GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-11-04 02:58:59 +00:00
Code Issues Projects Releases Packages Wiki Activity

add score and totalChecks to 1_

Browse source 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
This commit is contained in:
Thomas Sjögren 2017-10-23 15:39:18 +02:00
commit 3d532a29ac
1 changed files with 66 additions and 1 deletions

67
tests/1_host_configuration.sh
View file

@ -6,24 +6,32 @@ auditrules="/etc/audit/audit.rules"
# 1.1
check_1_1="1.1 - Ensure a separate partition for containers has been created"
totalChecks=$((totalChecks + 1))
if grep /var/lib/docker /etc/fstab >/dev/null 2>&1; then
pass "$check_1_1"
logjson "1.1" "PASS"
currentScore=$((currentScore + 1))
elif mountpoint -q -- /var/lib/docker >/dev/null 2>&1; then
pass "$check_1_1"
logjson "1.1" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_1"
logjson "1.1" "WARN"
currentScore=$((currentScore - 1))
fi
# 1.2
check_1_2="1.2 - Ensure the container host has been Hardened"
totalChecks=$((totalChecks + 1))
note "$check_1_2"
logjson "1.2" "INFO"
currentScore=$((currentScore - 0))
# 1.3
check_1_3="1.3 - Ensure Docker is up to date"
totalChecks=$((totalChecks + 1))
docker_version=$(docker version | grep -i -A1 '^server' | grep -i 'version:' \
| awk '{print $NF; exit}' | tr -d '[:alpha:]-,')
docker_current_version="$(date +%y.%m.0 -d @$(( $(date +%s) - 2592000)))"
@ -33,237 +41,294 @@ if [ $? -eq 11 ]; then
info " * Using $docker_version, verify is it up to date as deemed necessary"
info " * Your operating system vendor may provide support and security maintenance for Docker"
logjson "1.3" "INFO"
currentScore=$((currentScore - 0))
else
pass "$check_1_3"
info " * Using $docker_version which is current"
info " * Check with your operating system vendor for support and security maintenance for Docker"
logjson "1.3" "PASS"
currentScore=$((currentScore - 0))
fi
# 1.4
check_1_4="1.4 - Ensure only trusted users are allowed to control Docker daemon"
totalChecks=$((totalChecks + 1))
docker_users=$(getent group docker)
info "$check_1_4"
for u in $docker_users; do
info " * $u"
logjson "1.4" "$u"
done
currentScore=$((currentScore - 0))
# 1.5
check_1_5="1.5 - Ensure auditing is configured for the Docker daemon"
totalChecks=$((totalChecks + 1))
file="/usr/bin/docker "
if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep "$file" >/dev/null 2>&1; then
pass "$check_1_5"
logjson "1.5" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_5"
logjson "1.5" "WARN"
currentScore=$((currentScore - 1))
fi
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_5"
logjson "1.5" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_5"
logjson "1.5" "WARN"
currentScore=$((currentScore - 1))
fi
# 1.6
check_1_6="1.6 - Ensure auditing is configured for Docker files and directories - /var/lib/docker"
totalChecks=$((totalChecks + 1))
directory="/var/lib/docker"
if [ -d "$directory" ]; then
if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep $directory >/dev/null 2>&1; then
pass "$check_1_6"
logjson "1.6" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_6"
logjson "1.6" "WARN"
currentScore=$((currentScore - 1))
fi
elif grep -s "$directory" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_6"
logjson "1.6" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_6"
logjson "1.6" "WARN"
currentScore=$((currentScore - 1))
fi
else
info "$check_1_6"
info " * Directory not found"
logjson "1.6" "INFO"
currentScore=$((currentScore + 0))
fi
# 1.7
check_1_7="1.7 - Ensure auditing is configured for Docker files and directories - /etc/docker"
totalChecks=$((totalChecks + 1))
directory="/etc/docker"
if [ -d "$directory" ]; then
if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep $directory >/dev/null 2>&1; then
pass "$check_1_7"
logjson "1.7" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_7"
logjson "1.7" "WARN"
currentScore=$((currentScore - 1))
fi
elif grep -s "$directory" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_7"
logjson "1.7" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_7"
logjson "1.7" "WARN"
currentScore=$((currentScore - 1))
fi
else
info "$check_1_7"
info " * Directory not found"
logjson "1.7" "INFO"
currentScore=$((currentScore + 0))
fi
# 1.8
check_1_8="1.8 - Ensure auditing is configured for Docker files and directories - docker.service"
totalChecks=$((totalChecks + 1))
file="$(get_systemd_service_file docker.service)"
if [ -f "$file" ]; then
if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep "$file" >/dev/null 2>&1; then
pass "$check_1_8"
logjson "1.8" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_8"
logjson "1.8" "WARN"
currentScore=$((currentScore - 1))
fi
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_8"
logjson "1.8" "pass"
logjson "1.8" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_8"
logjson "1.8" "WARN"
currentScore=$((currentScore - 1))
fi
else
info "$check_1_8"
info " * File not found"
logjson "1.8" "INFO"
currentScore=$((currentScore + 0))
fi
# 1.9
check_1_9="1.9 - Ensure auditing is configured for Docker files and directories - docker.socket"
totalChecks=$((totalChecks + 1))
file="$(get_systemd_service_file docker.socket)"
if [ -e "$file" ]; then
if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep "$file" >/dev/null 2>&1; then
pass "$check_1_9"
logjson "1.9" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_9"
logjson "1.9" "WARN"
currentScore=$((currentScore - 1))
fi
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_9"
logjson "1.9" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_9"
logjson "1.9" "WARN"
currentScore=$((currentScore - 1))
fi
else
info "$check_1_9"
info " * File not found"
logjson "1.9" "INFO"
currentScore=$((currentScore + 0))
fi
# 1.10
check_1_10="1.10 - Ensure auditing is configured for Docker files and directories - /etc/default/docker"
totalChecks=$((totalChecks + 1))
file="/etc/default/docker"
if [ -f "$file" ]; then
if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep $file >/dev/null 2>&1; then
pass "$check_1_10"
logjson "1.10" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_10"
logjson "1.10" "WARN"
currentScore=$((currentScore - 1))
fi
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_10"
logjson "1.10" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_10"
logjson "1.10" "WARN"
currentScore=$((currentScore - 1))
fi
else
info "$check_1_10"
info " * File not found"
logjson "1.10" "INFO"
currentScore=$((currentScore + 0))
fi
# 1.11
check_1_11="1.11 - Ensure auditing is configured for Docker files and directories - /etc/docker/daemon.json"
totalChecks=$((totalChecks + 1))
file="/etc/docker/daemon.json"
if [ -f "$file" ]; then
if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep $file >/dev/null 2>&1; then
pass "$check_1_11"
logjson "1.11" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_11"
logjson "1.11" "WARN"
currentScore=$((currentScore - 1))
fi
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_11"
logjson "1.11" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_11"
logjson "1.11" "WARN"
currentScore=$((currentScore - 1))
fi
else
info "$check_1_11"
info " * File not found"
logjson "1.11" "INFO"
currentScore=$((currentScore + 0))
fi
# 1.12
check_1_12="1.12 - Ensure auditing is configured for Docker files and directories - /usr/bin/docker-containerd"
totalChecks=$((totalChecks + 1))
file="/usr/bin/docker-containerd"
if [ -f "$file" ]; then
if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep $file >/dev/null 2>&1; then
pass "$check_1_12"
logjson "1.12" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_12"
logjson "1.12" "WARN"
currentScore=$((currentScore - 1))
fi
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_12"
logjson "1.12" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_12"
logjson "1.12" "WARN"
currentScore=$((currentScore - 1))
fi
else
info "$check_1_12"
info " * File not found"
logjson "1.12" "INFO"
currentScore=$((currentScore + 0))
fi
# 1.13
check_1_13="1.13 - Ensure auditing is configured for Docker files and directories - /usr/bin/docker-runc"
totalChecks=$((totalChecks + 1))
file="/usr/bin/docker-runc"
if [ -f "$file" ]; then
if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep $file >/dev/null 2>&1; then
pass "$check_1_13"
logjson "1.13" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_13"
logjson "1.13" "WARN"
currentScore=$((currentScore - 1))
fi
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_13"
logjson "1.13" "PASS"
currentScore=$((currentScore + 1))
else
warn "$check_1_13"
logjson "1.13" "WARN"
currentScore=$((currentScore - 1))
fi
else
info "$check_1_13"
info " * File not found"
logjson "1.13" "INFO"
currentScore=$((currentScore + 0))
fi