310 lines
14 KiB
Bash
Executable File
310 lines
14 KiB
Bash
Executable File
#!/bin/bash
|
|
##########################################################################
|
|
# Shellscript : Security Remediation
|
|
# Autor : Andreas Vogel, NEXT Enterprise gmbh, 2021
|
|
##########################################################################
|
|
|
|
plistlocation="/Library/Application Support/SecurityScoring/org_security_score.plist"
|
|
currentUser="$(python -c 'from SystemConfiguration import SCDynamicStoreCopyConsoleUser; import sys; username = (SCDynamicStoreCopyConsoleUser(None, None, None) or [None])[0]; username = [username,""][username in [u"loginwindow", None, u""]]; sys.stdout.write(username + "\n");')"
|
|
currentUserID="$(/usr/bin/id -u $currentUser)"
|
|
hardwareUUID="$(/usr/sbin/system_profiler SPHardwareDataType | grep "Hardware UUID" | awk -F ": " '{print $2}' | xargs)"
|
|
|
|
logFile="/Library/Application Support/SecurityScoring/remediation.log"
|
|
echo "$(date -u)" "Beginning remediation" >> "$logFile"
|
|
|
|
|
|
if [[ ! -e $plistlocation ]]; then
|
|
echo "No scoring file present"
|
|
exit 0
|
|
fi
|
|
|
|
set -x
|
|
|
|
###################### 2.1.1 Turn off Bluetooth, if no paired devices exist ###############################################################
|
|
Audit2_1_1="$(defaults read "$plistlocation" OrgScore2_1_1)"
|
|
|
|
if [ "$Audit2_1_1" = "1" ]; then
|
|
echo "$(date -u)" "Checking 2.1.1" | tee -a "$logFile"
|
|
connectable="$( system_profiler SPBluetoothDataType | grep -c "Paired: Yes" )"
|
|
if [ "$connectable" -gt 0 ]; then
|
|
echo "$(date -u)" "2.1.1 passed" | tee -a "$logFile"
|
|
else
|
|
defaults write /Library/Preferences/com.apple.Bluetooth ControllerPowerState -bool false
|
|
killall -HUP bluetoothd
|
|
echo "$(date -u)" "2.1.1 remediated" | tee -a "$logFile"
|
|
fi
|
|
fi
|
|
|
|
###################### 2.2.1 Enable "Set time and date automatically" #####################################################################
|
|
Audit2_1_3="$(defaults read "$plistlocation" OrgScore2_1_3)"
|
|
|
|
if [ "$Audit2_1_3" = "1" ]; then
|
|
sudo -u "$currentUser" defaults write ~/Library/Preferences/ByHost/com.apple.controlcenter.plist Bluetooth -int 18
|
|
# sudo -u "$currentUser" defaults write ~/Library/Preferences/ByHost/com.apple.controlcenter.plist Bluetooth -int 24 # to disable
|
|
echo "$(date -u)" "2.1.3 remediated" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 2.2.2 Ensure time set is within appropriate limits #################################################################
|
|
Audit2_2_2="$(defaults read "$plistlocation" OrgScore2_2_2)"
|
|
|
|
if [ "$Audit2_2_2" = "1" ]; then
|
|
systemsetup -setusingnetworktime off 2>&1
|
|
systemsetup -setusingnetworktime on 2>&1
|
|
# timeServer="$(systemsetup -getnetworktimeserver | awk '{print $4}')"
|
|
# ntpdate -sv "$timeServer"
|
|
echo "$(date -u)" "2.2.2 enforced" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 2.4.5 Disable Remote Login ##########################################################################################
|
|
# 2.4.5 Disable Remote Login
|
|
# Requires full disk access
|
|
# Verify organizational score
|
|
Audit2_4_5="$(defaults read "$plistlocation" OrgScore2_4_5)"
|
|
# If organizational score is 1 or true, check status of client
|
|
# If client fails, then remediate
|
|
if [ "$Audit2_4_5" = "1" ]; then
|
|
/usr/sbin/systemsetup -f -setremotelogin off
|
|
echo "$(date -u)" "2.4.5 remediated" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 2.4.10 Disable Content Caching ######################################################################################
|
|
#2.4.10 Disable Content Caching
|
|
# Verify organizational score
|
|
Audit2_4_10="$(defaults read "$plistlocation" OrgScore2_4_10)"
|
|
# If organizational score is 1 or true, check status of client
|
|
# If client fails, then remediate
|
|
if [ "$Audit2_4_10" = "1" ]; then
|
|
/usr/bin/AssetCacheManagerUtil deactivate
|
|
echo "$(date -u)" "2.4.10 remediated" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 2.5.8 Disable sending diagnostic and usage data to App ##############################################################
|
|
# 2.5.8 Disable sending diagnostic and usage data to Apple
|
|
# Verify Organizational score
|
|
Audit2_5_8="$(defaults read "$plistlocation" OrgScore2_5_8)"
|
|
# If organizational score is 1 or true, check status of client
|
|
# If client fails, then remediate
|
|
if [ "$Audit2_5_8" = "1" ]; then
|
|
AppleDiagn=$(defaults read /Library/Application\ Support/CrashReporter/DiagnosticMessagesHistory.plist AutoSubmit)
|
|
if [ $AppleDiagn == 1 ]; then
|
|
defaults write /Library/Application\ Support/CrashReporter/DiagnosticMessagesHistory.plist AutoSubmit -int 0
|
|
echo "$(date -u)" "2.5.8 remediated" | tee -a "$logFile"
|
|
fi
|
|
fi
|
|
|
|
###################### 2.12 Disable "Wake for network access" #############################################################################
|
|
Audit2_12="$(defaults read "$plistlocation" OrgScore2_12)"
|
|
|
|
if [ "$Audit2_12" = "1" ]; then
|
|
pmset -a womp 0
|
|
pmset -a powernap 0
|
|
echo "$(date -u)" "2.12 remediated" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 3.2 Configure Security Auditing Flags ##############################################################################
|
|
Audit3_2="$(defaults read "$plistlocation" OrgScore3_2)"
|
|
|
|
if [ "$Audit3_2" = "1" ]; then
|
|
cp /etc/security/audit_control /etc/security/audit_control_old
|
|
sed "s/"flags:lo,aa"/"flags:lo,ad,fd,fm,-all"/g" /etc/security/audit_control_old > /etc/security/audit_control
|
|
chmod 644 /etc/security/audit_control
|
|
chown root:wheel /etc/security/audit_control
|
|
echo "$(date -u)" "3.2 remediated" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 3.5 Retain install.log for 365 or more days ########################################################################
|
|
Audit3_5="$(defaults read "$plistlocation" OrgScore3_5)"
|
|
|
|
if [ "$Audit3_5" = "1" ]; then
|
|
installRetention="$(grep -i ttl /etc/asl/com.apple.install | awk -F'ttl=' '{print $2}')"
|
|
if [[ "$installRetention" = "" ]]; then
|
|
mv /etc/asl/com.apple.install /etc/asl/com.apple.install.old
|
|
sed '$s/$/ ttl=365/' /etc/asl/com.apple.install.old > /etc/asl/com.apple.install
|
|
chmod 644 /etc/asl/com.apple.install
|
|
chown root:wheel /etc/asl/com.apple.install
|
|
echo "$(date -u)" "3.5 remediated" | tee -a "$logfile"
|
|
else
|
|
if [[ "$installRetention" -lt "365" ]]; then
|
|
mv /etc/asl/com.apple.install /etc/asl/com.apple.install.old
|
|
sed "s/"ttl=$installRetention"/"ttl=365"/g" /etc/asl/com.apple.install.old > /etc/asl/com.apple.install
|
|
chmod 644 /etc/asl/com.apple.install
|
|
chown root:wheel /etc/asl/com.apple.install
|
|
echo "$(date -u)" "3.5 remediated" | tee -a "$logfile"
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
###################### 3.6 Ensure firewall is configured to log ###########################################################################
|
|
Audit3_6="$(defaults read "$plistlocation" OrgScore3_6)"
|
|
|
|
if [ "$Audit3_6" = "1" ]; then
|
|
/usr/libexec/ApplicationFirewall/socketfilterfw --setloggingmode on
|
|
echo "$(date -u)" "3.6 remediated" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 4.2 Enable "Show Wi-Fi status in menu bar" #########################################################################
|
|
Audit4_2="$(defaults read "$plistlocation" OrgScore4_2)"
|
|
|
|
if [ "$Audit4_2" = "1" ]; then
|
|
open "/System/Library/CoreServices/Menu Extras/AirPort.menu"
|
|
echo "$(date -u)" "4.2 remediated" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 4.4 Ensure http server is not running ##############################################################################
|
|
Audit4_4="$(defaults read "$plistlocation" OrgScore4_4)"
|
|
|
|
if [ "$Audit4_4" = "1" ]; then
|
|
apachectl stop
|
|
defaults write /System/Library/LaunchDaemons/org.apache.httpd Disabled -bool true
|
|
echo "$(date -u)" "4.4 remediated" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 4.5 Ensure nfs server is not running ###############################################################################
|
|
Audit4_5="$(defaults read "$plistlocation" OrgScore4_5)"
|
|
|
|
if [ "$Audit4_5" = "1" ]; then
|
|
nfsd disable
|
|
rm -rf /etc/exports
|
|
echo "$(date -u)" "4.5 remediated" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 5.1.1 Secure Home Folders ##########################################################################################
|
|
Audit5_1_1="$(defaults read "$plistlocation" OrgScore5_1_1)"
|
|
|
|
if [ "$Audit5_1_1" = "1" ]; then
|
|
|
|
IFS=$'\n'
|
|
for userDirs in $( find /Users -mindepth 1 -maxdepth 1 -type d -perm -1 | grep -v "Shared" | grep -v "Guest" ); do
|
|
chmod og-rwx "$userDirs"
|
|
done
|
|
echo "$(date -u)" "5.1.1 enforced" | tee -a "$logFile"
|
|
unset IFS
|
|
fi
|
|
|
|
###################### 5.1.2 Check System Wide Applications for appropriate permissions ###################################################
|
|
Audit5_1_2="$(defaults read "$plistlocation" OrgScore5_1_2)"
|
|
|
|
if [ "$Audit5_1_2" = "1" ]; then
|
|
IFS=$'\n'
|
|
for apps in $( find /Applications -iname "*\.app" -type d -perm -2 ); do
|
|
chmod -R o-w "$apps"
|
|
done
|
|
echo "$(date -u)" "5.1.2 enforced" | tee -a "$logFile"
|
|
unset IFS
|
|
fi
|
|
|
|
###################### 5.1.3 Check System folder for world writable files #################################################################
|
|
Audit5_1_3="$(defaults read "$plistlocation" OrgScore5_1_3)"
|
|
|
|
if [ "$Audit5_1_3" = "1" ]; then
|
|
IFS=$'\n'
|
|
for sysPermissions in $( find /System -type d -perm -2 | grep -v "Public/Drop Box" ); do
|
|
chmod -R o-w "$sysPermissions"
|
|
done
|
|
echo "$(date -u)" "5.1.3 enforced" | tee -a "$logFile"
|
|
unset IFS
|
|
fi
|
|
|
|
###################### 5.1.4 Check Library folder for world writable files ################################################################
|
|
Audit5_1_4="$(defaults read "$plistlocation" OrgScore5_1_4)"
|
|
|
|
if [ "$Audit5_1_4" = "1" ]; then
|
|
# Exempts Adobe files by default!
|
|
# for libPermissions in $( find /Library -type d -perm -2 -ls | grep -v Caches ); do
|
|
IFS=$'\n'
|
|
for libPermissions in $( find /Library -type d -perm -2 | grep -v Caches | grep -v Adobe | grep -v VMware); do
|
|
chmod -R o-w "$libPermissions"
|
|
done
|
|
echo "$(date -u)" "5.1.4 enforced" | tee -a "$logFile"
|
|
unset IFS
|
|
fi
|
|
|
|
###################### 5.3 Reduce the sudo timeout period #################################################################################
|
|
Audit5_3="$(defaults read "$plistlocation" OrgScore5_3)"
|
|
|
|
if [ "$Audit5_3" = "1" ]; then
|
|
echo "Defaults timestamp_timeout=0" >> /etc/sudoers
|
|
echo "$(date -u)" "5.3 remediated" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 5.4 Use a separate timestamp for each user/tty combo ###############################################################
|
|
Audit5_4="$(defaults read "$plistlocation" OrgScore5_4)"
|
|
|
|
if [ "$Audit5_4" = "1" ]; then
|
|
sed -i ".old" '/Default !tty_tickets/d' /etc/sudoers
|
|
chmod 644 /etc/sudoers
|
|
chown root:wheel /etc/sudoers
|
|
echo "$(date -u)" "5.4 remediated" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 5.6 Ensure login keychain is locked when the computer sleeps #######################################################
|
|
# If both 5.5 and 5.6 need to be set, both commands must be run at the same time
|
|
|
|
Audit5_5="$(defaults read "$plistlocation" OrgScore5_5)"
|
|
Audit5_6="$(defaults read "$plistlocation" OrgScore5_6)"
|
|
# If organizational score is 1 or true, check status of client
|
|
# If client fails, then remediate
|
|
if [ "$Audit5_5" = "1" ] && [ "$Audit5_6" = 1 ]; then
|
|
echo "$(date -u)" "Checking 5.5 and 5.6" | tee -a "$logFile"
|
|
security set-keychain-settings -l -u -t 21600s /Users/"$currentUser"/Library/Keychains/login.keychain
|
|
echo "$(date -u)" "5.5 and 5.6 remediated" | tee -a "$logFile"
|
|
elif [ "$Audit5_5" = "1" ] && [ "$Audit5_6" = 0 ]; then
|
|
echo "$(date -u)" "Checking 5.5" | tee -a "$logFile"
|
|
security set-keychain-settings -u -t 21600s /Users/"$currentUser"/Library/Keychains/login.keychain
|
|
echo "$(date -u)" "5.5 remediated" | tee -a "$logFile"
|
|
elif [ "$Audit5_5" = "0" ] && [ "$Audit5_6" = 1 ]; then
|
|
echo "$(date -u)" "Checking 5.6" | tee -a "$logFile"
|
|
security set-keychain-settings -l /Users/"$currentUser"/Library/Keychains/login.keychain
|
|
echo "$(date -u)" "5.6 remediated" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 5.7 Do not enable the "root" account ###############################################################################
|
|
Audit5_7="$(defaults read "$plistlocation" OrgScore5_7)"
|
|
|
|
if [ "$Audit5_7" = "1" ]; then
|
|
dscl . -create /Users/root UserShell /usr/bin/false
|
|
echo "$(date -u)" "5.7 remediated" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 5.10 Ensure system is set to hibernate #############################################################################
|
|
Audit5_10="$(defaults read "$plistlocation" OrgScore5_10)"
|
|
|
|
if [ "$Audit5_10" = "1" ]; then
|
|
pmset -a standbydelayhigh 600
|
|
pmset -a standbydelaylow 600
|
|
pmset -a highstandbythreshold 90
|
|
pmset -a destroyfvkeyonstandby 1
|
|
echo "$(date -u)" "5.10 remediated" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 5.11 Require an administrator password to access system-wide preferences ###########################################
|
|
Audit5_11="$(defaults read "$plistlocation" OrgScore5_11)"
|
|
|
|
if [ "$Audit5_11" = "1" ]; then
|
|
security authorizationdb read system.preferences > /tmp/system.preferences.plist
|
|
/usr/libexec/PlistBuddy -c "Set :shared false" /tmp/system.preferences.plist
|
|
security authorizationdb write system.preferences < /tmp/system.preferences.plist
|
|
echo "$(date -u)" "5.11 remediated" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 5.12 Disable ability to login to another user's active and locked session ##########################################
|
|
Audit5_12="$(defaults read "$plistlocation" OrgScore5_12)"
|
|
|
|
if [ "$Audit5_12" = "1" ]; then
|
|
/usr/bin/security authorizationdb write system.login.screensaver "use-login-window-ui"
|
|
echo "$(date -u)" "5.12 remediated" | tee -a "$logFile"
|
|
fi
|
|
|
|
###################### 6.2 Turn on filename extensions ####################################################################################
|
|
Audit6_2="$(defaults read "$plistlocation" OrgScore6_2)"
|
|
|
|
if [ "$Audit6_2" = "1" ]; then
|
|
sudo -u "$currentUser" defaults write NSGlobalDomain AppleShowAllExtensions -bool true
|
|
pkill -u "$currentUser" Finder
|
|
echo "$(date -u)" "6.2 remediated" | tee -a "$logFile"
|
|
# defaults write /Users/"$currentUser"/Library/Preferences/.GlobalPreferences.plist AppleShowAllExtensions -bool true
|
|
fi
|
|
|
|
echo "$(date -u)" "Remediation complete" | tee -a "$logFile"
|
|
echo "continue"
|
|
exit 0 |