up vote 1 down vote favorite
1
share [g+] share [fb]

I've a dedicated LAMP server (Ubuntu) with several Drupal and Wordpress installations on it.

Is there a free CVE compatible tool, which could scan my server with all websites and generate automatic reports about discovered security vulnerabilities ?

Thank You very much for Your answers.

link|improve this question
50% accept rate
feedback

3 Answers

up vote 1 down vote accepted

Try out nessus. Does everything you listed in your requirements.

link|improve this answer
Thank You, Patrick. I saw, what nessus is a commercial product, is it free ? At the page ow wikipedia it says, what is not completely free, as I understood en.wikipedia.org/wiki/Nessus_(software) – Fedir Nov 29 '11 at 7:03
I think its licensing is such that its free, but if you use it in a work environment, you have to pay for it. Same product though. – Patrick Nov 29 '11 at 16:58
Ok. So, it's not exactly, what I'm looking for. But I've found a branch of that product : openvas.org in GPL license. Probably, that will make the job ! – Fedir Nov 29 '11 at 18:04
This answer was the most near to my question. Thanks again to all. – Fedir Nov 30 '11 at 16:15
feedback
up vote 1 down vote

OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

http://www.ossec.net/

link|improve this answer
Thanks. It looks like realtime security "guardian". At the moment I'm looking only for static audit tool, which lists vulnerabilities in CVE format. Didn't found in the documentation of OSSEC if it could scan the system and give the report in such format. – Fedir Nov 28 '11 at 22:29
feedback
up vote 1 down vote

Check out http://security.stackexchange.com/ for this type of question.

You need to think in terms of two types of security: Overall OS security for the L part of your LAMP stack, and application security, or the AMP part of the stack.

For overall system security you can try OSSIM to do some basic tests, but there is definitely a learning curve.

Each Wordpress and Drupal install (depending on the amount of privilege you give administrators of each site) is a potential liability with third-party plugins and the like. Take a look at this question for some great pointers.

link|improve this answer
Thank You for the link, didn't knew this subdomain. OSSIM looks very interesting, even I didn't found still, if it has CVE support. – Fedir Nov 28 '11 at 22:25
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.