diff options
| -rwxr-xr-x | init-sh/custom.sh | 0 | ||||
| -rwxr-xr-x | init-sh/init.sh | 5 | ||||
| -rwxr-xr-x | init-sh/level1.sh | 52 | ||||
| -rwxr-xr-x | init-sh/level2.sh | 65 | ||||
| -rwxr-xr-x | init-sh/level3.sh | 64 | ||||
| -rwxr-xr-x | init-sh/level4.sh | 66 | ||||
| -rwxr-xr-x | init-sh/level5.sh | 62 | ||||
| -rw-r--r-- | init-sh/lib.sh | 23 |
8 files changed, 215 insertions, 122 deletions
diff --git a/init-sh/custom.sh b/init-sh/custom.sh new file mode 100755 index 0000000..e69de29 --- /dev/null +++ b/init-sh/custom.sh diff --git a/init-sh/init.sh b/init-sh/init.sh index 4e89cb9..fa8e9b3 100755 --- a/init-sh/init.sh +++ b/init-sh/init.sh @@ -2,10 +2,15 @@ if [ -z $1 ]; then echo "Usage : $0 [0-5]" + echo "Usage : $0 \"custom\"" exit 1 fi +if [ "${1}" == "custom" ]; then + /etc/security/msec/init-sh/custom.sh +fi + if [ -f /etc/security/msec/init-sh/level$1.sh ]; then /etc/security/msec/init-sh/level$1.sh if [ -f /etc/security/msec/init-sh/perm.$1 ]; then diff --git a/init-sh/level1.sh b/init-sh/level1.sh index 3d5d300..b54b85b 100755 --- a/init-sh/level1.sh +++ b/init-sh/level1.sh @@ -12,30 +12,44 @@ else fi # login as root on console granted... -AddRules "tty1" /etc/securetty -AddRules "tty2" /etc/securetty -AddRules "tty3" /etc/securetty -AddRules "tty4" /etc/securetty -AddRules "tty5" /etc/securetty +echo "Login as root is granted :" +AddRules "tty1" /etc/securetty quiet +AddRules "tty2" /etc/securetty quiet +AddRules "tty3" /etc/securetty quiet +AddRules "tty4" /etc/securetty quiet +AddRules "tty5" /etc/securetty quiet AddRules "tty6" /etc/securetty # Suid Check -AddRules "CHECK_SUID=no" /etc/security/msec/security.conf -AddRules "CHECK_PROMISC=no" /etc/security/msec/security.conf -AddRules "TTY_WARN=no" /etc/security/msec/security.conf +echo "Updating file check variable :" +echo -e "\t- Check suid root file : no." +AddRules "CHECK_SUID_ROOT=no" /etc/security/msec/security.conf quiet +echo -e "\t- Check suid goup file : no." +AddRules "CHECK_SUID_GROUP=no" /etc/security/msec/security.conf quiet +echo -e "\t- Check world writable file : no." +AddRules "CHECK_WRITABLE=no" /etc/security/msec/security.conf quiet +echo -e "\t- Check unowned file : no." +AddRules "CHECK_UNOWNED=no" /etc/security/msec/security.conf quiet +echo -e "\t- Check promiscuous mode : no." +AddRules "CHECK_PROMISC=no" /etc/security/msec/security.conf quiet +echo -e "\t- Security warning on tty : no." +AddRules "TTY_WARN=no" /etc/security/msec/security.conf quiet +echo -e "\t- Security warning in syslog : yes." AddRules "SYSLOG_WARN=yes" /etc/security/msec/security.conf -# umask -AddRules "umask 022" /etc/profile -AddRules "SECURE_LEVEL=1" /etc/profile -# Group -usermod -G audio "${USERNAME}" - -# For X auth : -xhost + localhost 2>&1 >& /dev/null - # lilo update -lilo +echo -n "Running lilo to record new config : " +/sbin/lilo >& /dev/null +echo -e "done.\n" -# Path +# /etc/profile +echo "Setting secure level variable to 1 :" +AddRules "SECURE_LEVEL=1" /etc/profile +echo "Setting umask to 002 (user = rw, group = rw, o = r) :" +AddRules "umask 002" /etc/profile +echo "Adding \"non secure\" PATH variable :" AddRules "PATH=\$PATH:/usr/X11R6/bin:." /etc/profile + +# Group +echo "Adding \"${USERNAME} to audio group :" +usermod -G audio "${USERNAME}" diff --git a/init-sh/level2.sh b/init-sh/level2.sh index 64027da..b9385f9 100755 --- a/init-sh/level2.sh +++ b/init-sh/level2.sh @@ -12,42 +12,45 @@ else fi # login as root on console granted... -AddRules "tty1" /etc/securetty -AddRules "tty2" /etc/securetty -AddRules "tty3" /etc/securetty -AddRules "tty4" /etc/securetty -AddRules "tty5" /etc/securetty -AddRules "tty6" /etc/securetty - -# Suid Check -AddRules "CHECK_SUID=yes" /etc/security/msec/security.conf -AddRules "CHECK_PROMISC=no" /etc/security/msec/security.conf -AddRules "TTY_WARN=no" /etc/security/msec/security.conf +echo "Login as root is granted :" +AddRules "tty1" /etc/securetty quiet +AddRules "tty2" /etc/securetty quiet +AddRules "tty3" /etc/securetty quiet +AddRules "tty4" /etc/securetty quiet +AddRules "tty5" /etc/securetty quiet +AddRules "tty6" /etc/securetty + +# security.conf +echo "Updating file check variable :" +echo -e "\t- Check suid root file : yes." +AddRules "CHECK_SUID_ROOT=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check suid goup file : no." +AddRules "CHECK_SUID_GROUP=no" /etc/security/msec/security.conf quiet +echo -e "\t- Check world writable file : no." +AddRules "CHECK_WRITABLE=no" /etc/security/msec/security.conf quiet +echo -e "\t- Check unowned file : no." +AddRules "CHECK_UNOWNED=no" /etc/security/msec/security.conf quiet +echo -e "\t- Check promiscuous mode : no." +AddRules "CHECK_PROMISC=no" /etc/security/msec/security.conf quiet +echo -e "\t- Security warning on tty : no." +AddRules "TTY_WARN=no" /etc/security/msec/security.conf quiet +echo -e "\t- Security warning in syslog : yes." AddRules "SYSLOG_WARN=yes" /etc/security/msec/security.conf -# Permissions -AddRules "umask 002" /etc/profile -AddRules "SECURE_LEVEL=2" /etc/profile -# Group -usermod -G audio ${USERNAME} >& /dev/null - -# For X auth : -xhost + localhost 2>&1 >& /dev/null - # lilo update +echo -n "Running lilo to record new config : " /sbin/lilo +echo -e "done.\n" -# Path +# /etc/profile +echo "Setting secure level variable to 2 :" +AddRules "SECURE_LEVEL=2" /etc/profile +echo "Setting umask to 022 (user = rw, group = r, o = r) :" +AddRules "umask 022" /etc/profile +echo "Adding \"normal\" PATH variable :" AddRules "PATH=\$PATH:/usr/X11R6/bin" /etc/profile - - - - - - - - - - +# Group +echo "Adding \"${USERNAME} to audio group :" +usermod -G audio "${USERNAME}" diff --git a/init-sh/level3.sh b/init-sh/level3.sh index 1c1cfd9..bfb71ea 100755 --- a/init-sh/level3.sh +++ b/init-sh/level3.sh @@ -12,48 +12,48 @@ else fi # All events logged on tty12 +echo "Loging all messages on tty12 : " AddRules "*.* /dev/tty12" /etc/syslog.conf # login as root from the console allowed +echo "Login as root is allowed (on the console) : " AddRules "tty1" /etc/securetty -AddRules "tty2" /etc/securetty -AddRules "tty3" /etc/securetty -AddRules "tty4" /etc/securetty -AddRules "tty5" /etc/securetty -AddRules "tty6" /etc/securetty - -# Suid Check -AddRules "CHECK_SUID_ROOT=yes" /etc/security/msec/security.conf -AddRules "CHECK_SUID_GROUP=yes" /etc/security/msec/security.conf -AddRules "CHECK_WRITABLE=yes" /etc/security/msec/security.conf -AddRules "CHECK_UNOWNED=yes" /etc/security/msec/security.conf -AddRules "CHECK_PROMISC=no" /etc/security/msec/security.conf -AddRules "TTY_WARN=no" /etc/security/msec/security.conf +AddRules "tty2" /etc/securetty quiet +AddRules "tty3" /etc/securetty quiet +AddRules "tty4" /etc/securetty quiet +AddRules "tty5" /etc/securetty quiet +AddRules "tty6" /etc/securetty quiet + +# / +echo "Updating file check variable : " +echo -e "\t- Check suid root file : yes." +AddRules "CHECK_SUID_ROOT=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check suid goup file : yes." +AddRules "CHECK_SUID_GROUP=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check world writable file : yes." +AddRules "CHECK_WRITABLE=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check unowned file : yes." +AddRules "CHECK_UNOWNED=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check promiscuous mode : \"no\" :" +AddRules "CHECK_PROMISC=no" /etc/security/msec/security.conf quiet +echo -e "\t- Security warning on tty : \"no\" :" +AddRules "TTY_WARN=no" /etc/security/msec/security.conf quiet +echo -e "\t- Security warning on syslog : \"yes\" :" AddRules "SYSLOG_WARN=yes" /etc/security/msec/security.conf # Crontab +echo "Adding permission check in crontab (scheduled every midnight) :" AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab +echo -n "Running lilo to record new config : " +/sbin/lilo >& /dev/null +echo -e "done.\n" -# Permissions +# /etc/profile +echo "Setting secure level variable to 3 :" +AddRules "SECURE_LEVEL=3" /etc/profile +echo "Setting umask to 022 (user = rw, group = r, o = r) :" AddRules "umask 022" /etc/profile -AddRules "SECURE_LEVEL=3 /etc/profile - -/sbin/lilo - - -# Path +echo "Adding a \"normal\" PATH variable : " AddRules "PATH=\$PATH:/usr/X11R6/bin" /etc/profile - - - - - - - - - - - - diff --git a/init-sh/level4.sh b/init-sh/level4.sh index a255b35..c3e0e5e 100755 --- a/init-sh/level4.sh +++ b/init-sh/level4.sh @@ -14,51 +14,79 @@ else fi # Log in append only mode +echo -e "Changing attribute of /var/log/* to append only...\n" chattr +a /var/log/* # All events logged on tty12 +echo "Loging all messages on tty12 : " AddRules "*.* /dev/tty12" /etc/syslog.conf # Prevent all kind of connection except from localhost +echo "Denying all kind of connection except localhost : " AddRules "ALL:ALL EXCEPT localhost:DENY" /etc/hosts.deny # Login as root on the console allowed : -AddRules "tty1" /etc/securetty -AddRules "tty2" /etc/securetty -AddRules "tty3" /etc/securetty -AddRules "tty4" /etc/securetty -AddRules "tty5" /etc/securetty -AddRules "tty6" /etc/securetty +echo "Denying login as root (except on the console) :" +AddRules "tty1" /etc/securetty quiet +AddRules "tty2" /etc/securetty quiet +AddRules "tty3" /etc/securetty quiet +AddRules "tty4" /etc/securetty quiet +AddRules "tty5" /etc/securetty quiet +AddRules "tty6" /etc/securetty # Suid check -AddRules "CHECK_SUID_ROOT=yes" /etc/security/msec/security.conf -AddRules "CHECK_SUID_GROUP=yes" /etc/security/msec/security.conf -AddRules "CHECK_WRITABLE=yes" /etc/security/msec/security.conf -AddRules "CHECK_UNOWNED=yes" /etc/security/msec/security.conf -AddRules "CHECK_PROMISC=yes" /etc/security/msec/security.conf -AddRules "TTY_WARN=yes" /etc/security/msec/security.conf +echo "Updating file check variable : " +echo -e "\t- Check suid root file : yes." +AddRules "CHECK_SUID_ROOT=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check suid goup file : yes." +AddRules "CHECK_SUID_GROUP=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check world writable file : yes." +AddRules "CHECK_WRITABLE=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check unowned file : yes." +AddRules "CHECK_UNOWNED=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check promiscuous mode : yes." +AddRules "CHECK_PROMISC=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Security warning on tty : \"yes\" :" +AddRules "TTY_WARN=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Security warning in syslog : \"yes\" :" AddRules "SYSLOG_WARN=yes" /etc/security/msec/security.conf # Check every 1 minutes for promisc problem +echo "Adding promisc check in crontab (scheduled every minutes) :" AddRules "*/1 * * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/promisc_check.sh" /etc/crontab + +echo "Adding permission check in crontab (scheduled every midnight) :" AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab # Do you want a password ? LiloUpdate; -/sbin/lilo +echo -n "Running lilo to record new config : " +/sbin/lilo >& /dev/null +echo -e "done.\n" # Server update +echo "Setting secure level variable to 4 :" AddRules "SECURE_LEVEL=4" /etc/profile export SECURE_LEVEL=4 +echo -n "Disabling all service, except : {" for service in `chkconfig --list | awk '{print $1}'`; do - chkconfig --del "${service}" - chkconfig --msec --add "${service}" + if grep -qx ${service} /etc/security/msec/init-sh/server.4; then + echo -n " ${service}" + fi done +echo " } : " -# Permissions -AddRules "umask 022" /etc/profile +for service in `chkconfig --list | awk '{print $1}'`; do + chkconfig --del "${service}" + if ! chkconfig --msec --add "${service}"; then + echo -e "\t- Services ${service} is now disabled." + fi +done +echo -e "done.\n"; -# Path +# /etc/profile +echo "Setting umask to 077 (user = rw) :" +AddRules "umask 077" /etc/profile +echo "Adding \"normal\" PATH variable :" AddRules "PATH=\$PATH:/usr/X11R6/bin" /etc/profile - diff --git a/init-sh/level5.sh b/init-sh/level5.sh index b6fd09d..a39944e 100755 --- a/init-sh/level5.sh +++ b/init-sh/level5.sh @@ -9,50 +9,82 @@ if [ -f /etc/security/msec/init-sh/lib.sh ]; then . /etc/security/msec/init-sh/lib.sh fi +echo -e "Changing attribute of /var/log/* to append only...\n" chattr +a /var/log/* # All events logged on tty12 +echo "Loging all messages on tty12 : " AddRules "*.* /dev/tty12" /etc/syslog.conf # Prevent all kind of connection +echo "Denying all kind of connection : " AddRules "ALL:ALL:DENY" /etc/hosts.deny # No login as root -AddRules "" /etc/securetty +echo "Login as root is denied : " +echo "Modified file : /etc/securetty..." +echo -e "done.\n\n" # Suid check -AddRules "CHECK_SUID_ROOT=yes" /etc/security/msec/security.conf -AddRules "CHECK_SUID_GROUP=yes" /etc/security/msec/security.conf -AddRules "CHECK_WRITABLE=yes" /etc/security/msec/security.conf -AddRules "CHECK_UNOWNED=yes" /etc/security/msec/security.conf -AddRules "CHECK_PROMISC=yes" /etc/security/msec/security.conf -AddRules "TTY_WARN=yes" /etc/security/msec/security.conf -AddRules "SYSLOG_WARN=yes" /etc/security/msec/security.conf - +echo "Updating file check variable : " +echo -e "\t- Check suid root file : yes." +AddRules "CHECK_SUID_ROOT=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check suid goup file : yes." +AddRules "CHECK_SUID_GROUP=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check world writable file : yes." +AddRules "CHECK_WRITABLE=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check unowned file : yes." +AddRules "CHECK_UNOWNED=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check promiscuous mode : yes." +AddRules "CHECK_PROMISC=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Security warning on tty : \"yes\" :" +AddRules "TTY_WARN=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Security warning in syslog : \"yes\" :" +AddRules "SYSLOG_WARN=yes" /etc/security/msec/security.conf + +################ Crontab things ################### # Check every 1 minutes for promisc problem +echo "Adding promisc check in crontab (scheduled every minutes) :" AddRules "*/1 * * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/promisc_check.sh" /etc/crontab -AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab +echo "Adding permission check in crontab (schedued every midnight) :" +AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab +################################################### # Wanna a password ? LiloUpdate; -/sbin/lilo + +echo -n "Running lilo to record new config : " +/sbin/lilo >& /dev/null +echo -e "done.\n" # Disable all server : +echo "Setting secure level variable to 5 :" AddRules "SECURE_LEVEL=5" /etc/profile IFS=" " export SECURE_LEVEL=5 +echo -n "Disabling all service, except : {" +for service in `chkconfig --list | awk '{print $1}'`; do + if grep -qx ${service} /etc/security/msec/init-sh/server.5; then + echo -n " ${service}" + fi +done +echo " } : " + for service in `chkconfig --list | awk '{print $1}'`; do chkconfig --del "${service}" - chkconfig --msec --add "${service}" + if ! chkconfig --msec --add "${service}"; then + echo -e "\t- Services ${service} is now disabled." + fi done +echo -e "done.\n"; -# Permissions +# /etc/profile +echo "Setting umask to 077 (user = rw) :" AddRules "umask 077" /etc/profile - -# Path +echo "Adding \"normal\" PATH variable :" AddRules "PATH=\$PATH:/usr/X11R6/bin" /etc/profile echo diff --git a/init-sh/lib.sh b/init-sh/lib.sh index 61dfb9e..578c4e4 100644 --- a/init-sh/lib.sh +++ b/init-sh/lib.sh @@ -34,16 +34,24 @@ AddRules () { return; fi + if [ -z ${3} ]; then + echo "Modifying config in ${file}..." + fi + if ! grep -qx "${string}" ${file}; then echo "${COMMENT}" >> ${file}; echo "${string}" >> ${file}; fi + if [ -z ${3} ]; then + echo -e "done.\n" + fi } CleanRules() { file=$1 ctrl=0 + echo -en "\t- Cleaning msec appended line in ${file} : " mv -f ${file} /tmp/secure.tmp touch ${file} @@ -64,11 +72,14 @@ CleanRules() { rm -f /tmp/secure.tmp + echo "done." } CommentUserRules() { file=$1 + echo -en "\t- Cleaning user appended line in ${file} : " + mv -f ${file} /tmp/secure.tmp touch ${file} @@ -79,6 +90,7 @@ CommentUserRules() { done < /tmp/secure.tmp rm -f /tmp/secure.tmp + echo "done." } Syslog() { @@ -126,29 +138,28 @@ LiloUpdate() { fi } - +clear +echo "Preparing to run security script : " CleanRules /etc/syslog.conf - CleanRules /etc/hosts.deny CommentUserRules /etc/hosts.deny - CleanRules /etc/hosts.allow CommentUserRules /etc/hosts.allow - CleanRules /etc/securetty CommentUserRules /etc/securetty - CleanRules /etc/security/msec/security.conf CommentUserRules /etc/security/msec/security.conf - CleanRules /etc/profile CleanRules /etc/lilo.conf CleanRules /etc/rc.d/rc.firewall CleanRules /etc/crontab +echo -e "\nStarting to reconfigure the system : " # For all secure level +echo "Setting spoofing protection : " AddRules "echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter" /etc/rc.d/rc.firewall + # default group which must exist on the system groupadd audio >& /dev/null groupadd xgrp >& /dev/null |