diff --git a/benchmarks/access-and-control/1.29-ensure-password-reuse-is-limited.md b/benchmarks/access-and-control/1.29-ensure-password-reuse-is-limited.md index df58fded593c518fb12fd19e1c9f91c980b8fca6..f2be6e304edd045cc16214251649f86819fce840 100644 --- a/benchmarks/access-and-control/1.29-ensure-password-reuse-is-limited.md +++ b/benchmarks/access-and-control/1.29-ensure-password-reuse-is-limited.md @@ -30,7 +30,6 @@ if grep -Eq '^\s*password\s+(sufficient\s+pam_unix|requi(red|site)\s+pam_pwhisto else sed -ri 's/^\s*(password\s+(requisite|sufficient)\s+(pam_pwhistory\.so|pam_unix\.so)\s+)(.*)$/\1\4 remember=5/' $PTF fi -authselect apply-changes ``` ## 扫描检测 diff --git a/benchmarks/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.md b/benchmarks/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.md index d3ac4606814df70f3a0c66cfa69fe02da07d6eb0..b099ea54a406f39a11f9445be8c03150f50ed810 100644 --- a/benchmarks/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.md +++ b/benchmarks/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.md @@ -30,7 +30,6 @@ if grep -Eq '^\s*password\s+(sufficient\s+pam_unix|requi(red|site)\s+pam_pwhisto else sed -ri 's/^\s*(password\s+(requisite|sufficient)\s+(pam_pwhistory\.so|pam_unix\.so)\s+)(.*)$/\1\4 remember=5/' $PTF fi -authselect apply-changes ``` ## 扫描检测 diff --git a/remediation-kits/access-and-control/1.23-ensure-ssh-pam-is-enabled.sh b/remediation-kits/access-and-control/1.23-ensure-ssh-pam-is-enabled.sh index 23c93643015c1d135abf1650422910129dd5b8e5..d7662e48b481cc9a14ef2cd08897c458914752a8 100644 --- a/remediation-kits/access-and-control/1.23-ensure-ssh-pam-is-enabled.sh +++ b/remediation-kits/access-and-control/1.23-ensure-ssh-pam-is-enabled.sh @@ -1 +1 @@ -echo "UsePAM yes" >> /etc/ssh/sshd_config \ No newline at end of file +grep -Eiq '^\s*UsePAM\s+yes' /etc/ssh/sshd_config || echo "UsePAM yes" >> /etc/ssh/sshd_config \ No newline at end of file diff --git a/remediation-kits/access-and-control/1.29-ensure-password-reuse-is-limited.sh b/remediation-kits/access-and-control/1.29-ensure-password-reuse-is-limited.sh index e486434e2bca1b8d9da401f46247f49766e864df..34298a2556919eae7db95d024416ae61a2e318c6 100644 --- a/remediation-kits/access-and-control/1.29-ensure-password-reuse-is-limited.sh +++ b/remediation-kits/access-and-control/1.29-ensure-password-reuse-is-limited.sh @@ -8,5 +8,4 @@ if grep -Eq '^\s*password\s+(sufficient\s+pam_unix|requi(red|site)\s+pam_pwhisto sed -ri 's/^\s*(password\s+(requisite|sufficient)\s+(pam_pwhistory\.so|pam_unix\.so)\s+)(.*)(remember=\S+\s*)(.*)$/\1\4 remember=5 \6/' $PTF else sed -ri 's/^\s*(password\s+(requisite|sufficient)\s+(pam_pwhistory\.so|pam_unix\.so)\s+)(.*)$/\1\4 remember=5/' $PTF -fi -authselect apply-changes \ No newline at end of file +fi \ No newline at end of file diff --git a/remediation-kits/access-and-control/1.39-ensure-default-user-umask-is-027-or-more-restrictive.sh b/remediation-kits/access-and-control/1.39-ensure-default-user-umask-is-027-or-more-restrictive.sh index e03ab96d2229aa64d1a6e9d9a7b0815e2f55597f..119fe0f3ebf34fc7b4adb3b3de55f5e32c001b6e 100644 --- a/remediation-kits/access-and-control/1.39-ensure-default-user-umask-is-027-or-more-restrictive.sh +++ b/remediation-kits/access-and-control/1.39-ensure-default-user-umask-is-027-or-more-restrictive.sh @@ -1,7 +1,7 @@ grep -Eq "^(\s*)umask\s+\S+(\s*#.*)?\s*$" /etc/profile.d/set_umask.sh && sed -ri "s/^(\s*)umask\s+\S+(\s*#.*)?\s*$/\1umask 027\2/" /etc/profile.d/set_umask.sh || echo "umask 027" >> /etc/profile.d/set_umask.sh -grep -Eq "^(\s*)umask\s+\S+(\s*#.*)?\s*$" /etc/bashrc && sed -ri "s/^(\s*)umask\s+\S+(\s*#.*)?\s*$/\1umask 027\2/" /etc/bashrc || echo "umask 027" >> /etc/bashrc +grep -Eq "umask\s+[0-9][0-9][0-9]" /etc/bashrc && sed -ri 's/umask\s+[0-9][0-9][0-9]/umask 027/' /etc/bashrc || echo "umask 027" >> /etc/bashrc grep -Eq "^(\s*)umask\s+\S+(\s*#.*)?\s*$" /etc/profile && sed -ri "s/^(\s*)umask\s+\S+(\s*#.*)?\s*$/\1umask 027\2/" /etc/profile || echo "umask 027" >> /etc/profile grep -Eq "^(\s*)UMASK\s+\S+(\s*#.*)?\s*$" /etc/login.defs && sed -ri "s/^(\s*)UMASK\s+\S+(\s*#.*)?\s*$/\1UMASK 027\2/" /etc/login.defs || echo "UMASK 027" >> /etc/login.defs -grep -q "USERGROUPS_ENAB" /etc/login.defs && sed -ri "s/^(\s*)USERGROUPS_ENAB\s+\S+(\s*#.*)?\s*$/\1USERGROUPS_ENAB on\2/" /etc/login.defs || echo "USERGROUPS_ENAB no" >> /etc/login.defs +grep -q "USERGROUPS_ENAB" /etc/login.defs && sed -ri "s/^(\s*)USERGROUPS_ENAB\s+\S+(\s*#.*)?\s*$/\1USERGROUPS_ENAB no\2/" /etc/login.defs || echo "USERGROUPS_ENAB no" >> /etc/login.defs echo "session optional pam_umask.so" >> /etc/pam.d/password-auth echo "session optional pam_umask.so" >> /etc/pam.d/system-auth diff --git a/remediation-kits/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.sh b/remediation-kits/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.sh index 330fb545c45aa21a453384ed31a6bbbe57ab4922..40b817c40320ae5316ee3bed9482a605bebe8e05 100644 --- a/remediation-kits/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.sh +++ b/remediation-kits/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.sh @@ -2,5 +2,4 @@ passSuffRowNum=($(cat /etc/pam.d/system-auth | awk '{if($1 == "password" && $2 = targetString="password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5" if [ -n "$passSuffRowNum" ]; then sed -i "${passSuffRowNum} c ${targetString}" /etc/pam.d/system-auth; -fi -authselect apply-changes \ No newline at end of file +fi \ No newline at end of file diff --git a/scanners/access-and-control/1.39-ensure-default-user-umask-is-027-or-more-restrictive.sh b/scanners/access-and-control/1.39-ensure-default-user-umask-is-027-or-more-restrictive.sh index 6fcf5fa01763b1918476cff2ca3377361b7bc9d2..175cda67e34d96781984f6ee35be72849dad4011 100644 --- a/scanners/access-and-control/1.39-ensure-default-user-umask-is-027-or-more-restrictive.sh +++ b/scanners/access-and-control/1.39-ensure-default-user-umask-is-027-or-more-restrictive.sh @@ -1,12 +1,6 @@ -result=false -val_umask="" +result=0 +umask_file=`grep -RPi '(^|^[^#]*)\s*umask\s+([0-7][0-7][01][0-7]\b|[0-7][0-7][0-7][0-6]\b|[0-7][01][0-7]\b|[0-7][0-7][0-6]\b|(u=[rwx]{0,3},)?(g=[rwx]{0,3},)?o=[rwx]+\b|(u=[rwx]{1,3},)?g=[^rx]{1,3}(,o=[rwx]{0,3})?\b)' /etc/login.defs /etc/profile* /etc/bashrc* /etc/profile.d/*.sh` -val_umask=`grep -RPi '(^|^[^#]*)\s*umask\s+([0-7][0-7][01][0-7]\b|[0-7][0-7][0-7][0-6]\b|[0-7][01][0-7]\b|[0-7][0-7][0-6]\b|(u=[rwx]{0,3},)?(g=[rwx]{0,3},)?o=[rwx]+\b|(u=[rwx]{1,3},)?g=[^rx]{1,3}(,o=[rwx]{0,3})?\b)' /etc/login.defs /etc/profile* /etc/bashrc*` -grep -Eiq '^\s*UMASK\s+(0[0-7][2-7]7|[0-7][2-7]7)\b' /etc/login.defs && grep -Eqi '^\s*USERGROUPS_ENAB\s*"?no"?\b' /etc/login.defs && grep -Eq '^\s*session\s+(optional|requisite|required)\s+pam_umask\.so\b' /etc/pam.d/common-session && result=true -grep -REiq '^\s*UMASK\s+\s*(0[0-7][2-7]7|[0-7][2-7]7|u=(r?|w?|x?)(r?|w?|x?)(r?|w?|x?),g=(r?x?|x?r?),o=)\b' /etc/profile* /etc/bashrc* && result=true +[[ -z $umask_file ]] && grep -Eqi '^\s*USERGROUPS_ENAB\s*"?no"?\b' /etc/login.defs && grep -Piq '^session\s*optional\s*pam_umask\.so$' /etc/pam.d/password-auth && result=1 -if [[ $result == true && $val_umask == "" ]]; then - echo "pass" -else - echo "fail" -fi \ No newline at end of file +[[ $result == 1 ]] && echo 'pass' || echo 'fail' \ No newline at end of file diff --git a/scanners/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.sh b/scanners/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.sh index 92fbcdc8f08f02ef50a7e001a4d50c6782f9fea4..0d3975fb565269bad69ed5944f3a41e37f680dd4 100644 --- a/scanners/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.sh +++ b/scanners/access-and-control/1.44-ensure-that-password-reuse-limit-is-between-5-and-25-times.sh @@ -1,6 +1,6 @@ val_remember=99999 val_remember=`grep -Pi "^\h*password\h+(requisite|sufficient)\h+(pam_pwhistory\.so|pam_unix\.so)\h+([^#\n\r]+\h+)?remember=([5-9]|[1-9][0-9]+)\h*(\h+.*)?$" /etc/pam.d/system-auth | cut -d '=' -f2` -[ ! -z val_remember ] && result_remember=`echo "$val_remember >=5 && $val_remember <= 25" | bc` +[ ! -z $val_remember ] && result_remember=`echo "$val_remember >=5 && $val_remember <= 25" | bc` if [[ $result_remember -eq 1 ]]; then echo 'pass' diff --git a/scanners/logging-and-auditing/2.14-ensure-rsyslog-default-file-permissions-configured.sh b/scanners/logging-and-auditing/2.14-ensure-rsyslog-default-file-permissions-configured.sh index 1c7c164b865f1fdc26bf169a2d6cd62e00f05b1d..b70ed6cb33459bfa0ab129f28bb0596b928eff66 100644 --- a/scanners/logging-and-auditing/2.14-ensure-rsyslog-default-file-permissions-configured.sh +++ b/scanners/logging-and-auditing/2.14-ensure-rsyslog-default-file-permissions-configured.sh @@ -1,18 +1,18 @@ -result_rsyslog=false -result_rsyslog_d=false -conf_file_path=`ls /etc/rsyslog.d/*.conf` +#!/usr/bin/env bash +result=0 -if [[ -a /etc/rsyslog.conf && -a $conf_file_path ]]; then - grep -q ^\$FileCreateMode /etc/rsyslog.conf && result_rsyslog=true - grep -q ^\$FileCreateMode /etc/rsyslog.d/*.conf && result_rsyslog_d=true -elif [[ -a /etc/rsyslog.conf ]]; then - grep -q ^\$FileCreateMode /etc/rsyslog.conf && result_rsyslog=true -elif [[ -a $conf_file_path ]]; then - grep -q ^\$FileCreateMode /etc/rsyslog.d/*.conf && result_rsyslog_d=true -fi +for p in `find /etc/rsyslog.conf ; find /etc/rsyslog.d/ -name *.conf` ; do + [[ -f $p ]] && file_path=$file_path" ${p}" +done -if [[ $result_rsyslog == true || $result_rsyslog_d == true ]]; then - echo "pass" +if [[ -n $file_path ]] && [[ -n $(sed -rn 's/^\$FileCreateMode\s*//gp' $file_path) ]]; then + for num in $(sed -rn 's/^\$FileCreateMode\s*//gp' $file_path); do + result=0 + echo $num | grep -Pq '[0][0-6][0-4][0]' && result=1 + [[ $result == 0 ]] && echo 'fail' && break + done else - echo "fail" + echo 'fail' fi + +[[ $result == 1 ]] && echo 'pass' diff --git a/scanners/logging-and-auditing/2.5-ensure-audit-configuration-files-are-0640-or-more-restrictive.sh b/scanners/logging-and-auditing/2.5-ensure-audit-configuration-files-are-0640-or-more-restrictive.sh index 2b261e62cc2df9cf023b88279c38b2b236af9e42..7f13eb0992aec1ccbad4a163aa4c23e39912e34b 100644 --- a/scanners/logging-and-auditing/2.5-ensure-audit-configuration-files-are-0640-or-more-restrictive.sh +++ b/scanners/logging-and-auditing/2.5-ensure-audit-configuration-files-are-0640-or-more-restrictive.sh @@ -1,13 +1,18 @@ -result_audit=false -result_rules_d=false -result_rules_d_file=false +#!/usr/bin/env bash +result=0 -stat -c "%a" /etc/audit/ | grep -Eq '^[0-7][0,1,4,5]0\s*$' && result_audit=true -stat -c "%a" /etc/audit/rules.d/ | grep -Eq '^[0-7][0,1,4,5]0\s*$' && result_rules_d=true -stat -c "%a" /etc/audit/rules.d/* | grep -Eq '^[0-7][0,1,4,5]0\s*$' && result_rules_d_file=true +for p in `find /etc/audit/rules.d/ -name *.rules ; find /etc/audit/rules.d/ -name *.conf ; find /etc/audit/audit*.rules ; find /etc/audit/audit*.conf` ; do + [[ -f $p ]] && file_path=$file_path" ${p}" +done -if [ "$result_audit" = true ] && [ "$result_rules_d" = true ] && [ "$result_rules_d_file" = true ]; then - echo "pass" +if [[ -n $file_path ]] ; then + for access in `stat -c "%a" $file_path`; do + result=0 + echo $access | grep -Pq '[0-6][0-4][0]' && result=1 + [[ $result == 0 ]] && echo 'fail' && break + done else - echo "fail" -fi \ No newline at end of file + echo 'fail' +fi + +[[ $result == 1 ]] && echo 'pass' diff --git a/scanners/logging-and-auditing/2.6-ensure-only-authorized-accounts-own-the-audit-configuration-files.sh b/scanners/logging-and-auditing/2.6-ensure-only-authorized-accounts-own-the-audit-configuration-files.sh index 7ec8d6ea0a9146ad0a2d91092484164de2355f51..8801597f167545559356f12e9cf117d62ae63934 100644 --- a/scanners/logging-and-auditing/2.6-ensure-only-authorized-accounts-own-the-audit-configuration-files.sh +++ b/scanners/logging-and-auditing/2.6-ensure-only-authorized-accounts-own-the-audit-configuration-files.sh @@ -1,13 +1,18 @@ -result_audit=false -result_rules_d=false -result_rules_d_file=false +#!/usr/bin/env bash +result=0 -stat -c "%U" /etc/audit/ | grep -Eq 'root' && result_audit=true -stat -c "%U" /etc/audit/rules.d/ | grep -Eq 'root' && result_rules_d=true -stat -c "%U" /etc/audit/rules.d/*.{rules,conf} | grep -Eq 'root' && result_rules_d_file=true +for p in `find /etc/audit/rules.d/ -name *.rules ; find /etc/audit/rules.d/ -name *.conf ; find /etc/audit/audit*.rules ; find /etc/audit/audit*.conf` ; do + [[ -f $p ]] && file_path=$file_path" ${p}" +done -if [ "$result_audit" = true ] && [ "$result_rules_d" = true ] && [ "$result_rules_d_file" = true ]; then - echo "pass" +if [[ -n $file_path ]] ; then + for uid in `stat -c "%U" $file_path`; do + result=0 + [[ $uid == 'root' ]] && result=1 + [[ $result == 0 ]] && echo 'fail' && break + done else - echo "fail" -fi \ No newline at end of file + echo 'fail' +fi + +[[ $result == 1 ]] && echo 'pass' diff --git a/scanners/logging-and-auditing/2.7-ensure-only-authorized-groups-own-the-audit-configuration-files.sh b/scanners/logging-and-auditing/2.7-ensure-only-authorized-groups-own-the-audit-configuration-files.sh index 2dad41a16219b6dc337e734897a4243743c9209e..a31d8bfded62563ae591ece010eec7472b5dda0a 100644 --- a/scanners/logging-and-auditing/2.7-ensure-only-authorized-groups-own-the-audit-configuration-files.sh +++ b/scanners/logging-and-auditing/2.7-ensure-only-authorized-groups-own-the-audit-configuration-files.sh @@ -1,13 +1,18 @@ -result_audit=false -result_rules_d=false -result_rules_d_file=false +#!/usr/bin/env bash +result=0 -stat -c "%G" /etc/audit/ | grep -Eq 'root' && result_audit=true -stat -c "%G" /etc/audit/rules.d/ | grep -Eq 'root' && result_rules_d=true -stat -c "%G" /etc/audit/rules.d/*.{rules,conf} | grep -Eq 'root' && result_rules_d_file=true +for p in `find /etc/audit/rules.d/ -name *.rules ; find /etc/audit/rules.d/ -name *.conf ; find /etc/audit/audit*.rules ; find /etc/audit/audit*.conf` ; do + [[ -f $p ]] && file_path=$file_path" ${p}" +done -if [ "$result_audit" = true ] && [ "$result_rules_d" = true ] && [ "$result_rules_d_file" = true ]; then - echo "pass" +if [[ -n $file_path ]] ; then + for gid in `stat -c "%G" $file_path`; do + result=0 + [[ $gid == 'root' ]] && result=1 + [[ $result == 0 ]] && echo 'fail' && break + done else - echo "fail" -fi \ No newline at end of file + echo 'fail' +fi + +[[ $result == 1 ]] && echo 'pass' diff --git a/scanners/system-configurations/4.11-ensure-permissions-on-bootloader-config-are-configured.sh b/scanners/system-configurations/4.11-ensure-permissions-on-bootloader-config-are-configured.sh index 788b67ccf2dc15189334ee901192878244443f50..201de146698d5363745d6c4e0c11d245188d1a31 100644 --- a/scanners/system-configurations/4.11-ensure-permissions-on-bootloader-config-are-configured.sh +++ b/scanners/system-configurations/4.11-ensure-permissions-on-bootloader-config-are-configured.sh @@ -1,27 +1,17 @@ #!/usr/bin/env bash -GFPT() -{ -tst1="" tst2="" tst3="" tst4="" tst5="" tst6="" output="" output2="" output3="" output4="" output5="" output6="" -grubfile=$(find /boot -type f \( -name 'grubenv' -o -name 'grub.conf' -o -name 'grub.cfg' \) -exec grep -Pl '^\h*(kernelopts=|linux|kernel)' {} \;) -grubdir=$(dirname "$grubfile") -stat -c "%a" "$grubfile" | grep -Pq '^\h*[0-7]00$' && tst1=pass output="Permissions on \"$grubfile\" are \"$(stat -c "%a" "$grubfile")\"" -stat -c "%u:%g" "$grubfile" | grep -Pq '^\h*0:0$' && tst2=pass output2="\"$grubfile\" is owned by \"$(stat -c "%U" "$grubfile")\" and belongs to group \"$(stat -c "%G" "$grubfile")\"" -if [ -f "$grubdir/user.cfg" ]; then - stat -c "%a" "$grubdir/user.cfg" | grep -Pq '^\h*[0-7]00$' && tst3=pass output3="Permissions on \"$grubdir/user.cfg\" are \"$(stat -c "%a" "$grubdir/user.cfg")\"" - stat -c "%u:%g" "$grubdir/user.cfg" | grep -Pq '^\h*0:0$' && tst4=pass output4="\"$grubdir/user.cfg\" is owned by \"$(stat -c "%U" "$grubdir/user.cfg")\" and belongs to group \"$(stat -c "%G" "$grubdir/user.cfg")\"" +[[ -f /boot/grub2/grub.cfg ]] && file_path='/boot/grub2/grub.cfg' +[[ -f /boot/grub2/grubenv ]] && file_path=$file_path' /boot/grub2/grubenv' +[[ -f /boot/grub2/user.cfg ]] && file_path=$file_path' /boot/grub2/user.cfg' +result=0 + +if [[ -n $file_path ]] ; then + for access in $file_path; do + result=0 + stat -c '%U:%G' $access | grep -Pq "^root\:root$" && stat -c '%a' $access | grep -Pq "^[0-7]00$" && result=1 + [[ $result == 0 ]] && echo 'fail' && break + done else - tst3=pass;tst4=pass + echo 'fail' fi -if [ -f "$grubdir/grub.cfg" ]; then - stat -c "%a" "$grubdir/grub.cfg" | grep -Pq '^\h*[0-7]00$' && tst5=pass output5="Permissions on \"$grubdir/grub.cfg\" are \"$(stat -c "%a" "$grubdir/grub.cfg")\"" - stat -c "%u:%g" "$grubdir/grub.cfg" | grep -Pq '^\h*0:0$' && tst6=pass output6="\"$grubdir/grub.cfg\" is owned by \"$(stat -c "%U" "$grubdir/grub.cfg")\" and belongs to group \"$(stat -c "%G" "$grubdir/grub.cfg")\"" -else - tst5=pass;tst6=pass -fi -if [ "$tst1" = "pass" ] && [ "$tst2" = "pass" ] && [ "$tst3" = "pass" ] && [ "$tst4" = "pass" ] && [ "$tst5" = "pass" ] && [ "$tst6" = "pass" ]; then - echo "pass" -else - echo "fail" -fi -} -GFPT \ No newline at end of file + +[[ $result == 1 ]] && echo 'pass' diff --git a/scanners/system-configurations/4.58-ensure-a-firewall-package-is-installed.sh b/scanners/system-configurations/4.58-ensure-a-firewall-package-is-installed.sh index 0092e22e32b518ccbee02bce6219610e31e19f39..a222e4177825accbccdd6c7cae0cbc94f3e50db5 100644 --- a/scanners/system-configurations/4.58-ensure-a-firewall-package-is-installed.sh +++ b/scanners/system-configurations/4.58-ensure-a-firewall-package-is-installed.sh @@ -1,6 +1,6 @@ result="" -rpm -q iptables | grep -Psq "^iptables\-.*" && result=true +rpm -qa | grep -Psq "^iptables\-.*" && result=true [ -z "$result" ] && rpm -q nftables | grep -Psq "^nftables\-.*" && result=true [ -z "$result" ] && rpm -q firewalld | grep -Psq "^firewalld\-.*" && result=true diff --git a/scanners/system-configurations/4.63-ensure-iptables-packages-are-installed.sh b/scanners/system-configurations/4.63-ensure-iptables-packages-are-installed.sh index 743b33e2568af070fc6606b259a52ea374c0579e..d9039ebf53494749ae7e97210a5c0409c6ac06ae 100644 --- a/scanners/system-configurations/4.63-ensure-iptables-packages-are-installed.sh +++ b/scanners/system-configurations/4.63-ensure-iptables-packages-are-installed.sh @@ -1,6 +1,6 @@ result=false -rpm -q iptables | grep -Psq "^iptables\-.*" && rpm -q iptables-services | grep -Psq "^iptables\-services\-.*" && result=true +rpm -qa | grep -Psq "^iptables\-.*" && rpm -q iptables-services | grep -Psq "^iptables\-services\-.*" && result=true if [ "$result" = true ]; then echo "pass" diff --git a/tools/remediation-kits/config/Anolis_security_benchmark_level1.config b/tools/remediation-kits/config/Anolis_security_benchmark_level1.config index bd42598adba48fcf4aebe34d8253c51afff91eb2..fb5cfa24e032efd5873984ffb399b34795c504db 100644 --- a/tools/remediation-kits/config/Anolis_security_benchmark_level1.config +++ b/tools/remediation-kits/config/Anolis_security_benchmark_level1.config @@ -9,10 +9,12 @@ 1.20 1.21 1.22 +1.23 1.24 1.27 1.28 1.29 +1.30 1.31 1.32 1.34 @@ -39,6 +41,7 @@ 4.9 4.11 4.13 +4.14 4.44 4.45 4.46