I need to write some kind of bash script that would check conf files of services (commonly used as nginx apache mongodb cassandra ssh etc) and search for patterns (i.e. check if mongod.conf has authorization: enabled line or check if ssh logging via keys is enabled, also checking if every service is in it newest version, disabling default users) to be sure that the service is safe.But here's one problem I can't solve (yet ;)) - I need to prove that my script works - do you know any application that would check for vulnerabilities of commonly used services? I don't mean websites - services. I could perform that test before running my script and after and then - voila - my script is saving the world ;)I would be really thankful for any answer.Thank you so much :3
Check service for vulnerabilities
linux;bash;security;vulnerability
The thing what you are asking for to me it seems like writing standard monitoring scripts.The best way to approach it is to settle on some programming language and use it to write them all.Bash scripting is not the best choice as it's flaky for some operations - it can do a lot, but it's huge problem with maintaining it and it's very messy due to the usage of various external binaries and handling errors and so on, it's not good as exception handling in other languages.I'd recommend to use one of the JVM languages - Java, Scala, Groovy - you have there drivers for every database and other things. Also C# is good choice as it has all libraries.If not, then Python, PHP, Perl - here you have also a lot of drivers and APIs.So you need to take this subject seriously as it's one of the most important things and assure proper test for every service.As you write just the scripts, you can use any existing network monitoring front-end like Nagios with Thruk to power the scheduled execution of these and notifications / reporting.Moreover, you can draw metrics with pnp4nagios.Also note that Vulnerability Scan and Monitoring are two different things. For the first you have OpenVAS and Nessus, for the second you have Nagios, Solar Winds and others. What you want to do is to use custom scripts with e.g. Nagios.It is also very good way to learn programming. All you need is to do very simple scripts so this way you can learn a lot without much pressure. Dedicate 2-3 hours per day all the time, so this way you can gain big insight into your infrastructure. You can start with Eclipse or IntelliJ and use Gradle to build simple projects. Since there's good automation with Gradle and good support in Java you should be happy in long term. And you can ask dev team for help. Check the Nagios plugin documentation what strings should be returned to draw graphs with pnp4nagios.You can also try ingesting logs into the database, which is also very helpful.Now some more practical info. You can run java mini-programs (Nagios plugins) remotely or you can run it locally on Nagios machine (preferred). So this way you ssh (in Java or Python) to the system, read the file, download it and parse it. So you need some of the network operations in some scenarios.You can also use Cloud APIs.And you can use SNMP too with existing Nagios plugins so you don't need Java for everything.Some databases you can monitor with dedicated solutions, if you dont do scripting manually (for which Nagios is the best), you can find on the web something which will monitor your DB performance.Finally, monitoring scripts are OK to check if you database has password. This is what it is used to do normally. And also that it doesn't run out of RAM, disk space etc.And here is how this can be done properly.Database of your infrastructure, e.g. all hosts and so on, possibly with automated detection. This is linked to the build infrastructure / automation. This can be more than one database if you use cloud.Another database with the logs and other e.g. documents, so this contains log of execution of Nagios and results from scripts run in (4). Here you can ingest any other logs. MongoDB would be good. Cassandra can do it as well.NagiosRun the check which looks into the database (2) and see if checks were successful and what is the resultCheck if the background script is running by checking the logs from database (2)Background scripts running password / access checksIf every system from database (1) does not have empty root password or default password setIf every system from database (1) allows certain logonsIngest the results and logs into the database (2)This can also run OpenVAS and result can be ingested to (2)As result, you can then update build (1) or servers from (1) if there's default password or no password. You can make also build (1) generate checks for Nagios to monitor and produce specific metrics. You can run many Nagios systems. Database (2) can be used to ingest logs from various sources (you'd need adapters for this). Bases on these logs you can see whatever is brute-forced and tune the policies etc.Also Nessus and OpenVAS are huge hogs. So using Nagios with dedicated checks for hosts is just easy and effective way. Also Nessus and OpenVAS are not good solutions for checking for default or lack of passwords. Dedicated script is the better way of solving this problem.