Files
CISS.debian.installer/func/cdi_4700_verification/4680_check_sshd_config_integrity.sh
2025-09-25 20:14:53 +01:00

75 lines
2.2 KiB
Bash

#!/bin/bash
# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
# SPDX-Comment: SSH-Hardening Integrity Check (Centurion SSH Audit Support)
set -Ceuo pipefail
IFS=$'\n\t'
declare -r REF_CONFIG="/path/to/includes/etc/ssh/sshd_config"
declare -r LIVE_CONFIG="/etc/ssh/sshd_config"
declare -r REF_SSHD_T="/path/to/includes/etc/ssh/sshd_config.sshdT"
hash_file() {
sha256sum "$1" | awk '{print $1}'
}
bold() { tput bold; echo "$1"; tput sgr0; }
red() { tput setaf 1; echo "$1"; tput sgr0; }
green() { tput setaf 2; echo "$1"; tput sgr0; }
echo
bold "Checking SSH Configuration Integrity..."
if [[ ! -f "${REF_CONFIG}" ]]; then
red "ERROR: Reference config '${REF_CONFIG}' not found."
exit 1
fi
if [[ ! -f "${LIVE_CONFIG}" ]]; then
red "ERROR: Live config '${LIVE_CONFIG}' not found."
exit 1
fi
declare -r HASH_REF=$(hash_file "${REF_CONFIG}")
declare -r HASH_LIVE=$(hash_file "${LIVE_CONFIG}")
if [[ "${HASH_REF}" == "${HASH_LIVE}" ]]; then
green "✓ sshd_config matches reference (SHA256: ${HASH_LIVE})"
else
red "✗ sshd_config has been modified!"
diff -u "${REF_CONFIG}" "${LIVE_CONFIG}" || true
fi
# Vergleich der sshd -T Ausgabe
echo
bold "🔍 Verifying sshd -T output..."
if [[ ! -f "${REF_SSHD_T}" ]]; then
red "ERROR: Reference sshd -T output not found: '${REF_SSHD_T}'"
exit 1
fi
TMP_SSHD_T=$(mktemp)
sshd -T > "${TMP_SSHD_T}"
if diff -q "${TMP_SSHD_T}" "${REF_SSHD_T}" >/dev/null; then
green "✓ sshd -T output matches expected configuration."
else
red "✗ sshd -T output has changed:"
diff -u "${REF_SSHD_T}" "${TMP_SSHD_T}" || true
fi
rm -f "${TMP_SSHD_T}"
echo
bold "✔ SSH config integrity check completed."
guard_dir && return 0