Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking for a tool, that scans unix operating systems for configuration issues. E.g. a script that finds

PermitRootLogin yes

in the ssh config file or with other words: a script that automates compliance checks. Since there are quite a few configuration files with security relevant configurations, that lie in all sorts of different places already differing from linux distribution to linux distribution, I'd rather check if that exists before I start writing my own script. :)

What I was able to find so far is:

  • Vulnerability scanner Nessus supports UNIX Configuration Auditing. As far as I could see, it reads only the list of installed packets and then checks if there are vulnerabilities in those

  • eEye has a tool called Retina of which I'm not sure, if it's for windows only, and what it checks exactly.

  • BastilleLinux, BastilleMac, which tests and hardens. It is still shiped with current Ubuntu version, and it says on their website, that they'll be restarting development, I can't see any updates.

Do you know of a tool (preferably OpenSource so I can edit/contribute), that might match better?

share|improve this question
1  
If you know what you want to look for, why not write your own scripts? –  Terry Chia Aug 9 '12 at 8:06
    
That example isn't even worth a script. Just find or grep. –  Polynomial Aug 9 '12 at 8:16
    
@TerryChia This script is supposed to look for configuration issueS. There are quite a lot of configuration files too look at (Network, Kernel, Applications, ...). Depending on which distribution the files change already. I don't mind writing such a script, but it's a lot of work, and if such a script already exists, it'd be to reinvent the wheel. That's why I first want to see if it already exists :) Polynomial, it's only an example. Look at the comment to TerryChia please. –  user857990 Aug 9 '12 at 8:21
    
@user857990 Why would it not be a smart choice? –  Terry Chia Aug 9 '12 at 8:22
2  
Welcome - if you have a quick look at the faq you will see that shopping questions are off-topic. Your question does have a core which is on-topic: how can you automate compliance checking, which Rory McCune has answered, so you may get more/wider answers if you slightly reword your question this way. –  Rory Alsop Aug 9 '12 at 8:53

3 Answers 3

You might want to look at Nessus Compliance checks. They provide an interface which allows you to check files for specific items and settings.

Also there a quite a few pre-defined templates available through the support portal which cover a wide range of unix/linux flavours, and checks against the Center for Internet Security standards amongst others

share|improve this answer

There's also a tool called Security Blanket that may be of interest to you (not sure of your budget), which I've heard is easy to configure and run as per here.

Regarding CIS (Center for Internet Security) standards, although still very valid, I had heard that they weren't been actively worked on :(

The Tripwire Enterprise solutions (if within your budget) might also help but to be honest, I haven't played with any Tripwire stuff in a very long time so you'd have to check it out yourself.

share|improve this answer

Im not very talented at coding but used the basics of creating a shell script and printing out outputs to check for configuration standards and write them to a text file. Ive tried to show expected/desired output and then what the output is.

You can get the document from CIS here or you may need to fill in a form to get it https://benchmarks.cisecurity.org/downloads/multiform/index.cfm?do=download&download=/ubuntu/CIS_Ubuntu_12.04_LTS_Server_Benchmark_v1.0.0.pdf

Ive used this on ubuntu 14.04 as server benchmarks are not published for this yet but will be pretty close.

Create the shell script on the server with nano hardeningtests.sh and paste in below content in the link and run with sh hardeningtests.sh

Then read the output file hardeningtests.txt

The tests are based on CIS Ubuntu Hardening Standards and a few other output items. Some further clean up to make it clearer is necessary but its pretty comprehensive.

http://www.gtp.com.au/serverscripts/ubuntu-hardening-tests.sh

Hope it helps.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.