Skip to content

Commit 74fe7ce

Browse files
rdiersrdiers
committed
Section 6 Fixes - 1
Section 6 Fixes - 1
1 parent a3624aa commit 74fe7ce

28 files changed

+360
-0
lines changed

‎LICENSE

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,19 @@
11
MIT License
22

3+
Copyright for portions of CentOS7-CIS are held by
4+
5+
Copyright (c) 2015 MindPoint Group http://www.mindpointgroup.com
6+
7+
as part of RHEL7-CIS.
8+
9+
All other copyright for project CentOS7-CIS are held by
10+
311
Copyright (c) 2018 Radsec
412

13+
AND
14+
15+
Copyright (c) 2018 Glownew Group
16+
517
Permission is hereby granted, free of charge, to any person obtaining a copy
618
of this software and associated documentation files (the "Software"), to deal
719
in the Software without restriction, including without limitation the rights

‎scripts/6.2.10.sh

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash
2+
3+
cat /etc/passwd | egrep -v '^(root|halt|sync|shutdown)' | awk -F: '($7 != "/sbin/nologin" && $7 != "/bin/false") { print $1 " " $6 }' | while read user dir; do
4+
if [ ! -d "$dir" ]; then
5+
echo "The home directory ($dir) of user $user does not exist."
6+
else
7+
for file in $dir/.[A-Za-z0-9]*; do
8+
if [ ! -h "$file" -a -f "$file" ]; then
9+
fileperm=`ls -ld $file | cut -f1 -d" "`
10+
11+
if [ `echo $fileperm | cut -c6` != "-" ]; then
12+
echo "Group Write permission set on file $file"
13+
fi
14+
if [ `echo $fileperm | cut -c9` != "-" ]; then
15+
echo "Other Write permission set on file $file"
16+
fi
17+
fi
18+
done
19+
fi
20+
done

‎scripts/6.2.11.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
for dir in `cat /etc/passwd | awk -F: '{ print $6 }'`; do
3+
if [ ! -h "$dir/.forward" -a -f "$dir/.forward" ]; then
4+
echo ".forward file $dir/.forward exists"
5+
fi
6+
done

‎scripts/6.2.12.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
for dir in `cat /etc/passwd | awk -F: '{ print $6 }'`; do
3+
if [ ! -h "$dir/.netrc" -a -f "$dir/.netrc" ]; then
4+
echo ".netrc file $dir/.netrc exists"
5+
fi
6+
done

‎scripts/6.2.13.sh

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/bin/bash
2+
3+
cat /etc/passwd | egrep -v '^(root|halt|sync|shutdown)' | awk -F: '($7 != "/sbin/nologin" && $7 != "/bin/false") { print $1 " " $6 }' | while read user dir; do
4+
if [ ! -d "$dir" ]; then
5+
echo "The home directory ($dir) of user $user does not exist."
6+
else
7+
for file in $dir/.netrc; do
8+
if [ ! -h "$file" -a -f "$file" ]; then
9+
fileperm=`ls -ld $file | cut -f1 -d" "`
10+
if [ `echo $fileperm | cut -c5` != "-" ]; then
11+
echo "Group Read set on $file"
12+
fi
13+
if [ `echo $fileperm | cut -c6` != "-" ]; then
14+
echo "Group Write set on $file"
15+
fi
16+
if [ `echo $fileperm | cut -c7` != "-" ]; then
17+
echo "Group Execute set on $file"
18+
fi
19+
if [ `echo $fileperm | cut -c8` != "-" ]; then
20+
echo "Other Read set on $file"
21+
fi
22+
if [ `echo $fileperm | cut -c9` != "-" ]; then
23+
echo "Other Write set on $file"
24+
fi
25+
if [ `echo $fileperm | cut -c10` != "-" ]; then
26+
echo "Other Execute set on $file"
27+
fi
28+
fi
29+
done
30+
fi
31+
done

‎scripts/6.2.14.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
for dir in `cat /etc/passwd | egrep -v '(root|halt|sync|shutdown)' | awk -F: '($7 != "/usr/sbin/nologin") { print $6 }'`; do
3+
for file in $dir/.rhosts; do
4+
if [ ! -h "$file" -a -f "$file" ]; then
5+
echo ".rhosts file in $dir"
6+
fi
7+
done
8+
done

‎scripts/6.2.15.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
3+
for i in $(cut -s -d: -f4 /etc/passwd | sort -u ); do
4+
grep -q -P "^.*?:[^:]*:$i:" /etc/group
5+
if [ $? -ne 0 ]; then
6+
echo "Group $i is referenced by /etc/passwd but does not exist in /etc/group"
7+
fi
8+
done

‎scripts/6.2.17.sh

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
3+
cat /etc/group | cut -f3 -d":" | sort -n | uniq -c | while read x ; do
4+
[ -z "${x}" ] && break
5+
set - $x
6+
if [ $1 -gt 1 ]; then
7+
groups= `awk -F: '($3 == n) { print $1 }' n=$2 /etc/group | xargs`
8+
echo "Duplicate GID ($2): ${groups}"
9+
fi
10+
done

‎scripts/6.2.18.sh

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
3+
cat /etc/passwd | cut -f1 -d":" | sort -n | uniq -c | while read x ; do
4+
[ -z "${x}" ] && break
5+
set - $x
6+
if [ $1 -gt 1 ]; then
7+
uids= `awk -F: '($1 == n) { print $3 }' n=$2 /etc/passwd | xargs`
8+
echo "Duplicate User Name ($2): ${uids}"
9+
fi
10+
done

‎scripts/6.2.19.sh

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
3+
cat /etc/group | cut -f1 -d":" | sort -n | uniq -c | while read x ; do
4+
[ -z "${x}" ] && break
5+
set - $x
6+
if [ $1 -gt 1 ]; then
7+
gids= `gawk -F: '($1 == n) { print $3 }' n=$2 /etc/group | xargs`
8+
echo "Duplicate Group Name ($2): ${gids}"
9+
fi
10+
done

‎scripts/6.2.6.sh

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#!/bin/bash
2+
3+
if [ " `echo $PATH | grep ::` " != "" ]; then
4+
echo "Empty Directory in PATH (::)"
5+
fi
6+
if ["`echo$PATH|grep:$`" !=""]; then echo "Trailing : in PATH"
7+
fi
8+
p= `echo $PATH | sed -e 's/::/:/' -e 's/:$//' -e 's/:/ /g'` set -- $p
9+
while [ "$1" != "" ]; do
10+
if [ "$1" = "." ]; then
11+
echo "PATH contains ."
12+
shift
13+
continue
14+
fi
15+
if [ -d $1 ]; then
16+
dirperm= `ls -ldH $1 | cut -f1 -d" "`
17+
if [ `echo $dirperm | cut -c6` != "-" ]; then
18+
echo "Group Write permission set on directory $1" fi
19+
if [ `echo $dirperm | cut -c9` != "-" ]; then
20+
echo "Other Write permission set on directory $1"
21+
fi
22+
dirown= `ls -ldH $1 | awk '{print $3}'`
23+
if [ "$dirown" != "root" ] ; then
24+
echo $1 is not owned by root
25+
fi
26+
else
27+
318 | P a g e
28+
echo $1 is not a directory
29+
fi
30+
shift done

‎scripts/6.2.7.sh

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/bash
2+
3+
cat /etc/passwd | egrep -v '^(root|halt|sync|shutdown)' | awk -F: '($7 != "/sbin/nologin" && $7 != "/bin/false") { print $1 " " $6 }' | while read user dir; do
4+
if [ ! -d "$dir" ]; then
5+
echo "The home directory ($dir) of user $user does not exist."
6+
fi
7+
done

‎scripts/6.2.8.sh

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/bash
2+
3+
cat /etc/passwd | egrep -v '^(root|halt|sync|shutdown)' | awk -F: '($7 != "/sbin/nologin" && $7 != "/bin/false") { print $1 " " $6 }' | while read user dir; do
4+
if [ ! -d "$dir" ]; then
5+
echo "The home directory ($dir) of user $user does not exist."
6+
else
7+
dirperm=`ls -ld $dir | cut -f1 -d" "`
8+
if [ `echo $dirperm | cut -c6` != "-" ]; then
9+
echo "Group Write permission set on the home directory ($dir) of user $user"
10+
fi
11+
if [ `echo $dirperm | cut -c8` != "-" ]; then
12+
echo "Other Read permission set on the home directory ($dir) of user $user"
13+
fi
14+
if [ `echo $dirperm | cut -c9` != "-" ]; then
15+
echo "Other Write permission set on the home directory ($dir) of user $user"
16+
fi
17+
if [ `echo $dirperm | cut -c10` != "-" ]; then
18+
echo "Other Execute permission set on the home directory ($dir) of user $user"
19+
fi
20+
fi
21+
done

‎scripts/6.2.9.sh

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/bin/bash
2+
3+
cat /etc/passwd | egrep -v '^(root|halt|sync|shutdown)' | awk -F: '($7 != "/sbin/nologin" && $7 != "/bin/false") { print $1 " " $6 }' | while read user dir; do
4+
if [ ! -d "$dir" ]; then
5+
echo "The home directory ($dir) of user $user does not exist."
6+
else
7+
owner=$(stat -L -c "%U" "$dir")
8+
if [ "$owner" != "$user" ]; then
9+
echo "The home directory ($dir) of user $user is owned by $owner."
10+
fi
11+
fi
12+
done

‎scripts/six_two_eight_rule.sh

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/bin/bash
2+
cat /etc/passwd | egrep -v '^(root|halt|sync|shutdown)' | awk -F: '($7 != "/sbin/nologin" && $7 != "/bin/false") { print $1 " " $6 }' | while read user dir; do
3+
if [ ! -d "$dir" ]; then
4+
echo "The home directory ($dir) of user $user does not exist."
5+
else
6+
dirperm=`ls -ld $dir | cut -f1 -d" "`
7+
if [ `echo $dirperm | cut -c6` != "-" ]; then
8+
echo "Group Write permission set on the home directory ($dir) of user $user"
9+
fi
10+
if [ `echo $dirperm | cut -c8` != "-" ]; then
11+
echo "Other Read permission set on the home directory ($dir) of user $user"
12+
fi
13+
if [ `echo $dirperm | cut -c9` != "-" ]; then
14+
echo "Other Write permission set on the home directory ($dir) of user $user"
15+
fi
16+
if [ `echo $dirperm | cut -c10` != "-" ]; then
17+
echo "Other Execute permission set on the home directory ($dir) of user $user"
18+
fi fi
19+
done

‎scripts/six_two_eighteen_rule.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
cat /etc/passwd | cut -f1 -d":" | sort -n | uniq -c | while read x ; do [ -z "${x}" ] && break
3+
set - $x
4+
if [ $1 -gt 1 ]; then
5+
uids= `awk -F: '($1 == n) { print $3 }' n=$2 /etc/passwd | xargs`
6+
echo "Duplicate User Name ($2): ${uids}"
7+
fi
8+
done

‎scripts/six_two_eleven_rule.sh

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/bash
2+
cat /etc/passwd | egrep -v '^(root|halt|sync|shutdown)' | awk -F: '($7 != "/sbin/nologin" && $7 != "/bin/false") { print $1 " " $6 }' | while read user dir; do
3+
if [ ! -d "$dir" ]; then
4+
echo "The home directory ($dir) of user $user does not exist."
5+
else
6+
if [ ! -h "$dir/.forward" -a -f "$dir/.forward" ]; then
7+
echo ".forward file $dir/.forward exists" fi
8+
fi
9+
done

‎scripts/six_two_fifteen_rule.sh

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
for i in $(cut -s -d: -f4 /etc/passwd | sort -u ); do grep -q -P "^.*?:[^:]*:$i:" /etc/group
3+
if [ $? -ne 0 ]; then
4+
echo "Group $i is referenced by /etc/passwd but does not exist in /etc/group"
5+
fi done

‎scripts/six_two_fourteen_rule.sh

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
cat /etc/passwd | egrep -v '^(root|halt|sync|shutdown)' | awk -F: '($7 != "/sbin/nologin" && $7 != "/bin/false") { print $1 " " $6 }' | while read user dir; do
3+
if [ ! -d "$dir" ]; then
4+
echo "The home directory ($dir) of user $user does not exist."
5+
else
6+
for file in $dir/.rhosts; do
7+
if [ ! -h "$file" -a -f "$file" ]; then
8+
echo ".rhosts file in $dir"
9+
fi done
10+
fi done

‎scripts/six_two_nine_rule.sh

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/bash
2+
cat /etc/passwd | egrep -v '^(root|halt|sync|shutdown)' | awk -F: '($7 != "/sbin/nologin" && $7 != "/bin/false") { print $1 " " $6 }' | while read user dir; do
3+
if [ ! -d "$dir" ]; then
4+
echo "The home directory ($dir) of user $user does not exist."
5+
else
6+
owner=$(stat -L -c "%U" "$dir")
7+
if [ "$owner" != "$user" ]; then
8+
echo "The home directory ($dir) of user $user is owned by $owner." fi
9+
fi done

‎scripts/six_two_nineteen_rule.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
cat /etc/group | cut -f1 -d":" | sort -n | uniq -c | while read x ; do [ -z "${x}" ] && break
3+
set - $x
4+
if [ $1 -gt 1 ]; then
5+
gids= `gawk -F: '($1 == n) { print $3 }' n=$2 /etc/group | xargs`
6+
echo "Duplicate Group Name ($2): ${gids}"
7+
fi
8+
done

‎scripts/six_two_seven_rule.sh

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
cat /etc/passwd | egrep -v '^(root|halt|sync|shutdown)' | awk -F: '($7 != "/sbin/nologin" && $7 != "/bin/false") { print $1 " " $6 }' | while read user dir; do
3+
if [ ! -d "$dir" ]; then
4+
echo "The home directory ($dir) of user $user does not exist."
5+
fi done

‎scripts/six_two_seventeen_rule.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
cat /etc/group | cut -f3 -d":" | sort -n | uniq -c | while read x ; do [ -z "${x}" ] && break
3+
set - $x
4+
if [ $1 -gt 1 ]; then
5+
groups= `awk -F: '($3 == n) { print $1 }' n=$2 /etc/group | xargs`
6+
echo "Duplicate GID ($2): ${groups}"
7+
fi
8+
done

‎scripts/six_two_six_rule.sh

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#!/bin/bash
2+
if [ " `echo $PATH | grep ::` " != "" ]; then
3+
echo "Empty Directory in PATH (::)"
4+
fi
5+
if["`echo$PATH|grep:$`" !=""];then echo "Trailing : in PATH"
6+
fi
7+
p= `echo $PATH | sed -e 's/::/:/' -e 's/:$//' -e 's/:/ /g'` set -- $p
8+
while [ "$1" != "" ]; do
9+
if [ "$1" = "." ]; then
10+
echo "PATH contains ."
11+
shift
12+
continue
13+
fi
14+
if [ -d $1 ]; then
15+
dirperm= `ls -ldH $1 | cut -f1 -d" "`
16+
if [ `echo $dirperm | cut -c6` != "-" ]; then
17+
echo "Group Write permission set on directory $1" fi
18+
if [ `echo $dirperm | cut -c9` != "-" ]; then
19+
echo "Other Write permission set on directory $1"
20+
fi
21+
dirown= `ls -ldH $1 | awk '{print $3}'`
22+
if [ "$dirown" != "root" ] ; then
23+
echo $1 is not owned by root
24+
fi
25+
else
26+
318 | P a g e
27+
echo $1 is not a directory
28+
fi
29+
shift done

‎scripts/six_two_sixteen_rule.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
cat /etc/passwd | cut -f3 -d":" | sort -n | uniq -c | while read x ; do [ -z "${x}" ] && break
3+
set - $x
4+
if [ $1 -gt 1 ]; then
5+
users= `awk -F: '($3 == n) { print $1 }' n=$2 /etc/passwd | xargs`
6+
echo "Duplicate UID ($2): ${users}"
7+
fi
8+
done

‎scripts/six_two_ten_rule.sh

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/bin/bash
2+
cat /etc/passwd | egrep -v '^(root|halt|sync|shutdown)' | awk -F: '($7 != "/sbin/nologin" && $7 != "/bin/false") { print $1 " " $6 }' | while read user dir; do
3+
if [ ! -d "$dir" ]; then
4+
echo "The home directory ($dir) of user $user does not exist."
5+
else
6+
for file in $dir/.[A-Za-z0-9]*; do
7+
if [ ! -h "$file" -a -f "$file" ]; then
8+
fileperm=`ls -ld $file | cut -f1 -d" "`
9+
if [ `echo $fileperm | cut -c6` != "-" ]; then echo "Group Write permission set on file $file"
10+
fi
11+
if [ `echo $fileperm | cut -c9` != "-" ]; then
12+
echo "Other Write permission set on file $file" fi
13+
fi done
14+
fi done

‎scripts/six_two_thirdteen_rule.sh

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/bin/bash
2+
cat /etc/passwd | egrep -v '^(root|halt|sync|shutdown)' | awk -F: '($7 != "/sbin/nologin" && $7 != "/bin/false") { print $1 " " $6 }' | while read user dir; do
3+
if [ ! -d "$dir" ]; then
4+
echo "The home directory ($dir) of user $user does not exist."
5+
else
6+
for file in $dir/.netrc; do
7+
if [ ! -h "$file" -a -f "$file" ]; then
8+
fileperm=`ls -ld $file | cut -f1 -d" "`
9+
if [ `echo $fileperm | cut -c5` != "-" ]; then
10+
echo "Group Read set on $file"
11+
fi
12+
if [ `echo $fileperm | cut -c6` != "-" ]; then
13+
echo "Group Write set on $file"
14+
fi
15+
if [ `echo $fileperm | cut -c7` != "-" ]; then
16+
echo "Group Execute set on $file"
17+
fi
18+
if [ `echo $fileperm | cut -c8` != "-" ]; then
19+
echo "Other Read set on $file"
20+
fi
21+
if [ `echo $fileperm | cut -c9` != "-" ]; then
22+
echo "Other Write set on $file"
23+
fi
24+
if [ `echo $fileperm | cut -c10` != "-" ]; then
25+
echo "Other Execute set on $file"
26+
fi fi
27+
done

0 commit comments

Comments
 (0)