Final Submission for Ghaymah SecOps Assessment

task1-security-audit/ghaymah_audit.sh

@@ -0,0 +1,297 @@
+#!/usr/bin/env bash
+# =============================================================================
+# Ghaymah Security Audit Script (Internship Version)
+# =============================================================================
+# Purpose : Audit listening ports, SSL/TLS, and file permissions.
+# Usage   : chmod +x ghaymah_audit.sh && sudo ./ghaymah_audit.sh <domain> <port> <dir>
+# Example : sudo ./ghaymah_audit.sh example.com 443 ./app
+# =============================================================================
+
+set -uo pipefail
+
+# ── Configuration ────────────────────────────────────────────────────────────
+TARGET_DOMAIN="${1:-ghaymah.systems}"
+TARGET_PORT="${2:-443}"
+TARGET_DIR="${3:-.}"
+
+REPORT_DIR="./audit_reports"
+TIMESTAMP=$(date +%Y%m%d_%H%M%S)
+REPORT_FILE="${REPORT_DIR}/ghaymah_audit_${TIMESTAMP}.txt"
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+NC='\033[0m' # No Color
+
+# Counters for summary
+CRITICAL_COUNT=0
+WARNING_COUNT=0
+PASS_COUNT=0
+
+# ── Setup ────────────────────────────────────────────────────────────────────
+mkdir -p "${REPORT_DIR}"
+
+log() {
+    local level="$1"
+    shift
+    local msg="$*"
+    case "${level}" in
+        CRITICAL|FAIL)
+            echo -e "${RED}[FAIL]${NC} ${msg}"
+            ((CRITICAL_COUNT++)) || true
+            ;;
+        WARNING)
+            echo -e "${YELLOW}[WARNING]${NC} ${msg}"
+            ((WARNING_COUNT++)) || true
+            ;;
+        PASS)
+            echo -e "${GREEN}[PASS]${NC} ${msg}"
+            ((PASS_COUNT++)) || true
+            ;;
+        INFO)
+            echo -e "${CYAN}${msg}${NC}"
+            ;;
+        SECTION)
+            echo -e "\n-----------------------------------"
+            echo -e "${msg}"
+            echo -e "-----------------------------------\n"
+            ;;
+    esac
+    echo "[${level}] ${msg}" >> "${REPORT_FILE}"
+}
+
+check_dependencies() {
+    local deps=("openssl" "find" "awk" "grep" "curl")
+    for dep in "${deps[@]}"; do
+        if ! command -v "${dep}" &>/dev/null; then
+            log CRITICAL "Missing dependency: ${dep}"
+            exit 1
+        fi
+    done
+}
+
+# =============================================================================
+# PORT AUDIT
+# =============================================================================
+audit_listening_ports() {
+    log SECTION "PORT AUDIT"
+
+    # Define the required ports and their protocol names
+    declare -A ports=(
+        [22]="SSH"
+        [80]="HTTP"
+        [443]="HTTPS"
+        [3306]="MySQL"
+        [5432]="PostgreSQL"
+        [6379]="Redis"
+        [27017]="MongoDB"
+    )
+
+    for port in "${!ports[@]}"; do
+        local service_name="${ports[$port]}"
+        
+        # Check if port is open on target
+        if (echo >/dev/tcp/${TARGET_DOMAIN}/"${port}") 2>/dev/null; then
+            # Categorize the findings based on expected exposure
+            case "${port}" in
+                80|443) 
+                    log PASS "${service_name} (${port}) reachable"
+                    ;;
+                22)
+                    log WARNING "${service_name} (${port}) exposed — ensure strong auth"
+                    ;;
+                *)
+                    log WARNING "${service_name} (${port}) exposed — database/cache should not be public"
+                    ;;
+            esac
+        else
+            case "${port}" in
+                80|443) 
+                    log FAIL "${service_name} (${port}) unavailable"
+                    ;;
+                *)
+                    log PASS "${service_name} (${port}) closed"
+                    ;;
+            esac
+        fi
+    done
+}
+
+# =============================================================================
+# SSL/TLS AUDIT
+# =============================================================================
+audit_ssl_tls() {
+    log SECTION "SSL AUDIT"
+
+    local status
+    status=$(curl -s -o /dev/null -w "%{http_code}" "https://${TARGET_DOMAIN}" 2>/dev/null || echo "000")
+
+    if [[ "${status}" == "200" ]]; then
+        log PASS "HTTPS response code: ${status}"
+    else
+        log WARNING "HTTPS response code: ${status}"
+    fi
+
+    if ! timeout 5 bash -c "echo >/dev/tcp/${TARGET_DOMAIN}/${TARGET_PORT}" 2>/dev/null; then
+        log FAIL "Cannot connect to ${TARGET_DOMAIN}:${TARGET_PORT} for SSL checks."
+        return
+    fi
+
+    # Check TLS 1.3
+    if echo | timeout 10 openssl s_client -connect "${TARGET_DOMAIN}:${TARGET_PORT}" -tls1_3 2>/dev/null | grep -q "Cipher is"; then
+        log PASS "TLS 1.3 Enabled"
+    else
+        log WARNING "TLS 1.3 Disabled or Unavailable"
+    fi
+
+    # Check certificate validity and expiry
+    local expiry_date
+    expiry_date=$(echo | timeout 10 openssl s_client -connect "${TARGET_DOMAIN}:${TARGET_PORT}" -servername "${TARGET_DOMAIN}" 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2 || true)
+    
+    if [[ -n "${expiry_date}" ]]; then
+        local expiry_epoch
+        expiry_epoch=$(date -d "${expiry_date}" +%s 2>/dev/null || date -j -f "%b %d %T %Y %Z" "${expiry_date}" +%s 2>/dev/null || echo "0")
+        local now_epoch
+        now_epoch=$(date +%s)
+        
+        if [[ "${expiry_epoch}" -gt 0 ]]; then
+            local days_remaining=$(( (expiry_epoch - now_epoch) / 86400 ))
+            if [[ "${days_remaining}" -lt 0 ]]; then
+                log FAIL "Certificate Expired"
+            elif [[ "${days_remaining}" -lt 30 ]]; then
+                log WARNING "Certificate expires soon (${days_remaining} days)"
+            else
+                log PASS "Certificate Valid (${days_remaining} days remaining)"
+            fi
+        else
+            log FAIL "Failed to parse certificate expiry."
+        fi
+    else
+        log FAIL "Could not retrieve certificate."
+    fi
+
+    # Check Security Headers
+    if command -v curl &>/dev/null; then
+        local headers
+        headers=$(curl -sI "https://${TARGET_DOMAIN}" --max-time 10 2>/dev/null || true)
+        
+        declare -A header_checks=(
+            ["strict-transport-security"]="HSTS"
+            ["content-security-policy"]="Content-Security-Policy"
+            ["x-frame-options"]="X-Frame-Options"
+            ["x-content-type-options"]="X-Content-Type-Options"
+            ["referrer-policy"]="Referrer-Policy"
+            ["permissions-policy"]="Permissions-Policy"
+        )
+
+        for header_name in "${!header_checks[@]}"; do
+            local header_label="${header_checks[$header_name]}"
+            if echo "${headers}" | grep -qi "${header_name}"; then
+                log PASS "${header_label} Enabled"
+            else
+                log WARNING "${header_label} Missing"
+            fi
+        done
+    else
+        log WARNING "curl not found, skipping HTTP security header checks."
+    fi
+}
+
+# =============================================================================
+# PERMISSIONS AUDIT
+# =============================================================================
+audit_permissions() {
+    log SECTION "PERMISSION AUDIT"
+
+    if [[ ! -d "${TARGET_DIR}" ]]; then
+        log FAIL "Target directory ${TARGET_DIR} does not exist."
+        return
+    fi
+
+    # Check World-Writable Files
+    local ww_files
+    ww_files=$(find "${TARGET_DIR}" -type f -perm -o+w 2>/dev/null)
+    if [[ -z "${ww_files}" ]]; then
+        log PASS "No world writable files"
+    else
+        while IFS= read -r file; do
+            [[ -z "$file" ]] && continue
+            local perms
+            perms=$(stat -c "%a" "$file" 2>/dev/null)
+            log WARNING "World writable file: ${file} (${perms})"
+        done <<< "${ww_files}"
+    fi
+
+    # Check World-Writable Directories
+    local ww_dirs
+    ww_dirs=$(find "${TARGET_DIR}" -type d -perm -o+w 2>/dev/null)
+    if [[ -z "${ww_dirs}" ]]; then
+        log PASS "No world writable directories"
+    else
+        while IFS= read -r dir; do
+            [[ -z "$dir" ]] && continue
+            local perms
+            perms=$(stat -c "%a" "$dir" 2>/dev/null)
+            log WARNING "World writable directory: ${dir} (${perms})"
+        done <<< "${ww_dirs}"
+    fi
+}
+
+# =============================================================================
+# SUMMARY
+# =============================================================================
+generate_summary() {
+    log SECTION "SUMMARY"
+    
+    local overall="PASS"
+    if [[ "${CRITICAL_COUNT}" -gt 0 ]]; then
+        overall="FAIL"
+    elif [[ "${WARNING_COUNT}" -gt 0 ]]; then
+        overall="WARNING"
+    fi
+
+    echo -e "Critical : ${CRITICAL_COUNT}"
+    echo -e "Warnings : ${WARNING_COUNT}"
+    echo -e "Passed   : ${PASS_COUNT}"
+    echo -e ""
+    
+    if [[ "${overall}" == "PASS" ]]; then
+        echo -e "Overall  : ${GREEN}${overall}${NC}"
+    elif [[ "${overall}" == "WARNING" ]]; then
+        echo -e "Overall  : ${YELLOW}${overall}${NC}"
+    else
+        echo -e "Overall  : ${RED}${overall}${NC}"
+    fi
+    
+    # Save to report file
+    {
+        echo "Critical : ${CRITICAL_COUNT}"
+        echo "Warnings : ${WARNING_COUNT}"
+        echo "Passed   : ${PASS_COUNT}"
+        echo "Overall  : ${overall}"
+    } >> "${REPORT_FILE}"
+}
+
+# =============================================================================
+# MAIN
+# =============================================================================
+main() {
+    echo -e "=================================================="
+    echo -e "GHAYMAH SECURITY AUDIT"
+    echo -e "=================================================="
+    echo -e "\nTarget:\n${TARGET_DOMAIN}\n"
+    
+    echo "Audit Started: $(date)" > "${REPORT_FILE}"
+
+    check_dependencies
+
+    audit_listening_ports
+    audit_ssl_tls
+    audit_permissions
+    
+    generate_summary
+}
+
+main "$@"