Authentication on Unix and related targets: best practices

For scanning Unix and related systems such as Linux, it is possible to scan most vulnerabilities without root access. You will need root access for a few vulnerability checks, and for many policy checks. If you plan to scan with a non-root user, you need to make sure the account has specified permissions, and be aware that the non-root user will not find certain checks.The following sections contain guidelines for what to configure and what can only be found with root access. Due to the complexity of the checks and the fact they are updated frequently, this list is subject to change.

To ensure near-comprehensive vulnerability coverage when scanning as a non-root user, you need to do one of the following:

• Elevate permissions so that you can run commands as root without using an actual root account.
• Configure your systems such that your non-root scanning user has permissions on specified commands and directories.

The following sections describe the configuration for these options.

Configuring your scan environment to support permission elevation

One way to elevate scan permissions without using a root user or performing a custom configuration is to use permission elevation, such as sudo or pbrun. These options require specific configuration (for instance, for pbrun, you need to whitelist the user's shell), but do not require you to customize permissions as described in Commands the application runs below.

Commands the application runs

The following section contains guidelines for what commands the application runs when scanning. The vast majority of these commands can be run without root. As indicated above, this list is subject to change as new checks are added.

The majority of the commands are required for one of the following:

• getting the version of the operating system
• getting the versions of installed software packages
• running policy checks implemented as shell scripts

The following commands are required for all Unix/Linux distributions:

• ifconfig
• java
• sha1
• sha1sum
• md5
• md5sum
• awk
• grep
• egrep
• cut
• id
• ls
• unzip

InsightVM will attempt to scan certain files, and will be able to perform the corresponding checks if the user account has the appropriate access to those files. The following is a list of files or directories that the account needs to be able to access:

• /etc/group
• /etc/passwd
• grub.conf
• menu.lst
• lilo.conf
• syslog.conf
• /etc/permissions
• /etc/securetty
• /var/log/postgresql
• /etc/hosts.equiv
• .netrc
• /, /dev, /sys, and /proc /home /var /etc
• /etc/master.passwd
• sshd_config

For Linux, the application needs to read the following files, if present, to determine the distribution:

• /etc/debian_release
• /etc/debian_version
• /etc/redhat-release
• /etc/redhat_version
• /etc/os-release
• /etc/SuSE-release
• /etc/fedora-release
• /etc/slackware-release
• /etc/slackware-version
• /etc/system-release
• /etc/mandrake-release
• /etc/yellowdog-release
• /etc/gentoo-release
• /etc/UnitedLinux-release
• /etc/vmware-release
• /etc/slp.reg
• /etc/oracle-release

On any Unix or related variants (such as Ubuntu or OS X), there are specific commands the account needs to be able to perform in order to run specific checks. These commands should be whitelisted for the account.

The account needs to be able to perform the following commands for certain checks:

• cat
• find
• mysqlaccess
• mysqlhotcopy
• sh
• sysctl
• dmidecode
• perlsuid
• apt-get
• rpm

For the following types of distributions, the account needs execute permissions as indicated.

AIX

• lslpp –cL to list packages
• oslevel
• emgr -l

Blue Coat

• show version

Cisco

Required for operating system detection:

• show version

Required for vulnerability scanning (configuration detection):

Cisco IOS:

• show cip status
• show interface
• show iox
• show running-config
• show udp

Cisco IOS-XE:

• show ap status
• show avc sd-service info detailed
• show bgp rpki servers
• show cip status
• show iox
• show ip interface brief
• show ip virtual-reassembly
• show ipv6 mfib .*
• show l2tp tunnel
• show mdns-sd summary
• show mpls interfaces
• show platform hardware qfp active feature firewall runtime
• show running-config
• show sdwan appqoe status
• show udp
• show utd engine standard status
• show wireless ewc-ap redundancy summary

Cisco IOS-XR:

• show bfd hw-offload state
• show mpls interfaces
• show platform
• show running-config
• show version

Cisco NX-OS:

• show cfs status
• show cloudsec sa interface all
• show feature
• show ip ospf interface
• show module
• show mpls interface detail
• show running-config
• show running-config all
• show running-config cdp all
• show sockets connection

Cisco ASA:

• show asp table socket
• show running-config
• show running-config tunnel-group

Required for policy scanning:

• show version | include Cisco
• show interface
• show running-config
• show snmp host
• show run | include banner login
• show log | incl Trap logging
• show snmp user
• show snmp group
• show ip ssh | incl retries
• show cdp
• show ip ssh | incl timeout
• show running-config | include [ ]*neighbor[ ]*.*[ ]*password
• show run | include banner exec
• show run | include banner motd

Debian-based distributions

• uname
• dpkg
• egrep
• cut
• xargs

F5

• either version, show, or tmsh show sys version

FreeBSD

• freebsd-version is needed to fingerprint FreeBSD versions 10 and later
• The user account needs permissions to execute cat /var/db/freebsd-update/tag on FreeBSD version earlier than 10.
• FreeBSD package fingerprinting requires:
  • pkg info
  • pkg_info

Juniper

• uname
• show version

Mac OS X

• /usr/sbin/softwareupdate
• /usr/sbin/system_profiler
• sw_vers

Palo Alto Networks PAN-OS

• show system info

• Run a Palo Alto firewall policy

  Palo Alto Networks PAN-OS asset configuration

  The following information applies to PanOS and engine-based policies only.

  Prerequisites

  Before you can scan an asset, ensure that:

  • You have access to an SSH connection as an administrator.
  • The scan is able to run the show config running xpath [value] and show config merged command which is available in the default operational mode.

  Run a Palo Alto firewall policy

  1. Copy the provided example.
  2. Customize the values in the policy's configurable fields to meet your organization's individual needs.

  Configurable fields may yield unexpected results

  The benchmark example provided may require modification depending on individual needs.

   
  1
  admin@cis-pa-9-c> show config running
  2
  
  3
  config {
  4
    mgt-config {
  5
     users {
  6
        admin {
  7
         phash $1$fuinsaxv$MK4HTQeN9qrqhUqi6T4op0;
  8
          permissions {
  9
           role-based {
  10
              superuser yes;
  11
           }
  12
          }
  13
       }
  14
     }
  15
     password-complexity {
  16
        minimum-length 12;
  17
        password-history-count 24;
  18
        minimum-lowercase-letters 1;
  19
        minimum-uppercase-letters 1;
  20
        minimum-numeric-letters 1;
  21
        minimum-special-characters 1;
  22
        new-password-differs-by-characters 3;
  23
        enabled yes;
  24
        block-username-inclusion yes;
  25
        password-change-period-block 90;
  26
      }
  27
      password-profile;
  28
  }
  29
    shared {
  30
      application;
  31
      application-group;
  32
      service;
  33
     .
  34
     .
  35
     .

  3. Create a scan template by selecting the Palo Alto benchmark.
  4. Create a site as an administrator using SSH.

RPM-based distributions (e.g. Red Hat, SUSE, or Oracle)

• uname
• rpm
• chkconfig

Solaris

• showrev
• pkginfo
• ndd

VMware ESX/ESXi

• vmware -v

Vulnerability Checks that require RootExecutionService

For certain vulnerability checks, root access is required. If you choose to scan with a non-root user, be aware that these vulnerabilities will not be found, even if they exist on your system.The following is a list of checks that require root access:

• OpenSSH config allows SSHv1 protocol/unix-check-openssh-ssh-version-two is conceptually the same as another check, SSH server supports SSH protocol v1 clients/ssh-v1-supported, which does not require root.

Discovery scans vs Authenticated scans