First of all this question is not a duplicate of this one.
What I'm asking for is an application agnostic security analyzer for a particular or all major Linux distributions. What it should do are the following:
- check any unused port are opened (if some particular service is listening on a particular port it's OK)
- make sure configuration files permissions for any main stream services in use are OK (e.g.
bindconfiguration files etc.)
- various OS hardening aspects: ssl keys are in the same folder (i.e.
/etc/certs/) with right permissions, mount flags for
/tmpand other partitions posses no or minimal threats, processes are bind to
sshis configured correctly (pass login disabled, root login disabled) etc.
- monitoring configuration:
rootmail is forwarded to some other user, logs are stored/forwarded securely etc.
The purpose of a such tool would be validation of a freshly build
packer AWS AMI or
So what I'm looking for is a some kind of dynamic operating system configuration analyzer to make sure provisioning was done right and the base box used was not flawed security-wise.