Change arbo and create config file
This commit is contained in:
@@ -0,0 +1 @@
|
||||
#!/usr/bin/env python3
|
||||
@@ -0,0 +1,51 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
import re
|
||||
from json import dumps
|
||||
from parsing.base import ParsingBase
|
||||
|
||||
|
||||
class Parsing(ParsingBase):
|
||||
def __init__(self, objects):
|
||||
self._parsing = dict()
|
||||
self._reports = dict()
|
||||
self._objects = objects
|
||||
|
||||
def runParsing(self):
|
||||
# Generate report
|
||||
self._constructReports()
|
||||
|
||||
|
||||
print(self._reports)
|
||||
|
||||
def _parseFile(self):
|
||||
pass
|
||||
|
||||
def _generateReport(self, objects):
|
||||
# We can generate the report
|
||||
for postfix in self._reports['postfix']:
|
||||
self._reports['postfix'][postfix] = objects[postfix]
|
||||
|
||||
def _parsingFile(self, line, obj, vulnerabilityFound) -> bool:
|
||||
"""
|
||||
This function parse the line and try to find the item in it
|
||||
"""
|
||||
result = bool()
|
||||
|
||||
return result
|
||||
|
||||
def _constructReports(self):
|
||||
"""
|
||||
Construct dictionary for result of the tests
|
||||
Each entry contains:
|
||||
Key:
|
||||
- filename: filename of the test
|
||||
- line: line of the test
|
||||
- parse: Display the line where the vulnerabilites has been found
|
||||
- description: description of the vulnerability
|
||||
- level: high, medium or low
|
||||
"""
|
||||
self._reports['postfix'] = dict()
|
||||
|
||||
def getResults(self) -> dict:
|
||||
return self._reports
|
||||
@@ -0,0 +1,7 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
def postfix() -> dict:
|
||||
postfix = dict()
|
||||
postfix['regexp'] = "inet_interfaces = all"
|
||||
postfix['replace'] = "inet_interfaces = loopback-only"
|
||||
return postfix
|
||||
@@ -0,0 +1 @@
|
||||
#!/usr/bin/env python3
|
||||
@@ -0,0 +1,129 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
import re
|
||||
from json import dumps
|
||||
from parsing.base import ParsingBase
|
||||
|
||||
class Parsing(ParsingBase):
|
||||
def __init__(self, objects, audit):
|
||||
self._parsing = dict()
|
||||
self._reports = dict()
|
||||
self._objects = objects
|
||||
self._audit = audit
|
||||
|
||||
def runParsing(self):
|
||||
# Generate report
|
||||
self._constructReports()
|
||||
|
||||
for audit in self._audit:
|
||||
if audit['audit'] == 'file':
|
||||
with open(audit['value'], 'rb') as fdata:
|
||||
self._parseFile(fdata)
|
||||
if audit['audit'] == 'process':
|
||||
self._parseProcess()
|
||||
|
||||
def _parseFile(self, fdata):
|
||||
data = fdata.read()
|
||||
lines = data.splitlines()
|
||||
numLines = 1
|
||||
|
||||
vulnerabilityFound = dict()
|
||||
|
||||
# I create an array which contains all flag we need to find
|
||||
# After that, for each data, I put the number of occurence I found.
|
||||
# If the array is empty, no entry found for a flag, otherwise, we check the value
|
||||
for obj in self._objects:
|
||||
vulnerabilityFound[obj['flag']] = dict()
|
||||
vulnerabilityFound[obj['flag']]['recommand_value'] = obj['value']
|
||||
vulnerabilityFound[obj['flag']]['occurence'] = 0
|
||||
for item in obj:
|
||||
vulnerabilityFound[obj['flag']][item] = obj[item]
|
||||
|
||||
for line in lines:
|
||||
line = line.decode("utf-8")
|
||||
|
||||
for obj in self._objects:
|
||||
result = self._parsingFile(line, obj, vulnerabilityFound)
|
||||
if result:
|
||||
vulnerabilityFound[obj['flag']]['lineNumber'] = numLines
|
||||
vulnerabilityFound[obj['flag']]['occurence'] += 1
|
||||
|
||||
numLines += 1
|
||||
|
||||
# Now, we can check if the value is specified or not
|
||||
# And check if the flag is specified and need to put on the sysctl config
|
||||
for entry in vulnerabilityFound:
|
||||
obj = vulnerabilityFound[entry]
|
||||
vulnerabilityFound[entry]['result'] = dict()
|
||||
if obj['occurence'] > 0:
|
||||
#print(entry)
|
||||
#print(obj)
|
||||
if obj['current_value'] != obj['recommand_value']:
|
||||
vulnerabilityFound[entry]['result']['result'] = "failed"
|
||||
else:
|
||||
vulnerabilityFound[entry]['result']['result'] = "success"
|
||||
else:
|
||||
# No find the flag, we recommand to enable it
|
||||
vulnerabilityFound[entry]['result']['result'] = "failed"
|
||||
|
||||
# Generate report
|
||||
self._generateReport(vulnerabilityFound)
|
||||
|
||||
def _parseProcess(self):
|
||||
vulnerabilityFound = dict()
|
||||
|
||||
# Generate report
|
||||
#self._generateReport(vulnerabilityFound)
|
||||
|
||||
def _generateReport(self, objects):
|
||||
# We can generate the report
|
||||
for sysctl in self._reports['file']['sysctl']:
|
||||
self._reports['file']['sysctl'][sysctl] = objects[sysctl]
|
||||
|
||||
def _parsingFile(self, line, obj, vulnerabilityFound) -> bool:
|
||||
"""
|
||||
This function parse the line and try to find the item in it
|
||||
"""
|
||||
result = bool()
|
||||
|
||||
groupLine = re.search(obj['flag'], line)
|
||||
if groupLine:
|
||||
# Avoid the comment
|
||||
if not line.startswith('#'):
|
||||
sLine = line.split('=')
|
||||
flag = sLine[0].strip()
|
||||
value = int(sLine[1].strip())
|
||||
|
||||
vulnerabilityFound[flag]['current_value'] = value
|
||||
|
||||
result = True
|
||||
|
||||
return result
|
||||
|
||||
def _constructReports(self):
|
||||
"""
|
||||
Construct dictionary for result of the tests
|
||||
Each entry contains:
|
||||
Key:
|
||||
- filename: filename of the test
|
||||
- line: line of the test
|
||||
- parse: Display the line where the vulnerabilites has been found
|
||||
- description: description of the vulnerability
|
||||
- level: high, medium or low
|
||||
"""
|
||||
# For file
|
||||
self._reports['file'] = dict()
|
||||
self._reports['file']['filename'] = self._audit[0]['value']
|
||||
self._reports['file']['sysctl'] = dict()
|
||||
|
||||
# For process
|
||||
self._reports['process'] = dict()
|
||||
self._reports['process']['sysctl'] = dict()
|
||||
|
||||
|
||||
for sysctl in self._objects:
|
||||
self._reports['file']['sysctl'][sysctl['flag']] = dict()
|
||||
self._reports['process']['sysctl'][sysctl['flag']] = dict()
|
||||
|
||||
def getResults(self) -> dict:
|
||||
return self._reports
|
||||
@@ -0,0 +1,219 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
# Define the entry
|
||||
|
||||
def sysctl() -> list:
|
||||
sysctl = list()
|
||||
|
||||
# https://access.redhat.com/security/sysctl/sysctl-2023-0179
|
||||
#####
|
||||
# CVE
|
||||
#####
|
||||
sysctl.append({
|
||||
"from": "cve",
|
||||
"id": "cve-2023-0179",
|
||||
"description": "A buffer overflow vulnerability was be found in Linux system. An hacker can allow privilege escalation through Netfilter subsystem",
|
||||
"flag": "kernel.unprivileged_userns_clone",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
"affectedSystem": ({
|
||||
'linux': "Debian",
|
||||
'release': 'buster',
|
||||
'kernel': '4.19.249-2'
|
||||
})
|
||||
})
|
||||
|
||||
#####
|
||||
# Best practice from CIS
|
||||
#####
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable IPv4 forwarding",
|
||||
"flag": "net.ipv4.conf.all.forwarding",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable ICMP redirects IPv4",
|
||||
"flag": "net.ipv4.conf.all.accept_redirects",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable Accepting Source Routed packets IPv4 for all interfaces",
|
||||
"flag": "net.ipv4.conf.all.accept_source_route",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable Accepting Source Routed packets IPv4 for default interface",
|
||||
"flag": "net.ipv4.conf.default.accept_source_route",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable ICMP Secure redirects IPv4 for all interfaces",
|
||||
"flag": "net.ipv4.conf.all.secure_redirects",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable ICMP Secure redirects IPv4 for default interface",
|
||||
"flag": "net.ipv4.conf.default.secure_redirects",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Enable Log martian packets IPv4 for all interfaces",
|
||||
"flag": "net.ipv4.conf.all.log_martians",
|
||||
"value": 1,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Enable Log martian packets IPv4 for default interface",
|
||||
"flag": "net.ipv4.conf.default.log_martians",
|
||||
"value": 1,
|
||||
"level": "medium",
|
||||
})
|
||||
# https://lwn.net/Articles/277146/
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Enable TCP syn cookies IPv4",
|
||||
"flag": "net.ipv4.tcp_syncookies",
|
||||
"value": 1,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable IPv4 forwarding on all interfaces",
|
||||
"flag": "net.ipv4.ip_forward",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable IPv4 send redirects on all interfaces",
|
||||
"flag": "net.ipv4.conf.all.send_redirects",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable IPv4 send redirects on default interface",
|
||||
"flag": "net.ipv4.conf.default.send_redirects",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Enable IPv4 reverse path filtering on all interfaces",
|
||||
"flag": "net.ipv4.conf.all.rp_filter",
|
||||
"value": 1,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Enable IPv4 reverse path filtering on default interface",
|
||||
"flag": "net.ipv4.conf.default.rp_filter",
|
||||
"value": 1,
|
||||
"level": "medium",
|
||||
})
|
||||
|
||||
# For IPv6
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable IPvi6 forwarding",
|
||||
"flag": "net.ipv6.conf.all.forwarding",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable ICMP redirects IPv6",
|
||||
"flag": "net.ipv6.conf.all.accept_redirects",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable ICMP redirects IPv6 for default interface",
|
||||
"flag": "net.ipv6.conf.default.accept_redirects",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
# https://datatracker.ietf.org/doc/html/rfc4861
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable Route Advertisements for IPv6 for all interfaces",
|
||||
"flag": "net.ipv6.conf.all.accept_ra",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable Route Advertisements for IPv6 for default interface",
|
||||
"flag": "net.ipv6.conf.default.accept_ra",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable Accepting Source Routed for IPv6 for all interfaces",
|
||||
"flag": "net.ipv6.conf.all.accept_source_route",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable Accepting Source Routed for IPv6 for default interface",
|
||||
"flag": "net.ipv6.conf.default.accept_source_route",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable ICMP Secure redirects IPv6 for all interfaces",
|
||||
"flag": "net.ipv6.conf.all.secure_redirects",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
sysctl.append({
|
||||
"from": "cis",
|
||||
"id": "",
|
||||
"description": "Disable ICMP Secure redirects IPv6 for default interface",
|
||||
"flag": "net.ipv6.conf.default.secure_redirects",
|
||||
"value": 0,
|
||||
"level": "medium",
|
||||
})
|
||||
|
||||
|
||||
return sysctl
|
||||
Reference in New Issue
Block a user