Skip to content

Commit 5f5d5d1

Browse files
lizricelizrice
authored
Merge pull request #23 from aquasecurity/new-cis-version
Add new linux-benchmark version 2.0.0
2 parents 333b5ff + 373487c commit 5f5d5d1

15 files changed

+9006
-0
lines changed

‎cfg/2.0.0/6.2.10.sh

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/bash
2+
3+
grep -E -v '^(halt|sync|shutdown)' /etc/passwd | awk -F: '($7 != "'"$(which
4+
nologin)"'" && $7 != "/bin/false") { print $1 " " $6 }' | while read user
5+
dir; do
6+
if [ ! -d "$dir" ]; then
7+
echo "The home directory ($dir) of user $user does not exist."
8+
else
9+
for file in $dir/.[A-Za-z0-9]*; do
10+
if [ ! -h "$file" -a -f "$file" ]; then
11+
fileperm=$(ls -ld $file | cut -f1 -d" ")
12+
if [ $(echo $fileperm | cut -c6) != "-" ]; then
13+
echo "Group Write permission set on file $file"
14+
fi
15+
if [ $(echo $fileperm | cut -c9) != "-" ]; then
16+
echo "Other Write permission set on file $file"
17+
fi
18+
fi
19+
done
20+
fi
21+
done

‎cfg/2.0.0/6.2.11.sh

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/bash
2+
3+
grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '($7 !=
4+
"'"$(which nologin)"'" && $7 != "/bin/false") { print $1 " " $6 }' | while
5+
read user dir; do
6+
if [ ! -d "$dir" ]; then
7+
echo "The home directory ($dir) of user $user does not exist."
8+
else
9+
if [ ! -h "$dir/.forward" -a -f "$dir/.forward" ]; then
10+
echo ".forward file $dir/.forward exists"
11+
fi
12+
fi
13+
done

‎cfg/2.0.0/6.2.12.sh

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/bash
2+
3+
grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '($7 !=
4+
"'"$(which nologin)"'" && $7 != "/bin/false") { print $1 " " $6 }' | while
5+
read user dir; do
6+
if [ ! -d "$dir" ]; then
7+
echo "The home directory ($dir) of user $user does not exist."
8+
else
9+
if [ ! -h "$dir/.netrc" -a -f "$dir/.netrc" ]; then
10+
echo ".netrc file $dir/.netrc exists"
11+
fi
12+
fi
13+
done

‎cfg/2.0.0/6.2.13.sh

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/bin/bash
2+
3+
grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '($7 !=
4+
"'"$(which nologin)"'" && $7 != "/bin/false") { print $1 " " $6 }' | while
5+
read user dir; do
6+
if [ ! -d "$dir" ]; then
7+
echo "The home directory ($dir) of user $user does not exist."
8+
else
9+
for file in $dir/.netrc; do
10+
if [ ! -h "$file" -a -f "$file" ]; then
11+
fileperm=$(ls -ld $file | cut -f1 -d" ")
12+
if [ $(echo $fileperm | cut -c5) != "-" ]; then
13+
echo "Group Read set on $file"
14+
fi
15+
if [ $(echo $fileperm | cut -c6) != "-" ]; then
16+
echo "Group Write set on $file"
17+
fi
18+
if [ $(echo $fileperm | cut -c7) != "-" ]; then
19+
echo "Group Execute set on $file"
20+
fi
21+
if [ $(echo $fileperm | cut -c8) != "-" ]; then
22+
echo "Other Read set on $file"
23+
fi
24+
if [ $(echo $fileperm | cut -c9) != "-" ]; then
25+
echo "Other Write set on $file"
26+
fi
27+
if [ $(echo $fileperm | cut -c10) != "-" ]; then
28+
echo "Other Execute set on $file"
29+
fi
30+
fi
31+
done
32+
fi
33+
done

‎cfg/2.0.0/6.2.14.sh

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/bin/bash
2+
3+
grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '($7 !=
4+
"'"$(which nologin)"'" && $7 != "/bin/false") { print $1 " " $6 }' | while
5+
read user dir; do
6+
if [ ! -d "$dir" ]; then
7+
echo "The home directory ($dir) of user $user does not exist."
8+
else
9+
for file in $dir/.rhosts; do
10+
if [ ! -h "$file" -a -f "$file" ]; then
11+
echo ".rhosts file in $dir"
12+
fi
13+
done
14+
fi
15+
done

‎cfg/2.0.0/6.2.15.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
3+
for i in $(cut -s -d: -f4 /etc/passwd | sort -u ); do
4+
grep -q -P "^.*?:[^:]*:$i:" /etc/group
5+
if [ $? -ne 0 ]; then
6+
echo "Group $i is referenced by /etc/passwd but does not exist in /etc/group"
7+
fi
8+
done

‎cfg/2.0.0/6.2.16.sh

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
3+
cut -f3 -d":" /etc/passwd | sort -n | uniq -c | while read x ; do
4+
[ -z "$x" ] && break
5+
set - $x
6+
if [ $1 -gt 1 ]; then
7+
users=$(awk -F: '($3 == n) { print $1 }' n=$2 /etc/passwd | xargs)
8+
echo "Duplicate UID ($2): $users"
9+
fi
10+
done

‎cfg/2.0.0/6.2.17.sh

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
3+
cut -f3 -d":" /etc/group | sort -n | uniq -c | while read x ; do
4+
[ -z "$x" ] && break
5+
set - $x
6+
if [ $1 -gt 1 ]; then
7+
groups=$(awk -F: '($3 == n) { print $1 }' n=$2 /etc/group | xargs)
8+
echo "Duplicate GID ($2): $groups"
9+
fi
10+
done

‎cfg/2.0.0/6.2.18.sh

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
3+
cut -f1 -d":" /etc/passwd | sort -n | uniq -c | while read x ; do
4+
[ -z "$x" ] && break
5+
set - $x
6+
if [ $1 -gt 1 ]; then
7+
uids=$(awk -F: '($1 == n) { print $3 }' n=$2 /etc/passwd | xargs)
8+
echo "Duplicate User Name ($2): $uids"
9+
fi
10+
done

‎cfg/2.0.0/6.2.19.sh

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
3+
cut -f1 -d":" /etc/group | sort -n | uniq -c | while read x ; do
4+
[ -z "$x" ] && break
5+
set - $x
6+
if [ $1 -gt 1 ]; then
7+
gids=$(gawk -F: '($1 == n) { print $3 }' n=$2 /etc/group | xargs)
8+
echo "Duplicate Group Name ($2): $gids"
9+
fi
10+
done

‎cfg/2.0.0/6.2.6.sh

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#!/bin/bash
2+
if [ "$(echo "$PATH" | grep ::)" != "" ]; then
3+
echo "Empty Directory in PATH (::)"
4+
fi
5+
6+
if [ "$(echo "$PATH" | grep :$)" != "" ]; then
7+
echo "Trailing : in PATH"
8+
fi
9+
10+
p=$(echo "$PATH" | sed -e 's/::/:/' -e 's/:$//' -e 's/:/ /g')
11+
set -- $p
12+
while [ "$1" != "" ]; do
13+
if [ "$1" = "." ]; then
14+
shift
15+
continue
16+
fi
17+
if [ -d "$1" ]; then
18+
dirperm=$(ls -ldH "$1" | cut -f1 -d" ")
19+
if [ "$(echo "$dirperm" | cut -c6)" != "-" ]; then
20+
echo "Group Write permission set on directory $1"
21+
fi
22+
if [ "$(echo "$dirperm" | cut -c9)" != "-" ]; then
23+
echo "Other Write permission set on directory $1"
24+
fi dirown=$(ls -ldH "$1" | awk '{print $3}')
25+
if [ "$dirown" != "root" ] ; then
26+
echo "$1 is not owned by root"
27+
fi
28+
else
29+
echo "$1 is not a directory"
30+
fi
31+
shift
32+
done

‎cfg/2.0.0/6.2.7.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
grep -E -v '^(halt|sync|shutdown)' /etc/passwd | awk -F: '($7 != "'"$(which
3+
nologin)"'" && $7 != "/bin/false") { print $1 " " $6 }' | while read -r user
4+
dir; do
5+
if [ ! -d "$dir" ]; then
6+
echo "The home directory ($dir) of user $user does not exist."
7+
fi
8+
done

‎cfg/2.0.0/6.2.8.sh

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/bin/bash
2+
3+
grep -E -v '^$(halt|sync|shutdown)' /etc/passwd | awk -F: '$($7 != "'"$$(which
4+
nologin)"'" && $7 != "/bin/false") { print $1 " " $6 }' | while read user
5+
dir; do
6+
if [ ! -d "$dir" ]; then
7+
echo "The home directory $($dir) of user $user does not exist."
8+
else
9+
dirperm=$$(ls -ld $dir | cut -f1 -d" ")
10+
if [ $(echo $dirperm | cut -c6) != "-" ]; then
11+
echo "Group Write permission set on the home directory $($dir) of user $user"
12+
fi
13+
if [ $(echo $dirperm | cut -c8) != "-" ]; then
14+
echo "Other Read permission set on the home directory $($dir) of user $user"
15+
fi
16+
if [ $(echo $dirperm | cut -c9) != "-" ]; then
17+
echo "Other Write permission set on the home directory $($dir) of user $user"
18+
fi
19+
if [ $(echo $dirperm | cut -c10) != "-" ]; then
20+
echo "Other Execute permission set on the home directory $($dir) of user $user"
21+
fi
22+
fi
23+
done
24+

‎cfg/2.0.0/6.2.9.sh

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/bin/bash
2+
3+
grep -E -v '^(halt|sync|shutdown)' /etc/passwd | awk -F: '($7 != "'"$(which
4+
nologin)"'" && $7 != "/bin/false") { print $1 " " $6 }' | while read user
5+
dir; do
6+
if [ ! -d "$dir" ]; then
7+
echo "The home directory ($dir) of user $user does not exist."
8+
else
9+
owner=$(stat -L -c "%U" "$dir")
10+
if [ "$owner" != "$user" ]; then
11+
echo "The home directory ($dir) of user $user is owned by $owner."
12+
fi
13+
fi
14+
done

0 commit comments

Comments
 (0)