Linux安全基线检查与自动化-工具盒子

目前企业中对安全看得非常的重要，这也是我们为什么要做安全相关的动作，这是一个保证企业的业务能够免受其非法分子的侵害，在安全角度来看，也从个人角度来看，随时保证自身的服务器安全，也是我们应该做的事情。
检查确认点
1.1 帐号管理
1.1.1 检查root是否为唯一的UID为0用户
1.1.2 检查是否按用户分配账号
1.1.3 检查是否删除与设备运行、维护等工作无关的账号
1.1.4 检查是否设置不同的用户组
1.1.5 检查GID是否唯一
1.2 口令策略
1.2.1 检查是否设置口令生存周期
1.2.2 检查是否设置口令更改最小间隔天数
1.2.3 检查设备密码复杂度策略
1.2.4 检查是否设置口令过期前警告天数
1.2.5 检查是否存在空口令账号
1.2.6 检查密码重复使用次数限制
1.2.7 检查账户认证失败次数限制
1.3 认证授权
1.3.1 检查用户目录缺省访问权限设置
1.3.2 检查是否设置SSH登录前警告Banner
1.4 日志审计
1.4.1 检查是否对登录进行日志记录
1.4.2 检查是否启用cron行为日志功能
1.4.3 检查是否配置远程日志功能
1.4.4 检查是否配置su命令使用情况记录
1.4.5 检查日志文件权限设置
1.4.6 检查安全事件日志配置
10.79.3.10
1.5 文件权限
1.5.1 检查FTP用户上传的文件所具有的权限
1.5.2 检查重要目录或文件权限设置
1.6 网络通信
1.6.1 检查是否禁止root用户远程登录
1.6.2 检查使用IP协议远程维护的设备是否配置SSH协议，禁用Telnet协议
1.6.3 检查是否修改SNMP默认团体字
1.6.4 检查是否禁止root用户登录FTP
1.6.5 检查是否使用PAM认证模块禁止wheel组之外的用户su为root
1.7 其他配置
1.7.1 检查是否禁止匿名用户登录FTP
1.7.2 检查是否删除了潜在危险文件
1.7.3 检查是否设置命令行界面超时退出
1.7.4 检查系统是否禁用Ctrl+Alt+Delete组合键
1.7.5 检查root用户的path环境变量
1.7.6 检查历史命令设置
1.7.7 检查是否设置SSH成功登录后Banner
1.7.8 检查是否限制FTP用户登录后能访问的目录
1.7.9 检查是否关闭数据包转发功能
1.7.10 检查别名文件/etc/aliase
1.7.11 检查是否使用NTP（网络时间协议）保持时间同步
1.7.12 检查是否限制远程登录IP范围
1.7.13 检查NFS（网络文件系统）服务配置
1.7.14 检查是否配置定时自动屏幕锁定
1.7.15 检查是否安装chkrootkit进行系统监测
1.7.16 检查是否安装OS补丁
1.7.17 检查FTP banner设置
1.7.18 检查Telnet banner设置
1.7.19 检查系统内核参数配置
1.7.20 检查系统openssh安全配置
1.7.21 检查系统coredump设置
1.7.22 检查是否关闭不必要的服务和端口
1.7.23 检查磁盘空间占用率
#!/usr/bin/env bash
#
# CIS-LBK CIS Debian Family Linux Benchmark v1.0.0 Build Kit script
# ~/CIS-LBK/DEBIAN_FAMILY_LBK.sh
# 
# Name                Date       Description
# ------------------------------------------------------------------------------------------------
# Eric Pinnell       12/01/20    Build Kit "CIS Debian Family Linux Benchmark v1.0.0"
#

if \[ ! "$BASH_VERSION" \] ; then
exec /bin/bash "$0" "$@"
fi


Set global variables
====================



BDIR="$(dirname "$(readlink -f "$0")")"
FDIR=$BDIR/functions
RECDIR="$FDIR"/recommendations
GDIR="$FDIR"/general
LDIR=$BDIR/logs
RDIR=$BDIR/backup
DTG=$(date +%m_%d_%Y_%H%M)
mkdir $LDIR/$DTG
mkdir $RDIR/$DTG
LOGDIR=$LDIR/$DTG
BKDIR=$RDIR/$DTG
LOG=$LOGDIR/CIS-LBK_verbose.log
SLOG=$LOGDIR/CIS-LBK.log
ELOG=$LOGDIR/CIS-LBK_error.log
FRLOG=$LOGDIR/CIS-LBK_failed.log
MANLOG=$LOGDIR/CIS-LBK_manual.log
passed_recommendations="0"
failed_recommendations="0"
remediated_recommendations="0"
not_applicable_recommendations="0"
excluded_recommendations="0"
manual_recommendations="0"
skipped_recommendations="0"
total_recommendations="0"


Load functions (Order matters)
==============================



for func in "$GDIR"/.sh; do
\[ -e "$func" \] \|\| break
. "$func"
done
for func in "$RECDIR"/.sh; do
\[ -e "$func" \] \|\| break
. "$func"
done


#Clear the screen for output
clear


Display the build kit banner
============================



BANR


Ensure script is being run as root
==================================



ROOTUSRCK


Display the terms of use
========================



terms_of_use
============



Display CIS Linux Build Kit warning banner
==========================================



WARBNR
#run_profile=L2S # Uncomment this line to provide profile to be run manually


Profile Options:
================



L1S - For Level 1 Server
========================



L1W - For Level 1 Workstation
=============================



L2S - For Level 2 Server
========================



L2W - For Level 2 Workstation
=============================



Have user select profile to run
===============================



select_profile


Recommediations This is where a BM specific script begins.
==========================================================



Generated for specific Benchmark
================================




1 Initial Setup
===============





1.1 Filesystem Configuration
============================





1.1.1 Disable unused filesystems
================================




RN="1.1.1.1"
RNA="Ensure mounting of cramfs filesystems is disabled"
profile="L1S L1W"
REC="cramfs_filesystem_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.1.2"
RNA="Ensure mounting of freevxfs filesystems is disabled"
profile="L1S L1W"
REC="freevxfs_filesystem_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.1.3"
RNA="Ensure mounting of jffs2 filesystems is disabled"
profile="L1S L1W"
REC="jffs2_filesystem_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.1.4"
RNA="Ensure mounting of hfs filesystems is disabled"
profile="L1S L1W"
REC="hfs_filesystem_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.1.5"
RNA="Ensure mounting of hfsplus filesystems is disabled"
profile="L1S L1W"
REC="hfsplus_filesystem_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.1.6"
RNA="Ensure mounting of squashfs filesystems is disabled"
profile="L1S L1W"
REC="squashfs_filesystem_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.1.7"
RNA="Ensure mounting of udf filesystems is disabled"
profile="L1S L1W"
REC="udf_filesystem_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.2"
RNA="Ensure /tmp is configured"
profile="L1S L1W"
REC="ensure_tmp_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.3"
RNA="Ensure nodev option set on /tmp partition"
profile="L1S L1W"
REC="ensure_nodev_tmp"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.4"
RNA="Ensure nosuid option set on /tmp partition"
profile="L1S L1W"
REC="ensure_nosuid_tmp"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.5"
RNA="Ensure noexec option set on /tmp partition"
profile="L1S L1W"
REC="ensure_noexec_tmp"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.6"
RNA="Ensure separate partition exists for /var"
profile="L2S L2W"
REC="var_partition_exists"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.7"
RNA="Ensure separate partition exists for /var/tmp"
profile="L2S L2W"
REC="var_tmp_partition_exists"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.8"
RNA="Ensure nodev option set on /var/tmp partition"
profile="L1S L1W"
REC="ensure_nodev_var_tmp"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.9"
RNA="Ensure nosuid option set on /var/tmp partition"
profile="L1S L1W"
REC="ensure_nosuid_var_tmp"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.10"
RNA="Ensure noexec option set on /var/tmp partition"
profile="L1S L1W"
REC="ensure_noexec_var_tmp"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.11"
RNA="Ensure separate partition exists for /var/log"
profile="L2S L2W"
REC="var_log_partition_exists"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.12"
RNA="Ensure separate partition exists for /var/log/audit"
profile="L2S L2W"
REC="var_log_audit_partition_exists"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.13"
RNA="Ensure separate partition exists for /home"
profile="L2S L2W"
REC="home_partition_exists"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.14"
RNA="Ensure nodev option set on /home partition"
profile="L1S L1W"
REC="ensure_nodev_home"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.15"
RNA="Ensure nodev option set on /dev/shm partition"
profile="L1S L1W"
REC="ensure_nodev_dev_shm"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.16"
RNA="Ensure nosuid option set on /dev/shm partition"
profile="L1S L1W"
REC="ensure_nosuid_dev_shm"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.17"
RNA="Ensure noexec option set on /dev/shm partition"
profile="L1S L1W"
REC="ensure_noexec_dev_shm"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.18"
RNA="Ensure nodev option set on removable media partitions"
profile="L1S L1W"
REC="ensure_nodev_removable_media"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.19"
RNA="Ensure nosuid option set on removable media partitions"
profile="L1S L1W"
REC="ensure_nosuid_removable_media"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.20"
RNA="Ensure noexec option set on removable media partitions"
profile="L1S L1W"
REC="ensure_noexec_removable_media"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.21"
RNA="Ensure sticky bit is set on all world-writable directories"
profile="L1S L1W"
REC="ensure_stickybit_world_writable_directories"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.22"
RNA="Disable Automounting"
profile="L1S L2W"
REC="disable_automounting"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.1.23"
RNA="Disable USB Storage"
profile="L1S L2W"
REC="disable_usb_storage"
total_recommendations=$((total_recommendations+1))
runrec



1.2 Configure Software Updates
==============================




RN="1.2.1"
RNA="Ensure package manager repositories are configured"
profile="L1S L1W"
REC="ensure_package_manager_repositories_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.2.2"
RNA="Ensure GPG keys are configured"
profile="L1S L1W"
REC="ensure_gpg_keys_configured"
total_recommendations=$((total_recommendations+1))
runrec



1.3 Configure sudo
==================




RN="1.3.1"
RNA="Ensure sudo is installed"
profile="L1S L1W"
REC="ensure_sudo_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.3.2"
RNA="Ensure sudo commands use pty"
profile="L1S L1W"
REC="ensure_sudo_commands_pty"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.3.3"
RNA="Ensure sudo log file exists"
profile="L1S L1W"
REC="ensure_sudo_logfile_exists"
total_recommendations=$((total_recommendations+1))
runrec



1.4 Filesystem Integrity Checking
=================================




RN="1.4.1"
RNA="Ensure AIDE is installed"
profile="L1S L1W "
REC="ensure_aide_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.4.2"
RNA="Ensure filesystem integrity is regularly checked"
profile="L1S L1W"
REC="deb_ensure_filesystem_integrity_checked"
total_recommendations=$((total_recommendations+1))
runrec



1.5 Secure Boot Settings
========================




RN="1.5.1"
RNA="Ensure permissions on bootloader config are configured"
profile="L1S L1W"
REC="deb_ensure_bootloader_password_set"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.5.2"
RNA="Ensure bootloader password is set"
profile="L1S L1W"
REC="ensure_permissions_bootloader_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.5.3"
RNA="Ensure authentication required for single user mode"
profile="L1S L1W"
REC="deb_ensure_authentication_required_single_user_mode"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.6"
RNA="Additional Process Hardening"
profile=""
REC=""
total_recommendations=$((total_recommendations+1))
runrec


RN="1.6.1"
RNA="Ensure XD/NX support is enabled"
profile="L1S L1W"
REC="ensure_XD_NX_support_enabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.6.2"
RNA="Ensure address space layout randomization (ASLR) is enabled"
profile="L1S L1W"
REC="ensure_aslr_enabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.6.3"
RNA="Ensure prelink is disabled"
profile="L1S L1W"
REC="ensure_prelink_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.6.4"
RNA="Ensure core dumps are restricted"
profile="L1S L1W"
REC="core_dumps_restricted"
total_recommendations=$((total_recommendations+1))
runrec



1.7 Mandatory Access Control
============================





1.7.1 Configure AppArmor
========================




RN="1.7.1.1"
RNA="Ensure AppArmor is installed"
profile="L1S L1W"
REC="deb_ensure_apparmor_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.7.1.2"
RNA="Ensure AppArmor is enabled in the bootloader configuration"
profile="L1S L1W"
REC="deb_ensure_apparmor_enabled_bootloader_configuration"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.7.1.3"
RNA="Ensure all AppArmor Profiles are in enforce or complain mode"
profile="L1S L1W"
REC="deb_ensure_apparmor_profiles_in_enforce_or_complain_mode"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.7.1.4"
RNA="Ensure all AppArmor Profiles are enforcing"
profile="L2S L2W"
REC="deb_ensure_apparmor_profiles_are_enforcing"
total_recommendations=$((total_recommendations+1))
runrec



1.8 Warning Banners
===================




RN="1.8.1"
RNA="Ensure message of the day is configured properly"
profile="L1S L1W"
REC="nix_ensure_motd_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.8.2"
RNA="Ensure permissions on /etc/issue.net are configured"
profile="L1S L1W"
REC="nix_ensure_local_login_warning_banner_configured_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.8.3"
RNA="Ensure permissions on /etc/issue are configured"
profile="L1S L1W"
REC="nix_ensure_remote_login_warning_banner_configured_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.8.4"
RNA="Ensure permissions on /etc/motd are configured"
profile="L1S L1W"
REC="nix_ensure_permissions_motd_configured_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.8.5"
RNA="Ensure remote login warning banner is configured properly"
profile="L1S L1W"
REC="nix_ensure_permissions_issue_configured_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.8.6"
RNA="Ensure local login warning banner is configured properly"
profile="L1S L1W"
REC="nix_ensure_permissions_issue_net_configured_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.9"
RNA="Ensure GDM is removed or login is configured"
profile="L1S L1W"
REC="deb_ensure_gdm_login_banner_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="1.10"
RNA="Ensure updates patches and additional security software are installed"
profile="L1S L1W"
REC="deb_ensure_updates_patches_additional_security_software_installed"
total_recommendations=$((total_recommendations+1))
runrec



2 Services
==========





2.1 Special Purpose Services
============================





2.1.1 Time Synchronization
==========================




RN="2.1.1.1"
RNA="Ensure time synchronization is in use"
profile="L1S L1W"
REC="deb_ensure_time_synchronization_in_use"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.1.2"
RNA="Ensure systemd-timesyncd is configured"
profile="L1S L1W"
REC="deb_ensure_systemd-timesyncd_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.1.3"
RNA="Ensure chrony is configured"
profile="L1S L1W"
REC="deb_chrony_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.1.4"
RNA="Ensure ntp is configured"
profile="L1S L1W"
REC="deb_ensure_ntp_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.2"
RNA="Ensure X Window System is not installed"
profile="L1S"
REC="deb_ensure_xwindows_system_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.3"
RNA="Ensure Avahi Server is not installed"
profile="L1S L1W"
REC="deb_ensure_avahi_server_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.4"
RNA="Ensure CUPS is not installed"
profile="L1S L2W"
REC="ensure_cups_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.5"
RNA="Ensure DHCP Server is not installed"
profile="L1S L1W"
REC="deb_ensure_dhcp_server_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.6"
RNA="Ensure LDAP server is not installed"
profile="L1S L1W"
REC="deb_ensure_ldap_server_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.7"
RNA="Ensure NFS is not installed"
profile="L1S L1W"
REC="deb_ensure_nfs_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.8"
RNA="Ensure DNS Server is not installed"
profile="L1S L1W"
REC="deb_ensure_dns_server_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.9"
RNA="Ensure FTP Server is not installed"
profile="L1S L1W"
REC="ensure_ftp_server_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.10"
RNA="Ensure HTTP server is not installed"
profile="L1S L1W"
REC="deb_ensure_http_server_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.11"
RNA="Ensure IMAP and POP3 server are not installed"
profile="L1S L1W"
REC="deb_ensure_imap_pop3_server_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.12"
RNA="Ensure Samba is not installed"
profile="L1S L1W"
REC="ensure_samba_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.13"
RNA="Ensure HTTP Proxy Server is not installed"
profile="L1S L1W"
REC="ensure_http_proxy_server_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.14"
RNA="Ensure SNMP Server is not installed"
profile="L1S L1W"
REC="deb_ensure_snmp_server_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.15"
RNA="Ensure mail transfer agent is configured for local-only mode"
profile="L1S L1W"
REC="ensure_mail_transfer_agent_configured_local_only"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.16"
RNA="Ensure rsync service is not installed"
profile="L1S L1W"
REC="deb_ensure_rsync_service_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.1.17"
RNA="Ensure NIS Server is not installed"
profile="L1S L1W"
REC="deb_ensure_nis_server_not_installed"
total_recommendations=$((total_recommendations+1))
runrec



2.2 Service Clients
===================




RN="2.2.1"
RNA="Ensure NIS Client is not installed"
profile="L1S L1W"
REC="deb_ensure_nis_client_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.2.2"
RNA="Ensure rsh client is not installed"
profile="L1S L1W"
REC="deb_ensure_rsh_client_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.2.3"
RNA="Ensure talk client is not installed"
profile="L1S L1W"
REC="ensure_talk_client_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.2.4"
RNA="Ensure telnet client is not installed"
profile="L1S L1W"
REC="ensure_telnet_client_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.2.5"
RNA="Ensure LDAP client is not installed"
profile="L1S L1W"
REC="deb_ensure_ldap_client_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.2.6"
RNA="Ensure  RPC is not installed"
profile="L1S L1W"
REC="deb_ensure_rpc_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="2.3"
RNA="Ensure nonessential services are removed or masked"
profile="L1S L1W"
REC="ensure_nonessential_services_removed_or_masked"
total_recommendations=$((total_recommendations+1))
runrec



3 Network Configuration
=======================





3.1 Disable unused network protocols and devices
================================================




RN="3.1.1"
RNA="Disable IPv6"
profile="L2S L2W"
REC="disable_ipv6"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.1.2"
RNA="Ensure wireless interfaces are disabled"
profile="L1S L1W"
REC="ensure_wireless_interfaces_disabled"
total_recommendations=$((total_recommendations+1))
runrec



3.2 Network Parameters (Host Only)
==================================




RN="3.2.1"
RNA="Ensure packet redirect sending is disabled"
profile="L1S L1W"
REC="packet_redirect_sending_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.2.2"
RNA="Ensure IP forwarding is disabled"
profile="L1S L1W"
REC="ip_forwarding_disabled"
total_recommendations=$((total_recommendations+1))
runrec



3.3 Network Parameters (Host and Router)
========================================




RN="3.3.1"
RNA="Ensure source routed packets are not accepted"
profile="L1S L1W"
REC="ensure_source_routed_packets_not_accepted"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.3.2"
RNA="Ensure ICMP redirects are not accepted"
profile="L1S L1W"
REC="ensure_icmp_redirects_not_accepted"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.3.3"
RNA="Ensure secure ICMP redirects are not accepted"
profile="L1S L1W"
REC="ensure_secure_icmp_redirects_not_accepted"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.3.4"
RNA="Ensure suspicious packets are logged"
profile="L1S L1W"
REC="ensure_suspicious_packets_logged"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.3.5"
RNA="Ensure broadcast ICMP requests are ignored"
profile="L1S L1W"
REC="ensure_broadcast_icmp_requests_ignored"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.3.6"
RNA="Ensure bogus ICMP responses are ignored"
profile="L1S L1W"
REC="nix_ensure_bogus_icmp_responses_ignored"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.3.7"
RNA="Ensure Reverse Path Filtering is enabled"
profile="L1S L1W"
REC="ensure_reverse_path_filtering_enabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.3.8"
RNA="Ensure TCP SYN Cookies is enabled"
profile="L1S L1W"
REC="ensure_tcp_syn_cookies_enabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.3.9"
RNA="Ensure IPv6 router advertisements are not accepted"
profile="L1S L1W"
REC="ensure_ipv6_router_advertisements_not_accepted"
total_recommendations=$((total_recommendations+1))
runrec



3.5 Uncommon Network Protocols
==============================




RN="3.5.1"
RNA="Ensure DCCP is disabled"
profile="L2S L2W"
REC="ensure_dccp_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.5.2"
RNA="Ensure SCTP is disabled"
profile="L2S L2W"
REC="ensure_sctp_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.5.3"
RNA="Ensure RDS is disabled"
profile="L2S L2W"
REC="ensure_rds_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.5.4"
RNA="Ensure TIPC is disabled"
profile="L2S L2W"
REC="ensure_tipc_disabled"
total_recommendations=$((total_recommendations+1))
runrec



3.6 Firewall Configuration
==========================





3.6.1 Configure UncomplicatedFirewall
=====================================




RN="3.6.1.1"
RNA="Ensure Uncomplicated Firewall is installed"
profile="L1S L1W"
REC="deb_ensure_uncomplicated_firewall_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.1.2"
RNA="Ensure iptables-persistent is not installed"
profile="L1S L1W"
REC="deb_ensure_iptables_persistent_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.1.3"
RNA="Ensure ufw service is enabled"
profile="L1S L1W"
REC="deb_ensure_ufw_service_enabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.1.4"
RNA="Ensure loopback traffic is configured"
profile="L1S L1W"
REC="deb_ensure_ufw_loopback_traffic_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.1.5"
RNA="Ensure outbound connections are configured"
profile="L1S L1W"
REC="deb_ensure_outbound_connections_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.1.6"
RNA="Ensure firewall rules exist for all open ports"
profile="L1S L1W"
REC="deb_ensure_firewall_rules_exist_all_open_ports"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.1.7"
RNA="Ensure default deny firewall policy"
profile="L1S L1W"
REC="deb_ensure_default_deny_firewall_policy"
total_recommendations=$((total_recommendations+1))
runrec



3.6.2 Configure nftables
========================




RN="3.6.2.1"
RNA="Ensure nftables is installed"
profile="L1S L1W"
REC="deb_ensure_nftables_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.2.2"
RNA="Ensure Uncomplicated Firewall is not installed or disabled"
profile="L1S L1W"
REC="deb_ensure_ufw_not_installed_or_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.2.3"
RNA="Ensure iptables are flushed"
profile="L1S L1W"
REC="deb_ensure_iptables_flushed"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.2.4"
RNA="Ensure a table exists"
profile="L1S L1W"
REC="deb_ensure_table_exists"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.2.5"
RNA="Ensure base chains exist"
profile="L1S L1W"
REC="deb_ensure_base_chains_exists"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.2.6"
RNA="Ensure loopback traffic is configured"
profile="L1S L1W"
REC="deb_nft_ensure_loopback_traffic_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.2.7"
RNA="Ensure outbound and established connections are configured"
profile="L1S L1W"
REC="deb_nft_ensure_outbound_established_connections_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.2.8"
RNA="Ensure default deny firewall policy"
profile="L1S L1W"
REC="deb_nft_ensure_default_deny_firewall_policy"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.2.9"
RNA="Ensure nftables service is enabled"
profile="L1S L1W"
REC="deb_ensure_nftables_service_enabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.2.10"
RNA="Ensure nftables rules are permanent"
profile="L1S L1W"
REC="deb_ensure_nftables_rules_permanent"
total_recommendations=$((total_recommendations+1))
runrec



3.6.3 Configure iptables
========================





3.6.3.1 Configure software
==========================




RN="3.6.3.1.1"
RNA="Ensure iptables packages are installed"
profile="L1S L1W"
REC="deb_ensure_iptables_packages_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.3.1.2"
RNA="Ensure nftables is not installed"
profile="L1S L1W"
REC="deb_ensure_nftables_not_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.3.1.3"
RNA="Ensure Uncomplicated Firewall is not installed or disabled"
profile="L1S L1W"
REC="deb_ensure_ufw_not_installed_or_disabled"
total_recommendations=$((total_recommendations+1))
runrec



3.6.3.2 Configure IPv4 iptables
===============================




RN="3.6.3.2.1"
RNA="Ensure default deny firewall policy"
profile="L1S L1W"
REC="deb_ensure_ipv4_default_deny_firewall_policy"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.3.2.2"
RNA="Ensure loopback traffic is configured"
profile="L1S L1W"
REC="deb_ensure_ipv4_loopback_traffic_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.3.2.3"
RNA="Ensure outbound and established connections are configured"
profile="L1S L1W"
REC="deb_ensure_ipv4_outbound_and_established_connections_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.3.2.4"
RNA="Ensure firewall rules exist for all open ports"
profile="L1S L1W"
REC="deb_ensure_ipv4_firewall_rules_exist_all_open_ports"
total_recommendations=$((total_recommendations+1))
runrec



3.6.3.3 Configure IPv6 ip6tables
================================




RN="3.6.3.3.1"
RNA="Ensure IPv6 default deny firewall policy"
profile="L1S L1W"
REC="deb_ensure_ipv6_default_deny_firewall_policy"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.3.3.2"
RNA="Ensure IPv6 loopback traffic is configured"
profile="L1S L1W"
REC="deb_ensure_ipv6_loopback_traffic_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.3.3.3"
RNA="Ensure IPv6 outbound and established connections are configured"
profile="L1S L1W"
REC="deb_ensure_ipv6_outbound_and_established_connections_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="3.6.3.3.4"
RNA="Ensure IPv6 firewall rules exist for all open ports"
profile="L1S L1W"
REC="deb_ensure_ipv6_firewall_rules_exist_all_open_ports"
total_recommendations=$((total_recommendations+1))
runrec



4 Logging and Auditing
======================





4.1 Configure System Accounting (auditd)
========================================





4.1.1 Ensure auditing is enabled
================================




RN="4.1.1.1"
RNA="Ensure auditd is installed"
profile="L2S L2W"
REC="deb_ensure_auditd_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.1.2"
RNA="Ensure auditd service is enabled"
profile="L2S L2W"
REC="ensure_auditd_service_enabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.1.3"
RNA="Ensure auditing for processes that start prior to auditd is enabled"
profile="L2S L2W"
REC="ensure_auditing_processes_start_prior_auditd_enabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.1.4"
RNA="Ensure audit_backlog_limit is sufficient"
profile="L2S L2W"
REC="ensure_audit_backlog_limit_sufficient"
total_recommendations=$((total_recommendations+1))
runrec



4.1.2 Configure Data Retention
==============================




RN="4.1.2.1"
RNA="Ensure audit log storage size is configured"
profile="L2S L2W"
REC="ensure_audit_log_storage_size_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.2.2"
RNA="Ensure audit logs are not automatically deleted"
profile="L2S L2W"
REC="ensure_audit_logs_not_automatically_deleted"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.2.3"
RNA="Ensure system is disabled when audit logs are full"
profile="L2S L2W"
REC="ensure_system_disabled_audit_logs_full"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.3"
RNA="Ensure events that modify date and time information are collected"
profile="L2S L2W"
REC="ensure_events_modify_date_time_information_collected"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.4"
RNA="Ensure events that modify user/group information are collected"
profile="L2S L2W"
REC="ensure_events_modify_user_group_information_collected"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.5"
RNA="Ensure events that modify the systems network environment are collected"
profile="L2S L2W"
REC="ensure_events_modify_systems_network_environment_collected"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.6"
RNA="Ensure events that modify the systems Mandatory Access Controls are collected"
profile="L2S L2W"
REC="deb_ensure_events_modify_systems_mac_collected"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.7"
RNA="Ensure login and logout events are collected"
profile="L2S L2W"
REC="deb_ensure_login_logout_events_collected"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.8"
RNA="Ensure session initiation information is collected"
profile="L2S L2W"
REC="ensure_session_initiation_information_collected"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.9"
RNA="Ensure discretionary access control permission modification events are collected"
profile="L2S L2W"
REC="ensure_dac_permission_modification_events_collected"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.10"
RNA="Ensure unsuccessful unauthorized file access attempts are collected"
profile="L2S L2W"
REC="ensure_unsuccessful_unauthorized_file_access_attempts_collected"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.11"
RNA="Ensure use of privileged commands is collected"
profile="L2S L2W"
REC="ensure_use_privileged_commands_collected"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.12"
RNA="Ensure successful file system mounts are collected"
profile="L2S L2W"
REC="ensure_successful_file_system_mounts_collected"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.13"
RNA="Ensure file deletion events by users are collected"
profile="L2S L2W"
REC="ensure_file_deletion_events_by_users_collected"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.14"
RNA="Ensure changes to system administration scope (sudoers) is collected"
profile="L2S L2W"
REC="ensure_changes_sudoers_collected"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.15"
RNA="Ensure system administrator command executions (sudo) are collected"
profile="L2S L2W"
REC="ensure_system_administrator_command_executions_collected"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.16"
RNA="Ensure kernel module loading and unloading is collected"
profile="L2S L2W"
REC="ensure_kernel_module_loading_unloading_collected"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.1.17"
RNA="Ensure the audit configuration is immutable"
profile="L2S L2W"
REC="ensure_audit_configuration_immutable"
total_recommendations=$((total_recommendations+1))
runrec



4.2 Configure Logging
=====================




RN="4.2.1"
RNA="Configure rsyslog"
profile=""
REC=""
total_recommendations=$((total_recommendations+1))
runrec


RN="4.2.1.1"
RNA="Ensure rsyslog is installed"
profile="L1S L1W"
REC="ensure_rsyslog_installed"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.2.1.2"
RNA="Ensure rsyslog Service is enabled"
profile="L1S L1W"
REC="ensure_rsyslog_service_enabled_running"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.2.1.3"
RNA="Ensure logging is configured"
profile="L1S L1W"
REC="ensure_logging_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.2.1.4"
RNA="Ensure rsyslog default file permissions configured"
profile="L1S L1W"
REC="ensure_rsyslog_default_file_permissions_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.2.1.5"
RNA="Ensure rsyslog is configured to send logs to a remote log host"
profile="L1S L1W"
REC="ensure_rsyslog_configured_send_logs_remote_host"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.2.1.6"
RNA="Ensure remote rsyslog messages are only accepted on designated log hosts."
profile="L1S L1W"
REC="ensure_remote_rsyslog_messages_only_accepted_designated_host"
total_recommendations=$((total_recommendations+1))
runrec



4.2.2 Configure journald
========================




RN="4.2.2.1"
RNA="Ensure journald is configured to send logs to rsyslog"
profile="L1S L1W"
REC="ensure_journald_configured_send_logs_rsyslog"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.2.2.2"
RNA="Ensure journald is configured to compress large log files"
profile="L1S L1W"
REC="ensure_journald_configured_compress_large_files"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.2.2.3"
RNA="Ensure journald is configured to write logfiles to persistent disk"
profile="L1S L1W"
REC="ensure_journald_configured_write_logfiles_disk"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.2.3"
RNA="Ensure permissions on all logfiles are configured"
profile="L1S L1W"
REC="ensure_permissions_on_logfiles_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.3"
RNA="Ensure logrotate is configured"
profile="L1S L1W"
REC="ensure_logrotate_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="4.4"
RNA="Ensure logrotate assigns appropriate permissions"
profile="L1S L1W"
REC="ensure_logrotate_assigns_appropriate_permissions"
total_recommendations=$((total_recommendations+1))
runrec



5 Access Authentication and Authorization
=========================================





5.1 Configure time-based job schedulers
=======================================




RN="5.1.1"
RNA="Ensure cron daemon is enabled and running"
profile="L1S L1W"
REC="deb_ensure_cron_daemon_enabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.1.2"
RNA="Ensure permissions on /etc/crontab are configured"
profile="L1S L1W"
REC="ensure_permissions_crontab_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.1.3"
RNA="Ensure permissions on /etc/cron.hourly are configured"
profile="L1S L1W"
REC="ensure_permissions_cron_hourly_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.1.4"
RNA="Ensure permissions on /etc/cron.daily are configured"
profile="L1S L1W"
REC="ensure_permissions_cron_daily_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.1.5"
RNA="Ensure permissions on /etc/cron.weekly are configured"
profile="L1S L1W"
REC="ensure_permissions_cron_weekly_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.1.6"
RNA="Ensure permissions on /etc/cron.monthly are configured"
profile="L1S L1W"
REC="ensure_permissions_cron_monthly_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.1.7"
RNA="Ensure permissions on /etc/cron.d are configured"
profile="L1S L1W"
REC="ensure_permissions_cron_d_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.1.8"
RNA="Ensure cron is restricted to authorized users"
profile="L1S L1W"
REC="ensure_cron_restricted_authorized_users"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.1.9"
RNA="Ensure at is restricted to authorized users"
profile="L1S L1W"
REC="ensure_at_restricted_authorized_users"
total_recommendations=$((total_recommendations+1))
runrec



5.2 Configure SSH Server
========================




RN="5.2.1"
RNA="Ensure permissions on /etc/ssh/sshd_config are configured"
profile="L1S L1W"
REC="ensure_permissions_sshd_config_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.2"
RNA="Ensure permissions on SSH private host key files are configured"
profile="L1S L1W"
REC="ensure_permissions_ssh_private_hostkey_files_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.3"
RNA="Ensure permissions on SSH public host key files are configured"
profile="L1S L1W"
REC="ensure_permissions_ssh_public_hostkey_files_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.4"
RNA="Ensure SSH LogLevel is appropriate"
profile="L1S L1W"
REC="ensure_ssh_loglevel_appropriate"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.5"
RNA="Ensure SSH X11 forwarding is disabled"
profile="L2S L1W"
REC="ensure_ssh_x11_forwarding_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.6"
RNA="Ensure SSH MaxAuthTries is set to 4 or less"
profile="L1S L1W"
REC="ensure_ssh_maxauthtries_4_or_less"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.7"
RNA="Ensure SSH IgnoreRhosts is enabled"
profile="L1S L1W"
REC="ensure_ssh_ignorerhosts_enabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.8"
RNA="Ensure SSH HostbasedAuthentication is disabled"
profile="L1S L1W"
REC="ensure_ssh_hostbasedauthentication_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.9"
RNA="Ensure SSH root login is disabled"
profile="L1S L1W"
REC="ensure_ssh_root_login_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.10"
RNA="Ensure SSH PermitEmptyPasswords is disabled"
profile="L1S L1W"
REC="ensure_ssh_permitemptypasswords_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.11"
RNA="Ensure SSH PermitUserEnvironment is disabled"
profile="L1S L1W"
REC="ensure_ssh_permituserenvironment_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.12"
RNA="Ensure only strong Ciphers are used"
profile="L1S L1W"
REC="ssh7_ensure_strong_ciphers_used"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.13"
RNA="Ensure only strong MAC algorithms are used"
profile="L1S L1W"
REC="ssh7_ensure_strong_mac_algorithms_used"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.14"
RNA="Ensure only strong Key Exchange algorithms are used"
profile="L1S L1W"
REC="ssh7_ensure_strong_key_exchange_algorithms_used"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.15"
RNA="Ensure SSH Idle Timeout Interval is configured"
profile="L1S L1W"
REC="fed28_ensure_ssh_idle_timeout_interval_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.16"
RNA="Ensure SSH LoginGraceTime is set to one minute or less"
profile="L1S L1W"
REC="ensure_ssh_logingracetime_one_minute_or_less"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.17"
RNA="Ensure SSH access is limited"
profile="L1S L1W"
REC="ensure_ssh_access_limited"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.18"
RNA="Ensure SSH warning banner is configured"
profile="L1S L1W"
REC="ensure_ssh_warning_banner_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.19"
RNA="Ensure SSH PAM is enabled"
profile="L1S L1W"
REC="ensure_ssh_pam_enabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.20"
RNA="Ensure SSH AllowTcpForwarding is disabled"
profile="L1S L1W"
REC="ensure_ssh_allowtcpforwarding_disabled"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.21"
RNA="Ensure SSH MaxStartups is configured"
profile="L1S L1W"
REC="ensure_ssh_warning_maxstartups_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.2.22"
RNA="Ensure SSH MaxSessions is limited"
profile="L1S L1W"
REC="ensure_ssh_maxsessions_limited"
total_recommendations=$((total_recommendations+1))
runrec



5.3 Configure PAM
=================




RN="5.3.1"
RNA="Ensure password creation requirements are configured"
profile="L1S L1W"
REC="deb_ensure_password_creation_requirements_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.3.2"
RNA="Ensure lockout for failed password attempts is configured"
profile="L1S L1W"
REC="deb_ensure_lockout_failed_password_attempts_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.3.3"
RNA="Ensure password reuse is limited"
profile="L1S L1W"
REC="deb_ensure_password_reuse_limited"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.3.4"
RNA="Ensure password hashing algorithm is SHA-512"
profile="L1S L1W"
REC="deb_ensure_password_hashing_algorithm_sha512"
total_recommendations=$((total_recommendations+1))
runrec



5.4 User Accounts and Environment
=================================





5.4.1 Set Shadow Password Suite Parameters
==========================================




RN="5.4.1.1"
RNA="Ensure password expiration is 365 days or less"
profile="L1S L1W"
REC="password_expiration_365_days_less"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.4.1.2"
RNA="Ensure minimum days between password changes is  configured"
profile="L1S L1W"
REC="ensure_minimum_days_between_password_changes_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.4.1.3"
RNA="Ensure password expiration warning days is 7 or more"
profile="L1S L1W"
REC="ensure_expiration_warning_days_7_more"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.4.1.4"
RNA="Ensure inactive password lock is 30 days or less"
profile="L1S L1W"
REC="ensure_inactive_password_lock_30_days_less"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.4.1.5"
RNA="Ensure all users last password change date is in the past"
profile="L1S L1W"
REC="ensure_all_users_last_password_change_in_past"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.4.2"
RNA="Ensure system accounts are secured"
profile="L1S L1W"
REC="ensure_system_accounts_secured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.4.3"
RNA="Ensure default group for the root account is GID 0"
profile="L1S L1W"
REC="ensure_default_group_for_root_gid_0"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.4.4"
RNA="Ensure default user umask is 027 or more restrictive"
profile="L1S L1W"
REC="ensure_default_user_umask_027_more_restrictive_v2"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.4.5"
RNA="Ensure default user shell timeout is 900 seconds or less"
profile="L1S L1W"
REC="ensure_default_user_shell_timeout_configured"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.5"
RNA="Ensure root login is restricted to system console"
profile="L1S L1W"
REC="ensure_root_login_restricted_system_console"
total_recommendations=$((total_recommendations+1))
runrec


RN="5.6"
RNA="Ensure access to the su command is restricted"
profile="L1S L1W"
REC="deb_ensure_access_su_command_restricted"
total_recommendations=$((total_recommendations+1))
runrec



6 System Maintenance
====================





6.1 System File Permissions
===========================




RN="6.1.1"
RNA="Audit system file permissions"
profile="L2S L2W"
REC="audit_system_file_permissions"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.1.2"
RNA="Ensure permissions on /etc/passwd are configured"
profile="L1S L1W"
REC="ensure_perms_etc_passwd_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.1.3"
RNA="Ensure permissions on /etc/passwd- are configured"
profile="L1S L1W"
REC="ensure_perms_etc_passwd_dash_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.1.4"
RNA="Ensure permissions on /etc/group are configured"
profile="L1S L1W"
REC="ensure_perms_etc_group_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.1.5"
RNA="Ensure permissions on /etc/group- are configured"
profile="L1S L1W"
REC="ensure_perms_etc_group_dash_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.1.6"
RNA="Ensure permissions on /etc/shadow are configured"
profile="L1S L1W"
REC="ensure_perms_etc_shadow_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.1.7"
RNA="Ensure permissions on /etc/shadow- are configured"
profile="L1S L1W"
REC="ensure_perms_etc_shadow_dash_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.1.8"
RNA="Ensure permissions on /etc/gshadow are configured"
profile="L1S L1W"
REC="ensure_perms_etc_gshadow_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.1.9"
RNA="Ensure permissions on /etc/gshadow- are configured"
profile="L1S L1W"
REC="ensure_perms_etc_gshadow_dash_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.1.10"
RNA="Ensure no world writable files exist"
profile="L1S L1W"
REC="no_world_writable_files_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.1.11"
RNA="Ensure no unowned files or directories exist"
profile="L1S L1W"
REC="no_ungrouped_files_dirs_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.1.12"
RNA="Ensure no ungrouped files or directories exist"
profile="L1S L1W"
REC="no_ungrouped_files_dirs_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.1.13"
RNA="Audit SUID executables"
profile="L1S L1W"
REC="audit_suid_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.1.14"
RNA="Audit SGID executables"
profile="L1S L1W"
REC="audit_sgid_fct"
total_recommendations=$((total_recommendations+1))
runrec



6.2 User and Group Settings
===========================




RN="6.2.1"
RNA="Ensure accounts in /etc/passwd use shadowed passwords"
profile="L1S L1W"
REC="ensure_accounts_in_etc_passwd_use_shadowed_passwords"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.2.2"
RNA="Ensure password fields are not empty"
profile="L1S L1W"
REC="nonempty_pw_fields_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.2.3"
RNA="Ensure all users home directories exist"
profile="L1S L1W"
REC="ensure_users_home_directories_exist"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.2.4"
RNA="Ensure users own their home directories"
profile="L1S L1W"
REC="ensure_users_own_their_home_directories"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.2.5"
RNA="Ensure users home directories permissions are 750 or more restrictive"
profile="L1S L1W"
REC="restrictive_home_dir_check_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.2.6"
RNA="Ensure users dot files are not group or world writable"
profile="L1S L1W"
REC="ensure_users_dot_files_not_group_world_writable"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.2.7"
RNA="Ensure no users have .netrc files"
profile="L1S L1W"
REC="ensure_no_users_have_dot_netrc_files"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.2.8"
RNA="Ensure no users have .forward files"
profile="L1S L1W"
REC="ensure_no_users_have_dot_forward_files"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.2.9"
RNA="Ensure no users have .rhosts files"
profile="L1S L1W"
REC="ensure_no_users_have_dot_rhosts_files"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.2.10"
RNA="Ensure root is the only UID 0 account"
profile="L1S L1W"
REC="root_only_uid_0_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.2.11"
RNA="Ensure root PATH Integrity"
profile="L1S L1W"
REC="root_path_integrity_fct"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.2.12"
RNA="Ensure all groups in /etc/passwd exist in /etc/group"
profile="L1S L1W"
REC="ensure_all_groups_etc_passwd_exist_etc_group"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.2.13"
RNA="Ensure no duplicate UIDs exist"
profile="L1S L1W"
REC="ensure_no_duplicate_uid_exist"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.2.14"
RNA="Ensure no duplicate GIDs exist"
profile="L1S L1W"
REC="ensure_no_duplicate_gid_exist"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.2.15"
RNA="Ensure no duplicate user names exist"
profile="L1S L1W"
REC="ensure_no_duplicate_user_names_exist"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.2.16"
RNA="Ensure no duplicate group names exist"
profile="L1S L1W"
REC="ensure_no_duplicate_group_names_exist"
total_recommendations=$((total_recommendations+1))
runrec


RN="6.2.17"
RNA="Ensure shadow group is empty"
profile="L1S L1W"
REC="ensure_shadow_group_empty"
total_recommendations=$((total_recommendations+1))
runrec


End of generation for specific Benchmark
========================================



#End of recommendations


Update grub.cfg permissions (again)
===================================



\[ -e /boot/grub/grub.cfg \] \&\& chmod og-rwx /boot/grub/grub.cfg
\[ -e /boot/grub2/grub.cfg \] \&\& chmod og-rwx /boot/grub2/grub.cfg


Provide summery report
======================


`summery_report
`
完整脚本下载链接:https://caiyun.139.com/m/i?165CkqBibG1y8 提取码:wbq7
51工具盒子

Linux安全基线检查与自动化

厉飞雨

相关推荐

最新文章

猜你喜欢

快捷分类
