Analyzing apache
This commit is contained in:
parent
725fe43786
commit
c21cdf3c57
@ -8,9 +8,9 @@ def apache_protocols() -> dict:
|
||||
ssl["level"] = "high"
|
||||
ssl["protocols"] = list()
|
||||
# https://httpd.apache.org/docs/trunk/ssl/ssl_howto.html
|
||||
ssl["protocols"].append("-TLSv1")
|
||||
ssl["protocols"].append("-TLSv1.1")
|
||||
ssl["protocols"].append("-SSLv3")
|
||||
ssl["protocols"].append("TLSv1")
|
||||
ssl["protocols"].append("TLSv1.1")
|
||||
ssl["protocols"].append("SSLv3")
|
||||
ssl["recommand_value"] = "SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1"
|
||||
|
||||
return ssl
|
||||
@ -20,7 +20,9 @@ def apache_signature() -> dict:
|
||||
|
||||
signature["description"] = "Disable Apache signature"
|
||||
signature["level"] = "high"
|
||||
signature['value'] = 'ServerSignature On'
|
||||
signature['signature'] = list()
|
||||
signature['signature'].append('ServerSignature On')
|
||||
signature['signature'].append('ServerTokens Prod')
|
||||
|
||||
return signature
|
||||
|
||||
@ -29,6 +31,10 @@ def apache_indexes() -> dict:
|
||||
|
||||
indexes['description'] = 'Disable files and directory indexes'
|
||||
indexes['level'] = 'medium'
|
||||
indexes['value'] = 'Options -Indexes'
|
||||
indexes['flag'] = 'Options'
|
||||
indexes['options'] = list()
|
||||
indexes['options'].append('Indexes')
|
||||
indexes['options'].append('FollowSymLinks')
|
||||
indexes['recommand_value'] = 'Options -Indexes -FollowSymLinks'
|
||||
|
||||
return indexes
|
||||
|
||||
@ -56,7 +56,7 @@ def main():
|
||||
|
||||
# Get system informations
|
||||
report['kernel'] = getKernelVersion()
|
||||
report['release'] = f"{identifySystem()} {getRelease()} ({getCodeName()}) "
|
||||
report['release'] = f"{identifySystem()} {getRelease()} {getCodeName().strip()}"
|
||||
|
||||
# Create our dispatcher
|
||||
dispatcher = Dispatcher()
|
||||
|
||||
@ -2,14 +2,14 @@
|
||||
|
||||
import re
|
||||
from os import listdir
|
||||
from os.path import isdir
|
||||
from os.path import isdir, isfile
|
||||
from audit.system.plugins.apache import apache_protocols, apache_signature, apache_indexes
|
||||
|
||||
|
||||
class Apache:
|
||||
def __init__(self, arguments):
|
||||
self._ssl_versions = apache_protocols()
|
||||
self._signature = apache_signature()
|
||||
self._signatures = apache_signature()
|
||||
self._indexes = apache_indexes()
|
||||
self._reports = dict()
|
||||
self._apache_directory = arguments["apache_directory"]
|
||||
@ -26,36 +26,42 @@ class Apache:
|
||||
# Check if the directory exist
|
||||
path = f"{self._apache_directory}"
|
||||
if isdir(path):
|
||||
self._reports['audit'] = True
|
||||
self._analyzingSslVersion()
|
||||
self._analyzingSignature()
|
||||
self._analyzingIndexes()
|
||||
else:
|
||||
self._reports['audit'] = False
|
||||
self._reports["msg"] = "No directory found"
|
||||
|
||||
print(self._reports)
|
||||
|
||||
def getReports(self) -> dict:
|
||||
return self._reports
|
||||
|
||||
################################################
|
||||
# Analyzing SSL
|
||||
################################################
|
||||
def _analyzingSslVersion(self):
|
||||
# Check if the file exist
|
||||
path = f"{self._apache_directory}/sites-available"
|
||||
if isdir(path):
|
||||
self._reports['audit'] = True
|
||||
self._reports['ssl']['audit'] = True
|
||||
count = 0
|
||||
self._reports["ssl"]["virtualhost"] = dict()
|
||||
for site in listdir(path):
|
||||
with open(f"{path}/{site}", 'rb') as f:
|
||||
self._parseFile(f)
|
||||
vh = f"{path}/{site}"
|
||||
with open(vh, 'rb') as f:
|
||||
self._parseFileFindingSsl(f, site)
|
||||
count += 1
|
||||
|
||||
if count == 0:
|
||||
self._reports['audit'] = False
|
||||
self._reports['msg'] = \
|
||||
self._reports['ssl']['audit'] = False
|
||||
self._reports['ssl']['msg'] = \
|
||||
f'No virtual host found in the directory {path}'
|
||||
else:
|
||||
self._reports['audit'] = False
|
||||
self._reports["msg"] = f"No directory {path} found"
|
||||
self._reports['ssl']['audit'] = False
|
||||
self._reports['ssl']["msg"] = f"No directory {path} found"
|
||||
|
||||
def _parseFile(self, fdata):
|
||||
def _parseFileFindingSsl(self, fdata, virtualhost):
|
||||
data = fdata.read()
|
||||
lines = data.splitlines()
|
||||
|
||||
@ -63,57 +69,208 @@ class Apache:
|
||||
line = line.decode('utf-8')
|
||||
|
||||
# check if SSL is enable for the VirtualHost
|
||||
grSSLEngine = re.search("SSLEngine on", line)
|
||||
# (?#) -> remove commentary
|
||||
# (\s) -> remove space and tabulation
|
||||
grSSLEngine = re.search(
|
||||
"(?#)(\s)SSLEngine on",
|
||||
line,
|
||||
re.IGNORECASE
|
||||
)
|
||||
if grSSLEngine:
|
||||
self._check_ssl_version(lines)
|
||||
report = self._check_ssl_version(lines)
|
||||
|
||||
def _check_ssl_version(self, lines):
|
||||
self._reports["ssl"]["virtualhost"][virtualhost] = report
|
||||
|
||||
def _check_ssl_version(self, lines) -> dict:
|
||||
report = dict()
|
||||
findProtocol = False
|
||||
protocolsFound = list()
|
||||
for line in lines:
|
||||
line = line.decode("utf-8")
|
||||
|
||||
grSSLProtocol = re.search("SSLProtocol", line)
|
||||
grSSLProtocol = re.search(
|
||||
"(?#)(\s)SSLProtocol",
|
||||
line,
|
||||
re.IGNORECASE
|
||||
)
|
||||
if grSSLProtocol:
|
||||
for protocol in self._ssl_versions["protocols"]:
|
||||
if protocol in line:
|
||||
print(line)
|
||||
grProtocol = re.search(f"-{protocol}", line)
|
||||
if grProtocol:
|
||||
protocolsFound.append(protocol)
|
||||
findProtocol = True
|
||||
|
||||
print(protocolsFound)
|
||||
|
||||
if len(self._ssl_versions) == len(protocolsFound):
|
||||
print("Success")
|
||||
if len(self._ssl_versions["protocols"]) == len(protocolsFound):
|
||||
report["result"] = "success"
|
||||
else:
|
||||
print("Failed")
|
||||
report["msg"] = list()
|
||||
report["result"] = "failed"
|
||||
for proto in self._ssl_versions["protocols"]:
|
||||
if proto not in protocolsFound:
|
||||
report["msg"].append(
|
||||
f"{proto} need to be disabled"
|
||||
)
|
||||
|
||||
if findProtocol:
|
||||
self._reports["ssl"]["result"] = "success"
|
||||
else:
|
||||
self._reports["ssl"]["result"] = "failed"
|
||||
|
||||
|
||||
self._reports["ssl"]["description"] = \
|
||||
report["description"] = \
|
||||
self._ssl_versions["description"]
|
||||
self._reports["ssl"]["level"] = self._ssl_versions["level"]
|
||||
self._reports["ssl"]["recommand_value"] = \
|
||||
report["level"] = self._ssl_versions["level"]
|
||||
report["recommand_value"] = \
|
||||
self._ssl_versions["recommand_value"]
|
||||
return report
|
||||
|
||||
def _check_value_exist(self, line, value) -> bool:
|
||||
grValue = re.search(value, line)
|
||||
if grValue:
|
||||
return True
|
||||
return False
|
||||
################################################
|
||||
# Analyzing Signature
|
||||
################################################
|
||||
def _analyzingSignature(self):
|
||||
# Check if the apache2.conf exist
|
||||
path = f"{self._apache_directory}/apache2.conf"
|
||||
if isfile(path):
|
||||
self._reports["signature"]["audit"] = True
|
||||
|
||||
with open(path, 'rb') as fdata:
|
||||
self._reports["signature"]["signature"] = \
|
||||
self._parsingApacheConfigForSignature(fdata)
|
||||
|
||||
else:
|
||||
self._reports["signature"]["audit"] = False
|
||||
self._reports["signature"]["audit"] = \
|
||||
f"The file {path} do not exist"
|
||||
|
||||
def _parsingApacheConfigForSignature(self, fdata) -> dict:
|
||||
report = dict()
|
||||
data = fdata.read()
|
||||
lines = data.splitlines()
|
||||
|
||||
for signature in self._signatures["signature"]:
|
||||
report[signature] = dict()
|
||||
|
||||
for line in lines:
|
||||
line = line.decode('utf-8')
|
||||
|
||||
for signature in self._signatures["signature"]:
|
||||
grSignature = re.search(
|
||||
f"(?#){signature}",
|
||||
line,
|
||||
re.IGNORECASE
|
||||
)
|
||||
if grSignature:
|
||||
# It's not a comment
|
||||
if '#' not in line:
|
||||
report[signature]["audit"] = True
|
||||
report[signature]["result"] = "success"
|
||||
report[signature]["description"] = self._signatures["description"]
|
||||
report[signature]["level"] = self._signatures["level"]
|
||||
|
||||
for signature in report:
|
||||
if len(report[signature]) == 0:
|
||||
report[signature]["audit"] = True
|
||||
report[signature]["result"] = "failed"
|
||||
report[signature]["recommand_value"] = signature
|
||||
report[signature]["description"] = self._signatures["description"]
|
||||
report[signature]["level"] = self._signatures["level"]
|
||||
|
||||
return report
|
||||
|
||||
################################################
|
||||
# Analyzing Indexes
|
||||
################################################
|
||||
def _analyzingIndexes(self):
|
||||
# Check if the apache2.conf exist
|
||||
path = f"{self._apache_directory}/apache2.conf"
|
||||
if isfile(path):
|
||||
self._reports["indexes"]["audit"] = True
|
||||
|
||||
with open(path, 'rb') as fdata:
|
||||
self._reports["indexes"]["indexes"] = \
|
||||
self._parsingApacheConfig(fdata)
|
||||
else:
|
||||
self._reports["indexes"]["audit"] = False
|
||||
self._reports["indexes"]["audit"] = \
|
||||
f"The file {path} do not exist"
|
||||
|
||||
def _parsingApacheConfig(self, fdata) -> dict:
|
||||
report = dict()
|
||||
report["directories"] = dict()
|
||||
data = fdata.read()
|
||||
lines = data.splitlines()
|
||||
# Each entry in the variable directories contains a list
|
||||
# of <Directory> with all data in it
|
||||
# We create another entry when a found </Directory>
|
||||
directories = list()
|
||||
directoryFound = False
|
||||
index = 0
|
||||
optsFound = list()
|
||||
|
||||
for line in lines:
|
||||
line = line.decode('utf-8')
|
||||
|
||||
# Find a <Directory
|
||||
if not directoryFound:
|
||||
grDirectory = re.search("<Directory ", line, re.IGNORECASE)
|
||||
if grDirectory:
|
||||
directoryFound = True
|
||||
directories.append(list())
|
||||
directories[index].append(line)
|
||||
else:
|
||||
#directory.append(line)
|
||||
directories[index].append(line)
|
||||
grDirectory = re.search("</Directory>", line, re.IGNORECASE)
|
||||
if grDirectory:
|
||||
directoryFound = False
|
||||
index += 1
|
||||
|
||||
# We will find if we find an indexes option
|
||||
for d in directories:
|
||||
for entry in d:
|
||||
# We get the directory path
|
||||
grDirectory = re.search(
|
||||
f"<Directory",
|
||||
entry,
|
||||
re.IGNORECASE
|
||||
)
|
||||
if grDirectory:
|
||||
path = entry.replace("<Directory", "")
|
||||
path = path.replace(">", "")
|
||||
path = path.replace("\"", "")
|
||||
report["directories"][path] = dict()
|
||||
|
||||
# Try to find the Option flag
|
||||
grFlag = re.search(
|
||||
f"{self._indexes['flag']}",
|
||||
entry,
|
||||
re.IGNORECASE
|
||||
)
|
||||
if grFlag:
|
||||
for opt in self._indexes['options']:
|
||||
grOption = re.search(
|
||||
f"-{opt}",
|
||||
entry,
|
||||
re.IGNORECASE
|
||||
)
|
||||
if grOption:
|
||||
optsFound.append(opt)
|
||||
#print(d[0])
|
||||
|
||||
report["audit"] = True
|
||||
report["options"] = dict()
|
||||
if len(optsFound) == len(self._indexes['options']):
|
||||
report["result"] = "success"
|
||||
else:
|
||||
report["result"] = "failed"
|
||||
for opt in self._indexes["options"]:
|
||||
if opt not in optsFound:
|
||||
report["options"][opt] = f"{opt} is not removed. You should disable it"
|
||||
|
||||
report["description"] = self._indexes["description"]
|
||||
report["level"] = self._indexes["level"]
|
||||
report["recommand_value"] = self._indexes["recommand_value"]
|
||||
print(report)
|
||||
return report
|
||||
|
||||
def _constructReports(self):
|
||||
"""
|
||||
Construct dictionary for result of the tests
|
||||
Each entry contains:
|
||||
Key:
|
||||
- filename: filename of the test
|
||||
- line: line of the test
|
||||
- parse: Display the line where the vulnerabilites has been found
|
||||
- description: description of the vulnerability
|
||||
- level: high, medium or low
|
||||
"""
|
||||
|
||||
@ -38,15 +38,31 @@ def generateHtmlReport(data):
|
||||
_generateAccordion(dataJinja2['sysctl']['file']['sysctl'], 'sysctl')
|
||||
|
||||
if 'apache' in data['system']:
|
||||
dataJinja2['apache'] = data['system']['apache']
|
||||
|
||||
if data['system']['apache']['audit']:
|
||||
dataJinja2['apache'] = data['system']['apache']
|
||||
else:
|
||||
dataJinja2['apache'] = data['system']['apache']
|
||||
if data['system']['apache']['ssl']['audit']:
|
||||
_generateAccordion(
|
||||
dataJinja2["apache"]["ssl"]["virtualhost"],
|
||||
"apache-virtualhost"
|
||||
)
|
||||
if data['system']['apache']['signature']['audit']:
|
||||
print(dataJinja2['apache']['signature'])
|
||||
_generateAccordion(
|
||||
dataJinja2["apache"]["signature"]["signature"],
|
||||
"apache-signature"
|
||||
)
|
||||
print("")
|
||||
if data['system']['apache']['indexes']['audit']:
|
||||
print(dataJinja2['apache']['indexes'])
|
||||
_generateAccordion(
|
||||
dataJinja2["apache"]["indexes"]["indexes"],
|
||||
"apache-indexes"
|
||||
)
|
||||
|
||||
if 'localaccount' in data['system']:
|
||||
if 'profile' in data['system']['localaccount']:
|
||||
dataJinja2['profile'] = dict()
|
||||
#dataJinja2['profile']['level'] = data['system']['localaccount']['profile']['level']
|
||||
dataJinja2['profile']['filename'] = data['system']['localaccount']['profile']['filename']
|
||||
dataJinja2['profile']['vulnerabilities'] = data['system']['localaccount']['profile']['vulnerabilities']
|
||||
|
||||
|
||||
555
httpd.conf
Normal file
555
httpd.conf
Normal file
@ -0,0 +1,555 @@
|
||||
#
|
||||
# This is the main Apache HTTP server configuration file. It contains the
|
||||
# configuration directives that give the server its instructions.
|
||||
# See <URL:http://httpd.apache.org/docs/2.4/> for detailed information.
|
||||
# In particular, see
|
||||
# <URL:http://httpd.apache.org/docs/2.4/mod/directives.html>
|
||||
# for a discussion of each configuration directive.
|
||||
#
|
||||
# Do NOT simply read the instructions in here without understanding
|
||||
# what they do. They're here only as hints or reminders. If you are unsure
|
||||
# consult the online docs. You have been warned.
|
||||
#
|
||||
# Configuration and logfile names: If the filenames you specify for many
|
||||
# of the server's control files begin with "/" (or "drive:/" for Win32), the
|
||||
# server will use that explicit path. If the filenames do *not* begin
|
||||
# with "/", the value of ServerRoot is prepended -- so "logs/access_log"
|
||||
# with ServerRoot set to "/usr/local/apache2" will be interpreted by the
|
||||
# server as "/usr/local/apache2/logs/access_log", whereas "/logs/access_log"
|
||||
# will be interpreted as '/logs/access_log'.
|
||||
ServerSignature off
|
||||
#ServerSignature on
|
||||
ServerTokens Full
|
||||
#ServerTokens Prod
|
||||
#
|
||||
# ServerRoot: The top of the directory tree under which the server's
|
||||
# configuration, error, and log files are kept.
|
||||
#
|
||||
# Do not add a slash at the end of the directory path. If you point
|
||||
# ServerRoot at a non-local disk, be sure to specify a local disk on the
|
||||
# Mutex directive, if file-based mutexes are used. If you wish to share the
|
||||
# same ServerRoot for multiple httpd daemons, you will need to change at
|
||||
# least PidFile.
|
||||
#
|
||||
ServerRoot "/usr/local/apache2"
|
||||
|
||||
#
|
||||
# Mutex: Allows you to set the mutex mechanism and mutex file directory
|
||||
# for individual mutexes, or change the global defaults
|
||||
#
|
||||
# Uncomment and change the directory if mutexes are file-based and the default
|
||||
# mutex file directory is not on a local disk or is not appropriate for some
|
||||
# other reason.
|
||||
#
|
||||
# Mutex default:logs
|
||||
|
||||
#
|
||||
# Listen: Allows you to bind Apache to specific IP addresses and/or
|
||||
# ports, instead of the default. See also the <VirtualHost>
|
||||
# directive.
|
||||
#
|
||||
# Change this to Listen on specific IP addresses as shown below to
|
||||
# prevent Apache from glomming onto all bound IP addresses.
|
||||
#
|
||||
#Listen 12.34.56.78:80
|
||||
Listen 80
|
||||
|
||||
#
|
||||
# Dynamic Shared Object (DSO) Support
|
||||
#
|
||||
# To be able to use the functionality of a module which was built as a DSO you
|
||||
# have to place corresponding `LoadModule' lines at this location so the
|
||||
# directives contained in it are actually available _before_ they are used.
|
||||
# Statically compiled modules (those listed by `httpd -l') do not need
|
||||
# to be loaded here.
|
||||
#
|
||||
# Example:
|
||||
# LoadModule foo_module modules/mod_foo.so
|
||||
#
|
||||
LoadModule mpm_event_module modules/mod_mpm_event.so
|
||||
#LoadModule mpm_prefork_module modules/mod_mpm_prefork.so
|
||||
#LoadModule mpm_worker_module modules/mod_mpm_worker.so
|
||||
LoadModule authn_file_module modules/mod_authn_file.so
|
||||
#LoadModule authn_dbm_module modules/mod_authn_dbm.so
|
||||
#LoadModule authn_anon_module modules/mod_authn_anon.so
|
||||
#LoadModule authn_dbd_module modules/mod_authn_dbd.so
|
||||
#LoadModule authn_socache_module modules/mod_authn_socache.so
|
||||
LoadModule authn_core_module modules/mod_authn_core.so
|
||||
LoadModule authz_host_module modules/mod_authz_host.so
|
||||
LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
|
||||
LoadModule authz_user_module modules/mod_authz_user.so
|
||||
#LoadModule authz_dbm_module modules/mod_authz_dbm.so
|
||||
#LoadModule authz_owner_module modules/mod_authz_owner.so
|
||||
#LoadModule authz_dbd_module modules/mod_authz_dbd.so
|
||||
LoadModule authz_core_module modules/mod_authz_core.so
|
||||
#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
|
||||
#LoadModule authnz_fcgi_module modules/mod_authnz_fcgi.so
|
||||
LoadModule access_compat_module modules/mod_access_compat.so
|
||||
LoadModule auth_basic_module modules/mod_auth_basic.so
|
||||
#LoadModule auth_form_module modules/mod_auth_form.so
|
||||
#LoadModule auth_digest_module modules/mod_auth_digest.so
|
||||
#LoadModule allowmethods_module modules/mod_allowmethods.so
|
||||
#LoadModule isapi_module modules/mod_isapi.so
|
||||
#LoadModule file_cache_module modules/mod_file_cache.so
|
||||
#LoadModule cache_module modules/mod_cache.so
|
||||
#LoadModule cache_disk_module modules/mod_cache_disk.so
|
||||
#LoadModule cache_socache_module modules/mod_cache_socache.so
|
||||
#LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
|
||||
#LoadModule socache_dbm_module modules/mod_socache_dbm.so
|
||||
#LoadModule socache_memcache_module modules/mod_socache_memcache.so
|
||||
#LoadModule socache_redis_module modules/mod_socache_redis.so
|
||||
#LoadModule watchdog_module modules/mod_watchdog.so
|
||||
#LoadModule macro_module modules/mod_macro.so
|
||||
#LoadModule dbd_module modules/mod_dbd.so
|
||||
#LoadModule bucketeer_module modules/mod_bucketeer.so
|
||||
#LoadModule dumpio_module modules/mod_dumpio.so
|
||||
#LoadModule echo_module modules/mod_echo.so
|
||||
#LoadModule example_hooks_module modules/mod_example_hooks.so
|
||||
#LoadModule case_filter_module modules/mod_case_filter.so
|
||||
#LoadModule case_filter_in_module modules/mod_case_filter_in.so
|
||||
#LoadModule example_ipc_module modules/mod_example_ipc.so
|
||||
#LoadModule buffer_module modules/mod_buffer.so
|
||||
#LoadModule data_module modules/mod_data.so
|
||||
#LoadModule ratelimit_module modules/mod_ratelimit.so
|
||||
LoadModule reqtimeout_module modules/mod_reqtimeout.so
|
||||
#LoadModule ext_filter_module modules/mod_ext_filter.so
|
||||
#LoadModule request_module modules/mod_request.so
|
||||
#LoadModule include_module modules/mod_include.so
|
||||
LoadModule filter_module modules/mod_filter.so
|
||||
#LoadModule reflector_module modules/mod_reflector.so
|
||||
#LoadModule substitute_module modules/mod_substitute.so
|
||||
#LoadModule sed_module modules/mod_sed.so
|
||||
#LoadModule charset_lite_module modules/mod_charset_lite.so
|
||||
#LoadModule deflate_module modules/mod_deflate.so
|
||||
#LoadModule xml2enc_module modules/mod_xml2enc.so
|
||||
#LoadModule proxy_html_module modules/mod_proxy_html.so
|
||||
#LoadModule brotli_module modules/mod_brotli.so
|
||||
LoadModule mime_module modules/mod_mime.so
|
||||
#LoadModule ldap_module modules/mod_ldap.so
|
||||
LoadModule log_config_module modules/mod_log_config.so
|
||||
#LoadModule log_debug_module modules/mod_log_debug.so
|
||||
#LoadModule log_forensic_module modules/mod_log_forensic.so
|
||||
#LoadModule logio_module modules/mod_logio.so
|
||||
#LoadModule lua_module modules/mod_lua.so
|
||||
LoadModule env_module modules/mod_env.so
|
||||
#LoadModule mime_magic_module modules/mod_mime_magic.so
|
||||
#LoadModule cern_meta_module modules/mod_cern_meta.so
|
||||
#LoadModule expires_module modules/mod_expires.so
|
||||
LoadModule headers_module modules/mod_headers.so
|
||||
#LoadModule ident_module modules/mod_ident.so
|
||||
#LoadModule usertrack_module modules/mod_usertrack.so
|
||||
#LoadModule unique_id_module modules/mod_unique_id.so
|
||||
LoadModule setenvif_module modules/mod_setenvif.so
|
||||
LoadModule version_module modules/mod_version.so
|
||||
#LoadModule remoteip_module modules/mod_remoteip.so
|
||||
#LoadModule proxy_module modules/mod_proxy.so
|
||||
#LoadModule proxy_connect_module modules/mod_proxy_connect.so
|
||||
#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
|
||||
#LoadModule proxy_http_module modules/mod_proxy_http.so
|
||||
#LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
|
||||
#LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
|
||||
#LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so
|
||||
#LoadModule proxy_fdpass_module modules/mod_proxy_fdpass.so
|
||||
#LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
|
||||
#LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
|
||||
#LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
|
||||
#LoadModule proxy_express_module modules/mod_proxy_express.so
|
||||
#LoadModule proxy_hcheck_module modules/mod_proxy_hcheck.so
|
||||
#LoadModule session_module modules/mod_session.so
|
||||
#LoadModule session_cookie_module modules/mod_session_cookie.so
|
||||
#LoadModule session_crypto_module modules/mod_session_crypto.so
|
||||
#LoadModule session_dbd_module modules/mod_session_dbd.so
|
||||
#LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
|
||||
#LoadModule slotmem_plain_module modules/mod_slotmem_plain.so
|
||||
#LoadModule ssl_module modules/mod_ssl.so
|
||||
#LoadModule optional_hook_export_module modules/mod_optional_hook_export.so
|
||||
#LoadModule optional_hook_import_module modules/mod_optional_hook_import.so
|
||||
#LoadModule optional_fn_import_module modules/mod_optional_fn_import.so
|
||||
#LoadModule optional_fn_export_module modules/mod_optional_fn_export.so
|
||||
#LoadModule dialup_module modules/mod_dialup.so
|
||||
#LoadModule http2_module modules/mod_http2.so
|
||||
#LoadModule proxy_http2_module modules/mod_proxy_http2.so
|
||||
#LoadModule md_module modules/mod_md.so
|
||||
#LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
|
||||
#LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
|
||||
#LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
|
||||
#LoadModule lbmethod_heartbeat_module modules/mod_lbmethod_heartbeat.so
|
||||
LoadModule unixd_module modules/mod_unixd.so
|
||||
#LoadModule heartbeat_module modules/mod_heartbeat.so
|
||||
#LoadModule heartmonitor_module modules/mod_heartmonitor.so
|
||||
#LoadModule dav_module modules/mod_dav.so
|
||||
LoadModule status_module modules/mod_status.so
|
||||
LoadModule autoindex_module modules/mod_autoindex.so
|
||||
#LoadModule asis_module modules/mod_asis.so
|
||||
#LoadModule info_module modules/mod_info.so
|
||||
#LoadModule suexec_module modules/mod_suexec.so
|
||||
<IfModule !mpm_prefork_module>
|
||||
#LoadModule cgid_module modules/mod_cgid.so
|
||||
</IfModule>
|
||||
<IfModule mpm_prefork_module>
|
||||
#LoadModule cgi_module modules/mod_cgi.so
|
||||
</IfModule>
|
||||
#LoadModule dav_fs_module modules/mod_dav_fs.so
|
||||
#LoadModule dav_lock_module modules/mod_dav_lock.so
|
||||
#LoadModule vhost_alias_module modules/mod_vhost_alias.so
|
||||
#LoadModule negotiation_module modules/mod_negotiation.so
|
||||
LoadModule dir_module modules/mod_dir.so
|
||||
#LoadModule imagemap_module modules/mod_imagemap.so
|
||||
#LoadModule actions_module modules/mod_actions.so
|
||||
#LoadModule speling_module modules/mod_speling.so
|
||||
#LoadModule userdir_module modules/mod_userdir.so
|
||||
LoadModule alias_module modules/mod_alias.so
|
||||
#LoadModule rewrite_module modules/mod_rewrite.so
|
||||
|
||||
<IfModule unixd_module>
|
||||
#
|
||||
# If you wish httpd to run as a different user or group, you must run
|
||||
# httpd as root initially and it will switch.
|
||||
#
|
||||
# User/Group: The name (or #number) of the user/group to run httpd as.
|
||||
# It is usually good practice to create a dedicated user and group for
|
||||
# running httpd, as with most system services.
|
||||
#
|
||||
User www-data
|
||||
Group www-data
|
||||
|
||||
</IfModule>
|
||||
|
||||
# 'Main' server configuration
|
||||
#
|
||||
# The directives in this section set up the values used by the 'main'
|
||||
# server, which responds to any requests that aren't handled by a
|
||||
# <VirtualHost> definition. These values also provide defaults for
|
||||
# any <VirtualHost> containers you may define later in the file.
|
||||
#
|
||||
# All of these directives may appear inside <VirtualHost> containers,
|
||||
# in which case these default settings will be overridden for the
|
||||
# virtual host being defined.
|
||||
#
|
||||
|
||||
#
|
||||
# ServerAdmin: Your address, where problems with the server should be
|
||||
# e-mailed. This address appears on some server-generated pages, such
|
||||
# as error documents. e.g. admin@your-domain.com
|
||||
#
|
||||
ServerAdmin you@example.com
|
||||
|
||||
#
|
||||
# ServerName gives the name and port that the server uses to identify itself.
|
||||
# This can often be determined automatically, but we recommend you specify
|
||||
# it explicitly to prevent problems during startup.
|
||||
#
|
||||
# If your host doesn't have a registered DNS name, enter its IP address here.
|
||||
#
|
||||
#ServerName www.example.com:80
|
||||
|
||||
#
|
||||
# Deny access to the entirety of your server's filesystem. You must
|
||||
# explicitly permit access to web content directories in other
|
||||
# <Directory> blocks below.
|
||||
#
|
||||
<Directory />
|
||||
AllowOverride none
|
||||
Options -Indexes
|
||||
Require all denied
|
||||
</Directory>
|
||||
|
||||
#
|
||||
# Note that from this point forward you must specifically allow
|
||||
# particular features to be enabled - so if something's not working as
|
||||
# you might expect, make sure that you have specifically enabled it
|
||||
# below.
|
||||
#
|
||||
|
||||
#
|
||||
# DocumentRoot: The directory out of which you will serve your
|
||||
# documents. By default, all requests are taken from this directory, but
|
||||
# symbolic links and aliases may be used to point to other locations.
|
||||
#
|
||||
DocumentRoot "/usr/local/apache2/htdocs"
|
||||
<Directory "/usr/local/apache2/htdocs">
|
||||
#
|
||||
# Possible values for the Options directive are "None", "All",
|
||||
# or any combination of:
|
||||
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
|
||||
#
|
||||
# Note that "MultiViews" must be named *explicitly* --- "Options All"
|
||||
# doesn't give it to you.
|
||||
#
|
||||
# The Options directive is both complicated and important. Please see
|
||||
# http://httpd.apache.org/docs/2.4/mod/core.html#options
|
||||
# for more information.
|
||||
#
|
||||
Options -Indexes -FollowSymLinks
|
||||
|
||||
#
|
||||
# AllowOverride controls what directives may be placed in .htaccess files.
|
||||
# It can be "All", "None", or any combination of the keywords:
|
||||
# AllowOverride FileInfo AuthConfig Limit
|
||||
#
|
||||
AllowOverride None
|
||||
|
||||
#
|
||||
# Controls who can get stuff from this server.
|
||||
#
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
#
|
||||
# DirectoryIndex: sets the file that Apache will serve if a directory
|
||||
# is requested.
|
||||
#
|
||||
<IfModule dir_module>
|
||||
DirectoryIndex index.html
|
||||
</IfModule>
|
||||
|
||||
#
|
||||
# The following lines prevent .htaccess and .htpasswd files from being
|
||||
# viewed by Web clients.
|
||||
#
|
||||
<Files ".ht*">
|
||||
Require all denied
|
||||
</Files>
|
||||
|
||||
#
|
||||
# ErrorLog: The location of the error log file.
|
||||
# If you do not specify an ErrorLog directive within a <VirtualHost>
|
||||
# container, error messages relating to that virtual host will be
|
||||
# logged here. If you *do* define an error logfile for a <VirtualHost>
|
||||
# container, that host's errors will be logged there and not here.
|
||||
#
|
||||
ErrorLog /proc/self/fd/2
|
||||
|
||||
#
|
||||
# LogLevel: Control the number of messages logged to the error_log.
|
||||
# Possible values include: debug, info, notice, warn, error, crit,
|
||||
# alert, emerg.
|
||||
#
|
||||
LogLevel warn
|
||||
|
||||
<IfModule log_config_module>
|
||||
#
|
||||
# The following directives define some format nicknames for use with
|
||||
# a CustomLog directive (see below).
|
||||
#
|
||||
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
|
||||
LogFormat "%h %l %u %t \"%r\" %>s %b" common
|
||||
|
||||
<IfModule logio_module>
|
||||
# You need to enable mod_logio.c to use %I and %O
|
||||
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
|
||||
</IfModule>
|
||||
|
||||
#
|
||||
# The location and format of the access logfile (Common Logfile Format).
|
||||
# If you do not define any access logfiles within a <VirtualHost>
|
||||
# container, they will be logged here. Contrariwise, if you *do*
|
||||
# define per-<VirtualHost> access logfiles, transactions will be
|
||||
# logged therein and *not* in this file.
|
||||
#
|
||||
CustomLog /proc/self/fd/1 common
|
||||
|
||||
#
|
||||
# If you prefer a logfile with access, agent, and referer information
|
||||
# (Combined Logfile Format) you can use the following directive.
|
||||
#
|
||||
#CustomLog "logs/access_log" combined
|
||||
</IfModule>
|
||||
|
||||
<IfModule alias_module>
|
||||
#
|
||||
# Redirect: Allows you to tell clients about documents that used to
|
||||
# exist in your server's namespace, but do not anymore. The client
|
||||
# will make a new request for the document at its new location.
|
||||
# Example:
|
||||
# Redirect permanent /foo http://www.example.com/bar
|
||||
|
||||
#
|
||||
# Alias: Maps web paths into filesystem paths and is used to
|
||||
# access content that does not live under the DocumentRoot.
|
||||
# Example:
|
||||
# Alias /webpath /full/filesystem/path
|
||||
#
|
||||
# If you include a trailing / on /webpath then the server will
|
||||
# require it to be present in the URL. You will also likely
|
||||
# need to provide a <Directory> section to allow access to
|
||||
# the filesystem path.
|
||||
|
||||
#
|
||||
# ScriptAlias: This controls which directories contain server scripts.
|
||||
# ScriptAliases are essentially the same as Aliases, except that
|
||||
# documents in the target directory are treated as applications and
|
||||
# run by the server when requested rather than as documents sent to the
|
||||
# client. The same rules about trailing "/" apply to ScriptAlias
|
||||
# directives as to Alias.
|
||||
#
|
||||
ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"
|
||||
|
||||
</IfModule>
|
||||
|
||||
<IfModule cgid_module>
|
||||
#
|
||||
# ScriptSock: On threaded servers, designate the path to the UNIX
|
||||
# socket used to communicate with the CGI daemon of mod_cgid.
|
||||
#
|
||||
#Scriptsock cgisock
|
||||
</IfModule>
|
||||
|
||||
#
|
||||
# "/usr/local/apache2/cgi-bin" should be changed to whatever your ScriptAliased
|
||||
# CGI directory exists, if you have that configured.
|
||||
#
|
||||
<Directory "/usr/local/apache2/cgi-bin">
|
||||
AllowOverride None
|
||||
Options None
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
<IfModule headers_module>
|
||||
#
|
||||
# Avoid passing HTTP_PROXY environment to CGI's on this or any proxied
|
||||
# backend servers which have lingering "httpoxy" defects.
|
||||
# 'Proxy' request header is undefined by the IETF, not listed by IANA
|
||||
#
|
||||
RequestHeader unset Proxy early
|
||||
</IfModule>
|
||||
|
||||
<IfModule mime_module>
|
||||
#
|
||||
# TypesConfig points to the file containing the list of mappings from
|
||||
# filename extension to MIME-type.
|
||||
#
|
||||
TypesConfig conf/mime.types
|
||||
|
||||
#
|
||||
# AddType allows you to add to or override the MIME configuration
|
||||
# file specified in TypesConfig for specific file types.
|
||||
#
|
||||
#AddType application/x-gzip .tgz
|
||||
#
|
||||
# AddEncoding allows you to have certain browsers uncompress
|
||||
# information on the fly. Note: Not all browsers support this.
|
||||
#
|
||||
#AddEncoding x-compress .Z
|
||||
#AddEncoding x-gzip .gz .tgz
|
||||
#
|
||||
# If the AddEncoding directives above are commented-out, then you
|
||||
# probably should define those extensions to indicate media types:
|
||||
#
|
||||
AddType application/x-compress .Z
|
||||
AddType application/x-gzip .gz .tgz
|
||||
|
||||
#
|
||||
# AddHandler allows you to map certain file extensions to "handlers":
|
||||
# actions unrelated to filetype. These can be either built into the server
|
||||
# or added with the Action directive (see below)
|
||||
#
|
||||
# To use CGI scripts outside of ScriptAliased directories:
|
||||
# (You will also need to add "ExecCGI" to the "Options" directive.)
|
||||
#
|
||||
#AddHandler cgi-script .cgi
|
||||
|
||||
# For type maps (negotiated resources):
|
||||
#AddHandler type-map var
|
||||
|
||||
#
|
||||
# Filters allow you to process content before it is sent to the client.
|
||||
#
|
||||
# To parse .shtml files for server-side includes (SSI):
|
||||
# (You will also need to add "Includes" to the "Options" directive.)
|
||||
#
|
||||
#AddType text/html .shtml
|
||||
#AddOutputFilter INCLUDES .shtml
|
||||
</IfModule>
|
||||
|
||||
#
|
||||
# The mod_mime_magic module allows the server to use various hints from the
|
||||
# contents of the file itself to determine its type. The MIMEMagicFile
|
||||
# directive tells the module where the hint definitions are located.
|
||||
#
|
||||
#MIMEMagicFile conf/magic
|
||||
|
||||
#
|
||||
# Customizable error responses come in three flavors:
|
||||
# 1) plain text 2) local redirects 3) external redirects
|
||||
#
|
||||
# Some examples:
|
||||
#ErrorDocument 500 "The server made a boo boo."
|
||||
#ErrorDocument 404 /missing.html
|
||||
#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
|
||||
#ErrorDocument 402 http://www.example.com/subscription_info.html
|
||||
#
|
||||
|
||||
#
|
||||
# MaxRanges: Maximum number of Ranges in a request before
|
||||
# returning the entire resource, or one of the special
|
||||
# values 'default', 'none' or 'unlimited'.
|
||||
# Default setting is to accept 200 Ranges.
|
||||
#MaxRanges unlimited
|
||||
|
||||
#
|
||||
# EnableMMAP and EnableSendfile: On systems that support it,
|
||||
# memory-mapping or the sendfile syscall may be used to deliver
|
||||
# files. This usually improves server performance, but must
|
||||
# be turned off when serving from networked-mounted
|
||||
# filesystems or if support for these functions is otherwise
|
||||
# broken on your system.
|
||||
# Defaults: EnableMMAP On, EnableSendfile Off
|
||||
#
|
||||
#EnableMMAP off
|
||||
#EnableSendfile on
|
||||
|
||||
# Supplemental configuration
|
||||
#
|
||||
# The configuration files in the conf/extra/ directory can be
|
||||
# included to add extra features or to modify the default configuration of
|
||||
# the server, or you may simply copy their contents here and change as
|
||||
# necessary.
|
||||
|
||||
# Server-pool management (MPM specific)
|
||||
#Include conf/extra/httpd-mpm.conf
|
||||
|
||||
# Multi-language error messages
|
||||
#Include conf/extra/httpd-multilang-errordoc.conf
|
||||
|
||||
# Fancy directory listings
|
||||
#Include conf/extra/httpd-autoindex.conf
|
||||
|
||||
# Language settings
|
||||
#Include conf/extra/httpd-languages.conf
|
||||
|
||||
# User home directories
|
||||
#Include conf/extra/httpd-userdir.conf
|
||||
|
||||
# Real-time info on requests and configuration
|
||||
#Include conf/extra/httpd-info.conf
|
||||
|
||||
# Virtual hosts
|
||||
#Include conf/extra/httpd-vhosts.conf
|
||||
|
||||
# Local access to the Apache HTTP Server Manual
|
||||
#Include conf/extra/httpd-manual.conf
|
||||
|
||||
# Distributed authoring and versioning (WebDAV)
|
||||
#Include conf/extra/httpd-dav.conf
|
||||
|
||||
# Various default settings
|
||||
#Include conf/extra/httpd-default.conf
|
||||
|
||||
# Configure mod_proxy_html to understand HTML4/XHTML1
|
||||
<IfModule proxy_html_module>
|
||||
Include conf/extra/proxy-html.conf
|
||||
</IfModule>
|
||||
|
||||
# Secure (SSL/TLS) connections
|
||||
#Include conf/extra/httpd-ssl.conf
|
||||
#
|
||||
# Note: The following must must be present to support
|
||||
# starting without SSL on platforms with no /dev/random equivalent
|
||||
# but a statically compiled-in mod_ssl.
|
||||
#
|
||||
<IfModule ssl_module>
|
||||
SSLRandomSeed startup builtin
|
||||
SSLRandomSeed connect builtin
|
||||
</IfModule>
|
||||
|
||||
35
issues.py
35
issues.py
@ -1,35 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
class Issues:
|
||||
OS = ['Debian', 'Ubuntu', 'Redhat']
|
||||
CATEGORY = ['cve', 'cis']
|
||||
|
||||
def __init__(self, alias, os, severity, priority, component, description, category):
|
||||
self._alias = alias # CVE-xxxx-yyyy
|
||||
self._os = os
|
||||
self._severity = severity
|
||||
self._priority = priority
|
||||
self._component = component
|
||||
self._description = description
|
||||
self._category = category
|
||||
|
||||
def getAlias(self) -> str:
|
||||
return self._alias
|
||||
|
||||
def getOs(self) -> str:
|
||||
return self._os
|
||||
|
||||
def getSeverity(self) -> str:
|
||||
return self._severity
|
||||
|
||||
def getPriority(self) -> str:
|
||||
return self._priority
|
||||
|
||||
def getComponent(self) -> str:
|
||||
return self._component
|
||||
|
||||
def getDescription(self) -> str:
|
||||
return self._description
|
||||
|
||||
def getCategory(self) -> str:
|
||||
return self._category
|
||||
118
old_main.py
118
old_main.py
@ -1,118 +0,0 @@
|
||||
# coding: utf-8
|
||||
|
||||
import re
|
||||
from os import path
|
||||
from subprocess import call, check_output, run
|
||||
|
||||
|
||||
# 3 levels to tests: low, medium anh high
|
||||
CHECKSLIST = {}
|
||||
|
||||
# TIPS
|
||||
# https://www.process.st/server-security/
|
||||
|
||||
def identifySystem():
|
||||
os = None
|
||||
with open('/etc/issue', 'r') as f:
|
||||
line = f.readline()
|
||||
if re.search('Arch Linux', line):
|
||||
os = 'ARCHLINUX'
|
||||
elif re.search('Ubuntu', line):
|
||||
os = 'UBUNTU'
|
||||
elif re.search('Debian', line):
|
||||
os = 'DEBIAN'
|
||||
else:
|
||||
os = 'UNKNOWN'
|
||||
|
||||
return os
|
||||
|
||||
def check_upgrade_packages():
|
||||
pass
|
||||
|
||||
def check_telnet_is_open():
|
||||
# check port 23 is listening
|
||||
r = run(['ss', '-atn'], capture_output=True)
|
||||
r = r.stdout.decode()
|
||||
print(r)
|
||||
|
||||
def check_empty_local_passwords():
|
||||
pass
|
||||
|
||||
def check_security_access():
|
||||
# Check in /etc/security/access
|
||||
pass
|
||||
|
||||
def check_hosts_allow():
|
||||
# Check in /etc/hosts.allow
|
||||
pass
|
||||
|
||||
def check_sshd_root():
|
||||
res = False
|
||||
|
||||
if not path.exists("/etc/ssh/sshd_config"):
|
||||
print("File sshd_config doesn't exist")
|
||||
return False
|
||||
|
||||
with open("/etc/ssh/sshd_config", "r") as f:
|
||||
for l in f.readlines():
|
||||
l = l.replace('\n', '')
|
||||
if re.search("PermitRootLogin.*root", l):
|
||||
if not re.search("^#", l):
|
||||
res = True
|
||||
return res
|
||||
|
||||
def generateChecksList():
|
||||
# LOW
|
||||
CHECKSLIST['low'] = []
|
||||
CHECKSLIST['low'].append({
|
||||
'callback': check_sshd_root,
|
||||
'name': check_sshd_root.__name__,
|
||||
'resolution': 'Please, remove root auth to your server',
|
||||
'score': 100
|
||||
})
|
||||
CHECKSLIST['low'].append({
|
||||
'callback': check_upgrade_packages,
|
||||
'name': check_upgrade_packages.__name__,
|
||||
'resolution': 'Please, upgrade your packages',
|
||||
'score': 50
|
||||
})
|
||||
CHECKSLIST['low'].append({
|
||||
'callback': check_telnet_is_open,
|
||||
'name': check_telnet_is_open.__name__,
|
||||
'resolution': 'Telnet is enabled. Please, disabled this program if you could.',
|
||||
'score': 50
|
||||
})
|
||||
# MEDIUM
|
||||
CHECKSLIST['medium'] = {}
|
||||
# HIGH
|
||||
CHECKSLIST['high'] = {}
|
||||
|
||||
def getTotalScore():
|
||||
score = 0
|
||||
for entry in CHECKSLIST['low']:
|
||||
score += entry['score']
|
||||
|
||||
return score
|
||||
|
||||
def main():
|
||||
# Generate our checklist
|
||||
generateChecksList()
|
||||
|
||||
# Get total score
|
||||
totalScore = getTotalScore()
|
||||
|
||||
# Identify system
|
||||
identifySystem()
|
||||
|
||||
score = totalScore
|
||||
for entry in CHECKSLIST['low']:
|
||||
print(f'Checking {entry["name"]}...')
|
||||
res = entry['callback']()
|
||||
if res:
|
||||
print(entry['resolution'])
|
||||
score -= entry['score']
|
||||
|
||||
print(f'Your total score: {score}')
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
48
reports/templates/apache-indexes.html.j2
Normal file
48
reports/templates/apache-indexes.html.j2
Normal file
@ -0,0 +1,48 @@
|
||||
{% if data["apache"]["indexes"]["audit"] %}
|
||||
{% for item in data['apache']['indexes']['indexes'] %}
|
||||
<div class="accordion" id="accordionApacheIndexes">
|
||||
<div class="accordion-item">
|
||||
<h2 class="accordion-header">
|
||||
<button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#{{ data['apache']['indexes']['indexes'][item]['accordion-id'] }}" aria-expanded="true" aria-controls="{{ data['apache']['indexes']['indexes'][item]['accordion-id'] }}">
|
||||
<strong>VirtualHost {{ item }}</strong>
|
||||
{% if data['apache']['indexes']['indexes'][item]['result'] == 'failed' %}
|
||||
<span class="text-bg-danger p-1" style="padding-left:10pt;padding-right:10pt;margin-left:15pt;">{{ data['apache']['indexes']['indexes'][item]['result'] }}</span>
|
||||
{% elif data['apache']['indexes']['indexes'][item]['result'] == 'success' %}
|
||||
<span class="text-bg-success p-1" style="padding-left:10pt;padding-right:10pt;margin-left:15pt;">{{ data['apache']['indexes']['indexes'][item]['result'] }}</span>
|
||||
{% endif %}
|
||||
<span class="text-bg-primary p-1" style="padding-left:10pt;padding-right:10pt;margin-left:15pt;">{{ data['apache']['indexes']['indexes'][item]['level'] }}</span>
|
||||
</button>
|
||||
</h2>
|
||||
<div id="{{ data['apache']['indexes']['indexes'][item]['accordion-id'] }}" class="accordion-collapse collapse" data-bs-parent="#accordionApache">
|
||||
<div class="accordion-body">
|
||||
{{ data['apache']['indexes']['indexes'][item]['description'] }}. <br />
|
||||
{% if data['apache']['indexes']['indexes'][item]['result'] == 'failed' %}
|
||||
Result of the audit:
|
||||
<div class="bd-example-snippet bd-code-snippet">
|
||||
<div class="highlight">
|
||||
<pre tabindex="0" class="chroma"><code class="language-shell">
|
||||
{% for protocol in data['apache']['indexes']['indexes'][item]['msg'] %}
|
||||
{{ protocol }}
|
||||
{% endfor %}
|
||||
</pre></code>
|
||||
</div> <!-- end .highlight -->
|
||||
</div> <!-- end .bd-code-snippet -->
|
||||
|
||||
For resolving the issue, add this line in the VirtualHost file:
|
||||
<div class="bd-example-snippet bd-code-snippet">
|
||||
<div class="highlight">
|
||||
<pre tabindex="0" class="chroma"><code class="language-shell">
|
||||
{{ data['apache']['indexes']['indexes'][item]['recommand_value'] }}
|
||||
</pre></code>
|
||||
</div> <!-- end .highlight -->
|
||||
</div> <!-- end .bd-code-snippet -->
|
||||
{% endif %}
|
||||
|
||||
</div> <!-- end .accordion-body -->
|
||||
</div> <!-- end .accordion-collapse -->
|
||||
</div> <!-- end .accordion-item -->
|
||||
</div> <!-- end .accordion -->
|
||||
{% endfor %}
|
||||
{% else %}
|
||||
{{ data['apache']['indexes']['msg'] }}
|
||||
{% endif %}
|
||||
38
reports/templates/apache-signature.html.j2
Normal file
38
reports/templates/apache-signature.html.j2
Normal file
@ -0,0 +1,38 @@
|
||||
{% if data['apache']['signature']['audit'] %}
|
||||
{% for item in data['apache']['signature']['signature'] %}
|
||||
<div class="accordion" id="accordionApacheSignature">
|
||||
<div class="accordion-item">
|
||||
<h2 class="accordion-header">
|
||||
<button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#{{ data['apache']['signature']['signature'][item]['accordion-id'] }}" aria-expanded="true" aria-controls="{{ data['apache']['signature']['signature'][item]['accordion-id'] }}">
|
||||
<strong>VirtualHost {{ item }}</strong>
|
||||
{% if data['apache']['signature']['signature'][item]['result'] == 'failed' %}
|
||||
<span class="text-bg-danger p-1" style="padding-left:10pt;padding-right:10pt;margin-left:15pt;">{{ data['apache']['signature']['signature'][item]['result'] }}</span>
|
||||
{% elif data['apache']['signature']['signature'][item]['result'] == 'success' %}
|
||||
<span class="text-bg-success p-1" style="padding-left:10pt;padding-right:10pt;margin-left:15pt;">{{ data['apache']['signature']['signature'][item]['result'] }}</span>
|
||||
{% endif %}
|
||||
<span class="text-bg-primary p-1" style="padding-left:10pt;padding-right:10pt;margin-left:15pt;">{{ data['apache']['signature']['signature'][item]['level'] }}</span>
|
||||
</button>
|
||||
</h2>
|
||||
<div id="{{ data['apache']['signature']['signature'][item]['accordion-id'] }}" class="accordion-collapse collapse" data-bs-parent="#accordionApache">
|
||||
<div class="accordion-body">
|
||||
{{ data['apache']['signature']['signature'][item]['description'] }}. <br />
|
||||
{% if data['apache']['signature']['signature'][item]['result'] == 'failed' %}
|
||||
For resolving the issue, add this line in the VirtualHost file:
|
||||
<div class="bd-example-snippet bd-code-snippet">
|
||||
<div class="highlight">
|
||||
<pre tabindex="0" class="chroma"><code class="language-shell">
|
||||
{{ data['apache']['signature']['signature'][item]['recommand_value'] }}
|
||||
</pre></code>
|
||||
</div> <!-- end .highlight -->
|
||||
</div> <!-- end .bd-code-snippet -->
|
||||
{% endif %}
|
||||
|
||||
</div> <!-- end .accordion-body -->
|
||||
</div> <!-- end .accordion-collapse -->
|
||||
</div> <!-- end .accordion-item -->
|
||||
</div> <!-- end .accordion -->
|
||||
{% endfor %}
|
||||
|
||||
{% else %}
|
||||
{{ data['apache']['msg'] }}
|
||||
{% endif %}
|
||||
48
reports/templates/apache-ssl.html.j2
Normal file
48
reports/templates/apache-ssl.html.j2
Normal file
@ -0,0 +1,48 @@
|
||||
{% if data["apache"]["ssl"]["audit"] %}
|
||||
{% for item in data['apache']['ssl']['virtualhost'] %}
|
||||
<div class="accordion" id="accordionApacheSsl">
|
||||
<div class="accordion-item">
|
||||
<h2 class="accordion-header">
|
||||
<button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#{{ data['apache']['ssl']['virtualhost'][item]['accordion-id'] }}" aria-expanded="true" aria-controls="{{ data['apache']['ssl']['virtualhost'][item]['accordion-id'] }}">
|
||||
<strong>VirtualHost {{ item }}</strong>
|
||||
{% if data['apache']['ssl']['virtualhost'][item]['result'] == 'failed' %}
|
||||
<span class="text-bg-danger p-1" style="padding-left:10pt;padding-right:10pt;margin-left:15pt;">{{ data['apache']['ssl']['virtualhost'][item]['result'] }}</span>
|
||||
{% elif data['apache']['ssl']['virtualhost'][item]['result'] == 'success' %}
|
||||
<span class="text-bg-success p-1" style="padding-left:10pt;padding-right:10pt;margin-left:15pt;">{{ data['apache']['ssl']['virtualhost'][item]['result'] }}</span>
|
||||
{% endif %}
|
||||
<span class="text-bg-primary p-1" style="padding-left:10pt;padding-right:10pt;margin-left:15pt;">{{ data['apache']['ssl']['virtualhost'][item]['level'] }}</span>
|
||||
</button>
|
||||
</h2>
|
||||
<div id="{{ data['apache']['ssl']['virtualhost'][item]['accordion-id'] }}" class="accordion-collapse collapse" data-bs-parent="#accordionApache">
|
||||
<div class="accordion-body">
|
||||
{{ data['apache']['ssl']['virtualhost'][item]['description'] }}. <br />
|
||||
{% if data['apache']['ssl']['virtualhost'][item]['result'] == 'failed' %}
|
||||
Result of the audit:
|
||||
<div class="bd-example-snippet bd-code-snippet">
|
||||
<div class="highlight">
|
||||
<pre tabindex="0" class="chroma"><code class="language-shell">
|
||||
{% for protocol in data['apache']['ssl']['virtualhost'][item]['msg'] %}
|
||||
{{ protocol }}
|
||||
{% endfor %}
|
||||
</pre></code>
|
||||
</div> <!-- end .highlight -->
|
||||
</div> <!-- end .bd-code-snippet -->
|
||||
|
||||
For resolving the issue, add this line in the VirtualHost file:
|
||||
<div class="bd-example-snippet bd-code-snippet">
|
||||
<div class="highlight">
|
||||
<pre tabindex="0" class="chroma"><code class="language-shell">
|
||||
{{ data['apache']['ssl']['virtualhost'][item]['recommand_value'] }}
|
||||
</pre></code>
|
||||
</div> <!-- end .highlight -->
|
||||
</div> <!-- end .bd-code-snippet -->
|
||||
{% endif %}
|
||||
|
||||
</div> <!-- end .accordion-body -->
|
||||
</div> <!-- end .accordion-collapse -->
|
||||
</div> <!-- end .accordion-item -->
|
||||
</div> <!-- end .accordion -->
|
||||
{% endfor %}
|
||||
{% else %}
|
||||
{{ data['apache']['ssl']['msg'] }}
|
||||
{% endif %}
|
||||
@ -1,53 +1,19 @@
|
||||
<h3 class="fs-3">Apache</h3>
|
||||
|
||||
{% if data['apache']['audit'] %}
|
||||
{% for item in data['postfix']['vulnerabilities'] %}
|
||||
<div class="accordion" id="accordionApache">
|
||||
<div class="accordion-item">
|
||||
<h2 class="accordion-header">
|
||||
<button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#{{ data['postfix']['vulnerabilities'][item]['accordion-id'] }}" aria-expanded="true" aria-controls="{{ data['postfix']['vulnerabilities'][item]['accordion-id'] }}">
|
||||
<strong>{{ item }}</strong>
|
||||
{% if data['postfix']['vulnerabilities'][item]['result'] == 'failed' %}
|
||||
<span class="text-bg-danger p-1" style="padding-left:10pt;padding-right:10pt;margin-left:15pt;">{{ data['postfix']['vulnerabilities'][item]['result'] }}</span>
|
||||
{% elif data['postfix']['vulnerabilities'][item]['result'] == 'success' %}
|
||||
<span class="text-bg-success p-1" style="padding-left:10pt;padding-right:10pt;margin-left:15pt;">{{ data['postfix']['vulnerabilities'][item]['result'] }}</span>
|
||||
{% endif %}
|
||||
</button>
|
||||
</h2>
|
||||
<div id="{{ data['postfix']['vulnerabilities'][item]['accordion-id'] }}" class="accordion-collapse collapse" data-bs-parent="#accordionApache">
|
||||
<div class="accordion-body">
|
||||
{{ data['postfix']['vulnerabilities'][item]['description'] }}. <br />
|
||||
{% if data['postfix']['vulnerabilities'][item]['result'] == 'success' %}
|
||||
<div class="bd-example-snippet bd-code-snippet">
|
||||
<div class="highlight">
|
||||
<pre tabindex="0" class="chroma"><code class="language-shell">
|
||||
{{ data['postfix']['vulnerabilities'][item]['flagFound'] }}
|
||||
</pre></code>
|
||||
</div> <!-- end .highlight -->
|
||||
</div> <!-- end .bd-code-snippet -->
|
||||
{% else %}
|
||||
For resolving the issue, add this line in the <strong>{{ data['postfix']['filename'] }}</strong> vulnerabilities:
|
||||
<div class="bd-example-snippet bd-code-snippet">
|
||||
<div class="highlight">
|
||||
<pre tabindex="0" class="chroma"><code class="language-shell">
|
||||
{% for value in data['postfix']['vulnerabilities'][item]['recommand_value'] %}
|
||||
{{ data['postfix']['vulnerabilities'][item]['flag'] }} = {{ value }}
|
||||
{% endfor %}
|
||||
</pre></code>
|
||||
</div> <!-- end .highlight -->
|
||||
</div> <!-- end .bd-code-snippet -->
|
||||
{% endif %}
|
||||
<h5 class="fs-5">SSL</h5>
|
||||
{% include 'apache-ssl.html.j2' %}
|
||||
|
||||
<div style="margin-bottom: 15pt"></div>
|
||||
|
||||
{% if 'id' in data['postfix']['vulnerabilities'][item] %}
|
||||
linked with the <strong>{{ data['postfix']['vulnerabilities'][item]['id'] }}</strong>
|
||||
{% endif %}
|
||||
<h5 class="fs-5">Signature</h5>
|
||||
{% include 'apache-signature.html.j2' %}
|
||||
|
||||
</div> <!-- end .accordion-body -->
|
||||
</div> <!-- end .accordion-collapse -->
|
||||
</div> <!-- end .accordion-item -->
|
||||
</div> <!-- end .accordion -->
|
||||
{% endfor %}
|
||||
<div style="margin-bottom: 15pt"></div>
|
||||
|
||||
<h5 class="fs-5">Indexes</h5>
|
||||
{% include 'apache-indexes.html.j2' %}
|
||||
|
||||
{% else %}
|
||||
{{ data['apache']['msg'] }}
|
||||
{{ data['apache']['msg'] }}
|
||||
{% endif %}
|
||||
|
||||
11
utils.py
11
utils.py
@ -14,17 +14,6 @@ class ConfigError(Exception):
|
||||
super().__init__(self.message)
|
||||
|
||||
def identifySystem():
|
||||
#os = None
|
||||
#with open('/etc/issue', 'r') as f:
|
||||
# line = f.readline()
|
||||
# if re.search('Arch Linux', line):
|
||||
# os = 'ARCHLINUX'
|
||||
# elif re.search('Ubuntu', line):
|
||||
# os = 'UBUNTU'
|
||||
# elif re.search('Debian', line):
|
||||
# os = 'DEBIAN'
|
||||
# else:
|
||||
# os = 'UNKNOWN'
|
||||
kernelVers = run(['/usr/bin/lsb_release', '-is'], capture_output=True)
|
||||
return kernelVers.stdout.decode('utf-8')
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user