Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've a dedicated LAMP server (Ubuntu) with several Drupal and Wordpress installations on it.

Is there a free CVE compatible tool, which could scan my server with all websites and generate automatic reports about discovered security vulnerabilities ?

Thank You very much for Your answers.

share|improve this question

closed as off-topic by Michael Hampton Jan 14 at 15:57

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Michael Hampton
If this question can be reworded to fit the rules in the help center, please edit the question.

3 Answers 3

up vote 1 down vote accepted

Try out nessus. Does everything you listed in your requirements.

share|improve this answer
    
Thank You, Patrick. I saw, what nessus is a commercial product, is it free ? At the page ow wikipedia it says, what is not completely free, as I understood en.wikipedia.org/wiki/Nessus_(software) –  Fedir Nov 29 '11 at 7:03
    
I think its licensing is such that its free, but if you use it in a work environment, you have to pay for it. Same product though. –  Patrick Nov 29 '11 at 16:58
    
Ok. So, it's not exactly, what I'm looking for. But I've found a branch of that product : openvas.org in GPL license. Probably, that will make the job ! –  Fedir Nov 29 '11 at 18:04
    
This answer was the most near to my question. Thanks again to all. –  Fedir Nov 30 '11 at 16:15

OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

http://www.ossec.net/

share|improve this answer
    
Thanks. It looks like realtime security "guardian". At the moment I'm looking only for static audit tool, which lists vulnerabilities in CVE format. Didn't found in the documentation of OSSEC if it could scan the system and give the report in such format. –  Fedir Nov 28 '11 at 22:29

Check out http://security.stackexchange.com/ for this type of question.

You need to think in terms of two types of security: Overall OS security for the L part of your LAMP stack, and application security, or the AMP part of the stack.

For overall system security you can try OSSIM to do some basic tests, but there is definitely a learning curve.

Each Wordpress and Drupal install (depending on the amount of privilege you give administrators of each site) is a potential liability with third-party plugins and the like. Take a look at this question for some great pointers.

share|improve this answer
    
Thank You for the link, didn't knew this subdomain. OSSIM looks very interesting, even I didn't found still, if it has CVE support. –  Fedir Nov 28 '11 at 22:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.