├── LICENSE
├── README.md
├── docker_hardening
├── ._CIS_Docker_1.13.0_Benchmark_v1.0.0.pdf
└── CIS_Docker_1.13.0_Benchmark_v1.0.0.pdf
├── linux_hardening
├── alpine_hardening
│ ├── ._CIS_Distribution_Independent_Linux_Benchmark_v1.0.1.pdf
│ ├── CIS_Distribution_Independent_Linux_Benchmark_v1.0.1.pdf
│ ├── README.md
│ └── alpineAudit.py
├── linux_other
│ ├── ._CIS_CentOS_Linux_7_Benchmark_v2.1.1.pdf
│ └── CIS_CentOS_Linux_7_Benchmark_v2.1.1.pdf
├── miscLinuxAudit.py
└── ubuntu_hardening
│ ├── ._CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0.pdf
│ ├── CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0.pdf
│ └── linuxAudit.py
├── mac_hardening
├── ._CIS_Apple_OSX_10.12_Benchmark_v1.0.0.pdf
├── CIS_Apple_OSX_10.12_Benchmark_v1.0.0.pdf
├── README.md
└── macAudit.py
└── windows_hardening
├── ._CIS_Microsoft_Windows_10_Enterprise_Release_1607_Benchmark_v1.2.0.pdf
└── CIS_Microsoft_Windows_10_Enterprise_Release_1607_Benchmark_v1.2.0.pdf
/LICENSE:
--------------------------------------------------------------------------------
1 | GNU GENERAL PUBLIC LICENSE
2 | Version 3, 29 June 2007
3 |
4 | Copyright (C) 2007 Free Software Foundation, Inc.
5 | Everyone is permitted to copy and distribute verbatim copies
6 | of this license document, but changing it is not allowed.
7 |
8 | Preamble
9 |
10 | The GNU General Public License is a free, copyleft license for
11 | software and other kinds of works.
12 |
13 | The licenses for most software and other practical works are designed
14 | to take away your freedom to share and change the works. By contrast,
15 | the GNU General Public License is intended to guarantee your freedom to
16 | share and change all versions of a program--to make sure it remains free
17 | software for all its users. We, the Free Software Foundation, use the
18 | GNU General Public License for most of our software; it applies also to
19 | any other work released this way by its authors. You can apply it to
20 | your programs, too.
21 |
22 | When we speak of free software, we are referring to freedom, not
23 | price. Our General Public Licenses are designed to make sure that you
24 | have the freedom to distribute copies of free software (and charge for
25 | them if you wish), that you receive source code or can get it if you
26 | want it, that you can change the software or use pieces of it in new
27 | free programs, and that you know you can do these things.
28 |
29 | To protect your rights, we need to prevent others from denying you
30 | these rights or asking you to surrender the rights. Therefore, you have
31 | certain responsibilities if you distribute copies of the software, or if
32 | you modify it: responsibilities to respect the freedom of others.
33 |
34 | For example, if you distribute copies of such a program, whether
35 | gratis or for a fee, you must pass on to the recipients the same
36 | freedoms that you received. You must make sure that they, too, receive
37 | or can get the source code. And you must show them these terms so they
38 | know their rights.
39 |
40 | Developers that use the GNU GPL protect your rights with two steps:
41 | (1) assert copyright on the software, and (2) offer you this License
42 | giving you legal permission to copy, distribute and/or modify it.
43 |
44 | For the developers' and authors' protection, the GPL clearly explains
45 | that there is no warranty for this free software. For both users' and
46 | authors' sake, the GPL requires that modified versions be marked as
47 | changed, so that their problems will not be attributed erroneously to
48 | authors of previous versions.
49 |
50 | Some devices are designed to deny users access to install or run
51 | modified versions of the software inside them, although the manufacturer
52 | can do so. This is fundamentally incompatible with the aim of
53 | protecting users' freedom to change the software. The systematic
54 | pattern of such abuse occurs in the area of products for individuals to
55 | use, which is precisely where it is most unacceptable. Therefore, we
56 | have designed this version of the GPL to prohibit the practice for those
57 | products. If such problems arise substantially in other domains, we
58 | stand ready to extend this provision to those domains in future versions
59 | of the GPL, as needed to protect the freedom of users.
60 |
61 | Finally, every program is threatened constantly by software patents.
62 | States should not allow patents to restrict development and use of
63 | software on general-purpose computers, but in those that do, we wish to
64 | avoid the special danger that patents applied to a free program could
65 | make it effectively proprietary. To prevent this, the GPL assures that
66 | patents cannot be used to render the program non-free.
67 |
68 | The precise terms and conditions for copying, distribution and
69 | modification follow.
70 |
71 | TERMS AND CONDITIONS
72 |
73 | 0. Definitions.
74 |
75 | "This License" refers to version 3 of the GNU General Public License.
76 |
77 | "Copyright" also means copyright-like laws that apply to other kinds of
78 | works, such as semiconductor masks.
79 |
80 | "The Program" refers to any copyrightable work licensed under this
81 | License. Each licensee is addressed as "you". "Licensees" and
82 | "recipients" may be individuals or organizations.
83 |
84 | To "modify" a work means to copy from or adapt all or part of the work
85 | in a fashion requiring copyright permission, other than the making of an
86 | exact copy. The resulting work is called a "modified version" of the
87 | earlier work or a work "based on" the earlier work.
88 |
89 | A "covered work" means either the unmodified Program or a work based
90 | on the Program.
91 |
92 | To "propagate" a work means to do anything with it that, without
93 | permission, would make you directly or secondarily liable for
94 | infringement under applicable copyright law, except executing it on a
95 | computer or modifying a private copy. Propagation includes copying,
96 | distribution (with or without modification), making available to the
97 | public, and in some countries other activities as well.
98 |
99 | To "convey" a work means any kind of propagation that enables other
100 | parties to make or receive copies. Mere interaction with a user through
101 | a computer network, with no transfer of a copy, is not conveying.
102 |
103 | An interactive user interface displays "Appropriate Legal Notices"
104 | to the extent that it includes a convenient and prominently visible
105 | feature that (1) displays an appropriate copyright notice, and (2)
106 | tells the user that there is no warranty for the work (except to the
107 | extent that warranties are provided), that licensees may convey the
108 | work under this License, and how to view a copy of this License. If
109 | the interface presents a list of user commands or options, such as a
110 | menu, a prominent item in the list meets this criterion.
111 |
112 | 1. Source Code.
113 |
114 | The "source code" for a work means the preferred form of the work
115 | for making modifications to it. "Object code" means any non-source
116 | form of a work.
117 |
118 | A "Standard Interface" means an interface that either is an official
119 | standard defined by a recognized standards body, or, in the case of
120 | interfaces specified for a particular programming language, one that
121 | is widely used among developers working in that language.
122 |
123 | The "System Libraries" of an executable work include anything, other
124 | than the work as a whole, that (a) is included in the normal form of
125 | packaging a Major Component, but which is not part of that Major
126 | Component, and (b) serves only to enable use of the work with that
127 | Major Component, or to implement a Standard Interface for which an
128 | implementation is available to the public in source code form. A
129 | "Major Component", in this context, means a major essential component
130 | (kernel, window system, and so on) of the specific operating system
131 | (if any) on which the executable work runs, or a compiler used to
132 | produce the work, or an object code interpreter used to run it.
133 |
134 | The "Corresponding Source" for a work in object code form means all
135 | the source code needed to generate, install, and (for an executable
136 | work) run the object code and to modify the work, including scripts to
137 | control those activities. However, it does not include the work's
138 | System Libraries, or general-purpose tools or generally available free
139 | programs which are used unmodified in performing those activities but
140 | which are not part of the work. For example, Corresponding Source
141 | includes interface definition files associated with source files for
142 | the work, and the source code for shared libraries and dynamically
143 | linked subprograms that the work is specifically designed to require,
144 | such as by intimate data communication or control flow between those
145 | subprograms and other parts of the work.
146 |
147 | The Corresponding Source need not include anything that users
148 | can regenerate automatically from other parts of the Corresponding
149 | Source.
150 |
151 | The Corresponding Source for a work in source code form is that
152 | same work.
153 |
154 | 2. Basic Permissions.
155 |
156 | All rights granted under this License are granted for the term of
157 | copyright on the Program, and are irrevocable provided the stated
158 | conditions are met. This License explicitly affirms your unlimited
159 | permission to run the unmodified Program. The output from running a
160 | covered work is covered by this License only if the output, given its
161 | content, constitutes a covered work. This License acknowledges your
162 | rights of fair use or other equivalent, as provided by copyright law.
163 |
164 | You may make, run and propagate covered works that you do not
165 | convey, without conditions so long as your license otherwise remains
166 | in force. You may convey covered works to others for the sole purpose
167 | of having them make modifications exclusively for you, or provide you
168 | with facilities for running those works, provided that you comply with
169 | the terms of this License in conveying all material for which you do
170 | not control copyright. Those thus making or running the covered works
171 | for you must do so exclusively on your behalf, under your direction
172 | and control, on terms that prohibit them from making any copies of
173 | your copyrighted material outside their relationship with you.
174 |
175 | Conveying under any other circumstances is permitted solely under
176 | the conditions stated below. Sublicensing is not allowed; section 10
177 | makes it unnecessary.
178 |
179 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
180 |
181 | No covered work shall be deemed part of an effective technological
182 | measure under any applicable law fulfilling obligations under article
183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or
184 | similar laws prohibiting or restricting circumvention of such
185 | measures.
186 |
187 | When you convey a covered work, you waive any legal power to forbid
188 | circumvention of technological measures to the extent such circumvention
189 | is effected by exercising rights under this License with respect to
190 | the covered work, and you disclaim any intention to limit operation or
191 | modification of the work as a means of enforcing, against the work's
192 | users, your or third parties' legal rights to forbid circumvention of
193 | technological measures.
194 |
195 | 4. Conveying Verbatim Copies.
196 |
197 | You may convey verbatim copies of the Program's source code as you
198 | receive it, in any medium, provided that you conspicuously and
199 | appropriately publish on each copy an appropriate copyright notice;
200 | keep intact all notices stating that this License and any
201 | non-permissive terms added in accord with section 7 apply to the code;
202 | keep intact all notices of the absence of any warranty; and give all
203 | recipients a copy of this License along with the Program.
204 |
205 | You may charge any price or no price for each copy that you convey,
206 | and you may offer support or warranty protection for a fee.
207 |
208 | 5. Conveying Modified Source Versions.
209 |
210 | You may convey a work based on the Program, or the modifications to
211 | produce it from the Program, in the form of source code under the
212 | terms of section 4, provided that you also meet all of these conditions:
213 |
214 | a) The work must carry prominent notices stating that you modified
215 | it, and giving a relevant date.
216 |
217 | b) The work must carry prominent notices stating that it is
218 | released under this License and any conditions added under section
219 | 7. This requirement modifies the requirement in section 4 to
220 | "keep intact all notices".
221 |
222 | c) You must license the entire work, as a whole, under this
223 | License to anyone who comes into possession of a copy. This
224 | License will therefore apply, along with any applicable section 7
225 | additional terms, to the whole of the work, and all its parts,
226 | regardless of how they are packaged. This License gives no
227 | permission to license the work in any other way, but it does not
228 | invalidate such permission if you have separately received it.
229 |
230 | d) If the work has interactive user interfaces, each must display
231 | Appropriate Legal Notices; however, if the Program has interactive
232 | interfaces that do not display Appropriate Legal Notices, your
233 | work need not make them do so.
234 |
235 | A compilation of a covered work with other separate and independent
236 | works, which are not by their nature extensions of the covered work,
237 | and which are not combined with it such as to form a larger program,
238 | in or on a volume of a storage or distribution medium, is called an
239 | "aggregate" if the compilation and its resulting copyright are not
240 | used to limit the access or legal rights of the compilation's users
241 | beyond what the individual works permit. Inclusion of a covered work
242 | in an aggregate does not cause this License to apply to the other
243 | parts of the aggregate.
244 |
245 | 6. Conveying Non-Source Forms.
246 |
247 | You may convey a covered work in object code form under the terms
248 | of sections 4 and 5, provided that you also convey the
249 | machine-readable Corresponding Source under the terms of this License,
250 | in one of these ways:
251 |
252 | a) Convey the object code in, or embodied in, a physical product
253 | (including a physical distribution medium), accompanied by the
254 | Corresponding Source fixed on a durable physical medium
255 | customarily used for software interchange.
256 |
257 | b) Convey the object code in, or embodied in, a physical product
258 | (including a physical distribution medium), accompanied by a
259 | written offer, valid for at least three years and valid for as
260 | long as you offer spare parts or customer support for that product
261 | model, to give anyone who possesses the object code either (1) a
262 | copy of the Corresponding Source for all the software in the
263 | product that is covered by this License, on a durable physical
264 | medium customarily used for software interchange, for a price no
265 | more than your reasonable cost of physically performing this
266 | conveying of source, or (2) access to copy the
267 | Corresponding Source from a network server at no charge.
268 |
269 | c) Convey individual copies of the object code with a copy of the
270 | written offer to provide the Corresponding Source. This
271 | alternative is allowed only occasionally and noncommercially, and
272 | only if you received the object code with such an offer, in accord
273 | with subsection 6b.
274 |
275 | d) Convey the object code by offering access from a designated
276 | place (gratis or for a charge), and offer equivalent access to the
277 | Corresponding Source in the same way through the same place at no
278 | further charge. You need not require recipients to copy the
279 | Corresponding Source along with the object code. If the place to
280 | copy the object code is a network server, the Corresponding Source
281 | may be on a different server (operated by you or a third party)
282 | that supports equivalent copying facilities, provided you maintain
283 | clear directions next to the object code saying where to find the
284 | Corresponding Source. Regardless of what server hosts the
285 | Corresponding Source, you remain obligated to ensure that it is
286 | available for as long as needed to satisfy these requirements.
287 |
288 | e) Convey the object code using peer-to-peer transmission, provided
289 | you inform other peers where the object code and Corresponding
290 | Source of the work are being offered to the general public at no
291 | charge under subsection 6d.
292 |
293 | A separable portion of the object code, whose source code is excluded
294 | from the Corresponding Source as a System Library, need not be
295 | included in conveying the object code work.
296 |
297 | A "User Product" is either (1) a "consumer product", which means any
298 | tangible personal property which is normally used for personal, family,
299 | or household purposes, or (2) anything designed or sold for incorporation
300 | into a dwelling. In determining whether a product is a consumer product,
301 | doubtful cases shall be resolved in favor of coverage. For a particular
302 | product received by a particular user, "normally used" refers to a
303 | typical or common use of that class of product, regardless of the status
304 | of the particular user or of the way in which the particular user
305 | actually uses, or expects or is expected to use, the product. A product
306 | is a consumer product regardless of whether the product has substantial
307 | commercial, industrial or non-consumer uses, unless such uses represent
308 | the only significant mode of use of the product.
309 |
310 | "Installation Information" for a User Product means any methods,
311 | procedures, authorization keys, or other information required to install
312 | and execute modified versions of a covered work in that User Product from
313 | a modified version of its Corresponding Source. The information must
314 | suffice to ensure that the continued functioning of the modified object
315 | code is in no case prevented or interfered with solely because
316 | modification has been made.
317 |
318 | If you convey an object code work under this section in, or with, or
319 | specifically for use in, a User Product, and the conveying occurs as
320 | part of a transaction in which the right of possession and use of the
321 | User Product is transferred to the recipient in perpetuity or for a
322 | fixed term (regardless of how the transaction is characterized), the
323 | Corresponding Source conveyed under this section must be accompanied
324 | by the Installation Information. But this requirement does not apply
325 | if neither you nor any third party retains the ability to install
326 | modified object code on the User Product (for example, the work has
327 | been installed in ROM).
328 |
329 | The requirement to provide Installation Information does not include a
330 | requirement to continue to provide support service, warranty, or updates
331 | for a work that has been modified or installed by the recipient, or for
332 | the User Product in which it has been modified or installed. Access to a
333 | network may be denied when the modification itself materially and
334 | adversely affects the operation of the network or violates the rules and
335 | protocols for communication across the network.
336 |
337 | Corresponding Source conveyed, and Installation Information provided,
338 | in accord with this section must be in a format that is publicly
339 | documented (and with an implementation available to the public in
340 | source code form), and must require no special password or key for
341 | unpacking, reading or copying.
342 |
343 | 7. Additional Terms.
344 |
345 | "Additional permissions" are terms that supplement the terms of this
346 | License by making exceptions from one or more of its conditions.
347 | Additional permissions that are applicable to the entire Program shall
348 | be treated as though they were included in this License, to the extent
349 | that they are valid under applicable law. If additional permissions
350 | apply only to part of the Program, that part may be used separately
351 | under those permissions, but the entire Program remains governed by
352 | this License without regard to the additional permissions.
353 |
354 | When you convey a copy of a covered work, you may at your option
355 | remove any additional permissions from that copy, or from any part of
356 | it. (Additional permissions may be written to require their own
357 | removal in certain cases when you modify the work.) You may place
358 | additional permissions on material, added by you to a covered work,
359 | for which you have or can give appropriate copyright permission.
360 |
361 | Notwithstanding any other provision of this License, for material you
362 | add to a covered work, you may (if authorized by the copyright holders of
363 | that material) supplement the terms of this License with terms:
364 |
365 | a) Disclaiming warranty or limiting liability differently from the
366 | terms of sections 15 and 16 of this License; or
367 |
368 | b) Requiring preservation of specified reasonable legal notices or
369 | author attributions in that material or in the Appropriate Legal
370 | Notices displayed by works containing it; or
371 |
372 | c) Prohibiting misrepresentation of the origin of that material, or
373 | requiring that modified versions of such material be marked in
374 | reasonable ways as different from the original version; or
375 |
376 | d) Limiting the use for publicity purposes of names of licensors or
377 | authors of the material; or
378 |
379 | e) Declining to grant rights under trademark law for use of some
380 | trade names, trademarks, or service marks; or
381 |
382 | f) Requiring indemnification of licensors and authors of that
383 | material by anyone who conveys the material (or modified versions of
384 | it) with contractual assumptions of liability to the recipient, for
385 | any liability that these contractual assumptions directly impose on
386 | those licensors and authors.
387 |
388 | All other non-permissive additional terms are considered "further
389 | restrictions" within the meaning of section 10. If the Program as you
390 | received it, or any part of it, contains a notice stating that it is
391 | governed by this License along with a term that is a further
392 | restriction, you may remove that term. If a license document contains
393 | a further restriction but permits relicensing or conveying under this
394 | License, you may add to a covered work material governed by the terms
395 | of that license document, provided that the further restriction does
396 | not survive such relicensing or conveying.
397 |
398 | If you add terms to a covered work in accord with this section, you
399 | must place, in the relevant source files, a statement of the
400 | additional terms that apply to those files, or a notice indicating
401 | where to find the applicable terms.
402 |
403 | Additional terms, permissive or non-permissive, may be stated in the
404 | form of a separately written license, or stated as exceptions;
405 | the above requirements apply either way.
406 |
407 | 8. Termination.
408 |
409 | You may not propagate or modify a covered work except as expressly
410 | provided under this License. Any attempt otherwise to propagate or
411 | modify it is void, and will automatically terminate your rights under
412 | this License (including any patent licenses granted under the third
413 | paragraph of section 11).
414 |
415 | However, if you cease all violation of this License, then your
416 | license from a particular copyright holder is reinstated (a)
417 | provisionally, unless and until the copyright holder explicitly and
418 | finally terminates your license, and (b) permanently, if the copyright
419 | holder fails to notify you of the violation by some reasonable means
420 | prior to 60 days after the cessation.
421 |
422 | Moreover, your license from a particular copyright holder is
423 | reinstated permanently if the copyright holder notifies you of the
424 | violation by some reasonable means, this is the first time you have
425 | received notice of violation of this License (for any work) from that
426 | copyright holder, and you cure the violation prior to 30 days after
427 | your receipt of the notice.
428 |
429 | Termination of your rights under this section does not terminate the
430 | licenses of parties who have received copies or rights from you under
431 | this License. If your rights have been terminated and not permanently
432 | reinstated, you do not qualify to receive new licenses for the same
433 | material under section 10.
434 |
435 | 9. Acceptance Not Required for Having Copies.
436 |
437 | You are not required to accept this License in order to receive or
438 | run a copy of the Program. Ancillary propagation of a covered work
439 | occurring solely as a consequence of using peer-to-peer transmission
440 | to receive a copy likewise does not require acceptance. However,
441 | nothing other than this License grants you permission to propagate or
442 | modify any covered work. These actions infringe copyright if you do
443 | not accept this License. Therefore, by modifying or propagating a
444 | covered work, you indicate your acceptance of this License to do so.
445 |
446 | 10. Automatic Licensing of Downstream Recipients.
447 |
448 | Each time you convey a covered work, the recipient automatically
449 | receives a license from the original licensors, to run, modify and
450 | propagate that work, subject to this License. You are not responsible
451 | for enforcing compliance by third parties with this License.
452 |
453 | An "entity transaction" is a transaction transferring control of an
454 | organization, or substantially all assets of one, or subdividing an
455 | organization, or merging organizations. If propagation of a covered
456 | work results from an entity transaction, each party to that
457 | transaction who receives a copy of the work also receives whatever
458 | licenses to the work the party's predecessor in interest had or could
459 | give under the previous paragraph, plus a right to possession of the
460 | Corresponding Source of the work from the predecessor in interest, if
461 | the predecessor has it or can get it with reasonable efforts.
462 |
463 | You may not impose any further restrictions on the exercise of the
464 | rights granted or affirmed under this License. For example, you may
465 | not impose a license fee, royalty, or other charge for exercise of
466 | rights granted under this License, and you may not initiate litigation
467 | (including a cross-claim or counterclaim in a lawsuit) alleging that
468 | any patent claim is infringed by making, using, selling, offering for
469 | sale, or importing the Program or any portion of it.
470 |
471 | 11. Patents.
472 |
473 | A "contributor" is a copyright holder who authorizes use under this
474 | License of the Program or a work on which the Program is based. The
475 | work thus licensed is called the contributor's "contributor version".
476 |
477 | A contributor's "essential patent claims" are all patent claims
478 | owned or controlled by the contributor, whether already acquired or
479 | hereafter acquired, that would be infringed by some manner, permitted
480 | by this License, of making, using, or selling its contributor version,
481 | but do not include claims that would be infringed only as a
482 | consequence of further modification of the contributor version. For
483 | purposes of this definition, "control" includes the right to grant
484 | patent sublicenses in a manner consistent with the requirements of
485 | this License.
486 |
487 | Each contributor grants you a non-exclusive, worldwide, royalty-free
488 | patent license under the contributor's essential patent claims, to
489 | make, use, sell, offer for sale, import and otherwise run, modify and
490 | propagate the contents of its contributor version.
491 |
492 | In the following three paragraphs, a "patent license" is any express
493 | agreement or commitment, however denominated, not to enforce a patent
494 | (such as an express permission to practice a patent or covenant not to
495 | sue for patent infringement). To "grant" such a patent license to a
496 | party means to make such an agreement or commitment not to enforce a
497 | patent against the party.
498 |
499 | If you convey a covered work, knowingly relying on a patent license,
500 | and the Corresponding Source of the work is not available for anyone
501 | to copy, free of charge and under the terms of this License, through a
502 | publicly available network server or other readily accessible means,
503 | then you must either (1) cause the Corresponding Source to be so
504 | available, or (2) arrange to deprive yourself of the benefit of the
505 | patent license for this particular work, or (3) arrange, in a manner
506 | consistent with the requirements of this License, to extend the patent
507 | license to downstream recipients. "Knowingly relying" means you have
508 | actual knowledge that, but for the patent license, your conveying the
509 | covered work in a country, or your recipient's use of the covered work
510 | in a country, would infringe one or more identifiable patents in that
511 | country that you have reason to believe are valid.
512 |
513 | If, pursuant to or in connection with a single transaction or
514 | arrangement, you convey, or propagate by procuring conveyance of, a
515 | covered work, and grant a patent license to some of the parties
516 | receiving the covered work authorizing them to use, propagate, modify
517 | or convey a specific copy of the covered work, then the patent license
518 | you grant is automatically extended to all recipients of the covered
519 | work and works based on it.
520 |
521 | A patent license is "discriminatory" if it does not include within
522 | the scope of its coverage, prohibits the exercise of, or is
523 | conditioned on the non-exercise of one or more of the rights that are
524 | specifically granted under this License. You may not convey a covered
525 | work if you are a party to an arrangement with a third party that is
526 | in the business of distributing software, under which you make payment
527 | to the third party based on the extent of your activity of conveying
528 | the work, and under which the third party grants, to any of the
529 | parties who would receive the covered work from you, a discriminatory
530 | patent license (a) in connection with copies of the covered work
531 | conveyed by you (or copies made from those copies), or (b) primarily
532 | for and in connection with specific products or compilations that
533 | contain the covered work, unless you entered into that arrangement,
534 | or that patent license was granted, prior to 28 March 2007.
535 |
536 | Nothing in this License shall be construed as excluding or limiting
537 | any implied license or other defenses to infringement that may
538 | otherwise be available to you under applicable patent law.
539 |
540 | 12. No Surrender of Others' Freedom.
541 |
542 | If conditions are imposed on you (whether by court order, agreement or
543 | otherwise) that contradict the conditions of this License, they do not
544 | excuse you from the conditions of this License. If you cannot convey a
545 | covered work so as to satisfy simultaneously your obligations under this
546 | License and any other pertinent obligations, then as a consequence you may
547 | not convey it at all. For example, if you agree to terms that obligate you
548 | to collect a royalty for further conveying from those to whom you convey
549 | the Program, the only way you could satisfy both those terms and this
550 | License would be to refrain entirely from conveying the Program.
551 |
552 | 13. Use with the GNU Affero General Public License.
553 |
554 | Notwithstanding any other provision of this License, you have
555 | permission to link or combine any covered work with a work licensed
556 | under version 3 of the GNU Affero General Public License into a single
557 | combined work, and to convey the resulting work. The terms of this
558 | License will continue to apply to the part which is the covered work,
559 | but the special requirements of the GNU Affero General Public License,
560 | section 13, concerning interaction through a network will apply to the
561 | combination as such.
562 |
563 | 14. Revised Versions of this License.
564 |
565 | The Free Software Foundation may publish revised and/or new versions of
566 | the GNU General Public License from time to time. Such new versions will
567 | be similar in spirit to the present version, but may differ in detail to
568 | address new problems or concerns.
569 |
570 | Each version is given a distinguishing version number. If the
571 | Program specifies that a certain numbered version of the GNU General
572 | Public License "or any later version" applies to it, you have the
573 | option of following the terms and conditions either of that numbered
574 | version or of any later version published by the Free Software
575 | Foundation. If the Program does not specify a version number of the
576 | GNU General Public License, you may choose any version ever published
577 | by the Free Software Foundation.
578 |
579 | If the Program specifies that a proxy can decide which future
580 | versions of the GNU General Public License can be used, that proxy's
581 | public statement of acceptance of a version permanently authorizes you
582 | to choose that version for the Program.
583 |
584 | Later license versions may give you additional or different
585 | permissions. However, no additional obligations are imposed on any
586 | author or copyright holder as a result of your choosing to follow a
587 | later version.
588 |
589 | 15. Disclaimer of Warranty.
590 |
591 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
592 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
596 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
597 | IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
599 |
600 | 16. Limitation of Liability.
601 |
602 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
610 | SUCH DAMAGES.
611 |
612 | 17. Interpretation of Sections 15 and 16.
613 |
614 | If the disclaimer of warranty and limitation of liability provided
615 | above cannot be given local legal effect according to their terms,
616 | reviewing courts shall apply local law that most closely approximates
617 | an absolute waiver of all civil liability in connection with the
618 | Program, unless a warranty or assumption of liability accompanies a
619 | copy of the Program in return for a fee.
620 |
621 | END OF TERMS AND CONDITIONS
622 |
623 | How to Apply These Terms to Your New Programs
624 |
625 | If you develop a new program, and you want it to be of the greatest
626 | possible use to the public, the best way to achieve this is to make it
627 | free software which everyone can redistribute and change under these terms.
628 |
629 | To do so, attach the following notices to the program. It is safest
630 | to attach them to the start of each source file to most effectively
631 | state the exclusion of warranty; and each file should have at least
632 | the "copyright" line and a pointer to where the full notice is found.
633 |
634 | {one line to give the program's name and a brief idea of what it does.}
635 | Copyright (C) {year} {name of author}
636 |
637 | This program is free software: you can redistribute it and/or modify
638 | it under the terms of the GNU General Public License as published by
639 | the Free Software Foundation, either version 3 of the License, or
640 | (at your option) any later version.
641 |
642 | This program is distributed in the hope that it will be useful,
643 | but WITHOUT ANY WARRANTY; without even the implied warranty of
644 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
645 | GNU General Public License for more details.
646 |
647 | You should have received a copy of the GNU General Public License
648 | along with this program. If not, see .
649 |
650 | Also add information on how to contact you by electronic and paper mail.
651 |
652 | If the program does terminal interaction, make it output a short
653 | notice like this when it starts in an interactive mode:
654 |
655 | {project} Copyright (C) {year} {fullname}
656 | This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
657 | This is free software, and you are welcome to redistribute it
658 | under certain conditions; type `show c' for details.
659 |
660 | The hypothetical commands `show w' and `show c' should show the appropriate
661 | parts of the General Public License. Of course, your program's commands
662 | might be different; for a GUI interface, you would use an "about box".
663 |
664 | You should also get your employer (if you work as a programmer) or school,
665 | if any, to sign a "copyright disclaimer" for the program, if necessary.
666 | For more information on this, and how to apply and follow the GNU GPL, see
667 | .
668 |
669 | The GNU General Public License does not permit incorporating your program
670 | into proprietary programs. If your program is a subroutine library, you
671 | may consider it more useful to permit linking proprietary applications with
672 | the library. If this is what you want to do, use the GNU Lesser General
673 | Public License instead of this License. But first, please read
674 | .
675 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # CISBenchmarks
2 | Hardening audit scripts validating Workstations and Servers based on CIS benchmarks
3 |
4 | Center for Internet Security (CIS), http://benchmarks.cisecurity.org
5 |
6 | CIS Bechmarks are based on
7 | -Install Updates, Patches and Additional Security Software
8 | -System Preferences
9 | -Logging and Auditing
10 | -Network Configurations
11 | -System Access, Authentication and Authorization
12 | -User Accounts and Environment
13 | -Additional Considerations
14 |
15 |
16 |
--------------------------------------------------------------------------------
/docker_hardening/._CIS_Docker_1.13.0_Benchmark_v1.0.0.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/praveendhac/CISBenchmarks/15e48d342e635196e225a7b9386f70ca1f86eafd/docker_hardening/._CIS_Docker_1.13.0_Benchmark_v1.0.0.pdf
--------------------------------------------------------------------------------
/docker_hardening/CIS_Docker_1.13.0_Benchmark_v1.0.0.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/praveendhac/CISBenchmarks/15e48d342e635196e225a7b9386f70ca1f86eafd/docker_hardening/CIS_Docker_1.13.0_Benchmark_v1.0.0.pdf
--------------------------------------------------------------------------------
/linux_hardening/alpine_hardening/._CIS_Distribution_Independent_Linux_Benchmark_v1.0.1.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/praveendhac/CISBenchmarks/15e48d342e635196e225a7b9386f70ca1f86eafd/linux_hardening/alpine_hardening/._CIS_Distribution_Independent_Linux_Benchmark_v1.0.1.pdf
--------------------------------------------------------------------------------
/linux_hardening/alpine_hardening/CIS_Distribution_Independent_Linux_Benchmark_v1.0.1.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/praveendhac/CISBenchmarks/15e48d342e635196e225a7b9386f70ca1f86eafd/linux_hardening/alpine_hardening/CIS_Distribution_Independent_Linux_Benchmark_v1.0.1.pdf
--------------------------------------------------------------------------------
/linux_hardening/alpine_hardening/README.md:
--------------------------------------------------------------------------------
1 | Hardening audit scripts validating Workstations and Servers based on CIS benchmarks
2 | Center for Internet Security (CIS), http://benchmarks.cisecurity.org
3 |
4 | **Scored**
5 | Failure to comply with "Scored" recommendations will decrease the final benchmark score. Compliance with "Scored" recommendations will increase the final benchmark score.
6 | **Not Scored**
7 | Failure to comply with "Not Scored" recommendations will not decrease the final benchmark score. Compliance with "Not Scored" recommendations will not increase the final benchmark score.
8 |
9 | **Level 1 - Server**
10 | Items in this profile intend to:
11 | o be practical and prudent;
12 | o provide a clear security benefit; and
13 | o not inhibit the utility of the technology beyond acceptable means.
14 | This profile is intended for servers.
15 | **Level 2 - Server**
16 | This profile extends the "Level 1 - Server" profile. Items in this profile exhibit one or more of the following characteristics:
17 | o are intended for environments or use cases where security is paramount.
18 | o acts as defense in depth measure.
19 | o may negatively inhibit the utility or performance of the technology.
20 | This profile is intended for servers.
21 | **Level 1 - Workstation**
22 | Items in this profile intend to:
23 | o be practical and prudent;
24 | o provide a clear security benefit; and
25 | o not inhibit the utility of the technology beyond acceptable means.
26 | This profile is intended for workstations.
27 | **Level 2 - Workstation**
28 | This profile extends the "Level 1 - Workstation" profile. Items in this profile exhibit one or more of the following characteristics:
29 | o are intended for environments or use cases where security is paramount.
30 | o acts as defense in depth measure.
31 | o may negatively inhibit the utility or performance of the technology.
32 | This profile is intended for workstations.
33 |
34 | Bechmarks are based on
35 | **Initial Setup**
36 | Filesystem Configuration
37 | Configure Software Updates
38 | Filesystem Integrity Checking
39 | Secure Boot Settings
40 | Additional Process Hardening
41 | Mandatory Access Control
42 | Warning Banners
43 | **Services**
44 | inetd Services
45 | Special Purpose Services
46 | Service Clients
47 | **Network Configuration**
48 | Network Parameters (Host Only)
49 | Network Parameters (Host and Router)
50 | IPv6
51 | TCP Wrappers
52 | Uncommon Network Protocols
53 | Firewall Configuration
54 | **Logging and Auditing**
55 | Configure System Accounting (auditd)
56 | Configure Logging
57 | **Access, Authentication and Authorization**
58 | Configure cron
59 | SSH Server Configuration
60 | Configure PAM
61 | User Accounts and Environment
62 | **System Maintenance**
63 | System File Permissions
64 | User and Group Settings
65 |
66 |
--------------------------------------------------------------------------------
/linux_hardening/linux_other/._CIS_CentOS_Linux_7_Benchmark_v2.1.1.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/praveendhac/CISBenchmarks/15e48d342e635196e225a7b9386f70ca1f86eafd/linux_hardening/linux_other/._CIS_CentOS_Linux_7_Benchmark_v2.1.1.pdf
--------------------------------------------------------------------------------
/linux_hardening/linux_other/CIS_CentOS_Linux_7_Benchmark_v2.1.1.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/praveendhac/CISBenchmarks/15e48d342e635196e225a7b9386f70ca1f86eafd/linux_hardening/linux_other/CIS_CentOS_Linux_7_Benchmark_v2.1.1.pdf
--------------------------------------------------------------------------------
/linux_hardening/ubuntu_hardening/._CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/praveendhac/CISBenchmarks/15e48d342e635196e225a7b9386f70ca1f86eafd/linux_hardening/ubuntu_hardening/._CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0.pdf
--------------------------------------------------------------------------------
/linux_hardening/ubuntu_hardening/CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/praveendhac/CISBenchmarks/15e48d342e635196e225a7b9386f70ca1f86eafd/linux_hardening/ubuntu_hardening/CIS_Ubuntu_Linux_16.04_LTS_Benchmark_v1.0.0.pdf
--------------------------------------------------------------------------------
/linux_hardening/ubuntu_hardening/linuxAudit.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/python
2 |
3 | import os, sys, time, re
4 | import argparse
5 | import subprocess
6 |
7 | #Scored - Success/Failure to comply will incerease/decrease the final benchmark score
8 | #Not Scored - Failure to comply will not decrease the final benchmark score. Compliance will not increase the score.
9 | #Level 1 Server - general requirement
10 | #Level 1 Workstation - general requirement
11 | #Level 2 Server - required where security is paramount. Extends Level 1 profile
12 | #Level 2 Workstation - required where security is paramount. Extends Level 1 profile
13 |
14 | total_compliances = 0
15 | compliant_count = 0
16 |
17 | def update_compliance_status(compliance_check, compliance_status):
18 | global total_compliances
19 | total_compliances +=1
20 | CRED = '\33[31m'
21 | CGREEN = '\33[32m'
22 | CEND = '\33[0m'
23 |
24 | if args.nocolor:
25 | print compliance_check + ": " + compliance_status
26 | else:
27 | if "NON-" in compliance_status:
28 | print compliance_check + ": " + CRED + compliance_status + CEND
29 | else:
30 | print compliance_check + ": " + CGREEN + compliance_status + CEND
31 | return
32 |
33 | def exec_command(cmd):
34 | global total_compliances
35 | global compliant_count
36 | try:
37 | out = subprocess.check_output(cmd,stderr=subprocess.STDOUT,shell=True)
38 | except:
39 | out = "EXCEPTION. Command execution failed or no output"
40 | return out
41 |
42 | def verbose_logs(info_str, op):
43 | if args.verbose:
44 | print info_str +": "+ op
45 | return
46 |
47 | def filesystem_config():
48 | global compliant_count
49 |
50 | compliance_check = "(Not Scored, Level 1)"
51 | cmd = ""
52 | n = exec_command(cmd)
53 | verbose_logs("Command used", cmd)
54 | verbose_logs("Command Output", is_sw_uptodate)
55 | verbose_logs("Expected output to be compliant","")
56 | verbose_logs("To be compliant, run","")
57 |
58 | compliance_check = "(Not Scored, Level 1)"
59 | cmd = ""
60 | n = exec_command(cmd)
61 | verbose_logs("Command used", cmd)
62 | verbose_logs("Command Output", is_sw_uptodate)
63 | verbose_logs("Expected output to be compliant","")
64 | verbose_logs("To be compliant, run","")
65 |
66 | compliance_check = "(Not Scored, Level 1)"
67 | cmd = ""
68 | n = exec_command(cmd)
69 | verbose_logs("Command used", cmd)
70 | verbose_logs("Command Output", is_sw_uptodate)
71 | verbose_logs("Expected output to be compliant","")
72 | verbose_logs("To be compliant, run","")
73 |
74 | compliance_check = "(Not Scored, Level 1)"
75 | cmd = ""
76 | n = exec_command(cmd)
77 | verbose_logs("Command used", cmd)
78 | verbose_logs("Command Output", is_sw_uptodate)
79 | verbose_logs("Expected output to be compliant","")
80 | verbose_logs("To be compliant, run","")
81 |
82 | compliance_check = "(Not Scored, Level 1)"
83 | cmd = ""
84 | n = exec_command(cmd)
85 | verbose_logs("Command used", cmd)
86 | verbose_logs("Command Output", is_sw_uptodate)
87 | verbose_logs("Expected output to be compliant","")
88 | verbose_logs("To be compliant, run","")
89 |
90 | compliance_check = "(Not Scored, Level 1)"
91 | cmd = ""
92 | n = exec_command(cmd)
93 | verbose_logs("Command used", cmd)
94 | verbose_logs("Command Output", is_sw_uptodate)
95 | verbose_logs("Expected output to be compliant","")
96 | verbose_logs("To be compliant, run","")
97 |
98 | compliance_check = "(Not Scored, Level 1)"
99 | cmd = ""
100 | n = exec_command(cmd)
101 | verbose_logs("Command used", cmd)
102 | verbose_logs("Command Output", is_sw_uptodate)
103 | verbose_logs("Expected output to be compliant","")
104 | verbose_logs("To be compliant, run","")
105 |
106 | compliance_check = "(Not Scored, Level 1)"
107 | cmd = ""
108 | n = exec_command(cmd)
109 | verbose_logs("Command used", cmd)
110 | verbose_logs("Command Output", is_sw_uptodate)
111 | verbose_logs("Expected output to be compliant","")
112 | verbose_logs("To be compliant, run","")
113 |
114 | compliance_check = "(Not Scored, Level 1)"
115 | cmd = ""
116 | n = exec_command(cmd)
117 | verbose_logs("Command used", cmd)
118 | verbose_logs("Command Output", is_sw_uptodate)
119 | verbose_logs("Expected output to be compliant","")
120 | verbose_logs("To be compliant, run","")
121 |
122 | compliance_check = "(Not Scored, Level 1)"
123 | cmd = ""
124 | n = exec_command(cmd)
125 | verbose_logs("Command used", cmd)
126 | verbose_logs("Command Output", is_sw_uptodate)
127 | verbose_logs("Expected output to be compliant","")
128 | verbose_logs("To be compliant, run","")
129 |
130 | compliance_check = "(Not Scored, Level 1)"
131 | cmd = ""
132 | n = exec_command(cmd)
133 | verbose_logs("Command used", cmd)
134 | verbose_logs("Command Output", is_sw_uptodate)
135 | verbose_logs("Expected output to be compliant","")
136 | verbose_logs("To be compliant, run","")
137 |
138 | compliance_check = "(Not Scored, Level 1)"
139 | cmd = ""
140 | n = exec_command(cmd)
141 | verbose_logs("Command used", cmd)
142 | verbose_logs("Command Output", is_sw_uptodate)
143 | verbose_logs("Expected output to be compliant","")
144 | verbose_logs("To be compliant, run","")
145 |
146 | compliance_check = "(Not Scored, Level 1)"
147 | cmd = ""
148 | n = exec_command(cmd)
149 | verbose_logs("Command used", cmd)
150 | verbose_logs("Command Output", is_sw_uptodate)
151 | verbose_logs("Expected output to be compliant","")
152 | verbose_logs("To be compliant, run","")
153 |
154 | compliance_check = "(Not Scored, Level 1)"
155 | cmd = ""
156 | n = exec_command(cmd)
157 | verbose_logs("Command used", cmd)
158 | verbose_logs("Command Output", is_sw_uptodate)
159 | verbose_logs("Expected output to be compliant","")
160 | verbose_logs("To be compliant, run","")
161 |
162 | compliance_check = "(Not Scored, Level 1)"
163 | cmd = ""
164 | n = exec_command(cmd)
165 | verbose_logs("Command used", cmd)
166 | verbose_logs("Command Output", is_sw_uptodate)
167 | verbose_logs("Expected output to be compliant","")
168 | verbose_logs("To be compliant, run","")
169 |
170 | compliance_check = "(Not Scored, Level 1)"
171 | cmd = ""
172 | n = exec_command(cmd)
173 | verbose_logs("Command used", cmd)
174 | verbose_logs("Command Output", is_sw_uptodate)
175 | verbose_logs("Expected output to be compliant","")
176 | verbose_logs("To be compliant, run","")
177 |
178 | compliance_check = "(Not Scored, Level 1)"
179 | cmd = ""
180 | n = exec_command(cmd)
181 | verbose_logs("Command used", cmd)
182 | verbose_logs("Command Output", is_sw_uptodate)
183 | verbose_logs("Expected output to be compliant","")
184 | verbose_logs("To be compliant, run","")
185 |
186 | compliance_check = "(Not Scored, Level 1)"
187 | cmd = ""
188 | n = exec_command(cmd)
189 | verbose_logs("Command used", cmd)
190 | verbose_logs("Command Output", is_sw_uptodate)
191 | verbose_logs("Expected output to be compliant","")
192 | verbose_logs("To be compliant, run","")
193 |
194 | compliance_check = "(Not Scored, Level 1)"
195 | cmd = ""
196 | n = exec_command(cmd)
197 | verbose_logs("Command used", cmd)
198 | verbose_logs("Command Output", is_sw_uptodate)
199 | verbose_logs("Expected output to be compliant","")
200 | verbose_logs("To be compliant, run","")
201 |
202 | compliance_check = "(Not Scored, Level 1)"
203 | cmd = ""
204 | n = exec_command(cmd)
205 | verbose_logs("Command used", cmd)
206 | verbose_logs("Command Output", is_sw_uptodate)
207 | verbose_logs("Expected output to be compliant","")
208 | verbose_logs("To be compliant, run","")
209 |
210 | compliance_check = "(Not Scored, Level 1)"
211 | cmd = ""
212 | n = exec_command(cmd)
213 | verbose_logs("Command used", cmd)
214 | verbose_logs("Command Output", is_sw_uptodate)
215 | verbose_logs("Expected output to be compliant","")
216 | verbose_logs("To be compliant, run","")
217 |
218 | compliance_check = "(Not Scored, Level 1)"
219 | cmd = ""
220 | n = exec_command(cmd)
221 | verbose_logs("Command used", cmd)
222 | verbose_logs("Command Output", is_sw_uptodate)
223 | verbose_logs("Expected output to be compliant","")
224 | verbose_logs("To be compliant, run","")
225 |
226 | def config_swUpdates():
227 | global compliant_count
228 | compliance_check = "(Not Scored, Level 1)"
229 | cmd = ""
230 | n = exec_command(cmd)
231 | verbose_logs("Command used", cmd)
232 | verbose_logs("Command Output", is_sw_uptodate)
233 | verbose_logs("Expected output to be compliant","")
234 | verbose_logs("To be compliant, run","")
235 |
236 | compliance_check = "(Not Scored, Level 1)"
237 | cmd = ""
238 | n = exec_command(cmd)
239 | verbose_logs("Command used", cmd)
240 | verbose_logs("Command Output", is_sw_uptodate)
241 | verbose_logs("Expected output to be compliant","")
242 | verbose_logs("To be compliant, run","")
243 |
244 | def fs_integrity_checking():
245 | global compliant_count
246 | compliance_check = "(Not Scored, Level 1)"
247 | cmd = ""
248 | n = exec_command(cmd)
249 | verbose_logs("Command used", cmd)
250 | verbose_logs("Command Output", is_sw_uptodate)
251 | verbose_logs("Expected output to be compliant","")
252 | verbose_logs("To be compliant, run","")
253 |
254 | compliance_check = "(Not Scored, Level 1)"
255 | cmd = ""
256 | n = exec_command(cmd)
257 | verbose_logs("Command used", cmd)
258 | verbose_logs("Command Output", is_sw_uptodate)
259 | verbose_logs("Expected output to be compliant","")
260 | verbose_logs("To be compliant, run","")
261 |
262 | def secBoot_settings():
263 | global compliant_count
264 | compliance_check = "(Not Scored, Level 1)"
265 | cmd = ""
266 | n = exec_command(cmd)
267 | verbose_logs("Command used", cmd)
268 | verbose_logs("Command Output", is_sw_uptodate)
269 | verbose_logs("Expected output to be compliant","")
270 | verbose_logs("To be compliant, run","")
271 |
272 | compliance_check = "(Not Scored, Level 1)"
273 | cmd = ""
274 | n = exec_command(cmd)
275 | verbose_logs("Command used", cmd)
276 | verbose_logs("Command Output", is_sw_uptodate)
277 | verbose_logs("Expected output to be compliant","")
278 | verbose_logs("To be compliant, run","")
279 |
280 | compliance_check = "(Not Scored, Level 1)"
281 | cmd = ""
282 | n = exec_command(cmd)
283 | verbose_logs("Command used", cmd)
284 | verbose_logs("Command Output", is_sw_uptodate)
285 | verbose_logs("Expected output to be compliant","")
286 | verbose_logs("To be compliant, run","")
287 |
288 | compliance_check = "(Not Scored, Level 1)"
289 | cmd = ""
290 | n = exec_command(cmd)
291 | verbose_logs("Command used", cmd)
292 | verbose_logs("Command Output", is_sw_uptodate)
293 | verbose_logs("Expected output to be compliant","")
294 | verbose_logs("To be compliant, run","")
295 |
296 | def process_hardening():
297 | global compliant_count
298 | compliance_check = "(Not Scored, Level 1)"
299 | cmd = ""
300 | n = exec_command(cmd)
301 | verbose_logs("Command used", cmd)
302 | verbose_logs("Command Output", is_sw_uptodate)
303 | verbose_logs("Expected output to be compliant","")
304 | verbose_logs("To be compliant, run","")
305 |
306 | compliance_check = "(Not Scored, Level 1)"
307 | cmd = ""
308 | n = exec_command(cmd)
309 | verbose_logs("Command used", cmd)
310 | verbose_logs("Command Output", is_sw_uptodate)
311 | verbose_logs("Expected output to be compliant","")
312 | verbose_logs("To be compliant, run","")
313 |
314 | compliance_check = "(Not Scored, Level 1)"
315 | cmd = ""
316 | n = exec_command(cmd)
317 | verbose_logs("Command used", cmd)
318 | verbose_logs("Command Output", is_sw_uptodate)
319 | verbose_logs("Expected output to be compliant","")
320 | verbose_logs("To be compliant, run","")
321 |
322 | compliance_check = "(Not Scored, Level 1)"
323 | cmd = ""
324 | n = exec_command(cmd)
325 | verbose_logs("Command used", cmd)
326 | verbose_logs("Command Output", is_sw_uptodate)
327 | verbose_logs("Expected output to be compliant","")
328 | verbose_logs("To be compliant, run","")
329 |
330 | def mandatory_access_control():
331 | global compliant_count
332 | compliance_check = "(Not Scored, Level 1)"
333 | cmd = ""
334 | n = exec_command(cmd)
335 | verbose_logs("Command used", cmd)
336 | verbose_logs("Command Output", is_sw_uptodate)
337 | verbose_logs("Expected output to be compliant","")
338 | verbose_logs("To be compliant, run","")
339 |
340 | compliance_check = "(Not Scored, Level 1)"
341 | cmd = ""
342 | n = exec_command(cmd)
343 | verbose_logs("Command used", cmd)
344 | verbose_logs("Command Output", is_sw_uptodate)
345 | verbose_logs("Expected output to be compliant","")
346 | verbose_logs("To be compliant, run","")
347 |
348 | compliance_check = "(Not Scored, Level 1)"
349 | cmd = ""
350 | n = exec_command(cmd)
351 | verbose_logs("Command used", cmd)
352 | verbose_logs("Command Output", is_sw_uptodate)
353 | verbose_logs("Expected output to be compliant","")
354 | verbose_logs("To be compliant, run","")
355 |
356 | compliance_check = "(Not Scored, Level 1)"
357 | cmd = ""
358 | n = exec_command(cmd)
359 | verbose_logs("Command used", cmd)
360 | verbose_logs("Command Output", is_sw_uptodate)
361 | verbose_logs("Expected output to be compliant","")
362 | verbose_logs("To be compliant, run","")
363 |
364 | compliance_check = "(Not Scored, Level 1)"
365 | cmd = ""
366 | n = exec_command(cmd)
367 | verbose_logs("Command used", cmd)
368 | verbose_logs("Command Output", is_sw_uptodate)
369 | verbose_logs("Expected output to be compliant","")
370 | verbose_logs("To be compliant, run","")
371 |
372 | compliance_check = "(Not Scored, Level 1)"
373 | cmd = ""
374 | n = exec_command(cmd)
375 | verbose_logs("Command used", cmd)
376 | verbose_logs("Command Output", is_sw_uptodate)
377 | verbose_logs("Expected output to be compliant","")
378 | verbose_logs("To be compliant, run","")
379 |
380 | compliance_check = "(Not Scored, Level 1)"
381 | cmd = ""
382 | n = exec_command(cmd)
383 | verbose_logs("Command used", cmd)
384 | verbose_logs("Command Output", is_sw_uptodate)
385 | verbose_logs("Expected output to be compliant","")
386 | verbose_logs("To be compliant, run","")
387 |
388 | compliance_check = "(Not Scored, Level 1)"
389 | cmd = ""
390 | n = exec_command(cmd)
391 | verbose_logs("Command used", cmd)
392 | verbose_logs("Command Output", is_sw_uptodate)
393 | verbose_logs("Expected output to be compliant","")
394 | verbose_logs("To be compliant, run","")
395 |
396 | compliance_check = "(Not Scored, Level 1)"
397 | cmd = ""
398 | n = exec_command(cmd)
399 | verbose_logs("Command used", cmd)
400 | verbose_logs("Command Output", is_sw_uptodate)
401 | verbose_logs("Expected output to be compliant","")
402 | verbose_logs("To be compliant, run","")
403 |
404 | compliance_check = "(Not Scored, Level 1)"
405 | cmd = ""
406 | n = exec_command(cmd)
407 | verbose_logs("Command used", cmd)
408 | verbose_logs("Command Output", is_sw_uptodate)
409 | verbose_logs("Expected output to be compliant","")
410 | verbose_logs("To be compliant, run","")
411 |
412 | def warning_banners():
413 | global compliant_count
414 | compliance_check = "(Not Scored, Level 1)"
415 | cmd = ""
416 | n = exec_command(cmd)
417 | verbose_logs("Command used", cmd)
418 | verbose_logs("Command Output", is_sw_uptodate)
419 | verbose_logs("Expected output to be compliant","")
420 | verbose_logs("To be compliant, run","")
421 |
422 | compliance_check = "(Not Scored, Level 1)"
423 | cmd = ""
424 | n = exec_command(cmd)
425 | verbose_logs("Command used", cmd)
426 | verbose_logs("Command Output", is_sw_uptodate)
427 | verbose_logs("Expected output to be compliant","")
428 | verbose_logs("To be compliant, run","")
429 |
430 | compliance_check = "(Not Scored, Level 1)"
431 | cmd = ""
432 | n = exec_command(cmd)
433 | verbose_logs("Command used", cmd)
434 | verbose_logs("Command Output", is_sw_uptodate)
435 | verbose_logs("Expected output to be compliant","")
436 | verbose_logs("To be compliant, run","")
437 |
438 | compliance_check = "(Not Scored, Level 1)"
439 | cmd = ""
440 | n = exec_command(cmd)
441 | verbose_logs("Command used", cmd)
442 | verbose_logs("Command Output", is_sw_uptodate)
443 | verbose_logs("Expected output to be compliant","")
444 | verbose_logs("To be compliant, run","")
445 |
446 | compliance_check = "(Not Scored, Level 1)"
447 | cmd = ""
448 | n = exec_command(cmd)
449 | verbose_logs("Command used", cmd)
450 | verbose_logs("Command Output", is_sw_uptodate)
451 | verbose_logs("Expected output to be compliant","")
452 | verbose_logs("To be compliant, run","")
453 |
454 | compliance_check = "(Not Scored, Level 1)"
455 | cmd = ""
456 | n = exec_command(cmd)
457 | verbose_logs("Command used", cmd)
458 | verbose_logs("Command Output", is_sw_uptodate)
459 | verbose_logs("Expected output to be compliant","")
460 | verbose_logs("To be compliant, run","")
461 |
462 | compliance_check = "(Not Scored, Level 1)"
463 | cmd = ""
464 | n = exec_command(cmd)
465 | verbose_logs("Command used", cmd)
466 | verbose_logs("Command Output", is_sw_uptodate)
467 | verbose_logs("Expected output to be compliant","")
468 | verbose_logs("To be compliant, run","")
469 |
470 | compliance_check = "(Not Scored, Level 1)"
471 | cmd = ""
472 | n = exec_command(cmd)
473 | verbose_logs("Command used", cmd)
474 | verbose_logs("Command Output", is_sw_uptodate)
475 | verbose_logs("Expected output to be compliant","")
476 | verbose_logs("To be compliant, run","")
477 |
478 | def inetd_services():
479 | global compliant_count
480 |
481 | compliance_check = "(Not Scored, Level 1)"
482 | cmd = ""
483 | n = exec_command(cmd)
484 | verbose_logs("Command used", cmd)
485 | verbose_logs("Command Output", is_sw_uptodate)
486 | verbose_logs("Expected output to be compliant","")
487 | verbose_logs("To be compliant, run","")
488 |
489 | compliance_check = "(Not Scored, Level 1)"
490 | cmd = ""
491 | n = exec_command(cmd)
492 | verbose_logs("Command used", cmd)
493 | verbose_logs("Command Output", is_sw_uptodate)
494 | verbose_logs("Expected output to be compliant","")
495 | verbose_logs("To be compliant, run","")
496 |
497 | compliance_check = "(Not Scored, Level 1)"
498 | cmd = ""
499 | n = exec_command(cmd)
500 | verbose_logs("Command used", cmd)
501 | verbose_logs("Command Output", is_sw_uptodate)
502 | verbose_logs("Expected output to be compliant","")
503 | verbose_logs("To be compliant, run","")
504 |
505 | compliance_check = "(Not Scored, Level 1)"
506 | cmd = ""
507 | n = exec_command(cmd)
508 | verbose_logs("Command used", cmd)
509 | verbose_logs("Command Output", is_sw_uptodate)
510 | verbose_logs("Expected output to be compliant","")
511 | verbose_logs("To be compliant, run","")
512 |
513 | compliance_check = "(Not Scored, Level 1)"
514 | cmd = ""
515 | n = exec_command(cmd)
516 | verbose_logs("Command used", cmd)
517 | verbose_logs("Command Output", is_sw_uptodate)
518 | verbose_logs("Expected output to be compliant","")
519 | verbose_logs("To be compliant, run","")
520 |
521 | compliance_check = "(Not Scored, Level 1)"
522 | cmd = ""
523 | n = exec_command(cmd)
524 | verbose_logs("Command used", cmd)
525 | verbose_logs("Command Output", is_sw_uptodate)
526 | verbose_logs("Expected output to be compliant","")
527 | verbose_logs("To be compliant, run","")
528 |
529 | compliance_check = "(Not Scored, Level 1)"
530 | cmd = ""
531 | n = exec_command(cmd)
532 | verbose_logs("Command used", cmd)
533 | verbose_logs("Command Output", is_sw_uptodate)
534 | verbose_logs("Expected output to be compliant","")
535 | verbose_logs("To be compliant, run","")
536 |
537 | compliance_check = "(Not Scored, Level 1)"
538 | cmd = ""
539 | n = exec_command(cmd)
540 | verbose_logs("Command used", cmd)
541 | verbose_logs("Command Output", is_sw_uptodate)
542 | verbose_logs("Expected output to be compliant","")
543 | verbose_logs("To be compliant, run","")
544 |
545 | compliance_check = "(Not Scored, Level 1)"
546 | cmd = ""
547 | n = exec_command(cmd)
548 | verbose_logs("Command used", cmd)
549 | verbose_logs("Command Output", is_sw_uptodate)
550 | verbose_logs("Expected output to be compliant","")
551 | verbose_logs("To be compliant, run","")
552 |
553 | compliance_check = "(Not Scored, Level 1)"
554 | cmd = ""
555 | n = exec_command(cmd)
556 | verbose_logs("Command used", cmd)
557 | verbose_logs("Command Output", is_sw_uptodate)
558 | verbose_logs("Expected output to be compliant","")
559 | verbose_logs("To be compliant, run","")
560 |
561 | def special_purpose_services():
562 | global compliant_count
563 |
564 | compliance_check = "(Not Scored, Level 1)"
565 | cmd = ""
566 | n = exec_command(cmd)
567 | verbose_logs("Command used", cmd)
568 | verbose_logs("Command Output", is_sw_uptodate)
569 | verbose_logs("Expected output to be compliant","")
570 | verbose_logs("To be compliant, run","")
571 |
572 | compliance_check = "(Not Scored, Level 1)"
573 | cmd = ""
574 | n = exec_command(cmd)
575 | verbose_logs("Command used", cmd)
576 | verbose_logs("Command Output", is_sw_uptodate)
577 | verbose_logs("Expected output to be compliant","")
578 | verbose_logs("To be compliant, run","")
579 |
580 | compliance_check = "(Not Scored, Level 1)"
581 | cmd = ""
582 | n = exec_command(cmd)
583 | verbose_logs("Command used", cmd)
584 | verbose_logs("Command Output", is_sw_uptodate)
585 | verbose_logs("Expected output to be compliant","")
586 | verbose_logs("To be compliant, run","")
587 |
588 | compliance_check = "(Not Scored, Level 1)"
589 | cmd = ""
590 | n = exec_command(cmd)
591 | verbose_logs("Command used", cmd)
592 | verbose_logs("Command Output", is_sw_uptodate)
593 | verbose_logs("Expected output to be compliant","")
594 | verbose_logs("To be compliant, run","")
595 |
596 | compliance_check = "(Not Scored, Level 1)"
597 | cmd = ""
598 | n = exec_command(cmd)
599 | verbose_logs("Command used", cmd)
600 | verbose_logs("Command Output", is_sw_uptodate)
601 | verbose_logs("Expected output to be compliant","")
602 | verbose_logs("To be compliant, run","")
603 |
604 | compliance_check = "(Not Scored, Level 1)"
605 | cmd = ""
606 | n = exec_command(cmd)
607 | verbose_logs("Command used", cmd)
608 | verbose_logs("Command Output", is_sw_uptodate)
609 | verbose_logs("Expected output to be compliant","")
610 | verbose_logs("To be compliant, run","")
611 |
612 | compliance_check = "(Not Scored, Level 1)"
613 | cmd = ""
614 | n = exec_command(cmd)
615 | verbose_logs("Command used", cmd)
616 | verbose_logs("Command Output", is_sw_uptodate)
617 | verbose_logs("Expected output to be compliant","")
618 | verbose_logs("To be compliant, run","")
619 |
620 | compliance_check = "(Not Scored, Level 1)"
621 | cmd = ""
622 | n = exec_command(cmd)
623 | verbose_logs("Command used", cmd)
624 | verbose_logs("Command Output", is_sw_uptodate)
625 | verbose_logs("Expected output to be compliant","")
626 | verbose_logs("To be compliant, run","")
627 |
628 | compliance_check = "(Not Scored, Level 1)"
629 | cmd = ""
630 | n = exec_command(cmd)
631 | verbose_logs("Command used", cmd)
632 | verbose_logs("Command Output", is_sw_uptodate)
633 | verbose_logs("Expected output to be compliant","")
634 | verbose_logs("To be compliant, run","")
635 |
636 | compliance_check = "(Not Scored, Level 1)"
637 | cmd = ""
638 | n = exec_command(cmd)
639 | verbose_logs("Command used", cmd)
640 | verbose_logs("Command Output", is_sw_uptodate)
641 | verbose_logs("Expected output to be compliant","")
642 | verbose_logs("To be compliant, run","")
643 |
644 | compliance_check = "(Not Scored, Level 1)"
645 | cmd = ""
646 | n = exec_command(cmd)
647 | verbose_logs("Command used", cmd)
648 | verbose_logs("Command Output", is_sw_uptodate)
649 | verbose_logs("Expected output to be compliant","")
650 | verbose_logs("To be compliant, run","")
651 |
652 | compliance_check = "(Not Scored, Level 1)"
653 | cmd = ""
654 | n = exec_command(cmd)
655 | verbose_logs("Command used", cmd)
656 | verbose_logs("Command Output", is_sw_uptodate)
657 | verbose_logs("Expected output to be compliant","")
658 | verbose_logs("To be compliant, run","")
659 |
660 | compliance_check = "(Not Scored, Level 1)"
661 | cmd = ""
662 | n = exec_command(cmd)
663 | verbose_logs("Command used", cmd)
664 | verbose_logs("Command Output", is_sw_uptodate)
665 | verbose_logs("Expected output to be compliant","")
666 | verbose_logs("To be compliant, run","")
667 |
668 | compliance_check = "(Not Scored, Level 1)"
669 | cmd = ""
670 | n = exec_command(cmd)
671 | verbose_logs("Command used", cmd)
672 | verbose_logs("Command Output", is_sw_uptodate)
673 | verbose_logs("Expected output to be compliant","")
674 | verbose_logs("To be compliant, run","")
675 |
676 | compliance_check = "(Not Scored, Level 1)"
677 | cmd = ""
678 | n = exec_command(cmd)
679 | verbose_logs("Command used", cmd)
680 | verbose_logs("Command Output", is_sw_uptodate)
681 | verbose_logs("Expected output to be compliant","")
682 | verbose_logs("To be compliant, run","")
683 |
684 | compliance_check = "(Not Scored, Level 1)"
685 | cmd = ""
686 | n = exec_command(cmd)
687 | verbose_logs("Command used", cmd)
688 | verbose_logs("Command Output", is_sw_uptodate)
689 | verbose_logs("Expected output to be compliant","")
690 | verbose_logs("To be compliant, run","")
691 |
692 | compliance_check = "(Not Scored, Level 1)"
693 | cmd = ""
694 | n = exec_command(cmd)
695 | verbose_logs("Command used", cmd)
696 | verbose_logs("Command Output", is_sw_uptodate)
697 | verbose_logs("Expected output to be compliant","")
698 | verbose_logs("To be compliant, run","")
699 |
700 | def service_clients():
701 | global compliant_count
702 |
703 | compliance_check = "(Not Scored, Level 1)"
704 | cmd = ""
705 | n = exec_command(cmd)
706 | verbose_logs("Command used", cmd)
707 | verbose_logs("Command Output", is_sw_uptodate)
708 | verbose_logs("Expected output to be compliant","")
709 | verbose_logs("To be compliant, run","")
710 |
711 | compliance_check = "(Not Scored, Level 1)"
712 | cmd = ""
713 | n = exec_command(cmd)
714 | verbose_logs("Command used", cmd)
715 | verbose_logs("Command Output", is_sw_uptodate)
716 | verbose_logs("Expected output to be compliant","")
717 | verbose_logs("To be compliant, run","")
718 |
719 | compliance_check = "(Not Scored, Level 1)"
720 | cmd = ""
721 | n = exec_command(cmd)
722 | verbose_logs("Command used", cmd)
723 | verbose_logs("Command Output", is_sw_uptodate)
724 | verbose_logs("Expected output to be compliant","")
725 | verbose_logs("To be compliant, run","")
726 |
727 | compliance_check = "(Not Scored, Level 1)"
728 | cmd = ""
729 | n = exec_command(cmd)
730 | verbose_logs("Command used", cmd)
731 | verbose_logs("Command Output", is_sw_uptodate)
732 | verbose_logs("Expected output to be compliant","")
733 | verbose_logs("To be compliant, run","")
734 |
735 | compliance_check = "(Not Scored, Level 1)"
736 | cmd = ""
737 | n = exec_command(cmd)
738 | verbose_logs("Command used", cmd)
739 | verbose_logs("Command Output", is_sw_uptodate)
740 | verbose_logs("Expected output to be compliant","")
741 | verbose_logs("To be compliant, run","")
742 |
743 | def networkParam_hostRouter():
744 | global compliant_count
745 | compliance_check = "(Not Scored, Level 1)"
746 | cmd = ""
747 | n = exec_command(cmd)
748 | verbose_logs("Command used", cmd)
749 | verbose_logs("Command Output", is_sw_uptodate)
750 | verbose_logs("Expected output to be compliant","")
751 | verbose_logs("To be compliant, run","")
752 |
753 | compliance_check = "(Not Scored, Level 1)"
754 | cmd = ""
755 | n = exec_command(cmd)
756 | verbose_logs("Command used", cmd)
757 | verbose_logs("Command Output", is_sw_uptodate)
758 | verbose_logs("Expected output to be compliant","")
759 | verbose_logs("To be compliant, run","")
760 |
761 | compliance_check = "(Not Scored, Level 1)"
762 | cmd = ""
763 | n = exec_command(cmd)
764 | verbose_logs("Command used", cmd)
765 | verbose_logs("Command Output", is_sw_uptodate)
766 | verbose_logs("Expected output to be compliant","")
767 | verbose_logs("To be compliant, run","")
768 |
769 | compliance_check = "(Not Scored, Level 1)"
770 | cmd = ""
771 | n = exec_command(cmd)
772 | verbose_logs("Command used", cmd)
773 | verbose_logs("Command Output", is_sw_uptodate)
774 | verbose_logs("Expected output to be compliant","")
775 | verbose_logs("To be compliant, run","")
776 |
777 | compliance_check = "(Not Scored, Level 1)"
778 | cmd = ""
779 | n = exec_command(cmd)
780 | verbose_logs("Command used", cmd)
781 | verbose_logs("Command Output", is_sw_uptodate)
782 | verbose_logs("Expected output to be compliant","")
783 | verbose_logs("To be compliant, run","")
784 |
785 | compliance_check = "(Not Scored, Level 1)"
786 | cmd = ""
787 | n = exec_command(cmd)
788 | verbose_logs("Command used", cmd)
789 | verbose_logs("Command Output", is_sw_uptodate)
790 | verbose_logs("Expected output to be compliant","")
791 | verbose_logs("To be compliant, run","")
792 |
793 | compliance_check = "(Not Scored, Level 1)"
794 | cmd = ""
795 | n = exec_command(cmd)
796 | verbose_logs("Command used", cmd)
797 | verbose_logs("Command Output", is_sw_uptodate)
798 | verbose_logs("Expected output to be compliant","")
799 | verbose_logs("To be compliant, run","")
800 |
801 | compliance_check = "(Not Scored, Level 1)"
802 | cmd = ""
803 | n = exec_command(cmd)
804 | verbose_logs("Command used", cmd)
805 | verbose_logs("Command Output", is_sw_uptodate)
806 | verbose_logs("Expected output to be compliant","")
807 | verbose_logs("To be compliant, run","")
808 |
809 | compliance_check = "(Not Scored, Level 1)"
810 | cmd = ""
811 | n = exec_command(cmd)
812 | verbose_logs("Command used", cmd)
813 | verbose_logs("Command Output", is_sw_uptodate)
814 | verbose_logs("Expected output to be compliant","")
815 | verbose_logs("To be compliant, run","")
816 |
817 | compliance_check = "(Not Scored, Level 1)"
818 | cmd = ""
819 | n = exec_command(cmd)
820 | verbose_logs("Command used", cmd)
821 | verbose_logs("Command Output", is_sw_uptodate)
822 | verbose_logs("Expected output to be compliant","")
823 | verbose_logs("To be compliant, run","")
824 |
825 | def ipv6():
826 | global compliant_count
827 | compliance_check = "(Not Scored, Level 1)"
828 | cmd = ""
829 | n = exec_command(cmd)
830 | verbose_logs("Command used", cmd)
831 | verbose_logs("Command Output", is_sw_uptodate)
832 | verbose_logs("Expected output to be compliant","")
833 | verbose_logs("To be compliant, run","")
834 |
835 | def tcp_wrappers():
836 | global compliant_count
837 | compliance_check = "(Not Scored, Level 1)"
838 | cmd = ""
839 | n = exec_command(cmd)
840 | verbose_logs("Command used", cmd)
841 | verbose_logs("Command Output", is_sw_uptodate)
842 | verbose_logs("Expected output to be compliant","")
843 | verbose_logs("To be compliant, run","")
844 |
845 | def uncommon_nwProtocols():
846 | global compliant_count
847 | compliance_check = "(Not Scored, Level 1)"
848 | cmd = ""
849 | n = exec_command(cmd)
850 | verbose_logs("Command used", cmd)
851 | verbose_logs("Command Output", is_sw_uptodate)
852 | verbose_logs("Expected output to be compliant","")
853 | verbose_logs("To be compliant, run","")
854 |
855 | def firewall_configuration():
856 | global compliant_count
857 | compliance_check = "(Not Scored, Level 1)"
858 | cmd = ""
859 | n = exec_command(cmd)
860 | verbose_logs("Command used", cmd)
861 | verbose_logs("Command Output", is_sw_uptodate)
862 | verbose_logs("Expected output to be compliant","")
863 | verbose_logs("To be compliant, run","")
864 |
865 | def config_sysAccounting():
866 | global compliant_count
867 | compliance_check = "(Not Scored, Level 1)"
868 | cmd = ""
869 | n = exec_command(cmd)
870 | verbose_logs("Command used", cmd)
871 | verbose_logs("Command Output", is_sw_uptodate)
872 | verbose_logs("Expected output to be compliant","")
873 | verbose_logs("To be compliant, run","")
874 |
875 | def config_logging():
876 | global compliant_count
877 | compliance_check = "(Not Scored, Level 1)"
878 | cmd = ""
879 | n = exec_command(cmd)
880 | verbose_logs("Command used", cmd)
881 | verbose_logs("Command Output", is_sw_uptodate)
882 | verbose_logs("Expected output to be compliant","")
883 | verbose_logs("To be compliant, run","")
884 |
885 | def config_cron():
886 | global compliant_count
887 | compliance_check = "(Not Scored, Level 1)"
888 | cmd = ""
889 | n = exec_command(cmd)
890 | verbose_logs("Command used", cmd)
891 | verbose_logs("Command Output", is_sw_uptodate)
892 | verbose_logs("Expected output to be compliant","")
893 | verbose_logs("To be compliant, run","")
894 |
895 | def config_SSH():
896 | global compliant_count
897 | compliance_check = "(Not Scored, Level 1)"
898 | cmd = ""
899 | n = exec_command(cmd)
900 | verbose_logs("Command used", cmd)
901 | verbose_logs("Command Output", is_sw_uptodate)
902 | verbose_logs("Expected output to be compliant","")
903 | verbose_logs("To be compliant, run","")
904 |
905 | def config_PAM():
906 | global compliant_count
907 | compliance_check = "(Not Scored, Level 1)"
908 | cmd = ""
909 | n = exec_command(cmd)
910 | verbose_logs("Command used", cmd)
911 | verbose_logs("Command Output", is_sw_uptodate)
912 | verbose_logs("Expected output to be compliant","")
913 | verbose_logs("To be compliant, run","")
914 |
915 | def userAccounts_andEnvironment():
916 | global compliant_count
917 | compliance_check = "(Not Scored, Level 1)"
918 | cmd = ""
919 | n = exec_command(cmd)
920 | verbose_logs("Command used", cmd)
921 | verbose_logs("Command Output", is_sw_uptodate)
922 | verbose_logs("Expected output to be compliant","")
923 | verbose_logs("To be compliant, run","")
924 |
925 | def sysFilePermissions():
926 | global compliant_count
927 | compliance_check = "(Not Scored, Level 1)"
928 | cmd = ""
929 | n = exec_command(cmd)
930 | verbose_logs("Command used", cmd)
931 | verbose_logs("Command Output", is_sw_uptodate)
932 | verbose_logs("Expected output to be compliant","")
933 | verbose_logs("To be compliant, run","")
934 |
935 | def userGroupSettings():
936 | global compliant_count
937 | compliance_check = "(Not Scored, Level 1)"
938 | cmd = ""
939 | n = exec_command(cmd)
940 | verbose_logs("Command used", cmd)
941 | verbose_logs("Command Output", is_sw_uptodate)
942 | verbose_logs("Expected output to be compliant","")
943 | verbose_logs("To be compliant, run","")
944 |
945 | compliance_check = "(Not Scored, Level 1)"
946 | cmd = ""
947 | n = exec_command(cmd)
948 | verbose_logs("Command used", cmd)
949 | verbose_logs("Command Output", is_sw_uptodate)
950 | verbose_logs("Expected output to be compliant","")
951 | verbose_logs("To be compliant, run","")
952 |
953 | compliance_check = "(Scored, Level 1))"
954 | cmd = ""
955 | n = exec_command(cmd)
956 | verbose_logs("Command used", cmd)
957 | verbose_logs("Command Output", )
958 | verbose_logs("Expected output to be compliant","")
959 | verbose_logs("To be compliant, run","")
960 |
961 | if __name__ == "__main__":
962 | global total_compliances
963 | global compliant_count
964 |
965 | parser = argparse.ArgumentParser()
966 | parser.add_argument("-v", "--verbose", help="increase output verbosity",action="store_true")
967 | parser.add_argument("-n", "--nocolor", help="plain console output(default logging uses color)",action="store_true")
968 | args = parser.parse_args()
969 |
970 | print "Hardening Checks for Alpine Linux based on Centre for Internet Security Benchmarks"
971 | print "Benchmark Reference","CIS Distribution Independent Linux v1.0.1 - 01-31-2017"
972 | print "Author: Praveen Darshanam"
973 |
974 | verbose_logs("RECOMMENDATION SECTION","Initial Setup")
975 | filesystem_config()
976 | config_swUpdates()
977 | fsIntegrity_checking()
978 | secBoot_settings()
979 | process_hardening()
980 | mandatory_access_control()
981 | warning_banners()
982 |
983 | verbose_logs("RECOMMENDATION SECTION","Services")
984 | inetd_services()
985 | special_purpose_services()
986 | service_clients()
987 |
988 | verbose_logs("RECOMMENDATION SECTION","Network Configuration")
989 | networkParam_hostRouter()
990 | ipv6()
991 | tcp_wrappers()
992 | uncommon_nwProtocols()
993 | firewall_configuration()
994 |
995 | verbose_logs("RECOMMENDATION SECTION","Logging and Auditing")
996 | config_sysAccounting()
997 | config_logging()
998 |
999 | verbose_logs("RECOMMENDATION SECTION","Access, Authentication and Authorization")
1000 | config_cron()
1001 | config_SSH()
1002 | config_PAM()
1003 | userAccounts_andEnvironment()
1004 |
1005 | verbose_logs("RECOMMENDATION SECTION","System Maintenance")
1006 | sysFilePermissions()
1007 | userGroupSettings()
1008 |
1009 |
1010 | """
1011 | print "Checking File System Permissions and Access Controls"
1012 | print "Checking Password Management"
1013 | """
1014 | verbose_logs("RECOMMENDATION SECTION","User Accounts and Environment")
1015 | user_AccountsEnvironment()
1016 |
1017 | verbose_logs("RECOMMENDATION SECTION","Additional Considerations")
1018 | additional_considerations()
1019 |
1020 | print "Total Compliances Checklist:", total_compliances
1021 | print "Total Compliances Passed:", compliant_count
1022 |
--------------------------------------------------------------------------------
/mac_hardening/._CIS_Apple_OSX_10.12_Benchmark_v1.0.0.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/praveendhac/CISBenchmarks/15e48d342e635196e225a7b9386f70ca1f86eafd/mac_hardening/._CIS_Apple_OSX_10.12_Benchmark_v1.0.0.pdf
--------------------------------------------------------------------------------
/mac_hardening/CIS_Apple_OSX_10.12_Benchmark_v1.0.0.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/praveendhac/CISBenchmarks/15e48d342e635196e225a7b9386f70ca1f86eafd/mac_hardening/CIS_Apple_OSX_10.12_Benchmark_v1.0.0.pdf
--------------------------------------------------------------------------------
/mac_hardening/README.md:
--------------------------------------------------------------------------------
1 | # CISBenchmarks
2 | Hardening audit scripts validating Workstations and Servers based on CIS benchmarks
3 |
4 | Center for Internet Security (CIS), http://benchmarks.cisecurity.org
5 |
6 | Bechmarks are based on
7 | -Install Updates, Patches and Additional Security Software
8 | -System Preferences
9 | -Bluetooth
10 | -Date & Time
11 | -Desktop & Screen Saver
12 | -Sharing
13 | -Energy Saver
14 | -Security & Privacy
15 | -iCloud
16 | -Time Machine
17 | -Logging and Auditing
18 | -Configure asl.conf
19 | -Network Configurations
20 | -System Access, Authentication and Authorization
21 | -File System Permissions and Access Controls
22 | -Password Management
23 | -User Accounts and Environment
24 | -Accounts Preferences Action Items
25 | -Additional Considerations
26 |
27 | praveend$ ./macAudit.py -h
28 | usage: macAudit.py [-h] [-v] [-n]
29 |
30 | optional arguments:
31 | -h, --help show this help message and exit
32 | -v, --verbose increase output verbosity
33 | -n, --nocolor plain console output(default logging uses color)
34 | praveend$
35 |
36 |
37 |
38 |
39 |
--------------------------------------------------------------------------------
/mac_hardening/macAudit.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/python
2 | import os, sys, time, re
3 | import argparse
4 | import subprocess
5 |
6 | #Scored - Failure to comply will decrease the final benchmark score
7 | #Not Scored - Failure to comply will not decrease the final benchmark score
8 | #Level 1 - general requirement
9 | #Level 2 - required where security is paramount. Extends Level 1 profile
10 |
11 | total_compliances = 0
12 | compliant_count = 0
13 |
14 | def update_compliance_status(compliance_check, compliance_status):
15 | global total_compliances
16 | total_compliances +=1
17 | CRED = '\33[31m'
18 | CGREEN = '\33[32m'
19 | CEND = '\33[0m'
20 |
21 | if args.nocolor:
22 | print compliance_check + ": " + compliance_status
23 | else:
24 | if "NON-" in compliance_status:
25 | print compliance_check + ": " + CRED + compliance_status + CEND
26 | else:
27 | print compliance_check + ": " + CGREEN + compliance_status + CEND
28 | return
29 |
30 | def exec_command(cmd):
31 | global total_compliances
32 | global compliant_count
33 | try:
34 | out = subprocess.check_output(cmd,stderr=subprocess.STDOUT,shell=True)
35 | except:
36 | out = "EXCEPTION. Command execution failed or no output"
37 | return out
38 |
39 | def verbose_logs(info_str, op):
40 | if args.verbose:
41 | print info_str +": "+ op
42 | return
43 |
44 | def check_patches():
45 | global total_compliances
46 | global compliant_count
47 |
48 | compliance_check = "Verify all Apple provided software is current (Scored, Level 1)"
49 | cmd = "softwareupdate -l"
50 | is_sw_uptodate = exec_command(cmd)
51 | verbose_logs("Command used", cmd)
52 | verbose_logs("Command Output", is_sw_uptodate)
53 | verbose_logs("Expected output to be compliant","All the software must be uptodate")
54 | if "No new software available" in is_sw_uptodate:
55 | update_compliance_status(compliance_check, "COMPLIANT")
56 | compliant_count += 1
57 | else:
58 | compliant_count -= 1
59 | update_compliance_status(compliance_check, "NON-COMPLIANT")
60 |
61 | compliance_check = "Enable Auto Update (Scored, Level 1)"
62 | cmd = "defaults read /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled"
63 | au = exec_command(cmd)
64 | verbose_logs("Command used", cmd)
65 | verbose_logs("Command Output", au)
66 | verbose_logs("Expected output to be compliant","AutomaticCheckEnabled should be 1")
67 | verbose_logs("To be compliant, run","sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate AutomaticCheckEnabled -int 1")
68 | if "1" in au:
69 | update_compliance_status(compliance_check, "COMPLIANT")
70 | compliant_count += 1
71 | else:
72 | compliant_count -= 1
73 | update_compliance_status(compliance_check, "NON-COMPLIANT")
74 |
75 | compliance_check = "Enable app update installs (Scored, Level 1)"
76 | cmd = "defaults read /Library/Preferences/com.apple.commerce AutoUpdate"
77 | apui = exec_command(cmd)
78 | verbose_logs("Command used", cmd)
79 | verbose_logs("Command Output", apui)
80 | verbose_logs("Expected output to be compliant","Returned value should be 1")
81 | verbose_logs("To be compliant, run(needs logout/login)","sudo defaults write /Library/Preferences/com.apple.commerce AutoUpdate -bool TRUE")
82 | if "1" in apui:
83 | update_compliance_status(compliance_check, "COMPLIANT")
84 | compliant_count += 1
85 | else:
86 | compliant_count -= 1
87 | update_compliance_status(compliance_check, "NON-COMPLIANT")
88 |
89 | compliance_check = "Enable system data files and security update installs (Scored, Level 1)"
90 | #split the command into two
91 | cmd = "defaults read /Library/Preferences/com.apple.SoftwareUpdate | egrep '(ConfigDataInstall|CriticalUpdateInstall)'"
92 | sui = exec_command(cmd)
93 | verbose_logs("Command used", cmd)
94 | verbose_logs("Command Output", sui)
95 | verbose_logs("Expected output to be compliant","Returned value should be 1 for both ConfigDataInstall,CriticalUpdateInstall")
96 | verbose_logs("To be compliant, run","sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate ConfigDataInstall -bool true && sudo defaults write /Library/Preferences/com.apple.SoftwareUpdate CriticalUpdateInstall -bool true")
97 | if "1" in sui:
98 | update_compliance_status(compliance_check, "COMPLIANT")
99 | compliant_count += 1
100 | else:
101 | compliant_count -= 1
102 | update_compliance_status(compliance_check, "NON-COMPLIANT")
103 |
104 | compliance_check = "Enable OS X update installs (Scored, Level 1)"
105 | cmd = "defaults read /Library/Preferences/com.apple.commerce AutoUpdateRestartRequired"
106 | osxui = exec_command(cmd)
107 | verbose_logs("Command used", cmd)
108 | verbose_logs("Command Output", osxui)
109 | verbose_logs("Expected output to be compliant","Returned value should be 1")
110 | verbose_logs("To be compliant, run","sudo defaults write /Library/Preferences/com.apple.commerce AutoUpdateRestartRequired -bool TRUE")
111 | if "1" in osxui:
112 | update_compliance_status(compliance_check, "COMPLIANT")
113 | compliant_count += 1
114 | else:
115 | compliant_count -= 1
116 | update_compliance_status(compliance_check, "NON-COMPLIANT")
117 |
118 | def system_preferences():
119 | global total_compliances
120 | global compliant_count
121 |
122 | #BLUETOOTH
123 | compliance_check = "Turn off Bluetooth, if no paired devices exist (Scored, Level 1)"
124 | cmd = "defaults read /Library/Preferences/com.apple.Bluetooth ControllerPowerState"
125 | bt_pde = exec_command(cmd)
126 | verbose_logs("Command used", cmd)
127 | verbose_logs("Command Output", bt_pde)
128 | verbose_logs("Expected output to be compliant","Returned value should be 0")
129 | if "0" in bt_pde:
130 | update_compliance_status(compliance_check, "COMPLIANT")
131 | compliant_count += 1
132 | elif "1" in bt_pde:
133 | cmd = "system_profiler SPBluetoothDataType | grep \"Bluetooth:\" -A 20 | grep Connectable"
134 | bt_enabled = exec_command(cmd)
135 | verbose_logs("Command used", cmd)
136 | verbose_logs("Command Output", bt_enabled)
137 | verbose_logs("Expected output to be compliant","Paired Bluetooth devices should exist")
138 | verbose_logs("To be compliant, run","sudo defaults write /Library/Preferences/com.apple.Bluetooth ControllerPowerState -int 0 && sudo killall -HUP blued")
139 | if "EXCEPTION" in bt_enabled:
140 | compliant_count -= 1
141 | update_compliance_status(compliance_check, "NON-COMPLIANT")
142 | else:
143 | update_compliance_status(compliance_check, "COMPLIANT")
144 | compliant_count += 1
145 | else:
146 | compliant_count -= 1
147 | update_compliance_status(compliance_check, "NON-COMPLIANT")
148 |
149 | compliance_check = "Turn off Bluetooth \"Discoverable\" mode when not pairing devices (Scored, Level 1)"
150 | cmd = "/usr/sbin/system_profiler SPBluetoothDataType | grep -i discoverable"
151 | bt_discoverable = exec_command(cmd)
152 | verbose_logs("Command used", cmd)
153 | verbose_logs("Command Output", bt_discoverable)
154 | verbose_logs("Expected output to be compliant","Discoverable: Off")
155 | if "off" in bt_discoverable.lower():
156 | compliant_count += 1
157 | update_compliance_status(compliance_check, "COMPLIANT")
158 | else:
159 | compliant_count -= 1
160 | update_compliance_status(compliance_check, "NON-COMPLIANT")
161 |
162 | compliance_check = "Show Bluetooth status in menu bar (Scored, Level 1)"
163 | cmd = "defaults read com.apple.systemuiserver menuExtras | grep Bluetooth.menu"
164 | bt_status_menubar = exec_command(cmd)
165 | verbose_logs("Command used", cmd)
166 | verbose_logs("Command Output", bt_status_menubar)
167 | verbose_logs("Expected output to be compliant","/System/Library/CoreServices/Menu Extras/Bluetooth.menu")
168 | verbose_logs("To be compliant, run","defaults write com.apple.systemuiserver menuExtras -array-add \"/System/Library/CoreServices/Menu Extras/Bluetooth.menu\"")
169 | verbose_logs("Use case", "Enabling Bluetooth menu will help the user know Bluetooth on/off status easily")
170 | if "bluetooth.menu" in bt_status_menubar.lower():
171 | compliant_count += 1
172 | update_compliance_status(compliance_check, "COMPLIANT")
173 | else:
174 | compliant_count -= 1
175 | update_compliance_status(compliance_check, "NON-COMPLIANT")
176 |
177 | #DATE AND TIME
178 | #NEED sudo ACCESS FOR BELOW COMMANDS
179 | compliance_check = "Enable \"Set time and date automatically\" (Not Scored, Level 2)"
180 | cmd = "sudo systemsetup -getusingnetworktime"
181 | dt_auto = exec_command(cmd)
182 | verbose_logs("Command used", cmd)
183 | verbose_logs("Command Output", dt_auto)
184 | verbose_logs("Expected output to be compliant","Network Time: On")
185 | verbose_logs("To be compliant, run","sudo systemsetup -setnetworktimeserver && sudo systemsetup -setusingnetworktime on")
186 | if "network time: on" in dt_auto.lower():
187 | compliant_count += 1
188 | update_compliance_status(compliance_check, "COMPLIANT")
189 | else:
190 | update_compliance_status(compliance_check, "NON-COMPLIANT")
191 |
192 | compliance_check = "Ensure time set is within appropriate limits (Scored, Level 1)"
193 | cmd = "sudo systemsetup -getnetworktimeserver"
194 | dt_ntp_server = exec_command(cmd)
195 | verbose_logs("Command used", cmd)
196 | if "EXCEPTION" in dt_ntp_server:
197 | compliant_count -= 1
198 | update_compliance_status(compliance_check, "NON-COMPLIANT")
199 | else:
200 | ntp_domain = dt_ntp_server.split(':')[1].strip()
201 | cmd = "sudo ntpdate -svd " + ntp_domain + " | egrep offset |egrep ntpdate"
202 | #command output: 10 Oct 19:06:24 ntpdate[26544]: adjust time server 17.253.82.253 offset -0.037603 sec
203 | dt_ntp_offset = exec_command(cmd)
204 | verbose_logs("Command used", cmd)
205 | verbose_logs("Command Output", dt_ntp_offset)
206 | verbose_logs("Expected output to be compliant","Offset result(s) are smaller than 270.x or -270.x seconds")
207 | ntpdate_output = dt_ntp_offset.split('\n')
208 | for eachline in ntpdate_output:
209 | match_offset = re.match(r'.*?ntpdate.*?time\s+server.*?offset\s+([-.\d]+)\s+sec.*?',eachline, re.I|re.M)
210 | if match_offset:
211 | offset_val = float(match_offset.group(1))
212 | verbose_logs("Current ntpdate offset value", offset_val)
213 | if (offset_val > -270.0) or (offset_val < 270.0):
214 | compliant_count += 1
215 | update_compliance_status(compliance_check, "COMPLIANT")
216 | else:
217 | compliant_count -= 1
218 | update_compliance_status(compliance_check, "NON-COMPLIANT")
219 | verbose_logs("To be compliant, run","sudo systemsetup -setnetworktimeserver && sudo systemsetup -setusingnetworktime on")
220 | verbose_logs("Current ntpdate offset value", offset_val)
221 | else:
222 | compliant_count -= 1
223 | update_compliance_status(compliance_check, "NON-COMPLIANT")
224 | verbose_logs("To be compliant, run","sudo systemsetup -setnetworktimeserver && sudo systemsetup -setusingnetworktime on")
225 |
226 | compliance_check = "Restrict NTP server to loopback interface (Scored, Level 1)"
227 | cmd = "cat /etc/ntp-restrict.conf | grep \"restrict lo\""
228 | dt_ntp_lo = exec_command(cmd)
229 | verbose_logs("Command used", cmd)
230 | verbose_logs("Command Output", dt_ntp_lo)
231 | verbose_logs("Expected output to be compliant","restrict lo")
232 | verbose_logs("To be compliant, add","restrict lo interface ignore wildcard interface listen lo to /etc/ntp-restrict.conf")
233 | if "restrict lo" in dt_ntp_lo.lower():
234 | compliant_count += 1
235 | update_compliance_status(compliance_check, "COMPLIANT")
236 | else:
237 | compliant_count -= 1
238 | update_compliance_status(compliance_check, "NON-COMPLIANT")
239 |
240 | #DESKTOP & SCREEN SAVER
241 | compliance_check = "Set an inactivity interval of 20 minutes or less for the screen saver (Scored, Level 1)"
242 | cmd = "ioreg -rd1 -c IOPlatformExpertDevice | grep \"IOPlatformUUID\""
243 | dss_uuid = exec_command(cmd)
244 | verbose_logs("Command used", cmd)
245 | verbose_logs("Command Output", dss_uuid)
246 | uuid = dss_uuid.split('=')[1].replace('\"','').strip()
247 | verbose_logs("UUID", uuid)
248 | cmd = "find /Users -type d -maxdepth 1"
249 | get_all_users = exec_command(cmd)
250 | verbose_logs("Command used", cmd)
251 | verbose_logs("Command Output", get_all_users)
252 | all_users = get_all_users.split('\n')
253 | for euser in all_users:
254 | pref = euser + "/Library/Preferences/ByHost/com.apple.screensaver." + uuid
255 | fplist = pref + ".plist"
256 | if os.path.isfile(fplist) and euser:
257 | cmd = "sudo defaults read " + fplist.strip() + " idleTime"
258 | read_plist = exec_command(cmd)
259 | verbose_logs("Command used", cmd)
260 | verbose_logs("Command Output", read_plist)
261 | verbose_logs("Expected output to be compliant","Verify the setting is not 0 but is adequately low (< 1200)")
262 | if "EXCEPTION" in read_plist:
263 | compliant_count -= 1
264 | update_compliance_status(compliance_check, "NON-COMPLIANT")
265 | else:
266 | idle_time = int (read_plist)
267 | if idle_time >0 and idle_time <=1200:
268 | update_compliance_status(compliance_check + "(for user " +euser+ ")", "COMPLIANT")
269 | else:
270 | update_compliance_status(compliance_check + "(for user" +euser+ ")", "NON-COMPLIANT")
271 | verbose_logs("To be compliant, run","defaults -currentHost write com.apple.screensaver idleTime -int 600")
272 | else:
273 | #file not present
274 | continue
275 | verbose_logs("INFO","Check system is configured as prescribed for the current logged in user")
276 | cmd = "defaults -currentHost read com.apple.screensaver idleTime"
277 | idletime = exec_command(cmd)
278 | verbose_logs("Command used", cmd)
279 | verbose_logs("Command Output", idletime)
280 | verbose_logs("Expected output to be compliant","Verify the setting is not 0 but is adequately low (< 1200)")
281 | if "EXCEPTION" in read_plist:
282 | compliant_count -= 1
283 | update_compliance_status(compliance_check +"(current logged in user)", "NON-COMPLIANT")
284 | else:
285 | idle_time = int(read_plist)
286 | if idle_time >0 and idle_time <=1200:
287 | compliant_count += 1
288 | update_compliance_status(compliance_check +"(current logged in user)", "COMPLIANT")
289 | else:
290 | compliant_count -= 1
291 | update_compliance_status(compliance_check +"(current logged in user)", "NON-COMPLIANT")
292 | verbose_logs("To be compliant, run","defaults -currentHost write com.apple.screensaver idleTime -int 600")
293 |
294 | compliance_check = "Secure screen saver corners (Scored, Level 2)"
295 | cmd = "defaults read ~/Library/Preferences/com.apple.dock | grep -i corner"
296 | dss_ssc = exec_command(cmd)
297 | verbose_logs("Command used", cmd)
298 | verbose_logs("Command Output", dss_ssc)
299 | verbose_logs("Expected output to be compliant","Verify that 6 is not returned for any key value for any user")
300 | if " 6" in dss_ssc:
301 | compliant_count -= 1
302 | update_compliance_status(compliance_check, "NON-COMPLIANT")
303 | verbose_logs("To be compliant, check","System Preferences->Mission Control->Hot Corners->Remove corners which are set to Disable Screen Saver. Make it -")
304 | else:
305 | compliant_count += 1
306 | update_compliance_status(compliance_check, "COMPLIANT")
307 |
308 | compliance_check = "Verify Display Sleep is set to a value larger than the Screen Saver (Not Scored, Level 1)"
309 | cmd = "pmset -g | grep displaysleep"
310 | dss_ds = exec_command(cmd)
311 | verbose_logs("Command used", cmd)
312 | verbose_logs("Command Output", dss_ds)
313 | verbose_logs("Expected output to be compliant","verify displaysleep value returned is longer than the Screen Saver, if the Screen Saver is used to lock the screen")
314 | match_offset = re.match(r'.*?displaysleep\s+(\d+).*?',dss_ds)
315 | if match_offset:
316 | offset_val = int(match_offset.group(1))
317 | disp_sleep = int(dss_ds.split(' ')[-1].strip())
318 | if disp_sleep > idle_time:
319 | compliant_count += 1
320 | update_compliance_status(compliance_check, "COMPLIANT")
321 | else:
322 | update_compliance_status(compliance_check, "NON-COMPLIANT")
323 | verbose_logs("To be compliant, run","sudo pmset -c displaysleep 0")
324 |
325 | compliance_check = "Set a screen corner to Start Screen Saver (Scored, Level 1)"
326 | cmd = "defaults read ~/Library/Preferences/com.apple.dock | grep -i corner"
327 | dss_sc_sss = exec_command(cmd)
328 | verbose_logs("Command used", cmd)
329 | verbose_logs("Command Output", dss_sc_sss)
330 | verbose_logs("Expected output to be compliant","Atleast one of the 4 corners should be \"wvous-*-corner\" = 5")
331 | if " 5" in dss_sc_sss:
332 | compliant_count += 1
333 | update_compliance_status(compliance_check, "COMPLIANT")
334 | else:
335 | compliant_count -= 1
336 | update_compliance_status(compliance_check, "NON-COMPLIANT")
337 | verbose_logs("To be compliant, check","System Preferences->Mission Control->Hot Corners, make sure at least one Active Screen Corner is set to Start Screen Saver.")
338 |
339 | #SHARING
340 | compliance_check = "Disable Remote Apple Events (Scored, Level 1)"
341 | cmd = "sudo systemsetup -getremoteappleevents"
342 | sh_rae = exec_command(cmd)
343 | verbose_logs("Command used", cmd)
344 | verbose_logs("Command Output", sh_rae)
345 | verbose_logs("Expected output to be compliant","Verify the value returned is Remote Apple Events: Off")
346 | if " off" in sh_rae.lower():
347 | compliant_count += 1
348 | update_compliance_status(compliance_check, "COMPLIANT")
349 | else:
350 | compliant_count -= 1
351 | update_compliance_status(compliance_check, "NON-COMPLIANT")
352 | verbose_logs("To be compliant, run","sudo systemsetup -setremoteappleevents off")
353 |
354 | compliance_check = "Disable Internet Sharing (Scored, Level 1)"
355 | verbose_logs("Expected output to be compliant","NAT Config file should not exist or Enabled = 0 for all network interfaces")
356 | if os.path.isfile("/Library/Preferences/SystemConfiguration/com.apple.nat"):
357 | cmd = "sudo defaults read /Library/Preferences/SystemConfiguration/com.apple.nat | grep -i Enabled"
358 | sh_dis = exec_command(cmd)
359 | verbose_logs("Command used", cmd)
360 | verbose_logs("Command Output", sh_dis)
361 | verbose_logs("To be compliant, check","Open System Preferences->Select Sharing->uncheck Internet Sharing")
362 | match_enable0 = re.match(r'.*?Enable:\s+0.*?',sh_dis,re.I|re.M|re.S)
363 | if match_enable0:
364 | compliant_count += 1
365 | update_compliance_status(compliance_check, "COMPLIANT")
366 | else:
367 | compliant_count -= 1
368 | update_compliance_status(compliance_check, "NON-COMPLIANT")
369 | verbose_logs("To be compliant, check","Open System Preferences->Select Sharing->uncheck Internet Sharing")
370 | else:
371 | compliant_count += 1
372 | update_compliance_status(compliance_check, "COMPLIANT")
373 |
374 |
375 | compliance_check = "Disable Screen Sharing (Scored, Level 1)"
376 | cmd = "sudo launchctl load /System/Library/LaunchDaemons/com.apple.screensharing.plist"
377 | sh_dss = exec_command(cmd)
378 | verbose_logs("Command used", cmd)
379 | verbose_logs("Command Output", sh_dss)
380 | verbose_logs("Expected output to be compliant","Verify the value returned is Service is disabled")
381 | if "service is disabled" in sh_dss.lower():
382 | compliant_count += 1
383 | update_compliance_status(compliance_check, "COMPLIANT")
384 | else:
385 | compliant_count -= 1
386 | update_compliance_status(compliance_check, "NON-COMPLIANT")
387 | verbose_logs("To be compliant, check","Open System Preferences->Sharing->uncheck Screen Sharing")
388 |
389 | compliance_check = "Disable Printer Sharing (Scored, Level 1)"
390 | cmd = "system_profiler SPPrintersDataType | egrep \"Shared: Yes\""
391 | sh_dps = exec_command(cmd)
392 | verbose_logs("Command used", cmd)
393 | verbose_logs("Command Output", sh_dps)
394 | verbose_logs("Expected output to be compliant","output should be empty")
395 | if "EXCEPTION" in sh_dps:
396 | compliant_count += 1
397 | update_compliance_status(compliance_check, "COMPLIANT")
398 | else:
399 | compliant_count -= 1
400 | update_compliance_status(compliance_check, "NON-COMPLIANT")
401 | verbose_logs("To be compliant, check","Open System Preferences->Sharing->uncheck Printer Sharing")
402 |
403 | compliance_check = "Disable Remote Login (Scored, Level 1)"
404 | cmd = "sudo systemsetup -getremotelogin"
405 | sh_drl = exec_command(cmd)
406 | verbose_logs("Command used", cmd)
407 | verbose_logs("Command Output", sh_drl)
408 | verbose_logs("Expected output to be compliant","Verify the value returned is Remote Login: Off")
409 | if "remote login: off" in sh_drl.lower():
410 | compliant_count += 1
411 | update_compliance_status(compliance_check, "COMPLIANT")
412 | else:
413 | compliant_count -= 1
414 | update_compliance_status(compliance_check, "NON-COMPLIANT")
415 | verbose_logs("To be compliant, run","sudo systemsetup -setremotelogin off")
416 |
417 | compliance_check = "Disable DVD or CD Sharing (Scored, Level 1)"
418 | cmd = "sudo launchctl list | egrep ODSAgent"
419 | sh_cdrom = exec_command(cmd)
420 | verbose_logs("Command used", cmd)
421 | verbose_logs("Command Output", sh_cdrom)
422 | verbose_logs("Expected output to be compliant","com.apple.ODSAgent should not be in the output")
423 | if "com.apple.ODSAgent" in sh_cdrom:
424 | compliant_count -= 1
425 | update_compliance_status(compliance_check, "NON-COMPLIANT")
426 | verbose_logs("To be compliant, check","Open System Preferences->Sharing->uncheck DVD or CD Sharing")
427 | else:
428 | compliant_count += 1
429 | update_compliance_status(compliance_check, "COMPLIANT")
430 |
431 | compliance_check = "Disable Bluetooth Sharing (Scored, Level 1)"
432 | cmd = "system_profiler SPBluetoothDataType | grep State"
433 | sh_bt = exec_command(cmd)
434 | verbose_logs("Command used", cmd)
435 | verbose_logs("Command Output", sh_bt)
436 | verbose_logs("Expected output to be compliant","State: Disabled")
437 | if "enabled" in sh_bt.lower():
438 | compliant_count -= 1
439 | update_compliance_status(compliance_check, "NON-COMPLIANT")
440 | verbose_logs("To be compliant, check","Open System Preferences->Sharing->uncheck Bluetooth Sharing")
441 | else:
442 | compliant_count += 1
443 | update_compliance_status(compliance_check, "COMPLIANT")
444 |
445 | compliance_check = "Disable File Sharing (Scored, Level 1)"
446 | cmd = "sudo launchctl list | egrep AppleFileServer"
447 | sh_afs = exec_command(cmd)
448 | verbose_logs("Command used", cmd)
449 | verbose_logs("Command Output", sh_afs)
450 | verbose_logs("Expected output to be compliant","No output should be present")
451 | cmd = "grep -i array /Library/Preferences/SystemConfiguration/com.apple.smb.server.plist"
452 | sh_winfs = exec_command(cmd)
453 | verbose_logs("Command used", cmd)
454 | verbose_logs("Command Output", sh_winfs)
455 | verbose_logs("Expected output to be compliant","No output should be present")
456 | if ("EXCEPTION" in sh_afs) and ("EXCEPTION" in sh_winfs):
457 | compliant_count += 1
458 | update_compliance_status(compliance_check, "COMPLIANT")
459 | else:
460 | compliant_count -= 1
461 | update_compliance_status(compliance_check, "NON-COMPLIANT")
462 | verbose_logs("To be compliant, run","sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.AppleFileServer.plist")
463 | verbose_logs("To be compliant, run","sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.smbd.plist")
464 |
465 | compliance_check = "Disable Remote Management (Scored, Level 1)"
466 | cmd = "ps -ef | egrep ARDAgent"
467 | sh_drm = exec_command(cmd)
468 | verbose_logs("Command used", cmd)
469 | verbose_logs("Command Output", sh_drm)
470 | verbose_logs("Expected output to be compliant","Ensure /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent is not present as a running process")
471 | if "/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/MacOS/ARDAgent" not in sh_drm:
472 | compliant_count += 1
473 | update_compliance_status(compliance_check, "COMPLIANT")
474 | else:
475 | compliant_count -= 1
476 | update_compliance_status(compliance_check, "NON-COMPLIANT")
477 | verbose_logs("To be compliant, check","in System Preferences->Sharing->turn off Remote Management")
478 |
479 | #ENERGY SAVER
480 | compliance_check = "Disable \"Wake for network access\" (Scored, Level 2)"
481 | cmd = "pmset -g | grep -i 'AC Power'"
482 | ac_power_status = exec_command(cmd)
483 | verbose_logs("Command used", cmd)
484 | verbose_logs("Command Output", ac_power_status)
485 | verbose_logs("Expected output to be compliant","Verify that both values returned are 0")
486 | if "ac power" in ac_power_status.lower():
487 | verbose_logs("INFO","We are using AC Power source")
488 | #-c for charger (wall power), -b for battery
489 | cmd = "pmset -c -g | grep womp; pmset -b -g | grep womp"
490 | womp_values = exec_command(cmd)
491 | verbose_logs("Command used", cmd)
492 | verbose_logs("Command Output", womp_values)
493 | verbose_logs("Expected output to be compliant","Verify that both values returned are 0")
494 | match_womp = re.match(r'.*?womp\s+[1-9].*?',womp_values, re.I|re.M|re.S)
495 | if match_womp:
496 | compliant_count -= 1
497 | update_compliance_status(compliance_check, "NON-COMPLIANT")
498 | verbose_logs("To be compliant, run","sudo pmset -a womp 0")
499 | else:
500 | compliant_count += 1
501 | update_compliance_status(compliance_check, "COMPLIANT")
502 | else:
503 | update_compliance_status(compliance_check, "COULD NOT VERIFY COMPLIANCE")
504 |
505 | compliance_check = "Disable sleeping the computer when connected to power (Scored, Level 2)"
506 | if "AC Power" in ac_power_status:
507 | cmd = "pmset -g | egrep \"^\s*sleep\""
508 | pwr_is_sleep = exec_command(cmd)
509 | verbose_logs("Command used", cmd)
510 | verbose_logs("Command Output", womp_values)
511 | verbose_logs("Expected output to be compliant","Verify returned value is 0")
512 | #sleep_val = re.match(r'', pwr_is_sleep, re.I|re.M|re.S)
513 | if " 0" in pwr_is_sleep:
514 | compliant_count += 1
515 | update_compliance_status(compliance_check, "COMPLIANT")
516 | else:
517 | compliant_count -= 1
518 | update_compliance_status(compliance_check, "NON-COMPLIANT")
519 | verbose_logs("To be compliant, run","sudo pmset -c sleep 0 or System Preferences->Energy Saver->slider for Put the computer to sleep/Turn display off after to never")
520 |
521 | #SECURITY AND PRIVACY
522 | compliance_check = "Enable FileVault (Scored, Level 1)"
523 | cmd = "diskutil cs list | grep -i encryption"
524 | sp_enc_status = exec_command(cmd)
525 | verbose_logs("Command used", cmd)
526 | verbose_logs("Command Output", sp_enc_status)
527 | verbose_logs("Expected output to be compliant","Logical Volume should show as both Encrypted and unlocked")
528 | enc_status = re.match(r'Encryption\s+Type:(.*?)', sp_enc_status, re.I|re.M)
529 | if enc_status:
530 | print "enc_status groups:", enc_status.groups()
531 | print "enc_status group1:", enc_status.group(1)
532 | if ("AES-XTS" in sp_enc_status) and ("Unlocked" in sp_enc_status):
533 | compliant_count += 1
534 | update_compliance_status(compliance_check, "COMPLIANT")
535 | else:
536 | compliant_count -= 1
537 | update_compliance_status(compliance_check, "NON-COMPLIANT")
538 | verbose_logs("To be compliant, Check","System Preferences->Security and Privacy->FileVault->Turn on FileVault")
539 |
540 | compliance_check = "Enable Gatekeeper (Scored, Level 1)"
541 | cmd = "sudo spctl --status"
542 | sp_gatekeeper = exec_command(cmd)
543 | if "assessments enabled" in sp_gatekeeper:
544 | compliant_count += 1
545 | update_compliance_status(compliance_check, "COMPLIANT")
546 | else:
547 | compliant_count -= 1
548 | update_compliance_status(compliance_check, "NON-COMPLIANT")
549 | verbose_logs("To be compliant, Check","System Preferences->Security and Privacy->General->select Allow applications downloaded from: Mac App Store and identified developers")
550 | verbose_logs("or execute command", "sudo spctl --master-enable")
551 |
552 | compliance_check = "Enable Firewall (Scored, Level 1)"
553 | cmd = "defaults read /Library/Preferences/com.apple.alf globalstate"
554 | sp_fw_status = exec_command(cmd)
555 | verbose_logs("Command used", cmd)
556 | verbose_logs("Command Output", sp_fw_status)
557 | verbose_logs("Expected output to be compliant","Returned value must be 1 or 2")
558 | if "1" in sp_fw_status or "2" in sp_fw_status:
559 | compliant_count += 1
560 | update_compliance_status(compliance_check, "COMPLIANT")
561 | else:
562 | compliant_count -= 1
563 | update_compliance_status(compliance_check, "NON-COMPLIANT")
564 | verbose_logs("To be compliant, run","defaults write /Library/Preferences/com.apple.alf globalstate - int ")
565 | verbose_logs("or to be compliant check", "System Preferences->Security and Privacy->Firewall->select Turn On Firewall")
566 |
567 | compliance_check = "Enable Firewall Stealth Mode (Scored, Level 1)"
568 | cmd = "/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode"
569 | sp_fw_stealthmode = exec_command(cmd)
570 | verbose_logs("Command used", cmd)
571 | verbose_logs("Command Output", sp_fw_stealthmode)
572 | verbose_logs("Expected output to be compliant","Verify the value returned is Stealth mode enabled")
573 | if "enabled" in sp_fw_stealthmode:
574 | compliant_count += 1
575 | update_compliance_status(compliance_check, "COMPLIANT")
576 | else:
577 | compliant_count -= 1
578 | update_compliance_status(compliance_check, "NON-COMPLIANT")
579 | verbose_logs("To be compliant, run","sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on")
580 | verbose_logs("or To be compliant, check","System Preferences->Security and Privacy->Firewall Options->select Enable stealth mode")
581 | verbose_logs("INFO","ping might not work")
582 |
583 | compliance_check = "Review Application Firewall Rules (Scored, Level 1)"
584 | cmd = "/usr/libexec/ApplicationFirewall/socketfilterfw --listapps |grep \" : \" |wc -l"
585 | sp_fw_rulecount = exec_command(cmd)
586 | verbose_logs("Command used", cmd)
587 | verbose_logs("Command Output", sp_fw_rulecount)
588 | verbose_logs("Expected output to be compliant","Verify that the number of rules returned is lower than 10")
589 | verbose_logs("To be compliant, run(to remove ACL's)","/usr/libexec/ApplicationFirewall/socketfilterfw --remove ")
590 | fw_rule_count = int(sp_fw_rulecount.strip())
591 | if fw_rule_count <= 10:
592 | compliant_count += 1
593 | update_compliance_status(compliance_check, "COMPLIANT")
594 | else:
595 | compliant_count -= 1
596 | update_compliance_status(compliance_check, "NON-COMPLIANT")
597 | verbose_logs("To be compliant, run(to remove ACL's)","/usr/libexec/ApplicationFirewall/socketfilterfw --remove ")
598 | verbose_logs("To be compliant, Check","System Preferences->Security and Privacy->Firewall Options->select unneeded rules->select the minus sign below to delete them")
599 |
600 | compliance_check = "Enable Location Services (Not Scored, Level 2)"
601 | cmd = "sudo launchctl load /System/Library/LaunchDaemons/com.apple.locationd.plist"
602 | ps_location_services = exec_command(cmd)
603 | verbose_logs("Command used", cmd)
604 | verbose_logs("Command Output", ps_location_services)
605 | verbose_logs("Expected output to be compliant","Operation already in progress or service already loaded in output")
606 | if ("operation already in progress" in ps_location_services) or ("service already loaded" in ps_location_services):
607 | compliant_count += 1
608 | update_compliance_status(compliance_check, "COMPLIANT")
609 | else:
610 | update_compliance_status(compliance_check, "NON-COMPLIANT")
611 | verbose_logs("To be compliant, run","sudo launchctl load /System/Library/LaunchDaemons/com.apple.locationd.plist")
612 |
613 | compliance_check = "Monitor Location Services Access (Not Scored, Level 2)"
614 | cmd = "defaults read ~/Library/Preferences/com.apple.safari.plist SafariGeolocationPermissionPolicy globalstate"
615 | sp_lsa = exec_command(cmd)
616 | verbose_logs("Command used", cmd)
617 | verbose_logs("Command Output", sp_lsa)
618 | verbose_logs("Expected output to be compliant","Recommend using 0 or 1")
619 | if "2" in sp_lsa:
620 | update_compliance_status(compliance_check, "NON-COMPLIANT")
621 | verbose_logs("To be compliant, run","sudo launchctl load /System/Library/LaunchDaemons/com.apple.locationd.plist")
622 | else:
623 | compliant_count += 1
624 | update_compliance_status(compliance_check, "COMPLIANT")
625 | verbose_logs("To be compliant, check","open Safari->Select Safari from the menu bar->Preferences->Privacy->Check Deny without prompting(0) or Prompt for each website once each day(1)")
626 | verbose_logs("Review Applications using Location Services","System Preferences->Security and Privacy->Privacy->Location Services->Uncheck applications that are not approved for access to location service information")
627 | cmd = "sudo defaults read /var/db/locationd/clients.plist | grep -i com.*"
628 | sp_els = exec_command(cmd)
629 | verbose_logs("Command used", cmd)
630 | verbose_logs("Command Output(Applications using Location Services)", sp_els)
631 |
632 | #iCloud
633 | compliance_check = "iCloud configuration (Not Scored, Level 2)"
634 | verbose_logs("Command used", "COMMAND NOT FOUND FOR THIS CHECK")
635 | verbose_logs("Expected output to be compliant","Disable iCloud or configure the access to best enable data protection")
636 | update_compliance_status(compliance_check, "MANUAL VERIFICATION NEEDED")
637 | verbose_logs("INFO","Data Leakage is possible")
638 |
639 | compliance_check = "iCloud keychain (Not Scored, Level 2)"
640 | verbose_logs("Command used", "COMMAND NOT FOUND FOR THIS CHECK")
641 | verbose_logs("Expected output to be compliant","open System Preferences->iCloud->deselect Keychain if it is not approved in your organization")
642 | update_compliance_status(compliance_check, "MANUAL VERIFICATION NEEDED")
643 | verbose_logs("INFO","Ensure that the iCloud keychain is used consistently with organizational requirements")
644 | compliance_check = "iCloud Drive (Not Scored, Level 2)"
645 |
646 | compliance_check = "iCloud Drive(Not Scored, Level 2)"
647 | verbose_logs("Command used", "COMMAND NOT FOUND FOR THIS CHECK")
648 | verbose_logs("Expected output to be compliant","open System Preferences->iCloud->uncheck iCloud Drive")
649 | update_compliance_status(compliance_check, "MANUAL VERIFICATION NEEDED")
650 |
651 | compliance_check = "iCloud Drive Document sync (Scored, Level 2)"
652 | cmd = "ls -l ~/Library/Mobile?\ Documents/com~apple~CloudDocs/Documents/ | grep total"
653 | ps_ddsync = exec_command(cmd)
654 | verbose_logs("Command used", cmd)
655 | verbose_logs("Command Output", ps_ddsync)
656 | verbose_logs("Expected output to be compliant","There should be no result")
657 | verbose_logs("To be compliant, check","open System Preferences->iCloud->iCloud Drive->select Options next to iCloud Drive->uncheck Desktop & Documents Folders")
658 | if "EXCEPTION" in ps_ddsync:
659 | compliant_count += 1
660 | update_compliance_status(compliance_check, "COMPLIANT")
661 | else:
662 | compliant_count -= 1
663 | update_compliance_status(compliance_check, "NON-COMPLIANT")
664 |
665 | compliance_check = "iCloud Drive Desktop sync (Scored, Level 2)"
666 | cmd = "ls -l ~/Library/Mobile?\ Documents/com~apple~CloudDocs/Desktop/ | grep total"
667 | icloud_dds = exec_command(cmd)
668 | verbose_logs("Command used", cmd)
669 | verbose_logs("Command Output", icloud_dds)
670 | verbose_logs("Expected output to be compliant","There should be no result")
671 | verbose_logs("To be compliant, check","open System Preferences->iCloud->iCloud Drive->select Options next to iCloud Drive->uncheck Desktop & Documents Folders")
672 | if "EXCEPTION" in icloud_dds:
673 | compliant_count += 1
674 | update_compliance_status(compliance_check, "COMPLIANT")
675 | else:
676 | compliant_count -= 1
677 | update_compliance_status(compliance_check, "NON-COMPLIANT")
678 |
679 | #TIME MACHINE
680 | compliance_check = "Time Machine Auto-Backup (Scored, Level 2)"
681 | cmd = "defaults read /Library/Preferences/com.apple.TimeMachine.plist AutoBackup"
682 | tm_bkup = exec_command(cmd)
683 | verbose_logs("Command used", cmd)
684 | verbose_logs("Command Output", tm_bkup)
685 | verbose_logs("Expected output to be compliant","output should not be zero")
686 | if int(tm_bkup) != 0:
687 | compliant_count += 1
688 | update_compliance_status(compliance_check, "COMPLIANT")
689 | else:
690 | compliant_count -= 1
691 | update_compliance_status(compliance_check, "NON-COMPLIANT")
692 | verbose_logs("To be compliant, run","defaults write /Library/Preferences/com.apple.TimeMachine.plist AutoBackup 1")
693 |
694 | compliance_check = "Time Machine Volumes Are Encrypted (Not Scored, Level 1)"
695 | cmd = "tmutil destinationinfo"
696 | tm_vol = exec_command(cmd)
697 | verbose_logs("Command used", cmd)
698 | verbose_logs("Command Output", tm_vol)
699 | verbose_logs("Expected output to be compliant","")
700 | if "no destinations configured" in tm_vol.lower():
701 | update_compliance_status(compliance_check, "NON-COMPLIANT")
702 | elif "local" in tm_vol.lower():
703 | cmd = "diskutil list"
704 | tm_drive_list = exec_command(cmd)
705 | verbose_logs("Command used", cmd)
706 | verbose_logs("Command Output", tm_drive_list)
707 | verbose_logs("Expected output to be compliant","All Time Machine targets identified using tmutil should show an encrypted status")
708 | #TODO - did not get encrypted drives on test machine
709 | verbose_logs("To be compliant, run","defaults write /Library/Preferences/com.apple.TimeMachine.plist AutoBackup 1")
710 | update_compliance_status(compliance_check, "MANUAL VERIFICATION NEEDED")
711 |
712 | compliance_check = "Pair the remote control infrared receiver if enabled (Scored, Level 1)"
713 | cmd = "system_profiler 2>/dev/null | egrep \"IR Receiver\""
714 | tm_sp = exec_command(cmd)
715 | verbose_logs("Command used", cmd)
716 | verbose_logs("Command Output", tm_sp)
717 | verbose_logs("Expected output to be compliant","If DeviceEnabled = 1, then verify the value returned for the UIDFilter does not equal none")
718 | if "EXCEPTION" in tm_sp:
719 | compliant_count += 1
720 | update_compliance_status(compliance_check, "COMPLIANT")
721 | else:
722 | compliant_count -= 1
723 | update_compliance_status(compliance_check, "NON-COMPLIANT")
724 | cmd = "defaults read /Library/Preferences/com.apple.driver.AppleIRController"
725 | ir_details = exec_command(cmd)
726 | ir_dev_enabled = re.match(r'.*?DeviceEnabled\s+=\s+(\d);.*?',ir_details, re.I|re.M|re.S)
727 | ir_udifilter = re.match(r'.*?UIDFilter\s+=\s+(\w+);.*?',ir_details, re.I|re.M|re.S)
728 | print "ir_dev_enabled.groups:", ir_dev_enabled.groups(), "1:", ir_dev_enabled.group(1)
729 | print "ir_udifilter.groups:", ir_udifilter.groups(), "1:",ir_udifilter.group(1)
730 | print "Verify the value returned for DeviceEnabled = 0"
731 | verbose_logs("To be compliant, check","System Preferences->Security & Privacy->General->Advanced->check Disable remote control infrared receiver")
732 |
733 | compliance_check = "Enable Secure Keyboard Entry in terminal.app (Scored, Level 1)"
734 | cmd = "defaults read -app Terminal SecureKeyboardEntry"
735 | skbe = exec_command(cmd)
736 | verbose_logs("Command used", cmd)
737 | verbose_logs("Command Output", skbe)
738 | verbose_logs("Expected output to be compliant","Verify the value returned is 1")
739 | verbose_logs("To be compliant, check","open Terminal->select Terminal menu->select Secure Keyboard Entry")
740 | if "1" in skbe:
741 | compliant_count += 1
742 | update_compliance_status(compliance_check, "COMPLIANT")
743 | else:
744 | compliant_count -= 1
745 | update_compliance_status(compliance_check, "NON-COMPLIANT")
746 | verbose_logs("To be compliant, check","open Terminal->select Terminal menu->select Secure Keyboard Entry")
747 | verbose_logs("INFO","Secure Keyboard Entry prevents other applications on system/network from detecting and recording what is typed into Terminal")
748 |
749 | compliance_check = "Java 6 is not the default Java runtime (Scored, Level 2)"
750 | cmd = "java -version"
751 | java_ver = exec_command(cmd)
752 | verbose_logs("Command used", cmd)
753 | verbose_logs("Command Output", java_ver)
754 | verbose_logs("Expected output to be compliant","Java version greater than 1.6")
755 | verbose_logs("To be compliant, run","Update Java to latest version")
756 | #correct comparison is check for versions less than 1.7
757 | if "1.6" in java_ver:
758 | compliant_count -= 1
759 | update_compliance_status(compliance_check, "NON-COMPLIANT")
760 | else:
761 | compliant_count += 1
762 | update_compliance_status(compliance_check, "COMPLIANT")
763 |
764 | compliance_check = "Securely delete files as needed (Not Scored, Level 2)"
765 | cmd = "diskutil secureErase"
766 | update_compliance_status(compliance_check + "(using command \"" + cmd +"\")", "MANUAL VERIFICATION NEEDED")
767 |
768 | def check_logging_and_auditing():
769 | global compliant_count
770 |
771 | #LOGGING AND AUDITING
772 | #Configure asl.conf
773 | verbose_logs("INFO","maximum file size limitation string should be removed \"all_max=\"")
774 | verbose_logs("INFO","An organization appropriate retention should be added \"ttl=\"")
775 | verbose_logs("INFO","The rotation should be set with time stamps \"rotate=utc\" or \"rotate=local\"")
776 |
777 | compliance_check = "Retain system.log for 90 or more days (Scored, Level 1)"
778 | #> system.log mode=0640 format=bsd rotate=seq compress file_max=5M all_max=50M
779 | cmd = "grep -i ttl /etc/asl.conf |grep -i system\.log"
780 | systemlog_ttl = exec_command(cmd)
781 | verbose_logs("Command used", cmd)
782 | verbose_logs("Command Output", systemlog_ttl)
783 | verbose_logs("Expected output to be compliant","Verify that the ttl for system.log is greater than 90 days")
784 | verbose_logs("To be compliant, edit","/etc/asl.conf by adding ttl=90 or greater to system.log line")
785 | system_log_line = re.match(r'\s*[>?]\s*system.log.*?ttl=(\d+)',systemlog_ttl, re.I|re.M)
786 | if system_log_line:
787 | print "system_log_line groups:", system_log_line.groups()
788 | print "system_log_line group 1:", system_log_line.group(1)
789 | system_log_ttl = int(system_log_line.group(1))
790 | if system_log_ttl >= 90:
791 | compliant_count += 1
792 | update_compliance_status(compliance_check, "COMPLIANT")
793 | else:
794 | compliant_count -= 1
795 | update_compliance_status(compliance_check, "NON-COMPLIANT")
796 | else:
797 | compliant_count -= 1
798 | update_compliance_status(compliance_check, "NON-COMPLIANT")
799 |
800 | compliance_check = "Retain appfirewall.log for 90 or more days (Scored, Level 1)"
801 | cmd = "grep -i ttl /etc/asl.conf |grep -i appfirewall\.log"
802 | appfirewalllog_ttl = exec_command(cmd)
803 | verbose_logs("Command used", cmd)
804 | verbose_logs("Command Output", appfirewalllog_ttl)
805 | verbose_logs("Expected output to be compliant","Verify that the ttl for appfirewall.log is greater than 90 days")
806 | verbose_logs("To be compliant, edit","/etc/asl.conf by adding ttl=90 or greater to appfirewall.log line")
807 | appfirewall_log_line = re.match(r'\s*[>?]\s*appfirewall.log.*?ttl=(\d+)',appfirewalllog_ttl, re.I|re.M)
808 | if appfirewall_log_line:
809 | appfirewall_log_ttl = int(appfirewall_log_line.group(1))
810 | if appfirewall_log_ttl >= 90:
811 | compliant_count += 1
812 | update_compliance_status(compliance_check, "COMPLIANT")
813 | else:
814 | compliant_count -= 1
815 | update_compliance_status(compliance_check, "NON-COMPLIANT")
816 | else:
817 | compliant_count -= 1
818 | update_compliance_status(compliance_check, "NON-COMPLIANT")
819 |
820 | compliance_check = "Retain authd.log for 90 or more days (Scored, Level 1)"
821 | cmd = "grep -i ttl /etc/asl/com.apple.authd"
822 | authd_log_ttl = exec_command(cmd)
823 | verbose_logs("Command used", cmd)
824 | verbose_logs("Command Output", authd_log_ttl)
825 | verbose_logs("Expected output to be compliant","Verify that ttl is 90 or higher for authd.log")
826 | verbose_logs("To be compliant, run","")
827 | verbose_logs("To be compliant, edit","/etc/asl.conf by adding ttl=90 or greater to system.log line")
828 | authd_log_line = re.match(r'\s*[>|?|*]\s*authd.log.*?ttl=(\d+)',authd_log_ttl, re.I|re.M)
829 | if authd_log_line:
830 | print "authd_log_line groups:", authd_log_line.groups()
831 | print "authd_log_line group 1:", authd_log_line.group(1)
832 | authd_log_ttl = int(authd_log_line.group(1))
833 | if authd_log_ttl >= 90:
834 | compliant_count += 1
835 | update_compliance_status(compliance_check, "COMPLIANT")
836 | else:
837 | compliant_count -= 1
838 | update_compliance_status(compliance_check, "NON-COMPLIANT")
839 | else:
840 | compliant_count -= 1
841 | update_compliance_status(compliance_check, "NON-COMPLIANT")
842 |
843 | compliance_check = "Enable security auditing (Scored, Level 1)"
844 | cmd = "sudo launchctl list | grep -i auditd"
845 | sec_audit = exec_command(cmd)
846 | verbose_logs("Command used", cmd)
847 | verbose_logs("Command Output", sec_audit)
848 | verbose_logs("Expected output to be compliant","Verify \"com.apple.auditd\" appears.")
849 | if "com.apple.auditd" in sec_audit:
850 | compliant_count += 1
851 | update_compliance_status(compliance_check, "COMPLIANT")
852 | else:
853 | compliant_count -= 1
854 | update_compliance_status(compliance_check, "NON-COMPLIANT")
855 | verbose_logs("To be compliant, run","sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.auditd.plist")
856 |
857 | compliance_check = "Configure Security Auditing Flags (Scored, Level 2)"
858 | cmd = "sudo egrep \"^flags:\" /etc/security/audit_control"
859 | sec_audit_flags = exec_command(cmd)
860 | verbose_logs("Command used", cmd)
861 | verbose_logs("Command Output", sec_audit_flags)
862 | verbose_logs("Expected output to be compliant","Atleast one of the flags lo, ad, fd, fm, -all must be set")
863 | verbose_logs("To be compliant, edit","/etc/security/audit_control by adding required flag(s) lo, ad, fd, fm, -all")
864 | if "lo" in sec_audit_flags or "ad" in sec_audit_flags or "fd" in sec_audit_flags or "fm" in sec_audit_flags or "-all" in sec_audit_flags:
865 | compliant_count += 1
866 | update_compliance_status(compliance_check, "COMPLIANT")
867 | else:
868 | compliant_count -= 1
869 | update_compliance_status(compliance_check, "NON-COMPLIANT")
870 | verbose_logs("To be compliant, edit","/etc/security/audit_control by adding required flag(s) lo, ad, fd, fm, -all")
871 | verbose_logs("INFO", "lo - audit successful/failed login/logout events")
872 | verbose_logs("INFO", "ad - audit successful/failed administrative events")
873 | verbose_logs("INFO", "fd - audit successful/failed file deletion events")
874 | verbose_logs("INFO", "fm - audit successful/failed file attribute modification events")
875 | verbose_logs("INFO", "-all - audit all failed events across all audit classes")
876 |
877 | compliance_check = "Enable remote logging for Desktops on trusted networks (Not Scored, Level 2)"
878 | cmd = "grep -v \"127\.0\.0\" /etc/syslog.conf"
879 | #flat file logs are now configured in /etc/asl.conf
880 | syslog_ipaddr = exec_command(cmd)
881 | verbose_logs("Command used", cmd)
882 | verbose_logs("Command Output", syslog_ipaddr)
883 | verbose_logs("Expected output to be compliant","Remote loggind enabled. Must find entry \"*.* @syslog_ip_addr\"")
884 | syslog_server_config = re.match(r'@\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}',syslog_ipaddr, re.I|re.M)
885 | #check valip Syslog Server IP Address is configured
886 | if syslog_server_config:
887 | compliant_count += 1
888 | update_compliance_status(compliance_check, "COMPLIANT")
889 | else:
890 | update_compliance_status(compliance_check, "NON-COMPLIANT")
891 | verbose_logs("To be compliant, edit","/etc/syslog.conf by adding \"*.* @syslog_ip_addr\" on the top of the file")
892 |
893 | compliance_check = "Retain install.log for 365 or more days (Scored, Level 1)"
894 | cmd = "grep -i ttl /etc/asl/com.apple.install"
895 | install_log_ttl = exec_command(cmd)
896 | verbose_logs("Command used", cmd)
897 | verbose_logs("Command Output", install_log_ttl)
898 | verbose_logs("Expected output to be compliant","Verify that ttl is 365 or higher for install.log")
899 | verbose_logs("To be compliant, run","")
900 | verbose_logs("To be compliant, edit","/etc/asl/com.apple.install by adding ttl=90 or greater to install.log line")
901 | install_log_line = re.match(r'\s*[>|?|*]\s*install.log.*?ttl=(\d+)',install_log_ttl, re.I|re.M)
902 | if install_log_line:
903 | print "install_log_line groups:", install_log_line.groups()
904 | print "install_log_line group 1:", install_log_line.group(1)
905 | install_log_ttl = int(install_log_line.group(1))
906 | if install_log_ttl >= 365:
907 | compliant_count += 1
908 | update_compliance_status(compliance_check, "COMPLIANT")
909 | else:
910 | compliant_count -= 1
911 | update_compliance_status(compliance_check, "NON-COMPLIANT")
912 | else:
913 | compliant_count -= 1
914 | update_compliance_status(compliance_check, "NON-COMPLIANT")
915 |
916 | def network_configurations():
917 | global compliant_count
918 |
919 | compliance_check = "Disable Bonjour advertising service (Scored, Level 2)"
920 | #file was not present on my test machine
921 | cmd = "defaults read /Library/Preferences/com.apple.mDNSResponder.plist NoMulticastAdvertisements"
922 | is_bonjour_running = exec_command(cmd)
923 | verbose_logs("Command used", cmd)
924 | verbose_logs("Command Output", is_bonjour_running)
925 | verbose_logs("Expected output to be compliant","Verify the value returned is 1")
926 | if "1" in is_bonjour_running:
927 | compliant_count += 1
928 | update_compliance_status(compliance_check, "COMPLIANT")
929 | else:
930 | compliant_count -= 1
931 | update_compliance_status(compliance_check, "NON-COMPLIANT")
932 | verbose_logs("To be compliant, run","defaults write /Library/Preferences/com.apple.mDNSResponder.plist NoMulticastAdvertisements")
933 | verbose_logs("INFO","Final Cut Studio and AirPort Base Station management might not work if mDNSResponder is turned off")
934 |
935 | compliance_check = "Enable \"Show Wi-Fi status in menu bar\" (Scored, Level 1)"
936 | cmd = "defaults read com.apple.systemuiserver menuExtras | grep AirPort.menu"
937 | wifi_menubar = exec_command(cmd)
938 | verbose_logs("Command used", cmd)
939 | verbose_logs("Command Output", wifi_menubar)
940 | verbose_logs("Expected output to be compliant","output should have /System/Library/CoreServices/Menu Extras/AirPort.menu")
941 | if "/System/Library/CoreServices/Menu Extras/AirPort.menu" in wifi_menubar:
942 | compliant_count += 1
943 | update_compliance_status(compliance_check, "COMPLIANT")
944 | else:
945 | compliant_count -= 1
946 | update_compliance_status(compliance_check, "NON-COMPLIANT")
947 | verbose_logs("To be compliant, check","System Preferences->Network->check Check Show Wi-Fi status in menu bar")
948 |
949 | compliance_check = "Create network specific locations (Not Scored, Level 2)"
950 | verbose_logs("INFO","Ready Network configs for Mobility")
951 | verbose_logs("INFO","Remove unnecessary Network services like FireWire, VPN, AirPort or Ethernet")
952 | verbose_logs("Command used", "COMMAND NOT FOUND FOR THIS CHECK")
953 | update_compliance_status(compliance_check, "MANUAL VERIFICATION NEEDED")
954 | print "MANUAL. Open System Preferences: Network. Verify each network location is set up properly"
955 | verbose_logs("To be compliant, check","open System Preferences->Network->Verify each network location is set up properly. Remove unnecessary Network services")
956 |
957 | compliance_check = "Ensure http server is not running (Scored, Level 1)"
958 | cmd = "ps -ef | grep -i httpd"
959 | is_httpd_running = exec_command(cmd)
960 | verbose_logs("Command used", cmd)
961 | verbose_logs("Command Output", is_httpd_running)
962 | verbose_logs("Expected output to be compliant","No results for /usr/sbin/httpd")
963 | if "/httpd" in is_httpd_running.lower():
964 | compliant_count -= 1
965 | update_compliance_status(compliance_check, "NON-COMPLIANT")
966 | verbose_logs("To be compliant, run","sudo apachectl stop; sudo defaults write /System/Library/LaunchDaemons/org.apache.httpd Disabled -bool true")
967 | else:
968 | compliant_count += 1
969 | update_compliance_status(compliance_check, "COMPLIANT")
970 |
971 | compliance_check = "Ensure ftp server is not running (Scored, Level 1)"
972 | cmd = "sudo launchctl list | egrep ftp"
973 | is_ftpd_running = exec_command(cmd)
974 | verbose_logs("Command used", cmd)
975 | verbose_logs("Command Output", is_ftpd_running)
976 | verbose_logs("Expected output to be compliant","No results for com.apple.ftpd")
977 | if "com.apple.ftpd" in is_ftpd_running:
978 | compliant_count -= 1
979 | update_compliance_status(compliance_check, "NON-COMPLIANT")
980 | verbose_logs("To be compliant, run","sudo -s launchctl unload -w /System/Library/LaunchDaemons/ftp.plist")
981 | else:
982 | compliant_count += 1
983 | update_compliance_status(compliance_check, "COMPLIANT")
984 |
985 | compliance_check = "Ensure nfs server is not running (Scored, Level 1)"
986 | cmd = "ps -ef | grep -i nfsd"
987 | is_nfsd_running = exec_command(cmd)
988 | verbose_logs("Command used", cmd)
989 | verbose_logs("Command Output", is_nfsd_running)
990 | verbose_logs("Expected output to be compliant","no results for /sbin/nfsd and /etc/export file should not be present")
991 | if "/nfsd" in is_nfsd_running or os.path.isfile("/etc/exports"):
992 | compliant_count -= 1
993 | update_compliance_status(compliance_check, "NON-COMPLIANT")
994 | verbose_logs("To be compliant, run","sudo nfsd disable; rm /etc/export")
995 | else:
996 | compliant_count += 1
997 | update_compliance_status(compliance_check, "COMPLIANT")
998 |
999 | def sysAccess_Authen_Authoriz():
1000 | global compliant_count
1001 |
1002 | #SYSTEM ACCESS, AUTHENTICATION AND AUTHORIZATION
1003 | #File System Permissions and Access Controls
1004 | compliance_check = "Secure Home Folders (Scored, Level 1)"
1005 | cmd = "ls -l /Users/"
1006 | usr_dirlist = exec_command(cmd)
1007 | verbose_logs("Command used", cmd)
1008 | verbose_logs("Command Output", usr_dirlist)
1009 | verbose_logs("Expected output to be compliant","User directory permissions should be either \"drwx------\" or \"drwx--x--x\"")
1010 | udl = usr_dirlist.split('\n')
1011 | for each_udl in udl:
1012 | print "each_udl:", each_udl
1013 | if "drwx------" not in each_udl or "drwx--x--x" not in each_udl:
1014 | compliant_count -= 1
1015 | update_compliance_status(compliance_check, "NON-COMPLIANT")
1016 | verbose_logs("To be compliant, run","")
1017 | break
1018 | else:
1019 | compliant_count += 1
1020 | update_compliance_status(compliance_check, "COMPLIANT")
1021 |
1022 | compliance_check = "Check System Wide Applications for appropriate permissions (Scored, Level 1)"
1023 | cmd = "sudo find /Applications -iname \"*\.app\" -type d -perm -2 -ls"
1024 | app_permissions = exec_command(cmd)
1025 | verbose_logs("Command used", cmd)
1026 | verbose_logs("Command Output", app_permissions)
1027 | verbose_logs("Expected output to be compliant","There should not be any Apps with world writable permissions")
1028 | if "/Applications/" in app_permissions or "EXCEPTION" not in app_permissions:
1029 | compliant_count -= 1
1030 | update_compliance_status(compliance_check, "NON-COMPLIANT")
1031 | verbose_logs("To be compliant","Applications identified should be removed or changed permissions to drwxr-xr-x")
1032 | verbose_logs("To be compliant,run ","sudo chmod -R o-w /Applications/BadPermissions.app/")
1033 | else:
1034 | compliant_count += 1
1035 | update_compliance_status(compliance_check, "COMPLIANT")
1036 |
1037 | compliance_check = "Check System folder for world writable files (Scored, Level 1)"
1038 | cmd = "sudo find /System -type d -perm -2 -ls | grep -v \"Public/Drop Box\""
1039 | sys_permissions = exec_command(cmd)
1040 | verbose_logs("Command used", cmd)
1041 | verbose_logs("Command Output", sys_permissions)
1042 | verbose_logs("Expected output to be compliant","There should not be any System folder with world writable permissions")
1043 | if "/System/" in sys_permissions or "EXCEPTION" not in sys_permissions:
1044 | compliant_count -= 1
1045 | update_compliance_status(compliance_check, "NON-COMPLIANT")
1046 | verbose_logs("To be compliant,run","sudo chmod -R o-w /Bad/Directory")
1047 | else:
1048 | compliant_count += 1
1049 | update_compliance_status(compliance_check, "COMPLIANT")
1050 |
1051 | compliance_check = "Check Library folder for world writable files (Scored, Level 2)"
1052 | cmd = "sudo find /Library -type d -perm -2 -ls | grep -v Caches"
1053 | world_writable_libs = exec_command(cmd)
1054 | verbose_logs("Command used", cmd)
1055 | verbose_logs("Command Output", world_writable_libs)
1056 | verbose_logs("Expected output to be compliant","There should not be any Library folder with world writable permissions")
1057 | if "/Library" in world_writable_libs or "EXCEPTION" not in world_writable_libs:
1058 | compliant_count -= 1
1059 | update_compliance_status(compliance_check, "NON-COMPLIANT")
1060 | verbose_logs("To be compliant,run","sudo chmod -R o-w /Bad/Directory")
1061 | else:
1062 | compliant_count += 1
1063 | update_compliance_status(compliance_check, "COMPLIANT")
1064 |
1065 | #Password Management
1066 | compliance_check = "Configure account lockout threshold (Scored)"
1067 | #pwpolicy -getaccountpolicies did not return any value on my test setup
1068 | #sudo pwpolicy -n /Local/Default -a -setglobalpolicy minChars=8
1069 | #sudo pwpolicy -n /Local/Default -setglobalpolicy "minChars=14 requiresAlpha=1 requiresNumeric=1 requiresMixedCase=1 requiresSymbol=1 passwordCannotBeName=1 maxFailedLoginAttempts=5"
1070 | #sudo pwpolicy -n /Local/Default -getglobalpolicy
1071 | cmd = "pwpolicy -getaccountpolicies | grep -A 1 'policyAttributeMaximumFailedAuthentications' | tail -1 | cut -d'>' -f2 | cut -d '<' -f1"
1072 | lockout_threshold = exec_command(cmd)
1073 | verbose_logs("Command used", cmd)
1074 | verbose_logs("Command Output", lockout_threshold)
1075 | verbose_logs("Expected output to be compliant","Verify the value returned is 5 or lower")
1076 | if int(lockout_threshold) <=5:
1077 | compliant_count += 1
1078 | update_compliance_status(compliance_check, "COMPLIANT")
1079 | else:
1080 | compliant_count -= 1
1081 | update_compliance_status(compliance_check, "NON-COMPLIANT")
1082 | verbose_logs("To be compliant, run(sample password policy configuration)","sudo pwpolicy -n /Local/Default -setglobalpolicy \"minChars=15 requiresAlpha=1 requiresNumeric=1 requiresMixedCase=1 requiresSymbol=1 passwordCannotBeName=1 maxFailedLoginAttempts=5\"")
1083 |
1084 | compliance_check = "Set a minimum password length (Scored, Level 1)"
1085 | cmd = "pwpolicy -getaccountpolicies | egrep \"\d+ characters\""
1086 | passwd_len_str = exec_command(cmd)
1087 | verbose_logs("Command used", cmd)
1088 | verbose_logs("Command Output", passwd_len_str)
1089 | verbose_logs("Expected output to be compliant","Password must be a minimum of 15 characters in length")
1090 | passwd_len_stmt = re.match(r'.*?be\s+a\s+minimum\s+of\s+(\d+)\s+characters\s+in\s+length.*?',passwd_len_str, re.I|re.M|re.S)
1091 | if passwd_len_stmt:
1092 | passwd_len = int(passwd_len_stmt.group(1))
1093 | if passwd_len >= 15:
1094 | compliant_count += 1
1095 | update_compliance_status(compliance_check, "COMPLIANT")
1096 | else:
1097 | compliant_count -= 1
1098 | update_compliance_status(compliance_check, "NON-COMPLIANT")
1099 | verbose_logs("To be compliant, run","sudo pwpolicy -n /Local/Default -setglobalpolicy \"minChars=15 requiresAlpha=1 requiresNumeric=1 requiresMixedCase=1 requiresSymbol=1 passwordCannotBeName=1 maxFailedLoginAttempts=5\"")
1100 | else:
1101 | compliant_count -= 1
1102 | update_compliance_status(compliance_check, "NON-COMPLIANT")
1103 | verbose_logs("To be compliant, run","sudo pwpolicy -n /Local/Default -setglobalpolicy \"minChars=15 requiresAlpha=1 requiresNumeric=1 requiresMixedCase=1 requiresSymbol=1 passwordCannotBeName=1 maxFailedLoginAttempts=5\"")
1104 |
1105 | compliance_check = "Complex passwords must contain an Alphabetic Character (Scored, Level 1)"
1106 | cmd = "pwpolicy -getaccountpolicies | egrep Alpha"
1107 | requiresAlpha = exec_command(cmd)
1108 | verbose_logs("Command used", cmd)
1109 | verbose_logs("Command Output", requiresAlpha)
1110 | verbose_logs("Expected output to be compliant","should have \"com.apple.policy.legacy.requiresAlpha\" or \"RequiresAlpha\"")
1111 | if "requiresalpha" in requiresAlpha.lower():
1112 | compliant_count += 1
1113 | update_compliance_status(compliance_check, "COMPLIANT")
1114 | else:
1115 | compliant_count -= 1
1116 | update_compliance_status(compliance_check, "NON-COMPLIANT")
1117 | verbose_logs("To be compliant, run","sudo pwpolicy -n /Local/Default -setglobalpolicy \"minChars=15 requiresAlpha=1\"")
1118 |
1119 | compliance_check = "Complex passwords must contain a Numeric Character (Scored, Level 1)"
1120 | cmd = "pwpolicy -getaccountpolicies | egrep Numeric"
1121 | requiresNumeric = exec_command(cmd)
1122 | verbose_logs("Command used", cmd)
1123 | verbose_logs("Command Output", requiresNumeric)
1124 | verbose_logs("Expected output to be compliant","should have \"com.apple.policy.legacy.requiresNumeric\" or \"RequiresNumeric\"")
1125 | if "requiresnumeric" in requiresNumeric.lower():
1126 | compliant_count += 1
1127 | update_compliance_status(compliance_check, "COMPLIANT")
1128 | else:
1129 | compliant_count -= 1
1130 | update_compliance_status(compliance_check, "NON-COMPLIANT")
1131 | verbose_logs("To be compliant, run","sudo pwpolicy -n /Local/Default -setglobalpolicy \"minChars=15 requiresNumeric=1\"")
1132 |
1133 | compliance_check = "Complex passwords must contain a Special Character (Scored, Level 1)"
1134 | cmd = "pwpolicy -getaccountpolicies | egrep -i symbol"
1135 | requiresSymbol = exec_command(cmd)
1136 | verbose_logs("Command used", cmd)
1137 | verbose_logs("Command Output", requiresSymbol)
1138 | verbose_logs("Expected output to be compliant","should have \"com.apple.policy.legacy.requiresSymbol\" or \"RequiresSymbol\"")
1139 | verbose_logs("To be compliant, run","sudo pwpolicy -n /Local/Default -setglobalpolicy \"minChars=15 requiresSymbol=1\"")
1140 | if "requiressymbol" in requiresSymbol.lower():
1141 | compliant_count += 1
1142 | update_compliance_status(compliance_check, "COMPLIANT")
1143 | else:
1144 | compliant_count -= 1
1145 | update_compliance_status(compliance_check, "NON-COMPLIANT")
1146 | verbose_logs("To be compliant, run","sudo pwpolicy -n /Local/Default -setglobalpolicy \"minChars=15 requiresSymbol=1\"")
1147 |
1148 | compliance_check = "Complex passwords must uppercase and lowercase letters (Scored, Level 1)"
1149 | cmd = "pwpolicy -getaccountpolicies |grep -i requiresMixedCase"
1150 | requiresMixedCase = exec_command(cmd)
1151 | verbose_logs("Command used", cmd)
1152 | verbose_logs("Command Output", requiresMixedCase)
1153 | verbose_logs("Expected output to be compliant","should have \"com.apple.policy.legacy.requiresMixedCase\" or \"RequiresMixedCase\"")
1154 | verbose_logs("To be compliant, run","sudo pwpolicy -n /Local/Default -setglobalpolicy \"minChars=15 requiresMixedCase=1\"")
1155 | if "requiresmixedcase" in requiresMixedCase.lower():
1156 | compliant_count += 1
1157 | update_compliance_status(compliance_check, "COMPLIANT")
1158 | else:
1159 | compliant_count -= 1
1160 | update_compliance_status(compliance_check, "NON-COMPLIANT")
1161 | verbose_logs("To be compliant, run","sudo pwpolicy -n /Local/Default -setglobalpolicy \"minChars=15 requiresMixedCase=1\"")
1162 |
1163 | compliance_check = "Password Age (Scored, Level 1)"
1164 | cmd = "pwpolicy -getaccountpolicies | grep -B8 -A8 -i maxMinutesUntilChangePassword |grep -i integer | grep -oE \"\d+\""
1165 | passwordExp_noDays = exec_command(cmd)
1166 | verbose_logs("Command used", cmd)
1167 | verbose_logs("Command Output", passwordExp_noDays)
1168 | verbose_logs("Expected output to be compliant","should have \"com.apple.policy.legacy.maxMinutesUntilChangePassword\" or \"maxMinutesUntilChangePassword\"")
1169 | #30 days = 30d*24h*60 = 43200
1170 | verbose_logs("To be compliant, run","sudo pwpolicy -n /Local/Default -setglobalpolicy \"minChars=15 maxMinutesUntilChangePassword=43200\"")
1171 | if int(passwordExp_noDays) <= 90:
1172 | compliant_count += 1
1173 | update_compliance_status(compliance_check, "COMPLIANT")
1174 | else:
1175 | compliant_count -= 1
1176 | update_compliance_status(compliance_check, "NON-COMPLIANT")
1177 | verbose_logs("To be compliant, run","sudo pwpolicy -n /Local/Default -setglobalpolicy \"minChars=15 requiresMixedCase=1\"")
1178 |
1179 | compliance_check = "Password History (Scored, Level 1)"
1180 | cmd = ""
1181 | n = exec_command(cmd)
1182 |
1183 | compliance_check = "Reduce the sudo timeout period (Scored, Level 1)"
1184 | cmd = ""
1185 | n = exec_command(cmd)
1186 |
1187 | compliance_check = "Automatically lock the login keychain for inactivity (Scored, Level 2)"
1188 | cmd = ""
1189 | n = exec_command(cmd)
1190 |
1191 | compliance_check = "Ensure login keychain is locked when the computer sleeps (Scored, Level 2)"
1192 | cmd = ""
1193 | n = exec_command(cmd)
1194 |
1195 | compliance_check = "Enable OCSP and CRL certificate checking (Scored, Level 2)"
1196 | cmd = ""
1197 | n = exec_command(cmd)
1198 |
1199 | compliance_check = "Do not enable the \"root\" account (Scored, Level 1)"
1200 | cmd = ""
1201 | n = exec_command(cmd)
1202 |
1203 | compliance_check = "Disable automatic login (Scored, Level 1)"
1204 | cmd = ""
1205 | n = exec_command(cmd)
1206 |
1207 | compliance_check = "Require a password to wake the computer from sleep or screen saver (Scored, Level 1)"
1208 | cmd = ""
1209 | n = exec_command(cmd)
1210 |
1211 | compliance_check = "Require an administrator password to access system-wide preferences (Scored, Level 1))"
1212 | cmd = ""
1213 | n = exec_command(cmd)
1214 |
1215 | compliance_check = "Disable ability to login to another user's active and locked session (Scored, Level 1)"
1216 | cmd = ""
1217 | n = exec_command(cmd)
1218 |
1219 | compliance_check = "Create a custom message for the Login Screen (Scored, Level 1)"
1220 | cmd = ""
1221 | n = exec_command(cmd)
1222 |
1223 | compliance_check = "Create a Login window banner (Scored, Level 2)"
1224 | cmd = ""
1225 | n = exec_command(cmd)
1226 |
1227 | compliance_check = "Do not enter a password-related hint (Not Scored, Level 1)"
1228 | cmd = ""
1229 | n = exec_command(cmd)
1230 |
1231 | compliance_check = "Disable Fast User Switching (Not Scored, Level 2)"
1232 | cmd = ""
1233 | n = exec_command(cmd)
1234 |
1235 | compliance_check = "Secure individual keychains and items (Not Scored, Level 2)"
1236 | cmd = ""
1237 | n = exec_command(cmd)
1238 |
1239 | compliance_check = "Create specialized keychains for different purposes (Not Scored, Level 2)"
1240 | cmd = ""
1241 | n = exec_command(cmd)
1242 |
1243 | compliance_check = "System Integrity Protection status (Scored, Level 1)"
1244 | cmd = ""
1245 | n = exec_command(cmd)
1246 |
1247 | compliance_check = "Install an approved tokend for smartcard authentication (Scored, Level 2)"
1248 | cmd = ""
1249 | n = exec_command(cmd)
1250 |
1251 | def user_AccountsEnvironment():
1252 | global compliant_count
1253 |
1254 | compliance_check = "Display login window as name and password (Scored, Level 1)"
1255 | cmd = ""
1256 | n = exec_command(cmd)
1257 |
1258 | compliance_check = "Disable \"Show password hints\" (Scored, Level 1)"
1259 | cmd = ""
1260 | n = exec_command(cmd)
1261 |
1262 | compliance_check = "Disable guest account login (Scored, Level 1)"
1263 | cmd = ""
1264 | n = exec_command(cmd)
1265 |
1266 | compliance_check = "Disable \"Allow guests to connect to shared folders\" (Scored, Level 1)"
1267 | cmd = ""
1268 | n = exec_command(cmd)
1269 |
1270 | compliance_check = "Remove Guest home folder (Scored, Level 1)"
1271 | cmd = ""
1272 | n = exec_command(cmd)
1273 |
1274 | compliance_check = "Turn on filename extensions (Scored, Level 1)"
1275 | cmd = ""
1276 | n = exec_command(cmd)
1277 |
1278 | compliance_check = "Disable the automatic run of safe files in Safari (Scored, Level 1)"
1279 | cmd = ""
1280 | n = exec_command(cmd)
1281 |
1282 | compliance_check = "Safari disable Internet Plugins for global use (Not Scored, Level 2)"
1283 | cmd = ""
1284 | n = exec_command(cmd)
1285 |
1286 | compliance_check = "Use parental controls for systems that are not centrally managed (Not Scored, Level 2)"
1287 | cmd = ""
1288 | n = exec_command(cmd)
1289 |
1290 | def additional_considerations():
1291 | global compliant_count
1292 | compliance_check = "Wireless technology on OS X (Not Scored, Level 2)"
1293 | cmd = ""
1294 | n = exec_command(cmd)
1295 | verbose_logs("INFO", "Check Corporate Policies on Disabling/Enabling wireless technologies like Wi-Fi or Bluetooth")
1296 | update_compliance_status(compliance_check, "MANUAL VERIFICATION NEEDED")
1297 |
1298 | compliance_check = "iSight Camera Privacy and Confidentiality Concerns (Not Scored, Level 2)"
1299 | cmd = ""
1300 | n = exec_command(cmd)
1301 |
1302 | compliance_check = "Computer Name Considerations (Not Scored, Level 2)"
1303 | cmd = ""
1304 | n = exec_command(cmd)
1305 |
1306 | compliance_check = "Software Inventory Considerations (Not Scored, Level 2)"
1307 | cmd = ""
1308 | n = exec_command(cmd)
1309 |
1310 | compliance_check = "Firewall Consideration (Not Scored, Level 2)"
1311 | cmd = ""
1312 | n = exec_command(cmd)
1313 |
1314 | compliance_check = "Automatic Actions for Optical Media (Not Scored, Level 1)"
1315 | cmd = ""
1316 | n = exec_command(cmd)
1317 |
1318 | compliance_check = "App Store Automatically download apps purchased on other Macs Considerations (Not Scored, Level 2)"
1319 | cmd = ""
1320 | n = exec_command(cmd)
1321 |
1322 | compliance_check = "Extensible Firmware Interface (EFI) password (Not Scored, Level 2)"
1323 | cmd = ""
1324 | n = exec_command(cmd)
1325 |
1326 | compliance_check = "FileVault and Local Account Password Reset using AppleID (Not Scored, Level 2)"
1327 | cmd = ""
1328 | n = exec_command(cmd)
1329 |
1330 | compliance_check = "Repairing permissions is no longer needed (Not Scored, Level 1)"
1331 | cmd = ""
1332 | n = exec_command(cmd)
1333 |
1334 | compliance_check = "App Store Password Settings (Not Scored, Level 2)"
1335 | cmd = ""
1336 | n = exec_command(cmd)
1337 |
1338 | compliance_check = "Siri on MacOS (Not Scored, Level 1)"
1339 | cmd = ""
1340 | n = exec_command(cmd)
1341 |
1342 | compliance_check = "Apple Watch features with MacOS (Not Scored, Level 1)"
1343 | cmd = ""
1344 | n = exec_command(cmd)
1345 |
1346 | compliance_check = "Apple File System (APFS) (Not Scored, Level 1))"
1347 | cmd = ""
1348 | n = exec_command(cmd)
1349 |
1350 | if __name__ == "__main__":
1351 | global total_compliances
1352 | global compliant_count
1353 |
1354 | parser = argparse.ArgumentParser()
1355 | parser.add_argument("-v", "--verbose", help="increase output verbosity",action="store_true")
1356 | parser.add_argument("-n", "--nocolor", help="plain console output(default logging uses color)",action="store_true")
1357 | args = parser.parse_args()
1358 |
1359 | print "Hardening Checks for Apple MAC based on Centre for Internet Security Benchmarks"
1360 | print "Benchmark Reference","CIS Apple OSX 10.12 Benchmark v1.0.0 - 11-04-2016"
1361 | print "Author: Praveen Darshanam"
1362 |
1363 | verbose_logs("RECOMMENDATION SECTION","Install Updates, Patches and Additional Security Software")
1364 | check_patches()
1365 |
1366 | verbose_logs("RECOMMENDATION SECTION","System Preferences")
1367 | system_preferences()
1368 |
1369 | verbose_logs("RECOMMENDATION SECTION","Logging and Auditing")
1370 | check_logging_and_auditing()
1371 |
1372 | verbose_logs("RECOMMENDATION SECTION","Network Configurations")
1373 | network_configurations()
1374 |
1375 | verbose_logs("RECOMMENDATION SECTION","System Access, Authentication and Authorization")
1376 | sysAccess_Authen_Authoriz()
1377 | """
1378 | print "Checking File System Permissions and Access Controls"
1379 | print "Checking Password Management"
1380 | """
1381 | verbose_logs("RECOMMENDATION SECTION","User Accounts and Environment")
1382 | user_AccountsEnvironment()
1383 |
1384 | verbose_logs("RECOMMENDATION SECTION","Additional Considerations")
1385 | additional_considerations()
1386 |
1387 | print "Total Compliances Checklist:", total_compliances
1388 | print "Total Compliances Passed:", compliant_count
1389 |
--------------------------------------------------------------------------------
/windows_hardening/._CIS_Microsoft_Windows_10_Enterprise_Release_1607_Benchmark_v1.2.0.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/praveendhac/CISBenchmarks/15e48d342e635196e225a7b9386f70ca1f86eafd/windows_hardening/._CIS_Microsoft_Windows_10_Enterprise_Release_1607_Benchmark_v1.2.0.pdf
--------------------------------------------------------------------------------
/windows_hardening/CIS_Microsoft_Windows_10_Enterprise_Release_1607_Benchmark_v1.2.0.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/praveendhac/CISBenchmarks/15e48d342e635196e225a7b9386f70ca1f86eafd/windows_hardening/CIS_Microsoft_Windows_10_Enterprise_Release_1607_Benchmark_v1.2.0.pdf
--------------------------------------------------------------------------------