kura/amisecure

Am I Secure? Python script to do system and config security checks.

Ohai

• I'm an bitslinger/engineer working on the BIDI (BBC Internet Distribution Infrastructure) content delivery network for the BBC.
  • If you're curious about BIDI, my colleague has a great UKNOF talk about BIDI.
• I'm interested in hardware, HTTP, SMTP, video encoding and optimising to oblivion.
• I mostly write Python, but also write Lua, C, and Java for my job.
• I live in nginx/OpenResty configs.
• I occasionally write stuff @ kura.gg
• I have written a bunch of themes and plugins for the Pelican static site generator, including;
  • Themes
    • Eevee (repo)
    • Hauntr (repo)
    • Ghastly (repo)
  • Plugins
    • Lightbox (repo)
    • Pelican YouTube (repo)
    • Pelican Vimeo (repo)
    • Pelican GitHub Projects (repo)
    • Pelican FontAwesome (repo)
• I have also contributed a few features to the opensource, file-based markdown wiki wikmd include;
  • The caching layer
  • Search powered by the pure-Python Whoosh search library
• I have written a simple Firefox Relay-like system using AWS SES, Lambda & DynamoDB.
• I have also written some tools for reading data from TP-Link Tapo P110 smart plugs for ingesting via Telegraf.

© 2021 Taylor Swift + Eevee image copyright, Kura <copyright [atpersand] kura [dot] gg>

amisecure's Issues

Vulnerability database + check

Do version looks against a database of known vulns. Easy for Apache (http://httpd.apache.org/security/vulnerabilities_20.html) and nginx (http://nginx.org/en/security_advisories.html), more difficult for PHP which doesn't seem to have a list anywhere...

Figure out why Apache2 dir listing is always found

Annoying bug, grep shows nothing but -Indexes but somehow matches +Indexes regex.

Add a did you read source Q+A at start

Ask if the user has read the source, if answer is no then display not sure message because ran script as root that they randomly downloaded from the net.

SSL

Do SSL checks for nginx and Apache2. Check for SSLv2 etc.

Add suhosin check

Fix setting a value to display

Display value is broken, it always equates to True and also resets value to itself which means checks further down don't work correctly.

PHP - look for Suhosin

Add a nice help text with link to download

session.cookie_httponly

1 = secure
0 or not set = not secure

Switch to shell_command to use subprocess

Clean up

Clean up the damn code, it's no longer suitable and needs to be written from it's initial test style.

Add check for custom SSH port

Add a check for a custom SSH port. Mark as insecure in case SSH uses the standard port.

Double output on run