|
1 | 1 | # encoding: utf-8 |
2 | 2 | # |
3 | | -# Copyright 2015, Patrick Münch |
| 3 | +# Copyright 2015, Patrick Muench |
4 | 4 | # |
5 | 5 | # Licensed under the Apache License, Version 2.0 (the "License"); |
6 | 6 | # you may not use this file except in compliance with the License. |
|
16 | 16 | # |
17 | 17 | # author: Christoph Hartmann |
18 | 18 | # author: Dominik Richter |
19 | | -# author: Patrick Münch |
| 19 | +# author: Patrick Muench |
20 | 20 |
|
21 | 21 | control '01' do |
22 | 22 | impact 1.0 |
23 | | - title "Trusted hosts login" |
| 23 | + title 'Trusted hosts login' |
24 | 24 | desc "Rhosts/hosts.equiv files are a weak implemenation of authentication. Disabling the .rhosts and hosts.equiv support helps to prevent users from subverting the system's normal access control mechanisms of the system." |
25 | 25 | describe command('find / -name \'.rhosts\'') do |
26 | 26 | its('stdout') { should be_empty } |
|
32 | 32 |
|
33 | 33 | control '02' do |
34 | 34 | impact 1.0 |
35 | | - title "Check owner and permissions for /etc/shadow " |
36 | | - desc "Check periodically the owner and permissions for /etc/shadow" |
| 35 | + title 'Check owner and permissions for /etc/shadow' |
| 36 | + desc 'Check periodically the owner and permissions for /etc/shadow' |
37 | 37 | describe file('/etc/shadow') do |
38 | 38 | it { should exist } |
39 | 39 | it { should be_file } |
|
49 | 49 |
|
50 | 50 | control '03' do |
51 | 51 | impact 1.0 |
52 | | - title "Check owner and permissions for /etc/passwd " |
53 | | - desc "Check periodically the owner and permissions for /etc/passwd" |
| 52 | + title 'Check owner and permissions for /etc/passwd' |
| 53 | + desc 'Check periodically the owner and permissions for /etc/passwd' |
54 | 54 | describe file('/etc/passwd') do |
55 | 55 | it { should exist } |
56 | 56 | it { should be_file } |
|
68 | 68 |
|
69 | 69 | control '04' do |
70 | 70 | impact 1.0 |
71 | | - title "Dot in PATH variable" |
72 | | - desc "Do not include the current working directory in PATH variable. This makes it easier for an attacker to gain extensive rigths by executing a Trojan program" |
| 71 | + title 'Dot in PATH variable' |
| 72 | + desc 'Do not include the current working directory in PATH variable. This makes it easier for an attacker to gain extensive rigths by executing a Trojan program' |
73 | 73 | describe os_env('PATH') do |
74 | 74 | its('split') { should_not include('') } |
75 | 75 | its('split') { should_not include('.') } |
|
78 | 78 |
|
79 | 79 | control '05' do |
80 | 80 | impact 1.0 |
81 | | - title "Check login.defs" |
82 | | - desc "Check owner and permissions for login.defs. Also check the configured PATH variable and umask in login.defs" |
| 81 | + title 'Check login.defs' |
| 82 | + desc 'Check owner and permissions for login.defs. Also check the configured PATH variable and umask in login.defs' |
83 | 83 | describe file('/etc/login.defs') do |
84 | 84 | it { should exist } |
85 | 85 | it { should be_file } |
|
112 | 112 |
|
113 | 113 | control '06' do |
114 | 114 | impact 1.0 |
115 | | - title "Check for SUID/ SGID blacklist " |
116 | | - desc "Find blacklisted SUID and SGID files to ensure that no rogue SUID and SGID files have been introduced into the system" |
| 115 | + title 'Check for SUID/ SGID blacklist' |
| 116 | + desc 'Find blacklisted SUID and SGID files to ensure that no rogue SUID and SGID files have been introduced into the system' |
117 | 117 |
|
118 | 118 | blacklist = [ |
119 | 119 | # blacklist as provided by NSA |
|
141 | 141 | '/usr/lib/evolution/camel-lock-helper-1.2', # investigate current state... |
142 | 142 | '/usr/lib/pt_chown', # pseudo-tty, needed? |
143 | 143 | '/usr/lib/eject/dmcrypt-get-device', |
144 | | - '/usr/lib/mc/cons.saver' # midnight commander screensaver |
| 144 | + '/usr/lib/mc/cons.saver' # midnight commander screensaver |
145 | 145 | ] |
146 | 146 |
|
147 | 147 | output = command('find / -perm -4000 -o -perm -2000 -type f ! -path \'/proc/*\' -print 2>/dev/null | grep -v \'^find:\'') |
148 | 148 | diff = output.stdout.split(/\r?\n/) & blacklist |
149 | 149 | describe diff do |
150 | | - it {should be_empty} |
| 150 | + it { should be_empty } |
151 | 151 | end |
152 | 152 | end |
153 | 153 |
|
154 | 154 | control '07' do |
155 | 155 | impact 1.0 |
156 | | - title "Unique uid and gid" |
157 | | - desc "Check for unique uids gids" |
| 156 | + title 'Unique uid and gid' |
| 157 | + desc 'Check for unique uids gids' |
158 | 158 | describe passwd do |
159 | 159 | its('uids') { should_not contain_duplicates } |
160 | 160 | end |
|
0 commit comments