gbucchino/check_sys
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Parse sysctl

Browse Source
This commit is contained in:
gbucchino
2023-06-07 16:49:12 +02:00
parent 8b2e9cbd29
commit 882cdf805f
9 changed files with 328 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
issues/postfix.py
+6
View File
@@ -0,0 +1,6 @@
#!/usr/bin/env python3
def postfix() -> dict:
postfix = dict()
return postfix
issues/sysctl.py
+186
View File
@@ -6,6 +6,9 @@ def sysctl() -> list:
sysctl = list()
# https://access.redhat.com/security/sysctl/sysctl-2023-0179
#####
# CVE
#####
sysctl.append({
"from": "cve",
"id": "cve-2023-0179",
@@ -20,7 +23,9 @@ def sysctl() -> list:
})
})
#####
# Best practice from CIS
#####
sysctl.append({
"from": "cis",
"id": "",
@@ -29,5 +34,186 @@ def sysctl() -> list:
"value": 0,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable ICMP redirects IPv4",
"flag": "net.ipv4.conf.all.accept_redirects",
"value": 0,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable Accepting Source Routed packets IPv4 for all interfaces",
"flag": "net.ipv4.conf.all.accept_source_route",
"value": 0,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable Accepting Source Routed packets IPv4 for default interface",
"flag": "net.ipv4.conf.default.accept_source_route",
"value": 0,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable ICMP Secure redirects IPv4 for all interfaces",
"flag": "net.ipv4.conf.all.secure_redirects",
"value": 0,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable ICMP Secure redirects IPv4 for default interface",
"flag": "net.ipv4.conf.default.secure_redirects",
"value": 0,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Enable Log martian packets IPv4 for all interfaces",
"flag": "net.ipv4.conf.all.log_martians",
"value": 1,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Enable Log martian packets IPv4 for default interface",
"flag": "net.ipv4.conf.default.log_martians",
"value": 1,
"level": "medium",
})
# https://lwn.net/Articles/277146/
sysctl.append({
"from": "cis",
"id": "",
"description": "Enable TCP syn cookies IPv4",
"flag": "net.ipv4.tcp_syncookies",
"value": 1,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable IPv4 forwarding on all interfaces",
"flag": "net.ipv4.ip_forward",
"value": 0,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable IPv4 send redirects on all interfaces",
"flag": "net.ipv4.conf.all.send_redirects",
"value": 0,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable IPv4 send redirects on default interface",
"flag": "net.ipv4.conf.default.send_redirects",
"value": 0,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Enable IPv4 reverse path filtering on all interfaces",
"flag": "net.ipv4.conf.all.rp_filter",
"value": 1,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Enable IPv4 reverse path filtering on default interface",
"flag": "net.ipv4.conf.default.rp_filter",
"value": 1,
"level": "medium",
})
# For IPv6
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable IPvi6 forwarding",
"flag": "net.ipv6.conf.all.forwarding",
"value": 0,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable ICMP redirects IPv6",
"flag": "net.ipv6.conf.all.accept_redirects",
"value": 0,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable ICMP redirects IPv6 for default interface",
"flag": "net.ipv6.conf.default.accept_redirects",
"value": 0,
"level": "medium",
})
# https://datatracker.ietf.org/doc/html/rfc4861
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable Route Advertisements for IPv6 for all interfaces",
"flag": "net.ipv6.conf.all.accept_ra",
"value": 0,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable Route Advertisements for IPv6 for default interface",
"flag": "net.ipv6.conf.default.accept_ra",
"value": 0,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable Accepting Source Routed for IPv6 for all interfaces",
"flag": "net.ipv6.conf.all.accept_source_route",
"value": 0,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable Accepting Source Routed for IPv6 for default interface",
"flag": "net.ipv6.conf.default.accept_source_route",
"value": 0,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable ICMP Secure redirects IPv6 for all interfaces",
"flag": "net.ipv6.conf.all.secure_redirects",
"value": 0,
"level": "medium",
})
sysctl.append({
"from": "cis",
"id": "",
"description": "Disable ICMP Secure redirects IPv6 for default interface",
"flag": "net.ipv6.conf.default.secure_redirects",
"value": 0,
"level": "medium",
})
return sysctl