Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Syslog-ng fixes and enhancements #226

Merged
merged 2 commits into from
Dec 27, 2023
Merged

Syslog-ng fixes and enhancements #226

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
58f4ca0
syslog-ng : fix remote host test and enhance Regex
ThibaultDewailly Dec 27, 2023
796a561
enh: add test for 4.2.1.6
ThibaultDewailly Dec 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions bin/hardening/4.2.1.5_syslog-ng_remote_host.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,10 +16,9 @@ set -u # One variable unset, it's over
HARDENING_LEVEL=3
# shellcheck disable=2034
DESCRIPTION="Configure syslog-ng to send logs to a remote log host."

PACKAGE='syslog-ng'

PATTERN='destination[[:alnum:][:space:]*{]+(tcp|udp)[[:space:]]*\(\"[[:alnum:].]+\".'
SYSLOG_BASEDIR='/etc/syslog-ng'
PATTERN='destination[[:alnum:][:space:]*_*{]+(tcp|network|udp)[[:space:]]*\([[:space:]]*\"?[[:alnum:]\-.]+\"?.'

# This function will be called if the script status is on enabled / audit mode
audit() {
Expand Down
8 changes: 4 additions & 4 deletions bin/hardening/4.2.1.6_remote_syslog-ng_acl.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,9 @@ HARDENING_LEVEL=3
DESCRIPTION="Configure syslog to accept remote syslog messages only on designated log hosts."

PACKAGE='syslog-ng'

SYSLOG_BASEDIR='/etc/syslog-ng'
REMOTE_HOST=""
PATTERN='source[[:alnum:][:space:]*{]+(tcp|udp)[[:space:]]*\(\"[[:alnum:].]+\".'
PATTERN='source[[:alnum:][:space:]*_*{]+(tcp|network|udp)[[:space:]]*\([[:space:]]*\"?[[:alnum:]\-.]+\"?.'

# This function will be called if the script status is on enabled / audit mode
audit() {
Expand All @@ -37,7 +37,7 @@ audit() {
fi
done

if [[ "$REMOTE_HOST" ]]; then
if [[ "$REMOTE_HOST" ]] && [[ "$REMOTE_HOST" != 'false' ]]; then
info "This is the remote host, checking that it only accepts logs from specified zone"
if [ "$FOUND" = 1 ]; then
ok "$PATTERN is present in $FILES"
Expand Down Expand Up @@ -70,7 +70,7 @@ apply() {
fi
done

if [[ "$REMOTE_HOST" ]]; then
if [[ "$REMOTE_HOST" ]] && [[ "$REMOTE_HOST" != 'false' ]]; then
info "This is the remote host, checking that it only accepts logs from specified zone"
if [ "$FOUND" = 1 ]; then
ok "$PATTERN is present in $FILES"
Expand Down
2 changes: 1 addition & 1 deletion tests/hardening/4.2.1.5_syslog-ng_remote_host.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,6 @@ EOF
run subfile "${CIS_CHECKS_DIR}/${script}.sh" --audit-all

# Cleanup
rm /etc/syslog-ng/conf.d/1_tcp_destination
rm -f /etc/syslog-ng/conf.d/1_tcp_destination

}
33 changes: 30 additions & 3 deletions tests/hardening/4.2.1.6_remote_syslog-ng_acl.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,37 @@
# run-shellcheck
test_audit() {
describe Running on blank host
register_test retvalshouldbe 0
dismiss_count_for_test
register_test retvalshouldbe 1
# shellcheck disable=2154
echo 'REMOTE_HOST="true"' >>"${CIS_CONF_DIR}/conf.d/${script}.cfg"
run blank "${CIS_CHECKS_DIR}/${script}.sh" --audit-all

# TODO fill comprehensive tests
cp -a /etc/syslog-ng/syslog-ng.conf /tmp/syslog-ng.conf.bak
echo "source mySyslog tcp (\"127.0.0.1\")" >>/etc/syslog-ng/syslog-ng.conf

describe Checking one line conf
register_test retvalshouldbe 0
run oneline "${CIS_CHECKS_DIR}/${script}.sh" --audit-all

cp -a /tmp/syslog-ng.conf.bak /etc/syslog-ng/syslog-ng.conf
cat >>/etc/syslog-ng/syslog-ng.conf <<EOF
source mySyslog {
tcp ("127.0.0.1"),
port(1234),
EOF

describe Checking mutliline conf
register_test retvalshouldbe 0
run multiline "${CIS_CHECKS_DIR}/${script}.sh" --audit-all

mv /tmp/syslog-ng.conf.bak /etc/syslog-ng/syslog-ng.conf
echo "source mySyslog tcp (\"127.0.0.1\")" >>/etc/syslog-ng/conf.d/1_tcp_source
cat /etc/syslog-ng/conf.d/1_tcp_source

describe Checking file in subdirectory
register_test retvalshouldbe 0
run subfile "${CIS_CHECKS_DIR}/${script}.sh" --audit-all

rm -f /etc/syslog-ng/conf.d/1_tcp_source

}
Loading