aboutsummaryrefslogtreecommitdiffstats
path: root/init-sh
diff options
context:
space:
mode:
Diffstat (limited to 'init-sh')
-rwxr-xr-xinit-sh/custom.sh124
-rwxr-xr-xinit-sh/level1.sh2
-rwxr-xr-xinit-sh/level2.sh3
-rwxr-xr-xinit-sh/level3.sh7
-rwxr-xr-xinit-sh/level4.sh9
-rwxr-xr-xinit-sh/level5.sh7
-rw-r--r--init-sh/lib.sh5
7 files changed, 128 insertions, 29 deletions
diff --git a/init-sh/custom.sh b/init-sh/custom.sh
index feb5fdc..367f5aa 100755
--- a/init-sh/custom.sh
+++ b/init-sh/custom.sh
@@ -18,12 +18,14 @@ WaitAnswer; clear
if [ ${answer} == "yes" ]; then
find /var/log/ -type f -exec chattr +a {} \;
fi
+
###
echo "Do you want all system events to be logged on tty12 ?"
WaitAnswer; clear
if [ ${answer} == "yes" ]; then
AddRules "*.* /dev/tty12" /etc/syslog.conf
fi
+
###
echo "Do you want to deny any machine to connect to yours ?"
WaitAnswer
@@ -36,6 +38,7 @@ if [ ${answer} == "yes" ]; then
AddRules "ALL:ALL:DENY" /etc/hosts.deny
fi
fi
+
###
echo "Do you want root console login to be allowed ?"
WaitAnswer; clear
@@ -48,33 +51,70 @@ if [ ${answer} == "yes" ]; then
AddRules "tty6" /etc/securetty
fi
###
+echo "Do you want your system to daily check important security problem ?"
+WaitAnswer; clear
+if [ ${answer} == "yes" ]; then
+ AddRules "CHECK_SECURITY=yes" /etc/security/msec/security.conf
+ AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/security_check.sh" /etc/crontab
+fi
+
+###
+echo "Do you want your system to daily check new open port listening ?"
+WaitAnswer; clear
+if [ ${answer} == "yes" ]; then
+ AddRules "CHECK_OPEN_PORT=yes" /etc/security/msec/security.conf
+ AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/security_check.sh" /etc/crontab
+ AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/diff_check.sh" /etc/crontab
+fi
+
+###
+echo "Do you want your system to check for permission problem ?"
+WaitAnswer; clear
+if [ ${answer} == "yes" ]; then
+ AddRules "CHECK_PERMS=yes" /etc/security/msec/security.conf
+ AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/security_check.sh" /etc/crontab
+fi
+
+###
echo "Do you want your system to daily check SUID Root file change ?"
WaitAnswer; clear
if [ ${answer} == "yes" ]; then
AddRules "CHECK_SUID_ROOT=yes" /etc/security/msec/security.conf
- AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab
+ AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/diff_check.sh" /etc/crontab
+fi
+
+###
+echo "Do you want your system to daily check suid files md5 checksum changes ?"
+WaitAnswer; clear
+if [ ${answer} == "yes" ]; then
+ AddRules "CHECK_SUID_MD5=yes" /etc/security/msec/security.conf
+ AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/diff_check.sh" /etc/crontab
fi
+
###
echo "Do you want your system to daily check SUID Group file change ?"
WaitAnswer; clear
if [ ${answer} == "yes" ]; then
AddRules "CHECK_SUID_GROUP=yes" /etc/security/msec/security.conf
- AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab
+ AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/diff_check.sh" /etc/crontab
fi
+
###
-echo "Do you want your system to daily check Writable file change ?"
+echo "Do you want your system to daily check Writeable file change ?"
WaitAnswer; clear
if [ ${answer} == "yes" ]; then
AddRules "CHECK_WRITEABLE=yes" /etc/security/msec/security.conf
- AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab
+ AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/diff_check.sh" /etc/crontab
fi
+
###
echo "Do you want your system to daily check Unowned file change ?"
WaitAnswer; clear
if [ ${answer} == "yes" ]; then
AddRules "CHECK_UNOWNED=yes" /etc/security/msec/security.conf
- AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab
+ AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/diff_check.sh" /etc/crontab
fi
+
###
echo "Do you want your system to verify every minutes if a network interface"
echo "is in promiscuous state (which mean someone is probably running a sniffer on your machine ) ?"
@@ -84,23 +124,81 @@ if [ ${answer} == "yes" ]; then
AddRules "*/1 * * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/promisc_check.sh" /etc/crontab
fi
###
+
LiloUpdate;
/sbin/lilo >& /dev/null
+
###
-echo "Do you want a "." in your PATH variable ?"
-echo "This permit you to not use ./progname & to just type progname"
-echo "However this is a *high* security risk."
+echo "Do you want to disable your running server ( except important one )"
+echo "This is only valuable for server installed with rpm."
WaitAnswer; clear
if [ ${answer} == "yes" ]; then
- AddRules "PATH=\$PATH:/usr/X11R6/bin" /etc/profile
+ echo -n "Disabling all service, except : {"
+ for service in `chkconfig --list | awk '{print $1}'`; do
+ if grep -qx ${service} /etc/security/msec/init-sh/server.5 | grep -v "^#";
+ then
+ echo -n " ${service}"
+ fi
+ done
+ echo " } : "
+
+ for service in `chkconfig --list | awk '{print $1}'`; do
+ chkconfig --del "${service}"
+ if ! chkconfig --msec --add "${service}"; then
+ echo -e "\t- Services ${service} is now disabled."
+ fi
+ done
+ echo -e "done.\n";
fi
+
###
-AddRules "SECURE_LEVEL=\"custom\"" /etc/profile
-export SECURE_LEVEL="custom"
-###
-AddRules "umask 077" /etc/profile
+echo "Do you want to disallow rpm to automatically enable a new installed server for run on next reboot ?"
+echo "yes = you will need to chkconfig (--add ) servername for the server to run on boot."
+echo "no = rpm will do it for you, but you have less control of what is running on your machine."
+WaitAnswer; clear
+if [ ${answer} == "yes" ]; then
+ export SECURE_LEVEL="4"
+ AddRules "SECURE_LEVEL=\"4\"" /etc/profile
+else
+ AddRules "SECURE_LEVEL=\"3\"" /etc/profile
+fi
+###
+echo "Do you want an easy, normal, restricted, or paranoid umask ?"
+echo "easy ( 002 ) = user = rwx, group = rwx, other = rx"
+echo "normal ( 022 ) = user = rwx, group = rx, other = rx"
+echo "restricted ( for users ) ( 077 ) = user = rwx, group =, other ="
+echo "restricted ( for root ) ( 022 ) = user = rwx, = group = rx, other = rx"
+echo "paranoid ( 077 ) = user = rwx, group = , other ="
+answer="nothing"
+while [[ "${answer}" != "easy" && "${answer}" != "normal" && "${answer} != "restricted" && "${answer}" != "paranoid" ]]; do
+ echo -n "easy/normal/restricted/paranoid : "
+ read answer
+done
+case "${answer}" in
+ "easy")
+ AddRules "umask 002" /etc/profile
+ ;;
+ "normal")
+ AddRules "umask 022" /etc/profile
+ ;;
+ "restricted")
+ AddRules "if [ \${UID} == 0 ]; then umask 022; else umask 077; fi" /etc/profile
+ ;;
+ "paranoid")
+ AddRules "umask 077" /etc/profile
+ ;;
+###
+echo "Do you want a "." in your PATH variable ?"
+echo "This permit you to not use ./progname & to just type progname"
+echo "However this is a *high* security risk."
+WaitAnswer; clear
+if [ ${answer} == "yes" ]; then
+ AddRules "PATH=\$PATH:/usr/X11R6/bin:/usr/games:." /etc/profile
+else
+ AddRules "PATH=\$PATH:/usr/X11R6/bin:/usr/games" /etc/profile
+fi
diff --git a/init-sh/level1.sh b/init-sh/level1.sh
index b652fc6..a0cd43c 100755
--- a/init-sh/level1.sh
+++ b/init-sh/level1.sh
@@ -40,8 +40,6 @@ echo -e "\t- Check promiscuous mode : no."
AddRules "CHECK_PROMISC=no" /etc/security/msec/security.conf quiet
echo -e "\t- Check listening port : no."
AddRules "CHECK_OPEN_PORT=no" /etc/security/msec/security.conf quiet
-echo -e "\t- Check for dangerous .[sr]hosts file : no."
- AddRules "CHECK_RHOST=no" /etc/security/msec/security.conf quiet
echo -e "\t- Check passwd file integrity : no."
AddRules "CHECK_PASSWD=no" /etc/security/msec/security.conf quiet
echo -e "\t- Check shadow file integrity : no."
diff --git a/init-sh/level2.sh b/init-sh/level2.sh
index 1e6d605..20f3298 100755
--- a/init-sh/level2.sh
+++ b/init-sh/level2.sh
@@ -40,8 +40,6 @@ echo -e "\t- Check promiscuous mode : no."
AddRules "CHECK_PROMISC=no" /etc/security/msec/security.conf quiet
echo -e "\t- Check listening port : no."
AddRules "CHECK_OPEN_PORT=no" /etc/security/msec/security.conf quiet
-echo -e "\t- Check for dangerous .[sr]hosts file : no."
- AddRules "CHECK_RHOST=no" /etc/security/msec/security.conf quiet
echo -e "\t- Check passwd file integrity : no."
AddRules "CHECK_PASSWD=no" /etc/security/msec/security.conf quiet
echo -e "\t- Check shadow file integrity : no."
@@ -66,6 +64,7 @@ AddRules "umask 022" /etc/profile
echo "Adding \"normal\" PATH variable :"
AddRules "PATH=\$PATH:/usr/X11R6/bin:/usr/games" /etc/profile quiet
AddRules "export PATH SECURE_LEVEL" /etc/profile
+
# Group
echo -n "Adding \"${DRAKX_USERS}\" to audio group :"
for user in ${DRAKX_USERS}; do
diff --git a/init-sh/level3.sh b/init-sh/level3.sh
index 5859689..3d33690 100755
--- a/init-sh/level3.sh
+++ b/init-sh/level3.sh
@@ -41,11 +41,9 @@ echo -e "\t- Check world writable file : yes."
echo -e "\t- Check unowned file : no."
AddRules "CHECK_UNOWNED=no" /etc/security/msec/security.conf quiet
echo -e "\t- Check promiscuous mode : no."
- AddRules "CHECK_PROMISC=yes" /etc/security/msec/security.conf quiet
+ AddRules "CHECK_PROMISC=no" /etc/security/msec/security.conf quiet
echo -e "\t- Check listening port : yes."
AddRules "CHECK_OPEN_PORT=yes" /etc/security/msec/security.conf quiet
-echo -e "\t- Check for dangerous .[sr]hosts file : yes."
- AddRules "CHECK_RHOST=yes" /etc/security/msec/security.conf quiet
echo -e "\t- Check passwd file integrity : yes."
AddRules "CHECK_PASSWD=yes" /etc/security/msec/security.conf quiet
echo -e "\t- Check shadow file integrity : yes."
@@ -58,7 +56,8 @@ echo -e "\t- Security warning in syslog : \"yes\" :"
# Crontab
echo "Adding permission check in crontab (scheduled every midnight) :"
-AddRules "0 0 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab
+AddRules "0 0 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/diff_check.sh" /etc/crontab
+AddRules "0 0 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/security_check.sh" /etc/crontab
echo -n "Running lilo to record new config : "
/sbin/lilo >& /dev/null
diff --git a/init-sh/level4.sh b/init-sh/level4.sh
index 00ea93d..6745ae5 100755
--- a/init-sh/level4.sh
+++ b/init-sh/level4.sh
@@ -54,8 +54,6 @@ echo -e "\t- Check promiscuous mode : yes."
AddRules "CHECK_PROMISC=yes" /etc/security/msec/security.conf quiet
echo -e "\t- Check listening port : yes."
AddRules "CHECK_OPEN_PORT=yes" /etc/security/msec/security.conf quiet
-echo -e "\t- Check for dangerous .[sr]hosts file : yes."
- AddRules "CHECK_RHOST=yes" /etc/security/msec/security.conf quiet
echo -e "\t- Check passwd file integrity : yes."
AddRules "CHECK_PASSWD=yes" /etc/security/msec/security.conf quiet
echo -e "\t- Check shadow file integrity : yes."
@@ -70,8 +68,11 @@ echo -e "\t- Security warning in syslog : \"yes\" :"
echo "Adding promisc check in crontab (scheduled every minutes) :"
AddRules "*/1 * * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/promisc_check.sh" /etc/crontab
-echo "Adding permission check in crontab (scheduled every midnight) :"
-AddRules "0 0 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab
+echo "Adding \"diff\" security check in crontab (scheduled every midnight) :"
+AddRules "0 0 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/diff_check.sh" /etc/crontab
+
+echo "Adding \"global\" security check in crontab (scheduled every midnight) :"
+AddRules "0 0 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/security_check.sh" /etc/crontab
# Do you want a password ?
LiloUpdate;
diff --git a/init-sh/level5.sh b/init-sh/level5.sh
index 272267f..33ad73b 100755
--- a/init-sh/level5.sh
+++ b/init-sh/level5.sh
@@ -45,8 +45,6 @@ echo -e "\t- Check promiscuous mode : yes."
AddRules "CHECK_PROMISC=yes" /etc/security/msec/security.conf quiet
echo -e "\t- Check listening port : yes."
AddRules "CHECK_OPEN_PORT=yes" /etc/security/msec/security.conf quiet
-echo -e "\t- Check for dangerous .[sr]hosts file : yes."
- AddRules "CHECK_RHOST=yes" /etc/security/msec/security.conf quiet
echo -e "\t- Check passwd file integrity : yes."
AddRules "CHECK_PASSWD=yes" /etc/security/msec/security.conf quiet
echo -e "\t- Check shadow file integrity : yes."
@@ -62,8 +60,11 @@ echo -e "\t- Security warning in syslog : \"yes\" :"
echo "Adding promisc check in crontab (scheduled every minutes) :"
AddRules "*/1 * * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/promisc_check.sh" /etc/crontab
-echo "Adding permission check in crontab (schedued every midnight) :"
+echo "Adding \"diff\" security check in crontab (scheduled every midnight) :"
AddRules "0 0 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab
+
+echo "Adding \"global\" security check in crontab (scheduled every midnight) :"
+AddRules "0 0 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/security_check.sh" /etc/crontab
###################################################
# Wanna a password ?
diff --git a/init-sh/lib.sh b/init-sh/lib.sh
index 971a228..07a0507 100644
--- a/init-sh/lib.sh
+++ b/init-sh/lib.sh
@@ -99,7 +99,7 @@ Syslog() {
Ttylog() {
if [ "${TTY_LOG}" == "yes" ]; then
- for i in `w | grep -v "load\|TTY" | awk '{print $2}'` ; do
+ w | grep -v "load\|TTY" | awk '{print $2}' | while read line; do
echo -e ${1} > /dev/$i
done
fi
@@ -166,6 +166,7 @@ CleanRules /etc/profile
CleanRules /etc/lilo.conf
CleanRules /etc/rc.d/rc.firewall
CleanRules /etc/crontab
+CleanRules /etc/security/msec/security.users
echo -e "\nStarting to reconfigure the system : "
@@ -188,6 +189,8 @@ if [ ! -f /tmp/secure.DrakX ]; then
echo "Problem removing user \"${user}\" from group audio."
fi
done
+else
+ AddRules "${DRAKX_USERS}" /etc/security/msec/security.conf
fi
generated by cgit v1.2.1 (git 2.21.0) at 2024-11-01 20:11:33 +0000