denizparlak / zeus Goto Github PK

View Code? Open in Web Editor NEW

704.0 34.0 104.0 233 KB

AWS Auditing & Hardening Tool

Home Page: http://www.denizparlak.com/?p=386

License: MIT License

Shell 99.99% HTML 0.01% Roff 0.01%

cloudtrail aws-auditing hardening aws-hardening aws

zeus's Introduction

Zeus

AWS Auditing & Hardening Tool

Zeus is a powerful tool for AWS EC2 / S3 / CloudTrail / CloudWatch / KMS best hardening practices. It checks security settings according to the profiles the user creates and changes them to recommended settings based on the CIS AWS Benchmark source at request of the user.

~~Currently, it only includes the Logging mechanism.~~

Identity and Access Management

Avoid the use of the "root" account
Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password
Ensure credentials unused for 90 days or greater are disabled
Ensure access keys are rotated every 90 days or less
Ensure IAM password policy requires at least one uppercase letter
Ensure IAM password policy requires at least one lowercase letter
Ensure IAM password policy requires at least one symbol
Ensure IAM password policy requires at least one number
Ensure IAM password policy requires minimum length of 14 or greater
Ensure no root account access key exists
Ensure MFA is enabled for the "root" account
Ensure security questions are registered in the AWS account
Ensure IAM policies are attached only to groups or role
Enable detailed billing
Maintain current contact details
Ensure security contact information is registered
Ensure IAM instance roles are used for AWS resource access from instances

Logging

Ensure CloudTrail is enabled in all regions
Ensure CloudTrail log file validation is enabled
Ensure the S3 bucket CloudTrail logs to is not publicly accessible
Ensure CloudTrail trails are integrated with CloudWatch Logs
Ensure AWS Config is enabled in all regions
Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket
Ensure CloudTrail logs are encrypted at rest using KMS CMKs
Ensure rotation for customer created CMKs is enabled

Networking

Ensure no security groups allow ingress from 0.0.0.0/0 to port 22
Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389
Ensure VPC flow logging is enabled in all VPC
Ensure the default security group of every VPC restricts all traffic

Monitoring

Ensure a log metric filter and alarm exist for unauthorized API calls
Ensure a log metric filter and alarm exist for Management Consolesign-in without MFA
Ensure a log metric filter and alarm exist for usage of "root" account
Ensure a log metric filter and alarm exist for IAM policy changes
Ensure a log metric filter and alarm exist for CloudTrail configuration changes
Ensure a log metric filter and alarm exist for AWS Management Console authentication failures
Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs
Ensure a log metric filter and alarm exist for S3 bucket policy changes
Ensure a log metric filter and alarm exist for AWS Config configuration changes
Ensure a log metric filter and alarm exist for security group changes
Ensure a log metric filter and alarm exist for changes to NetworkAccess Control Lists (NACL)
Ensure a log metric filter and alarm exist for changes to network gateways
Ensure a log metric filter and alarm exist for route table changes
Ensure a log metric filter and alarm exist for VPC changes

ChangeLog

Soon.

Requirements

Zeus has been written in bash script using AWS-CLI and it works in Linux/UNIX and OSX.

~~Make sure that the AWS-CLI tool is installed on the system and profile is configured (aws configure).~~

Update:

pip & aws-cli checking functions are added that based on operating system.

Usage

git clone https://github.com/DenizParlak/Zeus.git && cd Zeus && chmod +x zeus.sh && ./zeus.sh

zeus's People

Contributors

Stargazers

Watchers

Forkers

cys3c irivera007 blackout314 arocse y0d4a overdrive3000 5up3rc shalombublil 0patch ksmaheshkumar sergey-pronin al13nator oswaldderiemaecker awesome-security warlinux varadhraj amanhardikar ossecfile utkarsh-devops samy06250 cookingcodewithme vdt hasantayyar magnologan jonshern softfactoryio sent2020 zadrota brikou megamindat cjpetrus nelyj tstrul tsheth alexitosrv slowmistio th3khadraoui brianelugan99 lizarragarigoberto r3dfruitrollup nattig classity tamanmerah ivosandoval sadhananatarajan12 ro9ueadmin jitinchawla johamcm l9sk praveengowdaballa abhinavk07 vinhht95-fork prtkgpta per-fide matesio danyal2050 seabreg esraalinca robincyberstruggle rafa0184 smolige001 polymath-is modulexcite pentest-tools 5l1v3r1 sanmakol jamver 0x434f6869 sugarp0pe tncyysl cynorsense latkes bahtiyarb-torba piterpentester hartl3y94 tommalvoriddle rakhithjk globalopensourcesociety ywsfay bencloudify marciopocebon cyberlola moisestapia 0ccupi3r investlab jrsk23 gopalakrishnsak n-benchoubane evandrocsantos sivaatluri567 dmore l3aalteshuva 3tternp kavyeshs41 rahulgandhijayabalan-bc

zeus's Issues

grep Invalid range bug

Same shell, different result, weird.

Project license

What is the license that is used for this project? Can you upload a LICENSE/COPYING file?

--require-uppercase-charecters Spelling typo

--require-uppercase-charecters is wrong. It should be --require-uppercase-characters

MacOS Problemi

İlk kurulum mac'im de denedim tool'u, MacOS oldugunu anlıyor ama pip yüklü olmadığında bu cıktı veriyor?

Mesela şuan sistem de py2 var ve pip hiç kurulu değil.

Python : Python 2.7.10 (default, Feb 7 2017, 00:08:15)

Omars-Air:Zeus omarkurt$ ./zeus.sh
   ______     ______     __  __     ______
  /\___  \   /\  ___\   /\ \/\ \   /\  ___\ 
  \/_/  /__  \ \  __\   \ \ \_\ \  \ \___  \ 
    /\_____\  \ \_____\  \ \_____\  \/\_____\ 
    \/_____/   \/_____/   \/_____/   \/_____/ 


____________________________________________

AWS Auditing & Hardening Tool v1.0 ~

[email protected]
twitter.com/_denizparlak

Zeus is starting at.. Wed Jul 5 17:28:01 +03 2017
____________________________________________

INFO: Operating System: MacOS

Avoid the use of the root account.
Result:

./zeus.sh: line 110: aws: command not found
./zeus.sh: line 111: aws: command not found
base64: invalid option -- d
Usage:	base64 [-hvD] [-b num] [-i in_file] [-o out_file]
  -h, --help     display this message
  -D, --decode   decodes input
  -b, --break    break encoded string into num character lines
  -i, --input    input file (default: "-" for stdin)
  -o, --output   output file (default: "-" for stdout)
IAM credential report file created as 'credential_reports.txt'

____________________________________________

Ensure MFA is enabled for all IAM users that have a console password.
Result:

./zeus.sh: line 129: aws: command not found
base64: invalid option -- d
Usage:	base64 [-hvD] [-b num] [-i in_file] [-o out_file]
  -h, --help     display this message
  -D, --decode   decodes input
  -b, --break    break encoded string into num character lines
  -i, --input    input file (default: "-" for stdin)
  -o, --output   output file (default: "-" for stdout)
MFA credential report file created as 'mfa_reports.txt'

____________________________________________

Ensure credentials unused for 90 days or greater are disabled.
Result:

./zeus.sh: line 147: aws: command not found
base64: invalid option -- d
Usage:	base64 [-hvD] [-b num] [-i in_file] [-o out_file]
  -h, --help     display this message
  -D, --decode   decodes input
  -b, --break    break encoded string into num character lines
  -i, --input    input file (default: "-" for stdin)
  -o, --output   output file (default: "-" for stdout)
OK
Password enabled for each user!

____________________________________________

Ensure access keys are rotated every 90 days or less.
Result:

./zeus.sh: line 170: aws: command not found
base64: invalid option -- d
Usage:	base64 [-hvD] [-b num] [-i in_file] [-o out_file]
  -h, --help     display this message
  -D, --decode   decodes input
  -b, --break    break encoded string into num character lines
  -i, --input    input file (default: "-" for stdin)
  -o, --output   output file (default: "-" for stdout)
Access keys rotate log file created as access_key.log

____________________________________________

Ensure IAM password policy requires at least one uppercase letter.
Result:

./zeus.sh: line 188: aws: command not found
OK
Uppercase letter force active!
____________________________________________

Ensure IAM password policy requires at least one lowercase letter.
Result:

./zeus.sh: line 215: aws: command not found
./zeus.sh: line 218: aws: command not found
OK
Lowercase letter force active!
____________________________________________

Ensure IAM password policy requires at least one symbol.
Result:

./zeus.sh: line 248: aws: command not found
OK
At least one symbol force active!
____________________________________________

Ensure IAM password policy requires at least one number.
Result:

./zeus.sh: line 278: aws: command not found
./zeus.sh: line 280: aws: command not found
OK
Number force active!
____________________________________________

Ensure IAM password policy requires minimum length of 14 or greater.
Result:

./zeus.sh: line 278: aws: command not found
./zeus.sh: line 280: aws: command not found
OK
Number force active!
____________________________________________

Ensure CloudTrail is enabled in all regions:
Result:

./zeus.sh: line 341: aws: command not found
./zeus.sh: line 344: aws: command not found
./zeus.sh: line 346: aws: command not found
egrep: repetition-operator operand invalid
WARNING
Trail found but multi region is not active.
Fix? y/n

Distro problem (Ubuntu)

awscli setup function is working wrong.

Syntax error

After a clean install on Amazon Linux VM I get the following error:

./zeus.sh: line 884: syntax error near unexpected token `}'

Does it work?

The idea behind zeus is nice but I cannot make it work...

I've checked against http://www.shellcheck.net and it is red :/

I think a esac, done stmt are missing but not sure...

Any idea what is wrong?

bash 4.1.x vs bash 4.2.x

Wrong results are occuring at some functions because of different bash version, this should be fix.