#!/bin/sh

# shellcheck disable=SC1090
# shellcheck disable=SC2034
# shellcheck disable=SC2154

# audit_azure_file_shares
#
# Check Azure File Shares
#
# 9.1.1 Ensure soft delete for Azure File Shares is Enabled
# 9.1.2 Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for SMB file shares
# 9.1.3 Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares
#
# Refer to Section(s) 9.1.1-3 Page(s) 475-84 CIS Microsoft Azure Foundations Benchmark v5.0.0
#
# 8.2 Ensure root squash for NFS file shares is configured 
# 8.3 Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for SMB file shares
# 8.4 Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares
#
# Refer to Sections(s) 8 Page(s) 106-19 Microsoft Azure Storage Services Benchmark v1.0.0
#
# This requires the Azure CLI to be installed and configured
#.

audit_azure_file_shares () {
  print_function "audit_azure_file_shares"
  check_message  "Azure File Shares"
  command="az storage account list --query \"[].name\" --output tsv"
  command_message    "${command}"
  s_accounts=$( eval "${command}" 2> /dev/null )
  if [ -z "${s_accounts}" ]; then
    info_message "No Storage Accounts found"
    return
  fi
  for s_account in ${s_accounts}; do
    command="az storage account show --name \"${storage_account}\" --query \"resourceGroup\" --output tsv"
    command_message   "${command}"
    res_group=$( eval "${command}" )
    # 9.1.1 Ensure soft delete for Azure File Shares is Enabled
    check_azure_file_share_value "Days retained"             "${s_account}" "${res_group}" "service-properties" "shareDeleteRetentionPolicy.days"        "eq" "7"           "--share-delete-retention-days"   ""
    check_azure_file_share_value "Soft Delete"               "${s_account}" "${res_group}" "service-properties" "shareDeleteRetentionPolicy.enabled"     "eq" "true"        "--enable-share-delete-retention" ""
    command="az storage account file-service-properties show --name \"${s_account}\" --resource-group \"${res_group}\" |grep -i smb"
    command_message        "${command}"
    protocol_check=$( eval "${command}" )
    if [ -n "${protocol_check}" ]; then
      # 9.1.2 Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for SMB file shares
      # 8.3 Ensure 'SMB protocol version' is set to 'SMB 3.1.1' or higher for SMB file shares
      check_azure_file_share_value "SMB Protocol Version"    "${s_account}" "${res_group}" "service-properties" "protocolSettings.smb.versions"          "eq" "SMB3.1.1"    "--versions"
      # 9.1.3 Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares
      # 8.4   Ensure 'SMB channel encryption' is set to 'AES-256-GCM' or higher for SMB file shares
      check_azure_file_share_value "SMB Channel Encryption"  "${s_account}" "${res_group}" "service-properties" "protocolSettings.smb.channelEncryption" "eq" "AES-256-GCM" "--channel-encryption"
    fi
    command="az storage account file-service-properties show --name \"${s_account}\" --resource-group \"${res_group}\" |grep -i nfs"
    command_message        "${command}"
    protocol_check=$( eval "${command}" )
    if [ -n "${protocol_check}" ]; then
      # 8.2 Ensure root squash for NFS file shares is configured 
      check_azure_file_share_value "NFS Root Squash"         "${s_account}" "${res_group}" "service-properties" "protocolSettings.nfs.rootSquash"        "eq"  "RootSquash"    "rootSquash"
    fi
  done
}
