Standart Security Audit

Пример стандартного отчета:

Дата: конец мая 2004 года

IP: XX.XX.XX.XX
Hostname: xx.xxxxx.xx

==============================================================================
I. Локальные политики безопасности
==============================================================================

1) Проверка запускаемых (бинарных) файлов
Опасность: нет

2) Проверка на вредоносные программы (бэкдоры, трояны, руткиты, биндшеллы,
черви, снифферы)
Опасность: нет

3) Проврека локальных служб и интерфесов
Опасность: нет

4) Проверка ядра ОС (kernel) 2.4.20-28.7
Опасность: нет

5) Проверка уязвимости к локальным DoS атакам
Статус: нормальная устойчивость

==============================================================================
II. Аудит по запущенным внешним сетевым сервисам с комментариями
==============================================================================

1) tcpmux (порт 1)
Опасность: нет
Комментарии: порт открыт программой portsentry для отслеживания сканирования
портов.

2) ftp (порт 21) ProFTPd 1.2.9
Опасность: нет
Комментарии: гостевой вход запрещен.

3) OpenSSH 3.1p1 (protocol 1.99) (порт 22).
Опасность: нет

4) Exim smtpd 4.34 (порт 25)
Опасность: нет

5) ISC Bind 9.2.1 (порт 53)
Опасность: нет

6) Apache httpd (порт 80)
Опасность: нет

7) pop3 (порт 110)
Опасность: нет

8) rpcbind (порт 111)
Опасность: нет
Комментарии: порт открыт программой portsentry для отслеживания сканирования
портов.

9) UW Imapd 2003.339-cpanel (порт 143)
Опасность: нет

10) Apache httpd (порт 443)
Опасность: нет

11) Exim smtpd/ssl 4.34 (порт 465)
Опасность: нет

12) UW Imapd/ssl 2003.339-cpanel (порт 993)
Опасность: нет

13) pop3/ssl (порт 995)
Опасность: нет

14) MySQL 4.0.18-standart (порт 3306).
Опасность: некритично
Комментарии: плохо, когда mysql открыт в интернет.
В большинстве случаевможно обойтись без этого.
Очень рекомендуется закрыть доступ в интернет для mysql.

15) Проверка уязвимости к удаленным DoS-атакам
Статус: нормальная устойчивость.

==============================================================================
III. Детализированный анализ Web-сервера
==============================================================================

1) Доступен HTTP-метод PUT.
Данный метод позволяет пользователям сохранять файлы на web-сервере.
Опасность: некритично
Комментарии: рекомендуется заблокировать данный метод.

2) Доступен HTTP-метод DELETE.
Данный метод позволяет пользователям удалять файлы на web-сервере
Опасность: некритично
Комментарии: рекомендуется заблокировать данный метод.

3) Доступен HTTP-метод PROPFIND.
Этот метод сигнализирует о том, что установлен DAV/WebDAV,
атакующий может получить листинг файлов и директорий.
Опасность: некритично
Комментарии: рекомендуется заблокировать данный метод.

4) Доступен HTTP-метод PROPPATCH.
Этот метод сигнализирует о том, что установлен DAV/WebDAV.
Опасность: некритично
Комментарии: рекомендуется заблокировать данный метод.

5) Доступен HTTP-метод TRACE.
Данный метод используется только для отладки.
Опасность: некритично
Комментарии: данный метод должен быть заблокирован на сервере

6) Доступен запрос /~root .
Могут быть также доступны запросы типа /~username, что понижает безопасность
сервера.
Опасность: некритично
Комментарии: рекомендуется заблокировать подобные запросы на web-сервере.

7) Доступна к просмотру папка Apache установленная по умолчанию /icons/
Опасность: некритично
Коментарии: если нету надобности открывать на общий доступ эту папку, то
рекомендуется удалить ее.

8) Доступна к просмотру директория Apache установленная по умолчанию
/manual/images/
Опасность: некритично
Комментарии: если нету надобности открывать на общий доступ эту папку, то
рекомендуется удалить ее.

9) TRACE-опция может привести к XSS-атакам (межсайтовый скриптинг)
Опасность: некритично
Комментарии: рекомендуется запретить эту опцию в настройках Apache

10) TRACK-опция (TRACE-алиас) может привести к XSS-атакам (межсайтовый скриптинг)
Опасность: некритично
Комментарии: рекомендуется запретить эту опцию в настройках Apache

11) Существует директория /manual/
Опасность: некритично
Комментарии: рекомендуется присвоить данной папке другие права пользователя и
группы
или переместить папку в другое место или, если она не нужна удалить с сервера.

12) Найдены следующие скрипты и папки: /cgi-sys/cgiecho, /cgi-sys/cgiemail,
/cgi-sys/domainredirect.cgi,
/cgi-sys/entropysearch.cgi, /cgi-sys/FormMail-clone.cgi, /cgi-sys/helpdesk.cgi,
/cgi-sys/mchat.cgi, /cgi-sys/realhelpdesk.cgi, /cgi-sys/realsignup.cgi,
/cgi-sys/scgiwrap,
/cgi-sys/signup.cgi, /cpanel/, /img-sys/, /java-sys/, /securecontrolpanel/,
/webmail/,
/webmail/blank.html, /webmail/horde/test.php, /cgi-sys/Count.cgi,
/cgi-sys/formmail.pl,
/cgi-sys/guestbook.cgi, /webmail/lib/emailreader_execute_on_each_page.inc.php,
/webmail/src/read_body.php.
Данные скрипты и папки часто устанавливаются по умолчанию в хостинговых
компаниях.
В данном случае установлены программой cpanel.
Не содержат уязвимостий, но в некоторых случаях есть опасность получения
атакующим привилегий
системного администратора через web. В связи с этим необходимо своевременно
обновлять ПО cpanel.

13) /bandwidth/index.cgi
Скрипт требует авторизации.
Опасность: нет
Комментарии: необходимо следить за криптостойкостью используемых паролей для
доступа к скрипту,
иначе возможен брутфорс (перебор) паролей.

==============================================================================
Суммарно:
==============================================================================

Найдено критических ошибок: 0
Некритических ошибок: 12
Вывод: хорошо защищенный сервер!

Пример дополнительного отчета на английском языке:
Дата: 16 июля 2004 года

Scan Details
Hosts which were alive and responding during test	1
Number of security holes found	1
Number of security warnings found	4

Host List
Host(s)	Possible Issue
XX.XX.XX.XX	Security hole(s) found

[ return to top ]

Analysis of Host
Address of Host	Port/Service	Issue regarding Port
XX.XX.XX.XX	ftp (21/tcp)	Security notes found
XX.XX.XX.XX	domain (53/tcp)	Security hole found
XX.XX.XX.XX	http (80/tcp)	Security warning(s) found
XX.XX.XX.XX	pop3 (110/tcp)	Security notes found
XX.XX.XX.XX	imap (143/tcp)	Security notes found
XX.XX.XX.XX	https (443/tcp)	Security warning(s) found
XX.XX.XX.XX	general/udp	Security notes found
XX.XX.XX.XX	domain (53/udp)	Security notes found

Security Issues and Fixes: XX.XX.XX.XX
Type	Port	Issue and Fix
Informational	ftp (21/tcp)	An unknown service is running on this port. It is usually reserved for FTP
Informational	ftp (21/tcp)	Remote FTP server banner : 220-This computer system is for authorized users only. Individuals using this system without authority or in excess of their authority are subject to
Vulnerability	domain (53/tcp)	The remote BIND 9 DNS server, according to its version number, is vulnerable to a buffer overflow which may allow an attacker to gain a shell on this host or to disable this server. Solution : upgrade to bind 9.2.2 or downgrade to the 8.x series See also : http://www.isc.org/products/BIND/bind9.html http://cert.uni-stuttgart.de/archive/bugtraq/2003/03/msg00075.html http://www.cert.org/advisories/CA-2002-19.html Risk factor : High
Warning	domain (53/tcp)	The remote name server allows DNS zone transfers to be performed. A zone transfer will allow the remote attacker to instantly populate a list of potential targets. In addition, companies often use a naming convention which can give hints as to a servers primary application (for instance, proxy.company.com, payroll.company.com, b2b.company.com, etc.). As such, this information is of great use to an attacker who may use it to gain information about the topology of your network and spot new targets. Solution: Restrict DNS zone transfers to only the servers that absolutely need it. Risk factor : Medium
Warning	domain (53/tcp)	The remote name server allows recursive queries to be performed by the host running nessusd. If this is your internal nameserver, then forget this warning. If you are probing a remote nameserver, then it allows anyone to use it to resolve third parties names (such as www.domain.org). This allows hackers to do cache poisoning attacks against this nameserver. If the host allows these recursive queries via UDP, then the host can be used to 'bounce' Denial of Service attacks against another network or system. See also : http://www.cert.org/advisories/CA-1997-22.html Solution : Restrict recursive queries to the hosts that should use this nameserver (such as those of the LAN connected to it). If you are using bind 8, you can do this by using the instruction 'allow-recursion' in the 'options' section of your named.conf If you are using bind 9, you can define a grouping of internal addresses using the 'acl' command Then, within the options block, you can explicitly state: 'allow-recursion { hosts_defined_in_acl }' For more info on Bind 9 administration (to include recursion), see: http://www.nominum.com/content/documents/bind9arm.pdf If you are using another name server, consult its documentation. Risk factor : Serious
Informational	domain (53/tcp)	BIND 'NAMED' is an open-source DNS server from ISC.org. Many proprietary DNS servers are based on BIND source code. The BIND based NAMED servers (or DNS servers) allow remote users to query for version and type information. The query of the CHAOS TXT record 'version.bind', will typically prompt the server to send the information back to the querying source. The remote bind version is : 9.2.1 Solution : Using the 'version' directive in the 'options' section will block the 'version.bind' query, but it will not log such attempts.
Informational	domain (53/tcp)	A DNS server is running on this port. If you do not use it, disable it. Risk factor : Low
Warning	http (80/tcp)	Your webserver supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods which are used to debug web server connections. It has been shown that servers supporting this method are subject to cross-site-scripting attacks, dubbed XST for "Cross-Site-Tracing", when used in conjunction with various weaknesses in browsers. An attacker may use this flaw to trick your legitimate web users to give him their credentials. Solution: Disable these methods. If you are using Apache, add the following lines for each virtual host in your configuration file : RewriteEngine on RewriteCond %{REQUEST_METHOD} ^(TRACE\|TRACK) RewriteRule .* - [F] If you are using Microsoft IIS, use the URLScan tool to deny HTTP TRACE requests or to permit only the methods needed to meet site requirements and policy. If you are using Sun ONE Web Server releases 6.0 SP2 and later, add the following to the default object section in obj.conf: <Client method="TRACE"> AuthTrans fn="set-variable" remove-headers="transfer-encoding" set-headers="content-length: 34377-1" error="501" </Client> If you are using Sun ONE Web Server releases 6.0 SP2 or below, compile the NSAPI plugin located at: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F50603 See http://www.whitehatsec.com/press_releases/WH-PR-20030120.pdf http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0035.html http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F50603 http://www.kb.cert.org/vuls/id/867593 Risk factor : Medium
Informational	http (80/tcp)	A web server is running on this port
Informational	http (80/tcp)	The following CGI have been discovered : Syntax : cginame (arguments [default value]) /sys_cpanel/css/ (D [A] M [A] N [A] D=D [] S [A] ) /sys_cpanel/ (D [A] M [A] N [D] D=D [] S [A] ) /sys_cpanel/images/ (D [A] M [A] N [D] S [A] ) /sys_cpanel/html/ (D [A] M [A] N [D] D=D [] S [A] ) Directory index found at /sys_cpanel/css/ Directory index found at /sys_cpanel/ Directory index found at /sys_cpanel/images/ Directory index found at /sys_cpanel/html/
Informational	http (80/tcp)	This web server was fingerprinted as: Apache/1.3.27-9 on Linux w/ mod_fastcgi?E which is not consistent with the displayed banner: Apache
Informational	http (80/tcp)	The remote web server type is : Apache and the 'ServerTokens' directive is ProductOnly Apache does not permit to hide the server type.
Informational	http (80/tcp)	An information leak occurs on Apache based web servers whenever the UserDir module is enabled. The vulnerability allows an external attacker to enumerate existing accounts by requesting access to their home directory and monitoring the response. Solution: 1) Disable this feature by changing 'UserDir public_html' (or whatever) to 'UserDir disabled'. Or 2) Use a RedirectMatch rewrite rule under Apache -- this works even if there is no such entry in the password file, e.g.: RedirectMatch ^/~(.*)$ http://my-target-webserver.somewhere.org/$1 Or 3) Add into httpd.conf: ErrorDocument 404 http://localhost/sample.html ErrorDocument 403 http://localhost/sample.html (NOTE: You need to use a FQDN inside the URL for it to work properly). Additional Information: http://www.securiteam.com/unixfocus/5WP0C1F5FI.html Risk factor : Low
Informational	pop3 (110/tcp)	A pop3 server is running on this port
Informational	pop3 (110/tcp)	The remote POP3 servers leak information about the software it is running, through the login banner. This may assist an attacker in choosing an attack strategy. Versions and types should be omitted where possible. The version of the remote POP3 server is : +OK ns1 Solution : Change the login banner to something generic. Risk factor : Low
Informational	imap (143/tcp)	An IMAP server is running on this port
Informational	imap (143/tcp)	The remote imap server banner is : * OK [CAPABILITY IMAP4REV1 LOGIN-REFERRALS AUTH=LOGIN] ns1.XXX-XXX.com IMAP4rev1 2003.339-cpanel at Fri, 16 Jul 2004 14:05:24 +0400 (MSD) Versions and types should be omitted where possible. Change the imap banner to something generic.
Warning	https (443/tcp)	Your webserver supports the TRACE and/or TRACK methods. TRACE and TRACK are HTTP methods which are used to debug web server connections. It has been shown that servers supporting this method are subject to cross-site-scripting attacks, dubbed XST for "Cross-Site-Tracing", when used in conjunction with various weaknesses in browsers. An attacker may use this flaw to trick your legitimate web users to give him their credentials. Solution: Disable these methods. If you are using Apache, add the following lines for each virtual host in your configuration file : RewriteEngine on RewriteCond %{REQUEST_METHOD} ^(TRACE\|TRACK) RewriteRule .* - [F] If you are using Microsoft IIS, use the URLScan tool to deny HTTP TRACE requests or to permit only the methods needed to meet site requirements and policy. If you are using Sun ONE Web Server releases 6.0 SP2 and later, add the following to the default object section in obj.conf: <Client method="TRACE"> AuthTrans fn="set-variable" remove-headers="transfer-encoding" set-headers="content-length: -1" error="501" </Client> If you are using Sun ONE Web Server releases 6.0 SP2 or below, compile the NSAPI plugin located at: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F50603 See http://www.whitehatsec.com/press_releases/WH-PR-20030120.pdf http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0035.html http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F50603 http://www.kb.cert.org/vuls/id/867593 Risk factor : Medium
Informational	https (443/tcp)	A web server is running on this port
Informational	https (443/tcp)	The following CGI have been discovered : Syntax : cginame (arguments [default value]) /sys_cpanel/css/ (D [A] M [A] N [A] D=D [] S [A] ) /sys_cpanel/ (D [A] M [A] N [D] D=D [] S [A] ) /sys_cpanel/images/ (D [A] M [A] N [D] S [A] ) /sys_cpanel/html/ (D [A] M [A] N [D] D=D [] S [A] ) Directory index found at /sys_cpanel/css/ Directory index found at /sys_cpanel/ Directory index found at /sys_cpanel/images/ Directory index found at /sys_cpanel/html/
Informational	https (443/tcp)	This web server was fingerprinted as: Apache/1.3.27-9 on Linux w/ mod_fastcgi?E which is not consistent with the displayed banner: Apache
Informational	https (443/tcp)	The remote web server type is : Apache and the 'ServerTokens' directive is ProductOnly Apache does not permit to hide the server type.
Informational	https (443/tcp)	An information leak occurs on Apache based web servers whenever the UserDir module is enabled. The vulnerability allows an external attacker to enumerate existing accounts by requesting access to their home directory and monitoring the response. Solution: 1) Disable this feature by changing 'UserDir public_html' (or whatever) to 'UserDir disabled'. Or 2) Use a RedirectMatch rewrite rule under Apache -- this works even if there is no such entry in the password file, e.g.: RedirectMatch ^/~(.*)$ http://my-target-webserver.somewhere.org/$1 Or 3) Add into httpd.conf: ErrorDocument 404 http://localhost/sample.html ErrorDocument 403 http://localhost/sample.html (NOTE: You need to use a FQDN inside the URL for it to work properly). Additional Information: http://www.securiteam.com/unixfocus/5WP0C1F5FI.html Risk factor : Low
Informational	general/udp	For your information, here is the traceroute to XX.XX.XX.XX : 192.168.x.x 192.168.x.x 213.x.x.x 192.x.x.x 10.0.1x.x 195.34.x.x 195.34.xx.x 195.34.xx.x 157.130.xxx.xxx 152.63.xx.x 152.63.xx.x 152.63.xx.xx 204.255.xxx.xx 154.54.x.xx 66.28.xx.xxx 66.28.xx.xxx 66.28.xx.xx 66.28.xx.xx 66.28.x.xx 66.28.x.xx 38.xxx.xx.xx 207.x.x.xxx XXX.xxx.xx.xx
Informational	domain (53/udp)	A DNS server is running on this port. If you do not use it, disable it. Risk factor : Low
Informational	domain (53/udp)	The remote name server could be fingerprinted as being one of the following : ISC BIND 9.2.1 ISC BIND 9.2.2