Пример #1
0
def dns_resolution(system_id):
    """
    Check the DNS name resolution.
    """
    using_proxy = False
    dns_lookup = 'data.alienvault.com'

    (success, system_ip) = get_system_ip_from_system_id(system_id)
    if not success:
        return (False, "Error translating system id to ip")

    (success, data) = get_av_config(system_ip, {'update_update_proxy': ''})
    if not success:
        return (False, "Error getting proxy configuration")


    if 'update_update_proxy' not in data:
        return (False, "Error getting proxy dns. 'update_proxy_key_not_found'")

    using_proxy = data['update_update_proxy'] !='disabled'
    if using_proxy:
        (success, data) = get_av_config(system_ip, {'update_update_proxy_dns': ''})
        if not success:
            return (False, "Error getting proxy dns")
        if 'update_update_proxy_dns' not in data:
            return (False, "Error getting proxy dns. 'update_update_proxy_dns not found'")
        dns_lookup = data['update_update_proxy_dns']

    (success, data) = ansiblemethods.system.network.resolve_dns_name(system_ip, dns_lookup)
    if not success:
        return (False, "Error resolving DNS name")

    return (True, data)
Пример #2
0
def get_system_config_general(system_id, no_cache=False):
    (success, system_ip) = ret = get_system_ip_from_system_id(system_id)
    if not success:
        return ret

    (success, config_values) = get_av_config(system_ip, {'general_admin_dns': '',
                                                         'general_admin_gateway': '',
                                                         'general_admin_ip': '',
                                                         'general_admin_netmask': '',
                                                         'general_hostname': '',
                                                         'general_interface': '',
                                                         'general_mailserver_relay': '',
                                                         'general_mailserver_relay_passwd': '',
                                                         'general_mailserver_relay_port': '',
                                                         'general_mailserver_relay_user': '',
                                                         'general_ntp_server': '',
                                                         'general_profile': '',
                                                         'firewall_active': '',
                                                         'update_update_proxy': '',
                                                         'update_update_proxy_dns': '',
                                                         'update_update_proxy_pass': '',
                                                         'update_update_proxy_port': '',
                                                         'update_update_proxy_user': '',
                                                         'vpn_vpn_infraestructure': ''
                                                         })

    if not success:
        api_log.error("system: get_config_general error: " + str(config_values))
        return (False, "Cannot get general configuration info %s" % str(config_values))

    return (True, config_values)
Пример #3
0
def get_system_config_general(system_id, no_cache=False):
    (success, system_ip) = ret = get_system_ip_from_system_id(system_id)
    if not success:
        return ret

    (success, config_values) = get_av_config(
        system_ip,
        {
            "general_admin_dns": "",
            "general_admin_gateway": "",
            "general_admin_ip": "",
            "general_admin_netmask": "",
            "general_hostname": "",
            "general_interface": "",
            "general_mailserver_relay": "",
            "general_mailserver_relay_passwd": "",
            "general_mailserver_relay_port": "",
            "general_mailserver_relay_user": "",
            "general_ntp_server": "",
            "general_profile": "",
            "firewall_active": "",
            "update_update_proxy": "",
            "update_update_proxy_dns": "",
            "update_update_proxy_pass": "",
            "update_update_proxy_port": "",
            "update_update_proxy_user": "",
        },
    )

    if not success:
        api_log.error("system: get_config_general error: " + str(config_values))
        return (False, "Cannot get general configuration info %s" % str(config_values))

    return (True, config_values)
Пример #4
0
def get_system_config_alienvault(system_id, no_cache=False):

    (success, system_ip) = get_system_ip_from_system_id(system_id)
    if not success:
        return (False, system_ip)

    (success, config_values) = get_av_config(
        system_ip, {
            'framework_framework_ip': '',
            'sensor_detectors': '',
            'sensor_interfaces': '',
            'sensor_mservers': '',
            'sensor_netflow': '',
            'sensor_networks': '',
            'server_server_ip': '',
            'server_alienvault_ip_reputation': '',
            'ha_ha_virtual_ip': '',
            'ha_ha_role': '',
        })

    if not success:
        api_log.error("system: get_config_alienvault error: " +
                      str(config_values))
        return (False, "Cannot get AlienVault configuration info %s" %
                str(config_values))

    return (True, config_values)
Пример #5
0
def get_system_config_alienvault(system_id, no_cache=False):

    (success, system_ip) = get_system_ip_from_system_id(system_id)
    if not success:
        return (False, system_ip)

    (success, config_values) = get_av_config(
        system_ip,
        {
            "framework_framework_ip": "",
            "sensor_detectors": "",
            "sensor_interfaces": "",
            "sensor_mservers": "",
            "sensor_netflow": "",
            "sensor_networks": "",
            "server_server_ip": "",
            "server_alienvault_ip_reputation": "",
            "ha_ha_virtual_ip": "",
            "ha_ha_role": "",
        },
    )

    if not success:
        api_log.error("system: get_config_alienvault error: " + str(config_values))
        return (False, "Cannot get AlienVault configuration info %s" % str(config_values))

    return (True, config_values)
Пример #6
0
def get_system_config_general(system_id, no_cache=False):
    (success, system_ip) = ret = get_system_ip_from_system_id(system_id)
    if not success:
        return ret

    (success, config_values) = get_av_config(
        system_ip, {
            'general_admin_dns': '',
            'general_admin_gateway': '',
            'general_admin_ip': '',
            'general_admin_netmask': '',
            'general_hostname': '',
            'general_interface': '',
            'general_mailserver_relay': '',
            'general_mailserver_relay_passwd': '',
            'general_mailserver_relay_port': '',
            'general_mailserver_relay_user': '',
            'general_ntp_server': '',
            'general_profile': '',
            'firewall_active': '',
            'update_update_proxy': '',
            'update_update_proxy_dns': '',
            'update_update_proxy_pass': '',
            'update_update_proxy_port': '',
            'update_update_proxy_user': ''
        })

    if not success:
        api_log.error("system: get_config_general error: " +
                      str(config_values))
        return (False, "Cannot get general configuration info %s" %
                str(config_values))

    return (True, config_values)
Пример #7
0
    def start(self):
        self.remove_monitor_data()
        rc, system_list = get_systems()
        if not rc:
            logger.error("Can't retrieve systems..%s" % str(system_list))
            return False

        for (system_id, system_ip) in system_list:
            # Use ansible to get the DNS config.
            result, ansible_output = get_av_config(system_ip,
                                                   {'general_admin_dns': ''})
            logger.info("DNS returned from ossim_setup.conf %s" %
                        str(ansible_output))
            if result:
                dnslist = []
                if 'general_admin_dns' in ansible_output:
                    dnslist = ansible_output['general_admin_dns'].split(',')
                count = 0
                for ip in dnslist:
                    r = dns_is_external(ip)
                    if r == -2:
                        count += 1
                    elif r == -1:
                        logger.error(
                            "Bad data in admin_dns field of ossim_setup.conf: "
                            + str(ip))
                # logger.info("DNS IP count = " + str(count))
                if count == len(dnslist):
                    admin_dns_msg = "Warning: All DNS configured are externals"
                    self.save_data(
                        system_id, ComponentTypes.SYSTEM,
                        self.get_json_message({
                            'admin_dns': admin_dns_msg,
                            'internal_dns': False
                        }))
                else:
                    self.save_data(
                        system_id, ComponentTypes.SYSTEM,
                        self.get_json_message({
                            'admin_dns':
                            'DNS ok. You have at least one internal DNS',
                            'internal_dns': True
                        }))

            else:
                if not self.save_data(
                        system_id, ComponentTypes.SYSTEM,
                        self.get_json_message(
                            {
                                'admin_dns': 'Error: %s' % str(ansible_output),
                                'internal_dns': True
                            })):
                    logger.error("Can't save monitor info")
        return True
Пример #8
0
def get_iface_list(system_ip):
    """Returns the interface list for a given ip"""
    dresult = {}
    host_list = []
    host_list.append(system_ip)
    response = ansible.run_module(host_list, "av_setup", "")

    if system_ip in response['dark']:
        return (False, "Error getting interfaces: " +
                response['dark'][system_ip]['msg'])
    else:
        # Get admin network information.
        data_to_retrieve = {'general_interface': '', 'sensor_interfaces': ''}

        success, av_config_response = get_av_config(system_ip,
                                                    data_to_retrieve)

        if not success:
            return False, "Error trying to read administrative interface: %s" % str(
                av_config_response)
        admin_interface = av_config_response.get('general_interface', '')
        sensor_interfaces = av_config_response.get('sensor_interfaces', '')
        # Check for the promisc flag
        for iface in response['contacted'][system_ip]['ansible_facts'][
                'ansible_interfaces']:
            #This only works on Linux
            iface_data = response['contacted'][system_ip]['ansible_facts'][
                'ansible_' + iface]
            dresult[iface] = {'promisc': iface_data['promisc']}
            if iface_data.has_key('ipv4'):
                dresult[iface]['ipv4'] = copy.deepcopy(iface_data['ipv4'])

            dresult[iface]['role'] = 'disabled'

            if iface != 'lo':
                # Is this the admin interface?
                if iface == admin_interface:
                    dresult[iface]['role'] = 'admin'
                # Is this a monitoring interface?
                elif iface in sensor_interfaces:
                    dresult[iface]['role'] = 'monitoring'
                # Is this a log management interface?
                elif iface_data['active'] == True and 'ipv4' in iface_data:
                    dresult[iface]['role'] = 'log_management'

        return (True, dresult)
Пример #9
0
def ansible_check_insecure_vpn(system_ip):
    """ Check if a VPN is insecure: Logjam vulnerability (CVE-2015-4000)

        @param system_ip    The system IP where we're going to check if the vulnerability is present
    """
    #First we get the VPN config.
    success, vpn_config = get_av_config(system_ip, {'vpn_config': ''})
    if success:
        for iface, config in vpn_config['vpn_config'].items():
            #Check that the VPN is enabled and we are the VPN server
            if config['enabled'] == 'yes' and config['role'] == 'server':
                #If this file is present then we are vulnerable.
                file_name = "/etc/openvpn/AVinfrastructure/keys/dh1024.pem"
                if file_exist(system_ip, file_name):
                    return True
    else:
        raise APICannotRetrieveOssimSetup(system_ip, str(vpn_config))

    return False
Пример #10
0
def ansible_check_insecure_vpn(system_ip):
    """ Check if a VPN is insecure: Logjam vulnerability (CVE-2015-4000)

        @param system_ip    The system IP where we're going to check if the vulnerability is present
    """
    #First we get the VPN config.
    success, vpn_config = get_av_config(system_ip, {'vpn_config': ''})
    if success:
        for iface, config in vpn_config['vpn_config'].items():
            #Check that the VPN is enabled and we are the VPN server
            if config['enabled'] == 'yes' and config['role'] == 'server':
                #If this file is present then we are vulnerable.
                file_name = "/etc/openvpn/AVinfrastructure/keys/dh1024.pem"
                if file_exist(system_ip, file_name):
                    return True
    else:
        raise APICannotRetrieveOssimSetup(system_ip, str(vpn_config))

    return False
Пример #11
0
def get_iface_list(system_ip):
    """Returns the interface list for a given ip"""
    dresult = {}
    host_list = []
    host_list.append(system_ip)
    response = ansible.run_module(host_list, "av_setup", "")

    if system_ip in response["dark"]:
        return (False, "Error getting interfaces: " + response["dark"][system_ip]["msg"])
    else:
        # Get admin network information.
        data_to_retrieve = {"general_interface": "", "sensor_interfaces": ""}

        success, av_config_response = get_av_config(system_ip, data_to_retrieve)

        if not success:
            return False, "Error trying to read administrative interface: %s" % str(av_config_response)
        admin_interface = av_config_response.get("general_interface", "")
        sensor_interfaces = av_config_response.get("sensor_interfaces", "")
        # Check for the promisc flag
        for iface in response["contacted"][system_ip]["ansible_facts"]["ansible_interfaces"]:
            # This only works on Linux
            iface_data = response["contacted"][system_ip]["ansible_facts"]["ansible_" + iface]
            dresult[iface] = {"promisc": iface_data["promisc"]}
            if iface_data.has_key("ipv4"):
                dresult[iface]["ipv4"] = copy.deepcopy(iface_data["ipv4"])

            dresult[iface]["role"] = "disabled"

            if iface != "lo":
                # Is this the admin interface?
                if iface == admin_interface:
                    dresult[iface]["role"] = "admin"
                # Is this a monitoring interface?
                elif iface in sensor_interfaces:
                    dresult[iface]["role"] = "monitoring"
                # Is this a log management interface?
                elif iface_data["active"] == True and "ipv4" in iface_data:
                    dresult[iface]["role"] = "log_management"

        return (True, dresult)
Пример #12
0
def get_iface_list(system_ip):
    """Returns the interface list for a given ip"""
    dresult = {}
    host_list = []
    host_list.append(system_ip)
    response = ansible.run_module(host_list, "av_setup", "")

    if system_ip in response['dark']:
        return (False, "Error getting interfaces: " + response['dark'][system_ip]['msg'])
    else:
        # Get admin network information.
        data_to_retrieve = {'general_interface': '', 'sensor_interfaces': ''}

        success, av_config_response = get_av_config(system_ip, data_to_retrieve)

        if not success:
            return False, "Error trying to read administrative interface: %s" % str(av_config_response)
        admin_interface = av_config_response.get('general_interface', '')
        sensor_interfaces = av_config_response.get('sensor_interfaces', '')
        # Check for the promisc flag
        for iface in response['contacted'][system_ip]['ansible_facts']['ansible_interfaces']:
            #This only works on Linux
            iface_data = response['contacted'][system_ip]['ansible_facts']['ansible_' + iface]
            dresult[iface] = {'promisc': iface_data['promisc']}
            if iface_data.has_key('ipv4'):
                dresult[iface]['ipv4'] = copy.deepcopy(iface_data['ipv4'])

            dresult[iface]['role'] = 'disabled'

            if iface != 'lo':
                # Is this the admin interface?
                if iface == admin_interface:
                    dresult[iface]['role'] = 'admin'
                # Is this a monitoring interface?
                elif iface in sensor_interfaces:
                    dresult[iface]['role'] = 'monitoring'
                # Is this a log management interface?
                elif iface_data['active'] == True and 'ipv4' in iface_data: 
                    dresult[iface]['role'] = 'log_management'

        return (True, dresult)
Пример #13
0
def backup_configuration_for_system_id(system_id='local', method="auto"):
    """ Task to run configuration backup for system """
    result, system_ip = get_system_ip_from_system_id(system_id)
    if not result:
        return False

    # If system_id is remote sensor - we need to get server IP to fetch correct backup password.
    server_ip = system_ip
    if not is_local(system_id):
        conf_key = 'server_server_ip'
        _, data = get_av_config(system_ip, {conf_key: True})
        server_ip = data.get(conf_key, system_ip)

    success, msg = make_system_backup(system_id=system_id,
                                      backup_type='configuration',
                                      rotate=False,
                                      retry=False,
                                      method=method,
                                      backup_pass=ansible_get_backup_config_pass(server_ip))

    return success, msg
Пример #14
0
    def start(self):
        self.remove_monitor_data()
        rc, system_list = get_systems()
        if not rc:
            logger.error("Can't retrieve systems..%s" % str(system_list))
            return False

        for (system_id, system_ip) in system_list:
            # Use ansible to get the DNS config.
            result, ansible_output = get_av_config(system_ip, {'general_admin_dns': ''})
            logger.info("DNS returned from ossim_setup.conf %s" % str(ansible_output))
            if result:
                dnslist = []
                if 'general_admin_dns' in ansible_output:
                    dnslist = ansible_output['general_admin_dns'].split(',')
                count = 0
                for ip in dnslist:
                    r = dns_is_external(ip)
                    if r == -2:
                        count += 1
                    elif r == -1:
                        logger.error("Bad data in admin_dns field of ossim_setup.conf: " + str(ip))
                # logger.info("DNS IP count = " + str(count))
                if count == len(dnslist):
                    admin_dns_msg = "Warning: All DNS configured are externals"
                    self.save_data(system_id, ComponentTypes.SYSTEM,
                                   self.get_json_message(
                                       {'admin_dns': admin_dns_msg,
                                        'internal_dns': False}))
                else:
                    self.save_data(system_id, ComponentTypes.SYSTEM,
                                   self.get_json_message({'admin_dns': 'DNS ok. You have at least one internal DNS',
                                                          'internal_dns': True}))

            else:
                if not self.save_data(system_id, ComponentTypes.SYSTEM,
                                      self.get_json_message({'admin_dns': 'Error: %s' % str(ansible_output),
                                                             'internal_dns': True})):
                    logger.error("Can't save monitor info")
        return True
Пример #15
0
def backup_configuration_for_system_id(system_id='local', method="auto"):
    """ Task to run configuration backup for system """
    result, system_ip = get_system_ip_from_system_id(system_id)
    if not result:
        return False

    # If system_id is remote sensor - we need to get server IP to fetch correct backup password.
    server_ip = system_ip
    if not is_local(system_id):
        conf_key = 'server_server_ip'
        _, data = get_av_config(system_ip, {conf_key: True})
        server_ip = data.get(conf_key, system_ip)

    success, msg = make_system_backup(
        system_id=system_id,
        backup_type='configuration',
        rotate=False,
        retry=False,
        method=method,
        backup_pass=ansible_get_backup_config_pass(server_ip))

    return success, msg
Пример #16
0
def get_system_sensor_configuration(system_id):

    (success, system_ip) = get_system_ip_from_system_id(system_id)
    if not success:
        return (False, system_ip)

    (success, config_values) = get_av_config(
        system_ip,
        {
            "sensor_asec": "",
            "sensor_detectors": "",
            "sensor_interfaces": "",
            "sensor_mservers": "",
            "sensor_netflow": "",
            "sensor_networks": "",
            "sensor_monitors": "",
        },
    )

    if not success:
        api_log.error("system: get_config_alienvault error: " + str(config_values))
        return (False, "Cannot get AlienVault configuration info %s" % str(config_values))

    return (True, config_values)
Пример #17
0
def get_system_sensor_configuration(system_id):

    (success, system_ip) = get_system_ip_from_system_id(system_id)
    if not success:
        return (False, system_ip)

    (success, config_values) = get_av_config(
        system_ip, {
            'sensor_asec': '',
            'sensor_detectors': '',
            'sensor_interfaces': '',
            'sensor_mservers': '',
            'sensor_netflow': '',
            'sensor_networks': '',
            'sensor_monitors': '',
        })

    if not success:
        api_log.error("system: get_config_alienvault error: " +
                      str(config_values))
        return (False, "Cannot get AlienVault configuration info %s" %
                str(config_values))

    return (True, config_values)