--- RHEL6/input/fixes/bash/no_nis_inclusions_common | 30 +++++++++++++++++++++++ 1 files changed, 30 insertions(+), 0 deletions(-) create mode 100755 RHEL6/input/fixes/bash/no_nis_inclusions_common
diff --git a/RHEL6/input/fixes/bash/no_nis_inclusions_common b/RHEL6/input/fixes/bash/no_nis_inclusions_common new file mode 100755 index 0000000..b63e077 --- /dev/null +++ b/RHEL6/input/fixes/bash/no_nis_inclusions_common @@ -0,0 +1,30 @@ +# Copyright (c) 2012 Tresys Technology LLC, Columbia, Maryland, USA +# +# This software was developed by Tresys Technology LLC +# with U.S. Government sponsorship. +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + + +# Delete entries that begin with the +: nis entry. +# +# arguments: +# delete_nis_lines(FILE) +# FILE - File to check for nis lines. +# +delete_nis_lines(){ + FILE=$1 + + [ -f "$FILE" ] || exit 1 + + /bin/sed -i -e "/^+:.*/d" "$FILE" +}
--- RHEL6/input/fixes/bash/no_nis_inclusions_group.sh | 28 +++++++++++++++++++ RHEL6/input/fixes/bash/no_nis_inclusions_passwd.sh | 29 ++++++++++++++++++++ RHEL6/input/fixes/bash/no_nis_inclusions_shadow.sh | 28 +++++++++++++++++++ 3 files changed, 85 insertions(+), 0 deletions(-) create mode 100755 RHEL6/input/fixes/bash/no_nis_inclusions_group.sh create mode 100755 RHEL6/input/fixes/bash/no_nis_inclusions_passwd.sh create mode 100755 RHEL6/input/fixes/bash/no_nis_inclusions_shadow.sh
diff --git a/RHEL6/input/fixes/bash/no_nis_inclusions_group.sh b/RHEL6/input/fixes/bash/no_nis_inclusions_group.sh new file mode 100755 index 0000000..0ba0c7b --- /dev/null +++ b/RHEL6/input/fixes/bash/no_nis_inclusions_group.sh @@ -0,0 +1,28 @@ +#!/bin/bash -u +set -e + +# +# Copyright (c) 2012 Tresys Technology LLC, Columbia, Maryland, USA +# +# This software was developed by Tresys Technology LLC +# with U.S. Government sponsorship. +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Remove any lines starting with +: in /etc/group + +FILE=/etc/group + +[ -f "$FILE" ] || exit 1 + +. $(dirname $0)/no_nis_inclusions_common +delete_nis_lines "$FILE" diff --git a/RHEL6/input/fixes/bash/no_nis_inclusions_passwd.sh b/RHEL6/input/fixes/bash/no_nis_inclusions_passwd.sh new file mode 100755 index 0000000..ed604a4 --- /dev/null +++ b/RHEL6/input/fixes/bash/no_nis_inclusions_passwd.sh @@ -0,0 +1,29 @@ +#!/bin/bash -u +set -e + +# +# Copyright (c) 2012 Tresys Technology LLC, Columbia, Maryland, USA +# +# This software was developed by Tresys Technology LLC +# with U.S. Government sponsorship. +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Remove any lines starting with +: in /etc/passwd + +FILE=/etc/passwd + +[ -f "$FILE" ] || exit 1 + +. $(dirname $0)/no_nis_inclusions_common + +delete_nis_lines "$FILE" diff --git a/RHEL6/input/fixes/bash/no_nis_inclusions_shadow.sh b/RHEL6/input/fixes/bash/no_nis_inclusions_shadow.sh new file mode 100755 index 0000000..952111a --- /dev/null +++ b/RHEL6/input/fixes/bash/no_nis_inclusions_shadow.sh @@ -0,0 +1,28 @@ +#!/bin/bash -u +set -e + +# +# Copyright (c) 2012 Tresys Technology LLC, Columbia, Maryland, USA +# +# This software was developed by Tresys Technology LLC +# with U.S. Government sponsorship. +# +# This library is free software; you can redistribute it and/or +# modify it under the terms of the GNU Lesser General Public +# License as published by the Free Software Foundation; either +# version 2.1 of the License, or (at your option) any later version. +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Remove any lines starting with +: in /etc/shadow + +FILE=/etc/shadow + +[ -f "$FILE" ] || exit 1 + +. $(dirname $0)/no_nis_inclusions_common +delete_nis_lines "$FILE"
On 4/5/13 3:09 PM, Francisco Slavin wrote:
+. $(dirname $0)/no_nis_inclusions_common
Thanks for taking a stab at remediation. I was looking through Tresys' scripts and many sourced a functions file. When playing with this, the fix was included exactly as in the bash remediation file, and the functions were not transformed in. Did you have a different experience?
scap-security-guide@lists.fedorahosted.org
-
Francisco Slavin -
Shawn Wells