Linux Host Security Scan Tool

[jlaw10]

I need to scan and confirm security compliance for a RedHat Linux Server. I want to capture such items as the following:

- open ports
- review suid, sgid
- user password security scan
- privileged user scan
- scan for availability of critical files
- overall compliance scan

Is there a free tool out there that is recommended?

 

[Noway2]

Linux itself probably has all of the tools you need built in. Here is a link to a check list that was designed for intruder detection and covers how to check the things you mentioned:

http://web.archive.org/web/20080109...g/tech_tips/intruder_detection_checklist.html

The link came from here

http://www.linuxquestions.org/questions/linux-security-4/security-references-45261/

which has A LOT of information that may be of interest to you.

 

[3t0n1c]

I am not aware of just one tool that would do all that in one package.

You can run a simple port (open port scan) from another host against your RH box like so:

nmap -P0 IPADDRESS

Where IPADDRESS is the IP address of your RH box.
This will give you a list of open ports on this machine. You need to do that from the same subnet, otherwise if there are routers or firewalls between the test machine and the RH box you may not get very good results (as some ports could be filtered). Also do a "man nmap" to see other switches to scan for specific ports (-p PORT) or even open UDP ports, etc.

On the RH box, have a look at your /etc/passwd, /etc/shadow, etc and see if there are any issues.

As far as testing user passwords, I am not sure if you mean doing a brute force and see what you can crack as far as the passwords go. Usually when you harden the system you specify what the least strongest password should be and assume most are better than that. (eg. no less than 8 characters, alphanumeric, uppercase, etc)

There are some tools that would scan for rootkits and other things like that, but that may not be what you want.

As far as updates check you can use this to get an idea:
yum check-update

This will give you a list of what's available, it wouldn't install anything, just checks against your repo's.

Good luck!

The more you learn, the more you realize how much you don't know.

 

[cspilman]

You might want to check out Nessus:

http://www.nessus.org/nessus/

Regards,
Chuck

 

[ady2012]

Tripwire and chkrookit can help you.