أنهيت الإمتحان

q1-security-audit/Bash Script/Ghaymah_Script_Documentation.md

@@ -0,0 +1,29 @@
+# Ghaymah Systems
+## Automated Security Script Documentation & Baseline Mapping
+
+### Overview
+This document provides a technical breakdown of the `ghaymah-audit.sh` bash script. It explains how each block of code functions and maps directly to the rules defined in the 15-point Ghaymah Cloud Infrastructure Security Baseline.
+
+### 1. Permissions Check (صلاحيات)
+**Technical Code Explanation:**
+The script utilizes the built-in Bash variable `$EUID` (Effective User ID) to evaluate the execution privileges. In Linux architectures, the root (administrator) user is always assigned an ID of 0. By evaluating the condition `[ "$EUID" -eq 0 ]`, the script can definitively determine if the environment is running with maximum privileges.
+
+**Connection to Ghaymah Baseline:**
+* **Rule 2.2 (Isolate Workloads - Rootless & Read-Only):** This check directly enforces our container security policy. Containers and workloads deployed on Ghaymah must run as non-root users. Blocking root execution prevents "container escape" vulnerabilities, protecting the underlying host nodes.
+* **Rule 1.2 (Just-in-Time Privileges):** It also aligns with the principle of least privilege, ensuring scripts and automation tools do not operate with standing root access.
+
+### 2. Open Ports Check (منافذ)
+**Technical Code Explanation:**
+The script uses network diagnostic commands (`ss -tuln` or `netstat -tuln`) to list all active, listening network ports on the machine without resolving DNS names (for speed). It pipes (`|`) this output into the `grep -E ':(22)\s'` command. This isolates the output to check specifically for Port 22, which is the default listening port for SSH (Secure Shell).
+
+**Connection to Ghaymah Baseline:**
+* **Rule 3.1 (Zero Trust Micro-segmentation):** By verifying that SSH is not exposed, we enforce our network isolation policies. Management ports should never be publicly exposed; access must be gated through Zero Trust Network Access (ZTNA).
+* **Rule 5.3 (Prevent Security Misconfiguration):** Leaving default management ports open is a critical OWASP misconfiguration. This check serves as an automated guardrail against deployment errors.
+
+### 3. SSL/TLS Certificate Check (SSL)
+**Technical Code Explanation:**
+The script chains several tools to validate cryptographic health. It uses `openssl s_client -connect` to ping the domain on port 443 (HTTPS) and download the live SSL certificate. It passes this to `openssl x509 -enddate` to extract the expiration date. Finally, it uses the `date +%s` command to convert both the expiration date and the current date into "Epoch time" (seconds elapsed since January 1, 1970). Comparing these two integers allows the script to accurately determine if the certificate has expired.
+
+**Connection to Ghaymah Baseline:**
+* **Rule 4.1 (Universal KMS Encryption & TLS 1.3):** This maps directly to our data security mandates. Data in transit must be encrypted. An expired certificate breaks the trust chain and compromises the encrypted tunnel, violating our security SLA.
+* **Rule 3.3 (Enforce mTLS):** Secure inter-service communication relies on valid certificates. This check ensures that the foundational layer for mutual TLS remains active and trusted.

q1-security-audit/Bash Script/System Check Bash Code.sh

@@ -0,0 +1,83 @@
+#!/bin/bash
+
+# ==============================================================================
+# Ghaymah Systems - Automated Security Baseline Checker
+# Description: Validates Permissions, Open Ports, and SSL Configuration.
+# ==============================================================================
+
+# Output Colors for readability
+GREEN='\033[0;32m'
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+DOMAIN="ghaymah.systems"
+
+echo -e "${YELLOW}====================================================${NC}"
+echo -e "${YELLOW}       Ghaymah Systems - Security Audit Script      ${NC}"
+echo -e "${YELLOW}====================================================${NC}\n"
+
+# ------------------------------------------------------------------------------
+# 1. PERMISSIONS CHECK (صلاحيات)
+# Ensures the script/container is not running with root privileges (Rule 2.2)
+# ------------------------------------------------------------------------------
+echo -e "[1] Checking System Permissions (Least Privilege / Rootless)..."
+if [ "$EUID" -eq 0 ]; then
+  echo -e "  ${RED}[FAILED]${NC} Environment is running as root (UID 0). This violates Ghaymah's rootless container policy."
+else
+  echo -e "  ${GREEN}[PASSED]${NC} Environment is running as a non-root user (UID $EUID)."
+fi
+echo ""
+
+# ------------------------------------------------------------------------------
+# 2. PORTS CHECK (منافذ)
+# Checks if SSH (Port 22) is actively listening, which should be disabled (Rule 3.1)
+# ------------------------------------------------------------------------------
+echo -e "[2] Checking Exposed Ports (Zero Trust Network)..."
+# Using 'ss' or 'netstat' to check for port 22 listening state
+if command -v ss &> /dev/null; then
+    PORT_CHECK=$(ss -tuln | grep -E ':(22)\s')
+elif command -v netstat &> /dev/null; then
+    PORT_CHECK=$(netstat -tuln | grep -E ':(22)\s')
+else
+    PORT_CHECK="Command not found, skipping."
+    echo -e "  ${YELLOW}[WARNING]${NC} Neither 'ss' nor 'netstat' is installed to check ports."
+fi
+
+if [[ -n "$PORT_CHECK" && "$PORT_CHECK" != "Command not found, skipping." ]]; then
+  echo -e "  ${RED}[FAILED]${NC} Unauthorized open port detected (Port 22/SSH is listening)!"
+  echo "$PORT_CHECK"
+elif [[ "$PORT_CHECK" == "" ]]; then
+  echo -e "  ${GREEN}[PASSED]${NC} No unauthorized management ports (like SSH) are exposed."
+fi
+echo ""
+
+# ------------------------------------------------------------------------------
+# 3. SSL/TLS CERTIFICATE CHECK (SSL)
+# Checks if the target domain has a valid, non-expired SSL certificate (Rule 3.3/4.1)
+# ------------------------------------------------------------------------------
+echo -e "[3] Checking SSL Certificate Validity for $DOMAIN..."
+if command -v openssl &> /dev/null; then
+    # Fetch the expiration date of the SSL certificate
+    EXPIRATION_DATE=$(echo | openssl s_client -servername "$DOMAIN" -connect "$DOMAIN":443 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
+    
+    if [ -n "$EXPIRATION_DATE" ]; then
+        # Convert dates to seconds since epoch for comparison
+        EXP_SECONDS=$(date -d "$EXPIRATION_DATE" +%s 2>/dev/null || date -j -f "%b %d %T %Y %Z" "$EXPIRATION_DATE" +%s)
+        CURRENT_SECONDS=$(date +%s)
+        
+        if [ "$EXP_SECONDS" -lt "$CURRENT_SECONDS" ]; then
+            echo -e "  ${RED}[FAILED]${NC} The SSL certificate for $DOMAIN has EXPIRED on $EXPIRATION_DATE."
+        else
+            echo -e "  ${GREEN}[PASSED]${NC} SSL Certificate is valid. Expires on: $EXPIRATION_DATE."
+        fi
+    else
+        echo -e "  ${RED}[FAILED]${NC} Could not retrieve SSL certificate. Is the domain reachable over port 443?"
+    fi
+else
+    echo -e "  ${YELLOW}[WARNING]${NC} 'openssl' command is not installed. Cannot verify SSL."
+fi
+
+echo -e "\n${YELLOW}====================================================${NC}"
+echo -e "${YELLOW}                  Audit Complete                    ${NC}"
+echo -e "${YELLOW}====================================================${NC}"