KNEL/football
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Complete repository reset for fresh start

Browse Source 
- Remove all project files and directories
- Keep git history intact
- Archive documentation in archive-docs/ directory

💘 Generated with Crush

Assisted-by: GLM-4.6 via Crush <crush@charm.land>
This commit is contained in:
Charles N Wyble
2026-01-21 08:56:22 -05:00
parent b98a20cae8
commit 69d6c81e1c
40 changed files with 0 additions and 12299 deletions
Download Patch File Download Diff File Expand all files Collapse all files

600
tests/compliance-test.sh
View File

@@ -1,600 +0,0 @@
#!/bin/bash
# Football Security and Compliance Test Suite
# Tests all security controls and compliance requirements
# Usage: ./tests/compliance-test.sh
set -e
# Color codes for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color
# Test counters
TOTAL_TESTS=0
PASSED_TESTS=0
FAILED_TESTS=0
SKIPPED_TESTS=0
WARNINGS=0
# Arrays for results
declare -a FAILED_TESTS_LIST
declare -a WARNING_LIST
# ============================================================================
# HELPER FUNCTIONS
# ============================================================================
log_test() {
echo -n "Testing: $1 ... "
((TOTAL_TESTS++))
}
pass_test() {
echo -e "${GREEN}PASS${NC}"
((PASSED_TESTS++))
}
fail_test() {
echo -e "${RED}FAIL${NC}"
((FAILED_TESTS++))
FAILED_TESTS_LIST+=("$1")
}
warn_test() {
echo -e "${YELLOW}WARNING${NC}"
((WARNINGS++))
WARNING_LIST+=("$1")
}
skip_test() {
echo -e "${BLUE}SKIP${NC}"
((SKIPPED_TESTS++))
}
section() {
echo ""
echo -e "${BLUE}========================================${NC}"
echo -e "${BLUE}$1${NC}"
echo -e "${BLUE}========================================${NC}"
echo ""
}
# ============================================================================
# CIS BENCHMARK TESTS - SECTION 1: FILESYSTEMS
# ============================================================================
test_filesystems() {
section "CIS Benchmark 1: Filesystem Configuration"
# 1.1.1 Disable unused filesystems
log_test "1.1.1 Ensure unused filesystems are disabled"
if [ -f /etc/modprobe.d/no-network-fs.conf ]; then
if grep -q "install nfs /bin/true" /etc/modprobe.d/no-network-fs.conf; then
pass_test
else
fail_test "1.1.1: NFS not disabled in modprobe.d"
fi
else
fail_test "1.1.1: no-network-fs.conf not found"
fi
# 1.1.3 Ensure /tmp is configured
log_test "1.1.3 Ensure /tmp partition configured"
if [ -d /tmp ]; then
if stat -c "%a" /tmp | grep -q "1777\|0777\|0755"; then
pass_test
else
warn_test "1.1.3: /tmp permissions may not be correct"
fi
else
fail_test "1.1.3: /tmp directory not found"
fi
# 1.1.19 Ensure sticky bit on world-writable directories
log_test "1.1.19 Ensure sticky bit on /tmp"
if stat -c "%a" /tmp | grep -q "1777"; then
pass_test
else
warn_test "1.1.19: /tmp may not have sticky bit"
fi
}
# ============================================================================
# CIS BENCHMARK TESTS - SECTION 3: NETWORK
# ============================================================================
test_network() {
section "CIS Benchmark 3: Network Configuration"
# 3.1.1 Ensure IP forwarding is disabled
log_test "3.1.1 Ensure IP forwarding is disabled"
if sysctl net.ipv4.ip_forward 2>/dev/null | grep -q "net.ipv4.ip_forward = 0"; then
pass_test
else
fail_test "3.1.1: IP forwarding not disabled"
fi
# 3.1.2 Ensure packet redirect sending is disabled
log_test "3.1.2 Ensure packet redirect sending is disabled"
if sysctl net.ipv4.conf.all.send_redirects 2>/dev/null | grep -q "net.ipv4.conf.all.send_redirects = 0"; then
pass_test
else
fail_test "3.1.2: Packet redirects not disabled"
fi
# 3.2.1 Ensure source routed packets are not accepted
log_test "3.2.1 Ensure source routed packets are not accepted"
if sysctl net.ipv4.conf.all.accept_source_route 2>/dev/null | grep -q "net.ipv4.conf.all.accept_source_route = 0"; then
pass_test
else
fail_test "3.2.1: Source routing not disabled"
fi
# 3.2.2 Ensure ICMP redirects are not accepted
log_test "3.2.2 Ensure ICMP redirects are not accepted"
if sysctl net.ipv4.conf.all.accept_redirects 2>/dev/null | grep -q "net.ipv4.conf.all.accept_redirects = 0"; then
pass_test
else
fail_test "3.2.2: ICMP redirects not disabled"
fi
# 3.2.8 Ensure TCP SYN Cookies is enabled
log_test "3.2.8 Ensure TCP SYN Cookies is enabled"
if sysctl net.ipv4.tcp_syncookies 2>/dev/null | grep -q "net.ipv4.tcp_syncookies = 1"; then
pass_test
else
fail_test "3.2.8: TCP SYN cookies not enabled"
fi
# 3.3.1 Ensure IPv6 router advertisements are not accepted
log_test "3.3.1 Ensure IPv6 router advertisements are not accepted"
if sysctl net.ipv6.conf.all.accept_ra 2>/dev/null | grep -q "net.ipv6.conf.all.accept_ra = 0\|not found"; then
pass_test
else
warn_test "3.3.1: IPv6 may accept router advertisements"
fi
}
# ============================================================================
# CIS BENCHMARK TESTS - SECTION 4: LOGGING AND AUDITING
# ============================================================================
test_auditing() {
section "CIS Benchmark 4: Logging and Auditing"
# 4.1.1.3 Ensure rsyslog is installed
log_test "4.1.1.3 Ensure rsyslog is installed"
if command -v rsyslogd >/dev/null 2>&1 || systemctl is-active rsyslog >/dev/null 2>&1; then
pass_test
else
fail_test "4.1.1.3: rsyslog not installed or not running"
fi
# 4.1.1.4 Ensure rsyslog service is enabled
log_test "4.1.1.4 Ensure rsyslog service is enabled"
if systemctl is-enabled rsyslog >/dev/null 2>&1; then
pass_test
else
fail_test "4.1.1.4: rsyslog not enabled"
fi
# 4.1.2.1 Ensure system is configured to log audit records
log_test "4.1.2.1 Ensure system logs audit records"
if systemctl is-active auditd >/dev/null 2>&1; then
pass_test
else
fail_test "4.1.2.1: auditd not running"
fi
# 4.1.2.2 Ensure auditd service is enabled
log_test "4.1.2.2 Ensure auditd service is enabled"
if systemctl is-enabled auditd >/dev/null 2>&1; then
pass_test
else
fail_test "4.1.2.2: auditd not enabled"
fi
# 4.1.2.7 Ensure audit records are stored
log_test "4.1.2.7 Ensure audit records are stored"
if [ -d /var/log/audit ]; then
pass_test
else
fail_test "4.1.2.7: /var/log/audit directory not found"
fi
}
# ============================================================================
# CIS BENCHMARK TESTS - SECTION 5: ACCESS CONTROL
# ============================================================================
test_access_control() {
section "CIS Benchmark 5: Access Control"
# 5.1.1 Ensure cron daemon is enabled and running
log_test "5.1.1 Ensure cron daemon is enabled"
if systemctl is-enabled cron >/dev/null 2>&1; then
pass_test
else
fail_test "5.1.1: cron not enabled"
fi
# 5.2.1 Ensure SSH server is not installed
log_test "5.2.1 Ensure SSH server is not installed"
if ! command -v sshd >/dev/null 2>&1 && ! systemctl list-unit-files | grep -q "sshd"; then
pass_test
else
if systemctl is-active sshd >/dev/null 2>&1; then
fail_test "5.2.1: SSH server is running"
else
warn_test "5.2.1: SSH installed but not running"
fi
fi
# 5.4.1.1 Ensure password creation requirements are configured
log_test "5.4.1.1 Ensure password creation requirements are configured"
if [ -f /etc/security/pwquality.conf ]; then
pass_test
else
fail_test "5.4.1.1: pwquality.conf not found"
fi
# 5.4.2 Ensure password hashing algorithm is SHA-512
log_test "5.4.2 Ensure password hashing algorithm is SHA-512"
if grep -q "ENCRYPT_METHOD SHA512" /etc/login.defs; then
pass_test
else
fail_test "5.4.2: Password hashing not set to SHA-512"
fi
# 5.4.3 Ensure system accounts are secured
log_test "5.4.3 Ensure system accounts are secured"
local unsecured_accounts=0
for user in daemon bin sys sync man lp mail news uucp; do
if id "$user" >/dev/null 2>&1; then
if ! passwd -S "$user" 2>/dev/null | grep -q "L"; then
((unsecured_accounts++))
fi
fi
done
if [ $unsecured_accounts -eq 0 ]; then
pass_test
else
fail_test "5.4.3: $unsecured_accounts system accounts not locked"
fi
}
# ============================================================================
# CIS BENCHMARK TESTS - SECTION 6: MAINTENANCE
# ============================================================================
test_maintenance() {
section "CIS Benchmark 6: System Maintenance"
# 6.1.1 Ensure system accounts are non-login
log_test "6.1.1 Ensure system accounts are non-login"
local login_accounts=0
for user in daemon bin sys sync man lp mail news uucp; do
if id "$user" >/dev/null 2>&1; then
if [ -n "$(getent passwd "$user" | cut -d: -f7)" ]; then
shell=$(getent passwd "$user" | cut -d: -f7)
if [ "$shell" != "/usr/sbin/nologin" ] && [ "$shell" != "/bin/false" ]; then
((login_accounts++))
fi
fi
fi
done
if [ $login_accounts -eq 0 ]; then
pass_test
else
warn_test "6.1.1: $login_accounts system accounts may have login shells"
fi
}
# ============================================================================
# CMMC AND FEDRAMP COMPLIANCE TESTS
# ============================================================================
test_compliance() {
section "CMMC Level 3 and FedRAMP Moderate Compliance"
# AC.6: Least privilege
log_test "AC.6: Ensure sudo configuration enforces least privilege"
if [ -f /etc/sudoers.d/cis-hardening ]; then
pass_test
else
fail_test "AC.6: CIS sudoers configuration not found"
fi
# AU.2: Audit events
log_test "AU.2: Ensure comprehensive audit rules are configured"
if [ -f /etc/audit/rules.d/cis-audit.rules ]; then
pass_test
else
fail_test "AU.2: CIS audit rules not found"
fi
# CM.6: Automated monitoring
log_test "CM.6: Ensure AIDE is configured for automated monitoring"
if [ -f /etc/aide.conf ] && command -v aide >/dev/null 2>&1; then
pass_test
else
fail_test "CM.6: AIDE not configured"
fi
# SC.8: Transmission confidentiality and integrity
log_test "SC.8: Ensure WireGuard is configured for encrypted transmission"
if [ -f /etc/wireguard/wg0.conf ]; then
pass_test
else
warn_test "SC.8: WireGuard configuration not found (may be in overlay)"
fi
# SI.7: Software and firmware integrity checking
log_test "SI.7: Ensure file integrity checking is scheduled"
if systemctl is-enabled aide-check.timer >/dev/null 2>&1; then
pass_test
else
warn_test "SI.7: AIDE check timer not enabled"
fi
}
# ============================================================================
# SECURITY CONFIGURATION TESTS
# ============================================================================
test_security_config() {
section "Security Configuration Tests"
# Firewall configuration
log_test "Ensure firewall rules are configured (WireGuard only)"
if [ -f /etc/iptables/rules.v4 ]; then
pass_test
else
warn_test "Firewall rules file not found (may be applied during boot)"
fi
# Kernel hardening
log_test "Ensure kernel hardening parameters are applied"
if [ -f /etc/sysctl.d/99-cis-hardening.conf ]; then
pass_test
else
fail_test "Kernel hardening configuration not found"
fi
# AppArmor status
log_test "Ensure AppArmor is enabled"
if systemctl is-active apparmor >/dev/null 2>&1 || [ -f /sys/kernel/security/apparmor/profiles ]; then
pass_test
else
warn_test "AppArmor may not be enabled"
fi
# Core dumps disabled
log_test "Ensure core dumps are disabled"
if grep -q "hard core 0" /etc/security/limits.conf; then
pass_test
else
fail_test "Core dumps not disabled in limits.conf"
fi
}
# ============================================================================
# NETWORK ISOLATION TESTS
# ============================================================================
test_network_isolation() {
section "Network Isolation Tests"
# SSH disabled
log_test "Ensure SSH is disabled"
if ! systemctl is-active sshd >/dev/null 2>&1 && ! systemctl is-active ssh >/dev/null 2>&1; then
pass_test
else
fail_test "SSH is running (should be disabled)"
fi
# Telnet disabled
log_test "Ensure Telnet is disabled"
if ! command -v telnetd >/dev/null 2>&1; then
pass_test
else
fail_test "Telnet server installed (should be removed)"
fi
# Bluetooth disabled
log_test "Ensure Bluetooth is disabled"
if systemctl is-active bluetooth 2>&1 | grep -q "inactive\|not found"; then
pass_test
else
fail_test "Bluetooth is active (should be disabled)"
fi
# Wireless disabled
log_test "Ensure wireless is disabled via kernel modules"
if [ -f /etc/modprobe.d/disable-wireless.conf ]; then
pass_test
else
fail_test "Wireless not disabled in modprobe.d"
fi
}
# ============================================================================
# LOGGING AND MONITORING TESTS
# ============================================================================
test_logging() {
section "Logging and Monitoring Tests"
# Audit logs exist
log_test "Ensure audit log directory exists"
if [ -d /var/log/audit ]; then
pass_test
else
fail_test "Audit log directory not found"
fi
# Security logs exist
log_test "Ensure security log directory exists"
if [ -d /var/log/security ] || [ -d /var/log ]; then
pass_test
else
warn_test "Security log directory not found"
fi
# Logrotate configured
log_test "Ensure logrotate is configured for security logs"
if [ -f /etc/logrotate.d/cis-logs ]; then
pass_test
else
warn_test "CIS logrotate configuration not found"
fi
# Audit rules loaded
log_test "Ensure audit rules are loaded"
if command -v auditctl >/dev/null 2>&1; then
if auditctl -l 2>/dev/null | grep -q "\-a\|\-w"; then
pass_test
else
warn_test "Audit rules may not be loaded"
fi
else
skip_test "auditctl command not available"
fi
}
# ============================================================================
# COMPREHENSIVE COMPLIANCE VERIFICATION
# ============================================================================
verify_compliance() {
section "Compliance Verification Summary"
echo "CIS Debian 13 Benchmark: Verifying implementation..."
echo "CMMC Level 3: Verifying implementation..."
echo "FedRAMP Moderate: Verifying implementation..."
echo "NIST SP 800-171: Verifying implementation..."
local cis_controls=180
local cis_implemented=$(find /etc -name "*.conf" -o -name "*.rules" | grep -c "cis\|hardening" 2>/dev/null || echo 0)
echo ""
echo "Implementation Status:"
echo " CIS Controls Configured: $cis_implemented / 180"
echo " Kernel Parameters Applied: $(grep -r "^[a-z]" /etc/sysctl.d/*.conf 2>/dev/null | wc -l)"
echo " Audit Rules Defined: $(grep -r "^-a\|^-w" /etc/audit/rules.d/*.conf 2>/dev/null | wc -l)"
echo " Log Files Configured: $(ls -1 /etc/logrotate.d/ 2>/dev/null | wc -l)"
echo " Security Services Enabled: $(systemctl list-unit-files | grep -c "enabled" | head -1 || echo 0)"
echo ""
if [ $cis_implemented -gt 10 ]; then
echo -e "${GREEN}✓ CIS Benchmark implementation appears comprehensive${NC}"
else
echo -e "${YELLOW}⚠ CIS Benchmark implementation may be incomplete${NC}"
fi
}
# ============================================================================
# GENERATE REPORT
# ============================================================================
generate_report() {
section "TEST RESULTS SUMMARY"
echo -e "Total Tests: $TOTAL_TESTS"
echo -e "${GREEN}Passed: $PASSED_TESTS${NC}"
echo -e "${RED}Failed: $FAILED_TESTS${NC}"
echo -e "${YELLOW}Warnings: $WARNINGS${NC}"
echo -e "${BLUE}Skipped: $SKIPPED_TESTS${NC}"
echo ""
# Calculate pass rate
local pass_rate=0
if [ $TOTAL_TESTS -gt 0 ]; then
pass_rate=$((PASSED_TESTS * 100 / TOTAL_TESTS))
fi
echo "Pass Rate: $pass_rate%"
echo ""
# Display failed tests
if [ $FAILED_TESTS -gt 0 ]; then
echo -e "${RED}Failed Tests:${NC}"
for test in "${FAILED_TESTS_LIST[@]}"; do
echo -e " - $test"
done
echo ""
fi
# Display warnings
if [ $WARNINGS -gt 0 ]; then
echo -e "${YELLOW}Warnings:${NC}"
for warning in "${WARNING_LIST[@]}"; do
echo -e " - $warning"
done
echo ""
fi
# Compliance status
if [ $FAILED_TESTS -eq 0 ]; then
echo -e "${GREEN}✓ ALL CRITICAL TESTS PASSED${NC}"
echo ""
echo "The system meets compliance requirements for:"
echo " - CIS Debian 13 Benchmark"
echo " - CMMC Level 3"
echo " - FedRAMP Moderate"
echo " - NIST SP 800-171"
else
echo -e "${RED}✗ SOME CRITICAL TESTS FAILED${NC}"
echo ""
echo "The system does not meet all compliance requirements."
echo "Review failed tests and warnings above."
fi
}
# ============================================================================
# MAIN EXECUTION
# ============================================================================
main() {
echo "================================================"
echo "Football Security and Compliance Test Suite"
echo "================================================"
echo ""
# Check if running as root
if [ "$EUID" -ne 0 ]; then
echo -e "${YELLOW}Warning: Running as non-root user. Some tests may fail.${NC}"
echo "Run with sudo for complete results."
echo ""
fi
# Run all test suites
test_filesystems
test_network
test_auditing
test_access_control
test_maintenance
test_compliance
test_security_config
test_network_isolation
test_logging
# Verify compliance
verify_compliance
# Generate report
generate_report
# Exit with appropriate code
if [ $FAILED_TESTS -gt 0 ]; then
exit 1
else
exit 0
fi
}
# Run main function
main "$@"

323
tests/verify-compliance.sh
View File

@@ -1,323 +0,0 @@
#!/bin/bash
# Automated Compliance Verification Script
# Verifies all compliance controls are properly implemented
set -e
# Color codes
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'
# Results tracking
TOTAL=0
COMPLIANT=0
NON_COMPLIANT=0
PARTIALLY_COMPLIANT=0
log() {
echo -e "${BLUE}[INFO]${NC} $1"
}
pass() {
echo -e "${GREEN}[PASS]${NC} $1"
((TOTAL++))
((COMPLIANT++))
}
fail() {
echo -e "${RED}[FAIL]${NC} $1"
((TOTAL++))
((NON_COMPLIANT++))
}
warn() {
echo -e "${YELLOW}[WARN]${NC} $1"
((TOTAL++))
((PARTIALLY_COMPLIANT++))
}
check_file() {
local file=$1
if [ -f "$file" ]; then
return 0
else
return 1
fi
}
check_service() {
local service=$1
local state=$2 # enabled, disabled, active, inactive
case $state in
enabled)
systemctl is-enabled "$service" >/dev/null 2>&1
return $?
;;
disabled)
systemctl is-enabled "$service" >/dev/null 2>&1
[ $? -ne 0 ]
return $?
;;
active)
systemctl is-active "$service" >/dev/null 2>&1
return $?
;;
inactive)
systemctl is-active "$service" >/dev/null 2>&1
[ $? -ne 0 ]
return $?
;;
esac
}
check_file_content() {
local file=$1
local pattern=$2
grep -q "$pattern" "$file" 2>/dev/null
return $?
}
echo "================================================"
echo "Automated Compliance Verification"
echo "================================================"
echo ""
# ============================================================================
# CIS DEBIAN 13 BENCHMARK VERIFICATION
# ============================================================================
echo "Verifying CIS Debian 13 Benchmark Implementation..."
echo ""
# Section 1: Filesystems
echo "Section 1: Filesystems Configuration"
check_file /etc/modprobe.d/no-network-fs.conf && \
pass "1.1.1: Network filesystems disabled in modprobe" || \
fail "1.1.1: Network filesystems not disabled"
check_file_content /etc/modprobe.d/no-network-fs.conf "install nfs /bin/true" && \
pass "1.1.1: NFS specifically disabled" || \
fail "1.1.1: NFS not disabled"
# Section 3: Network Configuration
echo ""
echo "Section 3: Network Configuration"
check_file /etc/sysctl.d/99-cis-hardening.conf && \
pass "3.x: Kernel hardening configuration present" || \
fail "3.x: Kernel hardening configuration missing"
check_file_content /etc/sysctl.d/99-cis-hardening.conf "net.ipv4.ip_forward = 0" && \
pass "3.1.1: IP forwarding disabled" || \
fail "3.1.1: IP forwarding not disabled"
check_file_content /etc/sysctl.d/99-cis-hardening.conf "net.ipv4.tcp_syncookies = 1" && \
pass "3.2.8: TCP SYN cookies enabled" || \
fail "3.2.8: TCP SYN cookies not enabled"
# Section 4: Logging and Auditing
echo ""
echo "Section 4: Logging and Auditing"
check_file /etc/audit/rules.d/cis-audit.rules && \
pass "4.1.2: Comprehensive audit rules configured" || \
fail "4.1.2: Audit rules not configured"
check_file /etc/rsyslog.d/50-cis-logging.conf && \
pass "4.1.1: Rsyslog security logging configured" || \
fail "4.1.1: Rsyslog logging not configured"
check_file /etc/logrotate.d/cis-logs && \
pass "4.1.1.7: Log rotation configured" || \
fail "4.1.1.7: Log rotation not configured"
# Section 5: Access Control
echo ""
echo "Section 5: Access Control"
check_file /etc/security/pwquality.conf && \
pass "5.4.1.1: Password quality requirements configured" || \
fail "5.4.1.1: Password quality not configured"
check_file /etc/login.defs && \
pass "5.4.2: Login configuration present" || \
fail "5.4.2: Login configuration missing"
check_file_content /etc/login.defs "ENCRYPT_METHOD SHA512" && \
pass "5.4.2: Password hashing set to SHA-512" || \
fail "5.4.2: Password hashing not SHA-512"
check_file /etc/pam.d/common-password-cis && \
pass "5.4.1: PAM password hardening configured" || \
fail "5.4.1: PAM password hardening missing"
check_file /etc/sudoers.d/cis-hardening && \
pass "5.5: Sudo hardening configured" || \
fail "5.5: Sudo hardening missing"
# ============================================================================
# CMMC LEVEL 3 VERIFICATION
# ============================================================================
echo ""
echo "Verifying CMMC Level 3 Implementation..."
echo ""
# AC - Access Control
echo "AC Domain: Access Control"
check_file /etc/sudoers.d/cis-hardening && \
pass "AC.6: Least privilege sudo configuration" || \
fail "AC.6: Least privilege not configured"
# AU - Audit and Accountability
echo "AU Domain: Audit and Accountability"
check_file /etc/audit/rules.d/cis-audit.rules && \
pass "AU.2: Comprehensive audit rules" || \
fail "AU.2: Audit rules not implemented"
check_service auditd enabled && \
pass "AU.x: Auditd service enabled" || \
fail "AU.x: Auditd not enabled"
# CM - Configuration Management
echo "CM Domain: Configuration Management"
check_file /etc/aide.conf && \
pass "CM.6: File integrity monitoring configured" || \
fail "CM.6: File integrity monitoring not configured"
# SC - System and Communications Protection
echo "SC Domain: System and Communications Protection"
check_file /etc/wireguard/wg0.conf 2>/dev/null || \
pass "SC.8: WireGuard VPN configured (in overlay)" || \
warn "SC.8: WireGuard config not in overlay"
check_file /etc/iptables/rules.v4 && \
pass "SC.7: Firewall rules configured" || \
fail "SC.7: Firewall rules not configured"
# SI - System and Information Integrity
echo "SI Domain: System and Information Integrity"
check_file /etc/aide.conf && \
pass "SI.7: File integrity checking tools" || \
fail "SI.7: FIM not configured"
# ============================================================================
# FEDRAMP MODERATE VERIFICATION
# ============================================================================
echo ""
echo "Verifying FedRAMP Moderate Implementation..."
echo ""
# AC-2: Account Management
check_file /etc/security/faillock.conf 2>/dev/null || \
check_file /etc/pam.d/common-password-cis && \
pass "AC-2: Account management controls" || \
fail "AC-2: Account management not configured"
# AU-6: Audit Review
check_file /etc/rsyslog.d/50-cis-logging.conf && \
pass "AU-6: Audit logging and review capability" || \
fail "AU-6: Audit review not configured"
# CM-2: Baseline Configuration
check_file /etc/sysctl.d/99-cis-hardening.conf && \
pass "CM-2: Security baseline configuration" || \
fail "CM-2: Security baseline not configured"
# SI-2: Flaw Remediation
check_file /etc/apt/sources.list && \
pass "SI-2: Package management for updates" || \
fail "SI-2: Package management not configured"
# ============================================================================
# SECURITY CONTROL VERIFICATION
# ============================================================================
echo ""
echo "Verifying Security Controls..."
echo ""
# Service States
echo "Service Configuration"
check_service ssh disabled && \
pass "SSH service disabled" || \
fail "SSH not disabled"
check_service sshd disabled && \
pass "SSHD service disabled" || \
fail "SSHD not disabled"
check_service auditd enabled && \
pass "Auditd enabled" || \
fail "Auditd not enabled"
check_service rsyslog enabled && \
pass "Rsyslog enabled" || \
fail "Rsyslog not enabled"
# File Permissions
echo ""
echo "File Security"
[ -f /etc/passwd ] && [ $(stat -c "%a" /etc/passwd) = "644" ] && \
pass "Permissions on /etc/passwd correct" || \
warn "/etc/passwd permissions may not be correct"
[ -f /etc/shadow ] && [ $(stat -c "%a" /etc/shadow 2>/dev/null) = "640\|000" ] && \
pass "Permissions on /etc/shadow correct" || \
warn "/etc/shadow permissions may not be correct"
# Kernel Parameters
echo ""
echo "Kernel Hardening"
sysctl net.ipv4.ip_forward 2>/dev/null | grep -q "= 0" && \
pass "IP forwarding disabled (runtime)" || \
fail "IP forwarding not disabled"
sysctl net.ipv4.tcp_syncookies 2>/dev/null | grep -q "= 1" && \
pass "TCP SYN cookies enabled (runtime)" || \
fail "TCP SYN cookies not enabled"
# ============================================================================
# COMPLIANCE SUMMARY
# ============================================================================
echo ""
echo "================================================"
echo "COMPLIANCE VERIFICATION SUMMARY"
echo "================================================"
echo ""
# Calculate compliance percentage
local percentage=0
if [ $TOTAL -gt 0 ]; then
percentage=$((COMPLIANT * 100 / TOTAL))
fi
echo "Total Controls Verified: $TOTAL"
echo -e "${GREEN}Compliant: $COMPLIANT${NC}"
echo -e "${YELLOW}Partially Compliant: $PARTIALLY_COMPLIANT${NC}"
echo -e "${RED}Non-Compliant: $NON_COMPLIANT${NC}"
echo ""
echo "Compliance Percentage: $percentage%"
echo ""
# Overall status
if [ $NON_COMPLIANT -eq 0 ] && [ $percentage -ge 95 ]; then
echo -e "${GREEN}✓ SYSTEM COMPLIANT${NC}"
echo ""
echo "The system meets compliance requirements for:"
echo " ✓ CIS Debian 13 Benchmark"
echo " ✓ CMMC Level 3"
echo " ✓ FedRAMP Moderate"
echo " ✓ NIST SP 800-171"
echo " ✓ NIST SP 800-53 Moderate"
echo ""
echo "Ready for deployment to Tier0 infrastructure."
exit 0
elif [ $NON_COMPLIANT -eq 0 ] && [ $percentage -ge 90 ]; then
echo -e "${GREEN}✓ SYSTEM MOSTLY COMPLIANT${NC}"
echo ""
echo "The system meets most compliance requirements."
echo "Review warnings and address any issues."
echo ""
exit 0
elif [ $NON_COMPLIANT -eq 0 ]; then
echo -e "${YELLOW}⚠ SYSTEM PARTIALLY COMPLIANT${NC}"
echo ""
echo "The system has some partial compliance issues."
echo "Review and address warnings before deployment."
echo ""
exit 1
else
echo -e "${RED}✗ SYSTEM NOT COMPLIANT${NC}"
echo ""
echo "The system has critical non-compliance issues."
echo "Address failed controls before deployment."
echo ""
exit 1
fi