Final Submission for SecOps Exam

q1-security-audit/security-check.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+
+echo "🔒 Starting Security Audit Check..."
+echo "------------------------------------"
+
+echo "🔍 [1] Checking Risky Open Ports..."
+OPEN_PORTS=$(netstat -tuln | awk '{print $4}' | grep -E ':(22|3306|21)$')
+if [ -z "$OPEN_PORTS" ]; then
+    echo "✅ PASS: No unauthorized risky ports are open."
+else
+    echo "❌ WARNING: The following risky ports are exposed:"
+    echo "$OPEN_PORTS"
+fi
+echo "------------------------------------"
+
+echo "🌐 [2] Checking SSL Certificate Expiry for mithal.space..."
+DOMAIN="mithal.space"
+EXPIRY_DATE=$(echo | openssl s_client -servername $DOMAIN -connect $DOMAIN:443 2>/dev/null | openssl x509 -noout -dates | grep notAfter | cut -d= -f2)
+if [ -n "$EXPIRY_DATE" ]; then
+    EXPIRY_SEC=$(date -d "$EXPIRY_DATE" +%s)
+    NOW_SEC=$(date +%s)
+    DAYS_LEFT=$(( ($EXPIRY_SEC - $NOW_SEC) / 86400 ))
+    if [ $DAYS_LEFT -gt 30 ]; then
+        echo "✅ PASS: SSL certificate is valid. Expires in $DAYS_LEFT days."
+    else
+        echo "⚠️ WARNING: SSL certificate expires soon (in $DAYS_LEFT days)!"
+    fi
+else
+    echo "❌ ERROR: Could not retrieve SSL certificate."
+fi
+echo "------------------------------------"
+
+echo "📁 [3] Checking Sensitive File Permissions..."
+SENSITIVE_FILE=".env" 
+if [ -f "$SENSITIVE_FILE" ]; then
+    PERMISSIONS=$(stat -c "%a" "$SENSITIVE_FILE")
+    if [ "$PERMISSIONS" -le 600 ]; then
+        echo "✅ PASS: Permissions for $SENSITIVE_FILE are secure ($PERMISSIONS)."
+    else
+        echo "❌ WARNING: Permissions for $SENSITIVE_FILE are too open ($PERMISSIONS)!"
+    fi
+else
+    echo "ℹ️ INFO: No $SENSITIVE_FILE found."
+fi
+echo "------------------------------------"
+echo "🏁 Security Audit Check Completed."