Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit e258aaf

Browse files
J12934J12934
committed
Include policy violation finding in ssh_scan
1 parent 0466262 commit e258aaf

File tree

2 files changed

+252
-22
lines changed

2 files changed

+252
-22
lines changed

‎integrations/ssh_scan/parser/parser.js‎

Lines changed: 149 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,129 @@
1+
const policyViolationFindingRules = [
2+
{
3+
policyViolationPrefix: /^Add these key exchange algorithms/,
4+
findingTemplate: {
5+
description: "Good / encouraged SSH key algorithms are missing",
6+
name: "Missing SSH Key Algorithms"
7+
}
8+
},
9+
{
10+
policyViolationPrefix: /^Add these MAC algorithms/,
11+
findingTemplate: {
12+
description: "Good / encouraged SSH MAC algorithms are missing",
13+
name: "Missing SSH MAC Algorithms"
14+
}
15+
},
16+
{
17+
policyViolationPrefix: /^Add these encryption ciphers/,
18+
findingTemplate: {
19+
description: "Good / encouraged SSH encryption ciphers are missing",
20+
name: "Missing SSH encryption Ciphers"
21+
}
22+
},
23+
{
24+
policyViolationPrefix: /^Add these compression algorithms/,
25+
findingTemplate: {
26+
description: "Good / encouraged SSH compression algorithms are missing",
27+
name: "Missing SSH compression algorithms"
28+
}
29+
},
30+
{
31+
policyViolationPrefix: /^Add these authentication methods/,
32+
findingTemplate: {
33+
description: "Good / encouraged SSH authentication methods are missing",
34+
name: "Missing SSH authentication methods"
35+
}
36+
},
37+
{
38+
policyViolationPrefix: /^Remove these key exchange algorithms/,
39+
findingTemplate: {
40+
description: "Deprecated / discouraged SSH key algorithms are used",
41+
name: "Insecure SSH Key Algorithms"
42+
}
43+
},
44+
{
45+
policyViolationPrefix: /^Remove these MAC algorithms/,
46+
findingTemplate: {
47+
description: "Deprecated / discouraged SSH MAC algorithms are used",
48+
name: "Insecure SSH MAC Algorithms"
49+
}
50+
},
51+
{
52+
policyViolationPrefix: /^Remove these encryption ciphers/,
53+
findingTemplate: {
54+
description: "Deprecated / discouraged SSH encryption ciphers are used",
55+
name: "Insecure SSH encryption Ciphers"
56+
}
57+
},
58+
{
59+
policyViolationPrefix: /^Remove these compression algorithms/,
60+
findingTemplate: {
61+
description:
62+
"Deprecated / discouraged SSH compression algorithms are used",
63+
name: "Insecure SSH compression algorithms"
64+
}
65+
},
66+
{
67+
policyViolationPrefix: /^Remove these authentication methods/,
68+
findingTemplate: {
69+
description: "Discouraged SSH authentication methods are used",
70+
name: "Discouraged SSH authentication methods"
71+
}
72+
},
73+
{
74+
policyViolationPrefix: /^Update your ssh version to/,
75+
findingTemplate: {
76+
description: "Outdated SSH protocol version used",
77+
name: "Outdated SSH Protocol Version"
78+
}
79+
}
80+
];
81+
82+
function createPolicyViolationFinding({
83+
name,
84+
description,
85+
recommendation,
86+
host: { hostname, ipAddress }
87+
}) {
88+
const payload = recommendation.split(": ")[1].split(", ");
89+
90+
return {
91+
name,
92+
description,
93+
category: "SSH Policy Violation",
94+
osi_layer: "NETWORK",
95+
severity: "MEDIUM",
96+
reference: {},
97+
hint: recommendation,
98+
location: hostname || ipAddress,
99+
attributes: {
100+
hostname: hostname,
101+
ip_address: ipAddress,
102+
payload: payload
103+
}
104+
};
105+
}
106+
107+
/**
108+
* Transforms a recommendation string from the Mozilla SSH_Scan Tools into a SSH Policy Violation Findings
109+
* @param {string} recommendation
110+
*/
111+
function transformRecommendationToFinding(
112+
recommendation,
113+
{ hostname, ipAddress }
114+
) {
115+
for (const rule of policyViolationFindingRules) {
116+
if (rule.policyViolationPrefix.test(recommendation)) {
117+
return createPolicyViolationFinding({
118+
name: rule.findingTemplate.name,
119+
description: rule.findingTemplate.description,
120+
recommendation,
121+
host: { hostname, ipAddress }
122+
});
123+
}
124+
}
125+
}
126+
1127
async function parse(fileContent) {
2128
const hosts = fileContent;
3129

@@ -7,17 +133,28 @@ async function parse(fileContent) {
7133
return undefined;
8134
}
9135

10-
const location = host.hostname || host.ip;
136+
const hostname = host.hostname || null;
137+
const ipAddress = host.ip;
138+
139+
const recommendations = host.compliance.recommendations || [];
140+
const policyViolationFindings = recommendations.map(recommendation =>
141+
transformRecommendationToFinding(recommendation, {
142+
hostname,
143+
ipAddress
144+
})
145+
);
146+
147+
const location = hostname || ipAddress;
11148
const compliance = host.compliance;
12149

13-
return {
14-
name: 'SSH Service',
15-
description: 'SSH Service Information',
16-
category: 'SSH Service',
17-
osi_layer: 'APPLICATION',
18-
severity: 'INFORMATIONAL',
150+
const serviceFinding = {
151+
name: "SSH Service",
152+
description: "SSH Service Information",
153+
category: "SSH Service",
154+
osi_layer: "APPLICATION",
155+
severity: "INFORMATIONAL",
19156
reference: {},
20-
hint: '',
157+
hint: "",
21158
location: location,
22159
attributes: {
23160
hostname: host.hostname || null,
@@ -34,9 +171,11 @@ async function parse(fileContent) {
34171
key_algorithms: host.key_algorithms,
35172
encryption_algorithms: host.encryption_algorithms_server_to_client,
36173
mac_algorithms: host.mac_algorithms_server_to_client,
37-
compression_algorithms: host.compression_algorithms_server_to_client,
38-
},
174+
compression_algorithms: host.compression_algorithms_server_to_client
175+
}
39176
};
177+
178+
return [serviceFinding, ...policyViolationFindings];
40179
})
41180
.filter(Boolean);
42181
}

‎integrations/ssh_scan/parser/parser.test.js‎

Lines changed: 103 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,25 @@
1-
const fs = require('fs');
2-
const util = require('util');
1+
const fs = require("fs");
2+
const util = require("util");
33

44
// eslint-disable-next-line security/detect-non-literal-fs-filename
55
const readFile = util.promisify(fs.readFile);
66

7-
const { parse } = require('./parser');
7+
const { parse } = require("./parser");
88

9-
test('ssh-scan parser parses errored result (no ssh server) to zero findings', async () => {
9+
test("ssh-scan parser parses errored result (no ssh server) to zero findings", async () => {
1010
const hosts = JSON.parse(
11-
await readFile(__dirname + '/__testFiles__/localhost.json', {
12-
encoding: 'utf8',
11+
await readFile(__dirname + "/__testFiles__/localhost.json", {
12+
encoding: "utf8"
1313
})
1414
);
1515

1616
expect(await parse(hosts)).toEqual([]);
1717
});
1818

19-
test('ssh-scan parser parses a proper result to proper findings', async () => {
19+
test("ssh-scan parser parses a proper result to proper findings", async () => {
2020
const hosts = JSON.parse(
21-
await readFile(__dirname + '/__testFiles__/securecodebox.io.json', {
22-
encoding: 'utf8',
21+
await readFile(__dirname + "/__testFiles__/securecodebox.io.json", {
22+
encoding: "utf8"
2323
})
2424
);
2525

@@ -84,14 +84,51 @@ test('ssh-scan parser parses a proper result to proper findings', async () => {
8484
"reference": Object {},
8585
"severity": "INFORMATIONAL",
8686
},
87+
Object {
88+
"attributes": Object {
89+
"hostname": "securecodebox.io",
90+
"ip_address": "138.201.126.99",
91+
"payload": Array [
92+
"diffie-hellman-group14-sha1",
93+
],
94+
},
95+
"category": "SSH Policy Violation",
96+
"description": "Deprecated / discouraged SSH key algorithms are used",
97+
"hint": "Remove these key exchange algorithms: diffie-hellman-group14-sha1",
98+
"location": "securecodebox.io",
99+
"name": "Insecure SSH Key Algorithms",
100+
"osi_layer": "NETWORK",
101+
"reference": Object {},
102+
"severity": "MEDIUM",
103+
},
104+
Object {
105+
"attributes": Object {
106+
"hostname": "securecodebox.io",
107+
"ip_address": "138.201.126.99",
108+
"payload": Array [
109+
"umac-64-etm@openssh.com",
110+
"hmac-sha1-etm@openssh.com",
111+
"umac-64@openssh.com",
112+
"hmac-sha1",
113+
],
114+
},
115+
"category": "SSH Policy Violation",
116+
"description": "Deprecated / discouraged SSH MAC algorithms are used",
117+
"hint": "Remove these MAC algorithms: umac-64-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, hmac-sha1",
118+
"location": "securecodebox.io",
119+
"name": "Insecure SSH MAC Algorithms",
120+
"osi_layer": "NETWORK",
121+
"reference": Object {},
122+
"severity": "MEDIUM",
123+
},
87124
]
88125
`);
89126
});
90127

91-
test('ssh-scan parser parses a result without a hostname into proper findings', async () => {
128+
test("ssh-scan parser parses a result without a hostname into proper findings", async () => {
92129
const hosts = JSON.parse(
93-
await readFile(__dirname + '/__testFiles__/192.168.42.42.json', {
94-
encoding: 'utf8',
130+
await readFile(__dirname + "/__testFiles__/192.168.42.42.json", {
131+
encoding: "utf8"
95132
})
96133
);
97134

@@ -157,6 +194,60 @@ test('ssh-scan parser parses a result without a hostname into proper findings',
157194
"reference": Object {},
158195
"severity": "INFORMATIONAL",
159196
},
197+
Object {
198+
"attributes": Object {
199+
"hostname": null,
200+
"ip_address": "192.168.42.42",
201+
"payload": Array [
202+
"diffie-hellman-group14-sha1",
203+
],
204+
},
205+
"category": "SSH Policy Violation",
206+
"description": "Deprecated / discouraged SSH key algorithms are used",
207+
"hint": "Remove these key exchange algorithms: diffie-hellman-group14-sha1",
208+
"location": "192.168.42.42",
209+
"name": "Insecure SSH Key Algorithms",
210+
"osi_layer": "NETWORK",
211+
"reference": Object {},
212+
"severity": "MEDIUM",
213+
},
214+
Object {
215+
"attributes": Object {
216+
"hostname": null,
217+
"ip_address": "192.168.42.42",
218+
"payload": Array [
219+
"umac-64-etm@openssh.com",
220+
"hmac-sha1-etm@openssh.com",
221+
"umac-64@openssh.com",
222+
"hmac-sha1",
223+
],
224+
},
225+
"category": "SSH Policy Violation",
226+
"description": "Deprecated / discouraged SSH MAC algorithms are used",
227+
"hint": "Remove these MAC algorithms: umac-64-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, hmac-sha1",
228+
"location": "192.168.42.42",
229+
"name": "Insecure SSH MAC Algorithms",
230+
"osi_layer": "NETWORK",
231+
"reference": Object {},
232+
"severity": "MEDIUM",
233+
},
234+
Object {
235+
"attributes": Object {
236+
"hostname": null,
237+
"ip_address": "192.168.42.42",
238+
"payload": Array [
239+
"password",
240+
],
241+
},
242+
"category": "SSH Policy Violation",
243+
"description": "Discouraged SSH authentication methods are used",
244+
"hint": "Remove these authentication methods: password",
245+
"location": "192.168.42.42",
246+
"name": "Discouraged SSH authentication methods",
247+
"osi_layer": "NETWORK",
248+
"reference": Object {},
249+
"severity": "MEDIUM",
250+
},
160251
]
161252
`);
162253
});

0 commit comments

Comments
 (0)