1

I'm in charge of auditing the security configuration of an important farm of Unix servers. So far, I came up with a way to assess the basic configuration but not the installed updates.

  • The very problem here is that I just can't trust the package management tools on those machine. Indeed some of them did not sync with the repository for a long time (So I can't do a "yum check-updates" on Redhat for example). Some of those servers are not even connected to the internet and use an company repository.

  • Another problem is that I have multiple target systems: AIX, Debian, Centos/Redhat, etc... So the version could be different (AIX) and the tools available will be different.

  • And, last but not least, I can't install anything on the target system. So I need to use a script to retrieve the information and either: process it directly or save the information to be able to process it later on a server (Which may happen to run a different distribution than the one on which the information have been retrieved).

The best ideas I could come up with were:

  • either retrieve the list of installed packages on the machine (dpkg -l for example on debian) and process it on a dedicated server (Directly parsing the "Packages" file of debian repositories). Still, the problem remains the same for AIX and Redhat...

  • or use Nessus' scripts to assess vulnerability on the installed packages, but I find this a bit dirty.

Does anyone know any better/efficient way of doing this ?

P.S: I already took time to review some answers to similar problems. Unfortunately Chef, puppet, ... don't meet the requirements I have to meet.

Edit: Long story short. I need to have the list of missing updates on a Unix system just like MBSA on Windows. I'm not authorized to install anything on this system as it's not mine. All I have are scripts languages.

Thanks.

  • 3
    If your requirements are "Do it all without installing anything on the client systems" your requirements are frankly unreasonable. Puppet/Chef/other proper configuration & system management software is the correct solution here: battle tested and proven to work. If you're rolling out something home-grown you're just going to waste your time debugging and ultimately you'll be in the same situation as if you were doing it all manually... – voretaq7 Jul 1 '13 at 19:21
  • Are you talking about auditing every aspect of the installed OS, or a specific product, or just the OS, or just all the non-OS products? – EightBitTony Jul 1 '13 at 21:23
  • Actually, the servers are not "mine". I'm not authorized to install anything on it. On the other hand (And what I did not make clear on my precedent post) I just need a list of missing updates. Nothing more, just like MBSA CLI on Windows. I don't intend to write it from scratch, just to find a solution able to run as "one-shot", generate a "log file" which will be analyzed on a server later. That's why I kind of eliminated Puppet/Chef/... Edit: I'm actually talking about auditing the version of all packages – Pierre Jul 1 '13 at 21:24
1

It is common to have some sort of proxy cache service acting as an intermediary between the upstream repositories and the target machines. It helps saving bandwith and makes deployments faster, in the RHEL/CentOS world that would be spacewalk, in Debian and derivatives a debmirror and in the AIX world possibly a NIM server.

Given the absence of ruby for AIX (some ports do exist, though), the appropriate configuration management for your environment would be cfengine. If that looks overkill, you can also try ansible, which only requires python. And there is pyhton even for AIX.

It is also common and even expected that the versions, name of the services, name of the packages, etc... differ from platform to platform. You need to deal with separating data and code. If a mature configuration management system does not meet your requirements, I seriously doubt that a bunch of home-brewed scripts will.

The third requirement: "I can't install anything on the target system..." is not clear at all, and seems to be in conflict with the fact that you are using private repos.

Last but not least, managing packages is only a 1% of the tasks you need to perform in order to secure and audit your systems.

  • Thanks for your answer ! I took the time to edit my question. Considering this, do you still think I could use cfengine/ansible ? It seems they are using an "agent" which needs to be installed on the targeted system. – Pierre Jul 2 '13 at 7:01
  • ansible can use a raw command module which doesn't need an agent. – dawud Jul 2 '13 at 7:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.