added
هذا الالتزام موجود في:
185
q1-security-audit/security-audit.sh
Executable file
185
q1-security-audit/security-audit.sh
Executable file
@@ -0,0 +1,185 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# security-audit.sh
|
||||
# Security audit script for applications hosted on Ghaymah or any VPS/PaaS environment.
|
||||
# Checks:
|
||||
# 1. Open ports
|
||||
# 2. SSL certificate status
|
||||
# 3. Sensitive file permissions
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
DOMAIN="${1:-}"
|
||||
PORT="${2:-443}"
|
||||
APP_DIR="${3:-.}"
|
||||
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
|
||||
pass() {
|
||||
echo -e "${GREEN}[OK]${NC} $1"
|
||||
}
|
||||
|
||||
warn() {
|
||||
echo -e "${YELLOW}[WARN]${NC} $1"
|
||||
}
|
||||
|
||||
fail() {
|
||||
echo -e "${RED}[FAIL]${NC} $1"
|
||||
}
|
||||
|
||||
echo "=================================================="
|
||||
echo " Automated Security Audit - $(date '+%Y-%m-%d %H:%M:%S')"
|
||||
echo "=================================================="
|
||||
|
||||
|
||||
# --------------------------------------------------
|
||||
# 1. Open Ports Check
|
||||
# --------------------------------------------------
|
||||
|
||||
echo
|
||||
echo "---- Checking Open Ports ----"
|
||||
|
||||
if command -v ss >/dev/null 2>&1; then
|
||||
OPEN_PORTS=$(ss -tuln | awk 'NR>1 {print $5}' | sed -E 's/.*:([0-9]+)$/\1/' | sort -un)
|
||||
|
||||
elif command -v netstat >/dev/null 2>&1; then
|
||||
OPEN_PORTS=$(netstat -tuln | awk 'NR>2 {print $4}' | sed -E 's/.*:([0-9]+)$/\1/' | sort -un)
|
||||
|
||||
else
|
||||
warn "Neither ss nor netstat is available. Skipping port check."
|
||||
OPEN_PORTS=""
|
||||
fi
|
||||
|
||||
|
||||
ALLOWED_PORTS="22 80 443"
|
||||
|
||||
if [ -n "$OPEN_PORTS" ]; then
|
||||
echo "Open ports: $OPEN_PORTS"
|
||||
|
||||
for port in $OPEN_PORTS; do
|
||||
if echo "$ALLOWED_PORTS" | grep -qw "$port"; then
|
||||
pass "Port $port is allowed"
|
||||
else
|
||||
warn "Port $port is open and not in the allowed list"
|
||||
fi
|
||||
done
|
||||
else
|
||||
warn "No ports detected"
|
||||
fi
|
||||
|
||||
|
||||
# --------------------------------------------------
|
||||
# 2. SSL Certificate Check
|
||||
# --------------------------------------------------
|
||||
|
||||
echo
|
||||
echo "---- Checking SSL Certificate ----"
|
||||
|
||||
if [ -z "$DOMAIN" ]; then
|
||||
warn "No domain provided. Skipping SSL check."
|
||||
|
||||
else
|
||||
|
||||
if command -v openssl >/dev/null 2>&1; then
|
||||
|
||||
CERT_INFO=$(echo | timeout 10 openssl s_client \
|
||||
-connect "${DOMAIN}:${PORT}" \
|
||||
-servername "$DOMAIN" 2>/dev/null | \
|
||||
openssl x509 -noout -dates -issuer -subject 2>/dev/null) || true
|
||||
|
||||
|
||||
if [ -z "$CERT_INFO" ]; then
|
||||
fail "Unable to retrieve SSL certificate"
|
||||
else
|
||||
echo "$CERT_INFO"
|
||||
|
||||
EXPIRY_DATE=$(echo "$CERT_INFO" | grep "notAfter" | cut -d= -f2)
|
||||
|
||||
if [ -n "$EXPIRY_DATE" ]; then
|
||||
|
||||
EXPIRY_EPOCH=$(date -d "$EXPIRY_DATE" +%s 2>/dev/null || echo 0)
|
||||
CURRENT_EPOCH=$(date +%s)
|
||||
|
||||
DAYS_LEFT=$(( (EXPIRY_EPOCH - CURRENT_EPOCH) / 86400 ))
|
||||
|
||||
if [ "$DAYS_LEFT" -lt 0 ]; then
|
||||
fail "SSL certificate expired"
|
||||
elif [ "$DAYS_LEFT" -lt 30 ]; then
|
||||
warn "SSL certificate expires in $DAYS_LEFT days"
|
||||
else
|
||||
pass "SSL certificate valid for $DAYS_LEFT days"
|
||||
fi
|
||||
|
||||
fi
|
||||
fi
|
||||
|
||||
else
|
||||
warn "OpenSSL is not installed"
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
|
||||
# --------------------------------------------------
|
||||
# 3. Sensitive File Permissions Check
|
||||
# --------------------------------------------------
|
||||
|
||||
echo
|
||||
echo "---- Checking Sensitive File Permissions ----"
|
||||
|
||||
SENSITIVE_FILES=(
|
||||
".env"
|
||||
"*.pem"
|
||||
"*.key"
|
||||
"id_rsa"
|
||||
"config/secrets*"
|
||||
)
|
||||
|
||||
|
||||
for pattern in "${SENSITIVE_FILES[@]}"; do
|
||||
|
||||
while IFS= read -r -d '' file; do
|
||||
|
||||
PERMISSIONS=$(stat -c "%a" "$file" 2>/dev/null || stat -f "%A" "$file")
|
||||
|
||||
if [ -n "$PERMISSIONS" ]; then
|
||||
|
||||
LAST_DIGIT="${PERMISSIONS: -1}"
|
||||
|
||||
if [ "$LAST_DIGIT" -ge 4 ] 2>/dev/null; then
|
||||
fail "$file has insecure permissions ($PERMISSIONS)"
|
||||
else
|
||||
pass "$file permissions are secure ($PERMISSIONS)"
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
done < <(find "$APP_DIR" -type f -iname "$pattern" -print0 2>/dev/null)
|
||||
|
||||
done
|
||||
|
||||
|
||||
echo
|
||||
echo "Checking world-writable files..."
|
||||
|
||||
WORLD_WRITABLE=$(find "$APP_DIR" -type f -perm -o+w 2>/dev/null | grep -v "/.git/" || true)
|
||||
|
||||
if [ -n "$WORLD_WRITABLE" ]; then
|
||||
|
||||
fail "World-writable files found:"
|
||||
echo "$WORLD_WRITABLE"
|
||||
|
||||
else
|
||||
|
||||
pass "No world-writable files found."
|
||||
|
||||
fi
|
||||
|
||||
|
||||
echo
|
||||
echo "=================================================="
|
||||
echo " Security Audit Completed"
|
||||
echo "=================================================="
|
||||
157
q1-security-audit/security-checklist.md
Normal file
157
q1-security-audit/security-checklist.md
Normal file
@@ -0,0 +1,157 @@
|
||||
# Security Audit Checklist for Ghaymah Application
|
||||
|
||||
## 1. Use Trusted Container Images
|
||||
|
||||
### What is the security control?
|
||||
Using trusted and verified container images reduces the risk of deploying images that contain malware, vulnerabilities, or unwanted software.
|
||||
|
||||
### How to apply it on Ghaymah?
|
||||
Use official images from trusted registries and verify images before deployment on Ghaymah Container Hosting. Enable image scanning to detect known vulnerabilities before running containers.
|
||||
|
||||
---
|
||||
|
||||
## 2. Scan Container Images for Vulnerabilities
|
||||
|
||||
### What is the security control?
|
||||
Container image scanning identifies vulnerable packages and outdated dependencies before they reach production.
|
||||
|
||||
### How to apply it on Ghaymah?
|
||||
Integrate vulnerability scanning tools into the CI/CD pipeline before pushing images to Ghaymah Container Registry. Block deployment of images with critical vulnerabilities.
|
||||
|
||||
---
|
||||
|
||||
## 3. Run Containers as Non-Root Users
|
||||
|
||||
### What is the security control?
|
||||
Running containers with root privileges increases the impact of a container compromise.
|
||||
|
||||
### How to apply it on Ghaymah?
|
||||
Configure Docker images to use a dedicated non-root user and enforce security policies that prevent privileged container execution.
|
||||
|
||||
---
|
||||
|
||||
## 4. Limit Container Resources
|
||||
|
||||
### What is the security control?
|
||||
Resource limits prevent one container from consuming excessive CPU or memory and affecting other services.
|
||||
|
||||
### How to apply it on Ghaymah?
|
||||
Configure CPU and memory limits for containers using Ghaymah Container platform settings. This helps prevent resource exhaustion attacks.
|
||||
|
||||
---
|
||||
|
||||
## 5. Keep Containers Updated
|
||||
|
||||
### What is the security control?
|
||||
Regular updates fix security vulnerabilities in operating systems, libraries, and application dependencies.
|
||||
|
||||
### How to apply it on Ghaymah?
|
||||
Regularly rebuild container images with updated dependencies and redeploy secure versions through the CI/CD pipeline.
|
||||
|
||||
---
|
||||
|
||||
# Network Security
|
||||
|
||||
## 6. Restrict Exposed Ports
|
||||
|
||||
### What is the security control?
|
||||
Reducing exposed ports minimizes the attack surface available to attackers.
|
||||
|
||||
### How to apply it on Ghaymah?
|
||||
Only expose required application ports and block unnecessary ports using Ghaymah network security rules.
|
||||
|
||||
---
|
||||
|
||||
## 7. Apply Firewall Rules
|
||||
|
||||
### What is the security control?
|
||||
Firewalls control incoming and outgoing traffic based on defined security rules.
|
||||
|
||||
### How to apply it on Ghaymah?
|
||||
Configure network access rules to allow only trusted sources and required services.
|
||||
|
||||
---
|
||||
|
||||
## 8. Use Network Policies
|
||||
|
||||
### What is the security control?
|
||||
Network policies restrict communication between different services and containers.
|
||||
|
||||
### How to apply it on Ghaymah?
|
||||
Create rules that control which containers can communicate with each other and prevent unauthorized internal access.
|
||||
|
||||
---
|
||||
|
||||
## 9. Enable HTTPS/TLS
|
||||
|
||||
### What is the security control?
|
||||
HTTPS encrypts communication between users and applications to protect sensitive information.
|
||||
|
||||
### How to apply it on Ghaymah?
|
||||
Configure SSL/TLS certificates for applications deployed on Ghaymah and enforce HTTPS connections.
|
||||
|
||||
---
|
||||
|
||||
# OWASP Security
|
||||
|
||||
## 10. Prevent SQL Injection
|
||||
|
||||
### What is the security control?
|
||||
SQL injection happens when attackers insert malicious SQL commands through application inputs.
|
||||
|
||||
### How to apply it on Ghaymah?
|
||||
Use prepared statements, input validation, and secure database access configurations for applications hosted on Ghaymah.
|
||||
|
||||
---
|
||||
|
||||
## 11. Protect Against Cross-Site Scripting (XSS)
|
||||
|
||||
### What is the security control?
|
||||
XSS protection prevents attackers from injecting malicious scripts into web applications.
|
||||
|
||||
### How to apply it on Ghaymah?
|
||||
Implement input sanitization, output encoding, and proper security headers in applications deployed on Ghaymah.
|
||||
|
||||
---
|
||||
|
||||
## 12. Implement Authentication Controls
|
||||
|
||||
### What is the security control?
|
||||
Strong authentication prevents unauthorized users from accessing application resources.
|
||||
|
||||
### How to apply it on Ghaymah?
|
||||
Use strong password policies, multi-factor authentication, and secure session management.
|
||||
|
||||
---
|
||||
|
||||
# Data Security
|
||||
|
||||
## 13. Encrypt Sensitive Data
|
||||
|
||||
### What is the security control?
|
||||
Encryption protects sensitive information from unauthorized access.
|
||||
|
||||
### How to apply it on Ghaymah?
|
||||
Encrypt stored data using secure storage options and use encrypted connections for data transfer.
|
||||
|
||||
---
|
||||
|
||||
## 14. Secure Backups
|
||||
|
||||
### What is the security control?
|
||||
Secure backups help recover data after accidental deletion or security incidents.
|
||||
|
||||
### How to apply it on Ghaymah?
|
||||
Store backups securely using Ghaymah storage services and restrict backup access using proper permissions.
|
||||
|
||||
---
|
||||
|
||||
# IAM Security
|
||||
|
||||
## 15. Apply Least Privilege Access
|
||||
|
||||
### What is the security control?
|
||||
Least privilege ensures users only have the permissions required to perform their tasks.
|
||||
|
||||
### How to apply it on Ghaymah?
|
||||
Create role-based access control policies and provide users with only the necessary permissions for managing cloud resources.
|
||||
المرجع في مشكلة جديدة
حظر مستخدم