Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[pull] master from ovh:master #4

Open
wants to merge 552 commits into
base: master
Choose a base branch
from
Open

[pull] master from ovh:master #4

wants to merge 552 commits into from

Conversation

pull[bot]
Copy link

@pull pull bot commented Jan 14, 2021 •
edited
Loading

See Commits and Changes for more details.

Created by pull[bot]

Can you help keep this open source service alive? 💖 Please sponsor : )

@thibaultserti
IMP(5.3.1): add test and config function for check
feefee2
@thibaultserti
IMP(5.3.1,5.3.2): add tests and upgrade PAM conf
8af91dd
@thibaultserti
IMP(5.3.4): improve check
9aac4c3
@thibaultserti
IMP(5.4.1.1-3): add tests and rename some variables
17e4375
@thibaultserti
IMP(5.4.3): add purposely failing test
728011f
@thibaultserti
IMP(5.4.4): add test
47f8b7b
@thibaultserti
IMP(5.6): add test
91a2824
@thibaultserti
IMP(4.1.3): skip on docker (bootloader)
5568065
@thibaultserti
IMP(4.1.x): add tests for each checks
ee4b241
@thibaultserti
FIX(2.2.12): smbd enabling check was wrong
c2090b7
@thibaultserti
FIX(3.1.1,3.2.1,3.2.2): don't check for IPv6 options if IPv6 is disabled
668dc80
@thibaultserti
FIX(2.3.18): Re-add telnet server check
6aae84f 
Renaming for 2.3.4 anbd 2.3.5 to have naming consistency.

	nouveau fichier : bin/hardening/2.2.18_disable_telnet_server.sh
	renommé :         bin/hardening/2.3.4_telnet_client_not_installed.sh -> bin/hardening/2.3.4_disable_telnet_client.sh
	renommé :         bin/hardening/2.3.5_ldap_client_not_installed.sh -> bin/hardening/2.3.5_disable_ldap_client.sh
	renommé :         tests/hardening/2.3.4_telnet_client_not_installed.sh -> tests/hardening/2.2.18_disable_telnet_server.sh
	renommé :         tests/hardening/2.3.5_ldap_client_not_installed.sh -> tests/hardening/2.3.4_disable_telnet_client.sh
	nouveau fichier : tests/hardening/2.3.5_disable_ldap_client.sh
@thibaultserti
Update changelog
4dc8701
@thibaultserti
IMP: Better cleanup after tests
fe56856
@thibaultserti
IMP(6.2.8): fix bug where /sbin/nologin was considered as a valid shell
a7afb10
@thibaultserti
IMP: dismiss for count some tests on blank host
67649ec
@thibaultserti
FIX: fix test for CDS
7b73eac
@thibaultserti
FIX(99.5.4): fix test (permission denied on authorized_keys)
03c8e25
@thibaultserti
Move to most recent docker image for buster
b586594
@thibaultserti
IMP(4.5): rename to 1.6.1.2 improve test
ce1e87b
@thibaultserti
FIX: fix apt autoremove to be non interactive
ffd5b28 
	modified:   bin/hardening/2.2.10_disable_http_server.sh
	modified:   bin/hardening/2.2.11_disable_imap_pop.sh
	modified:   bin/hardening/2.2.12_disable_samba.sh
	modified:   bin/hardening/2.2.14_disable_snmp_server.sh
	modified:   bin/hardening/2.2.2_disable_xwindow_system.sh
	modified:   bin/hardening/2.2.3_disable_avahi_server.sh
	modified:   bin/hardening/2.2.4_disable_print_server.sh
	modified:   bin/hardening/2.2.5_disable_dhcp.sh
	modified:   bin/hardening/2.2.6_disable_ldap.sh
	modified:   bin/hardening/2.2.7_disable_nfs_rpc.sh
	modified:   bin/hardening/2.2.8_disable_dns_server.sh
	modified:   bin/hardening/2.2.9_disable_ftp.sh
	modified:   bin/hardening/2.3.1_disable_nis.sh
	modified:   bin/hardening/2.3.2_disable_rsh_client.sh
	modified:   bin/hardening/2.3.3_disable_talk_client.sh
	modified:   bin/hardening/2.3.4_telnet_client_not_installed.sh
	modified:   bin/hardening/2.3.5_ldap_client_not_installed.sh
@thibaultserti
Add disclaimer when checks don't require comprehensive checks
7e8c976 
	modified:   tests/hardening/1.1.1.1_disable_freevxfs.sh
	modified:   tests/hardening/1.1.1.2_disable_jffs2.sh
	modified:   tests/hardening/1.1.1.3_disable_hfs.sh
	modified:   tests/hardening/1.1.1.4_disable_hfsplus.sh
	modified:   tests/hardening/1.1.1.5_disable_udf.sh
	modified:   tests/hardening/1.1.1.6_disable_cramfs.sh
	modified:   tests/hardening/1.1.1.7_disable_squashfs.sh
	modified:   tests/hardening/1.1.10_var_tmp_noexec.sh
	modified:   tests/hardening/1.1.11_var_log_partition.sh
	modified:   tests/hardening/1.1.12_var_log_audit_partition.sh
	modified:   tests/hardening/1.1.13_home_partition.sh
	modified:   tests/hardening/1.1.14_home_nodev.sh
	modified:   tests/hardening/1.1.18_removable_device_nodev.sh
	modified:   tests/hardening/1.1.19_removable_device_nosuid.sh
	modified:   tests/hardening/1.1.20_removable_device_noexec.sh
	modified:   tests/hardening/1.1.2_tmp_partition.sh
	modified:   tests/hardening/1.1.3_tmp_nodev.sh
	modified:   tests/hardening/1.1.4_tmp_nosuid.sh
	modified:   tests/hardening/1.1.5_tmp_noexec.sh
	modified:   tests/hardening/1.1.6_var_partition.sh
	modified:   tests/hardening/1.1.7_var_tmp_partition.sh
	modified:   tests/hardening/1.1.8_var_tmp_nodev.sh
	modified:   tests/hardening/1.1.9_var_tmp_nosuid.sh
	modified:   tests/hardening/1.8_install_updates.sh
	modified:   tests/hardening/2.2.10_disable_http_server.sh
	modified:   tests/hardening/2.2.11_disable_imap_pop.sh
	modified:   tests/hardening/2.2.12_disable_samba.sh
	modified:   tests/hardening/2.2.13_disable_http_proxy.sh
	modified:   tests/hardening/2.2.14_disable_snmp_server.sh
	modified:   tests/hardening/2.2.2_disable_xwindow_system.sh
	modified:   tests/hardening/2.2.3_disable_avahi_server.sh
	modified:   tests/hardening/2.2.4_disable_print_server.sh
	modified:   tests/hardening/2.2.5_disable_dhcp.sh
	modified:   tests/hardening/2.2.6_disable_ldap.sh
	modified:   tests/hardening/2.2.7_disable_nfs_rpc.sh
	modified:   tests/hardening/2.2.8_disable_dns_server.sh
	modified:   tests/hardening/2.2.9_disable_ftp.sh
	modified:   tests/hardening/2.3.1_disable_nis.sh
	modified:   tests/hardening/2.3.2_disable_rsh_client.sh
	modified:   tests/hardening/2.3.3_disable_talk_client.sh
	modified:   tests/hardening/2.3.4_telnet_client_not_installed.sh
	modified:   tests/hardening/2.3.5_ldap_client_not_installed.sh
@thibaultserti
Rename 6.1.2,6.1.3,6.1.4 to be CIS9 compliant
a6de243
@thibaultserti
FIX(4.1.1.2): fix auditd apply
7b8cca2
@thibaultserti
FIX(3.1.1): fix unbound variable issue
3c7a034
@thibaultserti
Update changelog
6620a82
@thibaultserti
Revert to previous check (8.2.4 in old num)
829ee86
@thibaultserti
IMP(5.2.3): 640 permission is now ok for the check
501ce8c
@thibaultserti
Fix race condition on /etc/passwd, /etc/shadow and /etc/group
fbd26ce
@thibaultserti
Update changelog
e288835
ThibaultDewailly and others added 30 commits August 31, 2023 14:34
@ThibaultDewailly
fix: chore debian manual update (#198)
f2cc14c 
* fix: chore debian manual update

fixes #182

* Regenerate man pages (Github action)

---------

Co-authored-by: ThibaultDewailly <[email protected]>
@ThibaultDewailly
fix: chore, debug logs print correctly now (#197)
27edec6
@ThibaultDewailly
fix: correct debian version check on 5.2.15 configuration generation (#…
6e79fcd 
…199)

fixes #196
@dependabot
build(deps): bump actions/checkout from 3 to 4 (#202)
9d3fb18 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@ThibaultDewailly
feat: add nftables to firewall software allow list (#203)
5370ec2 
* feat: add nftables to firewall software allow list

fixes #191

* fix: enhance 3.5.4.1.1_net_fw_default_policy_drop.sh iptables output check, disable associated test
@P-EB
Replace CIS_ROOT_DIR by a more flexible system (#204)
32886d3 
* Replace CIS_ROOT_DIR by a more flexible system

* Try to adapt the logic change to the functional tests
@P-EB
Update the README to reflect on changes made in PR#204 (#205)
08aff5d
@ThibaultDewailly
feat: Officialize Debian 12 support (#206)
2e53dfb 
* feat: Officialize Debian 12 support

Functional tests now pass
CIS Benchmark PDF for Debian 12 is not out yet, but the hardening points checked
are still relevant in Debian 12.
OVHcloud is now using it in critical production, hence making it officially supported

---------

Co-authored-by: ThibaultDewailly <[email protected]>
@ThibaultDewailly
fix: debian12 functional test pass is now mandatory (#207)
ceea343
@ThibaultDewailly
bump to 4.1.1
f6aa306
@ThibaultDewailly
fix: root_dir is still /opt/cis-hardening for the moment (#208)
f888ce0
@ThibaultDewailly
bump to 4.1.2
0f59f73
@ThibaultDewailly
feat: advertise Debian 12 compatibility in readme
2188577
@dependabot
build(deps): bump luizm/action-sh-checker from 0.7.0 to 0.8.0 (#210)
d6c3341 
Bumps [luizm/action-sh-checker](https://github.com/luizm/action-sh-checker) from 0.7.0 to 0.8.0.
- [Release notes](https://github.com/luizm/action-sh-checker/releases)
- [Commits](luizm/action-sh-checker@v0.7.0...v0.8.0)

---
updated-dependencies:
- dependency-name: luizm/action-sh-checker
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@ThibaultDewailly
enh: remove ssh system sandbox check (#213)
0eb2e2f 
UsePrivilegeSeparation option is deprecated.
Since the oldest supported Debian distribution is Buster (10), we can safely remove this check

Fixes #212
@ThibaultDewailly
fix: clean obsolete check 99.5.4.5.1, now handled by 5.3.4 (#215)
670c8c6 
Fixes #209
@dependabot @ThibaultDewailly
build(deps): bump metcalfc/changelog-generator from 4.1.0 to 4.2.0 (#214
693487c 
)

Bumps [metcalfc/changelog-generator](https://github.com/metcalfc/changelog-generator) from 4.1.0 to 4.2.0.
- [Release notes](https://github.com/metcalfc/changelog-generator/releases)
- [Changelog](https://github.com/metcalfc/changelog-generator/blob/main/release-notes.png)
- [Commits](metcalfc/changelog-generator@v4.1.0...v4.2.0)

---
updated-dependencies:
- dependency-name: metcalfc/changelog-generator
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: GoldenKiwi <[email protected]>
@speed47
Adapt all scripts to yescrypt (#216)
de295b3 
* Revert "fix: clean obsolete check 99.5.4.5.1, now handled by 5.3.4 (#215)"

This reverts commit 670c8c6.

We still want to verify the preexisting hashes in /etc/shadow,
even if the PAM configuration is correct for new passwords (5.3.4).

* Adapt 5.3.4, 99.5.4.5.1 and 99.5.4.5.2 to yescrypt
@ThibaultDewailly
bump to 4.1.3
c75244e
@ThibaultDewailly
fix: typo in README. Update example of --audit usage (#222)
fb4df82 
fixes #220
fixes #217
@ThibaultDewailly
fix: update Readme to clarify project usage (#223)
71019a5 
fixes: #219
@ThibaultDewailly
fix: Allow --only option to be called multiple times (#225)
c391723 
--only option was affected with a grep bug since 2017.
the regex was not able to parse more than the first passed argument.

fixes #224
@ThibaultDewailly
Syslog-ng fixes and enhancements (#226)
73616af 
* syslog-ng : fix remote host test and enhance Regex

fixes #124

* enh: add test for 4.2.1.6
@lgaida
Allow multiple exception users to be defined for 99.5.2.4_ssh_keys_fr…
5313799 
…om (#221)

* allow multiple exception users for 99.5.2.4
@lgaida @ThibaultDewailly
allow multiple users in 5.2.18 (#228)
730ab47 
* allow multiple exception users for 99.5.2.4

* move clean up part of previous commit

* split clean up part of previous commit

* add tests for multiple allowed and denied ssh users

* fix script to correctly set multiple allowed and denied ssh users

* add cleanup resolved check to 5.2.18

* apply shellfmt to 5.2.18

---------

Co-authored-by: GoldenKiwi <[email protected]>
@ThibaultDewailly
bump to 4.1.4
a45aa40
@ThibaultDewailly
fix: allow set-hardening-level option usage (#232)
3bd4078 
Was broken since 2020, fixes #230
@Isma399
fix: catch cidr network in ssh keys (#236)
43fc23e 
Co-authored-by: Ismaël Tanguy <[email protected]>
@dependabot @ThibaultDewailly
build(deps): bump metcalfc/changelog-generator from 4.2.0 to 4.3.1 (#234
f7cdf43 
)

Bumps [metcalfc/changelog-generator](https://github.com/metcalfc/changelog-generator) from 4.2.0 to 4.3.1.
- [Release notes](https://github.com/metcalfc/changelog-generator/releases)
- [Changelog](https://github.com/metcalfc/changelog-generator/blob/main/release-notes.png)
- [Commits](metcalfc/changelog-generator@v4.2.0...v4.3.1)

---
updated-dependencies:
- dependency-name: metcalfc/changelog-generator
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: GoldenKiwi <[email protected]>
@sinrazon
fix: invalid behavior on sid/alternative in 5.3.4/99.5.4.5.1 (#237)
6079b16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
⤵️ pull merge-conflict Resolve conflicts manually
Projects
None yet
Milestone
No milestone