debian busterでniktoを使ってみる。

■debian busterでniktoを使ってみる。

$ lsb_release -d
Description:	Debian GNU/Linux 10 (buster)

$ apt-cache search nikto
wapiti - web application vulnerability scanner
nikto - web server security scanner

$ sudo apt-get install -y nikto
$ nikto -update

$ nikto -h 172.31.31.100 | awk '!/Requires Authentication for realm/'
- Nikto v2.1.5
---------------------------------------------------------------------------
+ Target IP:          172.31.31.100
+ Target Hostname:    vm-stretch
+ Target Port:        80
+ Start Time:         2020-01-12 02:23:17 (GMT9)
---------------------------------------------------------------------------
+ Server: Apache/2.4.38 (Debian)
+ The anti-clickjacking X-Frame-Options header is not present.
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Server leaks inodes via ETags, header found with file /icons/README, fields: 0x13f4 0x438c034968a80 
+ OSVDB-3233: /icons/README: Apache default file found.
+ 6544 items checked: 0 error(s) and 3 item(s) reported on remote host
+ End Time:           2020-01-12 02:23:34 (GMT9) (17 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

■「OSVDB-3233」の確認
　デフォルトのコンテンツで使用するアイコンの配置場所。

$ sudo find /etc/apache2/ -type f -exec grep Alias.*icons {} +
/etc/apache2/mods-available/alias.conf:	Alias /icons/ "/usr/share/apache2/icons/"

$ sudo find /etc/apache2/ -type f -exec awk '/\/icons\//{print FILENAME | "sort -uV"}' {} +
/etc/apache2/mods-available/alias.conf
/etc/apache2/mods-available/autoindex.conf

$ ls /usr/share/apache2/icons/README
/usr/share/apache2/icons/README

■aliasモジュールを無効化する。

$ sudo find /etc/apache2/ -type f -exec awk '/\/usr\/share\/apache2\/icons/{print FILENAME";"$0}' {} +
/etc/apache2/mods-available/alias.conf;	Alias /icons/ "/usr/share/apache2/icons/"
/etc/apache2/mods-available/alias.conf;	<Directory "/usr/share/apache2/icons">

$ cp /etc/apache2/mods-available/alias.conf .

$ sudo vim /etc/apache2/mods-available/alias.conf
$ sdiff -s alias.conf /etc/apache2/mods-available/alias.conf
	Alias /icons/ "/usr/share/apache2/icons/"	      |	#	Alias /icons/ "/usr/share/apache2/icons/"
							      |	#
	<Directory "/usr/share/apache2/icons">		      |	#	<Directory "/usr/share/apache2/icons">
		Options FollowSymlinks			      |	#		Options FollowSymlinks
		AllowOverride None			      |	#		AllowOverride None
		Require all granted			      |	#		Require all granted
	</Directory>					      |	#	</Directory>

$ sudo apache2ctl configtest
Syntax OK
$ sudo systemctl restart apache2

■iconsの修正後の確認

$ nikto -h 172.31.31.100 | awk '/OSVDB|Start|checked|End/'
+ Start Time:         2020-01-12 02:53:06 (GMT9)
+ 6544 items checked: 0 error(s) and 1 item(s) reported on remote host
+ End Time:           2020-01-12 02:53:23 (GMT9) (17 seconds)

■もうひとつはクリックジャッキングへの対策
　フレーム内のページ表示を同一ドメイン内のみ許可する設定がコメントアウトされているところを
　明示的に無効にする。
　※X-Frame-Optionsの値は「deny」では動かない点に注意。

$ sudo find /etc/apache2/ -type f -exec grep X-Frame-Options {} +
/etc/apache2/conf-available/security.conf:#Header set X-Frame-Options: "sameorigin"

$ sudo find /etc/apache2/ -type f -exec grep sameorigin {} +
/etc/apache2/conf-available/security.conf:#Header set X-Frame-Options: "sameorigin"

$ cp /etc/apache2/conf-available/security.conf .
$ sudo sed -i -e 's/sameorigin/DENY/' /etc/apache2/conf-available/security.conf
$ sudo sed -i -e 's/#\(Header set X-Frame-Options\)/\1/' /etc/apache2/conf-available/security.conf

$ sdiff -s security.conf /etc/apache2/conf-available/security.conf
#Header set X-Frame-Options: "sameorigin"		      |	Header set X-Frame-Options: "DENY"

$ sudo systemctl reload apache2
$ curl --anyauth -u testu:testpw -v -X GET http://172.31.31.100/ 2>&1 | grep X-Fra
< X-Frame-Options: DENY