131 lines
3.6 KiB
Bash
Executable File
131 lines
3.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ©AngelaMos | 2026
|
|
# test_04_logging.sh
|
|
#
|
|
# Tests for CIS Section 4 (Logging and Auditing) checks
|
|
#
|
|
# Uses pass and fail fixture directories to verify auditd installation
|
|
# (4.1.1), boot-time audit parameter in GRUB (4.1.3), audit backlog
|
|
# limit (4.1.4), time change audit rules (4.1.5), rsyslog installation
|
|
# (4.2.1), rsyslog FileCreateMode (4.2.3), and logging rule presence
|
|
# (4.2.4). Each test asserts the expected status and evidence substring
|
|
# matches against fixture /etc/default/grub, /etc/audit/rules.d/, and
|
|
# /etc/rsyslog.conf contents.
|
|
#
|
|
# Connects to:
|
|
# checks/04_logging.sh - check functions under test
|
|
# tests/test_helpers.sh - setup_test, assert_status,
|
|
# assert_evidence_contains
|
|
|
|
test_4_1_1_pass() {
|
|
CURRENT_TEST="test_4_1_1_pass"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures"
|
|
check_4_1_1
|
|
assert_status "4.1.1" "PASS"
|
|
assert_evidence_contains "4.1.1" "auditd"
|
|
}
|
|
|
|
test_4_1_1_fail() {
|
|
CURRENT_TEST="test_4_1_1_fail"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures_fail"
|
|
check_4_1_1
|
|
assert_status "4.1.1" "FAIL"
|
|
assert_evidence_contains "4.1.1" "not installed"
|
|
}
|
|
|
|
test_4_1_3_pass() {
|
|
CURRENT_TEST="test_4_1_3_pass"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures"
|
|
check_4_1_3
|
|
assert_status "4.1.3" "PASS"
|
|
assert_evidence_contains "4.1.3" "audit=1"
|
|
}
|
|
|
|
test_4_1_3_fail() {
|
|
CURRENT_TEST="test_4_1_3_fail"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures_fail"
|
|
check_4_1_3
|
|
assert_status "4.1.3" "FAIL"
|
|
assert_evidence_contains "4.1.3" "audit=1"
|
|
}
|
|
|
|
test_4_1_4_pass() {
|
|
CURRENT_TEST="test_4_1_4_pass"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures"
|
|
check_4_1_4
|
|
assert_status "4.1.4" "PASS"
|
|
assert_evidence_contains "4.1.4" "backlog"
|
|
}
|
|
|
|
test_4_1_4_fail() {
|
|
CURRENT_TEST="test_4_1_4_fail"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures_fail"
|
|
check_4_1_4
|
|
assert_status "4.1.4" "FAIL"
|
|
assert_evidence_contains "4.1.4" "backlog"
|
|
}
|
|
|
|
test_4_1_5_pass() {
|
|
CURRENT_TEST="test_4_1_5_pass"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures"
|
|
check_4_1_5
|
|
assert_status "4.1.5" "PASS"
|
|
assert_evidence_contains "4.1.5" "Time change"
|
|
}
|
|
|
|
test_4_1_5_fail() {
|
|
CURRENT_TEST="test_4_1_5_fail"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures_fail"
|
|
check_4_1_5
|
|
assert_status "4.1.5" "FAIL"
|
|
assert_evidence_contains "4.1.5" "Missing audit rules"
|
|
}
|
|
|
|
test_4_2_1_pass() {
|
|
CURRENT_TEST="test_4_2_1_pass"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures"
|
|
check_4_2_1
|
|
assert_status "4.2.1" "PASS"
|
|
assert_evidence_contains "4.2.1" "rsyslog"
|
|
}
|
|
|
|
test_4_2_1_fail() {
|
|
CURRENT_TEST="test_4_2_1_fail"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures_fail"
|
|
check_4_2_1
|
|
assert_status "4.2.1" "FAIL"
|
|
assert_evidence_contains "4.2.1" "not installed"
|
|
}
|
|
|
|
test_4_2_3_pass() {
|
|
CURRENT_TEST="test_4_2_3_pass"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures"
|
|
check_4_2_3
|
|
assert_status "4.2.3" "PASS"
|
|
assert_evidence_contains "4.2.3" "0640"
|
|
}
|
|
|
|
test_4_2_3_fail() {
|
|
CURRENT_TEST="test_4_2_3_fail"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures_fail"
|
|
check_4_2_3
|
|
assert_status "4.2.3" "FAIL"
|
|
assert_evidence_contains "4.2.3" "0777"
|
|
}
|
|
|
|
test_4_2_4_pass() {
|
|
CURRENT_TEST="test_4_2_4_pass"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures"
|
|
check_4_2_4
|
|
assert_status "4.2.4" "PASS"
|
|
assert_evidence_contains "4.2.4" "logging rule"
|
|
}
|
|
|
|
test_4_2_4_fail() {
|
|
CURRENT_TEST="test_4_2_4_fail"
|
|
setup_test "${PROJECT_DIR}/testdata/fixtures_fail"
|
|
check_4_2_4
|
|
assert_status "4.2.4" "FAIL"
|
|
assert_evidence_contains "4.2.4" "No logging rules"
|
|
}
|