21 lines
1.2 KiB
Bash
21 lines
1.2 KiB
Bash
# The overall exposure of the SSH service, as systemd-analyze shows it.
|
|
score() { systemd-analyze security "$(pick sshd ssh).service" 2>/dev/null | tail -1 | grep -oE '[0-9]+\.[0-9]+' | head -1; }
|
|
|
|
task 1 "The service on TCP port 2323 stopped and disabled"
|
|
need "nothing listens on port 2323" '! listening 2323 tcp'
|
|
need "its unit is stopped and disabled" '! active legacy-console.service && ! enabled legacy-console.service'
|
|
|
|
task 2 "The setuid program no package installed"
|
|
need "/root/lab-answers/2 has its path" '[ "$(answer 2)" = /usr/local/bin/sysreport ]'
|
|
|
|
task 3 "The capability-holding program no package installed"
|
|
need "/root/lab-answers/3 has its path" '[ "$(answer 3)" = /usr/sbin/netprobe ]'
|
|
|
|
task 4 "A noexec, nosuid, nodev tmpfs on /mnt/nx"
|
|
need "a tmpfs is mounted on /mnt/nx" '[ "$(findmnt -n -o FSTYPE /mnt/nx)" = tmpfs ]'
|
|
need "it has noexec, nosuid and nodev" 'o=$(findmnt -n -o OPTIONS /mnt/nx); for w in noexec nosuid nodev; do grep -qw $w <<<"$o" || exit 1; done'
|
|
need "/mnt/nx/id is there and can't run" '[ -f /mnt/nx/id ] && ! /mnt/nx/id'
|
|
|
|
task 5 "The SSH service's exposure score"
|
|
need "/root/lab-answers/5 has the score" 's=$(score); [ -n "$s" ] && grep -qw "$s" /root/lab-answers/5'
|