diff options
Diffstat (limited to 'init-sh/level5.sh')
| -rwxr-xr-x | init-sh/level5.sh | 62 |
1 files changed, 47 insertions, 15 deletions
diff --git a/init-sh/level5.sh b/init-sh/level5.sh index b6fd09d..a39944e 100755 --- a/init-sh/level5.sh +++ b/init-sh/level5.sh @@ -9,50 +9,82 @@ if [ -f /etc/security/msec/init-sh/lib.sh ]; then . /etc/security/msec/init-sh/lib.sh fi +echo -e "Changing attribute of /var/log/* to append only...\n" chattr +a /var/log/* # All events logged on tty12 +echo "Loging all messages on tty12 : " AddRules "*.* /dev/tty12" /etc/syslog.conf # Prevent all kind of connection +echo "Denying all kind of connection : " AddRules "ALL:ALL:DENY" /etc/hosts.deny # No login as root -AddRules "" /etc/securetty +echo "Login as root is denied : " +echo "Modified file : /etc/securetty..." +echo -e "done.\n\n" # Suid check -AddRules "CHECK_SUID_ROOT=yes" /etc/security/msec/security.conf -AddRules "CHECK_SUID_GROUP=yes" /etc/security/msec/security.conf -AddRules "CHECK_WRITABLE=yes" /etc/security/msec/security.conf -AddRules "CHECK_UNOWNED=yes" /etc/security/msec/security.conf -AddRules "CHECK_PROMISC=yes" /etc/security/msec/security.conf -AddRules "TTY_WARN=yes" /etc/security/msec/security.conf -AddRules "SYSLOG_WARN=yes" /etc/security/msec/security.conf - +echo "Updating file check variable : " +echo -e "\t- Check suid root file : yes." +AddRules "CHECK_SUID_ROOT=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check suid goup file : yes." +AddRules "CHECK_SUID_GROUP=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check world writable file : yes." +AddRules "CHECK_WRITABLE=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check unowned file : yes." +AddRules "CHECK_UNOWNED=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Check promiscuous mode : yes." +AddRules "CHECK_PROMISC=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Security warning on tty : \"yes\" :" +AddRules "TTY_WARN=yes" /etc/security/msec/security.conf quiet +echo -e "\t- Security warning in syslog : \"yes\" :" +AddRules "SYSLOG_WARN=yes" /etc/security/msec/security.conf + +################ Crontab things ################### # Check every 1 minutes for promisc problem +echo "Adding promisc check in crontab (scheduled every minutes) :" AddRules "*/1 * * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/promisc_check.sh" /etc/crontab -AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab +echo "Adding permission check in crontab (schedued every midnight) :" +AddRules "0 0-23 * * * root nice --adjustment=+19 /etc/security/msec/cron-sh/file_check.sh" /etc/crontab +################################################### # Wanna a password ? LiloUpdate; -/sbin/lilo + +echo -n "Running lilo to record new config : " +/sbin/lilo >& /dev/null +echo -e "done.\n" # Disable all server : +echo "Setting secure level variable to 5 :" AddRules "SECURE_LEVEL=5" /etc/profile IFS=" " export SECURE_LEVEL=5 +echo -n "Disabling all service, except : {" +for service in `chkconfig --list | awk '{print $1}'`; do + if grep -qx ${service} /etc/security/msec/init-sh/server.5; then + echo -n " ${service}" + fi +done +echo " } : " + for service in `chkconfig --list | awk '{print $1}'`; do chkconfig --del "${service}" - chkconfig --msec --add "${service}" + if ! chkconfig --msec --add "${service}"; then + echo -e "\t- Services ${service} is now disabled." + fi done +echo -e "done.\n"; -# Permissions +# /etc/profile +echo "Setting umask to 077 (user = rw) :" AddRules "umask 077" /etc/profile - -# Path +echo "Adding \"normal\" PATH variable :" AddRules "PATH=\$PATH:/usr/X11R6/bin" /etc/profile echo |