Linux Security Plugin

(1 votes, average: 5.00 out of 5)

Loading...

This plugin is intended to run ONLY on modern Linux boxes. It’s ready to run on 64 & 32 bits.
It contains a custom build of John the ripper 1.8 + Contrib patches with 32&64 static binaries. The main concept of the plugin is to be monolothic, detect what can be hardened and try to solve differences between distros without asking nothing to the admin, so deployment could be the same for any system, ignoring versions, distro or architecture.

This plugin will check:

1. User password audit check, using dictionary (provided) with the
   500 most common used passwords. This usually don’t take more than a few seconds. If you have hundred of users, probably need to customize the plugin execution to be executed only each 2-6 hours. You can customize the password dictionary just adding your organization typical password in the file “basic_security/password-list”.
2. Check SSH on default port
3. Check FTP on default port
4. Check SSH to allow root access
5. Verify if is there a MySQL running without root password defined.

In the future we want to expand it’s features to include file hashing check, detect bruteforce attacks by analyzing logs, improve hardening check on root enviroment, etc. Keep updated to see what’s new in the next months.

Files:

basic_security (sources update, Jan 2021)

basic.security.tar.bz2 (contains password audit tool, optional)