Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking for a tool, that scans unix operating systems for configuration issues. E.g. a script that finds

PermitRootLogin yes

in the ssh config file or with other words: a script that automates compliance checks. Since there are quite a few configuration files with security relevant configurations, that lie in all sorts of different places already differing from linux distribution to linux distribution, I'd rather check if that exists before I start writing my own script. :)

What I was able to find so far is:

  • Vulnerability scanner Nessus supports UNIX Configuration Auditing. As far as I could see, it reads only the list of installed packets and then checks if there are vulnerabilities in those

  • eEye has a tool called Retina of which I'm not sure, if it's for windows only, and what it checks exactly.

  • BastilleLinux, BastilleMac, which tests and hardens. It is still shiped with current Ubuntu version, and it says on their website, that they'll be restarting development, I can't see any updates.

Do you know of a tool (preferably OpenSource so I can edit/contribute), that might match better?

share|improve this question
1  
If you know what you want to look for, why not write your own scripts? –  Terry Chia Aug 9 '12 at 8:06
    
That example isn't even worth a script. Just find or grep. –  Polynomial Aug 9 '12 at 8:16
    
@TerryChia This script is supposed to look for configuration issueS. There are quite a lot of configuration files too look at (Network, Kernel, Applications, ...). Depending on which distribution the files change already. I don't mind writing such a script, but it's a lot of work, and if such a script already exists, it'd be to reinvent the wheel. That's why I first want to see if it already exists :) Polynomial, it's only an example. Look at the comment to TerryChia please. –  user857990 Aug 9 '12 at 8:21
    
@user857990 Why would it not be a smart choice? –  Terry Chia Aug 9 '12 at 8:22
2  
Welcome - if you have a quick look at the faq you will see that shopping questions are off-topic. Your question does have a core which is on-topic: how can you automate compliance checking, which Rory McCune has answered, so you may get more/wider answers if you slightly reword your question this way. –  Rory Alsop Aug 9 '12 at 8:53
show 3 more comments

2 Answers

You might want to look at Nessus Compliance checks. They provide an interface which allows you to check files for specific items and settings.

Also there a quite a few pre-defined templates available through the support portal which cover a wide range of unix/linux flavours, and checks against the Center for Internet Security standards amongst others

share|improve this answer
add comment

There's also a tool called Security Blanket that may be of interest to you (not sure of your budget), which I've heard is easy to configure and run as per here.

Regarding CIS (Center for Internet Security) standards, although still very valid, I had heard that they weren't been actively worked on :(

The Tripwire Enterprise solutions (if within your budget) might also help but to be honest, I haven't played with any Tripwire stuff in a very long time so you'd have to check it out yourself.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.