Everbrent/cis
8
0
Fork 0
mirror of https://github.com/m8tin/cis.git synced 2026-08-01 11:47:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

hardened printf

Browse Source
This commit is contained in:
m8in
2026-06-10 20:51:08 +02:00
parent 93f3dfdb5f
commit d90d5769ff
10 changed files with 38 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
definitions/default/check/all/core_cron_starts_setup_as_fallback.check.sh
+1 -1
View File
@@ -1,7 +1,7 @@
#!/bin/bash #!/bin/bash
[ "$(id -u)" != "0" ] \ [ "$(id -u)" != "0" ] \
&& printf "(INSUFFICENT RIGHTS) " \ && printf -- "(INSUFFICENT RIGHTS) " \
&& exit 1 && exit 1
crontab -l | grep -E "[0-9]{1,2}[ \*]{8}[[:blank:]]*\/cis\/setupCoreOntoThisHost.sh" > /dev/null 2>&1 \ crontab -l | grep -E "[0-9]{1,2}[ \*]{8}[[:blank:]]*\/cis\/setupCoreOntoThisHost.sh" > /dev/null 2>&1 \
definitions/default/check/all/core_ssh_authorized_keys_of_jenkins_points_to_definitions.check.sh
+1 -1
View File
@@ -3,7 +3,7 @@
_CURRENT_FILE='/home/jenkins/.ssh/authorized_keys' _CURRENT_FILE='/home/jenkins/.ssh/authorized_keys'
[ "$(id -u)" != "0" ] \ [ "$(id -u)" != "0" ] \
&& printf "(INSUFFICENT RIGHTS) " \ && printf -- "(INSUFFICENT RIGHTS) " \
&& exit 1 && exit 1
#File has to be readable, then #File has to be readable, then
definitions/default/check/all/core_ssh_authorized_keys_of_root_is_empty_or_points_to_definitions.check.sh
+1 -1
View File
@@ -3,7 +3,7 @@
_CURRENT_FILE='/root/.ssh/authorized_keys' _CURRENT_FILE='/root/.ssh/authorized_keys'
[ "$(id -u)" != "0" ] \ [ "$(id -u)" != "0" ] \
&& printf "(INSUFFICENT RIGHTS) " \ && printf -- "(INSUFFICENT RIGHTS) " \
&& exit 1 && exit 1
#No file is ok #No file is ok
definitions/default/check/all/core_ssh_key_of_root_exists_as_expected.check.sh
+1 -1
View File
@@ -3,7 +3,7 @@
_CURRENT_FILE='/root/.ssh/id_ed25519' _CURRENT_FILE='/root/.ssh/id_ed25519'
[ "$(id -u)" != "0" ] \ [ "$(id -u)" != "0" ] \
&& printf "(INSUFFICENT RIGHTS) " \ && printf -- "(INSUFFICENT RIGHTS) " \
&& exit 1 && exit 1
#File has to be readable and no passphrase should be needed. #File has to be readable and no passphrase should be needed.
definitions/default/check/all/core_sudoers_file_of_jenkins_points_to_definitions.check.sh
+1 -1
View File
@@ -3,7 +3,7 @@
_CURRENT_FILE='/etc/sudoers.d/allow-jenkins-updateRepositories' _CURRENT_FILE='/etc/sudoers.d/allow-jenkins-updateRepositories'
[ "$(id -u)" != "0" ] \ [ "$(id -u)" != "0" ] \
&& printf "(INSUFFICENT RIGHTS) " \ && printf -- "(INSUFFICENT RIGHTS) " \
&& exit 1 && exit 1
#File has to be readable, then #File has to be readable, then
definitions/default/check/all/core_user_jenkins_exists.check.sh
+1 -1
View File
@@ -3,7 +3,7 @@
_CURRENT_USER='jenkins' _CURRENT_USER='jenkins'
[ "$(id -u)" != "0" ] \ [ "$(id -u)" != "0" ] \
&& printf "(INSUFFICENT RIGHTS) " \ && printf -- "(INSUFFICENT RIGHTS) " \
&& exit 1 && exit 1
id -u "${_CURRENT_USER}" > /dev/null 2>&1 \ id -u "${_CURRENT_USER}" > /dev/null 2>&1 \
script/host/pam/ssh-notify-root-login.sh
+6 -5
View File
@@ -81,20 +81,21 @@ function setup() {
readonly _COMMAND _PAM_FILE readonly _COMMAND _PAM_FILE
! [ -f "${_PAM_FILE}" ] \ ! [ -f "${_PAM_FILE}" ] \
&& printf "FAILURE: Missing file: %s\n" "${_PAM_FILE:?"Missing PAM_FILE"}" >&2 \ && printf -- "FAILURE: Missing file: %s\n" "${_PAM_FILE:?"Missing PAM_FILE"}" >&2 \
&& exit 1 && exit 1
# Lines are already appended, so nothing is to do, therefore no setup. # Lines are already appended, so nothing is to do, therefore no setup.
grep -q -F "/${CIS[SCRIPTNAME]?:"Missing SCRIPTNAME"}" "${_PAM_FILE}" \ grep -q -F "/${CIS[SCRIPTNAME]?:"Missing SCRIPTNAME"}" "${_PAM_FILE}" \
&& printf -- "FAILURE: Command have already been appended to the file: '%s'\n" "${_PAM_FILE}" >&2 \
&& return 1 && return 1
# Append command to call this script, which is the setup. # Append command to call this script, which is the setup.
printf "Appending the following command to file '%s':\n - %s\n" "${_PAM_FILE}" "${_COMMAND}" >&2 \ printf -- "Appending the following command to file '%s':\n - %s\n" "${_PAM_FILE}" "${_COMMAND}" >&2 \
&& printf "\n#Call this script on each ssh-login\n%s\n" "${_COMMAND}" >> "${_PAM_FILE}" \ && printf -- "\n#Call this script on each ssh-login\n%s\n" "${_COMMAND}" >> "${_PAM_FILE}" \
&& printf "SUCCESS: Setup completed.\n" >&2 \ && printf -- "SUCCESS: Setup completed.\n" >&2 \
&& return 0 && return 0
printf "FAILURE: Setup of '%s' failed.\n" "${CIS[SCRIPTNAME]}" >&2 printf -- "FAILURE: Setup of '%s' failed.\n" "${CIS[SCRIPTNAME]}" >&2
exit 1 exit 1
} }
script/host/zfs/snapshot.sh
+21 -21
View File
@@ -27,7 +27,7 @@ function cleanup() {
fi fi
[ -n "${_ZFS}" ] \ [ -n "${_ZFS}" ] \
&& printf %b "Cleaning snapshots of: '${_ZFS}'\n" \ && printf -- "Cleaning snapshots of: '%b'\n" "${_ZFS}" \
&& local _LIST=( $(zfs list -t snap -H -o name -S creation "${_ZFS}" | grep -F '@SNAP' ) ) && local _LIST=( $(zfs list -t snap -H -o name -S creation "${_ZFS}" | grep -F '@SNAP' ) )
# Nothing to do # Nothing to do
@@ -40,40 +40,40 @@ function cleanup() {
for _SNAPSHOT in "${_LIST[@]}"; do for _SNAPSHOT in "${_LIST[@]}"; do
case "${_SNAPSHOT}" in case "${_SNAPSHOT}" in
*"@SNAPMINUTELY_"*) *"@SNAPMINUTELY_"*)
((_COUNT_MINUTELY++)) ((_COUNT_MINUTELY++))
if [ ${_COUNT_MINUTELY} -gt ${_MINUTELY_MIN} ]; then if [ ${_COUNT_MINUTELY} -gt ${_MINUTELY_MIN} ]; then
printf %s " - remove snapshot (${_COUNT_MINUTELY}): '@${_SNAPSHOT#*@}' ... " >&2 printf -- " - remove snapshot (%s): '@%s' ... " "${_COUNT_MINUTELY}" "${_SNAPSHOT#*@}" >&2
zfs destroy "${_SNAPSHOT}" \ zfs destroy "${_SNAPSHOT}" \
&& printf %b '(done)\n' \ && printf -- '(done)\n' \
|| printf %b '(FAIL)\n' || printf -- '(FAIL)\n'
fi fi
;; ;;
*"@SNAPHOURLY_"*) *"@SNAPHOURLY_"*)
((_COUNT_HOURLY++)) ((_COUNT_HOURLY++))
if [ ${_COUNT_HOURLY} -gt ${_HOURLY_MIN} ]; then if [ ${_COUNT_HOURLY} -gt ${_HOURLY_MIN} ]; then
printf %s " - remove snapshot (${_COUNT_HOURLY}): '@${_SNAPSHOT#*@}' ... " >&2 printf -- " - remove snapshot (%s): '@%s' ... " "${_COUNT_HOURLY}" "${_SNAPSHOT#*@}" >&2
zfs destroy "${_SNAPSHOT}" \ zfs destroy "${_SNAPSHOT}" \
&& printf %b '(done)\n' \ && printf -- '(done)\n' \
|| printf %b '(FAIL)\n' || printf -- '(FAIL)\n'
fi fi
;; ;;
*"@SNAPDAILY_"*) *"@SNAPDAILY_"*)
((_COUNT_DAILY++)) ((_COUNT_DAILY++))
if [ ${_COUNT_DAILY} -gt ${_DAILY_MIN} ]; then if [ ${_COUNT_DAILY} -gt ${_DAILY_MIN} ]; then
printf %s " - remove snapshot (${_COUNT_DAILY}): '@${_SNAPSHOT#*@}' ... " >&2 printf -- " - remove snapshot (%s): '@%s' ... " "${_COUNT_DAILY}" "${_SNAPSHOT#*@}" >&2
zfs destroy "${_SNAPSHOT}" \ zfs destroy "${_SNAPSHOT}" \
&& printf %b '(done)\n' \ && printf -- '(done)\n' \
|| printf %b '(FAIL)\n' || printf -- '(FAIL)\n'
fi fi
;; ;;
*"@SNAPMONTHLY_"*) *"@SNAPMONTHLY_"*)
((_COUNT_MONTHLY++)) ((_COUNT_MONTHLY++))
if [ ${_COUNT_MONTHLY} -gt ${_MONTHLY_MIN} ]; then if [ ${_COUNT_MONTHLY} -gt ${_MONTHLY_MIN} ]; then
printf %s " - remove snapshot (${_COUNT_MONTHLY}): '@${_SNAPSHOT#*@}' ... " >&2 printf -- " - remove snapshot ($s): '@%s' ... " "${_COUNT_MONTHLY}" "${_SNAPSHOT#*@}" >&2
zfs destroy "${_SNAPSHOT}" \ zfs destroy "${_SNAPSHOT}" \
&& printf %b '(done)\n' \ && printf -- '(done)\n' \
|| printf %b '(FAIL)\n' || printf -- '(FAIL)\n'
fi fi
;; ;;
esac esac
@@ -103,14 +103,14 @@ function snapshot() {
_ZFS_BRANCH="${_ZFS_BRANCH%/}" #Remove tailing '/' if exists _ZFS_BRANCH="${_ZFS_BRANCH%/}" #Remove tailing '/' if exists
[ "${_CURRENT_HOST}" != "${CIS[HOST]:?"Missing CIS_HOST"}" ] \ [ "${_CURRENT_HOST}" != "${CIS[HOST]:?"Missing CIS_HOST"}" ] \
&& printf %b "ZFS will be skipped, because this host '${CIS[HOST]}' is not running the composition:\n" >&2 \ && printf -- "ZFS will be skipped, because this host '%b' is not running the composition:\n" "${CIS[HOST]}" >&2 \
&& printf %b " - Composition : ${_COMPOSITION}\n" >&2 \ && printf -- " - Composition : %b\n" "${_COMPOSITION}" >&2 \
&& printf %b " - Current host: ${_CURRENT_HOST}\n" >&2 \ && printf -- " - Current host: %b\n" "${_CURRENT_HOST}" >&2 \
&& continue && continue
_ZFS="$(zfs list -H -o name "${_ZFS_BRANCH:-"zpool1/persistent"}/${_COMPOSITION}" 2> /dev/null)" _ZFS="$(zfs list -H -o name "${_ZFS_BRANCH:-"zpool1/persistent"}/${_COMPOSITION}" 2> /dev/null)"
[ -z "${_ZFS}" ] \ [ -z "${_ZFS}" ] \
&& printf %b "FAILURE - ZFS not found: ${_ZFS_BRANCH:-"zpool1/persistent"}/${_COMPOSITION}\n" >&2 \ && printf -- "FAILURE - ZFS not found: %b/%b\n" "${_ZFS_BRANCH:-"zpool1/persistent"}" "${_COMPOSITION}" >&2 \
&& continue && continue
( (
script/monitor/check.sh
+1 -1
View File
@@ -36,8 +36,8 @@ function doChecks(){
} }
function usage(){ function usage(){
printf "\nUsage: /monitor/check.sh <command> <options>"
echo echo
echo "Usage: /monitor/check.sh <command> <options>"
echo "possible commands:" echo "possible commands:"
echo echo
echo "- all" echo "- all"
updateRepositories.sh
+4 -4
View File
@@ -41,25 +41,25 @@ function update_repositories() {
&& return 0 && return 0
[ "${_MODE}" == "--scripts" ] \ [ "${_MODE}" == "--scripts" ] \
&& printf "Host $HOSTNAME updating scripts: ${CIS[ROOT]:?"Missing CISROOT"} ... " \ && printf -- "Host $HOSTNAME updating scripts: ${CIS[ROOT]:?"Missing CISROOT"} ... " \
&& (git -C "${CIS[ROOT]:?"Missing CISROOT"}" pull &> /dev/null) \ && (git -C "${CIS[ROOT]:?"Missing CISROOT"}" pull &> /dev/null) \
&& echo "(done)" \ && echo "(done)" \
&& return 0 && return 0
[ "${_MODE}" == "--definitions" ] \ [ "${_MODE}" == "--definitions" ] \
&& printf "Host ${HOSTNAME} updating definitions: ${CIS[DOMAINDEFINITIONS]:?"Missing DEFINITIONS"} ... " \ && printf -- "Host ${HOSTNAME} updating definitions: ${CIS[DOMAINDEFINITIONS]:?"Missing DEFINITIONS"} ... " \
&& (git -C "${CIS[DOMAINDEFINITIONS]:?"Missing DEFINITIONS"}" pull &> /dev/null) \ && (git -C "${CIS[DOMAINDEFINITIONS]:?"Missing DEFINITIONS"}" pull &> /dev/null) \
&& echo "(done)" \ && echo "(done)" \
&& return 0 && return 0
[ "${_MODE}" == "--states" ] \ [ "${_MODE}" == "--states" ] \
&& printf "Host ${HOSTNAME} updating states: ${CIS[DOMAINSTATES]:?"Missing STATES"} ... " \ && printf -- "Host ${HOSTNAME} updating states: ${CIS[DOMAINSTATES]:?"Missing STATES"} ... " \
&& (git -C "${CIS[DOMAINSTATES]:?"Missing STATES"}" pull &> /dev/null) \ && (git -C "${CIS[DOMAINSTATES]:?"Missing STATES"}" pull &> /dev/null) \
&& echo "(done)" \ && echo "(done)" \
&& return 0 && return 0
[ "${_MODE}" == "--core" ] \ [ "${_MODE}" == "--core" ] \
&& printf "Host ${HOSTNAME} updating core including scripts, definitions and states ... " \ && printf -- "Host ${HOSTNAME} updating core including scripts, definitions and states ... " \
&& (git -C "${CIS[ROOT]:?"Missing CISROOT"}" pull &> /dev/null) \ && (git -C "${CIS[ROOT]:?"Missing CISROOT"}" pull &> /dev/null) \
&& (git -C "${CIS[DOMAINDEFINITIONS]:?"Missing DEFINITIONS"}" pull &> /dev/null) \ && (git -C "${CIS[DOMAINDEFINITIONS]:?"Missing DEFINITIONS"}" pull &> /dev/null) \
&& (git -C "${CIS[DOMAINSTATES]:?"Missing STATES"}" pull &> /dev/null) \ && (git -C "${CIS[DOMAINSTATES]:?"Missing STATES"}" pull &> /dev/null) \