-
Notifications
You must be signed in to change notification settings - Fork 62
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #34 from Samson-W/master
Fix a bug: Replaced pam_tally2 with pam_faillock in debian 11.
- Loading branch information
Showing
5 changed files
with
358 additions
and
29 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,6 +6,7 @@ | |
|
|
||
| # | ||
| # 8.1.26 Recored pam_tally/pam_tally2 command usage(Only for Debian) (Scored) | ||
| # Replaced pam_tally2 with faillock in debian 11 | ||
| # Author : Samson wen, Samson <[email protected]> Author add this | ||
| # | ||
|
|
||
|
|
@@ -74,13 +75,23 @@ apply () { | |
| } | ||
|
|
||
| # This function will check config parameters required | ||
| # Replaced pam_tally2 with faillock in debian 11 | ||
| check_config() { | ||
| is_debian_11 | ||
| if [ $DONT_AUDITD_BY_UID -eq 1 ]; then | ||
| if [ $FNRET = 1 ]; then | ||
| AUDIT_PARAMS='-a always,exit -F path=/sbin/pam_tally -F perm=wxa -k privileged-pam | ||
| -a always,exit -F path=/sbin/pam_tally2 -F perm=wxa -k privileged-pam' | ||
| elif [ $FNRET = 0 ]; then | ||
| AUDIT_PARAMS='-a always,exit -F path=/usr/sbin/faillock -F perm=wxa -k privileged-pam' | ||
| fi | ||
| else | ||
| if [ $FNRET = 1 ]; then | ||
| AUDIT_PARAMS='-a always,exit -F path=/sbin/pam_tally -F perm=wxa -F auid>=1000 -F auid!=4294967295 -k privileged-pam | ||
| -a always,exit -F path=/sbin/pam_tally2 -F perm=wxa -F auid>=1000 -F auid!=4294967295 -k privileged-pam' | ||
| elif [ $FNRET = 0 ]; then | ||
| AUDIT_PARAMS='-a always,exit -F path=/usr/sbin/faillock -F perm=wxa -F auid>=1000 -F auid!=4294967295 -k privileged-pam' | ||
| fi | ||
| fi | ||
| } | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,6 +6,7 @@ | |
|
|
||
| # | ||
| # 9.2.11 Set deny times for Password Attempts (Scored) | ||
| # Replaced pam_tally2 with pam_faillock in debian 11 | ||
| # The number in the original document is 9.2.2 | ||
| # for login and ssh service | ||
| # Author : Samson wen, Samson <[email protected]> | ||
|
|
@@ -17,30 +18,27 @@ set -u # One variable unset, it's over | |
| HARDENING_LEVEL=3 | ||
|
|
||
| PACKAGE='libpam-modules-bin' | ||
| PAMLIBNAME='pam_tally2.so' | ||
| AUTHPATTERN='^auth[[:space:]]*required[[:space:]]*pam_tally2.so' | ||
| AUTHFILE='/etc/pam.d/common-auth' | ||
| AUTHRULE='auth required pam_tally2.so deny=3 even_deny_root unlock_time=900' | ||
| ADDPATTERNLINE='# pam-auth-update(8) for details.' | ||
| DENYOPTION='deny' | ||
| DENY_VAL=3 | ||
|
|
||
| # This function will be called if the script status is on enabled / audit mode | ||
| audit () { | ||
| audit_before11 () { | ||
| is_pkg_installed $PACKAGE | ||
| if [ $FNRET != 0 ]; then | ||
| crit "$PACKAGE is not installed!" | ||
| FNRET=1 | ||
| FNRET=11 | ||
| else | ||
| ok "$PACKAGE is installed" | ||
| does_pattern_exist_in_file $AUTHFILE $AUTHPATTERN | ||
| if [ $FNRET = 0 ]; then | ||
| ok "$AUTHPATTERN is present in $AUTHFILE." | ||
| check_param_pair_by_pam $AUTHFILE $PAMLIBNAME $DENYOPTION le $DENY_VAL | ||
| check_param_pair_by_pam $AUTHFILE $PAMLIBNAME $DENYOPTION le $DENY_VAL | ||
| if [ $FNRET = 0 ]; then | ||
| ok "$DENYOPTION set condition is less-than-or-equal-to $DENY_VAL" | ||
| ok "$DENYOPTION set condition is less-than-or-equal-to $DENY_VAL" | ||
| else | ||
| crit "$DENYOPTION set condition is not $DENY_VAL" | ||
| crit "$DENYOPTION set condition is not $DENY_VAL" | ||
| fi | ||
| else | ||
| crit "$AUTHPATTERN is not present in $AUTHFILE" | ||
|
|
@@ -49,11 +47,45 @@ audit () { | |
| fi | ||
| } | ||
|
|
||
| # This function will be called if the script status is on enabled mode | ||
| apply () { | ||
| audit_debian11 () { | ||
| is_pkg_installed $PACKAGE | ||
| if [ $FNRET != 0 ]; then | ||
| crit "$PACKAGE is not installed!" | ||
| FNRET=11 | ||
| else | ||
| ok "$PACKAGE is installed" | ||
| does_pattern_exist_in_file $AUTHFILE $AUTHPATTERN | ||
| if [ $FNRET = 0 ]; then | ||
| ok "$AUTHPATTERN is present in $AUTHFILE." | ||
| check_param_pair_by_value $SECCONFFILE $DENYOPTION le $DENY_VAL | ||
| if [ $FNRET = 0 ]; then | ||
| ok "Option $DENYOPTION set condition is less than or equal to $DENY_VAL in $SECCONFFILE" | ||
| elif [ $FNRET = 1 ]; then | ||
| crit "Option $DENYOPTION set condition is greater than $DENY_VAL in $SECCONFFILE" | ||
| elif [ $FNRET = 2 ]; then | ||
| crit "Option $DENYOPTION is not conf in $SECCONFFILE" | ||
| elif [ $FNRET = 3 ]; then | ||
| crit "Config file $SECCONFFILE is not exist!" | ||
| fi | ||
| else | ||
| crit "$AUTHPATTERN is not present in $AUTHFILE" | ||
| FNRET=12 | ||
| fi | ||
| fi | ||
| } | ||
|
|
||
| audit () { | ||
| if [ $ISDEBIAN11 = 1 ]; then | ||
| audit_debian11 | ||
| else | ||
| audit_before11 | ||
| fi | ||
| } | ||
|
|
||
| apply_before11 () { | ||
| if [ $FNRET = 0 ]; then | ||
| ok "$DENYOPTION set condition is less-than-or-equal-to $DENY_VAL" | ||
| elif [ $FNRET = 1 ]; then | ||
| elif [ $FNRET = 11 ]; then | ||
| warn "Apply:$PACKAGE is absent, installing it" | ||
| install_package $PACKAGE | ||
| elif [ $FNRET = 2 ]; then | ||
|
|
@@ -74,6 +106,56 @@ apply () { | |
| fi | ||
| } | ||
|
|
||
| # Input: | ||
| # Param1: return-value of call check_param_pair_by_value | ||
| # Function: Perform corresponding repair actions based on the return value of the error. | ||
| apply_secconffile() { | ||
| FNRET=$1 | ||
| if [ $FNRET = 0 ]; then | ||
| ok "Option $DENYOPTION set condition is less than or equal to $DENY_VAL in $SECCONFFILE" | ||
| elif [ $FNRET = 1 ]; then | ||
| warn "Reset option $DENYOPTION to $DENY_VAL in $SECCONFFILE" | ||
| replace_in_file $SECCONFFILE "^$DENYOPTION.*" "$DENYOPTION = $DENY_VAL" | ||
| elif [ $FNRET = 2 ]; then | ||
| warn "$DENYOPTION is not conf, add to $SECCONFFILE" | ||
| add_end_of_file $SECCONFFILE "$DENYOPTION = $DENY_VAL" | ||
| elif [ $FNRET = 3 ]; then | ||
| warn "Config file $SECCONFFILE is not exist! Please check it by youself" | ||
| else | ||
| warn "This param $FNRET was not defined!!!" | ||
| fi | ||
| } | ||
|
|
||
| apply_debian11 () { | ||
| if [ $FNRET = 0 ]; then | ||
| ok "$DENYOPTION set condition is less than or equal to $DENY_VAL in $SECCONFFILE" | ||
| elif [ $FNRET = 11 ]; then | ||
| warn "Apply:$PACKAGE is absent, installing it" | ||
| install_package $PACKAGE | ||
| does_pattern_exist_in_file $AUTHFILE $AUTHPATTERN | ||
| if [ $FNRET != 0 ]; then | ||
| add_line_file_after_pattern "$AUTHFILE" "$AUTHRULE" "$ADDPATTERNLINE" | ||
| check_param_pair_by_value $SECCONFFILE $DENYOPTION le $DENY_VAL | ||
| apply_secconffile $FNRET | ||
| fi | ||
| elif [ $FNRET = 12 ]; then | ||
| add_line_file_after_pattern "$AUTHFILE" "$AUTHRULE" "$ADDPATTERNLINE" | ||
| check_param_pair_by_value $SECCONFFILE $DENYOPTION le $DENY_VAL | ||
| apply_secconffile $FNRET | ||
| else | ||
| apply_secconffile $FNRET | ||
| fi | ||
| } | ||
|
|
||
| # This function will be called if the script status is on enabled mode | ||
| apply () { | ||
| if [ $ISDEBIAN11 = 1 ]; then | ||
| apply_debian11 | ||
| else | ||
| apply_before11 | ||
| fi | ||
| } | ||
|
|
||
| # This function will check config parameters required | ||
| check_config() { | ||
| if [ $OS_RELEASE -eq 2 ]; then | ||
|
|
@@ -84,7 +166,19 @@ check_config() { | |
| AUTHRULE='auth required pam_failloc.so deny=3 even_deny_root unlock_time=900' | ||
| ADDPATTERNLINE='auth[[:space:]]*required' | ||
| else | ||
| : | ||
| is_debian_11 | ||
| # faillock for Debian 11 | ||
| if [ $FNRET = 0 ]; then | ||
| ISDEBIAN11=1 | ||
| SECCONFFILE='/etc/security/faillock.conf' | ||
| AUTHPATTERN='^auth[[:space:]]*required[[:space:]]*pam_faillock.so' | ||
| AUTHRULE='auth required pam_faillock.so' | ||
| else | ||
| ISDEBIAN11=0 | ||
| PAMLIBNAME='pam_tally2.so' | ||
| AUTHPATTERN='^auth[[:space:]]*required[[:space:]]*pam_tally2.so' | ||
| AUTHRULE='auth required pam_tally2.so deny=3 even_deny_root unlock_time=900' | ||
| fi | ||
| fi | ||
| } | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.