75 lines
2.2 KiB
Bash
75 lines
2.2 KiB
Bash
#!/bin/bash
|
|
# SPDX-Version: 3.0
|
|
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
|
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
|
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
|
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
|
# SPDX-FileType: SOURCE
|
|
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
|
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
|
# SPDX-PackageName: CISS.debian.installer
|
|
# SPDX-Security-Contact: security@coresecret.eu
|
|
# SPDX-Comment: SSH-Hardening Integrity Check (Centurion SSH Audit Support)
|
|
|
|
set -Ceuo pipefail
|
|
IFS=$'\n\t'
|
|
|
|
declare -r REF_CONFIG="/path/to/includes/etc/ssh/sshd_config"
|
|
declare -r LIVE_CONFIG="/etc/ssh/sshd_config"
|
|
declare -r REF_SSHD_T="/path/to/includes/etc/ssh/sshd_config.sshdT"
|
|
|
|
hash_file() {
|
|
sha256sum "$1" | awk '{print $1}'
|
|
}
|
|
|
|
bold() { tput bold; echo "$1"; tput sgr0; }
|
|
red() { tput setaf 1; echo "$1"; tput sgr0; }
|
|
green() { tput setaf 2; echo "$1"; tput sgr0; }
|
|
|
|
echo
|
|
bold "Checking SSH Configuration Integrity..."
|
|
|
|
if [[ ! -f "${REF_CONFIG}" ]]; then
|
|
red "ERROR: Reference config '${REF_CONFIG}' not found."
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! -f "${LIVE_CONFIG}" ]]; then
|
|
red "ERROR: Live config '${LIVE_CONFIG}' not found."
|
|
exit 1
|
|
fi
|
|
|
|
declare -r HASH_REF=$(hash_file "${REF_CONFIG}")
|
|
declare -r HASH_LIVE=$(hash_file "${LIVE_CONFIG}")
|
|
|
|
if [[ "${HASH_REF}" == "${HASH_LIVE}" ]]; then
|
|
green "✓ sshd_config matches reference (SHA256: ${HASH_LIVE})"
|
|
else
|
|
red "✗ sshd_config has been modified!"
|
|
diff -u "${REF_CONFIG}" "${LIVE_CONFIG}" || true
|
|
fi
|
|
|
|
# Vergleich der sshd -T Ausgabe
|
|
echo
|
|
bold "🔍 Verifying sshd -T output..."
|
|
|
|
if [[ ! -f "${REF_SSHD_T}" ]]; then
|
|
red "ERROR: Reference sshd -T output not found: '${REF_SSHD_T}'"
|
|
exit 1
|
|
fi
|
|
|
|
TMP_SSHD_T=$(mktemp)
|
|
sshd -T > "${TMP_SSHD_T}"
|
|
|
|
if diff -q "${TMP_SSHD_T}" "${REF_SSHD_T}" >/dev/null; then
|
|
green "✓ sshd -T output matches expected configuration."
|
|
else
|
|
red "✗ sshd -T output has changed:"
|
|
diff -u "${REF_SSHD_T}" "${TMP_SSHD_T}" || true
|
|
fi
|
|
|
|
rm -f "${TMP_SSHD_T}"
|
|
echo
|
|
bold "✔ SSH config integrity check completed."
|
|
guard_dir && return 0
|