-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy path3_network_parameter.sh
executable file
·246 lines (222 loc) · 6.74 KB
/
3_network_parameter.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
#!/bin/bash
# 3.1.1 Ensure IP forwarding is disabled (Scored)
check3_1_1=`sysctl net.ipv4.ip_forward`
if [ "$check3_1_1" == "net.ipv4.ip_forward = 0" ]
then
result3_1_1="OK"
else
result3_1_1="ERR, Fix Manually"
fi
export result3_1_1
# 3.1.2 Ensure packet redirect sending is disabled (Scored)
check3_1_2a=`sysctl net.ipv4.conf.all.send_redirects`
check3_1_2b=`sysctl net.ipv4.conf.default.send_redirects`
if [ "$check3_1_2a" == "net.ipv4.conf.all.send_redirects = 0" ] && [ "$check3_1_2b" == "net.ipv4.conf.default.send_redirects = 0" ]
then
result3_1_2="OK"
else
result3_1_2="ERR, Fix Manually"
fi
export result3_1_2
# 3.2.1 Ensure source routed packets are not accepted (Scored)
check3_2_1a=`sysctl net.ipv4.conf.all.accept_source_route`
check3_2_1b=`sysctl net.ipv4.conf.default.accept_source_route`
if [ "$check3_2_1a" == "net.ipv4.conf.all.accept_source_route = 0" ] && [ "$check3_2_1b" == "net.ipv4.conf.default.accept_source_route = 0" ]
then
result3_2_1="OK"
else
result3_2_1="ERR, Fix Manually"
fi
export result3_2_1
# 3.2.2 Ensure ICMP redirects are not accepted (Scored)
check3_2_2a=`sysctl net.ipv4.conf.all.accept_redirects`
check3_2_2b=`sysctl net.ipv4.conf.default.accept_redirects`
if [ "$check3_2_2a" == "net.ipv4.conf.all.accept_redirects = 0" ] && [ "$check3_2_2b" == "net.ipv4.conf.default.accept_redirects = 0" ]
then
result3_2_2="OK"
else
result3_2_2="ERR, Fix Manually"
fi
export result3_2_2
# 3.2.3 Ensure secure ICMP redirects are not accepted (Scored)
check3_2_3a=`sysctl net.ipv4.conf.all.secure_redirects`
check3_2_3b=`sysctl net.ipv4.conf.default.secure_redirects`
if [ "$check3_2_3a" == "net.ipv4.conf.all.secure_redirects = 0" ] && [ "$check3_2_3b" == "net.ipv4.conf.default.secure_redirects = 0" ]
then
result3_2_3="OK"
else
result3_2_3="ERR, Fix Manually"
fi
export result3_2_3
# 3.2.4 Ensure suspicious packets are logged (Scored)
check3_2_4a=`sysctl net.ipv4.conf.all.log_martians`
check3_2_4b=`sysctl net.ipv4.conf.default.log_martians`
if [ "$check3_2_4a" == "net.ipv4.conf.all.log_martians = 1" ] && [ "$check3_2_4b" == "net.ipv4.conf.default.log_martians = 1" ]
then
result3_2_4="OK"
else
result3_2_4="ERR, Fix Manually"
fi
export result3_2_4
# 3.2.5 Ensure broadcast ICMP requests are ignored (Scored)
check3_2_5=`sysctl net.ipv4.icmp_echo_ignore_broadcasts`
if [ "$check3_2_5" == "net.ipv4.icmp_echo_ignore_broadcasts = 1" ]
then
result3_2_5="OK"
else
result3_2_5="ERR, Fix Manually"
fi
export result3_2_5
# 3.2.6 Ensure bogus ICMP responses are ignored (Scored)
check3_2_6=`sysctl net.ipv4.icmp_ignore_bogus_error_responses`
if [ "$check3_2_6" == "net.ipv4.icmp_ignore_bogus_error_responses = 1" ]
then
result3_2_6="OK"
else
result3_2_6="ERR, Fix Manually"
fi
export result3_2_6
# 3.2.7 Ensure Reverse Path Filtering is enabled (Scored)
check3_2_7a=`sysctl net.ipv4.conf.all.rp_filter`
check3_2_7b=`sysctl net.ipv4.conf.default.rp_filter`
if [ "$check3_2_7a" == "net.ipv4.conf.all.rp_filter = 1" ] || [ "$check3_2_7b" == "net.ipv4.conf.default.rp_filter = 1" ]
then
result3_2_7="OK"
else
result3_2_7="ERR, Fix Manually"
fi
export result3_2_7
# 3.2.8 Ensure TCP SYN Cookies is enabled (Scored)
check3_2_8a=`sysctl net.ipv4.tcp_syncookies`
if [ "$check3_2_8a" == "net.ipv4.tcp_syncookies = 1" ]
then
result3_2_8="OK"
else
result3_2_8="ERR, Fix Manually"
fi
export result3_2_8
# 3.3.1 Ensure IPv6 router advertisements are not accepted (Scored)
check3_3_1a=`sysctl net.ipv6.conf.all.accept_ra`
check3_3_1b=`sysctl net.ipv6.conf.default.accept_ra`
if [ "$check3_3_1a" == "net.ipv6.conf.all.accept_ra = 0" ] && [ "$check3_3_1b" == "net.ipv6.conf.default.accept_ra = 0" ]
then
result3_3_1="OK"
else
result3_3_1="ERR, Fix Manually"
fi
export result3_3_1
# 3.3.2 Ensure IPv6 redirects are not accepted (Scored)
check3_3_2a=`sysctl net.ipv6.conf.all.accept_redirects`
check3_3_2b=`sysctl net.ipv6.conf.default.accept_redirects`
if [ "$check3_3_2a" == "net.ipv6.conf.all.accept_redirect = 0" ] && [ "$check3_3_2b" == "net.ipv6.conf.default.accept_redirect = 0" ]
then
result3_3_2="OK"
else
result3_3_2="ERR, Fix Manually"
fi
export result3_3_2
# 3.3.3 Ensure IPv6 is disabled (Not Scored)
check3_3_3=`modprobe -c | grep ipv6 | grep disable=1 | grep "#"`
if [ "$check3_3_3" != "" ]
then
result3_3_3="OK"
else
result3_3_3="ERR, Fix Manually"
fi
export result3_3_3
# 3.4.1 Ensure TCP Wrappers is installed (Scored)
check3_4_1a=`rpm -q tcp_wrappers | grep package`
check3_4_1b=`rpm -q tcp_wrappers-libs | grep package `
if [ "$check3_4_1a" == "" ] && [ "$check3_4_1b" == "" ]
then
result3_4_1="OK"
else
result3_4_1="ERR, Fix Manually"
fi
export result3_4_1
# 3.4.2 Ensure /etc/hosts.allow is configured (Scored)
check3_4_2=`cat /etc/hosts.allow | grep "ALL:" | grep "#"`
if [ "$check3_4_2" != "" ]
then
result3_4_2="OK"
else
result3_4_2="ERR, Fix Manually"
fi
export result3_4_2
# 3.4.3 Ensure /etc/hosts.deny is configured (Scored)
check3_4_3=`cat /etc/hosts.deny | grep "ALL: ALL" | grep "#"`
if [ "$check3_4_3" != "" ]
then
result3_4_3="OK"
else
result3_4_3="ERR, Fix Manually"
fi
export result3_4_3
# 3.4.4 Ensure permissions on /etc/hosts.allow are configured (Scored)
check3_4_4=`stat /etc/hosts.allow | grep 644 | grep root`
if [ "$check3_4_4" != "" ]
then
result3_4_4="OK"
else
result3_4_4="ERR, Fix Manually"
fi
export result3_4_4
# 3.4.5 Ensure permissions on /etc/hosts.deny are 644 (Scored)
check3_4_5=`stat /etc/hosts.deny | grep 644 | grep root`
if [ "$check3_4_5" != "" ]
then
result3_4_5="OK"
else
result3_4_5="ERR, Fix Manually"
fi
export result3_4_5
# 3.5.1 Ensure DCCP is disabled (Not Scored)
check3_5_1a=`modprobe -n -v dccp | grep install`
check3_5_1b=`lsmod | grep dccp`
if [ "$check3_5_1a" != "" ] && [ "$check3_5_1b" == "" ]
then
result3_5_1="OK"
else
result3_5_1="ERR, Fix Manually"
fi
export result3_5_1
# 3.5.2 Ensure SCTP is disabled (Not Scored)
check3_5_2a=`modprobe -n -v sctp | grep install`
check3_5_2b=`lsmod | grep sctp`
if [ "$check3_5_2a" != "" ] && [ "$check3_5_2b" == "" ]
then
result3_5_2="OK"
else
result3_5_2="ERR, Fix Manually"
fi
export result3_5_2
# 3.5.3 Ensure RDS is disabled (Not Scored)
check3_5_3a=`modprobe -n -v rds | grep install`
check3_5_3b=`lsmod | grep rds`
if [ "$check3_5_3a" != "" ] && [ "$check3_5_3b" == "" ]
then
result3_5_3="OK"
else
result3_5_3="ERR, Fix Manually"
fi
export result3_5_3
# 3.5.4 Ensure TIPC is disabled (Not Scored)
check3_5_4a=`modprobe -n -v tipc | grep install`
check3_5_4b=`lsmod | grep tipc`
if [ "$check3_5_4a" != "" ] && [ "$check3_5_4b" == "" ]
then
result3_5_4="OK"
else
result3_5_4="ERR, Fix Manually"
fi
export result3_5_4
# 3.7 Ensure wireless interfaces are disabled (Not Scored)
check3_7=`ifconfig | grep wl`
if [ "$check3_7" == "" ]
then
result3_7="OK"
else
result3_7="ERR, Fix Manually"
fi
export result3_7
bash 3_output.sh