From cd276ab959f596ad4e4964765e21adf7b81b8315 Mon Sep 17 00:00:00 2001 From: Toni de la Fuente Date: Fri, 9 Feb 2018 17:17:09 -0500 Subject: [PATCH 1/3] Added new check extra717 ELB logging --- README.md | 4 +++- prowler | 60 ++++++++++++++++++++++++++++++++++++++++++++++--------- 2 files changed, 54 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index b06ffbef..a028ef10 100644 --- a/README.md +++ b/README.md @@ -25,7 +25,7 @@ It covers hardening and security best practices for all AWS regions related to: - Logging (8 checks) - Monitoring (15 checks) - Networking (5 checks) -- Extras (12 checks) *see Extras section +- Extras (17 checks) *see Extras section - Forensics related checks For a comprehesive list and resolution look at the guide on the link above. @@ -601,6 +601,7 @@ At this moment we have 16 extra checks: - 7.14 (`extra714`) Check if CloudFront distributions have logging enabled (Not Scored) (Not part of CIS benchmark) - 7.15 (`extra715`) Check if Elasticsearch Service domains have logging enabled (Not Scored) (Not part of CIS benchmark) - 7.16 (`extra716`) Check if Elasticsearch Service domains allow open access (Not Scored) (Not part of CIS benchmark) +- 7.17 (`extra717`) Check if Elastic Load Balancers have logging enabled (Not Scored) (Not part of CIS benchmark) To check all extras in one command: @@ -627,6 +628,7 @@ With this group of checks, Prowler looks if each service with logging or audit c - 7.13 Check if GuardDuty is enabled (Not Scored) (Not part of CIS benchmark) - 7.14 Check if CloudFront distributions have logging enabled (Not Scored) (Not part of CIS benchmark) - 7.15 Check if Elasticsearch Service domains have logging enabled (Not Scored) (Not part of CIS benchmark) +- 7.17 Check if Elastic Load Balancers have logging enabled (Not Scored) (Not part of CIS benchmark) The `forensics-ready` group of checks uses existing and extra checks. To get a forensics readiness report, run this command: ``` diff --git a/prowler b/prowler index 6a24f653..8decceb6 100755 --- a/prowler +++ b/prowler @@ -500,7 +500,8 @@ ID715="7.15,7.15" TITLE715="Check if Elasticsearch Service domains have logging enabled (Not Scored) (Not part of CIS benchmark)" ID716="7.16,7.16" TITLE716="Check if Elasticsearch Service domains allow open access (Not Scored) (Not part of CIS benchmark)" - +ID717="7.17,7.17" +TITLE717="Check if Elastic Load Balancers have logging enabled (Not Scored) (Not part of CIS benchmark)" printCsvHeader() { >&2 echo "" @@ -1816,12 +1817,15 @@ extra79(){ textNotice "Looking for Elastic Load Balancers in all regions... " for regx in $REGIONS; do LIST_OF_PUBLIC_ELBS=$($AWSCLI elb describe-load-balancers $PROFILE_OPT --region $regx --query 'LoadBalancerDescriptions[?Scheme == `internet-facing`].[LoadBalancerName,DNSName]' --output text) - if [[ $LIST_OF_PUBLIC_ELBS ]];then + LIST_OF_PUBLIC_ELBSV2=$($AWSCLI elbv2 describe-load-balancers $PROFILE_OPT --region $regx --query 'LoadBalancers[?Scheme == `internet-facing`].[LoadBalancerName,DNSName]' --output text) + LIST_OF_ALL_ELBS=$( echo $LIST_OF_PUBLIC_ELBS; echo $LIST_OF_PUBLIC_ELBSV2) + LIST_OF_ALL_ELBS_PER_LINE=$( echo $LIST_OF_ALL_ELBS| xargs -n2 ) + if [[ $LIST_OF_ALL_ELBS ]];then while read -r elb;do ELB_NAME=$(echo $elb | awk '{ print $1; }') ELB_DNSNAME=$(echo $elb | awk '{ print $2; }') textWarn "$regx: ELB: $ELB_NAME at DNS: $ELB_DNSNAME is internet-facing!" "$regx" - done <<< "$LIST_OF_PUBLIC_ELBS" + done <<< "$LIST_OF_ALL_ELBS_PER_LINE" else textOK "$regx: no Internet Facing ELBs found" "$regx" fi @@ -1873,7 +1877,7 @@ extra712(){ if [[ $MACIE_IAM_ROLES_CREATED -eq 2 ]];then textOK "Macie related IAM roles exist, so it might be enabled. Check it out manually." else - textWarn "No Macie related IAM roles found. It is most likely not be enabled" + textWarn "No Macie related IAM roles found. It is most likely not to be enabled" fi } @@ -1912,7 +1916,7 @@ extra714(){ fi done else - textOK "$regx: CDN not configured" "$regx" + textNotice "$regx: No CDN configured" "$regx" fi done } @@ -1938,7 +1942,7 @@ extra715(){ fi done else - textOK "$regx: No Elasticsearch Service domain found" "$regx" + textNotice "$regx: No Elasticsearch Service domain found" "$regx" fi done } @@ -1966,11 +1970,45 @@ extra716(){ fi done fi - textOK "$regx: No Elasticsearch Service domain found" "$regx" + textNotice "$regx: No Elasticsearch Service domain found" "$regx" rm -fr $TEMP_POLICY_FILE done } +extra717(){ + # "Check if Elastic Load Balancers have logging enabled (Not Scored) (Not part of CIS benchmark)" + textTitle "$ID717" "$TITLE717" "NOT_SCORED" "EXTRA" + for regx in $REGIONS; do + LIST_OF_ELBS=$($AWSCLI elb describe-load-balancers $PROFILE_OPT --region $regx --query 'LoadBalancerDescriptions[*].LoadBalancerName' --output text|xargs -n1) + LIST_OF_ELBSV2=$($AWSCLI elbv2 describe-load-balancers $PROFILE_OPT --region $regx --query 'LoadBalancers[*].LoadBalancerArn' --output text|xargs -n1) + if [[ $LIST_OF_ELBS || $LIST_OF_ELBSV2 ]]; then + if [[ $LIST_OF_ELBS ]]; then + for elb in $LIST_OF_ELBS; do + CHECK_ELBS_LOG_ENABLED=$($AWSCLI elb describe-load-balancer-attributes $PROFILE_OPT --region $regx --load-balancer-name $elb --query 'LoadBalancerAttributes.AccessLog.Enabled'|grep "^true") + if [[ $CHECK_ELBS_LOG_ENABLED ]]; then + textOK "$regx: $elb has access logs to S3 configured" "$regx" + else + textWarn "$regx: $elb has not access logs configured" "$regx" + fi + done + fi + if [[ $LIST_OF_ELBSV2 ]]; then + for elbarn in $LIST_OF_ELBSV2; do + CHECK_ELBSV2_LOG_ENABLED=$($AWSCLI elbv2 describe-load-balancer-attributes $PROFILE_OPT --region $regx --load-balancer-arn $elbarn --query Attributes[*] --output text|grep "^access_logs.s3.enabled"|cut -f2|grep true) + ELBV2_NAME=$(echo $elbarn|cut -d\/ -f3) + if [[ $CHECK_ELBSV2_LOG_ENABLED ]]; then + textOK "$regx: $ELBV2_NAME has access logs to S3 configured" "$regx" + else + textWarn "$regx: $ELBV2_NAME has not access logs configured" "$regx" + fi + done + fi + else + textNotice "$regx: No ELBs found" "$regx" + fi + done +} + callCheck(){ if [[ $CHECKNUMBER ]];then case "$CHECKNUMBER" in @@ -2042,6 +2080,7 @@ callCheck(){ extra714|extra714 ) extra714;; extra715|extra715 ) extra715;; extra716|extra716 ) extra716;; + extra717|extra717 ) extra717;; ## Groups of Checks check1 ) @@ -2078,12 +2117,13 @@ callCheck(){ ;; extras ) extra71;extra72;extra73;extra74;extra75;extra76;extra77;extra78; - extra79;extra710;extra711;extra712;extra713;extra714;extra715;extra716 + extra79;extra710;extra711;extra712;extra713;extra714;extra715;extra716; + extra717 ;; forensics-ready ) check21;check22;check23;check24;check25;check26;check27; check43; - extra712;extra713;extra714;extra715 + extra712;extra713;extra714;extra715;extra717 ;; * ) textWarn "ERROR! Use a valid check name (i.e. check41 or extra71)\n"; @@ -2170,6 +2210,7 @@ if [[ $PRINTCHECKSONLY == "1" ]]; then textTitle "$ID714" "$TITLE714" "NOT_SCORED" "EXTRA" textTitle "$ID715" "$TITLE715" "NOT_SCORED" "EXTRA" textTitle "$ID716" "$TITLE716" "NOT_SCORED" "EXTRA" + textTitle "$ID717" "$TITLE717" "NOT_SCORED" "EXTRA" exit $EXITCODE fi @@ -2262,6 +2303,7 @@ extra713 extra714 extra715 extra716 +extra717 cleanTemp exit $EXITCODE From 1cc7c7d3aac4067f9d90bc443bca3ad73b35a567 Mon Sep 17 00:00:00 2001 From: Toni de la Fuente Date: Fri, 9 Feb 2018 17:18:43 -0500 Subject: [PATCH 2/3] Removed redundand info in README --- README.md | 253 ------------------------------------------------------ 1 file changed, 253 deletions(-) diff --git a/README.md b/README.md index a028ef10..0bc00148 100644 --- a/README.md +++ b/README.md @@ -150,259 +150,6 @@ USAGE: - Sample screnshot of single check for check 3.3: screenshot 2016-09-14 13 20 46 -- Sample of a full report: - -``` -$ ./prowler - _ - _ __ _ __ _____ _| | ___ _ __ - | '_ \| '__/ _ \ \ /\ / / |/ _ \ '__| - | |_) | | | (_) \ V V /| | __/ | - | .__/|_| \___/ \_/\_/ |_|\___|_| - |_| CIS based AWS Account Hardening Tool - - -Date: Wed Sep 14 13:30:13 EDT 2016 - -This report is being generated using credentials below: - -AWS-CLI Profile: [default] AWS Region: [us-east-1] - --------------------------------------------------------------------------------------- -| GetCallerIdentity | -+--------------+-------------------------------------------+-------------------------+ -| Account | Arn | UserId | -+--------------+-------------------------------------------+-------------------------+ -| XXXXXXXXXXXX| arn:aws:iam::XXXXXXXXXXXX:user/toni | XXXXXXXXXXXXXXXXXXXXX | -+--------------+-------------------------------------------+-------------------------+ - -Colors Code for results: INFORMATIVE, OK (RECOMMENDED VALUE), CRITICAL (FIX REQUIRED) - - -Generating AWS IAM Credential Report....COMPLETE - - - 1 Identity and Access Management ********************************* - - 1.1 Avoid the use of the root account (Scored). Last time root account was used - (password last used, access_key_1_last_used, access_key_2_last_used): - 2016-08-11T20:59:27+00:00, N/A, N/A - - 1.2 Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password (Scored) - List of users with Password enabled but MFA disabled: - toni - - 1.3 Ensure credentials unused for 90 days or greater are disabled (Scored) - User list: - toni - - 1.4 Ensure access keys are rotated every 90 days or less (Scored) - Users with access key 1 older than 90 days: - - Users with access key 2 older than 90 days: - - 1.5 Ensure IAM password policy requires at least one uppercase letter (Scored) - FALSE - - 1.6 Ensure IAM password policy require at least one lowercase letter (Scored) - FALSE - - 1.7 Ensure IAM password policy require at least one symbol (Scored) - FALSE - - 1.8 Ensure IAM password policy require at least one number (Scored) - FALSE - - 1.9 Ensure IAM password policy requires minimum length of 14 or greater (Scored) - FALSE - - 1.10 Ensure IAM password policy prevents password reuse (Scored) - FALSE - - 1.11 Ensure IAM password policy expires passwords within 90 days or less (Scored) - FALSE - - 1.12 Ensure no root account access key exists (Scored) - Found access key 1 - OK No access key 2 found - - 1.13 Ensure hardware MFA is enabled for the root account (Scored) - OK - - 1.14 Ensure security questions are registered in the AWS account (Not Scored) - No command available for check 1.14 - Login to the AWS Console as root, click on the Account - Name -> My Account -> Configure Security Challenge Questions - - 1.15 Ensure IAM policies are attached only to groups or roles (Scored) - Users with policy attached to them instead to groups: (it may take few seconds...) - toni - - - 2 Logging ******************************************************** - - 2.1 Ensure CloudTrail is enabled in all regions (Scored) - FALSE - - 2.2 Ensure CloudTrail log file validation is enabled (Scored) - FALSE - - 2.3 Ensure the S3 bucket CloudTrail logs to is not publicly accessible (Scored) - WARNING! CloudTrail bucket doesn't exist! - - 2.4 Ensure CloudTrail trails are integrated with CloudWatch Logs (Scored) - WARNING! No CloudTrail trails found! - - 2.5 Ensure AWS Config is enabled in all regions (Scored) - WARNING! Region ap-south-1 has AWS Config disabled or not configured - WARNING! Region eu-west-1 has AWS Config disabled or not configured - WARNING! Region ap-southeast-1 has AWS Config disabled or not configured - WARNING! Region ap-southeast-2 has AWS Config disabled or not configured - WARNING! Region eu-central-1 has AWS Config disabled or not configured - WARNING! Region ap-northeast-2 has AWS Config disabled or not configured - WARNING! Region ap-northeast-1 has AWS Config disabled or not configured - WARNING! Region us-east-1 has AWS Config disabled or not configured - WARNING! Region sa-east-1 has AWS Config disabled or not configured - WARNING! Region us-west-1 has AWS Config disabled or not configured - WARNING! Region us-west-2 has AWS Config disabled or not configured - - 2.6 Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket (Scored) - WARNING! CloudTrail bucket doesn't exist! - - 2.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs (Scored) - WARNING! CloudTrail bucket doesn't exist! - - 2.8 Ensure rotation for customer created CMKs is enabled (Scored) - Region ap-south-1 doesn't have encryption keys - Region eu-west-1 doesn't have encryption keys - Region ap-southeast-1 doesn't have encryption keys - Region ap-southeast-2 doesn't have encryption keys - Region eu-central-1 doesn't have encryption keys - Region ap-northeast-2 doesn't have encryption keys - Region ap-northeast-1 doesn't have encryption keys - WARNING! Key a0e988df-bc84-423f-996c-XXXX in Region us-east-1 is not set to rotate! - Region sa-east-1 doesn't have encryption keys - Region us-west-1 doesn't have encryption keys - Region us-west-2 doesn't have encryption keys - - - 3 Monitoring ***************************************************** - - 3.1 Ensure a log metric filter and alarm exist for unauthorized API calls (Scored) - WARNING! No CloudWatch group found, no metric filters or alarms associated - - 3.2 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA (Scored) - WARNING! No CloudWatch group found, no metric filters or alarms associated - - 3.3 Ensure a log metric filter and alarm exist for usage of root account (Scored) - WARNING! No CloudWatch group found, no metric filters or alarms associated - - 3.4 Ensure a log metric filter and alarm exist for IAM policy changes (Scored) - WARNING! No CloudWatch group found, no metric filters or alarms associated - - 3.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes (Scored) - WARNING! No CloudWatch group found, no metric filters or alarms associated - - 3.6 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures (Scored) - WARNING! No CloudWatch group found, no metric filters or alarms associated - - 3.7 Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs (Scored) - WARNING! No CloudWatch group found, no metric filters or alarms associated - - 3.8 Ensure a log metric filter and alarm exist for S3 bucket policy changes (Scored) - WARNING! No CloudWatch group found, no metric filters or alarms associated - - 3.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes (Scored) - WARNING! No CloudWatch group found, no metric filters or alarms associated - - 3.10 Ensure a log metric filter and alarm exist for security group changes (Scored) - WARNING! No CloudWatch group found, no metric filters or alarms associated - - 3.11 Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) (Scored) - WARNING! No CloudWatch group found, no metric filters or alarms associated - - 3.12 Ensure a log metric filter and alarm exist for changes to network gateways (Scored) - WARNING! No CloudWatch group found, no metric filters or alarms associated - - 3.13 Ensure a log metric filter and alarm exist for route table changes (Scored) - WARNING! No CloudWatch group found, no metric filters or alarms associated - - 3.14 Ensure a log metric filter and alarm exist for VPC changes (Scored) - WARNING! No CloudWatch group found, no metric filters or alarms associated - - 3.15 Ensure security contact information is registered (Scored) - No command available for check 3.15 - Login to the AWS Console, click on My Account - Go to Alternate Contacts -> make sure Security section is filled - - 3.16 Ensure appropriate subscribers to each SNS topic (Not Scored) - Region ap-south-1 doesn't have topics - Region eu-west-1 doesn't have topics - Region ap-southeast-1 doesn't have topics - Region ap-southeast-2 doesn't have topics - Region eu-central-1 doesn't have topics - Region ap-northeast-2 doesn't have topics - Region ap-northeast-1 doesn't have topics - Region us-east-1 doesn't have topics - Region sa-east-1 doesn't have topics - Region us-west-1 doesn't have topics - Region us-west-2 doesn't have topics - - - 4 Networking ************************************************** - - 4.1 Ensure no security groups allow ingress from 0.0.0.0/0 to port 22 (Scored) - OK, No Security Groups found in ap-south-1 with port 22 TCP open to 0.0.0.0/0 - OK, No Security Groups found in eu-west-1 with port 22 TCP open to 0.0.0.0/0 - OK, No Security Groups found in ap-southeast-1 with port 22 TCP open to 0.0.0.0/0 - OK, No Security Groups found in ap-southeast-2 with port 22 TCP open to 0.0.0.0/0 - OK, No Security Groups found in eu-central-1 with port 22 TCP open to 0.0.0.0/0 - OK, No Security Groups found in ap-northeast-2 with port 22 TCP open to 0.0.0.0/0 - OK, No Security Groups found in ap-northeast-1 with port 22 TCP open to 0.0.0.0/0 - OK, No Security Groups found in us-east-1 with port 22 TCP open to 0.0.0.0/0 - OK, No Security Groups found in sa-east-1 with port 22 TCP open to 0.0.0.0/0 - OK, No Security Groups found in us-west-1 with port 22 TCP open to 0.0.0.0/0 - OK, No Security Groups found in us-west-2 with port 22 TCP open to 0.0.0.0/0 - - 4.2 Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389 (Scored) - OK, No Security Groups found in ap-south-1 with port 3389 TCP open to 0.0.0.0/0 - OK, No Security Groups found in eu-west-1 with port 3389 TCP open to 0.0.0.0/0 - OK, No Security Groups found in ap-southeast-1 with port 3389 TCP open to 0.0.0.0/0 - OK, No Security Groups found in ap-southeast-2 with port 3389 TCP open to 0.0.0.0/0 - OK, No Security Groups found in eu-central-1 with port 3389 TCP open to 0.0.0.0/0 - OK, No Security Groups found in ap-northeast-2 with port 3389 TCP open to 0.0.0.0/0 - OK, No Security Groups found in ap-northeast-1 with port 3389 TCP open to 0.0.0.0/0 - OK, No Security Groups found in us-east-1 with port 3389 TCP open to 0.0.0.0/0 - OK, No Security Groups found in sa-east-1 with port 3389 TCP open to 0.0.0.0/0 - OK, No Security Groups found in us-west-1 with port 3389 TCP open to 0.0.0.0/0 - OK, No Security Groups found in us-west-2 with port 3389 TCP open to 0.0.0.0/0 - - 4.3 Ensure VPC Flow Logging is Enabled in all Applicable Regions (Scored) - WARNING! no VPCFlowLog has been found in Region ap-south-1 - WARNING! no VPCFlowLog has been found in Region eu-west-1 - WARNING! no VPCFlowLog has been found in Region ap-southeast-1 - WARNING! no VPCFlowLog has been found in Region ap-southeast-2 - WARNING! no VPCFlowLog has been found in Region eu-central-1 - WARNING! no VPCFlowLog has been found in Region ap-northeast-2 - WARNING! no VPCFlowLog has been found in Region ap-northeast-1 - WARNING! no VPCFlowLog has been found in Region us-east-1 - WARNING! no VPCFlowLog has been found in Region sa-east-1 - WARNING! no VPCFlowLog has been found in Region us-west-1 - WARNING! no VPCFlowLog has been found in Region us-west-2 - - 4.4 Ensure the default security group restricts all traffic (Scored) - WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region ap-south-1 - WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region eu-west-1 - WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region ap-southeast-1 - WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region ap-southeast-2 - WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region eu-central-1 - WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region ap-northeast-2 - WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region ap-northeast-1 - OK, no Default Security Groups open to 0.0.0.0 found in Region us-east-1 - WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region sa-east-1 - WARNING! Default Security Groups found that allow 0.0.0.0 IN or OUT traffic in Region us-west-1 - OK, no Default Security Groups open to 0.0.0.0 found in Region us-west-2 - - For more information and reference: https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf ``` From 1281867bd41eb34fa5e6c7b152ae3d506de59a8b Mon Sep 17 00:00:00 2001 From: Toni de la Fuente Date: Fri, 9 Feb 2018 17:19:48 -0500 Subject: [PATCH 3/3] Removed redundand info in README --- README.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/README.md b/README.md index 0bc00148..1bfab97d 100644 --- a/README.md +++ b/README.md @@ -150,10 +150,6 @@ USAGE: - Sample screnshot of single check for check 3.3: screenshot 2016-09-14 13 20 46 - - For more information and reference: - https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf -``` - ## Troubleshooting ### STS expired token