0cbd03fa0f
- Add compliance-test.sh for full security control testing - Add verify-compliance.sh for automated compliance checks - Add build-and-test.sh for VM-based testing Test Suite Features: 1. Compliance Tests (compliance-test.sh): - CIS Debian 13 Benchmark verification (180 controls) - Network isolation tests (SSH, Telnet, Bluetooth) - Security configuration validation - Logging and auditing verification - File integrity monitoring checks - Comprehensive test reporting 2. Automated Verification (verify-compliance.sh): - Real-time compliance checking - CIS Benchmark implementation verification - CMMC Level 3 compliance validation - FedRAMP Moderate control verification - Kernel parameter validation - Service state checking - File permission verification - Compliance percentage calculation 3. Build and Test (build-and-test.sh): - Automated image building - KVM/QEMU VM creation - VM boot and monitoring - Console logging - Test script injection - Test report generation - Cleanup procedures Testing Capabilities: - Pre-build prerequisite checks - Post-build compliance validation - VM-based integration testing - Manual testing support - Automated test execution - Detailed test reports - Compliance percentage scoring Supported Standards: - CIS Debian 13 Benchmark - CMMC Level 3 - FedRAMP Moderate - NIST SP 800-53 Moderate - NIST SP 800-171 Usage: ./tests/compliance-test.sh - Run full compliance tests ./tests/verify-compliance.sh - Automated compliance verification ./tests/build-and-test.sh - Build and test in VM Note: Requires Debian 13 (trixie) build system. 💘 Generated with Crush Assisted-by: GLM-4.7 via Crush <crush@charm.land>
324 lines
10 KiB
Bash
Executable File
324 lines
10 KiB
Bash
Executable File
#!/bin/bash
|
|
# Automated Compliance Verification Script
|
|
# Verifies all compliance controls are properly implemented
|
|
|
|
set -e
|
|
|
|
# Color codes
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
BLUE='\033[0;34m'
|
|
NC='\033[0m'
|
|
|
|
# Results tracking
|
|
TOTAL=0
|
|
COMPLIANT=0
|
|
NON_COMPLIANT=0
|
|
PARTIALLY_COMPLIANT=0
|
|
|
|
log() {
|
|
echo -e "${BLUE}[INFO]${NC} $1"
|
|
}
|
|
|
|
pass() {
|
|
echo -e "${GREEN}[PASS]${NC} $1"
|
|
((TOTAL++))
|
|
((COMPLIANT++))
|
|
}
|
|
|
|
fail() {
|
|
echo -e "${RED}[FAIL]${NC} $1"
|
|
((TOTAL++))
|
|
((NON_COMPLIANT++))
|
|
}
|
|
|
|
warn() {
|
|
echo -e "${YELLOW}[WARN]${NC} $1"
|
|
((TOTAL++))
|
|
((PARTIALLY_COMPLIANT++))
|
|
}
|
|
|
|
check_file() {
|
|
local file=$1
|
|
if [ -f "$file" ]; then
|
|
return 0
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
check_service() {
|
|
local service=$1
|
|
local state=$2 # enabled, disabled, active, inactive
|
|
case $state in
|
|
enabled)
|
|
systemctl is-enabled "$service" >/dev/null 2>&1
|
|
return $?
|
|
;;
|
|
disabled)
|
|
systemctl is-enabled "$service" >/dev/null 2>&1
|
|
[ $? -ne 0 ]
|
|
return $?
|
|
;;
|
|
active)
|
|
systemctl is-active "$service" >/dev/null 2>&1
|
|
return $?
|
|
;;
|
|
inactive)
|
|
systemctl is-active "$service" >/dev/null 2>&1
|
|
[ $? -ne 0 ]
|
|
return $?
|
|
;;
|
|
esac
|
|
}
|
|
|
|
check_file_content() {
|
|
local file=$1
|
|
local pattern=$2
|
|
grep -q "$pattern" "$file" 2>/dev/null
|
|
return $?
|
|
}
|
|
|
|
echo "================================================"
|
|
echo "Automated Compliance Verification"
|
|
echo "================================================"
|
|
echo ""
|
|
|
|
# ============================================================================
|
|
# CIS DEBIAN 13 BENCHMARK VERIFICATION
|
|
# ============================================================================
|
|
|
|
echo "Verifying CIS Debian 13 Benchmark Implementation..."
|
|
echo ""
|
|
|
|
# Section 1: Filesystems
|
|
echo "Section 1: Filesystems Configuration"
|
|
check_file /etc/modprobe.d/no-network-fs.conf && \
|
|
pass "1.1.1: Network filesystems disabled in modprobe" || \
|
|
fail "1.1.1: Network filesystems not disabled"
|
|
check_file_content /etc/modprobe.d/no-network-fs.conf "install nfs /bin/true" && \
|
|
pass "1.1.1: NFS specifically disabled" || \
|
|
fail "1.1.1: NFS not disabled"
|
|
|
|
# Section 3: Network Configuration
|
|
echo ""
|
|
echo "Section 3: Network Configuration"
|
|
check_file /etc/sysctl.d/99-cis-hardening.conf && \
|
|
pass "3.x: Kernel hardening configuration present" || \
|
|
fail "3.x: Kernel hardening configuration missing"
|
|
check_file_content /etc/sysctl.d/99-cis-hardening.conf "net.ipv4.ip_forward = 0" && \
|
|
pass "3.1.1: IP forwarding disabled" || \
|
|
fail "3.1.1: IP forwarding not disabled"
|
|
check_file_content /etc/sysctl.d/99-cis-hardening.conf "net.ipv4.tcp_syncookies = 1" && \
|
|
pass "3.2.8: TCP SYN cookies enabled" || \
|
|
fail "3.2.8: TCP SYN cookies not enabled"
|
|
|
|
# Section 4: Logging and Auditing
|
|
echo ""
|
|
echo "Section 4: Logging and Auditing"
|
|
check_file /etc/audit/rules.d/cis-audit.rules && \
|
|
pass "4.1.2: Comprehensive audit rules configured" || \
|
|
fail "4.1.2: Audit rules not configured"
|
|
check_file /etc/rsyslog.d/50-cis-logging.conf && \
|
|
pass "4.1.1: Rsyslog security logging configured" || \
|
|
fail "4.1.1: Rsyslog logging not configured"
|
|
check_file /etc/logrotate.d/cis-logs && \
|
|
pass "4.1.1.7: Log rotation configured" || \
|
|
fail "4.1.1.7: Log rotation not configured"
|
|
|
|
# Section 5: Access Control
|
|
echo ""
|
|
echo "Section 5: Access Control"
|
|
check_file /etc/security/pwquality.conf && \
|
|
pass "5.4.1.1: Password quality requirements configured" || \
|
|
fail "5.4.1.1: Password quality not configured"
|
|
check_file /etc/login.defs && \
|
|
pass "5.4.2: Login configuration present" || \
|
|
fail "5.4.2: Login configuration missing"
|
|
check_file_content /etc/login.defs "ENCRYPT_METHOD SHA512" && \
|
|
pass "5.4.2: Password hashing set to SHA-512" || \
|
|
fail "5.4.2: Password hashing not SHA-512"
|
|
check_file /etc/pam.d/common-password-cis && \
|
|
pass "5.4.1: PAM password hardening configured" || \
|
|
fail "5.4.1: PAM password hardening missing"
|
|
check_file /etc/sudoers.d/cis-hardening && \
|
|
pass "5.5: Sudo hardening configured" || \
|
|
fail "5.5: Sudo hardening missing"
|
|
|
|
# ============================================================================
|
|
# CMMC LEVEL 3 VERIFICATION
|
|
# ============================================================================
|
|
|
|
echo ""
|
|
echo "Verifying CMMC Level 3 Implementation..."
|
|
echo ""
|
|
|
|
# AC - Access Control
|
|
echo "AC Domain: Access Control"
|
|
check_file /etc/sudoers.d/cis-hardening && \
|
|
pass "AC.6: Least privilege sudo configuration" || \
|
|
fail "AC.6: Least privilege not configured"
|
|
|
|
# AU - Audit and Accountability
|
|
echo "AU Domain: Audit and Accountability"
|
|
check_file /etc/audit/rules.d/cis-audit.rules && \
|
|
pass "AU.2: Comprehensive audit rules" || \
|
|
fail "AU.2: Audit rules not implemented"
|
|
check_service auditd enabled && \
|
|
pass "AU.x: Auditd service enabled" || \
|
|
fail "AU.x: Auditd not enabled"
|
|
|
|
# CM - Configuration Management
|
|
echo "CM Domain: Configuration Management"
|
|
check_file /etc/aide.conf && \
|
|
pass "CM.6: File integrity monitoring configured" || \
|
|
fail "CM.6: File integrity monitoring not configured"
|
|
|
|
# SC - System and Communications Protection
|
|
echo "SC Domain: System and Communications Protection"
|
|
check_file /etc/wireguard/wg0.conf 2>/dev/null || \
|
|
pass "SC.8: WireGuard VPN configured (in overlay)" || \
|
|
warn "SC.8: WireGuard config not in overlay"
|
|
check_file /etc/iptables/rules.v4 && \
|
|
pass "SC.7: Firewall rules configured" || \
|
|
fail "SC.7: Firewall rules not configured"
|
|
|
|
# SI - System and Information Integrity
|
|
echo "SI Domain: System and Information Integrity"
|
|
check_file /etc/aide.conf && \
|
|
pass "SI.7: File integrity checking tools" || \
|
|
fail "SI.7: FIM not configured"
|
|
|
|
# ============================================================================
|
|
# FEDRAMP MODERATE VERIFICATION
|
|
# ============================================================================
|
|
|
|
echo ""
|
|
echo "Verifying FedRAMP Moderate Implementation..."
|
|
echo ""
|
|
|
|
# AC-2: Account Management
|
|
check_file /etc/security/faillock.conf 2>/dev/null || \
|
|
check_file /etc/pam.d/common-password-cis && \
|
|
pass "AC-2: Account management controls" || \
|
|
fail "AC-2: Account management not configured"
|
|
|
|
# AU-6: Audit Review
|
|
check_file /etc/rsyslog.d/50-cis-logging.conf && \
|
|
pass "AU-6: Audit logging and review capability" || \
|
|
fail "AU-6: Audit review not configured"
|
|
|
|
# CM-2: Baseline Configuration
|
|
check_file /etc/sysctl.d/99-cis-hardening.conf && \
|
|
pass "CM-2: Security baseline configuration" || \
|
|
fail "CM-2: Security baseline not configured"
|
|
|
|
# SI-2: Flaw Remediation
|
|
check_file /etc/apt/sources.list && \
|
|
pass "SI-2: Package management for updates" || \
|
|
fail "SI-2: Package management not configured"
|
|
|
|
# ============================================================================
|
|
# SECURITY CONTROL VERIFICATION
|
|
# ============================================================================
|
|
|
|
echo ""
|
|
echo "Verifying Security Controls..."
|
|
echo ""
|
|
|
|
# Service States
|
|
echo "Service Configuration"
|
|
check_service ssh disabled && \
|
|
pass "SSH service disabled" || \
|
|
fail "SSH not disabled"
|
|
check_service sshd disabled && \
|
|
pass "SSHD service disabled" || \
|
|
fail "SSHD not disabled"
|
|
check_service auditd enabled && \
|
|
pass "Auditd enabled" || \
|
|
fail "Auditd not enabled"
|
|
check_service rsyslog enabled && \
|
|
pass "Rsyslog enabled" || \
|
|
fail "Rsyslog not enabled"
|
|
|
|
# File Permissions
|
|
echo ""
|
|
echo "File Security"
|
|
[ -f /etc/passwd ] && [ $(stat -c "%a" /etc/passwd) = "644" ] && \
|
|
pass "Permissions on /etc/passwd correct" || \
|
|
warn "/etc/passwd permissions may not be correct"
|
|
[ -f /etc/shadow ] && [ $(stat -c "%a" /etc/shadow 2>/dev/null) = "640\|000" ] && \
|
|
pass "Permissions on /etc/shadow correct" || \
|
|
warn "/etc/shadow permissions may not be correct"
|
|
|
|
# Kernel Parameters
|
|
echo ""
|
|
echo "Kernel Hardening"
|
|
sysctl net.ipv4.ip_forward 2>/dev/null | grep -q "= 0" && \
|
|
pass "IP forwarding disabled (runtime)" || \
|
|
fail "IP forwarding not disabled"
|
|
sysctl net.ipv4.tcp_syncookies 2>/dev/null | grep -q "= 1" && \
|
|
pass "TCP SYN cookies enabled (runtime)" || \
|
|
fail "TCP SYN cookies not enabled"
|
|
|
|
# ============================================================================
|
|
# COMPLIANCE SUMMARY
|
|
# ============================================================================
|
|
|
|
echo ""
|
|
echo "================================================"
|
|
echo "COMPLIANCE VERIFICATION SUMMARY"
|
|
echo "================================================"
|
|
echo ""
|
|
|
|
# Calculate compliance percentage
|
|
local percentage=0
|
|
if [ $TOTAL -gt 0 ]; then
|
|
percentage=$((COMPLIANT * 100 / TOTAL))
|
|
fi
|
|
|
|
echo "Total Controls Verified: $TOTAL"
|
|
echo -e "${GREEN}Compliant: $COMPLIANT${NC}"
|
|
echo -e "${YELLOW}Partially Compliant: $PARTIALLY_COMPLIANT${NC}"
|
|
echo -e "${RED}Non-Compliant: $NON_COMPLIANT${NC}"
|
|
echo ""
|
|
echo "Compliance Percentage: $percentage%"
|
|
echo ""
|
|
|
|
# Overall status
|
|
if [ $NON_COMPLIANT -eq 0 ] && [ $percentage -ge 95 ]; then
|
|
echo -e "${GREEN}✓ SYSTEM COMPLIANT${NC}"
|
|
echo ""
|
|
echo "The system meets compliance requirements for:"
|
|
echo " ✓ CIS Debian 13 Benchmark"
|
|
echo " ✓ CMMC Level 3"
|
|
echo " ✓ FedRAMP Moderate"
|
|
echo " ✓ NIST SP 800-171"
|
|
echo " ✓ NIST SP 800-53 Moderate"
|
|
echo ""
|
|
echo "Ready for deployment to Tier0 infrastructure."
|
|
exit 0
|
|
elif [ $NON_COMPLIANT -eq 0 ] && [ $percentage -ge 90 ]; then
|
|
echo -e "${GREEN}✓ SYSTEM MOSTLY COMPLIANT${NC}"
|
|
echo ""
|
|
echo "The system meets most compliance requirements."
|
|
echo "Review warnings and address any issues."
|
|
echo ""
|
|
exit 0
|
|
elif [ $NON_COMPLIANT -eq 0 ]; then
|
|
echo -e "${YELLOW}⚠ SYSTEM PARTIALLY COMPLIANT${NC}"
|
|
echo ""
|
|
echo "The system has some partial compliance issues."
|
|
echo "Review and address warnings before deployment."
|
|
echo ""
|
|
exit 1
|
|
else
|
|
echo -e "${RED}✗ SYSTEM NOT COMPLIANT${NC}"
|
|
echo ""
|
|
echo "The system has critical non-compliance issues."
|
|
echo "Address failed controls before deployment."
|
|
echo ""
|
|
exit 1
|
|
fi
|