parent
724020db4f
commit
d12fa92261
@ -0,0 +1,146 @@
|
||||
# Function to check if value is well configured in conf file
|
||||
#
|
||||
# Parameters
|
||||
# - 1 : name of service (ex : SSH)
|
||||
# - 2 : config file (ex : /etc/ssh/sshd_config)
|
||||
# - 3 : expected pattern to search without start and end spaces, can be multiple (ex : ListenAddress[[:space:]]*${IPV4_ADMIN_LAN_IP} ListenAddress[[:space:]]*${IPV6_ADMIN_LAN_IP})
|
||||
# - 4 : name of param key (ex : ListenAddress)
|
||||
#
|
||||
# Return = 0 -> OK value is set
|
||||
# Return = 1 -> Error (wrong number of param or other)
|
||||
# Return = 2 -> Unexpected value is set
|
||||
# Return = 3 -> All expected values are NOT configured
|
||||
|
||||
check_value_in_conf_file () {
|
||||
|
||||
# Check the number of parameters
|
||||
if [ ${#} -ne 4 ]
|
||||
then
|
||||
echo -e "ERROR : when call check_value_in_conf_file function, bad parameters number expected : 4.\n"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Get parameters
|
||||
local name=${1}
|
||||
local conf_file=${2}
|
||||
local search_ok=${3}
|
||||
local param_key=${4}
|
||||
|
||||
# Print message to explain this check
|
||||
echo -e "Check ${BLUE}${name} ${param_key}${NC} config file ${conf_file} ..."
|
||||
|
||||
# If multiple expected values
|
||||
local list_search_ok=(${search_ok})
|
||||
local search_ok_to_grep="^[[:space:]]*"${search_ok}"[[:space:]]*$"
|
||||
|
||||
# If there is more than one unexpected values
|
||||
if [ ${#list_search_ok[@]} -gt 1 ]
|
||||
then
|
||||
search_ok_to_grep=""
|
||||
for var_search_ok in ${list_search_ok[@]}
|
||||
do
|
||||
search_ok_to_grep=${search_ok_to_grep}'-e '"^[[:space:]]*${var_search_ok}[[:space:]]*$"' '
|
||||
done
|
||||
fi
|
||||
|
||||
# Check if unexpected value is set (grep -v) (success if return code = 1)
|
||||
grep "^[[:space:]]*"${param_key} ${conf_file} | grep -q -v ${search_ok_to_grep}
|
||||
|
||||
# Return Code
|
||||
local RC=${?}
|
||||
|
||||
# Unexpected value is set
|
||||
if [ ${RC} -eq 0 ]
|
||||
then
|
||||
echo -e "${RED}Service ${name} has BAD CONFIGURATION for ${param_key} : check KO${NC}\n"
|
||||
return 2
|
||||
# Unexpected value is not set
|
||||
else
|
||||
|
||||
search_ok_to_grep="^[[:space:]]*"${search_ok}"[[:space:]]*$"
|
||||
|
||||
# Boolean for final Return Code, if one return code in the loop -ne 0 -> set finalRC=1
|
||||
local finalRC=0
|
||||
|
||||
# If there is more than one OK values
|
||||
if [ ${#list_search_ok[@]} -gt 1 ]
|
||||
then
|
||||
for var_search_ok in ${list_search_ok[@]}
|
||||
do
|
||||
grep -q "^[[:space:]]*"${var_search_ok}"[[:space:]]*$" ${conf_file}
|
||||
|
||||
RC=${?}
|
||||
|
||||
if [ ${RC} -ne 0 ]
|
||||
then
|
||||
finalRC=1
|
||||
fi
|
||||
|
||||
done
|
||||
|
||||
# Else : do classical check
|
||||
else
|
||||
# Check if OK value is set (success if return code = 0)
|
||||
grep -q "^[[:space:]]*"${search_ok}"[[:space:]]*$" ${conf_file}
|
||||
|
||||
# Return Code
|
||||
finalRC=${?}
|
||||
fi
|
||||
|
||||
# All expected values are not configured
|
||||
if [ ${finalRC} -ne 0 ]
|
||||
then
|
||||
echo -e "${RED}Service ${name} has BAD CONFIGURATION for ${param_key} : check KO${NC}\n"
|
||||
return 3
|
||||
# OK value is set
|
||||
else
|
||||
echo -e "${GREEN}Service ${name} has GOOD CONFIGURATION for ${param_key} : check OK${NC}\n"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# Function to print title
|
||||
#
|
||||
# Parameter
|
||||
# - 1 : title to print (ex : SSH)
|
||||
#
|
||||
# Return = 0 -> OK value is set
|
||||
# Return = 1 -> Error (wrong number of param or other)
|
||||
print_config_title () {
|
||||
|
||||
# Check the number of parameters
|
||||
if [ ${#} -ne 1 ]
|
||||
then
|
||||
echo -e "ERROR : when call print_config_title function, one parameter (only one) expected.\n"
|
||||
return 1
|
||||
fi
|
||||
|
||||
title=${1}
|
||||
basic_len=48
|
||||
|
||||
# Find number of "-" for title
|
||||
title_len=$(echo -n " ${title} " | wc -c)
|
||||
modulo2=$((${title_len} % 2))
|
||||
|
||||
|
||||
|
||||
# Echo title with 48 chars
|
||||
echo "------------------------------------------------"
|
||||
# If title_len <= 48
|
||||
if [ ${title_len} -lt ${basic_len} ]
|
||||
then
|
||||
final_left_len=$(( (${basic_len}-(${title_len}-${modulo2}))/2))
|
||||
final_right_len=$(( ${final_left_len}-${modulo2} ))
|
||||
printf %${final_left_len}s | tr " " "-"
|
||||
echo -n -e " ${BLUE}${title}${NC} "
|
||||
printf %${final_right_len}s | tr " " "-"
|
||||
else
|
||||
echo -e -n " ${BLUE}CHECK ${title} CONFIG${NC}"
|
||||
|
||||
fi
|
||||
echo -e "\n------------------------------------------------\n"
|
||||
return 0
|
||||
}
|
||||
|
||||
|
||||
@ -1,105 +1,58 @@
|
||||
echo "-------------------------------------------------"
|
||||
echo -e "-------------- ${BLUE}CHECK SSH CONFIG${NC} -----------------"
|
||||
echo -e "-------------------------------------------------\n"
|
||||
|
||||
# Check /etc/ssh/sshd_config config file
|
||||
echo -e "Check ${BLUE}SSH${NC} config file /etc/ssh/sshd_config"
|
||||
|
||||
# Check if PasswordAuthentication is enable (success if return code = 1)
|
||||
grep -q "^[[:space:]]*PasswordAuthentication[[:space:]]*yes" /etc/ssh/sshd_config
|
||||
|
||||
# Return Code
|
||||
RC=$?
|
||||
|
||||
# PasswordAuthentication is enabled
|
||||
if [ $RC -eq 0 ]
|
||||
then
|
||||
SSH_CONFIG_CHECK_FAILED="${SSH_CONFIG_CHECK_FAILED} PasswordAuthentication is enabled, disable it ;"
|
||||
echo -e "${RED}Service SSH has BAD CONFIGURATION for PasswordAuthentication : check KO${NC}\n"
|
||||
# PasswordAuthentication is disabled
|
||||
else
|
||||
# Check if PasswordAuthentication is enable (success if return code = 0)
|
||||
grep -q "^[[:space:]]*PasswordAuthentication[[:space:]]*no" /etc/ssh/sshd_config
|
||||
|
||||
# Return Code
|
||||
RC=$?
|
||||
|
||||
# PasswordAuthentication is not set to 'non'
|
||||
if [ $RC -ne 0 ]
|
||||
then
|
||||
SSH_CONFIG_CHECK_FAILED="${SSH_CONFIG_CHECK_FAILED} PasswordAuthentication is not set to 'no', set 'PasswordAuthentication no' ;"
|
||||
echo -e "${RED}Service SSH has BAD CONFIGURATION for PasswordAuthentication : check KO${NC}\n"
|
||||
# PasswordAuthentication is set to 'non'
|
||||
else
|
||||
echo -e "${GREEN}Service SSH has GOOD CONFIGURATION for PasswordAuthentication : check OK${NC}\n"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Check if PermitRootLogin is enable (success if return code = 1)
|
||||
grep -q -e "^[[:space:]]*PermitRootLogin[[:space:]]*yes" -e "^[[:space:]]*PermitRootLogin[[:space:]]*prohibit-password" /etc/ssh/sshd_config
|
||||
|
||||
# Return Code
|
||||
RC=$?
|
||||
|
||||
# PermitRootLogin is enabled (with password or pubkey)
|
||||
if [ $RC -eq 0 ]
|
||||
then
|
||||
SSH_CONFIG_CHECK_FAILED="${SSH_CONFIG_CHECK_FAILED} PermitRootLogin is enabled, disable it ;"
|
||||
echo -e "${RED}Service SSH has BAD CONFIGURATION for PermitRootLogin : check KO${NC}\n"
|
||||
# Root login is disabled
|
||||
else
|
||||
|
||||
# Check if PermitRootLogin is set to 'no' (success if return code = 0)
|
||||
grep -q "^[[:space:]]*PermitRootLogin[[:space:]]*no" /etc/ssh/sshd_config
|
||||
|
||||
# Return Code
|
||||
RC=$?
|
||||
|
||||
# PermitRootLogin is set to 'no' (with password or pubkey)
|
||||
if [ $RC -ne 0 ]
|
||||
then
|
||||
SSH_CONFIG_CHECK_FAILED="${SSH_CONFIG_CHECK_FAILED} PermitRootLogin is not set to 'no', set 'PermitRootLogin no' ;"
|
||||
echo -e "${RED}Service SSH has BAD CONFIGURATION for PermitRootLogin : check KO${NC}\n"
|
||||
# Root login is disabled
|
||||
else
|
||||
echo -e "${GREEN}Service SSH has GOOD CONFIGURATION for PermitRootLogin : check OK${NC}\n"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Check if SSHD only listen on Admin LAN (success if return code = 1)
|
||||
# WARNING, file need to be well intented
|
||||
SSH_LISTEN_ADDRESS_NOT_IN_ADMIN_LAN=$(grep "^ListenAddress" /etc/ssh/sshd_config | grep -v -e "^ListenAddress[[:space:]]*${IPV4_ADMIN_NETWORK}" -e "^ListenAddress[[:space:]]*${IPV6_ADMIN_NETWORK}")
|
||||
|
||||
# Return Code
|
||||
RC=$?
|
||||
|
||||
# ListenAddress other than the LAN Admin
|
||||
if [ $RC -eq 0 ]
|
||||
then
|
||||
SSH_CONFIG_CHECK_FAILED="${SSH_CONFIG_CHECK_FAILED} Config has ListenAddress not in Admin LAN '$SSH_LISTEN_ADDRESS_NOT_IN_ADMIN_LAN' ;"
|
||||
echo -e "${RED}Service SSH has ListenAddress not in Admin LAN '$SSH_LISTEN_ADDRESS_NOT_IN_ADMIN_LAN' : check KO${NC}\n"
|
||||
# No ListenAddress other than the LAN Admin
|
||||
else
|
||||
|
||||
# Check if ListenAddress IPv4 LAN Admin is configured (success if return code = 0)
|
||||
grep -q "^[[:space:]]*ListenAddress[[:space:]]*${IPV4_ADMIN_NETWORK}" /etc/ssh/sshd_config
|
||||
|
||||
# Return Code a
|
||||
RCa=$?
|
||||
|
||||
# Check if ListenAddress IPv6 LAN Admin is configured (success if return code = 0)
|
||||
grep -q "^[[:space:]]*ListenAddress[[:space:]]*${IPV6_ADMIN_NETWORK}" /etc/ssh/sshd_config
|
||||
|
||||
# Return Code b
|
||||
RCb=$?
|
||||
|
||||
# ListenAddress for Admin LAN are NOT configured
|
||||
if [ $RCa -ne 0 ] || [ $RCb -ne 0 ]
|
||||
then
|
||||
SSH_CONFIG_CHECK_FAILED="${SSH_CONFIG_CHECK_FAILED} Config has NOT ListenAddress (IPv4 AND IPv6) for Admin LAN ;"
|
||||
echo -e "${RED}Service SSH has NOT ListenAddress (IPv4 AND IPv6) for Admin LAN : check KO${NC}\n"
|
||||
# ListenAddress for Admin LAN are configured
|
||||
else
|
||||
echo -e "${GREEN}Service SSH has GOOD CONFIGURATION for ListenAddress : check OK${NC}\n"
|
||||
fi
|
||||
fi
|
||||
print_config_title 'CHECK SSH CONFIG'
|
||||
|
||||
check_value_in_conf_file "SSH" "/etc/ssh/sshd_config" "PasswordAuthentication[[:space:]]*no" "PasswordAuthentication"
|
||||
|
||||
case ${?} in
|
||||
0) # OK, nothing to do
|
||||
;;
|
||||
1) # Error (wrong number of param or other)
|
||||
SSH_CONFIG_CHECK_FAILED=${SSH_CONFIG_CHECK_FAILED}" Error during PasswordAuthentication with function check_value_in_conf_file, maybe incorrect number of parameter;"
|
||||
;;
|
||||
2) # Unexpected value is set
|
||||
SSH_CONFIG_CHECK_FAILED=${SSH_CONFIG_CHECK_FAILED}" PasswordAuthentication is not set to 'no' or has other value, set 'PasswordAuthentication no' ;"
|
||||
;;
|
||||
3) # All expected values are NOT configured
|
||||
SSH_CONFIG_CHECK_FAILED=${SSH_CONFIG_CHECK_FAILED}" PasswordAuthentication is not set to 'no', set 'PasswordAuthentication no' ;"
|
||||
;;
|
||||
*) # Unknown return code...
|
||||
SSH_CONFIG_CHECK_FAILED=${SSH_CONFIG_CHECK_FAILED}" Error, unknown return code when calling check_value_in_conf_file to check PasswordAuthentication;"
|
||||
;;
|
||||
esac
|
||||
|
||||
check_value_in_conf_file "SSH" "/etc/ssh/sshd_config" "PermitRootLogin[[:space:]]*no" "PermitRootLogin"
|
||||
|
||||
case ${?} in
|
||||
0) # OK, nothing to do
|
||||
;;
|
||||
1) # Error (wrong number of param or other)
|
||||
SSH_CONFIG_CHECK_FAILED=${SSH_CONFIG_CHECK_FAILED}" Error during PermitRootLogin with function check_value_in_conf_file, maybe incorrect number of parameter;"
|
||||
;;
|
||||
2) # Unexpected value is set
|
||||
SSH_CONFIG_CHECK_FAILED=${SSH_CONFIG_CHECK_FAILED}" PermitRootLogin is not set to 'no' or has other value, set 'PermitRootLogin no' ;"
|
||||
;;
|
||||
3) # All expected values are NOT configured
|
||||
SSH_CONFIG_CHECK_FAILED=${SSH_CONFIG_CHECK_FAILED}" PermitRootLogin is not set to 'no', set 'PermitRootLogin no' ;"
|
||||
;;
|
||||
*) # Unknown return code...
|
||||
SSH_CONFIG_CHECK_FAILED=${SSH_CONFIG_CHECK_FAILED}" Error, unknown return code when calling check_value_in_conf_file to check PermitRootLogin;"
|
||||
;;
|
||||
esac
|
||||
|
||||
check_value_in_conf_file "SSH" "/etc/ssh/sshd_config" "ListenAddress[[:space:]]*${IPV4_ADMIN_LAN_IP} ListenAddress[[:space:]]*${IPV6_ADMIN_LAN_IP}" "ListenAddress"
|
||||
|
||||
case ${?} in
|
||||
0) # OK, nothing to do
|
||||
;;
|
||||
1) # Error (wrong number of param or other)
|
||||
SSH_CONFIG_CHECK_FAILED=${SSH_CONFIG_CHECK_FAILED}" Error during ListenAddress check with function check_value_in_conf_file, maybe incorrect number of parameter;"
|
||||
;;
|
||||
2) # Unexpected value is set
|
||||
SSH_CONFIG_CHECK_FAILED=${SSH_CONFIG_CHECK_FAILED}" ListenAddress are not well configured or has other value, set ListenAddress for IPv4 and IPv6;"
|
||||
;;
|
||||
3) # All expected values are NOT configured
|
||||
SSH_CONFIG_CHECK_FAILED=${SSH_CONFIG_CHECK_FAILED}" ListenAddress are not well configured, set ListenAddress for IPv4 and IPv6;"
|
||||
;;
|
||||
*) # Unknown return code...
|
||||
SSH_CONFIG_CHECK_FAILED=${SSH_CONFIG_CHECK_FAILED}" Error, unknown return code when calling check_value_in_conf_file to check ListenAddress;"
|
||||
;;
|
||||
esac
|
||||
|
||||
Loading…
Reference in new issue