74 أسطر
2.5 KiB
Bash
74 أسطر
2.5 KiB
Bash
#!/bin/bash
|
|
#
|
|
# Ghaymah Automated Security Check
|
|
set -uo pipefail
|
|
|
|
echo "=========================================="
|
|
echo " Ghaymah Automated Security Check "
|
|
echo "=========================================="
|
|
|
|
TARGET_DOMAIN="ghaymah.systems"
|
|
TARGET_PORT="443"
|
|
WARNINGS=0
|
|
|
|
require_tool() {
|
|
if ! command -v "$1" >/dev/null 2>&1; then
|
|
echo "❌ ERROR: required tool '$1' not found. Skipping this check."
|
|
return 1
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
# 1. Check Open Ports (is SSH port 22 exposed on this host?)
|
|
echo "[1] Checking Network Ports (local host exposure)..."
|
|
if require_tool nc; then
|
|
if nc -z -v -w5 localhost 22 2>/dev/null; then
|
|
echo "⚠️ WARNING: Port 22 (SSH) is OPEN on this host. Restrict it to a Bastion/VPN only."
|
|
WARNINGS=$((WARNINGS+1))
|
|
else
|
|
echo "✅ Port 22 is properly closed or filtered on this host."
|
|
fi
|
|
fi
|
|
|
|
# 2. Check SSL/TLS Certificate validity for the public-facing domain
|
|
echo ""
|
|
echo "[2] Checking SSL Certificate for $TARGET_DOMAIN..."
|
|
if require_tool openssl; then
|
|
EXPIRATION_DATE=$(echo | openssl s_client -servername "$TARGET_DOMAIN" -connect "$TARGET_DOMAIN:$TARGET_PORT" 2>/dev/null \
|
|
| openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
|
|
|
|
if [ -n "$EXPIRATION_DATE" ]; then
|
|
echo "✅ SSL Certificate is valid. Expires on: $EXPIRATION_DATE"
|
|
else
|
|
echo "❌ ERROR: Could not retrieve SSL certificate. Check connection or HTTPS configuration."
|
|
WARNINGS=$((WARNINGS+1))
|
|
fi
|
|
fi
|
|
|
|
# 3. Check File Permissions — integrity check, NOT a "secrets" check.
|
|
# /etc/passwd holds account metadata (not password hashes — those live
|
|
# in /etc/shadow). What matters here is that it's NOT writable by
|
|
# anyone but root; 644 (or 600) is the safe baseline.
|
|
echo ""
|
|
echo "[3] Checking File Integrity Permissions..."
|
|
if require_tool stat; then
|
|
SENSITIVE_FILE="/etc/passwd"
|
|
PERMISSIONS=$(stat -c "%a" "$SENSITIVE_FILE" 2>/dev/null)
|
|
|
|
if [ "$PERMISSIONS" == "644" ] || [ "$PERMISSIONS" == "600" ]; then
|
|
echo "✅ Permissions for $SENSITIVE_FILE are secure ($PERMISSIONS) — not writable by non-root users."
|
|
else
|
|
echo "⚠️ WARNING: Permissions for $SENSITIVE_FILE are $PERMISSIONS (expected 644 or 600). This may allow unauthorized writes."
|
|
WARNINGS=$((WARNINGS+1))
|
|
fi
|
|
fi
|
|
|
|
echo ""
|
|
echo "=========================================="
|
|
if [ "$WARNINGS" -eq 0 ]; then
|
|
echo " ✅ All checks passed "
|
|
else
|
|
echo " ⚠️ Scan completed with $WARNINGS warning(s)"
|
|
fi
|
|
echo "=========================================="
|