feat: initial setup for PVE security scanner VM
Scripts for deploying a hardened internal network security scanner on Proxmox VE: - PVE-level firewall and VM creation - System hardening (sysctl, auditd, AIDE) - nftables firewall with dynamic IP blocking - SSH hardening with fail2ban - Security tools (OpenVAS, Nmap, Nuclei, httpx, Nikto, testssl, NetExec) - Monitoring, logging, and Docker autostart
This commit is contained in:
Yaojia Wang
32
README.md
Normal file
32
README.md
Normal file
@@ -0,0 +1,32 @@
|
|||||||
|
# PVE Security Scanner
|
||||||
|
|
||||||
|
Internal network security scanning VM for Proxmox VE.
|
||||||
|
|
||||||
|
## Structure
|
||||||
|
|
||||||
|
```
|
||||||
|
pve-security-scanner/
|
||||||
|
├── pve/ # Proxmox host-level config
|
||||||
|
│ ├── create-vm.sh # One-click VM creation
|
||||||
|
│ └── firewall.sh # PVE firewall rules
|
||||||
|
├── vm/ # VM internal config
|
||||||
|
│ ├── 01-system-harden.sh # OS hardening
|
||||||
|
│ ├── 02-firewall.sh # nftables firewall
|
||||||
|
│ ├── 03-ssh-harden.sh # SSH hardening
|
||||||
|
│ ├── 04-install-tools.sh # Security tools
|
||||||
|
│ └── 05-monitoring.sh # Logging and monitoring
|
||||||
|
└── README.md
|
||||||
|
```
|
||||||
|
|
||||||
|
## Deployment
|
||||||
|
|
||||||
|
1. On PVE host: run `pve/create-vm.sh` to create the VM
|
||||||
|
2. On PVE host: run `pve/firewall.sh` to apply PVE-level firewall
|
||||||
|
3. SSH into VM, run scripts in `vm/` directory in order (01 -> 05)
|
||||||
|
|
||||||
|
## Network Design
|
||||||
|
|
||||||
|
- Scanner VM sits on the management VLAN / main bridge
|
||||||
|
- Allowed to reach all internal subnets for scanning
|
||||||
|
- Outbound internet restricted (only for vuln DB updates)
|
||||||
|
- Inbound restricted to SSH + Web UI from admin IPs only
|
||||||
48
pve/create-vm.sh
Normal file
48
pve/create-vm.sh
Normal file
@@ -0,0 +1,48 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# =============================================================================
|
||||||
|
# PVE Security Scanner VM - Creation Script
|
||||||
|
# Run this on the Proxmox host
|
||||||
|
# =============================================================================
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# --- Configuration (modify these) ---
|
||||||
|
VMID=200
|
||||||
|
VM_NAME="security-scanner"
|
||||||
|
STORAGE="local-lvm" # PVE storage pool
|
||||||
|
ISO_PATH="local:iso/debian-12-amd64-netinst.iso" # Debian 12 ISO
|
||||||
|
BRIDGE="vmbr0" # Network bridge
|
||||||
|
CORES=4
|
||||||
|
MEMORY=8192 # MB
|
||||||
|
DISK_SIZE="80G"
|
||||||
|
VLAN_TAG="" # Set VLAN tag if needed, e.g., "10"
|
||||||
|
|
||||||
|
# --- Guard: check if VM already exists ---
|
||||||
|
if qm status "${VMID}" &>/dev/null; then
|
||||||
|
echo "[!] VM ${VMID} already exists. Skipping creation."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Create VM ---
|
||||||
|
echo "[+] Creating VM ${VMID} (${VM_NAME})..."
|
||||||
|
|
||||||
|
# VLAN_TAG conditional: appends ,tag=<N> only when VLAN_TAG is set
|
||||||
|
qm create "${VMID}" \
|
||||||
|
--name "${VM_NAME}" \
|
||||||
|
--ostype l26 \
|
||||||
|
--cores "${CORES}" \
|
||||||
|
--memory "${MEMORY}" \
|
||||||
|
--cpu cputype=host \
|
||||||
|
--scsihw virtio-scsi-single \
|
||||||
|
--scsi0 "${STORAGE}:${DISK_SIZE}" \
|
||||||
|
--ide2 "${ISO_PATH},media=cdrom" \
|
||||||
|
--net0 "virtio,bridge=${BRIDGE}${VLAN_TAG:+,tag=${VLAN_TAG}}" \
|
||||||
|
--boot "order=ide2;scsi0" \
|
||||||
|
--agent enabled=1 \
|
||||||
|
--onboot 1 \
|
||||||
|
--protection 0 \
|
||||||
|
--description "Internal network security scanner. Restricted network access."
|
||||||
|
|
||||||
|
echo "[+] VM ${VMID} created successfully."
|
||||||
|
echo "[+] Start the VM and install Debian 12, then run the vm/ scripts."
|
||||||
|
echo ""
|
||||||
|
echo " qm start ${VMID}"
|
||||||
135
pve/firewall.sh
Normal file
135
pve/firewall.sh
Normal file
@@ -0,0 +1,135 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# =============================================================================
|
||||||
|
# PVE-Level Firewall for Security Scanner VM
|
||||||
|
# Run this on the Proxmox host
|
||||||
|
# Applies firewall rules at the hypervisor level (defense in depth)
|
||||||
|
# =============================================================================
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
VMID=200
|
||||||
|
|
||||||
|
# --- Configuration (MUST be changed before running) ---
|
||||||
|
# Admin IPs allowed to access the scanner (comma-separated)
|
||||||
|
ADMIN_IPS="${SCANNER_ADMIN_IPS:-}"
|
||||||
|
# Internal subnets the scanner is allowed to reach
|
||||||
|
INTERNAL_NETS="${SCANNER_INTERNAL_NETS:-10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}"
|
||||||
|
|
||||||
|
# --- Guard: require ADMIN_IPS to be set ---
|
||||||
|
if [[ -z "${ADMIN_IPS}" ]]; then
|
||||||
|
echo "[ERROR] SCANNER_ADMIN_IPS environment variable is not set." >&2
|
||||||
|
echo " Example: export SCANNER_ADMIN_IPS='192.168.68.100,192.168.68.101'" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# Enable PVE firewall for the VM
|
||||||
|
# =============================================================================
|
||||||
|
echo "[+] Enabling PVE firewall for VM ${VMID}..."
|
||||||
|
|
||||||
|
# Create firewall config directory
|
||||||
|
mkdir -p "/etc/pve/firewall"
|
||||||
|
|
||||||
|
# --- VM-level firewall rules ---
|
||||||
|
cat > "/etc/pve/firewall/${VMID}.fw" << 'FWEOF'
|
||||||
|
[OPTIONS]
|
||||||
|
enable: 1
|
||||||
|
policy_in: DROP
|
||||||
|
policy_out: ACCEPT
|
||||||
|
dhcp: 0
|
||||||
|
macfilter: 0
|
||||||
|
log_level_in: info
|
||||||
|
log_level_out: warning
|
||||||
|
|
||||||
|
[IPSET admin_ips]
|
||||||
|
# Add your admin workstation IPs here
|
||||||
|
192.168.1.100
|
||||||
|
192.168.1.101
|
||||||
|
|
||||||
|
[IPSET internal_nets]
|
||||||
|
# Internal subnets the scanner can reach
|
||||||
|
10.0.0.0/8
|
||||||
|
172.16.0.0/12
|
||||||
|
192.168.0.0/16
|
||||||
|
|
||||||
|
[IPSET update_targets]
|
||||||
|
# External hosts for vulnerability database updates
|
||||||
|
# Greenbone feed servers
|
||||||
|
feed.community.greenbone.net
|
||||||
|
# Debian/Ubuntu repos
|
||||||
|
deb.debian.org
|
||||||
|
security.debian.org
|
||||||
|
# Docker Hub
|
||||||
|
registry-1.docker.io
|
||||||
|
production.cloudflare.docker.com
|
||||||
|
auth.docker.io
|
||||||
|
# GitHub (for Nuclei templates)
|
||||||
|
github.com
|
||||||
|
objects.githubusercontent.com
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# INBOUND RULES - Only admin access
|
||||||
|
# =============================================================================
|
||||||
|
[RULES]
|
||||||
|
|
||||||
|
# Allow SSH from admin IPs only
|
||||||
|
IN ACCEPT -source +admin_ips -p tcp -dport 22 -log info
|
||||||
|
|
||||||
|
# Allow OpenVAS Web UI (9392) from admin IPs only
|
||||||
|
IN ACCEPT -source +admin_ips -p tcp -dport 9392 -log info
|
||||||
|
|
||||||
|
# Allow ICMP ping from internal networks
|
||||||
|
IN ACCEPT -source +internal_nets -p icmp
|
||||||
|
|
||||||
|
# Allow established/related connections back in
|
||||||
|
IN ACCEPT -match conntrack --ctstate RELATED,ESTABLISHED
|
||||||
|
|
||||||
|
# Log and drop everything else (handled by policy_in: DROP)
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# OUTBOUND RULES - Restricted
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
# Allow DNS resolution
|
||||||
|
OUT ACCEPT -p udp -dport 53
|
||||||
|
OUT ACCEPT -p tcp -dport 53
|
||||||
|
|
||||||
|
# Allow NTP
|
||||||
|
OUT ACCEPT -p udp -dport 123
|
||||||
|
|
||||||
|
# Allow scanning to internal networks (all ports)
|
||||||
|
OUT ACCEPT -dest +internal_nets
|
||||||
|
|
||||||
|
# Allow HTTPS/HTTP only to update targets (vuln DB, packages, docker)
|
||||||
|
OUT ACCEPT -dest +update_targets -p tcp -dport 443 -log info
|
||||||
|
OUT ACCEPT -dest +update_targets -p tcp -dport 80
|
||||||
|
|
||||||
|
# Allow established connections
|
||||||
|
OUT ACCEPT -match conntrack --ctstate RELATED,ESTABLISHED
|
||||||
|
|
||||||
|
# Drop all other outbound
|
||||||
|
OUT DROP -log warning
|
||||||
|
FWEOF
|
||||||
|
|
||||||
|
echo "[+] PVE firewall rules written to /etc/pve/firewall/${VMID}.fw"
|
||||||
|
|
||||||
|
# --- Enable datacenter-level firewall if not already ---
|
||||||
|
echo "[+] Enabling datacenter-level firewall..."
|
||||||
|
pvesh set /cluster/firewall/options --enable 1 2>/dev/null || {
|
||||||
|
echo "[!] pvesh failed, checking cluster.fw manually..."
|
||||||
|
if ! grep -q "enable: 1" /etc/pve/firewall/cluster.fw 2>/dev/null; then
|
||||||
|
mkdir -p /etc/pve/firewall
|
||||||
|
if [[ -f /etc/pve/firewall/cluster.fw ]]; then
|
||||||
|
sed -i 's/^enable: 0/enable: 1/' /etc/pve/firewall/cluster.fw
|
||||||
|
else
|
||||||
|
cat > /etc/pve/firewall/cluster.fw << 'EOF'
|
||||||
|
[OPTIONS]
|
||||||
|
enable: 1
|
||||||
|
policy_in: ACCEPT
|
||||||
|
policy_out: ACCEPT
|
||||||
|
EOF
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
echo "[+] PVE firewall configured. Verify with: pvesh get /nodes/$(hostname)/qemu/${VMID}/firewall/rules"
|
||||||
|
echo "[!] IMPORTANT: Update admin_ips and internal_nets to match your network."
|
||||||
207
vm/01-system-harden.sh
Normal file
207
vm/01-system-harden.sh
Normal file
@@ -0,0 +1,207 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# =============================================================================
|
||||||
|
# System Hardening for Security Scanner VM
|
||||||
|
# Run this inside the VM as root
|
||||||
|
# =============================================================================
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
echo "============================================"
|
||||||
|
echo " System Hardening - Security Scanner VM"
|
||||||
|
echo "============================================"
|
||||||
|
|
||||||
|
# --- 1. Update system ---
|
||||||
|
echo "[+] Updating system packages..."
|
||||||
|
apt update && apt upgrade -y
|
||||||
|
apt install -y unattended-upgrades apt-listchanges
|
||||||
|
|
||||||
|
# Enable automatic security updates
|
||||||
|
cat > /etc/apt/apt.conf.d/50unattended-upgrades << 'EOF'
|
||||||
|
Unattended-Upgrade::Allowed-Origins {
|
||||||
|
"${distro_id}:${distro_codename}-security";
|
||||||
|
};
|
||||||
|
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
||||||
|
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
||||||
|
Unattended-Upgrade::Automatic-Reboot "false";
|
||||||
|
EOF
|
||||||
|
|
||||||
|
dpkg-reconfigure -f noninteractive unattended-upgrades
|
||||||
|
|
||||||
|
# --- 2. Kernel hardening (sysctl) ---
|
||||||
|
echo "[+] Applying kernel hardening..."
|
||||||
|
cat > /etc/sysctl.d/99-security-scanner.conf << 'EOF'
|
||||||
|
# --- Network hardening ---
|
||||||
|
# Disable IP forwarding (scanner should not route traffic)
|
||||||
|
net.ipv4.ip_forward = 0
|
||||||
|
net.ipv6.conf.all.forwarding = 0
|
||||||
|
|
||||||
|
# Ignore ICMP redirects
|
||||||
|
net.ipv4.conf.all.accept_redirects = 0
|
||||||
|
net.ipv4.conf.default.accept_redirects = 0
|
||||||
|
net.ipv6.conf.all.accept_redirects = 0
|
||||||
|
net.ipv6.conf.default.accept_redirects = 0
|
||||||
|
|
||||||
|
# Don't send ICMP redirects
|
||||||
|
net.ipv4.conf.all.send_redirects = 0
|
||||||
|
net.ipv4.conf.default.send_redirects = 0
|
||||||
|
|
||||||
|
# Enable reverse path filtering (anti-spoofing)
|
||||||
|
net.ipv4.conf.all.rp_filter = 1
|
||||||
|
net.ipv4.conf.default.rp_filter = 1
|
||||||
|
|
||||||
|
# Ignore broadcast pings
|
||||||
|
net.ipv4.icmp_echo_ignore_broadcasts = 1
|
||||||
|
|
||||||
|
# Enable SYN flood protection
|
||||||
|
net.ipv4.tcp_syncookies = 1
|
||||||
|
net.ipv4.tcp_max_syn_backlog = 2048
|
||||||
|
net.ipv4.tcp_synack_retries = 2
|
||||||
|
|
||||||
|
# Log suspicious packets
|
||||||
|
net.ipv4.conf.all.log_martians = 1
|
||||||
|
net.ipv4.conf.default.log_martians = 1
|
||||||
|
|
||||||
|
# Disable source routing
|
||||||
|
net.ipv4.conf.all.accept_source_route = 0
|
||||||
|
net.ipv4.conf.default.accept_source_route = 0
|
||||||
|
|
||||||
|
# --- Memory protection ---
|
||||||
|
# Restrict dmesg access
|
||||||
|
kernel.dmesg_restrict = 1
|
||||||
|
|
||||||
|
# Restrict kernel pointer exposure
|
||||||
|
kernel.kptr_restrict = 2
|
||||||
|
|
||||||
|
# Enable ASLR
|
||||||
|
kernel.randomize_va_space = 2
|
||||||
|
|
||||||
|
# Restrict ptrace
|
||||||
|
kernel.yama.ptrace_scope = 2
|
||||||
|
|
||||||
|
# --- File system ---
|
||||||
|
# Restrict core dumps
|
||||||
|
fs.suid_dumpable = 0
|
||||||
|
EOF
|
||||||
|
|
||||||
|
sysctl -p /etc/sysctl.d/99-security-scanner.conf
|
||||||
|
|
||||||
|
# --- 3. Restrict core dumps ---
|
||||||
|
echo "[+] Disabling core dumps..."
|
||||||
|
cat > /etc/security/limits.d/99-no-core.conf << 'EOF'
|
||||||
|
* hard core 0
|
||||||
|
* soft core 0
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# --- 4. Secure shared memory ---
|
||||||
|
echo "[+] Securing shared memory..."
|
||||||
|
if ! grep -q "tmpfs /dev/shm" /etc/fstab; then
|
||||||
|
echo "tmpfs /dev/shm tmpfs defaults,noexec,nosuid,nodev 0 0" >> /etc/fstab
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- 5. Set file permissions ---
|
||||||
|
echo "[+] Hardening file permissions..."
|
||||||
|
chmod 700 /root
|
||||||
|
chmod 600 /etc/crontab
|
||||||
|
chmod 700 /etc/cron.d
|
||||||
|
chmod 700 /etc/cron.daily
|
||||||
|
chmod 700 /etc/cron.hourly
|
||||||
|
chmod 700 /etc/cron.weekly
|
||||||
|
chmod 700 /etc/cron.monthly
|
||||||
|
|
||||||
|
# --- 6. Disable unnecessary services ---
|
||||||
|
echo "[+] Disabling unnecessary services..."
|
||||||
|
DISABLE_SERVICES=(
|
||||||
|
"avahi-daemon"
|
||||||
|
"cups"
|
||||||
|
"rpcbind"
|
||||||
|
"bluetooth"
|
||||||
|
)
|
||||||
|
for svc in "${DISABLE_SERVICES[@]}"; do
|
||||||
|
if systemctl is-enabled "${svc}" 2>/dev/null; then
|
||||||
|
systemctl disable --now "${svc}"
|
||||||
|
echo " Disabled: ${svc}"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
# --- 7. Install security tools ---
|
||||||
|
echo "[+] Installing security audit tools..."
|
||||||
|
apt install -y \
|
||||||
|
aide \
|
||||||
|
rkhunter \
|
||||||
|
lynis \
|
||||||
|
auditd \
|
||||||
|
audispd-plugins \
|
||||||
|
fail2ban \
|
||||||
|
logwatch
|
||||||
|
|
||||||
|
# --- 8. Initialize AIDE (file integrity monitoring) ---
|
||||||
|
echo "[!] Initializing AIDE database - this may take 10-20 minutes..."
|
||||||
|
aideinit
|
||||||
|
cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db
|
||||||
|
|
||||||
|
# --- 9. Configure auditd ---
|
||||||
|
echo "[+] Configuring audit rules..."
|
||||||
|
cat > /etc/audit/rules.d/scanner-audit.rules << 'EOF'
|
||||||
|
# Delete all existing rules
|
||||||
|
-D
|
||||||
|
|
||||||
|
# Buffer size
|
||||||
|
-b 8192
|
||||||
|
|
||||||
|
# Failure mode (1=printk, 2=panic)
|
||||||
|
-f 1
|
||||||
|
|
||||||
|
# Monitor /etc changes
|
||||||
|
-w /etc/ -p wa -k etc_changes
|
||||||
|
|
||||||
|
# Monitor authentication
|
||||||
|
-w /var/log/auth.log -p wa -k auth_log
|
||||||
|
-w /etc/passwd -p wa -k identity
|
||||||
|
-w /etc/shadow -p wa -k identity
|
||||||
|
-w /etc/group -p wa -k identity
|
||||||
|
-w /etc/gshadow -p wa -k identity
|
||||||
|
|
||||||
|
# Monitor sudo usage
|
||||||
|
-w /etc/sudoers -p wa -k sudoers
|
||||||
|
-w /etc/sudoers.d/ -p wa -k sudoers
|
||||||
|
|
||||||
|
# Monitor network config changes
|
||||||
|
-w /etc/hosts -p wa -k network
|
||||||
|
-w /etc/network/ -p wa -k network
|
||||||
|
-w /etc/nftables.conf -p wa -k firewall
|
||||||
|
|
||||||
|
# Monitor cron changes
|
||||||
|
-w /etc/crontab -p wa -k cron
|
||||||
|
-w /etc/cron.d/ -p wa -k cron
|
||||||
|
|
||||||
|
# Monitor scanner tool configs
|
||||||
|
-w /opt/greenbone/ -p wa -k scanner_config
|
||||||
|
|
||||||
|
# Lock audit rules (requires reboot to change)
|
||||||
|
-e 2
|
||||||
|
EOF
|
||||||
|
|
||||||
|
systemctl restart auditd
|
||||||
|
|
||||||
|
# --- 10. Password policy ---
|
||||||
|
echo "[+] Setting password policy..."
|
||||||
|
apt install -y libpam-pwquality
|
||||||
|
|
||||||
|
sed -i 's/^#\s*minlen.*/minlen = 12/' /etc/security/pwquality.conf
|
||||||
|
sed -i 's/^#\s*minclass.*/minclass = 3/' /etc/security/pwquality.conf
|
||||||
|
sed -i 's/^#\s*maxrepeat.*/maxrepeat = 3/' /etc/security/pwquality.conf
|
||||||
|
|
||||||
|
# Verify settings were applied
|
||||||
|
for setting in minlen minclass maxrepeat; do
|
||||||
|
if ! grep -q "^${setting}" /etc/security/pwquality.conf; then
|
||||||
|
echo "[!] WARNING: ${setting} was not set - appending to config"
|
||||||
|
case "${setting}" in
|
||||||
|
minlen) echo "minlen = 12" >> /etc/security/pwquality.conf ;;
|
||||||
|
minclass) echo "minclass = 3" >> /etc/security/pwquality.conf ;;
|
||||||
|
maxrepeat) echo "maxrepeat = 3" >> /etc/security/pwquality.conf ;;
|
||||||
|
esac
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "[+] System hardening complete."
|
||||||
|
echo "[!] Reboot recommended: shutdown -r now"
|
||||||
201
vm/02-firewall.sh
Normal file
201
vm/02-firewall.sh
Normal file
@@ -0,0 +1,201 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# =============================================================================
|
||||||
|
# nftables Firewall for Security Scanner VM
|
||||||
|
# Run this inside the VM as root
|
||||||
|
# Defense in depth: works alongside PVE-level firewall
|
||||||
|
# =============================================================================
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
echo "============================================"
|
||||||
|
echo " nftables Firewall - Security Scanner VM"
|
||||||
|
echo "============================================"
|
||||||
|
|
||||||
|
# --- Configuration (MUST be set via environment variables) ---
|
||||||
|
ADMIN_IPS="${SCANNER_ADMIN_IPS:-192.168.68.0/24}"
|
||||||
|
INTERNAL_NETS="${SCANNER_INTERNAL_NETS:-10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16}"
|
||||||
|
DNS_SERVERS="${SCANNER_DNS_SERVERS:-192.168.68.1}"
|
||||||
|
|
||||||
|
# --- Guard: require ADMIN_IPS ---
|
||||||
|
if [[ -z "${ADMIN_IPS}" ]]; then
|
||||||
|
echo "[ERROR] SCANNER_ADMIN_IPS environment variable is not set." >&2
|
||||||
|
echo " Example: export SCANNER_ADMIN_IPS='192.168.68.100, 192.168.68.101'" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Install nftables ---
|
||||||
|
apt install -y nftables
|
||||||
|
systemctl enable nftables
|
||||||
|
|
||||||
|
# --- Write nftables config ---
|
||||||
|
cat > /etc/nftables.conf << EOF
|
||||||
|
#!/usr/sbin/nft -f
|
||||||
|
|
||||||
|
flush ruleset
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# Definitions
|
||||||
|
# =============================================================================
|
||||||
|
define ADMIN_IPS = { ${ADMIN_IPS} }
|
||||||
|
define INTERNAL_NETS = { ${INTERNAL_NETS} }
|
||||||
|
define DNS_SERVERS = { ${DNS_SERVERS} }
|
||||||
|
|
||||||
|
# Ports for scanner services
|
||||||
|
define SCANNER_WEB_PORTS = { 443, 9392 }
|
||||||
|
define SCANNER_SSH_PORT = 22
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# Main table
|
||||||
|
# =============================================================================
|
||||||
|
table inet firewall {
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# Sets for dynamic blocking
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
set blocked_ips {
|
||||||
|
type ipv4_addr
|
||||||
|
flags timeout
|
||||||
|
comment "Dynamically blocked IPs"
|
||||||
|
}
|
||||||
|
|
||||||
|
set ssh_bruteforce {
|
||||||
|
type ipv4_addr
|
||||||
|
flags dynamic, timeout
|
||||||
|
timeout 15m
|
||||||
|
comment "SSH brute force tracking"
|
||||||
|
}
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# INPUT chain - What can reach the scanner
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
chain input {
|
||||||
|
type filter hook input priority 0; policy drop;
|
||||||
|
|
||||||
|
# Drop blocked IPs immediately
|
||||||
|
ip saddr @blocked_ips drop
|
||||||
|
|
||||||
|
# Allow loopback
|
||||||
|
iif "lo" accept
|
||||||
|
|
||||||
|
# Allow established/related connections
|
||||||
|
ct state established,related accept
|
||||||
|
|
||||||
|
# Drop invalid packets
|
||||||
|
ct state invalid counter drop
|
||||||
|
|
||||||
|
# --- ICMP (rate limited) ---
|
||||||
|
ip protocol icmp icmp type {
|
||||||
|
echo-request,
|
||||||
|
echo-reply,
|
||||||
|
destination-unreachable,
|
||||||
|
time-exceeded
|
||||||
|
} limit rate 10/second accept
|
||||||
|
|
||||||
|
# --- SSH from admin IPs only (with brute-force protection) ---
|
||||||
|
tcp dport \$SCANNER_SSH_PORT ip saddr \$ADMIN_IPS \
|
||||||
|
ct state new \
|
||||||
|
limit rate 5/minute \
|
||||||
|
accept
|
||||||
|
|
||||||
|
# Track SSH brute force attempts
|
||||||
|
tcp dport \$SCANNER_SSH_PORT ct state new \
|
||||||
|
add @ssh_bruteforce { ip saddr limit rate 3/minute } \
|
||||||
|
counter drop
|
||||||
|
|
||||||
|
# --- OpenVAS Web UI from admin IPs only ---
|
||||||
|
tcp dport \$SCANNER_WEB_PORTS ip saddr \$ADMIN_IPS accept
|
||||||
|
|
||||||
|
# --- Docker internal communication (use iifname for wildcard) ---
|
||||||
|
iifname "docker*" accept
|
||||||
|
iifname "br-*" accept
|
||||||
|
|
||||||
|
# --- Log dropped packets (rate limited) ---
|
||||||
|
limit rate 10/second \
|
||||||
|
log prefix "[NFT-INPUT-DROP] " level warn
|
||||||
|
|
||||||
|
# Default: drop (set by policy)
|
||||||
|
}
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# FORWARD chain - Docker container traffic
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
chain forward {
|
||||||
|
type filter hook forward priority 0; policy accept;
|
||||||
|
|
||||||
|
# Allow Docker container communication
|
||||||
|
iifname "docker*" accept
|
||||||
|
oifname "docker*" accept
|
||||||
|
iifname "br-*" accept
|
||||||
|
oifname "br-*" accept
|
||||||
|
}
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# OUTPUT chain - What the scanner can reach
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
chain output {
|
||||||
|
type filter hook output priority 0; policy drop;
|
||||||
|
|
||||||
|
# Allow loopback
|
||||||
|
oif "lo" accept
|
||||||
|
|
||||||
|
# Allow established/related
|
||||||
|
ct state established,related accept
|
||||||
|
|
||||||
|
# --- DNS ---
|
||||||
|
udp dport 53 accept
|
||||||
|
tcp dport 53 accept
|
||||||
|
|
||||||
|
# --- NTP ---
|
||||||
|
udp dport 123 accept
|
||||||
|
|
||||||
|
# --- Scanning: allow ALL traffic to internal networks ---
|
||||||
|
# This is required for port scanning, service detection, vuln scanning
|
||||||
|
ip daddr \$INTERNAL_NETS accept
|
||||||
|
|
||||||
|
# --- Package updates and vuln DB sync (HTTPS/HTTP) ---
|
||||||
|
# Outbound HTTP/HTTPS is allowed for vuln DB updates, package management,
|
||||||
|
# and Docker image pulls. Restricted at PVE layer to update_targets IPSET.
|
||||||
|
tcp dport { 80, 443 } accept
|
||||||
|
|
||||||
|
# --- ICMP out ---
|
||||||
|
ip protocol icmp accept
|
||||||
|
|
||||||
|
# --- Log dropped outbound (rate limited) ---
|
||||||
|
limit rate 10/second \
|
||||||
|
log prefix "[NFT-OUTPUT-DROP] " level warn
|
||||||
|
|
||||||
|
# Default: drop (set by policy)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# Separate table for connection tracking and logging
|
||||||
|
# =============================================================================
|
||||||
|
table inet logging {
|
||||||
|
|
||||||
|
chain prerouting {
|
||||||
|
type filter hook prerouting priority -200; policy accept;
|
||||||
|
|
||||||
|
# Log new inbound connections (rate limited, for audit trail)
|
||||||
|
ct state new \
|
||||||
|
limit rate 5/second \
|
||||||
|
log prefix "[NFT-NEW-CONN] " level info
|
||||||
|
}
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# --- Apply rules ---
|
||||||
|
echo "[+] Applying nftables rules..."
|
||||||
|
nft -f /etc/nftables.conf
|
||||||
|
|
||||||
|
# --- Verify ---
|
||||||
|
echo "[+] Current ruleset:"
|
||||||
|
nft list ruleset
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "[+] nftables firewall configured and active."
|
||||||
|
echo ""
|
||||||
|
echo "Useful commands:"
|
||||||
|
echo " nft list ruleset # Show all rules"
|
||||||
|
echo " nft list set inet firewall blocked_ips # Show blocked IPs"
|
||||||
|
echo " nft add element inet firewall blocked_ips { 1.2.3.4 timeout 1h } # Block IP"
|
||||||
|
echo " systemctl restart nftables # Reload rules"
|
||||||
150
vm/03-ssh-harden.sh
Normal file
150
vm/03-ssh-harden.sh
Normal file
@@ -0,0 +1,150 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# =============================================================================
|
||||||
|
# SSH Hardening for Security Scanner VM
|
||||||
|
# Run this inside the VM as root
|
||||||
|
# =============================================================================
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
echo "============================================"
|
||||||
|
echo " SSH Hardening - Security Scanner VM"
|
||||||
|
echo "============================================"
|
||||||
|
|
||||||
|
SSHD_CONFIG="/etc/ssh/sshd_config"
|
||||||
|
SSHD_CUSTOM="/etc/ssh/sshd_config.d/99-scanner-hardening.conf"
|
||||||
|
SSHD_BACKUP="${SSHD_CONFIG}.bak.$(date +%Y%m%d_%H%M%S)"
|
||||||
|
|
||||||
|
# --- 1. Backup original config ---
|
||||||
|
cp "${SSHD_CONFIG}" "${SSHD_BACKUP}"
|
||||||
|
|
||||||
|
# --- 2. Write hardened SSH config ---
|
||||||
|
echo "[+] Writing hardened SSH configuration..."
|
||||||
|
cat > "${SSHD_CUSTOM}" << 'EOF'
|
||||||
|
# =============================================================================
|
||||||
|
# SSH Hardening - Security Scanner VM
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
# --- Authentication ---
|
||||||
|
PermitRootLogin no
|
||||||
|
PasswordAuthentication no
|
||||||
|
PubkeyAuthentication yes
|
||||||
|
AuthenticationMethods publickey
|
||||||
|
PermitEmptyPasswords no
|
||||||
|
MaxAuthTries 10
|
||||||
|
MaxSessions 3
|
||||||
|
LoginGraceTime 30
|
||||||
|
|
||||||
|
# --- Ciphers ---
|
||||||
|
KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
|
||||||
|
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
|
||||||
|
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
|
||||||
|
|
||||||
|
# --- Network ---
|
||||||
|
Port 22
|
||||||
|
AddressFamily inet
|
||||||
|
ListenAddress 0.0.0.0
|
||||||
|
TCPKeepAlive yes
|
||||||
|
ClientAliveInterval 300
|
||||||
|
ClientAliveCountMax 2
|
||||||
|
|
||||||
|
# --- Access control ---
|
||||||
|
# Uncomment and set your admin user
|
||||||
|
# AllowUsers scanner-admin
|
||||||
|
# AllowGroups ssh-users
|
||||||
|
|
||||||
|
# --- Restrictions ---
|
||||||
|
# DisableForwarding covers X11, agent, TCP forwarding, and tunneling
|
||||||
|
DisableForwarding yes
|
||||||
|
GatewayPorts no
|
||||||
|
|
||||||
|
# --- Logging ---
|
||||||
|
SyslogFacility AUTH
|
||||||
|
LogLevel VERBOSE
|
||||||
|
|
||||||
|
# --- Misc ---
|
||||||
|
PrintMotd no
|
||||||
|
PrintLastLog yes
|
||||||
|
UseDNS no
|
||||||
|
Compression no
|
||||||
|
StrictModes yes
|
||||||
|
IgnoreRhosts yes
|
||||||
|
HostbasedAuthentication no
|
||||||
|
|
||||||
|
# --- Banner ---
|
||||||
|
Banner /etc/issue.net
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# --- 3. Create scanner admin user ---
|
||||||
|
ADMIN_USER="scanner-admin"
|
||||||
|
# Also allow the cloud-init default user
|
||||||
|
CLOUDINIT_USER="${SCANNER_SSH_USER:-kai}"
|
||||||
|
echo "[+] Creating admin user: ${ADMIN_USER}..."
|
||||||
|
|
||||||
|
if ! id "${ADMIN_USER}" &>/dev/null; then
|
||||||
|
useradd -m -s /bin/bash -G sudo,docker "${ADMIN_USER}"
|
||||||
|
mkdir -p "/home/${ADMIN_USER}/.ssh"
|
||||||
|
chmod 700 "/home/${ADMIN_USER}/.ssh"
|
||||||
|
touch "/home/${ADMIN_USER}/.ssh/authorized_keys"
|
||||||
|
chmod 600 "/home/${ADMIN_USER}/.ssh/authorized_keys"
|
||||||
|
chown -R "${ADMIN_USER}:${ADMIN_USER}" "/home/${ADMIN_USER}/.ssh"
|
||||||
|
echo "[!] Add your SSH public key to: /home/${ADMIN_USER}/.ssh/authorized_keys"
|
||||||
|
else
|
||||||
|
echo " User ${ADMIN_USER} already exists."
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Set AllowUsers (idempotent: replace commented or active line)
|
||||||
|
ALLOW_USERS="${ADMIN_USER} ${CLOUDINIT_USER}"
|
||||||
|
if grep -q "^AllowUsers" "${SSHD_CUSTOM}"; then
|
||||||
|
sed -i "s/^AllowUsers.*/AllowUsers ${ALLOW_USERS}/" "${SSHD_CUSTOM}"
|
||||||
|
elif grep -q "^# AllowUsers" "${SSHD_CUSTOM}"; then
|
||||||
|
sed -i "s/^# AllowUsers.*/AllowUsers ${ALLOW_USERS}/" "${SSHD_CUSTOM}"
|
||||||
|
else
|
||||||
|
echo "AllowUsers ${ALLOW_USERS}" >> "${SSHD_CUSTOM}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- 4. Configure fail2ban for SSH ---
|
||||||
|
echo "[+] Configuring fail2ban for SSH..."
|
||||||
|
cat > /etc/fail2ban/jail.d/sshd.conf << 'EOF'
|
||||||
|
[sshd]
|
||||||
|
enabled = true
|
||||||
|
port = ssh
|
||||||
|
filter = sshd
|
||||||
|
backend = systemd
|
||||||
|
maxretry = 3
|
||||||
|
findtime = 600
|
||||||
|
bantime = 3600
|
||||||
|
banaction = nftables[type=allports]
|
||||||
|
EOF
|
||||||
|
|
||||||
|
systemctl enable fail2ban
|
||||||
|
systemctl restart fail2ban
|
||||||
|
|
||||||
|
# --- 5. Generate new host keys (replace defaults) ---
|
||||||
|
echo "[+] Regenerating SSH host keys..."
|
||||||
|
rm -f /etc/ssh/ssh_host_*
|
||||||
|
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""
|
||||||
|
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ""
|
||||||
|
|
||||||
|
# Remove small DH moduli
|
||||||
|
echo "[+] Hardening DH moduli..."
|
||||||
|
awk '$5 >= 3071' /etc/ssh/moduli > /etc/ssh/moduli.safe
|
||||||
|
mv /etc/ssh/moduli.safe /etc/ssh/moduli
|
||||||
|
|
||||||
|
# --- 6. Validate and restart ---
|
||||||
|
echo "[+] Validating SSH configuration..."
|
||||||
|
if sshd -t; then
|
||||||
|
systemctl restart ssh 2>/dev/null || systemctl restart sshd
|
||||||
|
echo "[+] SSH hardening complete."
|
||||||
|
else
|
||||||
|
echo "[!] SSH config validation failed. Restoring backup..."
|
||||||
|
cp "${SSHD_BACKUP}" "${SSHD_CONFIG}"
|
||||||
|
rm -f "${SSHD_CUSTOM}"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "[!] IMPORTANT: Before closing this session:"
|
||||||
|
echo " 1. Add your SSH public key to /home/${ADMIN_USER}/.ssh/authorized_keys"
|
||||||
|
echo " 2. Test login with: ssh ${ADMIN_USER}@<this-vm-ip>"
|
||||||
|
echo " 3. Verify you can sudo: sudo whoami"
|
||||||
|
echo ""
|
||||||
|
echo "[!] WARNING: Password login is DISABLED. Ensure key-based access works first!"
|
||||||
476
vm/04-install-tools.sh
Normal file
476
vm/04-install-tools.sh
Normal file
@@ -0,0 +1,476 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# =============================================================================
|
||||||
|
# Security Scanning Tools Installation
|
||||||
|
# Run this inside the VM as root
|
||||||
|
# =============================================================================
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
echo "============================================"
|
||||||
|
echo " Security Tools - Installation"
|
||||||
|
echo "============================================"
|
||||||
|
|
||||||
|
# --- 1. Base dependencies ---
|
||||||
|
echo "[+] Installing base dependencies..."
|
||||||
|
apt install -y \
|
||||||
|
curl wget git \
|
||||||
|
net-tools iproute2 \
|
||||||
|
dnsutils whois \
|
||||||
|
python3 python3-pip python3-venv \
|
||||||
|
jq tmux htop \
|
||||||
|
ca-certificates gnupg
|
||||||
|
|
||||||
|
# --- 2. Docker (for Greenbone OpenVAS) ---
|
||||||
|
if ! command -v docker &>/dev/null; then
|
||||||
|
echo "[+] Installing Docker..."
|
||||||
|
install -m 0755 -d /etc/apt/keyrings
|
||||||
|
curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
|
||||||
|
chmod 644 /etc/apt/keyrings/docker.asc
|
||||||
|
|
||||||
|
# Detect distro (debian or ubuntu)
|
||||||
|
. /etc/os-release
|
||||||
|
DOCKER_DISTRO="${ID}" # "debian" or "ubuntu"
|
||||||
|
DOCKER_CODENAME="${VERSION_CODENAME}"
|
||||||
|
echo \
|
||||||
|
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \
|
||||||
|
https://download.docker.com/linux/${DOCKER_DISTRO} \
|
||||||
|
${DOCKER_CODENAME} stable" | \
|
||||||
|
tee /etc/apt/sources.list.d/docker.list > /dev/null
|
||||||
|
|
||||||
|
apt update
|
||||||
|
apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
|
||||||
|
systemctl enable docker
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- 3. Nmap (network scanner) ---
|
||||||
|
echo "[+] Installing Nmap..."
|
||||||
|
apt install -y nmap
|
||||||
|
|
||||||
|
# --- Helper: download and verify binary from GitHub ---
|
||||||
|
install_github_binary() {
|
||||||
|
local REPO="$1" # e.g., projectdiscovery/nuclei
|
||||||
|
local NAME="$2" # e.g., nuclei
|
||||||
|
local ARCH="linux_amd64"
|
||||||
|
|
||||||
|
echo "[+] Installing ${NAME}..."
|
||||||
|
local VERSION
|
||||||
|
VERSION=$(curl -s "https://api.github.com/repos/${REPO}/releases/latest" | jq -r '.tag_name' | sed 's/^v//')
|
||||||
|
|
||||||
|
local ZIP_URL="https://github.com/${REPO}/releases/download/v${VERSION}/${NAME}_${VERSION}_${ARCH}.zip"
|
||||||
|
local CHECKSUM_URL="https://github.com/${REPO}/releases/download/v${VERSION}/${NAME}_${VERSION}_checksums.txt"
|
||||||
|
|
||||||
|
wget -q "${ZIP_URL}" -O "/tmp/${NAME}.zip"
|
||||||
|
wget -q "${CHECKSUM_URL}" -O "/tmp/${NAME}_checksums.txt"
|
||||||
|
|
||||||
|
# Verify checksum
|
||||||
|
local EXPECTED_SHA
|
||||||
|
EXPECTED_SHA=$(grep "${ARCH}.zip" "/tmp/${NAME}_checksums.txt" | awk '{print $1}')
|
||||||
|
local ACTUAL_SHA
|
||||||
|
ACTUAL_SHA=$(sha256sum "/tmp/${NAME}.zip" | awk '{print $1}')
|
||||||
|
|
||||||
|
if [[ "${EXPECTED_SHA}" != "${ACTUAL_SHA}" ]]; then
|
||||||
|
echo "[ERROR] Checksum verification failed for ${NAME}!" >&2
|
||||||
|
echo " Expected: ${EXPECTED_SHA}" >&2
|
||||||
|
echo " Actual: ${ACTUAL_SHA}" >&2
|
||||||
|
rm -f "/tmp/${NAME}.zip" "/tmp/${NAME}_checksums.txt"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
echo " Checksum verified for ${NAME} v${VERSION}"
|
||||||
|
|
||||||
|
unzip -o "/tmp/${NAME}.zip" -d "/tmp/${NAME}-bin"
|
||||||
|
mv "/tmp/${NAME}-bin/${NAME}" "/usr/local/bin/${NAME}"
|
||||||
|
chmod +x "/usr/local/bin/${NAME}"
|
||||||
|
rm -rf "/tmp/${NAME}.zip" "/tmp/${NAME}-bin" "/tmp/${NAME}_checksums.txt"
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- 4. Nuclei (fast vulnerability scanner) ---
|
||||||
|
install_github_binary "projectdiscovery/nuclei" "nuclei"
|
||||||
|
|
||||||
|
# Update Nuclei templates
|
||||||
|
nuclei -update-templates 2>&1 | logger -t nuclei-setup || true
|
||||||
|
|
||||||
|
# --- 5. httpx (HTTP toolkit) ---
|
||||||
|
install_github_binary "projectdiscovery/httpx" "httpx"
|
||||||
|
|
||||||
|
# --- 6. Nikto (web server scanner) ---
|
||||||
|
echo "[+] Installing Nikto..."
|
||||||
|
apt install -y nikto
|
||||||
|
|
||||||
|
# --- 7. testssl.sh (TLS/SSL testing) ---
|
||||||
|
echo "[+] Installing testssl.sh..."
|
||||||
|
git clone --depth 1 https://github.com/drwetter/testssl.sh.git /opt/testssl
|
||||||
|
ln -sf /opt/testssl/testssl.sh /usr/local/bin/testssl
|
||||||
|
|
||||||
|
# --- 8. CrackMapExec / NetExec (network assessment) ---
|
||||||
|
echo "[+] Installing NetExec..."
|
||||||
|
python3 -m pip install --break-system-packages netexec 2>/dev/null || \
|
||||||
|
pipx install netexec 2>/dev/null || \
|
||||||
|
echo "[!] NetExec install failed - install manually if needed"
|
||||||
|
|
||||||
|
# --- 9. Greenbone OpenVAS (Docker Compose) ---
|
||||||
|
echo "[+] Setting up Greenbone OpenVAS..."
|
||||||
|
mkdir -p /opt/greenbone
|
||||||
|
cat > /opt/greenbone/docker-compose.yml << 'COMPEOF'
|
||||||
|
name: greenbone-community-edition
|
||||||
|
|
||||||
|
services:
|
||||||
|
vulnerability-tests:
|
||||||
|
image: registry.community.greenbone.net/community/vulnerability-tests
|
||||||
|
environment:
|
||||||
|
FEED_RELEASE: "24.10"
|
||||||
|
KEEP_ALIVE: 1
|
||||||
|
volumes:
|
||||||
|
- vt_data_vol:/mnt
|
||||||
|
|
||||||
|
notus-data:
|
||||||
|
image: registry.community.greenbone.net/community/notus-data
|
||||||
|
environment:
|
||||||
|
KEEP_ALIVE: 1
|
||||||
|
volumes:
|
||||||
|
- notus_data_vol:/mnt
|
||||||
|
|
||||||
|
scap-data:
|
||||||
|
image: registry.community.greenbone.net/community/scap-data
|
||||||
|
environment:
|
||||||
|
KEEP_ALIVE: 1
|
||||||
|
volumes:
|
||||||
|
- scap_data_vol:/mnt
|
||||||
|
|
||||||
|
cert-bund-data:
|
||||||
|
image: registry.community.greenbone.net/community/cert-bund-data
|
||||||
|
environment:
|
||||||
|
KEEP_ALIVE: 1
|
||||||
|
volumes:
|
||||||
|
- cert_data_vol:/mnt
|
||||||
|
|
||||||
|
dfn-cert-data:
|
||||||
|
image: registry.community.greenbone.net/community/dfn-cert-data
|
||||||
|
environment:
|
||||||
|
KEEP_ALIVE: 1
|
||||||
|
volumes:
|
||||||
|
- cert_data_vol:/mnt
|
||||||
|
depends_on:
|
||||||
|
cert-bund-data:
|
||||||
|
condition: service_healthy
|
||||||
|
|
||||||
|
data-objects:
|
||||||
|
image: registry.community.greenbone.net/community/data-objects
|
||||||
|
environment:
|
||||||
|
FEED_RELEASE: "24.10"
|
||||||
|
KEEP_ALIVE: 1
|
||||||
|
volumes:
|
||||||
|
- data_objects_vol:/mnt
|
||||||
|
|
||||||
|
report-formats:
|
||||||
|
image: registry.community.greenbone.net/community/report-formats
|
||||||
|
environment:
|
||||||
|
FEED_RELEASE: "24.10"
|
||||||
|
KEEP_ALIVE: 1
|
||||||
|
volumes:
|
||||||
|
- data_objects_vol:/mnt
|
||||||
|
depends_on:
|
||||||
|
data-objects:
|
||||||
|
condition: service_healthy
|
||||||
|
|
||||||
|
gpg-data:
|
||||||
|
image: registry.community.greenbone.net/community/gpg-data
|
||||||
|
volumes:
|
||||||
|
- gpg_data_vol:/mnt
|
||||||
|
|
||||||
|
redis-server:
|
||||||
|
image: registry.community.greenbone.net/community/redis-server
|
||||||
|
restart: on-failure
|
||||||
|
volumes:
|
||||||
|
- redis_socket_vol:/run/redis/
|
||||||
|
|
||||||
|
pg-gvm-migrator:
|
||||||
|
image: registry.community.greenbone.net/community/pg-gvm-migrator:stable
|
||||||
|
restart: "no"
|
||||||
|
volumes:
|
||||||
|
- psql_data_vol:/var/lib/postgresql
|
||||||
|
- psql_socket_vol:/var/run/postgresql
|
||||||
|
|
||||||
|
pg-gvm:
|
||||||
|
image: registry.community.greenbone.net/community/pg-gvm:stable
|
||||||
|
restart: on-failure:10
|
||||||
|
volumes:
|
||||||
|
- psql_data_vol:/var/lib/postgresql
|
||||||
|
- psql_socket_vol:/var/run/postgresql
|
||||||
|
depends_on:
|
||||||
|
pg-gvm-migrator:
|
||||||
|
condition: service_completed_successfully
|
||||||
|
|
||||||
|
gvmd:
|
||||||
|
image: registry.community.greenbone.net/community/gvmd:stable
|
||||||
|
restart: on-failure
|
||||||
|
volumes:
|
||||||
|
- gvmd_data_vol:/var/lib/gvm
|
||||||
|
- scap_data_vol:/var/lib/gvm/scap-data/
|
||||||
|
- cert_data_vol:/var/lib/gvm/cert-data
|
||||||
|
- data_objects_vol:/var/lib/gvm/data-objects/gvmd
|
||||||
|
- vt_data_vol:/var/lib/openvas/plugins
|
||||||
|
- psql_data_vol:/var/lib/postgresql
|
||||||
|
- gvmd_socket_vol:/run/gvmd
|
||||||
|
- ospd_openvas_socket_vol:/run/ospd
|
||||||
|
- psql_socket_vol:/var/run/postgresql
|
||||||
|
depends_on:
|
||||||
|
pg-gvm:
|
||||||
|
condition: service_started
|
||||||
|
scap-data:
|
||||||
|
condition: service_healthy
|
||||||
|
cert-bund-data:
|
||||||
|
condition: service_healthy
|
||||||
|
dfn-cert-data:
|
||||||
|
condition: service_healthy
|
||||||
|
data-objects:
|
||||||
|
condition: service_healthy
|
||||||
|
report-formats:
|
||||||
|
condition: service_healthy
|
||||||
|
|
||||||
|
gsa:
|
||||||
|
image: registry.community.greenbone.net/community/gsa:stable-slim
|
||||||
|
environment:
|
||||||
|
MOUNT_PATH: "/mnt/web"
|
||||||
|
KEEP_ALIVE: 1
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD-SHELL", "test -e /run/gsa/copying.done"]
|
||||||
|
start_period: 5s
|
||||||
|
volumes:
|
||||||
|
- gsa_data_vol:/mnt/web
|
||||||
|
|
||||||
|
gsad:
|
||||||
|
image: registry.community.greenbone.net/community/gsad:stable
|
||||||
|
restart: on-failure
|
||||||
|
environment:
|
||||||
|
GSAD_ARGS: "--listen=0.0.0.0 --http-only --api-only -f"
|
||||||
|
volumes:
|
||||||
|
- gvmd_socket_vol:/run/gvmd
|
||||||
|
depends_on:
|
||||||
|
gvmd:
|
||||||
|
condition: service_started
|
||||||
|
|
||||||
|
gvm-config:
|
||||||
|
image: registry.community.greenbone.net/community/gvm-config:latest
|
||||||
|
environment:
|
||||||
|
ENABLE_NGINX_CONFIG: "true"
|
||||||
|
ENABLE_TLS_GENERATION: "true"
|
||||||
|
volumes:
|
||||||
|
- nginx_config_vol:/mnt/nginx/configs
|
||||||
|
- nginx_certificates_vol:/mnt/nginx/certs
|
||||||
|
|
||||||
|
nginx:
|
||||||
|
image: registry.community.greenbone.net/community/nginx:latest
|
||||||
|
ports:
|
||||||
|
- "0.0.0.0:9392:9392"
|
||||||
|
volumes:
|
||||||
|
- nginx_config_vol:/etc/nginx/conf.d:ro
|
||||||
|
- nginx_certificates_vol:/etc/nginx/certs:ro
|
||||||
|
- gsa_data_vol:/usr/share/nginx/html:ro
|
||||||
|
depends_on:
|
||||||
|
gvm-config:
|
||||||
|
condition: service_completed_successfully
|
||||||
|
gsa:
|
||||||
|
condition: service_healthy
|
||||||
|
gsad:
|
||||||
|
condition: service_started
|
||||||
|
|
||||||
|
configure-openvas:
|
||||||
|
image: registry.community.greenbone.net/community/openvas-scanner:stable
|
||||||
|
volumes:
|
||||||
|
- openvas_data_vol:/mnt
|
||||||
|
- openvas_log_data_vol:/var/log/openvas
|
||||||
|
command:
|
||||||
|
- /bin/sh
|
||||||
|
- -c
|
||||||
|
- |
|
||||||
|
printf "table_driven_lsc = yes\nopenvasd_server = http://openvasd:80\n" > /mnt/openvas.conf
|
||||||
|
sed "s/127/128/" /etc/openvas/openvas_log.conf | sed 's/gvm/openvas/' > /mnt/openvas_log.conf
|
||||||
|
chmod 644 /mnt/openvas.conf
|
||||||
|
chmod 644 /mnt/openvas_log.conf
|
||||||
|
touch /var/log/openvas/openvas.log
|
||||||
|
chmod 666 /var/log/openvas/openvas.log
|
||||||
|
|
||||||
|
openvas:
|
||||||
|
image: registry.community.greenbone.net/community/openvas-scanner:stable
|
||||||
|
restart: on-failure
|
||||||
|
volumes:
|
||||||
|
- openvas_data_vol:/etc/openvas
|
||||||
|
- openvas_log_data_vol:/var/log/openvas
|
||||||
|
command:
|
||||||
|
- /bin/sh
|
||||||
|
- -c
|
||||||
|
- |
|
||||||
|
cat /etc/openvas/openvas.conf
|
||||||
|
tail -f /var/log/openvas/openvas.log
|
||||||
|
depends_on:
|
||||||
|
configure-openvas:
|
||||||
|
condition: service_completed_successfully
|
||||||
|
|
||||||
|
openvasd:
|
||||||
|
image: registry.community.greenbone.net/community/openvas-scanner:stable
|
||||||
|
restart: on-failure
|
||||||
|
environment:
|
||||||
|
OPENVASD_MODE: service_notus
|
||||||
|
GNUPGHOME: /etc/openvas/gnupg
|
||||||
|
LISTENING: 0.0.0.0:80
|
||||||
|
volumes:
|
||||||
|
- openvas_data_vol:/etc/openvas
|
||||||
|
- openvas_log_data_vol:/var/log/openvas
|
||||||
|
- gpg_data_vol:/etc/openvas/gnupg
|
||||||
|
- notus_data_vol:/var/lib/notus
|
||||||
|
depends_on:
|
||||||
|
vulnerability-tests:
|
||||||
|
condition: service_healthy
|
||||||
|
notus-data:
|
||||||
|
condition: service_healthy
|
||||||
|
configure-openvas:
|
||||||
|
condition: service_completed_successfully
|
||||||
|
gpg-data:
|
||||||
|
condition: service_completed_successfully
|
||||||
|
networks:
|
||||||
|
default:
|
||||||
|
aliases:
|
||||||
|
- openvasd
|
||||||
|
|
||||||
|
ospd-openvas:
|
||||||
|
image: registry.community.greenbone.net/community/ospd-openvas:stable
|
||||||
|
restart: on-failure
|
||||||
|
hostname: ospd-openvas.local
|
||||||
|
# SECURITY NOTE: NET_ADMIN, NET_RAW, and seccomp=unconfined are required
|
||||||
|
# for raw packet scanning (SYN scans, OS detection). Risk is mitigated by
|
||||||
|
# host-level nftables, PVE firewall, and VM-level isolation.
|
||||||
|
cap_add:
|
||||||
|
- NET_ADMIN
|
||||||
|
- NET_RAW
|
||||||
|
security_opt:
|
||||||
|
- seccomp=unconfined
|
||||||
|
- apparmor=unconfined
|
||||||
|
command:
|
||||||
|
[
|
||||||
|
"ospd-openvas",
|
||||||
|
"-f",
|
||||||
|
"--config",
|
||||||
|
"/etc/gvm/ospd-openvas.conf",
|
||||||
|
"--notus-feed-dir",
|
||||||
|
"/var/lib/notus/advisories",
|
||||||
|
"-m",
|
||||||
|
"666",
|
||||||
|
]
|
||||||
|
volumes:
|
||||||
|
- gpg_data_vol:/etc/openvas/gnupg
|
||||||
|
- vt_data_vol:/var/lib/openvas/plugins
|
||||||
|
- notus_data_vol:/var/lib/notus
|
||||||
|
- ospd_openvas_socket_vol:/run/ospd
|
||||||
|
- redis_socket_vol:/run/redis/
|
||||||
|
- openvas_data_vol:/etc/openvas/
|
||||||
|
- openvas_log_data_vol:/var/log/openvas
|
||||||
|
depends_on:
|
||||||
|
redis-server:
|
||||||
|
condition: service_started
|
||||||
|
gpg-data:
|
||||||
|
condition: service_completed_successfully
|
||||||
|
configure-openvas:
|
||||||
|
condition: service_completed_successfully
|
||||||
|
vulnerability-tests:
|
||||||
|
condition: service_healthy
|
||||||
|
notus-data:
|
||||||
|
condition: service_healthy
|
||||||
|
|
||||||
|
gvm-tools:
|
||||||
|
image: registry.community.greenbone.net/community/gvm-tools
|
||||||
|
volumes:
|
||||||
|
- gvmd_socket_vol:/run/gvmd
|
||||||
|
- ospd_openvas_socket_vol:/run/ospd
|
||||||
|
depends_on:
|
||||||
|
- gvmd
|
||||||
|
- ospd-openvas
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
gpg_data_vol:
|
||||||
|
scap_data_vol:
|
||||||
|
cert_data_vol:
|
||||||
|
data_objects_vol:
|
||||||
|
gvmd_data_vol:
|
||||||
|
psql_data_vol:
|
||||||
|
vt_data_vol:
|
||||||
|
notus_data_vol:
|
||||||
|
psql_socket_vol:
|
||||||
|
gvmd_socket_vol:
|
||||||
|
ospd_openvas_socket_vol:
|
||||||
|
redis_socket_vol:
|
||||||
|
openvas_data_vol:
|
||||||
|
openvas_log_data_vol:
|
||||||
|
gsa_data_vol:
|
||||||
|
nginx_config_vol:
|
||||||
|
nginx_certificates_vol:
|
||||||
|
COMPEOF
|
||||||
|
|
||||||
|
# --- 10. Create scan scripts directory ---
|
||||||
|
mkdir -p /opt/scans/{results,scripts}
|
||||||
|
|
||||||
|
# Quick scan helper script
|
||||||
|
cat > /opt/scans/scripts/quick-scan.sh << 'SCANEOF'
|
||||||
|
#!/bin/bash
|
||||||
|
# Quick internal network scan
|
||||||
|
# Usage: ./quick-scan.sh 192.168.1.0/24
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
TARGET="${1:?Usage: $0 <target-subnet>}"
|
||||||
|
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
|
||||||
|
RESULTS_DIR="/opt/scans/results/${TIMESTAMP}"
|
||||||
|
mkdir -p "${RESULTS_DIR}"
|
||||||
|
|
||||||
|
echo "[+] Starting quick scan of ${TARGET}"
|
||||||
|
echo "[+] Results will be saved to ${RESULTS_DIR}"
|
||||||
|
|
||||||
|
# Step 1: Host discovery
|
||||||
|
echo "[+] Step 1/4: Host discovery..."
|
||||||
|
nmap -sn "${TARGET}" -oG "${RESULTS_DIR}/hosts-alive.gnmap"
|
||||||
|
HOSTS=$(grep "Up" "${RESULTS_DIR}/hosts-alive.gnmap" | awk '{print $2}')
|
||||||
|
echo "${HOSTS}" > "${RESULTS_DIR}/hosts-alive.txt"
|
||||||
|
HOST_COUNT=$(wc -l < "${RESULTS_DIR}/hosts-alive.txt")
|
||||||
|
echo " Found ${HOST_COUNT} alive hosts"
|
||||||
|
|
||||||
|
# Step 2: Port scan top 1000
|
||||||
|
echo "[+] Step 2/4: Port scanning (top 1000 ports)..."
|
||||||
|
nmap -sV --script=safe -T4 --top-ports 1000 -iL "${RESULTS_DIR}/hosts-alive.txt" \
|
||||||
|
-oA "${RESULTS_DIR}/port-scan"
|
||||||
|
|
||||||
|
# Step 3: HTTP service detection
|
||||||
|
echo "[+] Step 3/4: HTTP service detection..."
|
||||||
|
grep -oP '\d+\.\d+\.\d+\.\d+' "${RESULTS_DIR}/hosts-alive.txt" | \
|
||||||
|
httpx -silent -ports 80,443,8080,8443,9090 -o "${RESULTS_DIR}/http-services.txt" 2>/dev/null || true
|
||||||
|
|
||||||
|
# Step 4: Nuclei scan on HTTP services
|
||||||
|
if [ -s "${RESULTS_DIR}/http-services.txt" ]; then
|
||||||
|
echo "[+] Step 4/4: Vulnerability scanning with Nuclei..."
|
||||||
|
nuclei -l "${RESULTS_DIR}/http-services.txt" \
|
||||||
|
-severity medium,high,critical \
|
||||||
|
-o "${RESULTS_DIR}/nuclei-findings.txt" 2>/dev/null || true
|
||||||
|
else
|
||||||
|
echo "[+] Step 4/4: No HTTP services found, skipping Nuclei."
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "[+] Scan complete. Results in: ${RESULTS_DIR}"
|
||||||
|
echo " - hosts-alive.txt: Live hosts"
|
||||||
|
echo " - port-scan.*: Port scan results"
|
||||||
|
echo " - http-services.txt: HTTP endpoints"
|
||||||
|
echo " - nuclei-findings.txt: Vulnerabilities found"
|
||||||
|
SCANEOF
|
||||||
|
chmod +x /opt/scans/scripts/quick-scan.sh
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "[+] All security tools installed."
|
||||||
|
echo ""
|
||||||
|
echo "Tool summary:"
|
||||||
|
echo " nmap - Network discovery and port scanning"
|
||||||
|
echo " nuclei - Fast vulnerability scanner"
|
||||||
|
echo " httpx - HTTP probing"
|
||||||
|
echo " nikto - Web server scanner"
|
||||||
|
echo " testssl - TLS/SSL testing"
|
||||||
|
echo " netexec - Network assessment (SMB, RDP, etc.)"
|
||||||
|
echo " OpenVAS (Docker) - Full vulnerability management"
|
||||||
|
echo ""
|
||||||
|
echo "Quick start:"
|
||||||
|
echo " cd /opt/greenbone && docker compose up -d # Start OpenVAS"
|
||||||
|
echo " /opt/scans/scripts/quick-scan.sh 192.168.1.0/24 # Quick scan"
|
||||||
166
vm/05-monitoring.sh
Normal file
166
vm/05-monitoring.sh
Normal file
@@ -0,0 +1,166 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# =============================================================================
|
||||||
|
# Monitoring and Logging for Security Scanner VM
|
||||||
|
# Run this inside the VM as root
|
||||||
|
# =============================================================================
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
echo "============================================"
|
||||||
|
echo " Monitoring & Logging - Security Scanner VM"
|
||||||
|
echo "============================================"
|
||||||
|
|
||||||
|
# --- 1. Configure rsyslog for centralized logging ---
|
||||||
|
echo "[+] Configuring rsyslog..."
|
||||||
|
cat > /etc/rsyslog.d/99-scanner.conf << 'EOF'
|
||||||
|
# Log all scanner-related activity to dedicated file
|
||||||
|
:programname, startswith, "nmap" /var/log/scanner/nmap.log
|
||||||
|
:programname, startswith, "nuclei" /var/log/scanner/nuclei.log
|
||||||
|
:programname, startswith, "nft" /var/log/scanner/firewall.log
|
||||||
|
|
||||||
|
# Log auth separately with more detail
|
||||||
|
auth,authpriv.* /var/log/scanner/auth.log
|
||||||
|
|
||||||
|
# Uncomment to forward to remote syslog server
|
||||||
|
# *.* @@syslog.internal.lan:514
|
||||||
|
EOF
|
||||||
|
|
||||||
|
mkdir -p /var/log/scanner
|
||||||
|
systemctl restart rsyslog
|
||||||
|
|
||||||
|
# --- 2. Log rotation ---
|
||||||
|
echo "[+] Configuring log rotation..."
|
||||||
|
cat > /etc/logrotate.d/scanner << 'EOF'
|
||||||
|
/var/log/scanner/*.log {
|
||||||
|
daily
|
||||||
|
missingok
|
||||||
|
rotate 30
|
||||||
|
compress
|
||||||
|
delaycompress
|
||||||
|
notifempty
|
||||||
|
create 0640 root adm
|
||||||
|
sharedscripts
|
||||||
|
postrotate
|
||||||
|
systemctl reload rsyslog > /dev/null 2>&1 || true
|
||||||
|
endscript
|
||||||
|
}
|
||||||
|
|
||||||
|
/opt/scans/results/*/*.txt {
|
||||||
|
weekly
|
||||||
|
missingok
|
||||||
|
rotate 12
|
||||||
|
compress
|
||||||
|
notifempty
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# --- 3. Logwatch (daily summary reports) ---
|
||||||
|
echo "[+] Configuring Logwatch..."
|
||||||
|
cat > /etc/logwatch/conf/logwatch.conf << 'EOF'
|
||||||
|
LogDir = /var/log
|
||||||
|
MailTo = root
|
||||||
|
MailFrom = scanner@localhost
|
||||||
|
Range = yesterday
|
||||||
|
Detail = Med
|
||||||
|
Service = All
|
||||||
|
Format = text
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# --- 4. Disk usage monitoring ---
|
||||||
|
echo "[+] Setting up disk usage monitoring..."
|
||||||
|
cat > /opt/scans/scripts/check-disk.sh << 'DISKEOF'
|
||||||
|
#!/bin/bash
|
||||||
|
set -euo pipefail
|
||||||
|
# Alert if disk usage exceeds threshold
|
||||||
|
THRESHOLD=85
|
||||||
|
USAGE=$(df / | tail -1 | awk '{print $5}' | sed 's/%//')
|
||||||
|
|
||||||
|
if [ "${USAGE}" -ge "${THRESHOLD}" ]; then
|
||||||
|
echo "[ALERT] Disk usage at ${USAGE}% on security scanner" | \
|
||||||
|
logger -t disk-monitor -p user.warning
|
||||||
|
echo "[ALERT] Disk usage at ${USAGE}% - consider cleaning /opt/scans/results/"
|
||||||
|
fi
|
||||||
|
DISKEOF
|
||||||
|
chmod +x /opt/scans/scripts/check-disk.sh
|
||||||
|
|
||||||
|
# --- 5. Docker health check ---
|
||||||
|
cat > /opt/scans/scripts/check-openvas.sh << 'HEALTHEOF'
|
||||||
|
#!/bin/bash
|
||||||
|
set -euo pipefail
|
||||||
|
# Check if OpenVAS containers are healthy
|
||||||
|
|
||||||
|
if [[ ! -d /opt/greenbone ]]; then
|
||||||
|
echo "[!] /opt/greenbone not found - skipping health check"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
UNHEALTHY=$(docker compose -f /opt/greenbone/docker-compose.yml ps --format json 2>/dev/null | jq -r 'select(.State != "running") | .Name' 2>/dev/null || true)
|
||||||
|
|
||||||
|
if [ -n "${UNHEALTHY}" ]; then
|
||||||
|
echo "[ALERT] Unhealthy OpenVAS containers: ${UNHEALTHY}" | \
|
||||||
|
logger -t openvas-health -p user.warning
|
||||||
|
echo "[ALERT] Restarting unhealthy containers..."
|
||||||
|
docker compose -f /opt/greenbone/docker-compose.yml up -d
|
||||||
|
fi
|
||||||
|
HEALTHEOF
|
||||||
|
chmod +x /opt/scans/scripts/check-openvas.sh
|
||||||
|
|
||||||
|
# --- 6. Cron jobs ---
|
||||||
|
echo "[+] Setting up monitoring cron jobs..."
|
||||||
|
cat > /etc/cron.d/scanner-monitoring << 'EOF'
|
||||||
|
# Disk check every 6 hours
|
||||||
|
0 */6 * * * root /opt/scans/scripts/check-disk.sh
|
||||||
|
|
||||||
|
# OpenVAS health check every 30 minutes
|
||||||
|
*/30 * * * * root /opt/scans/scripts/check-openvas.sh
|
||||||
|
|
||||||
|
# AIDE integrity check daily at 3am
|
||||||
|
0 3 * * * root /usr/bin/aide --check 2>&1 | logger -t aide-check -p user.info
|
||||||
|
|
||||||
|
# Lynis security audit weekly (Sunday 2am)
|
||||||
|
0 2 * * 0 root /usr/sbin/lynis audit system --quick --no-colors 2>&1 | logger -t lynis-audit -p user.info
|
||||||
|
|
||||||
|
# Clean scan results older than 90 days (maxdepth 1 for safety, log to syslog)
|
||||||
|
0 4 * * 0 root find /opt/scans/results -maxdepth 1 -type d -mtime +90 -print -exec rm -rf {} + 2>&1 | logger -t scan-cleanup
|
||||||
|
|
||||||
|
# Update Nuclei templates weekly
|
||||||
|
0 5 * * 1 root /usr/local/bin/nuclei -update-templates 2>&1 | logger -t nuclei-update -p user.info
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# --- 7. Login banner ---
|
||||||
|
echo "[+] Setting login banner..."
|
||||||
|
cat > /etc/motd << 'EOF'
|
||||||
|
+=====================================================+
|
||||||
|
| SECURITY SCANNER - AUTHORIZED ACCESS ONLY |
|
||||||
|
| |
|
||||||
|
| All activity on this system is logged and audited. |
|
||||||
|
| Unauthorized access is prohibited. |
|
||||||
|
+=====================================================+
|
||||||
|
|
||||||
|
Tools: nmap | nuclei | httpx | nikto | testssl | OpenVAS
|
||||||
|
Scans: /opt/scans/scripts/quick-scan.sh <target>
|
||||||
|
Logs: /var/log/scanner/
|
||||||
|
OpenVAS: http://localhost:9392
|
||||||
|
|
||||||
|
EOF
|
||||||
|
|
||||||
|
cat > /etc/issue.net << 'EOF'
|
||||||
|
*************************************************************
|
||||||
|
* WARNING: This is a restricted system. *
|
||||||
|
* All connections are monitored and recorded. *
|
||||||
|
* Disconnect IMMEDIATELY if you are not authorized. *
|
||||||
|
*************************************************************
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Banner is configured in /etc/ssh/sshd_config.d/99-scanner-hardening.conf by 03-ssh-harden.sh
|
||||||
|
systemctl reload ssh 2>/dev/null || systemctl reload sshd 2>/dev/null || true
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "[+] Monitoring and logging configured."
|
||||||
|
echo ""
|
||||||
|
echo "Summary:"
|
||||||
|
echo " Logs: /var/log/scanner/"
|
||||||
|
echo " Scan results: /opt/scans/results/"
|
||||||
|
echo " Cron jobs: /etc/cron.d/scanner-monitoring"
|
||||||
|
echo " Logwatch: Daily email summary to root"
|
||||||
|
echo " AIDE: File integrity check daily at 3am"
|
||||||
|
echo " Lynis: Security audit weekly (Sunday 2am)"
|
||||||
35
vm/06-docker-autostart.sh
Normal file
35
vm/06-docker-autostart.sh
Normal file
@@ -0,0 +1,35 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# =============================================================================
|
||||||
|
# Docker Compose Autostart for Greenbone OpenVAS
|
||||||
|
# Creates a systemd service so containers start on boot
|
||||||
|
# =============================================================================
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
echo "[+] Creating systemd service for Greenbone OpenVAS..."
|
||||||
|
|
||||||
|
cat > /etc/systemd/system/greenbone-openvas.service << 'EOF'
|
||||||
|
[Unit]
|
||||||
|
Description=Greenbone OpenVAS Scanner
|
||||||
|
Requires=docker.service
|
||||||
|
After=docker.service
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
RemainAfterExit=yes
|
||||||
|
WorkingDirectory=/opt/greenbone
|
||||||
|
ExecStart=/usr/bin/docker compose up -d
|
||||||
|
ExecStop=/usr/bin/docker compose down
|
||||||
|
TimeoutStartSec=300
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOF
|
||||||
|
|
||||||
|
systemctl daemon-reload
|
||||||
|
systemctl enable greenbone-openvas.service
|
||||||
|
|
||||||
|
echo "[+] Greenbone OpenVAS will start automatically on boot."
|
||||||
|
echo " Manual control:"
|
||||||
|
echo " systemctl start greenbone-openvas"
|
||||||
|
echo " systemctl stop greenbone-openvas"
|
||||||
|
echo " systemctl status greenbone-openvas"
|
||||||
61
vm/setup.sh
Normal file
61
vm/setup.sh
Normal file
@@ -0,0 +1,61 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# =============================================================================
|
||||||
|
# Security Scanner VM - Full Setup
|
||||||
|
# Run this inside the VM as root to execute all scripts in order
|
||||||
|
# =============================================================================
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||||
|
|
||||||
|
# --- Pre-flight checks ---
|
||||||
|
if [[ "$(id -u)" -ne 0 ]]; then
|
||||||
|
echo "[ERROR] This script must be run as root." >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ -z "${SCANNER_ADMIN_IPS:-}" ]]; then
|
||||||
|
echo "[ERROR] Set SCANNER_ADMIN_IPS before running." >&2
|
||||||
|
echo " Example: export SCANNER_ADMIN_IPS='192.168.68.100, 192.168.68.101'" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "============================================"
|
||||||
|
echo " Security Scanner VM - Full Setup"
|
||||||
|
echo "============================================"
|
||||||
|
echo ""
|
||||||
|
echo " ADMIN_IPS: ${SCANNER_ADMIN_IPS}"
|
||||||
|
echo " INTERNAL_NETS: ${SCANNER_INTERNAL_NETS:-10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16}"
|
||||||
|
echo " DNS_SERVERS: ${SCANNER_DNS_SERVERS:-192.168.68.1}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
SCRIPTS=(
|
||||||
|
"01-system-harden.sh"
|
||||||
|
"02-firewall.sh"
|
||||||
|
"03-ssh-harden.sh"
|
||||||
|
"04-install-tools.sh"
|
||||||
|
"05-monitoring.sh"
|
||||||
|
)
|
||||||
|
|
||||||
|
for script in "${SCRIPTS[@]}"; do
|
||||||
|
SCRIPT_PATH="${SCRIPT_DIR}/${script}"
|
||||||
|
if [[ ! -f "${SCRIPT_PATH}" ]]; then
|
||||||
|
echo "[ERROR] Script not found: ${SCRIPT_PATH}" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
echo ""
|
||||||
|
echo ">>> Running ${script}..."
|
||||||
|
bash "${SCRIPT_PATH}"
|
||||||
|
echo ">>> ${script} completed."
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "============================================"
|
||||||
|
echo " Setup complete!"
|
||||||
|
echo "============================================"
|
||||||
|
echo ""
|
||||||
|
echo " Next steps:"
|
||||||
|
echo " 1. Add SSH key: /home/scanner-admin/.ssh/authorized_keys"
|
||||||
|
echo " 2. Start OpenVAS: cd /opt/greenbone && docker compose up -d"
|
||||||
|
echo " 3. Set OpenVAS password:"
|
||||||
|
echo " docker compose exec -u gvmd gvmd gvmd --user=admin --new-password=<PASSWORD>"
|
||||||
|
echo " 4. Reboot: shutdown -r now"
|
||||||
Reference in New Issue
Block a user