then
53+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
54+
echo "Cannot source CIS_ROOT_DIR variable, aborting."
55+
exit 128
56+
fi
57+
58+
if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then
59+
. $CIS_ROOT_DIR/lib/main.sh
60+
else
61+
echo "Cannot find main.sh, have you correctly defined your root directory?"
62+
exit 128
63+
fi

‎bin/hardening/1.5.12_ensure_systemd_coredump_processsizemax.sh‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/bin/bash
2+
3+
#
4+
# harbian-audit for Debian GNU/Linux 13
5+
#
6+
7+
#
8+
# 1.5.12 Ensure systemd-coredump ProcessSizeMax is configured
9+
#
10+
11+
set -e
12+
set -u
13+
14+
HARDENING_LEVEL=2
15+
16+
17+
18+
19+
audit () {
20+
is_debian_ge_13
21+
if [ $FNRET = 0 ]; then
22+
check_param_pair_by_str '/etc/systemd/coredump.conf' 'ProcessSizeMax' '0'
23+
if [ $FNRET = 0 ]; then
24+
ok "Parameter is correctly set"
25+
else
26+
crit "Parameter is missing or incorrect"
27+
fi
28+
29+
else
30+
ok "Rule is not applicable to OS versions prior to Debian 13."
31+
FNRET=0
32+
fi
33+
}
34+
35+
apply () {
36+
# The main framework automatically calls audit() first to set FNRET based on the current system state.
37+
# Therefore, we just use the existing $FNRET instead of calling is_debian_ge_13 again which would clobber it.
38+
if [ $FNRET = 0 ]; then
39+
ok "Already compliant. Nothing to apply for 1.5.12 Ensure systemd-coredump ProcessSizeMax is configured."
40+
elif [ $FNRET != 0 ]; then
41+
is_debian_ge_13
42+
local is_supported=$FNRET
43+
if [ $is_supported = 0 ]; then
44+
replace_in_file_custom '/etc/systemd/coredump.conf' '^#?ProcessSizeMax.*' 'ProcessSizeMax=0'
45+
else
46+
ok "Rule is not applicable to OS versions prior to Debian 13."
47+
fi
48+
fi
49+
}
50+
51+
check_config() {
52+
:
53+
}
54+
55+
if [ -r /etc/default/cis-hardening ]; then
56+
. /etc/default/cis-hardening
57+
fi
58+
if [ -z "$CIS_ROOT_DIR" ]; then
59+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
60+
echo "Cannot source CIS_ROOT_DIR variable, aborting."
61+
exit 128
62+
fi
63+
64+
if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then
65+
. $CIS_ROOT_DIR/lib/main.sh
66+
else
67+
echo "Cannot find main.sh, have you correctly defined your root directory?"
68+
exit 128
69+
fi

‎bin/hardening/1.5.13_ensure_systemd_coredump_storage.sh‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/bin/bash
2+
3+
#
4+
# harbian-audit for Debian GNU/Linux 13
5+
#
6+
7+
#
8+
# 1.5.13 Ensure systemd-coredump Storage is configured
9+
#
10+
11+
set -e
12+
set -u
13+
14+
HARDENING_LEVEL=2
15+
16+
17+
18+
19+
audit () {
20+
is_debian_ge_13
21+
if [ $FNRET = 0 ]; then
22+
check_param_pair_by_str '/etc/systemd/coredump.conf' 'Storage' 'none'
23+
if [ $FNRET = 0 ]; then
24+
ok "Parameter is correctly set"
25+
else
26+
crit "Parameter is missing or incorrect"
27+
fi
28+
29+
else
30+
ok "Rule is not applicable to OS versions prior to Debian 13."
31+
FNRET=0
32+
fi
33+
}
34+
35+
apply () {
36+
# The main framework automatically calls audit() first to set FNRET based on the current system state.
37+
# Therefore, we just use the existing $FNRET instead of calling is_debian_ge_13 again which would clobber it.
38+
if [ $FNRET = 0 ]; then
39+
ok "Already compliant. Nothing to apply for 1.5.13 Ensure systemd-coredump Storage is configured."
40+
elif [ $FNRET != 0 ]; then
41+
is_debian_ge_13
42+
local is_supported=$FNRET
43+
if [ $is_supported = 0 ]; then
44+
replace_in_file_custom '/etc/systemd/coredump.conf' '^#?Storage.*' 'Storage=none'
45+
else
46+
ok "Rule is not applicable to OS versions prior to Debian 13."
47+
fi
48+
fi
49+
}
50+
51+
check_config() {
52+
:
53+
}
54+
55+
if [ -r /etc/default/cis-hardening ]; then
56+
. /etc/default/cis-hardening
57+
fi
58+
if [ -z "$CIS_ROOT_DIR" ]; then
59+
echo "There is no /etc/default/cis-hardening file nor cis-hardening directory in current environment."
60+
echo "Cannot source CIS_ROOT_DIR variable, aborting."
61+
exit 128
62+
fi
63+
64+
if [ -r $CIS_ROOT_DIR/lib/main.sh ]; then
65+
. $CIS_ROOT_DIR/lib/main.sh
66+
else
67+
echo "Cannot find main.sh, have you correctly defined your root directory?"
68+
exit 128
69+
fi

0 commit comments

Comments
 (0)