init
This commit is contained in:
Redsandyg
140
results/reports/2026-06-14_06-37-41_audit.log
Normal file
140
results/reports/2026-06-14_06-37-41_audit.log
Normal file
@@ -0,0 +1,140 @@
|
||||
Permissions audit 2026-06-14T06:37:59+00:00
|
||||
|
||||
=== Worker user ===
|
||||
user nginx;
|
||||
1 root 0:00 nginx: master process nginx -g daemon off;
|
||||
20 nginx 0:00 nginx: worker process
|
||||
21 nginx 0:00 nginx: worker process
|
||||
22 nginx 0:00 nginx: worker process
|
||||
23 nginx 0:00 nginx: worker process
|
||||
24 nginx 0:00 nginx: worker process
|
||||
25 nginx 0:00 nginx: worker process
|
||||
26 nginx 0:00 nginx: worker process
|
||||
27 nginx 0:00 nginx: worker process
|
||||
28 nginx 0:00 nginx: worker process
|
||||
29 nginx 0:00 nginx: worker process
|
||||
30 nginx 0:00 nginx: worker process
|
||||
31 nginx 0:00 nginx: worker process
|
||||
32 nginx 0:00 nginx: worker process
|
||||
33 nginx 0:00 nginx: worker process
|
||||
34 nginx 0:00 nginx: worker process
|
||||
35 nginx 0:00 nginx: worker process
|
||||
36 nginx 0:00 nginx: worker process
|
||||
37 nginx 0:00 nginx: worker process
|
||||
38 nginx 0:00 nginx: worker process
|
||||
39 nginx 0:00 nginx: worker process
|
||||
|
||||
=== Config permissions ===
|
||||
total 40
|
||||
drwxr-xr-x 1 root root 4096 Jun 14 05:28 .
|
||||
drwxr-xr-x 1 root root 4096 Jun 14 05:28 ..
|
||||
drwxrwxrwx 1 root root 4096 Jun 14 04:56 conf.d
|
||||
-rw-r--r-- 1 root root 1077 Feb 5 2025 fastcgi.conf
|
||||
-rw-r--r-- 1 root root 1007 Feb 5 2025 fastcgi_params
|
||||
-rw-r--r-- 1 root root 43 Jun 14 06:37 htpasswd
|
||||
-rw-r--r-- 1 root root 5349 Feb 5 2025 mime.types
|
||||
lrwxrwxrwx 1 root root 22 Apr 16 2025 modules -> /usr/lib/nginx/modules
|
||||
-rwxrwxrwx 1 root root 1233 Jun 14 06:27 nginx.conf
|
||||
-rw-r--r-- 1 root root 636 Feb 5 2025 scgi_params
|
||||
drwxrwxrwx 1 root root 4096 Jun 14 06:37 ssl
|
||||
-rw-r--r-- 1 root root 664 Feb 5 2025 uwsgi_params
|
||||
-rwxrwxrwx 1 root root 1233 Jun 14 06:27 /etc/nginx/nginx.conf
|
||||
FAIL: nginx can write nginx.conf
|
||||
|
||||
=== Web root permissions ===
|
||||
total 0
|
||||
drwxrwxrwx 1 root root 4096 Jun 14 04:56 .
|
||||
drwxrwxrwx 1 root root 4096 Jun 14 04:55 ..
|
||||
-rwxrwxrwx 1 root root 138 Jun 14 04:56 index.html
|
||||
FAIL: nginx can write web root
|
||||
|
||||
=== TLS certificates and keys ===
|
||||
total 40
|
||||
drwxrwxrwx 1 root root 4096 Jun 14 06:37 .
|
||||
drwxr-xr-x 1 root root 4096 Jun 14 05:28 ..
|
||||
-rw-r--r-- 1 root root 1814 Jun 14 06:37 ca.crt
|
||||
-rw------- 1 root root 3272 Jun 14 06:37 ca.key
|
||||
-rw-r--r-- 1 root root 1448 Jun 14 06:37 client.crt
|
||||
-rw------- 1 root root 1704 Jun 14 06:37 client.key
|
||||
-rw-r--r-- 1 root root 3254 Jun 14 06:37 fullchain.crt
|
||||
-rw-r--r-- 1 root root 1440 Jun 14 06:37 server.crt
|
||||
-rw------- 1 root root 1704 Jun 14 06:37 server.key
|
||||
-rw-r--r-- 1 root root 1131 Jun 14 06:37 untrusted.crt
|
||||
-rw------- 1 root root 1704 Jun 14 06:37 untrusted.key
|
||||
OK: nginx cannot read private key
|
||||
|
||||
=== htpasswd ===
|
||||
-rw-r--r-- 1 root root 43 Jun 14 06:37 /etc/nginx/htpasswd
|
||||
OK: nginx cannot write htpasswd
|
||||
|
||||
=== Logs ===
|
||||
total 8
|
||||
drwxr-xr-x 2 root root 4096 Jun 14 05:18 .
|
||||
drwxr-xr-x 1 root root 4096 Apr 16 2025 ..
|
||||
lrwxrwxrwx 1 root root 11 Apr 16 2025 access.log -> /dev/stdout
|
||||
lrwxrwxrwx 1 root root 11 Apr 16 2025 error.log -> /dev/stderr
|
||||
|
||||
=== Temp/cache paths ===
|
||||
total 28
|
||||
drwxr-xr-x 7 root root 4096 Jun 14 05:18 .
|
||||
drwxr-xr-x 1 root root 4096 Apr 16 2025 ..
|
||||
drwx------ 2 nginx root 4096 Jun 14 05:18 client_temp
|
||||
drwx------ 2 nginx root 4096 Jun 14 05:18 fastcgi_temp
|
||||
drwx------ 2 nginx root 4096 Jun 14 05:18 proxy_temp
|
||||
drwx------ 2 nginx root 4096 Jun 14 05:18 scgi_temp
|
||||
drwx------ 2 nginx root 4096 Jun 14 05:18 uwsgi_temp
|
||||
client_body_temp_path /var/cache/nginx/client_temp;
|
||||
proxy_temp_path /var/cache/nginx/proxy_temp;
|
||||
|
||||
=== Attack surface audit 2026-06-14T06:38:00+00:00 ===
|
||||
--- nginx -V ---
|
||||
nginx version: nginx/1.26.3
|
||||
built by gcc 13.2.1 20240309 (Alpine 13.2.1_git20240309)
|
||||
built with OpenSSL 3.3.0 9 Apr 2024 (running with OpenSSL 3.3.3 11 Feb 2025)
|
||||
TLS SNI support enabled
|
||||
configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --with-perl_modules_path=/usr/lib/perl5/vendor_perl --user=nginx --group=nginx --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-http_v3_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-Os -fstack-clash-protection -Wformat -Werror=format-security -fno-plt -g' --with-ld-opt='-Wl,--as-needed,-O1,--sort-common -Wl,-z,pack-relative-relocs'
|
||||
--- load_module ---
|
||||
(none)
|
||||
--- optional modules in config ---
|
||||
application/x-perl pl pm;
|
||||
# П.4: auth_request
|
||||
auth_request /auth;
|
||||
--- autoindex ---
|
||||
autoindex off;
|
||||
# П.21: autoindex off
|
||||
autoindex off;
|
||||
--- limit_except / request_method ---
|
||||
# П.7: limit_except
|
||||
limit_except GET POST {
|
||||
--- proxy_pass / upstream ---
|
||||
upstream approved_backend {
|
||||
upstream slow_upstream {
|
||||
proxy_pass http://auth-mock:9999/validate;
|
||||
proxy_pass_request_body off;
|
||||
proxy_pass http://approved_backend/;
|
||||
proxy_pass http://approved_backend/;
|
||||
# П.13: error log через недоступный upstream
|
||||
proxy_pass http://127.0.0.1:59999/;
|
||||
proxy_pass http://approved_backend/status;
|
||||
proxy_pass http://approved_backend/status;
|
||||
proxy_pass http://slow_upstream/;
|
||||
--- ssi ---
|
||||
(ssi off)
|
||||
|
||||
=== Code execution control audit 2026-06-14T06:38:01+00:00 ===
|
||||
application/x-perl pl pm;
|
||||
root /usr/share/nginx/html/public;
|
||||
root /usr/share/nginx/html/errors;
|
||||
internal;
|
||||
alias /usr/share/nginx/html/public/;
|
||||
alias /usr/share/nginx/html/public/;
|
||||
alias /usr/share/nginx/html/public/;
|
||||
internal;
|
||||
# П.8: internal
|
||||
internal;
|
||||
alias /usr/share/nginx/html/protected/;
|
||||
alias /usr/share/nginx/html/files/;
|
||||
alias /usr/share/nginx/html/public/;
|
||||
root /usr/share/nginx/html/public;
|
||||
--- SCRIPT_FILENAME ---
|
||||
(no fastcgi)
|
||||
Reference in New Issue
Block a user