diff --git a/checks/check_extra793 b/checks/check_extra793 new file mode 100644 index 00000000..038a4e1b --- /dev/null +++ b/checks/check_extra793 @@ -0,0 +1,109 @@ +#!/usr/bin/env bash + +# Prowler - the handy cloud security tool (copyright 2018) by Toni de la Fuente +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may not +# use this file except in compliance with the License. You may obtain a copy +# of the License at http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. +CHECK_ID_extra793="7.93" +CHECK_TITLE_extra793="[extra793] Check if Elastic Load Balancers have SSL listeners (Not Scored) (Not part of CIS benchmark)" +CHECK_SCORED_extra793="NOT_SCORED" +CHECK_TYPE_extra793="EXTRA" +CHECK_ASFF_RESOURCE_TYPE_extra793="AwsElbLoadBalancer" +CHECK_ALTERNATE_check793="extra793" + +extra793(){ + # "Check if Elastic Load Balancers have encrypted listeners (Not Scored) (Not part of CIS benchmark)" + for regx in $REGIONS; do + LIST_OF_ELBS=$($AWSCLI elb describe-load-balancers $PROFILE_OPT --region $regx --query 'LoadBalancerDescriptions[*].LoadBalancerName' --output text|xargs -n1) + LIST_OF_ELBSV2=$($AWSCLI elbv2 describe-load-balancers $PROFILE_OPT --region $regx --query 'LoadBalancers[?(Type == `application`)].LoadBalancerArn' --output text|xargs -n1) + if [[ $LIST_OF_ELBS || $LIST_OF_ELBSV2 ]]; then + if [[ $LIST_OF_ELBS ]]; then + ENCRYPTEDPROTOCOLS=("HTTPS" "SSL") + for elb in $LIST_OF_ELBS; do + ELB_PROTOCOLS=$($AWSCLI elb describe-load-balancers $PROFILE_OPT --region $regx --load-balancer-name $elb --query "LoadBalancerDescriptions[0].ListenerDescriptions[*].Listener.Protocol" --output text) + passed=true + potential_redirect=false + for protocol in $ELB_PROTOCOLS; do + if array_contains ENCRYPTEDPROTOCOLS "$protocol"; then + continue + else + # Check if both HTTP and HTTPS in use + if [[ $(echo $ELB_PROTOCOLS | grep HTTPS) ]]; then + potential_redirect=true + fi + passed=false + fi + done + + if $passed; then + textPass "$regx: $elb has encrypted listeners" "$regx" + else + if $potential_redirect; then + textInfo "$regx: $elb has both encrypted and non-encrypted listeners" "$regx" + else + textFail "$regx: $elb has non-encrypted listeners" "$regx" + fi + fi + done + fi + if [[ $LIST_OF_ELBSV2 ]]; then + for elbarn in $LIST_OF_ELBSV2; do + https_only=true + redirect_rule=false + elbname=$(echo $elbarn | awk -F 'loadbalancer/app/' '{print $2}' | awk -F '/' '{print $1}') + + ELBV2_LISTENERS=$($AWSCLI elbv2 describe-listeners $PROFILE_OPT --region $regx --load-balancer-arn $elbarn --query "Listeners[*]") + ELBV2_PROTOCOLS=$(echo $ELBV2_LISTENERS | jq -r '.[].Protocol') + + if [[ $(echo $ELBV2_PROTOCOLS | grep HTTPS) ]]; then + for line in $(echo $ELBV2_LISTENERS | jq -r '.[] | .Protocol + "," + .ListenerArn'); do + protocol=$(echo $line | awk -F ',' '{print $1}') + listenerArn=$(echo $line | awk -F ',' '{print $2}') + if [[ $protocol == "HTTP" ]]; then + https_only=false + # Check for redirect rule + ELBV2_RULES=$($AWSCLI elbv2 describe-rules $PROFILE_OPT --region $regx --listener-arn $listenerArn --query 'Rules[]') + if [[ $(echo $ELBV2_RULES | jq -r '.[].Actions[].RedirectConfig.Protocol' | grep HTTPS) ]]; then + redirect_rule=true + fi + fi + done + + if $https_only; then + textPass "$regx: $elbname has HTTPS listeners only" "$regx" + else + if $redirect_rule; then + textInfo "$regx: $elbname has HTTP listener that redirects to HTTPS" "$regx" + else + textFail "$regx: $elbname has non-encrypted listeners" "$regx" + fi + fi + else + textFail "$regx: $elbname has non-encrypted listeners" "$regx" + fi + done + fi + else + textInfo "$regx: No ELBs found" "$regx" + fi + done +} + +array_contains () { + local array="$1[@]" + local seeking=$2 + local in=1 + for element in "${!array}"; do + if [[ $element == "$seeking" ]]; then + in=0 + break + fi + done + return $in +} diff --git a/groups/group7_extras b/groups/group7_extras index 000dfe54..34b4c0a7 100644 --- a/groups/group7_extras +++ b/groups/group7_extras @@ -15,7 +15,7 @@ GROUP_ID[7]='extras' GROUP_NUMBER[7]='7.0' GROUP_TITLE[7]='Extras - all non CIS specific checks - [extras] ****************' GROUP_RUN_BY_DEFAULT[7]='Y' # run it when execute_all is called -GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733,extra734,extra735,extra736,extra737,extra738,extra739,extra740,extra741,extra742,extra743,extra744,extra745,extra746,extra747,extra748,extra749,extra750,extra751,extra752,extra753,extra754,extra755,extra756,extra757,extra758,extra761,extra762,extra763,extra764,extra765,extra767,extra768,extra769,extra770,extra771,extra772,extra773,extra774,extra775,extra776,extra777,extra778,extra779,extra780,extra781,extra782,extra783,extra784,extra785,extra786,extra787,extra788,extra791,extra792' +GROUP_CHECKS[7]='extra71,extra72,extra73,extra74,extra75,extra76,extra77,extra78,extra79,extra710,extra711,extra712,extra713,extra714,extra715,extra716,extra717,extra718,extra719,extra720,extra721,extra722,extra723,extra724,extra725,extra726,extra727,extra728,extra729,extra730,extra731,extra732,extra733,extra734,extra735,extra736,extra737,extra738,extra739,extra740,extra741,extra742,extra743,extra744,extra745,extra746,extra747,extra748,extra749,extra750,extra751,extra752,extra753,extra754,extra755,extra756,extra757,extra758,extra761,extra762,extra763,extra764,extra765,extra767,extra768,extra769,extra770,extra771,extra772,extra773,extra774,extra775,extra776,extra777,extra778,extra779,extra780,extra781,extra782,extra783,extra784,extra785,extra786,extra787,extra788,extra791,extra792,extra793' # Extras 759 and 760 (lambda variables and code secrets finder are not included) # to run detect-secrets use `./prowler -g secrets`