DokuWiki

Vendor: Digital Ocean.
Account: devops@expertus.com
Instance name: secscan.exphosted.com (DNS zone not public)
IP Address : 107.170.34.185
Nexpose dashboard: 107.170.34.185:3780

Nexpose, OpenVAS, Brakeman.
Nexpose and OpenVAS ( Nessus fork ) were shortlisted from all recommendations published by SANS and OWASP Nexpose was used to conduct the security scan. Prior experience and vulnerability database coverage were two decisive factors for the selection. Two scans were conducted. Results from this security scan revealed many security issues which were documented in the issue tracker.

Default Extensive profile (shipped with Nexpose) was modified to include web spidering, OS fingerprinting and scanning, intuitive i.e. potential vulnerability option which broadens the attack range, destructive scan option. No credentials were applied.

Default Exhaustive profile (shipped with Nexpose) was modified to include web spidering, OS fingerprinting and credentialed scanning, destructive scan option. Admin user login credentials were also configured.

Brakeman was executed to perform the following checks:

BasicAuth, ContentTag, CrossSiteScripting, DefaultRoutes, Deserialize, DetailedExceptions, DigestDoS, EscapeFunction, Evaluation, Execute, FileAccess, FilterSkipping, ForgerySetting, HeaderDoS, I18nXSS, JRubyXML, JSONParsing, LinkTo, LinkToHref, MailTo, MassAssignment, ModelAttrAccessible, ModelAttributes, ModelSerialize, NestedAttributes, NumberToCurrency, QuoteTableName, Redirect, Render, RenderDoS, ResponseSplitting, SQL, SSLVerify, SafeBufferManipulation, SanitizeMethods, SelectTag, SelectVulnerability, Send, SendFile, SessionSettings, SimpleFormat, SingleQuotes, SkipBeforeFilter, StripTags, SymbolDoS, TranslateBug, UnsafeReflection, ValidationRegex, WithoutProtection, YAMLParsing

Get a trial key from Nexpose.
Start the server (details mentioned above), login to the UI and apply the trial key.
Scan profiles are already stored - click on green play button to initiate the scan

Make sure that internal systems are protected from external threats;

STEP 1: Add and run this script in cronttab or /etc/rc.local file or install fail2ban;
          
        #!/bin/bash
        iptables -F
        iptables -X
        iptables -A INPUT -m state --state INVALID -j DROP
        iptables -A INPUT -p tcp --dport 22 -s 192.168.2.0/24,192.168.3.0/24,192.168.7.0/25 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
        iptables -A INPUT -p tcp --dport 22 -j DROP
        service iptables save

STEP 2: Install rootkit Hunter

        For Centos - yum install rkhunter
        For Debian - apt-get install rkhunter
        To check   - rkhunter -c (collect the report or run this every week or day and collect the log)
        
Step 3: To audit the system install the lynis;
        
        For the first run
        
        cd /opt
        git clone https://github.com/CISOfy/Lynis
        cd lynis
        ./lynis audit system -Q
        
        To Collect report remotely;
        
        ssh -t -i /root/.ssh/id_rsa_automated root@<remote_ip> "cd /opt/Lynis; ./lynis -c -Q -q"