GuillaumeHemmen/docker-bench-security
1
0
Fork 0
mirror of https://github.com/docker/docker-bench-security.git synced 2025-01-31 14:22:33 +01:00
Code Issues Projects Releases Packages Wiki Activity

add score and totalChecks to 1_

Browse source 
Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>
This commit is contained in:
Thomas Sjögren 2017-10-23 15:39:18 +02:00
parent a7600dd539
commit 3d532a29ac
1 changed files with 66 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

67
tests/1_host_configuration.sh
View file

@ -6,24 +6,32 @@ auditrules="/etc/audit/audit.rules"
# 1.1 # 1.1
check_1_1="1.1 - Ensure a separate partition for containers has been created" check_1_1="1.1 - Ensure a separate partition for containers has been created"
totalChecks=$((totalChecks + 1))
if grep /var/lib/docker /etc/fstab >/dev/null 2>&1; then if grep /var/lib/docker /etc/fstab >/dev/null 2>&1; then
pass "$check_1_1" pass "$check_1_1"
logjson "1.1" "PASS" logjson "1.1" "PASS"
currentScore=$((currentScore + 1))
elif mountpoint -q -- /var/lib/docker >/dev/null 2>&1; then elif mountpoint -q -- /var/lib/docker >/dev/null 2>&1; then
pass "$check_1_1" pass "$check_1_1"
logjson "1.1" "PASS" logjson "1.1" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_1" warn "$check_1_1"
logjson "1.1" "WARN" logjson "1.1" "WARN"
currentScore=$((currentScore - 1))
fi fi
# 1.2 # 1.2
check_1_2="1.2 - Ensure the container host has been Hardened" check_1_2="1.2 - Ensure the container host has been Hardened"
totalChecks=$((totalChecks + 1))
note "$check_1_2" note "$check_1_2"
logjson "1.2" "INFO" logjson "1.2" "INFO"
currentScore=$((currentScore - 0))
# 1.3 # 1.3
check_1_3="1.3 - Ensure Docker is up to date" check_1_3="1.3 - Ensure Docker is up to date"
totalChecks=$((totalChecks + 1))
docker_version=$(docker version | grep -i -A1 '^server' | grep -i 'version:' \ docker_version=$(docker version | grep -i -A1 '^server' | grep -i 'version:' \
| awk '{print $NF; exit}' | tr -d '[:alpha:]-,') | awk '{print $NF; exit}' | tr -d '[:alpha:]-,')
docker_current_version="$(date +%y.%m.0 -d @$(( $(date +%s) - 2592000)))" docker_current_version="$(date +%y.%m.0 -d @$(( $(date +%s) - 2592000)))"
@ -33,237 +41,294 @@ if [ $? -eq 11 ]; then
info " * Using $docker_version, verify is it up to date as deemed necessary" info " * Using $docker_version, verify is it up to date as deemed necessary"
info " * Your operating system vendor may provide support and security maintenance for Docker" info " * Your operating system vendor may provide support and security maintenance for Docker"
logjson "1.3" "INFO" logjson "1.3" "INFO"
currentScore=$((currentScore - 0))
else else
pass "$check_1_3" pass "$check_1_3"
info " * Using $docker_version which is current" info " * Using $docker_version which is current"
info " * Check with your operating system vendor for support and security maintenance for Docker" info " * Check with your operating system vendor for support and security maintenance for Docker"
logjson "1.3" "PASS" logjson "1.3" "PASS"
currentScore=$((currentScore - 0))
fi fi
# 1.4 # 1.4
check_1_4="1.4 - Ensure only trusted users are allowed to control Docker daemon" check_1_4="1.4 - Ensure only trusted users are allowed to control Docker daemon"
totalChecks=$((totalChecks + 1))
docker_users=$(getent group docker) docker_users=$(getent group docker)
info "$check_1_4" info "$check_1_4"
for u in $docker_users; do for u in $docker_users; do
info " * $u" info " * $u"
logjson "1.4" "$u" logjson "1.4" "$u"
done done
currentScore=$((currentScore - 0))
# 1.5 # 1.5
check_1_5="1.5 - Ensure auditing is configured for the Docker daemon" check_1_5="1.5 - Ensure auditing is configured for the Docker daemon"
totalChecks=$((totalChecks + 1))
file="/usr/bin/docker " file="/usr/bin/docker "
if command -v auditctl >/dev/null 2>&1; then if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep "$file" >/dev/null 2>&1; then if auditctl -l | grep "$file" >/dev/null 2>&1; then
pass "$check_1_5" pass "$check_1_5"
logjson "1.5" "PASS" logjson "1.5" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_5" warn "$check_1_5"
logjson "1.5" "WARN" logjson "1.5" "WARN"
currentScore=$((currentScore - 1))
fi fi
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_5" pass "$check_1_5"
logjson "1.5" "PASS" logjson "1.5" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_5" warn "$check_1_5"
logjson "1.5" "WARN" logjson "1.5" "WARN"
currentScore=$((currentScore - 1))
fi fi
# 1.6 # 1.6
check_1_6="1.6 - Ensure auditing is configured for Docker files and directories - /var/lib/docker" check_1_6="1.6 - Ensure auditing is configured for Docker files and directories - /var/lib/docker"
totalChecks=$((totalChecks + 1))
directory="/var/lib/docker" directory="/var/lib/docker"
if [ -d "$directory" ]; then if [ -d "$directory" ]; then
if command -v auditctl >/dev/null 2>&1; then if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep $directory >/dev/null 2>&1; then if auditctl -l | grep $directory >/dev/null 2>&1; then
pass "$check_1_6" pass "$check_1_6"
logjson "1.6" "PASS" logjson "1.6" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_6" warn "$check_1_6"
logjson "1.6" "WARN" logjson "1.6" "WARN"
currentScore=$((currentScore - 1))
fi fi
elif grep -s "$directory" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then elif grep -s "$directory" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_6" pass "$check_1_6"
logjson "1.6" "PASS" logjson "1.6" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_6" warn "$check_1_6"
logjson "1.6" "WARN" logjson "1.6" "WARN"
currentScore=$((currentScore - 1))
fi fi
else else
info "$check_1_6" info "$check_1_6"
info " * Directory not found" info " * Directory not found"
logjson "1.6" "INFO" logjson "1.6" "INFO"
currentScore=$((currentScore + 0))
fi fi
# 1.7 # 1.7
check_1_7="1.7 - Ensure auditing is configured for Docker files and directories - /etc/docker" check_1_7="1.7 - Ensure auditing is configured for Docker files and directories - /etc/docker"
totalChecks=$((totalChecks + 1))
directory="/etc/docker" directory="/etc/docker"
if [ -d "$directory" ]; then if [ -d "$directory" ]; then
if command -v auditctl >/dev/null 2>&1; then if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep $directory >/dev/null 2>&1; then if auditctl -l | grep $directory >/dev/null 2>&1; then
pass "$check_1_7" pass "$check_1_7"
logjson "1.7" "PASS" logjson "1.7" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_7" warn "$check_1_7"
logjson "1.7" "WARN" logjson "1.7" "WARN"
currentScore=$((currentScore - 1))
fi fi
elif grep -s "$directory" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then elif grep -s "$directory" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_7" pass "$check_1_7"
logjson "1.7" "PASS" logjson "1.7" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_7" warn "$check_1_7"
logjson "1.7" "WARN" logjson "1.7" "WARN"
currentScore=$((currentScore - 1))
fi fi
else else
info "$check_1_7" info "$check_1_7"
info " * Directory not found" info " * Directory not found"
logjson "1.7" "INFO" logjson "1.7" "INFO"
currentScore=$((currentScore + 0))
fi fi
# 1.8 # 1.8
check_1_8="1.8 - Ensure auditing is configured for Docker files and directories - docker.service" check_1_8="1.8 - Ensure auditing is configured for Docker files and directories - docker.service"
totalChecks=$((totalChecks + 1))
file="$(get_systemd_service_file docker.service)" file="$(get_systemd_service_file docker.service)"
if [ -f "$file" ]; then if [ -f "$file" ]; then
if command -v auditctl >/dev/null 2>&1; then if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep "$file" >/dev/null 2>&1; then if auditctl -l | grep "$file" >/dev/null 2>&1; then
pass "$check_1_8" pass "$check_1_8"
logjson "1.8" "PASS" logjson "1.8" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_8" warn "$check_1_8"
logjson "1.8" "WARN" logjson "1.8" "WARN"
currentScore=$((currentScore - 1))
fi fi
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_8" pass "$check_1_8"
logjson "1.8" "pass" logjson "1.8" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_8" warn "$check_1_8"
logjson "1.8" "WARN" logjson "1.8" "WARN"
currentScore=$((currentScore - 1))
fi fi
else else
info "$check_1_8" info "$check_1_8"
info " * File not found" info " * File not found"
logjson "1.8" "INFO" logjson "1.8" "INFO"
currentScore=$((currentScore + 0))
fi fi
# 1.9 # 1.9
check_1_9="1.9 - Ensure auditing is configured for Docker files and directories - docker.socket" check_1_9="1.9 - Ensure auditing is configured for Docker files and directories - docker.socket"
totalChecks=$((totalChecks + 1))
file="$(get_systemd_service_file docker.socket)" file="$(get_systemd_service_file docker.socket)"
if [ -e "$file" ]; then if [ -e "$file" ]; then
if command -v auditctl >/dev/null 2>&1; then if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep "$file" >/dev/null 2>&1; then if auditctl -l | grep "$file" >/dev/null 2>&1; then
pass "$check_1_9" pass "$check_1_9"
logjson "1.9" "PASS" logjson "1.9" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_9" warn "$check_1_9"
logjson "1.9" "WARN" logjson "1.9" "WARN"
currentScore=$((currentScore - 1))
fi fi
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_9" pass "$check_1_9"
logjson "1.9" "PASS" logjson "1.9" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_9" warn "$check_1_9"
logjson "1.9" "WARN" logjson "1.9" "WARN"
currentScore=$((currentScore - 1))
fi fi
else else
info "$check_1_9" info "$check_1_9"
info " * File not found" info " * File not found"
logjson "1.9" "INFO" logjson "1.9" "INFO"
currentScore=$((currentScore + 0))
fi fi
# 1.10 # 1.10
check_1_10="1.10 - Ensure auditing is configured for Docker files and directories - /etc/default/docker" check_1_10="1.10 - Ensure auditing is configured for Docker files and directories - /etc/default/docker"
totalChecks=$((totalChecks + 1))
file="/etc/default/docker" file="/etc/default/docker"
if [ -f "$file" ]; then if [ -f "$file" ]; then
if command -v auditctl >/dev/null 2>&1; then if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep $file >/dev/null 2>&1; then if auditctl -l | grep $file >/dev/null 2>&1; then
pass "$check_1_10" pass "$check_1_10"
logjson "1.10" "PASS" logjson "1.10" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_10" warn "$check_1_10"
logjson "1.10" "WARN" logjson "1.10" "WARN"
currentScore=$((currentScore - 1))
fi fi
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_10" pass "$check_1_10"
logjson "1.10" "PASS" logjson "1.10" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_10" warn "$check_1_10"
logjson "1.10" "WARN" logjson "1.10" "WARN"
currentScore=$((currentScore - 1))
fi fi
else else
info "$check_1_10" info "$check_1_10"
info " * File not found" info " * File not found"
logjson "1.10" "INFO" logjson "1.10" "INFO"
currentScore=$((currentScore + 0))
fi fi
# 1.11 # 1.11
check_1_11="1.11 - Ensure auditing is configured for Docker files and directories - /etc/docker/daemon.json" check_1_11="1.11 - Ensure auditing is configured for Docker files and directories - /etc/docker/daemon.json"
totalChecks=$((totalChecks + 1))
file="/etc/docker/daemon.json" file="/etc/docker/daemon.json"
if [ -f "$file" ]; then if [ -f "$file" ]; then
if command -v auditctl >/dev/null 2>&1; then if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep $file >/dev/null 2>&1; then if auditctl -l | grep $file >/dev/null 2>&1; then
pass "$check_1_11" pass "$check_1_11"
logjson "1.11" "PASS" logjson "1.11" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_11" warn "$check_1_11"
logjson "1.11" "WARN" logjson "1.11" "WARN"
currentScore=$((currentScore - 1))
fi fi
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_11" pass "$check_1_11"
logjson "1.11" "PASS" logjson "1.11" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_11" warn "$check_1_11"
logjson "1.11" "WARN" logjson "1.11" "WARN"
currentScore=$((currentScore - 1))
fi fi
else else
info "$check_1_11" info "$check_1_11"
info " * File not found" info " * File not found"
logjson "1.11" "INFO" logjson "1.11" "INFO"
currentScore=$((currentScore + 0))
fi fi
# 1.12 # 1.12
check_1_12="1.12 - Ensure auditing is configured for Docker files and directories - /usr/bin/docker-containerd" check_1_12="1.12 - Ensure auditing is configured for Docker files and directories - /usr/bin/docker-containerd"
totalChecks=$((totalChecks + 1))
file="/usr/bin/docker-containerd" file="/usr/bin/docker-containerd"
if [ -f "$file" ]; then if [ -f "$file" ]; then
if command -v auditctl >/dev/null 2>&1; then if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep $file >/dev/null 2>&1; then if auditctl -l | grep $file >/dev/null 2>&1; then
pass "$check_1_12" pass "$check_1_12"
logjson "1.12" "PASS" logjson "1.12" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_12" warn "$check_1_12"
logjson "1.12" "WARN" logjson "1.12" "WARN"
currentScore=$((currentScore - 1))
fi fi
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_12" pass "$check_1_12"
logjson "1.12" "PASS" logjson "1.12" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_12" warn "$check_1_12"
logjson "1.12" "WARN" logjson "1.12" "WARN"
currentScore=$((currentScore - 1))
fi fi
else else
info "$check_1_12" info "$check_1_12"
info " * File not found" info " * File not found"
logjson "1.12" "INFO" logjson "1.12" "INFO"
currentScore=$((currentScore + 0))
fi fi
# 1.13 # 1.13
check_1_13="1.13 - Ensure auditing is configured for Docker files and directories - /usr/bin/docker-runc" check_1_13="1.13 - Ensure auditing is configured for Docker files and directories - /usr/bin/docker-runc"
totalChecks=$((totalChecks + 1))
file="/usr/bin/docker-runc" file="/usr/bin/docker-runc"
if [ -f "$file" ]; then if [ -f "$file" ]; then
if command -v auditctl >/dev/null 2>&1; then if command -v auditctl >/dev/null 2>&1; then
if auditctl -l | grep $file >/dev/null 2>&1; then if auditctl -l | grep $file >/dev/null 2>&1; then
pass "$check_1_13" pass "$check_1_13"
logjson "1.13" "PASS" logjson "1.13" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_13" warn "$check_1_13"
logjson "1.13" "WARN" logjson "1.13" "WARN"
currentScore=$((currentScore - 1))
fi fi
elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then elif grep -s "$file" "$auditrules" | grep "^[^#;]" 2>/dev/null 1>&2; then
pass "$check_1_13" pass "$check_1_13"
logjson "1.13" "PASS" logjson "1.13" "PASS"
currentScore=$((currentScore + 1))
else else
warn "$check_1_13" warn "$check_1_13"
logjson "1.13" "WARN" logjson "1.13" "WARN"
currentScore=$((currentScore - 1))
fi fi
else else
info "$check_1_13" info "$check_1_13"
info " * File not found" info " * File not found"
logjson "1.13" "INFO" logjson "1.13" "INFO"
currentScore=$((currentScore + 0))
fi fi