$parentPath = Split-Path -Parent -Path $PSScriptRoot
$scriptPath = $parentPath + "/Helpers/ShellScripts/SLE_15/"
$rcTrue = "True"
$rcCompliant = "Compliant"
$rcFalse = "False"
$rcNone = "None"
$rcNonCompliant = "Non-Compliant"
$rcNonCompliantManualReviewRequired = "Manual Review Required"
$rcCompliantIPv6isDisabled = "IPv6 is disabled"
$rcFirewallStatus1 = "Using firewalld with iptables"
$rcFirewallStatus2 = "Using nftables"
$rcFirewallStatus3 = "Using iptables"

$retCompliant = @{
    Message = $rcCompliant
    Status = $rcTrue
}
$retNonCompliant = @{
    Message = $rcNonCompliant
    Status = $rcFalse
}
$retCompliantIPv6Disabled = @{
    Message = $rcCompliantIPv6isDisabled
    Status = $rcTrue
}
$retNonCompliantManualReviewRequired = @{
    Message = $rcNonCompliantManualReviewRequired
    Status = $rcNone
}
$retUsingFW1 = @{
    Message = $rcFirewallStatus1
    Status = $rcNone
}
$retUsingFW2 = @{
    Message = $rcFirewallStatus2
    Status = $rcNone
}
$retUsingFW3 = @{
    Message = $rcFirewallStatus3
    Status = $rcNone
}


$IPv6Status_script = @'
#!/bin/bash
[ -n "$passing" ] && passing=""
[ -z "$(grep "^\s*linux" /boot/grub2/grub.cfg | grep -v ipv6.disabled=1)" ] && passing="true"
grep -Eq "^\s*net\.ipv6\.conf\.all\.disable_ipv6\s*=\s*1\b(\s+#.*)?$" /etc/sysctl.conf /etc/sysctl.d/*.conf && grep -Eq "^\s*net\.ipv6\.conf\.default\.disable_ipv6\s*=\s*1\b(\s+#.*)?$" /etc/sysctl.conf /etc/sysctl.d/*.conf && sysctl net.ipv6.conf.all.disable_ipv6 | grep -Eq "^\s*net\.ipv6\.conf\.all\.disable_ipv6\s*=\s*1\b(\s+#.*)?$" && sysctl net.ipv6.conf.default.disable_ipv6 | grep -Eq "^\s*net\.ipv6\.conf\.default\.disable_ipv6\s*=\s*1\b(\s+#.*)?$" && passing="true"
if [ "$passing" = true ] ; then
    echo "IPv6 is disabled on the system"
else
    echo "IPv6 is enabled on the system"
fi
'@
$IPv6Status = bash -c $IPv6Status_script
if ($IPv6Status -match "enabled") {
    $IPv6Status = "enabled"
} else {
    $IPv6Status = "disabled"
}


# Firewall evaluation
function GetFirewallStatus {
    # 0 = init. value, undefined
    # 1 = using firewalld with iptabes as backend
    # 2 = using nftables
    # 3 = using iptables
    $FirewallStatus = 0

    # Testing for firewalld with iptables as backend
    $test1 = rpm -q firewalld iptables
    $test2 = rpm -q nftables
    $test3 = systemctl status nftables | grep "active (running)"
    $test4 = systemctl is-enabled nftables
    $test5 = systemctl is-enabled firewalld
    $test6 = firewall-cmd --state
    if($test1 -match "firewalld-" -and $test1 -match "iptables-" -and (!($test2 -match "nftables-") -or !($test3 -match "active (running)")) -and !($test4 -match "enabled") -and $test5 -match "enabled" -and $test6 -match "running") {
        return 1
    }

    # Testing for nftables
    $test1 = rpm -q nftables
    $test2 = rpm -q firewalld
    $test3 = systemctl status firewalld | grep "active (running)"
    $test4 = systemctl is-enabled firewalld
    $test5 = systemctl is-enabled nftables
    if($test1 -match "nftables-" -and !($test2 -match "firewalld-" -or $test3 -match "active (running)") -and !($test4 -match "enabled") -and $test5 -match "enabled") {
        return 2
    }

    # Testing for iptables
    $test1 = rpm -q iptables
    $test2 = rpm -q nftables
    $test3 = rpm -q firewalld
    $test4 = systemctl status firewalld | grep "active (running)"
    $test5 = systemctl is-enabled firewalld
    if($test1 -match "iptables-" -and $test2 -match "not installed" -and $test3 -match "not installed" -and !($test4 -match "running (active)") -and !($test5 -match "enabled")) {
        return 3
    }

    return $FirewallStatus
}

$FirewallStatus = GetFirewallStatus
### Chapter 1 - Initial Setup

[AuditTest] @{
    Id = "1.1.1.1"
    Task = "Ensure mounting of squashfs filesystems is disabled"
    Test = {
        $result1 = modprobe -n -v squashfs | grep -E '(suqashfs|install)'
        $result2 = lsmod | grep squashfs
        if ($result1 -match "install /bin/true" -and $result2 -eq $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.1.2"
    Task = "Ensure mounting of udf filesystems is disabled"
    Test = {
        $result1 = modprobe -n -v udf | grep -E '(udf|install)'
        $result2 = lsmod | grep udf
        if ($result1 -match "install /bin/true" -and $result2 -eq $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.1.3"
    Task = "Ensure mounting of FAT filesystems is disabled"
    Test = {
        $result1 = modprobe -n -v fat | grep -E '(fat|install)'
        $result2 = lsmod | grep udf
        $result3 = modprobe -n -v vfat | grep -E '(vfat|install)'
        $result4 = lsmod | grep udf
        $result5 = modprobe -n -v msdos | grep -E '(msdos|install)'
        $result6 = lsmod | grep udf
        if ($result1 -match "install /bin/true" -and $result2 -eq $null -and $result3 -match "install /bin/true" -and $result4 -eq $null -and $result5 -match "install /bin/true" -and $result6 -eq $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.2"
    Task = "Ensure /tmp is configured"
    Test = {
        $result1 = mount | grep -E '\s/tmp\s'
        if ($result1 -match "/tmp") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.3"
    Task = "Ensure noexec option set on /tmp partition"
    Test = {
        $result1 = mount | grep -E '\s/tmp\s' | grep -v noexec
        if ($result1 -eq $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.4"
    Task = "Ensure nodev option set on /tmp partition"
    Test = {
        $result1 = mount | grep -E '\s/tmp\s' | grep -v nodev
        if ($result1 -eq $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.5"
    Task = "Ensure nosuid option set on /tmp partition"
    Test = {
        $result1 = mount | grep -E '\s/tmp\s' | grep -v nosuid
        if ($result1 -eq $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.6"
    Task = "Ensure /dev/shm is configured"
    Test = {
        $result1 = mount | grep -E '\s/dev/shm\s'
        $result2 = grep -E '\s/dev/shm\s' /etc/fstab
        if ($result1 -ne $null -and $result2 -ne $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.7"
    Task = "Ensure noexec option set on /dev/shm partition"
    Test = {
        $result1 = mount | grep -E '\s/dev/shm\s' | grep -v noexec
        if ($result1 -eq $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.8"
    Task = "Ensure nodev option set on /dev/shm partition"
    Test = {
        $result1 = mount | grep -E '\s/dev/shm\s' | grep -v nodev
        if ($result1 -eq $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.9"
    Task = "Ensure nosuid option set on /dev/shm partition"
    Test = {
        $result1 = mount | grep -E '\s/dev/shm\s' | grep -v nosuid
        if ($result1 -eq $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.10"
    Task = "Ensure separate partition exists for /var"
    Test = {
        $result1 = mount | grep -E '\s/var\s'
        if ($result1 -ne $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.11"
    Task = "Ensure separate partition exists for /var/tmp"
    Test = {
        $result1 = mount | grep /var/tmp
        if ($result1 -ne $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.12"
    Task = "Ensure noexec option set on /var/tmp partition"
    Test = {
        $result1 = mount | grep -E '\s/var/tmp\s' | grep -v noexec
        if ($result1 -eq $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.13"
    Task = "Ensure nodev option set on /var/tmp partition"
    Test = {
        $result1 = mount | grep -E '\s/var/tmp\s' | grep -v nodev
        if ($result1 -eq $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.14"
    Task = "Ensure nosuid option set on /var/tmp partition"
    Test = {
        $result1 = mount | grep -E '\s/var/tmp\s' | grep -v nosuid
        if ($result1 -eq $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.15"
    Task = "Ensure separate partition exists for /var/log"
    Test = {
        $result1 = mount | grep -E '\s/var/log\s'
        if ($result1 -ne $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.16"
    Task = "Ensure separate partition exists for /var/log/audit"
    Test = {
        $result1 = mount | grep /var/log/audit
        if ($result1 -ne $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.17"
    Task = "Ensure separate partition exists for /home"
    Test = {
        $result1 = mount | grep /home
        if ($result1 -ne $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.18"
    Task = "Ensure nodev option set on /home partition"
    Test = {
        $result1 = mount | grep -E '\s/home\s' | grep -v nodev
        if ($result1 -eq $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.19"
    Task = "Ensure noexec option set on removable media partitions"
    Test = {
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "1.1.20"
    Task = "Ensure nodev option set on removable media partitions"
    Test = {
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "1.1.21"
    Task = "Ensure nosuid option set on removable media partitions"
    Test = {
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "1.1.22"
    Task = "Ensure sticky bit is set on all world-writable directories"
    Test = {
        $result_script = @'
#!/bin/bash
df --local -P 2>/dev/null | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type d \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null
'@
        $result = bash -c $result_script
        if ($result -ne $null) {
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.1.23"
    Task = "Disable Automounting"
    Test = {
        $result = systemctl is-enabled autofs
        if ($result -match "enabled") {
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.2.1"
    Task = "Ensure GPG keys are configured"
    Test = {
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "1.2.2"
    Task = "Ensure package manager repositories are configured"
    Test = {
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "1.2.3"
    Task = "Ensure gpgcheck is globally activated"
    Test = {
        $result = grep ^\s*gpgcheck /etc/zypp/zypp.conf
        if ($result -match "gpgcheck=1") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.3.1"
    Task = "Ensure sudo is installed"
    Test = {
        $result = rpm -q sudo
        if ($result -match "sudo-") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.3.2"
    Task = "Ensure sudo commands use pty"
    Test = {
        $result = grep -Ei '^\s*Defaults\s+([^#]\S+,\s*)?use_pty\b' /etc/sudoers /etc/sudoers.d/*
        if ($result -match "Defaults user_pty") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.3.3"
    Task = "Ensure sudo log file exists"
    Test = {
        $result = grep -Ei '^\s*Defaults\s+([^#;]+,\s*)?logfile\s*=\s*(")?[^#;]+(")?' /etc/sudoers /etc/sudoers.d/*
        if ($result -match "Defaults logfile=") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.4.1"
    Task = "Ensure aide is installed"
    Test = {
        $result = rpm -q aide
        if ($result -match "aide-") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.4.2"
    Task = "Ensure filesystem integrity is regularly checked"
    Test = {
        $result1 = crontab -u root -l | grep aide
        $result2 = grep -r aide /etc/cron.* /etc/crontab
        if ($result1 -ne $null -or $result2 -ne $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.5.1"
    Task = "Ensure bootloader password is set"
    Test = {
        $result1 = grep "^\s*set superusers" /boot/grub2/grub.cfg
        $result2 = grep "^\s*password" /boot/grub2/grub.cfg
        if ($result1 -match "set superusers=" -and $result2 -match "password_pbkdf2 ") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.5.2"
    Task = "Ensure permissions on bootloader config are configured"
    Test = {
        $result = stat /boot/grub2/grub.cfg | grep "Uid: "
        $result = $result | cut -d '(' -f 2
        $result = $result | cut -d '/' -f 1
        if($result -eq "0400" -or $result[1] -le 4){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.5.3"
    Task = "Ensure authentication required for single user mode"
    Test = {
        $result1 = grep /systemd-sulogin-shell /usr/lib/systemdm/system/rescue.service
        $result2 = grep /systemd-sulogin-shell /usr/lib/systemdm/system/rescue.service
        if($result1 -ne $null -and $result2 -ne $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.6.1"
    Task = "Ensure core dumps are restricted"
    Test = {
        $result1 = grep -E "^\s*\*\s+hard\s+core" /etc/security/limits.conf
        $result2 = sysctl fs.suid_dumpable
        $result3 = grep "fs\.suid_dumpable" /etc/sysctl.conf /etc/sysctl.d/*
        if($result1 -match "hard core 0" -and $result2 -match "fs.suid_dumpable = 0" -and $result3 -match "fs.suid_dumpable = 0") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

# 1.6.2 implemented for journalctl only
[AuditTest] @{
    Id = "1.6.2"
    Task = "Ensure XD/NX support is enabled"
    Test = {
        $result1 = journalctl | grep 'protection: active'
        if($result1 -match "protection: active") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.6.3"
    Task = "Ensure address space layout randomization (ASLR) is enabled"
    Test = {
        $result1 = sysctl kernel.randomize_va_space
        $result2 = grep "kernel\.randomize_va_space" /etc/sysctl.conf /etc/sysctl.d/*
        if($result1 -match "kernel.randomize_va_space = 2" -and $result2 -match "kernel.randomize_va_space = 2") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.6.4"
    Task = "Ensure prelink is disabled"
    Test = {
        $result1 = rpm -q prelink
        if($result1 -match "package prelink is not installed") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.7.1.1"
    Task = "Ensure AppArmor is installed"
    Test = {
        $result1 = rpm -q apparmor-docs apparmor-parser apparmor-profiles apparmor-utils libapparmor1
        if($result1 -ne $null -or $result2 -ne $null) {
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.7.1.2"
    Task = "Ensure AppArmor is enabled in the bootloader configuration"
    Test = {
        $result1 = grep "^\s*linux" /boot/grub2/grub.cfg | grep -v "apparmor=1"
        $result2 = grep "^\s*linux" /boot/grub2/grub.cfg | grep -v "security=apparmor"
        if($result1 -eq $null -and $result2 -eq $null) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.7.1.3"
    Task = "Ensure all AppArmor Profiles are in enforce or complain mode"
    Test = {
        $profileMode1 = apparmor_status | grep profiles | sed '1!d' | cut -d ' ' -f 1
        $profileMode2 = apparmor_status | grep profiles | sed '2!d' | cut -d ' ' -f 1
        $profileMode3 = apparmor_status | grep profiles | sed '3!d' | cut -d ' ' -f 1
        $result = expr $profileMode3 + $profileMode2
        $unconfinedProcesses = apparmor_status | grep processes | sed '4!d' | cut -d ' ' -f 1
        if ($result -eq $profileMode1 -and $unconfinedProcesses -eq 0) {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.7.1.4"
    Task = "Ensure all AppArmor Profiles are enforcing"
    Test = {
        $profileMode1 = apparmor_status | grep profiles | sed '1!d' | cut -d ' ' -f 1
        $profileMode2 = apparmor_status | grep profiles | sed '2!d' | cut -d ' ' -f 1
        
        $unconfinedProcesses = apparmor_status | grep processes | sed '4!d' | cut -d ' ' -f 1

        if($profileMode1 -eq $profileMode2 -and $unconfinedProcesses -eq 0){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.8.1.1"
    Task = "Ensure message of the day is configured properly"
    Test = {
        $result = grep -E -i "(\\\v|\\\r|\\\m|\\\s|$(grep '^ID=' /etc/os-release | cut -d= -f2 | sed -e 's/"//g'))" /etc/motd 2>/dev/null
        if($result -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.8.1.2"
    Task = "Ensure local login warning is configured peoperly"
    Test = {
        $result = grep -E -i "(\\\v|\\\r|\\\m|\\\s|$(grep '^ID=' /etc/os-release | cut -d= -f2 | sed -e 's/"//g'))" /etc/issue
        if($result -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.8.1.3"
    Task = "Ensure remote login warning banner is configured properly"
    Test = {
        $script = $scriptPath + "CIS-SEL15-1.8.1.3.sh"
        $result = bash $script
        if($result -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.8.1.4"
    Task = "Ensure permissions on /etc/motd are configured"
    Test = {
        $result = stat -L /etc/motd | grep "0644"
        if($result -eq $null -or $result -match "0644"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.8.1.5"
    Task = "Ensure permissions on /etc/issue are configured"
    Test = {
        $result = stat -L /etc/issue | grep "0644"
        if($result -ne $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

if (Test-Path -Path '/etc/issue.net') {
[AuditTest] @{
    Id = "1.8.1.6"
    Task = "Ensure permissions on /etc/issue.net are configured"
    Test = {
        $result = stat -L /etc/issue.net | grep "0644"
        if($result -ne $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}
}

[AuditTest] @{
    Id = "1.9"
    Task = "Ensure updates, patches, and additional security software are installed"
    Test = {
        $output = zypper list-updates
        $output = $?
        if($output -match "True"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "1.10"
    Task = "Ensure GDM is removed or login is configured"
    Test = {
        $result = rpm -q gdm
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

### Chapter 2 - Services

[AuditTest] @{
    Id = "2.1.1"
    Task = "Ensure xinetd is not installed"
    Test = {
        $result = rpm -q xinetd
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.1.1"
    Task = "Ensure time synchronization is in use"
    Test = {
        $result = rpm -q chrony
        if($result -match "chrony-"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.1.2"
    Task = "Ensure systemd-timesyncd is configured"
    Test = {
        $result = systemctl is-enabled systemd-timesyncd.service
        if($result -match "enabled"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.1.3"
    Task = "Ensure chrony is configured"
    Test = {
        $result1 = grep -E "^(server|pool)" /etc/chrony.conf
        $result2 = grep ^OPTIONS /etc/sysconfig/chronyd
        if($result1 -match "server " -and $result2 -match "-u chrony") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.2"
    Task = "Ensure X11 Server components are not installed"
    Test = {
        $result = rpm -qa xorg-x11-server*
        if($result -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.4"
    Task = "Ensure CUPS is not installed"
    Test = {
        $result = rpm -q cups
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.5"
    Task = "Ensure DHCP Server is not installed"
    Test = {
        $result = rpm -q dhcp
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.6"
    Task = "Ensure LDAP server is not installed"
    Test = {
        $result = rpm -q openldap2
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.7"
    Task = "Ensure nfs-utils is not installed or the nfs-server service is masked"
    Test = {
        $result1 = rpm -q nfs-utils
        $result2 = rpm -q nfs-kernel-server
        if($result1 -match "not installed" -and $result2 -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.8"
    Task = "Ensure rpcbind is not installed or the rpcbind services are masked"
    Test = {
        $result = rpm -q rpcbind
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.9"
    Task = "Ensure DNS Server is not installed"
    Test = {
        $result = rpm -q bind
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.10"
    Task = "Ensure FTP Server is not installed"
    Test = {
        $result = rpm -q vsftpd
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.11"
    Task = "Ensure HTTP Server is not installed"
    Test = {
        $result = rpm -q apache2
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.12"
    Task = "Ensure HTTP Server is not installed"
    Test = {
        $result = rpm -q dovecot
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.13"
    Task = "Ensure Samba is not installed"
    Test = {
        $result = rpm -q samba
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.14"
    Task = "Ensure HTTP Proxy Server is not installed"
    Test = {
        $result = rpm -q squid
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.15"
    Task = "Ensure net-snmp is not installed"
    Test = {
        $result = rpm -q net-snmp
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.16"
    Task = "Ensure mail transfer agent is configured for local-only mode"
    Test = {
        $result = ss -lntu | grep -E ':25\s' | grep -E -v '\s(127.0.0.1|\[?::1\]?):25\s'
        if($result -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.17"
    Task = "Ensure rsync is not installed or the rsyncd service is masked"
    Test = {
        $result = rpm -q rsync
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.18"
    Task = "Ensure NIS server is not installed"
    Test = {
        $result = rpm -q ypserv
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.2.19"
    Task = "Ensure telnet-server is not installed"
    Test = {
        $result = rpm -q telnet-server
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.3.1"
    Task = "Ensure NIS Client is not installed"
    Test = {
        $result = rpm -q ypbind
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.3.2"
    Task = "Ensure rsh client is not installed"
    Test = {
        $result = rpm -q rsh
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.3.3"
    Task = "Ensure talk client is not installed"
    Test = {
        $result = rpm -q talk
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.3.4"
    Task = "Ensure telnet client is not installed"
    Test = {
        $result = rpm -q telnet
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.3.5"
    Task = "Ensure LDAP client is not installed"
    Test = {
        $result = rpm -q openldap2-clients
        if($result -match "not installed"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "2.4"
    Task = "Ensure nonessential services are removed or masked"
    Test = {
        return $retNonCompliantManualReviewRequired
    }
}

## Chapter 3 - Network Configuration

# sysctl wird ignoriert
[AuditTest] @{
    Id = "3.1.1"
    Task = "Disable IPv6"
    Test = {
        if ($IPv6Status -match "disable") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.1.2"
    Task = "Ensure wireless interfaces are disabled"
    Test = {
        $result = ip link show up
        if($result -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.2.1"
    Task = "Ensure IP forwarding is disabled"
    Test = {
        if ($IPv6Status -match "disable") {
            $result1 = sysctl net.ipv4.ip_forward
            $result2 = grep -E -s "^\s*net\.ipv4\.ip_forward\s*=\s*1" /etc/sysctl.conf /etc/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /run/sysctl.d/*.conf
            if($result1 -match "net.ipv4.ip_forward = 0" -and $result2 -eq $null){
                return $retCompliant
            } else {
                return $retNonCompliant
            }
        } else {
            $result1 = sysctl net.ipv4.ip_forward
            $result2 = grep -E -s "^\s*net\.ipv4\.ip_forward\s*=\s*1" /etc/sysctl.conf /etc/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /run/sysctl.d/*.conf
            $result3 = sysctl net.ipv6.conf.all.forwarding
            $result4 = grep -E -s "^\s*net\.ipv6\.conf\.all\.forwarding\s*=\s*1" /etc/sysctl.conf /etc/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /run/sysctl.d/*.conf
            if($result1 -match "net.ipv4.ip_forward = 0" -and $result2 -eq $null -and $result3 -match "net.ipv6.conf.all.forwarding = 0" -and $result4 -eq $null){
                return $retCompliant
            } else {
                return $retNonCompliant
            }
        }
        
    }
}

[AuditTest] @{
    Id = "3.2.2"
    Task = "Ensure packet redirect sending is disabled"
    Test = {
        $result1 = sysctl net.ipv4.conf.all.send_redirects
        $result2 = sysctl net.ipv4.conf.default.send_redirects
        $result3 = grep "net\.ipv4\.conf\.all\.send_redirects" /etc/sysctl.conf /etc/sysctl.d/*
        $result4 = grep "net\.ipv4\.conf\.default\.send_redirects" /etc/sysctl.conf /etc/sysctl.d/*
        if($result1 -match "net.ipv4.conf.all.send_redirects = 0" -and $result2 -match "net.ipv4.conf.default.send_redirects = 0" -and $result3 -match "net.ipv4.conf.all.send_redirects = 0" -and $result4 -match "net.ipv4.conf.default.send_redirects= 0"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.3.1"
    Task = "Ensure source routed packets are not accepted"
    Test = {
        if ($IPv6Status -match "disable") {
            $result1 = sysctl net.ipv4.conf.all.accept_source_route
            $result2 = sysctl net.ipv4.conf.default.accept_source_route
            $result3 = grep "net\.ipv4\.conf\.all\.accept_source_route" /etc/sysctl.conf /etc/sysctl.d/*
            $result4 = grep "net\.ipv4\.conf\.default\.accept_source_route" /etc/sysctl.conf /etc/sysctl.d/*
            if($result1 -match "net.ipv4.conf.all.accept_source_route = 0" -and $result2 -match "net.ipv4.conf.default.accept_source_route = 0" -and $result3 -match "net.ipv4.conf.all.accept_source_route= 0" -and $result4 -match "net.ipv4.conf.default.accept_source_route= 0"){
                return $retCompliant
            } else {
                return $retNonCompliant
            }
        } else {
            $result1 = sysctl net.ipv4.conf.all.accept_source_route
            $result2 = sysctl net.ipv4.conf.default.accept_source_route
            $result3 = grep "net\.ipv4\.conf\.all\.accept_source_route" /etc/sysctl.conf /etc/sysctl.d/*
            $result4 = grep "net\.ipv4\.conf\.default\.accept_source_route" /etc/sysctl.conf /etc/sysctl.d/*
            $result5 = sysctl net.ipv6.conf.all.accept_source_route
            $result6 = sysctl net.ipv6.conf.default.accept_source_route
            $result7 = grep "net\.ipv6\.conf\.all\.accept_source_route" /etc/sysctl.conf /etc/sysctl.d/*
            $result8 = grep "net\.ipv6\.conf\.default\.accept_source_route" /etc/sysctl.conf /etc/sysctl.d/*
            if($result1 -match "net.ipv4.conf.all.accept_source_route = 0" -and $result2 -match "net.ipv4.conf.default.accept_source_route = 0" -and $result3 -match "net.ipv4.conf.all.accept_source_route= 0" -and $result4 -match "net.ipv4.conf.default.accept_source_route= 0" -and $result5 -match "net.ipv6.conf.all.accept_source_route = 0" -and $result6 -match "net.ipv6.conf.default.accept_source_route = 0" -and $result7 -match "net.ipv4.conf.all.accept_source_route= 0" -and $result8 -match "net.ipv6.conf.default.accept_source_route= 0"){
                return $retCompliant
            } else {
                return $retNonCompliant
            }
        }
    }
}

[AuditTest] @{
    Id = "3.3.2"
    Task = "Ensure ICMP redirects are not accepted"
    Test = {
        $result1 = sysctl net.ipv4.conf.all.accept_redirects
        $result2 = sysctl net.ipv4.conf.default.accept_redirects
        $result3 = grep "net\.ipv4\.conf\.all\.accept_redirects" /etc/sysctl.conf /etc/sysctl.d/*
        $result4 = grep "net\.ipv4\.conf\.default\.accept_redirects" /etc/sysctl.conf /etc/sysctl.d/*
        if($result1 -match "net.ipv4.conf.all.accept_redirects = 0" -and $result2 -match "net.ipv4.conf.default.accept_redirects = 0" -and $result3 -match "net.ipv4.conf.all.accept_redirects= 0" -and $result4 -match "net.ipv4.conf.default.accept_redirects= 0"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.3.3"
    Task = "Ensure secure ICMP redirects are not accepted"
    Test = {
        $result1 = sysctl net.ipv4.conf.all.secure_redirects
        $result2 = sysctl net.ipv4.conf.default.accept_redirects
        $result3 = grep "net\.ipv4\.conf\.all\.accept_redirects" /etc/sysctl.conf /etc/sysctl.d/*
        $result4 = grep "net\.ipv4\.conf\.default\.accept_redirects" /etc/sysctl.conf /etc/sysctl.d/*
        if($result1 -match "net.ipv4.conf.all.accept_redirects = 0" -and $result2 -match "net.ipv4.conf.default.accept_redirects = 0" -and $result3 -match "net.ipv4.conf.all.accept_redirects= 0" -and $result4 -match "net.ipv4.conf.default.accept_redirects= 0"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.3.4"
    Task = "Ensure suspicious packets are logged"
    Test = {
        $result1 = sysctl net.ipv4.conf.all.log_martians
        $result2 = sysctl net.ipv4.conf.default.log_martians
        $result3 = grep "net\.ipv4\.conf\.all\.log_martians" /etc/sysctl.conf /etc/sysctl.d/*
        $result4 = grep "net\.ipv4\.conf\.default\.log_martians" /etc/sysctl.conf /etc/sysctl.d/*
        if($result1 -match "net.ipv4.conf.all.log_martians = 1" -and $result2 -match "net.ipv4.conf.default.log_martians = 1" -and $result3 -match "net.ipv4.conf.all.log_martians = 1" -and $result4 -match "net.ipv4.conf.default.log_martians = 1"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.3.5"
    Task = "Ensure broadcast ICMP requests are ignored"
    Test = {
        $result1 = sysctl net.ipv4.icmp_echo_ignore_broadcasts
        $result2 = grep "net\.ipv4\.icmp_echo_ignore_broadcasts" /etc/sysctl.conf /etc/sysctl.d/*
        if($result1 -match "net.ipv4.icmp_echo_ignore_broadcasts = 1" -and $result2 -match "net.ipv4.icmp_echo_ignore_broadcasts = 1"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.3.6"
    Task = "Ensure bogus ICMP responses are ignored"
    Test = {
        $result1 = sysctl net.ipv4.icmp_ignore_bogus_error_responses
        $result2 = grep "net.ipv4.icmp_ignore_bogus_error_responses" /etc/sysctl.conf /etc/sysctl.d/*
        if($result1 -match "net.ipv4.icmp_ignore_bogus_error_responses = 1" -and $result2 -match "net.ipv4.icmp_ignore_bogus_error_responses = 1"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.3.7"
    Task = "Ensure Reverse Path Filtering is enabled"
    Test = {
        $result1 = sysctl net.ipv4.conf.all.rp_filter
        $result2 = sysctl net.ipv4.conf.default.rp_filter
        $result3 = grep "net\.ipv4\.conf\.all\.rp_filter" /etc/sysctl.conf /etc/sysctl.d/*
        $result4 = grep "net\.ipv4\.conf\.default\.rp_filter" /etc/sysctl.conf /etc/sysctl.d/*
        if($result1 -match "net.ipv4.conf.all.rp_filter = 1" -and $result2 -match "net.ipv4.conf.default.rp_filter = 1" -and $result3 -match "net.ipv4.conf.all.rp_filter = 1" -and $result4 -match "net.ipv4.conf.default.rp_filter = 1"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.3.8"
    Task = "Ensure TCP SYN Cookies is enabled"
    Test = {
        $result1 = sysctl net.ipv4.tcp_syncookies
        $result2 = grep "net\.ipv4\.tcp_syncookies" /etc/sysctl.conf /etc/sysctl.d/*
        if($result1 -match "net.ipv4.tcp_syncookies = 1" -and $result2 -match "net.ipv4.tcp_syncookies = 1"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.3.9"
    Task = "Ensure IPv6 router advertisements are not accepted"
    Test = {
        if ($IPv6Status -match "disabled") {
            return $retCompliantIPv6Disabled
        }
        $result1 = sysctl net.ipv6.conf.all.accept_ra
        $result2 = sysctl net.ipv6.conf.default.accept_ra
        $result3 = grep "net\.ipv6\.conf\.all\.accept_ra" /etc/sysctl.conf /etc/sysctl.d/*
        $result4 = grep "net\.ipv6\.conf\.default\.accept_ra" /etc/sysctl.conf /etc/sysctl.d/*
        if($result1 -match "net.ipv6.conf.all.accept_ra = 0" -and $result2 -match "net.ipv6.conf.default.accept_ra = 0" -and $result3 -match "net.ipv6.conf.all.accept_ra = 0" -and $result4 -match "net.ipv6.conf.default.accept_ra = 0"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.4.1"
    Task = "Ensure TCP SYN Cookies is enabled"
    Test = {
        $result1 = modprobe -n -v dccp
        $result2 = lsmod | grep dccp
        if($result1 -match "install /bin/true" -and $result2 -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.4.2"
    Task = "Ensure SCTP is disabled"
    Test = {
        $result1 = modprobe -n -v sctp
        $result2 = lsmod | grep sctp
        if($result1 -match "install /bin/true" -and $result2 -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

### Chapter 3.5.1.X firewalld
if( ($FirewallStatus -eq 0) -or ($FirewallStatus -eq 1) ){
[AuditTest] @{
    Id = "3.5.1.1"
    Task = "Ensure FirewallD is installed"
    Test = {
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        if ($FirewallStatus -match 3) {
            return $retUsingFW3
        }
        $result = rpm -q firewalld iptables
        if($result -match "firewalld-" -and $result -match "iptables-"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.1.2"
    Task = "Ensure nftables is not installed or stopped and masked"
    Test = {
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        if ($FirewallStatus -match 3) {
            return $retUsingFW3
        }
        $result1 = rpm -q nftables
        $result21 = systemctl status nftables | grep "active (running)"
        $result22 = systemctl is-enabled nftables
        if($result1 -match "not installed" -or (!($result21 -match "active (running)") -and !($result22 -match "enabled"))){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.1.3"
    Task = "Ensure firewalld service is enabled and running"
    Test = {
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        if ($FirewallStatus -match 3) {
            return $retUsingFW3
        }
        $result1 = systemctl is-enabled firewalld
        $result2 = firewall-cmd --state
        if($result1 -match "enabled" -and $result2 -match "running"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.1.4"
    Task = "Ensure default zone is set"
    Test = {
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        if ($FirewallStatus -match 3) {
            return $retUsingFW3
        }
        $result = firewall-cmd --get-default-zone
        if($result -ne $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.1.5"
    Task = "Ensure network interfaces are assigned to appropriate zone"
    Test = {
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        if ($FirewallStatus -match 3) {
            return $retUsingFW3
        }
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "3.5.1.6"
    Task = "Ensure unnecessary services and ports are not accepted"
    Test = {
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        if ($FirewallStatus -match 3) {
            return $retUsingFW3
        }
        return $retNonCompliantManualReviewRequired
    }
}
}

### Chapter 3.5.2.X nftables
if( ($FirewallStatus -eq 0) -or ($FirewallStatus -eq 2) ){
[AuditTest] @{
    Id = "3.5.2.1"
    Task = "Ensure nftables is installed"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 3) {
            return $retUsingFW3
        }
        $result = rpm -q nftables
        if($result -match "nftables-"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.2.2"
    Task = "Ensure firewalld is not installed or stopped and masked"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 3) {
            return $retUsingFW3
        }
        $result1 = rpm -q firewalld
        $result21 = systemctl status firewalld | grep "Active: " | grep -v "active (running) "
        $result22 = systemctl is-enabled firewalld
        if($result1 -match "not installed" -or ($result21 -eq $null -and $result22 -match "masked")){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.2.3"
    Task = "Ensure iptables are flushed"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 3) {
            return $retUsingFW3
        }
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "3.5.2.4"
    Task = "Ensure a table exists"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 3) {
            return $retUsingFW3
        }
        $result = nft list tables
        if($result -match "table inet filter") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.2.5"
    Task = "Ensure base chain exist"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 3) {
            return $retUsingFW3
        }
        $result1 = nft list ruleset | grep 'hook input'
        $result2 = nft list ruleset | grep 'hook forward'
        $result3 = nft list ruleset | grep 'hook output'
        if($result1 -match "type filter hook input priority 0;" -and $result2 -match "type filter hook forward priority 0;" -and $result3 -match "type filter hook output priority 0;") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.2.6"
    Task = "Ensure loopback traffic is configured"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 3) {
            return $retUsingFW3
        }
        $result1 = nft list ruleset | awk '/hook input/,/}/' | grep 'iif "lo" accept'
        $result2 = nft list ruleset | awk '/hook input/,/}/' | grep 'ip saddr'
        if($result1 -match "iif ""lo"" accept" -and $result2 -match "ip saddr 127.0.0.0/8 counter packets 0 bytes 0 drop") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.2.7"
    Task = "Ensure outbound and established connections are configured"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 3) {
            return $retUsingFW3
        }
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "3.5.2.8"
    Task = "Ensure default deny firewall policy"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 3) {
            return $retUsingFW3
        }
        $result1 = nft list ruleset | grep 'hook input'
        $result2 = nft list ruleset | grep 'hook forward'
        $result3 = nft list ruleset | grep 'hook output'
        if($result1 -match "type filter hook input priority 0; policy drop;" -and $result2 -match "type filter hook forward priority 0; policy drop;" -and $result3 -match "type filter hook output priority 0; policy drop;") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.2.9"
    Task = "Ensure nftables service is enabled"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 3) {
            return $retUsingFW3
        }
        $result = systemctl is-enabled nftables
        if($result -match "enabled") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.2.10"
    Task = "Ensure nftables rules are permanent"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 3) {
            return $retUsingFW3
        }
        $retNonCompliantManualReviewRequired
    }
}
}

### Chapter 3.5.3.X iptables
if( ($FirewallStatus -eq 0) -or ($FirewallStatus -eq 3) ){
[AuditTest] @{
    Id = "3.5.3.1.1"
    Task = "Ensure iptables package is installed"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        $result = rpm -q iptables
        if($result -match "iptables-") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.3.1.2"
    Task = "Ensure nftables is not installed"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        $result = rpm -q nftables
        if($result -match "not installed") {
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.3.1.3"
    Task = "Ensure firewalld is not installed or stopped and masked"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        $result1 = rpm -q firewalld
        $result21 = systemctl status firewalld | grep "Active: " | grep -v "active (running) "
        $result22 = systemctl is-enabled firewalld
        if($result1 -match "not installed" -or ($result21 -eq $null -and $result22 -match "masked")){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.3.2.1"
    Task = "Ensure default deny firewall policy"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        $output = iptables -L
        $test11 = $output -match "DROP" | grep "Chain INPUT (policy DROP)"
        $result11 = $?
        $test12 = $output -match "REJECT" | grep "Chain INPUT (policy REJECT)"
        $result12 = $?
        $test21 = $output -match "DROP" | grep "Chain FORWARD (policy DROP)"
        $result21 = $?
        $test22 = $output -match "REJECT" | grep "Chain FORWARD (policy REJECT)"
        $result22 = $?
        $test31 = $output -match "DROP" | grep "Chain OUTPUT (policy DROP)"
        $result31 = $?
        $test32 = $output -match "REJECT" | grep "Chain OUTPUT (policy REJECT)"
        $result32 = $?
        if(($result11 -match "True" -or $result12 -match "True") -and ($result21 -match "True" -or $result22 -match "True") -and ($result31 -match "True" -or $result32 -match "True")){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.3.2.2"
    Task = "Ensure iptables loopback traffic is configured"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        $test1 = iptables -L INPUT -v -n | grep "Chain\s*INPUT\s*(policy\s*DROP"
        $test2 = iptables -L OUTPUT -v -n | grep "Chain\s*OUTPUT\s*(policy\s*DROP"
        if($test1 -ne $null -and $test2 -ne $null){
            return $retCompliant
        }
        return $retNonCompliant
    }
}

[AuditTest] @{
    Id = "3.5.3.2.3"
    Task = "Ensure outbound and established connections are configured"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "3.5.3.2.4"
    Task = "Ensure firewall rules exist for all open ports"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "3.5.3.3.1"
    Task = "Ensure IPv6 default deny firewall policy"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        if ($IPv6Status -match "disabled") {
            return $retCompliantIPv6Disabled
        }
        $output = ip6tables -L
        $test11 = $output -match "DROP" | grep "Chain INPUT (policy DROP)"
        $result11 = $?
        $test12 = $output -match "REJECT" | grep "Chain INPUT (policy REJECT)"
        $result12 = $?
        $test21 = $output -match "DROP" | grep "Chain FORWARD (policy DROP)"
        $result21 = $?
        $test22 = $output -match "REJECT" | grep "Chain FORWARD (policy REJECT)"
        $result22 = $?
        $test31 = $output -match "DROP" | grep "Chain OUTPUT (policy DROP)"
        $result31 = $?
        $test32 = $output -match "REJECT" | grep "Chain OUTPUT (policy REJECT)"
        $result32 = $?
        if(($result11 -match "True" -or $result12 -match "True") -and ($result21 -match "True" -or $result22 -match "True") -and ($result31 -match "True" -or $result32 -match "True")){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.3.3.2"
    Task = "Ensure IPv6 loopback traffic is configured"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        if ($IPv6Status -match "disabled") {
            return $retCompliantIPv6Disabled
        }
        $output1 = ip6tables -L INPUT -v -n
        $test1 = $output1 | grep "ACCEPT\s*all\s*lo\s**\s*::/0\s*::/0"
        $test2 = $output1 | grep "DROP\s*all\s**\s**\s*::1\s*::/0"
        $output2 = ip6tables -L OUTPUT -v -n
        $test3 = $output2 | grep "ACCEPT\s*all\s*lo\s**\s*::/0\s*::/0"
        if($test1 -ne $null -and $test2 -ne $null -and $test3 -ne $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "3.5.3.3.3"
    Task = "Ensure IPv6 outbound and established connections are configured"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        if ($IPv6Status -match "disabled") {
            return $retCompliantIPv6Disabled
        }
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "3.5.3.3.4"
    Task = "Ensure IPv6 firewall rules exist for all open ports"
    Test = {
        if ($FirewallStatus -match 1) {
            return $retUsingFW1
        }
        if ($FirewallStatus -match 2) {
            return $retUsingFW2
        }
        if ($IPv6Status -match "disabled") {
            return $retCompliantIPv6Disabled
        }
        return $retNonCompliantManualReviewRequired
    }
}
}

## Chapter 4 Logging and Auditing

[AuditTest] @{
    Id = "4.1.1.1"
    Task = "Ensure auditd is installed"
    Test = {
        $test = rpm -q audit
        if($test -match "audit-"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.1.2"
    Task = "Ensure auditd service is enabled and running"
    Test = {
        $test1 = systemctl is-enabled auditd
        $test2 = systemctl status auditd | grep 'Active: active (running) '
        if($test1 -match "enabled" -and $test2 -ne $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.1.3"
    Task = "Ensure auditing for processes that start prior to auditd is enabled"
    Test = {
        $test = grep "^\s*linux" /boot/grub2/grub.cfg | grep -v "audit=1"
        if($test -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.2.1"
    Task = "Ensure audit log storage size is configured"
    Test = {
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "4.1.2.2"
    Task = "Ensure audit logs are not automatically deleted"
    Test = {
        $test = grep max_log_file_action /etc/audit/auditd.conf
        if($test -match "max_log_file_action = keep_logs"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.2.3"
    Task = "Ensure system is disabled when audit logs are full"
    Test = {
        $test1 = grep space_left_action /etc/audit/auditd.conf
        $test2 = grep action_mail_acct /etc/audit/auditd.conf
        $test3 = grep admin_space_left_action /etc/audit/auditd.conf
        if($test1 -match "space_left_action = email" -and $test2 -match "action_mail_acct = root" -and $test3 -match "admin_space_left_action = halt"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.2.4"
    Task = "Ensure system is disabled when audit logs are full"
    Test = {
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "4.1.3"
    Task = "Ensure system is disabled when audit logs are full"
    Test = {
        $test1 = grep time-change /etc/audit/rules.d/*.rules
        $test2 = auditctl -l | grep time-change
        if($test1 -match "/etc/audit/rules.d/time_change.rules:-a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time-change" -and
        $test1 -match "/etc/audit/rules.d/time_change.rules:-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time-change" -and
        $test1 -match "/etc/audit/rules.d/time_change.rules:-a always,exit -F arch=b64 -S clock_settime -k time-change" -and
        $test1 -match "/etc/audit/rules.d/time_change.rules:-a always,exit -F arch=b32 -S clock_settime -k time-change" -and
        $test1 -match "/etc/audit/rules.d/time_change.rules:-w /etc/localtime -p wa -k time-change" -and
        $test2 -match "-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=time-change" -and
        $test2 -match "-a always,exit -F arch=b32 -S stime,settimeofday,adjtimex -F key=time-change" -and
        $test2 -match "-a always,exit -F arch=b64 -S clock_settime -F key=time-change" -and
        $test2 -match "-a always,exit -F arch=b32 -S clock_settime -F key=time-change" -and
        $test2 -match "-w /etc/localtime -p wa -k time-change"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.4"
    Task = "Ensure events that modify user/group information are collected"
    Test = {
        $test1 = grep identity /etc/audit/rules.d/*.rules
        $test2 = auditctl -l | grep identity
        if($test1 -match "/etc/audit/rules.d/identity.rules:-w /etc/group -p wa -k identity" -and
        $test1 -match "/etc/audit/rules.d/identity.rules:-w /etc/passwd -p wa -k identity" -and
        $test1 -match "/etc/audit/rules.d/identity.rules:-w /etc/shadow -p wa -k identity" -and
        $test1 -match "/etc/audit/rules.d/identity.rules:-w /etc/security/opasswd -p wa -k identity" -and
        $test2 -match "-w /etc/group -p wa -k identity" -and
        $test2 -match "-w /etc/passwd -p wa -k identity" -and
        $test2 -match "-w /etc/shadow -p wa -k identity" -and
        $test2 -match "-w /etc/security/opasswd -p wa -k identity"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.5"
    Task = "Ensure events that modify the system's network environment are collected"
    Test = {
        $test1 = grep system-locale /etc/audit/rules.d/*.rules
        $test2 = auditctl -l | grep system-locale
        if($test1 -match "/etc/audit/rules.d/system-locale.rules:-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale" -and
        $test1 -match "/etc/audit/rules.d/system-locale.rules:-a always,exit -F arch=b32 -S sethostname -S setdomainname -k system-locale" -and
        $test1 -match "/etc/audit/rules.d/system-locale.rules:-w /etc/issue -p wa -k system-locale" -and
        $test1 -match "/etc/audit/rules.d/system-locale.rules:-w /etc/issue.net -p wa -k system-locale" -and
        $test1 -match "/etc/audit/rules.d/system-locale.rules:-w /etc/hosts -p wa -k system-locale" -and
        $test1 -match "/etc/audit/rules.d/system-locale.rules:-w /etc/sysconfig/network -p wa -k system-locale" -and
        $test2 -match "-a always,exit -F arch=b64 -S sethostname,setdomainname -F key=system-locale" -and
        $test2 -match "-a always,exit -F arch=b32 -S sethostname,setdomainname -F key=system-locale" -and
        $test2 -match "-w /etc/issue -p wa -k system-locale" -and
        $test2 -match "-w /etc/issue.net -p wa -k system-locale" -and
        $test2 -match "-w /etc/hosts -p wa -k system-locale" -and
        $test2 -match "-w /etc/sysconfig/network -p wa -k system-locale"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.6"
    Task = "Ensure events that modify the system's Mandatory Access Controls are collected"
    Test = {
        $test1 = grep MAC-policy /etc/audit/rules.d/*.rules
        $test2 = auditctl -l | grep MAC-policy
        if($test1 -match "/etc/audit/rules.d/MAC_policy.rules:-w /etc/selinux/ -p wa -k MAC-policy" -and $test1 -match "/etc/audit/rules.d/MAC_policy.rules:-w /usr/share/selinux/ -p wa -k MAC-policy" -and $test2 -match "-w /etc/selinux/ -p wa -k MAC-policy" -and $test2 -match "-w /usr/share/selinux/ -p wa -k MAC-policy"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.7"
    Task = "Ensure login and logout events are collected"
    Test = {
        $test1 = grep logins /etc/audit/rules.d/*.rules
        $test2 = auditctl -l | grep logins
        if($test1 -match "/etc/audit/rules.d/logins.rules:-w /var/log/faillog -p wa -k logins" -and
        $test1 -match "/etc/audit/rules.d/logins.rules:-w /var/log/lastlog -p wa -k logins" -and
        $test1 -match "/etc/audit/rules.d/logins.rules:-w /var/log/tallylog -p wa -k logins" -and
        $test2 -match "-w /var/log/faillog -p wa -k logins" -and
        $test2 -match "-w /var/log/lastlog -p wa -k logins" -and
        $test2 -match "-w /var/log/tallylog -p wa -k logins"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.8"
    Task = "Ensure session initiation information is collected"
    Test = {
        $test1 = grep -E '(session|logins)' /etc/audit/rules.d/*.rules
        $test2 = auditctl -l | grep -E '(session|logins)'
        if($test1 -match "/etc/audit/rules.d/session.rules:-w /var/run/utmp -p wa -k session" -and
        $test1 -match "/etc/audit/rules.d/session.rules:-w /var/log/wtmp -p wa -k logins" -and
        $test1 -match "/etc/audit/rules.d/session.rules:-w /var/log/btmp -p wa -k logins" -and
        $test2 -match "-w /var/run/utmp -p wa -k session" -and
        $test2 -match "-w /var/log/wtmp -p wa -k logins" -and
        $test2 -match "-w /var/log/btmp -p wa -k logins"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.9"
    Task = "Ensure discretionary access control permission modification events are collected"
    Test = {
        $test1 = grep perm_mod /etc/audit/rules.d/*.rules
        $test2 = auditctl -l | grep perm_mod
        if($test1 -match "/etc/audit/rules.d/perm_mod.rules:-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod" -and
        $test1 -match "/etc/audit/rules.d/perm_mod.rules:-a always,exit -F arch=b32 -S chmod -S fchmod -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod" -and
        $test1 -match "/etc/audit/rules.d/perm_mod.rules:-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod" -and
        $test1 -match "/etc/audit/rules.d/perm_mod.rules:-a always,exit -F arch=b32 -S chown -S fchown -S fchownat -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod" -and
        $test1 -match "/etc/audit/rules.d/perm_mod.rules:-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod" -and
        $test1 -match "/etc/audit/rules.d/perm_mod.rules:-a always,exit -F arch=b32 -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod" -and
        $test2 -match "-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=-1 -F key=perm_mod" -and
        $test2 -match "-a always,exit -F arch=b32 -S chmod,fchmod,fchmodat -F auid>=1000 -F auid!=-1 -F key=perm_mod" -and
        $test2 -match "-a always,exit -F arch=b64 -S chown,fchown,lchown,fchownat -F auid>=1000 -F auid!=-1 -F key=perm_mod" -and
        $test2 -match "-a always,exit -F arch=b32 -S lchown,fchown,chown,fchownat -F auid>=1000 -F auid!=-1 -F key=perm_mod" -and
        $test2 -match "-a always,exit -F arch=b64 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=-1 -F key=perm_mod" -and
        $test2 -match "-a always,exit -F arch=b32 -S setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr -F auid>=1000 -F auid!=-1 -F key=perm_mod"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.10"
    Task = "Ensure discretionary access control permission modification events are collected"
    Test = {
        $test1 = grep access /etc/audit/rules.d/*.rules
        $test2 = auditctl -l | grep access
        if($test1 -match "/etc/audit/rules.d/access.rules:-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access" -and
        $test1 -match "/etc/audit/rules.d/access.rules:-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access" -and
        $test1 -match "/etc/audit/rules.d/access.rules:-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access" -and
        $test1 -match "/etc/audit/rules.d/access.rules:-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access" -and
        $test2 -match "/etc/audit/rules.d/access.rules:-a always,exit -F arch=b32 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access" -and
        $test2 -match "-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat -F exit=-EACCES -F auid>=1000 -F auid!=-1 -F key=access" -and
        $test2 -match "-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat -F exit=-EPERM -F auid>=1000 -F auid!=-1 -F key=access" -and
        $test2 -match "-a always,exit -F arch=b32 -S open,creat,truncate,ftruncate,openat -F exit=-EPERM -F auid>=1000 -F auid!=-1 -F key=access"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.11"
    Task = "Ensure use of privileged commands is collected"
    Test = {
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "4.1.12"
    Task = "Ensure successful file system mounts are collected"
    Test = {
        $test1 = grep mounts /etc/audit/rules.d/*.rules
        $test2 = auditctl -l | grep mounts
        if($test1 -match "/etc/audit/rules.d/mounts.rules:-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts" -and
        $test1 -match "/etc/audit/rules.d/mounts.rules:-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts" -and
        $test2 -match "-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=-1 -F key=mounts" -and
        $test2 -match "-a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=-1 -F key=mounts"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.13"
    Task = "Ensure file deletion events by users are collected"
    Test = {
        $test1 = grep delete /etc/audit/rules.d/*.rules
        $test2 = auditctl -l | grep delete
        if($test1 -match "/etc/audit/rules.d/deletion.rules:-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete" -and
        $test1 -match "/etc/audit/rules.d/deletion.rules:-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=4294967295 -k delete" -and
        $test2 -match "-a always,exit -F arch=b64 -S rename,unlink,unlinkat,renameat -F auid>=1000 -F auid!=-1 -F key=delete" -and
        $test2 -match "-a always,exit -F arch=b32 -S unlink,rename,unlinkat,renameat -F auid>=1000 -F auid!=-1 -F key=delete"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.14"
    Task = "Ensure changes to system administration scope (sudoers) is collected"
    Test = {
        $test1 = grep scope /etc/audit/rules.d/*.rules
        $test2 = auditctl -l | grep scope
        if($test1 -match "/etc/audit/rules.d/scope.rules:-w /etc/sudoers -p wa -k scope" -and
        $test1 -match "/etc/audit/rules.d/scope.rules:-w /etc/sudoers.d/ -p wa -k scope" -and
        $test2 -match "-w /etc/sudoers -p wa -k scope" -and
        $test2 -match "-w /etc/sudoers.d -p wa -k scope"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.15"
    Task = "Ensure system administrator actions (sudolog) are collected"
    Test = {
        $test1 = grep -E "^\s*-w\s+$(grep -r logfile /etc/sudoers* | sed -e 's/.*logfile=//;s/,? .*//')\s+-p\s+wa\s+-k\s+actions" /etc/audit/rules.d/*.rules
        $test2 = auditctl -l | grep actions
        $test3 = echo "-w $(grep -r logfile /etc/sudoers* | sed -e 's/.*logfile=//;s/,? .*//') -p wa -k actions"
        if($test1 -match $test3 -and $test2 -match $test3){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.16"
    Task = "Ensure kernel module loading and unloading is collected"
    Test = {
        $test1 = grep modules /etc/audit/rules.d/*.rules
        $test2 = auditctl -l | grep modules
        if($test1 -match "/etc/audit/rules.d/modules.rules:-w /sbin/insmod -p x -k modules" -and
        $test1 -match "/etc/audit/rules.d/modules.rules:-w /sbin/rmmod -p x -k modules" -and
        $test1 -match "/etc/audit/rules.d/modules.rules:-w /sbin/modprobe -p x -k modules" -and
        $test1 -match "/etc/audit/rules.d/modules.rules:-a always,exit -F arch=b64 -S init_module -S delete_module -k modules" -and
        $test2 -match "-w /sbin/insmod -p x -k modules" -and
        $test2 -match "-w /sbin/rmmod -p x -k modules" -and
        $test2 -match "-w /sbin/modprobe -p x -k modules" -and
        $test2 -match "-a always,exit -F arch=b64 -S init_module,delete_module -F key=modules"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.1.17"
    Task = "Ensure the audit configuration is immutable"
    Test = {
        $test = grep "^\s*[^#]" /etc/audit/rules.d/*.rules | tail -1
        if($test -match "-e 2"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.2.1.1"
    Task = "Ensure rsyslog is installed"
    Test = {
        $test = rpm -q rsyslog
        if($test -match "rsyslog-"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.2.1.2"
    Task = "Ensure rsyslog Service is enabled and running"
    Test = {
        $test1 = systemctl is-enabled rsyslog
        $test2 = systemctl status rsyslog | grep 'active (running) '
        if($test1 -match "enabled" -and $test2 -ne $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.2.1.3"
    Task = "Ensure rsyslog default file permissions configured"
    Test = {
        $test = grep ^\$FileCreateMode /etc/rsyslog.conf /etc/rsyslog.d/*.conf
        if($test -match "FileCreateMode"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.2.1.4"
    Task = "Ensure logging is configured"
    Test = {
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "4.2.1.5"
    Task = "Ensure rsyslog is configured to send logs to a remote log host"
    Test = {
        $test = grep "^*.*[^I][^I]*@" /etc/rsyslog.conf /etc/rsyslog.d/*.conf
        if($test -ne $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.2.1.6"
    Task = "Ensure remote rsyslog messages are only accepted on designated log hosts"
    Test = {
        $test1 = grep '$ModLoad imtcp' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
        $test2 = grep '$InputTCPServerRun' /etc/rsyslog.conf /etc/rsyslog.d/*.conf
        if($test1 -match "ModLoad imtcp" -and $test2 -match "InputTCPServerRun 514"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.2.2.1"
    Task = "Ensure journald is configured to send logs to rsyslog"
    Test = {
        $test = grep -E ^\s*ForwardToSyslog /etc/systemd/journald.conf
        if($test -match "ForwardToSyslog=yes"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.2.2.2"
    Task = "Ensure journald is configured to compress large log files"
    Test = {
        $test = grep -E ^\s*Compress /etc/systemd/journald.conf
        if($test -match "Compress=yes"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.2.2.3"
    Task = "Ensure journald is configured to write logfiles to persistent disk"
    Test = {
        $test = grep -E ^\s*Storage /etc/systemd/journald.conf
        if($test -match "Storage=persistent"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.2.3"
    Task = "Ensure permissions on all logfiles are configured"
    Test = {
        $test = find /var/log -type f -perm /g+wx,o+rwx -exec ls -l '{}' \;
        if($test -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "4.2.4"
    Task = "Ensure logrotate is configured"
    Test = {
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "5.1.1"
    Task = "Ensure cron daemon is enabled and running"
    Test = {
        $test1 = systemctl is-enabled cron
        $test2 = systemctl status cron | grep 'Active: active (running) '
        if($test1 -eq $null -and $test2 -match "active (running)"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.1.2"
    Task = "Ensure permissions on /etc/crontab are configured"
    Test = {
        $test = stat /etc/crontab
        if($test -match "0600/-rw-"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.1.3"
    Task = "Ensure permissions on /etc/cron.hourly are configured"
    Test = {
        $test = stat /etc/cron.hourly/
        if($test -match "0700/drwx"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.1.4"
    Task = "Ensure permissions on /etc/cron.daily are configured"
    Test = {
        $test = stat /etc/cron.daily
        if($test -match "0700/drwx"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.1.5"
    Task = "Ensure permissions on /etc/cron.weekly are configured"
    Test = {
        $test = stat /etc/cron.weekly
        if($test -match "0700/drwx"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.1.6"
    Task = "Ensure permissions on /etc/cron.monthly are configured"
    Test = {
        $test = stat /etc/cron.weekly
        if($test -match "0700/drwx"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.1.7"
    Task = "Ensure permissions on /etc/cron.d are configured"
    Test = {
        $test = stat /etc/cron.weekly
        if($test -match "0700/drwx"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.1.8"
    Task = "Ensure cron is restricted to authorized users"
    Test = {
        $test = stat /etc/cron.deny
        if($test -match "cannot stat"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.1.9"
    Task = "Ensure cron is restricted to authorized users"
    Test = {
        $test1 = stat /etc/at.deny
        $test2 = stat /etc/at.allow
        if($test1 -match "cannot stat" -and $test2 -match "0600/-rw-"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.2.1"
    Task = "Ensure permissions on /etc/ssh/sshd_config are configured"
    Test = {
        $test1 = stat /etc/ssh/sshd_config
        if($test1 -match "0600/-rw-"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

### TODO ...
[AuditTest] @{
    Id = "5.2.2"
    Task = "Ensure permissions on SSH private host key files are configured"
    Test = {
        return $retCompliant
    }
}

### TODO...
[AuditTest] @{
    Id = "5.2.3"
    Task = "Ensure permissions on SSH public host key files are configured"
    Test = {
        return $retCompliant
    }
}

[AuditTest] @{
    Id = "5.2.4"
    Task = "Ensure SSH access is limited"
    Test = {
        $test = sshd -T | grep -E '^\s*(allow|deny)(users|groups)\s+\S+'
        if($test -match "allowusers " -or $test -match "allowgroups " -or $test -match "denyusers " -or $test -match "denygroups "){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.2.5"
    Task = "Ensure SSH LogLevel is appropriate"
    Test = {
        $test = sshd -T | grep loglevel
        if($test -match "loglevel\s+VERBOSE" -or $test -match "loglevel\s+INFO"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.2.6"
    Task = "Ensure SSH X11 forwarding is disabled"
    Test = {
        $test = sshd -T | grep -i x11forwarding
        if($test -match "x11forwarding no"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

### TODO
[AuditTest] @{
    Id = "5.2.7"
    Task = "Ensure SSH MaxAuthTries is set to 4 or less"
    Test = {
        $test = sshd -T | grep maxauthtries | grep maxauthtries | cut -d ' ' -f 2
        if($test -le 4){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.2.8"
    Task = "Ensure SSH IgnoreRhosts is enabled"
    Test = {
        $test = sshd -T | grep ignorerhosts
        if($test -match "ignorehosts yes"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.2.9"
    Task = "Ensure SSH HostbasedAuthentication is disabled"
    Test = {
        $test = sshd -T | grep hostbasedauthentication
        if($test -match "hostbasedauthentication no"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.2.10"
    Task = "Ensure SSH root login is disabled"
    Test = {
        $test = sshd -T | grep permitrootlogin
        if($test -match "permitrootlogin no"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.2.11"
    Task = "Ensure SSH PermitEmptyPasswords is disabled"
    Test = {
        $test = sshd -T | grep permitemptypasswords
        if($test -match "permitemptypasswords no"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.2.12"
    Task = "Ensure SSH PermitUserEnvironment is disabled"
    Test = {
        $test = sshd -T | grep permituserenvironment
        if($test -match "permituserenvironment no"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.2.13"
    Task = "Ensure only strong Ciphers are used"
    Test = {
        $test = sshd -T | grep ciphers
        if($test -match "3des-cbc" -or $test -match "aes128-cbc" -or $test -match "aes192-cbc" -or $test -match "aes256-cbc"){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.2.14"
    Task = "Ensure only strong MAC algorithms are used"
    Test = {
        $test = sshd -T | grep -i "MACs"
        if($test -match "hmac-md5" -or
        $test -match "hmac-md5-96" -or
        $test -match "hmac-ripemd160" -or
        $test -match "hmac-sha1" -or
        $test -match "hmac-sha1-96" -or
        $test -match "umac-64@openssh.com" -or
        $test -match "umac-128@openssh.com" -or
        $test -match "hmac-md5-etm@openssh.com" -or
        $test -match "hmac-md5-96-etm@openssh.com" -or
        $test -match "hmac-ripemd160-etm@openssh.com" -or
        $test -match "hmac-sha1-etm@openssh.com" -or
        $test -match "hmac-sha1-96-etm@openssh.com" -or
        $test -match "umac-64-etm@openssh.com" -or
        $test -match "umac-128-etm@openssh.com"){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.2.15"
    Task = "Ensure only strong Key Exchange algorithms are used"
    Test = {
        $test = sshd -T | grep kexalgorithms
        if($test -match "diffie-hellman-group1-sha1" -or
        $test -match "diffie-hellman-group14-sha1" -or
        $test -match "diffie-hellman-group-exchange-sha1"){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.2.16"
    Task = "Ensure SSH Idle Timeout Interval is configured"
    Test = {
        $test1 = sshd -T | grep clientaliveinterval | cut -d ' ' -f 2
        $test2 = sshd -T | grep clientaliveinterval | cut -d ' ' -f 2
        if($test1 -ge 1 -and $test1 -le 300 -and $test2 -ge 1 -and $test2 -le 3){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.2.17"
    Task = "Ensure SSH LoginGraceTime is set to one minute or less"
    Test = {
        $test = sshd -T | grep logingracetime | cut -d ' ' -f 2
        if($test -ge 1 -and $test1 -le 60){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

if (Test-Path -Path '/etc/issue.net') {
[AuditTest] @{
    Id = "5.2.18"
    Task = "Ensure SSH warning banner is configured"
    Test = {
        $test = sshd -T | grep banner
        if($test -match "banner /etc/issue.net"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}
}

[AuditTest] @{
    Id = "5.2.19"
    Task = "Ensure SSH PAM is enabled"
    Test = {
        $test = sshd -T | grep -i usepam
        if($test -match "usepam yes"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.2.20"
    Task = "Ensure SSH AllowTcpForwarding is disabled"
    Test = {
        $test = sshd -T | grep -i allowtcpforwarding
        if($test -match "allowtcpforwarding no"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.2.21"
    Task = "Ensure SSH MaxStartups is configured"
    Test = {
        $test = sshd -T | grep -i maxstartups
        if($test -match "maxstartups 10:30:60"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.2.22"
    Task = "Ensure SSH MaxSessions is limited"
    Test = {
        $test = sshd -T | grep -i maxsessions | cut -d ' ' -f 2
        if($test -le 10){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

# unfertig; nochmal drüber gehen TODO
[AuditTest] @{
    Id = "5.3.1"
    Task = "Ensure password creation requirements are configured"
    Test = {
        $test1 = grep -P '^\s*password\s+(requisite|required)\s+pam_cracklib.so\s+([^#]+\s+)*minlen=(1[4-9]|[1-9][0-9]+)\b' /etc/pam.d/common-password
        $test2 = grep -P '^\s*password\s+(?:requisite|required)\s+pam_cracklib\.so\s+(?:[^#]+\s+)*(?:(?!\2|\3|\4))(dcredit=-[1-9]|ucredit=-[1-9]|ocredit=-[1-9]|lcredit=-[1-9])\s+(?:[^#]+\s+)*(?:(?!\1|\3|\4))(dcredit=-[1-9]|ucredit=-[1-9]|ocredit=-[1-9]|lcredit=-[1-9])\s+(?:[^#]+\s+)*(?:(?!\1|\2|\4))(dcredit=-[1-9]|ucredit=-[1-9]|ocredit=-[1-9]|lcredit=-[1-9])\s+(?:[^#]+\s+)*(?!\1|\2|\3)(dcredit=-[1-9]|ucredit=-[1-9]|ocredit=-[1-9]|lcredit=-[1-9])' /etc/pam.d/common-password
        if($test2 -match "dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1" -and $test1 -match "minlen=14"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

# unfertig; nochmal drüber gehen TODO
[AuditTest] @{
    Id = "5.3.2"
    Task = "Ensure lockout for failed password attempts is configured"
    Test = {
        $test = grep -E '^\s*auth\s+\S+\s+pam_(tally2|unix)\.so' /etc/pam.d/login
        if($test -match "deny=5"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.3.3"
    Task = "Ensure password reuse is limited"
    Test = {
        $test = grep -P '^\s*password\s+(requisite|required)\s+pam_pwhistory\.so\s+([^#]+\s+)*remember=([5-9]|[1-9][0-9]+)\b' /etc/pam.d/common-password | cut -d= -f2
        if($test -ge 5){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.4.1.1"
    Task = "Ensure password hashing algorithm is SHA-512"
    Test = {
        $test = grep -Ei '^\s*^\s*ENCRYPT_METHOD\s+SHA512' /etc/login.defs
        if($test -match "SHA512"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.4.1.2"
    Task = "Ensure password expiration is 365 days or less"
    Test = {
        $test1 = grep ^\s*PASS_MAX_DAYS /etc/login.defs | cut -f2
        $test2_script = @'
#!/bin/bash
for line in $(grep -E ^[^:]+:[^\*] /etc/shadow | cut -d: -f5)
do
        if [ $line -gt 365 ]
        then
            echo "FAIL"
        fi
done
'@
        $test2 = bash -c $test2_script
        if($test1 -gt 365 -or $test2 -match "FAIL"){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.4.1.3"
    Task = "Ensure minimum days between password changes is configured"
    Test = {
        $test1 = grep ^\s*PASS_MIN_DAYS /etc/login.defs | cut -f2
        $test2_script = @'
#!/bin/bash
for line in $(grep -E ^[^:]+:[^\*] /etc/shadow | cut -d: -f4)
do
        if [ $line -lt 1 ]
        then
            echo "FAIL"
        fi
done
'@
        $test2 = bash -c $test2_script
        if($test1 -lt 1 -or $test2 -match "FAIL"){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.4.1.4"
    Task = "Ensure password expiration warning days is 7 or more"
    Test = {
        $test1 = grep ^\s*PASS_WARN_AGE /etc/login.defs | cut -f2
        $test2_script = @'
#!/bin/bash
for line in $(grep -E ^[^:]+:[^\*] /etc/shadow | cut -d: -f6)
do
        if [ $line -lt 7 ]
        then
            echo "FAIL"
        fi
done
'@
        $test2 = bash -c $test2_script
        if($test1 -lt 7 -or $test2 -match "FAIL"){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.4.1.5"
    Task = "Ensure inactive password lock is 30 days or less"
    Test = {
        $test1 = useradd -D | grep INACTIVE | cut -d= -f2
        $test2_script = @'
#!/bin/bash
for line in $(grep -E ^[^:]+:[^\*] /etc/shadow | cut -d: -f7)
do
        if [ $line -ge 30 ]
        then
            echo "FAIL"
        fi
done
'@
        $test2 = bash -c $test2_script
        if($test1 -gt 30 -or $test1 -eq -1 -or $test2 -match "FAIL"){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.4.1.6"
    Task = "Ensure all users last password change date is in the past"
    Test = {
        $test_script = @'
#!/bin/bash
for usr in $(cut -d: -f1 /etc/shadow); do
    [[ $(chage --list $usr | grep '^Last password change' | cut -d: -f2) > $(date) ]] && echo "$usr :$(chage --list $usr | grep '^Last password change' | cut -d: -f2)"; done
'@
        $test = bash -c $test_script
        if($test -ne $null){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.4.2"
    Task = "Ensure system accounts are secured"
    Test = {
        $script1 = $scriptPath + "CIS-SEL15-5.4.2_1.sh"
        $test1 = bash $script1
        $script2 = $scriptPath + "CIS-SEL15-5.4.2_2.sh"
        $test2 = bash $script2
        if($test1 -eq $null -and $test2 -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.4.3"
    Task = "Ensure default group for the root account is GID 0"
    Test = {
        $test = grep "^root:" /etc/passwd | cut -f4
        if($test -eq 0){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.4.4"
    Task = "Ensure default user shell timeout is configured"
    Test = {
        $script = $scriptPath + "CIS-SEL15-5.4.4.sh"
        $test1 = bash $script
        $test2 = grep -PR '^\s*([^$#;]+\s+)*TMOUT=(9[0-9][1-9]|0+|[1-9]\d{3,})\b\s*(\S+\s*)*(\s+#.*)?$' /etc/profile* /etc/bashrc.bashrc*
        if($test1 -match "configured in file: /etc/profile.d/" -and $test2 -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.4.5"
    Task = "Ensure default user umask is configured"
    Test = {
        $test1 = grep -RPi '(^|^[^#]*)\s*umask\s+([0-7][0-7][01][0-7]\b|[0-7][0-7][0-7][0-6]\b|[0-7][01][0-7]\b|[0-7][0-7][0-6]\b|(u=[rwx]{0,3},)?(g=[rwx]{0,3},)?o=[rwx]+\b|(u=[rwx]{1,3},)?g=[^rx]{1,3}(,o=[rwx]{0,3})?\b)' /etc/login.defs /etc/default/login /etc/profile* /etc/bash.bashrc*
        $test2 = grep -REi '^\s*UMASK\s+\s*(0[0-7][2-7]7|[0-7][2-7]7|u=(r?|w?|x?)(r?|w?|x?)(r?|w?|x?),g=(r?x?|x?r?),o=)\b' /etc/login.defs /etc/default/login /etc/profile* /etc/bash.bashrc*
        if(($test1 -eq $null -or $test1 -match "No such file or directory") -and $test2 -match "UMASK\s*027"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "5.5"
    Task = "Ensure root login is restricted to system console"
    Test = {
        return $retNonCompliantManualReviewRequired
    }
}

#TODO
[AuditTest] @{
    Id = "5.6"
    Task = "Ensure access to the su command is restricted"
    Test = {
        $test1 = grep -RPi '(^|^[^#]*)\s*umask\s+([0-7][0-7][01][0-7]\b|[0-7][0-7][0-7][0-6]\b|[0-7][01][0-7]\b|[0-7][0-7][0-6]\b|(u=[rwx]{0,3},)?(g=[rwx]{0,3},)?o=[rwx]+\b|(u=[rwx]{1,3},)?g=[^rx]{1,3}(,o=[rwx]{0,3})?\b)' /etc/login.defs /etc/default/login /etc/profile* /etc/bash.bashrc*
        $test2 = grep -REi '^\s*UMASK\s+\s*(0[0-7][2-7]7|[0-7][2-7]7|u=(r?|w?|x?)(r?|w?|x?)(r?|w?|x?),g=(r?x?|x?r?),o=)\b' /etc/login.defs /etc/default/login /etc/profile* /etc/bash.bashrc*
        if(($test1 -eq $null -or $test1 -match "No such file or directory") -and $test2 -match "UMASK\s*027"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}


### Chapter 6 - System Maintenance

[AuditTest] @{
    Id = "6.1.1"
    Task = "Audit system file permissions"
    Test = {
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "6.1.2"
    Task = "Ensure permissions on /etc/passwd are configured"
    Test = {
        $test1 = stat /etc/passwd
        if($test1 -match "0644"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.1.3"
    Task = "Ensure permissions on /etc/shadow are configured"
    Test = {
        $test1 = stat /etc/shadow
        if($test1 -match "0640"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.1.4"
    Task = "Ensure permissions on /etc/group are configured"
    Test = {
        $test1 = stat /etc/group
        if($test1 -match "0644"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.1.5"
    Task = "Ensure permissions on /etc/passwd- are configured"
    Test = {
        $test1 = stat /etc/passwd-
        if($test1 -match "0644"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.1.6"
    Task = "Ensure permissions on /etc/shadow- are configured"
    Test = {
        $test1 = stat /etc/shadow-
        if($test1 -match "0640"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.1.7"
    Task = "Ensure permissions on /etc/group- are configured"
    Test = {
        $test1 = stat /etc/group-
        if($test1 -match "0644"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.1.8"
    Task = "Ensure no world writable files exist"
    Test = {
        $test1 = df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type f -perm -0002
        if($test1 -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.1.9"
    Task = "Ensure no unowned files or directories exist"
    Test = {
        $test1 = df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -type f -perm -0002
        if($test1 -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.1.10"
    Task = "Ensure no ungrouped files or directories exist"
    Test = {
        $test1 = df --local -P | awk '{if (NR!=1) print $6}' | xargs -I '{}' find '{}' -xdev -nogroup
        if($test1 -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.1.11"
    Task = "Audit SUID executables"
    Test = {
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "6.1.12"
    Task = "Audit SGID executables"
    Test = {
        return $retNonCompliantManualReviewRequired
    }
}

[AuditTest] @{
    Id = "6.2.1"
    Task = "Ensure accounts in /etc/passwd use shadowed passwords"
    Test = {
        $script1 = $scriptPath + "CIS-SEL15-6.2.1.sh"
        $test1 = bash $script1
        if($test1 -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.2"
    Task = "Ensure /etc/shadow password fields are not empty"
    Test = {
        $script1 = $scriptPath + "CIS-SEL15-6.2.2.sh"
        $test1 = bash $script1
        if($test1 -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.3"
    Task = "Ensure root is the only UID 0 account"
    Test = {
        $test1_script = @'
#!/bin/bash
awk -F: '($3 == 0) { print $1 }' /etc/passwd
'@
        $test1 = bash -c $test1_script
        if($test1 -match "root"){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.4"
    Task = "Ensure root PATH Integrity"
    Test = {
        $test_script = @'
#!/bin/bash
if echo "$PATH" | grep -q "::" ; then
    echo "Empty Directory in PATH (::)"
fi
if echo "$PATH" | grep -q ":$" ; then
    echo "Trailing : in PATH"
fi
for x in $(echo "$PATH" | tr ":" " ") ; do
    if [ -d "$x" ] ; then
        ls -ldH "$x" | awk '
        $9 == "." {print "PATH contains current working directory (.)"}
        $3 != "root" {print $9, "is not owned by root"}
        substr($1,6,1) != "-" {print $9, "is group writable"}
        substr($1,9,1) != "-" {print $9, "is world writable"}'
    else
        echo "$x is not a directory"
    fi
done
'@
        $test = bash -c $test_script
        if($test -ne $null){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.5"
    Task = "Ensure all users' home directories exist"
    Test = {
        $script1 = $scriptPath + "CIS-SEL15-6.2.5.sh"
        $test = bash $script1
        if($test -match "does not exist"){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.6"
    Task = "Ensure users' home directories permissions are 750 or more restrictive"
    Test = {
        $script1 = $scriptPath + "CIS-SEL15-6.2.6.sh"
        $test = bash $script1
        if($test -ne $null){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.7"
    Task = "Ensure users own their home directories"
    Test = {
        $script1 = $scriptPath + "CIS-SEL15-6.2.7.sh"
        $test = bash $script1
        if($test -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.8"
    Task = "Ensure users' dot files are not group or world writable"
    Test = {
        $script1 = $scriptPath + "CIS-SEL15-6.2.8.sh"
        $test = bash $script1
        if($test -ne $null){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.9"
    Task = "Ensure no users have .forward files"
    Test = {
        $script1 = $scriptPath + "CIS-SEL15-6.2.9.sh"
        $test = bash $script1
        if($test -ne $null){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.10"
    Task = "Ensure no users have .netrc files"
    Test = {
        $script1 = $scriptPath + "CIS-SEL15-6.2.10.sh"
        $test = bash $script1
        if($test -ne $null){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.11"
    Task = "Ensure users' .netrc Files are not group or world accessible"
    Test = {
        $script1 = $scriptPath + "CIS-SEL15-6.2.11.sh"
        $test = bash $script1
        if($test -ne $null){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.12"
    Task = "Ensure no users have .rhosts files"
    Test = {
        $script1 = $scriptPath + "CIS-SEL15-6.2.12.sh"
        $test = bash $script1
        if($test -ne $null){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.13"
    Task = "Ensure all groups in /etc/passwd exist in /etc/group"
    Test = {
        $test_script = @'
#!/bin/bash
for i in $(cut -s -d: -f4 /etc/passwd | sort -u ); do
    grep -q -P "^.*?:[^:]*:$i:" /etc/group
    if [ $? -ne 0 ]; then
        echo "Group $i is referenced by /etc/passwd but does not exist in /etc/group"
    fi
done
'@
        $test = bash -c $test_script
        if($test -ne $null){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.14"
    Task = "Ensure no duplicate UIDs exist"
    Test = {
        $test_script = @'
#!/bin/bash
cut -f3 -d":" /etc/passwd | sort -n | uniq -c | while read x ; do
    [ -z "$x" ] && break
    set - $x
    if (( $1 > 1 )); then
        users=$(awk -F: '($3 == n) { print $1 }' n=$2 /etc/passwd | xargs)
        echo "Duplicate UID ($2): $users"
    fi
done
'@
        $test = bash -c $test_script
        if($test -ne $null){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.15"
    Task = "Ensure no duplicate GIDs exist"
    Test = {
        $test_script = @'
#!/bin/bash
cut -d: -f3 /etc/group | sort | uniq -d | while read x ; do
    echo "Duplicate GID ($x) in /etc/group"
done
'@
        $test = bash -c $test_script
        if($test -ne $null){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.16"
    Task = "Ensure no duplicate user names exist"
    Test = {
        $test_script = @'
#!/bin/bash
cut -d: -f1 /etc/passwd | sort | uniq -d | while read x ; do
    echo "Duplicate login name ${x} in /etc/passwd"
done
'@
        $test = bash -c $test_script
        if($test -ne $null){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.17"
    Task = "Ensure no duplicate group names exist"
    Test = {
        $test_script = @'
#!/bin/bash
cut -d: -f1 /etc/group | sort | uniq -d | while read x ; do
    echo "Duplicate group name ${x} in /etc/group"
done
'@
        $test = bash -c $test_script
        if($test -ne $null){
            return $retNonCompliant
        } else {
            return $retCompliant
        }
    }
}

[AuditTest] @{
    Id = "6.2.18"
    Task = "Ensure shadow group is empty"
    Test = {
        $script1 = $scriptPath + "CIS-SEL15-6.2.18_1.sh"
        $test1 = bash $script1
        $script2 = $scriptPath + "CIS-SEL15-6.2.18_2.sh"
        $test2 = bash $script2
        if($test1 -eq $null -and $test2 -eq $null){
            return $retCompliant
        } else {
            return $retNonCompliant
        }
    }
}