Everbrent/cis
8
0
Fork 0
mirror of https://github.com/m8tin/cis.git synced 2026-08-01 11:47:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

hardened printf

Browse Source
This commit is contained in:
m8in
2026-06-10 20:51:08 +02:00
parent 93f3dfdb5f
commit d90d5769ff
10 changed files with 38 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
definitions/default/check/all/core_cron_starts_setup_as_fallback.check.sh
+1 -1
View File
@@ -1,7 +1,7 @@
#!/bin/bash
[ "$(id -u)" != "0" ] \
&& printf "(INSUFFICENT RIGHTS) " \
&& printf -- "(INSUFFICENT RIGHTS) " \
&& exit 1
crontab -l | grep -E "[0-9]{1,2}[ \*]{8}[[:blank:]]*\/cis\/setupCoreOntoThisHost.sh" > /dev/null 2>&1 \
definitions/default/check/all/core_ssh_authorized_keys_of_jenkins_points_to_definitions.check.sh
+1 -1
View File
@@ -3,7 +3,7 @@
_CURRENT_FILE='/home/jenkins/.ssh/authorized_keys'
[ "$(id -u)" != "0" ] \
&& printf "(INSUFFICENT RIGHTS) " \
&& printf -- "(INSUFFICENT RIGHTS) " \
&& exit 1
#File has to be readable, then
definitions/default/check/all/core_ssh_authorized_keys_of_root_is_empty_or_points_to_definitions.check.sh
+1 -1
View File
@@ -3,7 +3,7 @@
_CURRENT_FILE='/root/.ssh/authorized_keys'
[ "$(id -u)" != "0" ] \
&& printf "(INSUFFICENT RIGHTS) " \
&& printf -- "(INSUFFICENT RIGHTS) " \
&& exit 1
#No file is ok
definitions/default/check/all/core_ssh_key_of_root_exists_as_expected.check.sh
+1 -1
View File
@@ -3,7 +3,7 @@
_CURRENT_FILE='/root/.ssh/id_ed25519'
[ "$(id -u)" != "0" ] \
&& printf "(INSUFFICENT RIGHTS) " \
&& printf -- "(INSUFFICENT RIGHTS) " \
&& exit 1
#File has to be readable and no passphrase should be needed.
definitions/default/check/all/core_sudoers_file_of_jenkins_points_to_definitions.check.sh
+1 -1
View File
@@ -3,7 +3,7 @@
_CURRENT_FILE='/etc/sudoers.d/allow-jenkins-updateRepositories'
[ "$(id -u)" != "0" ] \
&& printf "(INSUFFICENT RIGHTS) " \
&& printf -- "(INSUFFICENT RIGHTS) " \
&& exit 1
#File has to be readable, then
definitions/default/check/all/core_user_jenkins_exists.check.sh
+1 -1
View File
@@ -3,7 +3,7 @@
_CURRENT_USER='jenkins'
[ "$(id -u)" != "0" ] \
&& printf "(INSUFFICENT RIGHTS) " \
&& printf -- "(INSUFFICENT RIGHTS) " \
&& exit 1
id -u "${_CURRENT_USER}" > /dev/null 2>&1 \
script/host/pam/ssh-notify-root-login.sh
+6 -5
View File
@@ -81,20 +81,21 @@ function setup() {
readonly _COMMAND _PAM_FILE
! [ -f "${_PAM_FILE}" ] \
&& printf "FAILURE: Missing file: %s\n" "${_PAM_FILE:?"Missing PAM_FILE"}" >&2 \
&& printf -- "FAILURE: Missing file: %s\n" "${_PAM_FILE:?"Missing PAM_FILE"}" >&2 \
&& exit 1
# Lines are already appended, so nothing is to do, therefore no setup.
grep -q -F "/${CIS[SCRIPTNAME]?:"Missing SCRIPTNAME"}" "${_PAM_FILE}" \
&& printf -- "FAILURE: Command have already been appended to the file: '%s'\n" "${_PAM_FILE}" >&2 \
&& return 1
# Append command to call this script, which is the setup.
printf "Appending the following command to file '%s':\n - %s\n" "${_PAM_FILE}" "${_COMMAND}" >&2 \
&& printf "\n#Call this script on each ssh-login\n%s\n" "${_COMMAND}" >> "${_PAM_FILE}" \
&& printf "SUCCESS: Setup completed.\n" >&2 \
printf -- "Appending the following command to file '%s':\n - %s\n" "${_PAM_FILE}" "${_COMMAND}" >&2 \
&& printf -- "\n#Call this script on each ssh-login\n%s\n" "${_COMMAND}" >> "${_PAM_FILE}" \
&& printf -- "SUCCESS: Setup completed.\n" >&2 \
&& return 0
printf "FAILURE: Setup of '%s' failed.\n" "${CIS[SCRIPTNAME]}" >&2
printf -- "FAILURE: Setup of '%s' failed.\n" "${CIS[SCRIPTNAME]}" >&2
exit 1
}
script/host/zfs/snapshot.sh
+17 -17
View File
@@ -27,7 +27,7 @@ function cleanup() {
fi
[ -n "${_ZFS}" ] \
&& printf %b "Cleaning snapshots of: '${_ZFS}'\n" \
&& printf -- "Cleaning snapshots of: '%b'\n" "${_ZFS}" \
&& local _LIST=( $(zfs list -t snap -H -o name -S creation "${_ZFS}" | grep -F '@SNAP' ) )
# Nothing to do
@@ -43,37 +43,37 @@ function cleanup() {
*"@SNAPMINUTELY_"*)
((_COUNT_MINUTELY++))
if [ ${_COUNT_MINUTELY} -gt ${_MINUTELY_MIN} ]; then
printf %s " - remove snapshot (${_COUNT_MINUTELY}): '@${_SNAPSHOT#*@}' ... " >&2
printf -- " - remove snapshot (%s): '@%s' ... " "${_COUNT_MINUTELY}" "${_SNAPSHOT#*@}" >&2
zfs destroy "${_SNAPSHOT}" \
&& printf %b '(done)\n' \
|| printf %b '(FAIL)\n'
&& printf -- '(done)\n' \
|| printf -- '(FAIL)\n'
fi
;;
*"@SNAPHOURLY_"*)
((_COUNT_HOURLY++))
if [ ${_COUNT_HOURLY} -gt ${_HOURLY_MIN} ]; then
printf %s " - remove snapshot (${_COUNT_HOURLY}): '@${_SNAPSHOT#*@}' ... " >&2
printf -- " - remove snapshot (%s): '@%s' ... " "${_COUNT_HOURLY}" "${_SNAPSHOT#*@}" >&2
zfs destroy "${_SNAPSHOT}" \
&& printf %b '(done)\n' \
|| printf %b '(FAIL)\n'
&& printf -- '(done)\n' \
|| printf -- '(FAIL)\n'
fi
;;
*"@SNAPDAILY_"*)
((_COUNT_DAILY++))
if [ ${_COUNT_DAILY} -gt ${_DAILY_MIN} ]; then
printf %s " - remove snapshot (${_COUNT_DAILY}): '@${_SNAPSHOT#*@}' ... " >&2
printf -- " - remove snapshot (%s): '@%s' ... " "${_COUNT_DAILY}" "${_SNAPSHOT#*@}" >&2
zfs destroy "${_SNAPSHOT}" \
&& printf %b '(done)\n' \
|| printf %b '(FAIL)\n'
&& printf -- '(done)\n' \
|| printf -- '(FAIL)\n'
fi
;;
*"@SNAPMONTHLY_"*)
((_COUNT_MONTHLY++))
if [ ${_COUNT_MONTHLY} -gt ${_MONTHLY_MIN} ]; then
printf %s " - remove snapshot (${_COUNT_MONTHLY}): '@${_SNAPSHOT#*@}' ... " >&2
printf -- " - remove snapshot ($s): '@%s' ... " "${_COUNT_MONTHLY}" "${_SNAPSHOT#*@}" >&2
zfs destroy "${_SNAPSHOT}" \
&& printf %b '(done)\n' \
|| printf %b '(FAIL)\n'
&& printf -- '(done)\n' \
|| printf -- '(FAIL)\n'
fi
;;
esac
@@ -103,14 +103,14 @@ function snapshot() {
_ZFS_BRANCH="${_ZFS_BRANCH%/}" #Remove tailing '/' if exists
[ "${_CURRENT_HOST}" != "${CIS[HOST]:?"Missing CIS_HOST"}" ] \
&& printf %b "ZFS will be skipped, because this host '${CIS[HOST]}' is not running the composition:\n" >&2 \
&& printf %b " - Composition : ${_COMPOSITION}\n" >&2 \
&& printf %b " - Current host: ${_CURRENT_HOST}\n" >&2 \
&& printf -- "ZFS will be skipped, because this host '%b' is not running the composition:\n" "${CIS[HOST]}" >&2 \
&& printf -- " - Composition : %b\n" "${_COMPOSITION}" >&2 \
&& printf -- " - Current host: %b\n" "${_CURRENT_HOST}" >&2 \
&& continue
_ZFS="$(zfs list -H -o name "${_ZFS_BRANCH:-"zpool1/persistent"}/${_COMPOSITION}" 2> /dev/null)"
[ -z "${_ZFS}" ] \
&& printf %b "FAILURE - ZFS not found: ${_ZFS_BRANCH:-"zpool1/persistent"}/${_COMPOSITION}\n" >&2 \
&& printf -- "FAILURE - ZFS not found: %b/%b\n" "${_ZFS_BRANCH:-"zpool1/persistent"}" "${_COMPOSITION}" >&2 \
&& continue
(
script/monitor/check.sh
+1 -1
View File
@@ -36,8 +36,8 @@ function doChecks(){
}
function usage(){
printf "\nUsage: /monitor/check.sh <command> <options>"
echo
echo "Usage: /monitor/check.sh <command> <options>"
echo "possible commands:"
echo
echo "- all"
updateRepositories.sh
+4 -4
View File
@@ -41,25 +41,25 @@ function update_repositories() {
&& return 0
[ "${_MODE}" == "--scripts" ] \
&& printf "Host $HOSTNAME updating scripts: ${CIS[ROOT]:?"Missing CISROOT"} ... " \
&& printf -- "Host $HOSTNAME updating scripts: ${CIS[ROOT]:?"Missing CISROOT"} ... " \
&& (git -C "${CIS[ROOT]:?"Missing CISROOT"}" pull &> /dev/null) \
&& echo "(done)" \
&& return 0
[ "${_MODE}" == "--definitions" ] \
&& printf "Host ${HOSTNAME} updating definitions: ${CIS[DOMAINDEFINITIONS]:?"Missing DEFINITIONS"} ... " \
&& printf -- "Host ${HOSTNAME} updating definitions: ${CIS[DOMAINDEFINITIONS]:?"Missing DEFINITIONS"} ... " \
&& (git -C "${CIS[DOMAINDEFINITIONS]:?"Missing DEFINITIONS"}" pull &> /dev/null) \
&& echo "(done)" \
&& return 0
[ "${_MODE}" == "--states" ] \
&& printf "Host ${HOSTNAME} updating states: ${CIS[DOMAINSTATES]:?"Missing STATES"} ... " \
&& printf -- "Host ${HOSTNAME} updating states: ${CIS[DOMAINSTATES]:?"Missing STATES"} ... " \
&& (git -C "${CIS[DOMAINSTATES]:?"Missing STATES"}" pull &> /dev/null) \
&& echo "(done)" \
&& return 0
[ "${_MODE}" == "--core" ] \
&& printf "Host ${HOSTNAME} updating core including scripts, definitions and states ... " \
&& printf -- "Host ${HOSTNAME} updating core including scripts, definitions and states ... " \
&& (git -C "${CIS[ROOT]:?"Missing CISROOT"}" pull &> /dev/null) \
&& (git -C "${CIS[DOMAINDEFINITIONS]:?"Missing DEFINITIONS"}" pull &> /dev/null) \
&& (git -C "${CIS[DOMAINSTATES]:?"Missing STATES"}" pull &> /dev/null) \