ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-10 23:05:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added connection test for port 9300 in both linux and macosx on extra779

Browse Source
This commit is contained in:
Toni de la Fuente
2020-03-25 18:19:41 +01:00
parent eae4722499
commit 8faf1f45c4
2 changed files with 41 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
checks/check_extra779
View File

@@ -17,23 +17,24 @@ CHECK_TYPE_extra779="EXTRA"
CHECK_ALTERNATE_check779="extra779"
extra779(){
# if TEST_AUTHENTICATION has a value Prowler will try to access each ElasticSearch server to ports 9200/9300/5601
# from the host where Prowler is running and will try to read indices or get kibana status
TEST_ES_AUTHENTICATION=
# if TEST_AUTHENTICATION has a value Prowler will try to access each ElasticSearch server to port:
# 9200 API, 9300 Communcation and 5601 Kibana to figure out if authentication is enabled.
# That is from the host where Prowler is running and will try to read indices or get kibana status
TEST_ES_AUTHENTICATION=1
httpStatus(){
case $1 in
000) SERVER_RESPONSE="000 Not responding within 2 seconds" ;;
000) SERVER_RESPONSE="000 Not responding" ;;
200) SERVER_RESPONSE="200 Successful" ;;
400) SERVER_RESPONSE="400 Error: Bad Request" ;;
401) SERVER_RESPONSE="401 Error: Unauthorized" ;;
403) SERVER_RESPONSE="403 Error: Forbidden" ;;
404) SERVER_RESPONSE="404 Error: Not Found" ;;
407) SERVER_RESPONSE="407 Error: Proxy Authentication Required" ;;
408) SERVER_RESPONSE="408 Error: Request Timeout within 2 seconds" ;;
408) SERVER_RESPONSE="408 Error: Request Timeout" ;;
500) SERVER_RESPONSE="500 Error: Internal Server Error" ;;
502) SERVER_RESPONSE="502 Error: Bad Gateway" ;;
503) SERVER_RESPONSE="503 Error: Service Unavailable" ;;
504) SERVER_RESPONSE="504 Error: Gateway Timeout within 2 seconds" ;;
504) SERVER_RESPONSE="504 Error: Gateway Timeout" ;;
505) SERVER_RESPONSE="505 Error: HTTP Version Not Supported" ;;
*) SERVER_RESPONSE="HTTP: status not defined." ;;
esac
@@ -55,13 +56,26 @@ extra779(){
while read instance eip ; do
if [[ $TEST_ES_AUTHENTICATION ]];then
if [[ "$eip" != "None" ]];then
# check for Elasticsearch on port 9200
# check for Elasticsearch on port 9200, rest API HTTP.
CHECH_HTTP_9200=$(curl -m 2 -s -w "%{http_code}" -o /dev/null -X GET "http://$eip:9200/_cat/indices")
httpStatus $CHECH_HTTP_9200
if [[ $CHECH_HTTP_9200 -eq "200" ]];then
textFail "$regx: Found instance $instance with public IP $eip on Security Group: $sg with Elasticsearch response $SERVER_RESPONSE" "$regx"
textFail "$regx: Found instance $instance with public IP $eip on Security Group: $sg with Elasticsearch port 9200 response $SERVER_RESPONSE" "$regx"
else
textInfo "$regx: Found instance $instance with public IP $eip on Security Group: $sg with Elasticsearch response $SERVER_RESPONSE" "$regx"
textInfo "$regx: Found instance $instance with public IP $eip on Security Group: $sg with Elasticsearch port 9200 response $SERVER_RESPONSE" "$regx"
fi
# check for port 9300 TCP, this is the communication port, not:
# test_tcp_connectivity is in include/os_detector
# syntax is 'test_tcp_connectivity $HOST $PORT $TIMEOUT' (in seconds)
CHECK_TCP_9300=$(test_tcp_connectivity $eip 9300 2)
# Using HTTP error codes here as well to reuse httpStatus function
# codes for better handling, so 200 is open and 000 is not responding
httpStatus $CHECK_TCP_9300
if [[ $CHECK_TCP_9300 -eq "200" ]];then
textFail "$regx: Found instance $instance with public IP $eip on Security Group: $sg with Elasticsearch port 9300 response $SERVER_RESPONSE" "$regx"
else
textInfo "$regx: Found instance $instance with public IP $eip on Security Group: $sg with Elasticsearch port 9300 response $SERVER_RESPONSE" "$regx"
fi
# check for Kibana on port 5601
@@ -72,8 +86,6 @@ extra779(){
else
textInfo "$regx: Found instance $instance with public IP $eip on Security Group: $sg with Kibana response $SERVER_RESPONSE" "$regx"
fi
# port 9300 not added yet, a command to check that could be:
# timeout 1 bash -c '(echo > /dev/tcp/'$eip'/9300) >/dev/null 2>&1 && echo "open" || echo "closed"'
fi
else
if [[ "$eip" == "None" ]];then

18
include/os_detector
View File

@@ -55,6 +55,15 @@ if [ "$OSTYPE" == "linux-gnu" ] || [ "$OSTYPE" == "linux-musl" ]; then
DATE_BEFORE_MONTHS_TO_COMPARE=$(date -d @$STARTDATEINSECS '+%Y-%m-%d')
echo $DATE_BEFORE_MONTHS_TO_COMPARE
}
test_tcp_connectivity()
{
HOST=$1
PORT=$2
TIMEOUT=$3
# This is initially for ES port 9300, not not HTTP but I add HTTP error
# codes for better handling, so 200 is open and 000 is not responding
timeout $TIMEOUT bash -c '(echo > /dev/tcp/'$HOST'/'$PORT') >/dev/null 2>&1 && echo "200" || echo "000"'
}
elif [[ "$OSTYPE" == "darwin"* ]]; then
# BSD/OSX commands compatibility
TEMP_REPORT_FILE=$(mktemp -t prowler.cred_report-XXXXXX)
@@ -91,6 +100,15 @@ elif [[ "$OSTYPE" == "darwin"* ]]; then
DATE_BEFORE_MONTHS_TO_COMPARE=$(date -v -$(echo $MONTHS_TO_COMPARE)m '+%Y-%m-%d')
echo $DATE_BEFORE_MONTHS_TO_COMPARE
}
test_tcp_connectivity()
{
HOST=$1
PORT=$2
TIMEOUT=$3
# This is initially for ES port 9300, not not HTTP but I add HTTP error
# codes for better handling, so 200 is open and 000 is not responding
nc -z -G $TIMEOUT $HOST $PORT >/dev/null 2>&1 && echo "200" || echo "000"
}
elif [[ "$OSTYPE" == "cygwin" ]]; then
# POSIX compatibility layer and Linux environment emulation for Windows
TEMP_REPORT_FILE=$(mktemp -t -p /tmp prowler.cred_report-XXXXXX)