search

ovh / debian-cis

PCI-DSS compliant Debian 10/11/12 hardening
Other
756 stars 130 forks source link

fix: timeout of 99.1.3 #168

Closed speed47 closed 1 year ago

speed47 commented 1 year ago

The 99.1.3_acc_sudoers_no_all.sh script can sometimes timeout on servers where /etc/sudoers.d/ has thousands of files. This patch makes it run roughly 5x faster, as tested on a server with 1500 files in sudoers.d/.

Closes #167.

Signed-off-by: Stephane Lesimple stephane.lesimple@corp.ovh.com

tdenof commented 1 year ago

Hi @speed47 , thanks for spotting this. Indeed some scripts weren't initially designed for high workload and hence loops not always optimized. Disabling log and removing the unnecessary sed are good improvements with few changes. But just for backward compatibility, I think it's better if we just set a variable (with a comment above it to explain why it may be needed) that can be controlled via the configuration to simply enable or disable logging (and by default let it enable), so every one can control it as he wants (e.g declare a SKIPLOG=0 variable on the top of the script along with other variables, and on your side set SKIPLOG=1 in your 99.1.3 config file)

speed47 commented 1 year ago

Good idea, repushed a new version with a MAX_FILES_TO_LOG variable, which is zero by default and doesn't modify the current behavior. If the value is > 0, then it means this script won't log each file if the number of files found is more than this number. This way, we also get rid of the hardcoded 300 value, and instead of just enabling/disabling logging, users can specify what is their limit.