ssh_scan 0.0.2 → 0.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a227becd669eb5ec2b6586021dff565677832baa
-  data.tar.gz: f264bd2a58088a9731d0dd1633158ff408419b0c
+  metadata.gz: fa0b0404e66c6e6f45d68662e315de4016b97c01
+  data.tar.gz: 69d1d439decc01dd1c25c3cf9d6737a5a8b08f74
 SHA512:
-  metadata.gz: 1d21e7f8b147cf5296fc07a13bd2c99ebe2f062503c3781e29cc0d3cfa552266cfbdd0bf2d66db7c3ce23a9e5821791735c5a003af3be74eacf4e7fd95dbdfa2
-  data.tar.gz: f9cd8d31d3fc498364e87e891969f1d543f4e08349a0259d84d6ea906b908653363f3a400da535559a4dff86567e49679acd677ca2c32f80d858e1d8f9cc0e45
+  metadata.gz: cbbb0d49a507a8bda9fb29798e15f9d6a0349f3bc5f2e585280351cfc4ca4ba0aac79034d8c8ca57348184ebab4ec8440826f57d5f4af3b37f2b4047c8dab669
+  data.tar.gz: 000b50df34fd9df7ae3679dd67b084ace205a33c2f93f797fe3047073f10197b40dec602d6daa385e2d433e881ad8286e196d077a8c55b7f8136623400e85fe1

data/bin/ssh_scan

@@ -18,7 +18,8 @@ end
 # Populate the info we need to perform a scan
 ip = ARGV[0].chomp
 port = ARGV[1].nil? ? 22 : ARGV[1].to_i
-policy = SSHScan::IntermediatePolicy.new
+
+policy = SSHScan::Policy.from_file(File.expand_path("../../policies/mozilla_modern.yml", __FILE__))
 
 # Perform scan and get results
 scan_engine = SSHScan::ScanEngine.new()

data/lib/ssh_scan.rb

@@ -5,6 +5,7 @@ require 'bindata'
 require 'ssh_scan/version'
 require 'ssh_scan/constants'
 require 'ssh_scan/policy'
+require 'ssh_scan/policy_manager'
 require 'ssh_scan/protocol'
 require 'ssh_scan/scan_engine'
 

data/lib/ssh_scan/basic_server.rb

@@ -1,13 +1,9 @@
 require 'sinatra'
-require 'protocol'
-require 'socket'
-require 'policy'
-require 'constants'
-require 'scan_engine'
+require 'ssh_scan'
 
 get '/api/v1/scan/:ip' do
   if ip = params['ip']
-    policy = SSHScan::IntermediatePolicy.new
+    policy = SSHScan::Policy.from_file(File.expand_path("../../policies/mozilla_intermediate.yml", __FILE__))
     scan_engine = SSHScan::ScanEngine.new()
     result = scan_engine.scan(ip, 22, policy)
     content_type :json

data/lib/ssh_scan/policy.rb

@@ -1,75 +1,25 @@
-module SSHScan
-  class IntermediatePolicy
-    def name
-      self.class.to_s
-    end
-
-    def macs
-      ["hmac-sha2-512","hmac-sha2-256"]
-    end
-
-    def encryption
-      ["aes256-ctr","aes192-ctr","aes128-ctr"]
-    end
-
-    def kexs
-      ["diffie-hellman-group-exchange-sha256"]
-    end
-  end
+require 'yaml'
 
-  class PolicyManager
-    def initialize(result, policy)
-      @policy = policy
-      @result = result
-    end
-
-    def out_of_policy_encryption
-      target_encryption = @result[:encryption_algorithms_client_to_server] | @result[:encryption_algorithms_server_to_client]
-      outliers = []
-      target_encryption.each do |target_enc|
-        outliers << target_enc unless @policy.encryption.include?(target_enc)
-      end
-      return outliers
-    end
-
-    def out_of_policy_macs
-      target_macs = @result[:mac_algorithms_server_to_client] | @result[:mac_algorithms_client_to_server]
-      outliers = []
-      target_macs.each do |target_mac|
-        outliers << target_mac unless @policy.macs.include?(target_mac)
-      end
-      return outliers
-    end
-
-    def out_of_policy_kex
-      target_kexs = @result[:key_algorithms]
-      outliers = []
-      target_kexs.each do |target_kex|
-        outliers << target_kex unless @policy.kexs.include?(target_kex)
-      end
-      return outliers
-    end
+module SSHScan
+  class Policy
+    attr_reader :name, :kex, :macs, :encryption, :compression
 
-    def compliant?
-      out_of_policy_encryption.empty? &&
-      out_of_policy_macs.empty? &&
-      out_of_policy_kex.empty?
+    def initialize(opts = {})
+      @name = opts['name'] || []
+      @kex = opts['kex'] || []
+      @macs = opts['macs'] || []
+      @encryption = opts['encryption'] || []
+      @compression = opts['compression'] || []
     end
 
-    def recommendations
-      recommendations = []
-      recommendations << "Remove these Key Exchange Algos: #{out_of_policy_kex.join(", ")}" unless out_of_policy_kex.empty?
-      recommendations << "Remove these MAC Algos: #{out_of_policy_macs.join(", ")}" unless out_of_policy_macs.empty?
-      recommendations << "Remove these Encryption Ciphers: #{out_of_policy_encryption.join(", ")}" unless out_of_policy_encryption.empty?
-      return recommendations
+    def self.from_file(file)
+      opts = YAML.load_file(file)
+      self.new(opts)
     end
 
-    def compliance_results
-      {
-        :policy => @policy.name,
-        :compliant => compliant?,
-        :recommendations => recommendations
-      }
+    def self.from_string(string)
+      opts = YAML.load(string)
+      self.new(opts)
     end
   end
 end

data/lib/ssh_scan/policy_manager.rb

@@ -0,0 +1,127 @@
+module SSHScan
+  class PolicyManager
+    def initialize(result, policy)
+      @policy = policy
+      @result = result
+    end
+
+    def out_of_policy_encryption
+      target_encryption = @result[:encryption_algorithms_client_to_server] | @result[:encryption_algorithms_server_to_client]
+      outliers = []
+      target_encryption.each do |target_enc|
+        outliers << target_enc unless @policy.encryption.include?(target_enc)
+      end
+      return outliers
+    end
+
+    def missing_policy_encryption
+      target_encryption = @result[:encryption_algorithms_client_to_server] | @result[:encryption_algorithms_server_to_client]
+      outliers = []
+      @policy.encryption.each do |encryption|
+        if target_encryption.include?(encryption) == false
+          outliers << encryption
+        end
+      end
+      return outliers
+    end
+
+    def out_of_policy_macs
+      target_macs = @result[:mac_algorithms_server_to_client] | @result[:mac_algorithms_client_to_server]
+      outliers = []
+      target_macs.each do |target_mac|
+        outliers << target_mac unless @policy.macs.include?(target_mac)
+      end
+      return outliers
+    end
+
+    def missing_policy_macs
+      target_macs = @result[:mac_algorithms_server_to_client] | @result[:mac_algorithms_client_to_server]
+      outliers = []
+
+      @policy.macs.each do |mac|
+        if target_macs.include?(mac) == false
+          outliers << mac
+        end
+      end
+      return outliers
+    end
+
+    def out_of_policy_kex
+      target_kexs = @result[:key_algorithms]
+      outliers = []
+      target_kexs.each do |target_kex|
+        outliers << target_kex unless @policy.kex.include?(target_kex)
+      end
+      return outliers
+    end
+
+    def missing_policy_kex
+      target_kex = @result[:key_algorithms]
+      outliers = []
+
+      @policy.kex.each do |kex|
+        if target_kex.include?(kex) == false
+          outliers << kex
+        end
+      end
+      return outliers
+    end
+
+    def out_of_policy_compression
+      target_compressions = @result[:compression_algorithms_server_to_client] | @result[:compression_algorithms_client_to_server]
+      outliers = []
+      target_compressions.each do |target_compression|
+        outliers << target_compression unless @policy.compression.include?(target_compression)
+      end
+      return outliers
+    end
+
+    def missing_policy_compression
+      target_compressions = @result[:compression_algorithms_server_to_client] | @result[:compression_algorithms_client_to_server]
+      outliers = []
+
+      @policy.compression.each do |compression|
+        if target_compressions.include?(compression) == false
+          outliers << compression
+        end
+      end
+      return outliers
+    end
+
+    def compliant?
+      out_of_policy_encryption.empty? &&
+      out_of_policy_macs.empty? &&
+      out_of_policy_kex.empty? &&
+      out_of_policy_compression.empty? &&
+      missing_policy_encryption.empty? &&
+      missing_policy_macs.empty? &&
+      missing_policy_kex.empty? &&
+      missing_policy_compression?
+    end
+
+    def recommendations
+      recommendations = []
+
+      # Add these items to be compliant
+      recommendations << "Add these Key Exchange Algos: #{missing_policy_kex.join(", ")}" unless missing_policy_kex.empty?
+      recommendations << "Add these MAC Algos: #{missing_policy_macs.join(", ")}" unless missing_policy_macs.empty?
+      recommendations << "Add these Encryption Ciphers: #{missing_policy_encryption.join(", ")}" unless missing_policy_encryption.empty?
+      recommendations << "Add these Compression Algos: #{missing_policy_compression.join(", ")}" unless missing_policy_compression.empty?
+
+      # Remove these items to be compliant
+      recommendations << "Remove these Key Exchange Algos: #{out_of_policy_kex.join(", ")}" unless out_of_policy_kex.empty?
+      recommendations << "Remove these MAC Algos: #{out_of_policy_macs.join(", ")}" unless out_of_policy_macs.empty?
+      recommendations << "Remove these Encryption Ciphers: #{out_of_policy_encryption.join(", ")}" unless out_of_policy_encryption.empty?
+      recommendations << "Remove these Compression Algos: #{out_of_policy_compression.join(", ")}" unless out_of_policy_compression.empty?
+      return recommendations
+    end
+
+    def compliance_results
+      {
+        :policy => @policy.name,
+        :compliant => compliant?,
+        :recommendations => recommendations
+      }
+    end
+  end
+end

data/lib/ssh_scan/scan_engine.rb

@@ -27,7 +27,6 @@ module SSHScan
       result.merge!(kex_init_response.to_hash)
 
       # Evaluate for Policy Compliance
-      policy = SSHScan::IntermediatePolicy.new
       policy_mgr = SSHScan::PolicyManager.new(result, policy)
       result['compliance'] = policy_mgr.compliance_results
 

data/lib/ssh_scan/version.rb

@@ -1,3 +1,3 @@
 module SSHScan
-  VERSION = '0.0.2'
+  VERSION = '0.0.3'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ssh_scan
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.3
 platform: ruby
 authors:
 - Jonathan Claudius
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-02-16 00:00:00.000000000 Z
+date: 2016-02-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bindata
@@ -99,6 +99,7 @@ files:
 - lib/ssh_scan/basic_server.rb
 - lib/ssh_scan/constants.rb
 - lib/ssh_scan/policy.rb
+- lib/ssh_scan/policy_manager.rb
 - lib/ssh_scan/protocol.rb
 - lib/ssh_scan/scan_engine.rb
 - lib/ssh_scan/version.rb