2

I've a dedicated LAMP server (Ubuntu) with several Drupal and Wordpress installations on it.

Is there a free CVE compatible tool, which could scan my server with all websites and generate automatic reports about discovered security vulnerabilities ?

Thank You very much for Your answers.

closed as off-topic by Michael Hampton Jan 14 '14 at 15:57

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Michael Hampton
If this question can be reworded to fit the rules in the help center, please edit the question.

2

Try out nessus. Does everything you listed in your requirements.

  • Thank You, Patrick. I saw, what nessus is a commercial product, is it free ? At the page ow wikipedia it says, what is not completely free, as I understood en.wikipedia.org/wiki/Nessus_(software) – Fedir RYKHTIK Nov 29 '11 at 7:03
  • I think its licensing is such that its free, but if you use it in a work environment, you have to pay for it. Same product though. – Patrick Nov 29 '11 at 16:58
  • Ok. So, it's not exactly, what I'm looking for. But I've found a branch of that product : openvas.org in GPL license. Probably, that will make the job ! – Fedir RYKHTIK Nov 29 '11 at 18:04
  • This answer was the most near to my question. Thanks again to all. – Fedir RYKHTIK Nov 30 '11 at 16:15
1

OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

http://www.ossec.net/

  • Thanks. It looks like realtime security "guardian". At the moment I'm looking only for static audit tool, which lists vulnerabilities in CVE format. Didn't found in the documentation of OSSEC if it could scan the system and give the report in such format. – Fedir RYKHTIK Nov 28 '11 at 22:29
1

Check out https://security.stackexchange.com/ for this type of question.

You need to think in terms of two types of security: Overall OS security for the L part of your LAMP stack, and application security, or the AMP part of the stack.

For overall system security you can try OSSIM to do some basic tests, but there is definitely a learning curve.

Each Wordpress and Drupal install (depending on the amount of privilege you give administrators of each site) is a potential liability with third-party plugins and the like. Take a look at this question for some great pointers.

  • Thank You for the link, didn't knew this subdomain. OSSIM looks very interesting, even I didn't found still, if it has CVE support. – Fedir RYKHTIK Nov 28 '11 at 22:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.