PublicMirrors/vps-audit
1
0
Fork 0
mirror of https://github.com/vernu/vps-audit.git synced 2025-02-02 16:23:53 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update vps-audit.sh

Browse Source 
Feature: Added support for ss when netstat is not present
This commit is contained in:
Rob 2024-12-14 12:59:44 -08:00 committed by GitHub
parent 07abec919f
commit 04f6bd9429
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 25 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
vps-audit.sh
View File

@ -188,21 +188,32 @@ else
check_security "Running Services" "FAIL" "Too many services running ($SERVICES) - increases attack surface" check_security "Running Services" "FAIL" "Too many services running ($SERVICES) - increases attack surface"
fi fi
# Check ports # Check ports using netstat or ss
LISTENING_PORTS=$(netstat -tuln | grep LISTEN) if command -v netstat >/dev/null 2>&1; then
PORT_COUNT=$(echo "$LISTENING_PORTS" | wc -l) LISTENING_PORTS=$(netstat -tuln | grep LISTEN | awk '{print $4}')
elif command -v ss >/dev/null 2>&1; then
LISTENING_PORTS=$(ss -tuln | grep LISTEN | awk '{print $5}')
else
check_security "Port Scanning" "FAIL" "Neither 'netstat' nor 'ss' is available on this system."
LISTENING_PORTS=""
fi
# Get list of internet-accessible ports, excluding those explicitly denied by UFW # Process LISTENING_PORTS to extract unique public ports
PUBLIC_PORTS=$(netstat -tuln | grep LISTEN | \ if [ -n "$LISTENING_PORTS" ]; then
awk '$4 !~ /127.0.0.1|::1/ && ($4 ~ /0.0.0.0/ || $4 ~ /::/)' | \ PUBLIC_PORTS=$(echo "$LISTENING_PORTS" | awk -F':' '{print $NF}' | sort -n | uniq)
awk '{split($4, a, ":"); print a[length(a)]}' | sort -n | while read port; do PORT_COUNT=$(echo "$PUBLIC_PORTS" | wc -w)
# Skip ports that are explicitly denied in UFW INTERNET_PORTS=$(echo "$PUBLIC_PORTS" | wc -w)
if ! ufw status | grep -q "^$port.*DENY"; then
echo "$port"
fi
done | tr '\n' ',' | sed 's/,$//')
INTERNET_PORTS=$(echo "$PUBLIC_PORTS" | tr ',' '\n' | wc -l) if [ "$PORT_COUNT" -lt 10 ] && [ "$INTERNET_PORTS" -lt 3 ]; then
check_security "Port Security" "PASS" "Good configuration (Total: $PORT_COUNT, Public: $INTERNET_PORTS accessible ports): $PUBLIC_PORTS"
elif [ "$PORT_COUNT" -lt 20 ] && [ "$INTERNET_PORTS" -lt 5 ]; then
check_security "Port Security" "WARN" "Review recommended (Total: $PORT_COUNT, Public: $INTERNET_PORTS accessible ports): $PUBLIC_PORTS"
else
check_security "Port Security" "FAIL" "High exposure (Total: $PORT_COUNT, Public: $INTERNET_PORTS accessible ports): $PUBLIC_PORTS"
fi
else
check_security "Port Scanning" "WARN" "Port scanning failed due to missing tools. Ensure 'ss' or 'netstat' is installed."
fi
# Function to format the message with proper indentation for the report file # Function to format the message with proper indentation for the report file
format_for_report() { format_for_report() {
@ -210,21 +221,6 @@ format_for_report() {
echo "$message" >> "$REPORT_FILE" echo "$message" >> "$REPORT_FILE"
} }
# Evaluate security based on both total ports and internet-accessible ports
if [ "$PORT_COUNT" -lt 10 ] && [ "$INTERNET_PORTS" -lt 3 ]; then
RESULT="${GREEN}[PASS]${NC} Port Security ${GRAY}- Good configuration (Total: $PORT_COUNT, Public: $INTERNET_PORTS accessible ports): $PUBLIC_PORTS${NC}"
echo -e "$RESULT"
format_for_report "[PASS] Port Security - Good configuration (Total: $PORT_COUNT, Public: $INTERNET_PORTS accessible ports): $PUBLIC_PORTS"
elif [ "$PORT_COUNT" -lt 20 ] && [ "$INTERNET_PORTS" -lt 5 ]; then
RESULT="${YELLOW}[WARN]${NC} Port Security ${GRAY}- Review recommended (Total: $PORT_COUNT, Public: $INTERNET_PORTS accessible ports): $PUBLIC_PORTS${NC}"
echo -e "$RESULT"
format_for_report "[WARN] Port Security - Review recommended (Total: $PORT_COUNT, Public: $INTERNET_PORTS accessible ports): $PUBLIC_PORTS"
else
RESULT="${RED}[FAIL]${NC} Port Security ${GRAY}- High exposure (Total: $PORT_COUNT, Public: $INTERNET_PORTS accessible ports): $PUBLIC_PORTS${NC}"
echo -e "$RESULT"
format_for_report "[FAIL] Port Security - High exposure (Total: $PORT_COUNT, Public: $INTERNET_PORTS accessible ports): $PUBLIC_PORTS"
fi
# Check disk space usage # Check disk space usage
DISK_TOTAL=$(df -h / | awk 'NR==2 {print $2}') DISK_TOTAL=$(df -h / | awk 'NR==2 {print $2}')
DISK_USED=$(df -h / | awk 'NR==2 {print $3}') DISK_USED=$(df -h / | awk 'NR==2 {print $3}')