Chapter 9. Vulnerability Scanning and Intrusion Detection

There are lots of threats out there, and some of them might even penetrate into your network. You'll want to know when that happens, so you'll want to have a good Network Intrusion Detection System (NIDS) in place. We'll look at Snort, which is probably the most famous one. I'll then show you a way to cheat so that you can have a Snort system up and running in no time at all.

We've already seen how to scan a machine for viruses and rootkits by installing scanning tools onto the machines that we want to scan. However, there are a lot more vulnerabilities for which we can scan, and I'll show you some cool tools that you can use for that.

The following topics are covered in this chapter:

• An introduction to Snort and Security Onion
• Scanning and hardening with Lynis
• Finding vulnerabilities with OpenVAS
• Web server scanning with Nikto

Looking at Snort and Security Onion

Snort is a NIDS, which is offered as a free open source software product. The program itself is free of charge, but you'll need to pay if you want to have a complete, up-to-date set of threat detection rules. Snort started out as a one-man project, but it's now owned by Cisco.  Understand though, this isn't something that you install on the machine that you want to protect. Rather, you'll have at least one dedicated Snort machine someplace on the network, just monitoring all network traffic, watching for anomalies. When it sees traffic that shouldn't be there—something that indicates the presence of a bot, for example—it can either just send an alert message to an administrator or it can even block the anomalous traffic, depending on how the rules are configured. For a small network, you can have just one Snort machine that acts as both a control console and a sensor. For large networks, you could have one Snort machine set up as a control console and...

Scanning and hardening with Lynis

Lynis is yet another FOSS tool that you can use to scan your systems for vulnerabilities and bad security configurations. It comes as a portable shell script that you can use not only on Linux, but also on a variety of different Unix systems and Unix-like systems. It's a multipurpose tool, which you can use for compliance auditing, vulnerability scanning, or hardening. Unlike most vulnerability scanners, you install and run Lynis on the system that you want to scan. According to the creator of Lynis, this allows for more in-depth scanning.

The Lynis scanning tool is available as a free-of-charge version, but its scanning capabilities are somewhat limited. If you need all that Lynis has to offer, you'll need to purchase an enterprise license.

Installing Lynis on Red Hat/CentOS

Red Hat/CentOS users will find an up-to-date version of Lynis in the EPEL repository. So, if you have EPEL installed, as I showed you in Chapter 1, Running Linux on a Virtual Environment...

Finding vulnerabilities with OpenVAS

The Open Vulnerability Assessment Scanner (OpenVAS) is something that you would use to perform remote vulnerability scans. You can scan a single machine, a group of similar machines, or an entire network. It's not included in the repositories of the major Linux distros, so the best way to get it is to install one of the specialty security distros.

The big three security distros are Kali Linux, Parrot Linux, and Black Arch. They're aimed at security researchers and penetration testers, but they contain tools that would also be good for just a normal security administrator of either the Linux or Windows variety. OpenVAS is one such tool. All three of these three security distros have their unique advantages and disadvantages, but as Kali is the most popular, we'll go with it for the demos.

Note

You can download Kali Linux from https://www.kali.org/downloads/.

When you go to the Kali download page, you'll see lots of choices. If you're like me and don't like...

Web server scanning with Nikto

OpenVAS, which we just looked at, is a general-purpose vulnerability scanner. It can find vulnerabilities for any kind of operating system or for any server daemon. However, as we've just seen, an OpenVAS scan can take a while to run, and it might be more than what you need.

Nikto is a special-purpose tool with only one purpose. That is, it's meant to scan web servers and only web servers. It's easy to install, easy to use, and capable of doing a comprehensive scan of a web server fairly quickly. And, although it's included in Kali Linux, you don't need Kali Linux to run it.

Nikto in Kali Linux

If you already have Kali Linux, you'll find that nikto is already installed under the Vulnerability Analysis menu:

When you click on that menu item, you'll open a command-line terminal with a display of the Nikto help screen:

Installing and updating Nikto on Linux

Nikto is in the EPEL repository for Red Hat/CentOS, and it's in the normal repository for Ubuntu. Along with the...

Summary

We've reached yet another milestone in our journey, and we saw some cool stuff. We started with a discussion about the basics of setting up Snort as a NIDS. I then showed you how to seriously cheat by deploying specialty Linux distros that already have Snort set up and ready to go.

Next, I introduced you to Lynis and how you can use it to scan your system for various vulnerabilities and compliance issues. Finally, we wrapped things up with working demos of OpenVAS and Nikto.

In the next chapter, we'll wind up this whole journey with a look at some quick tips for busy administrators. I'll see you there.