Class: SSHScan::PolicyManager

Inherits:
Object
  • Object
show all
Defined in:
lib/ssh_scan/policy_manager.rb

Instance Method Summary collapse

Constructor Details

#initialize(result, policy) ⇒ PolicyManager

Returns a new instance of PolicyManager.



3
4
5
6
 
# File 'lib/ssh_scan/policy_manager.rb', line 3

def initialize(result, policy)
  @policy = policy
  @result = result
end

Instance Method Details

#compliance_results ⇒ Object 



119
120
121
122
123
124
125
 
# File 'lib/ssh_scan/policy_manager.rb', line 119

def compliance_results
  {
    :policy => @policy.name,
    :compliant => compliant?,
    :recommendations => recommendations
  }
end

#compliant? ⇒ Boolean

Returns:

  • (Boolean) 


91
92
93
94
95
96
97
98
99
100
 
# File 'lib/ssh_scan/policy_manager.rb', line 91

def compliant?
  out_of_policy_encryption.empty? &&
  out_of_policy_macs.empty? &&
  out_of_policy_kex.empty? &&
  out_of_policy_compression.empty? &&
  missing_policy_encryption.empty? &&
  missing_policy_macs.empty? &&
  missing_policy_kex.empty? &&
  missing_policy_compression?
end

#missing_policy_compression ⇒ Object 



79
80
81
82
83
84
85
86
87
88
89
 
# File 'lib/ssh_scan/policy_manager.rb', line 79

def missing_policy_compression
  target_compressions = @result[:compression_algorithms_server_to_client] | @result[:compression_algorithms_client_to_server]
  outliers = []

  @policy.compression.each do |compression|
    if target_compressions.include?(compression) == false
      outliers << compression
    end
  end
  return outliers
end

#missing_policy_encryption ⇒ Object 



17
18
19
20
21
22
23
24
25
26
 
# File 'lib/ssh_scan/policy_manager.rb', line 17

def missing_policy_encryption
  target_encryption = @result[:encryption_algorithms_client_to_server] | @result[:encryption_algorithms_server_to_client]
  outliers = []
  @policy.encryption.each do |encryption|
    if target_encryption.include?(encryption) == false
      outliers << encryption
    end
  end
  return outliers
end

#missing_policy_kex ⇒ Object 



58
59
60
61
62
63
64
65
66
67
68
 
# File 'lib/ssh_scan/policy_manager.rb', line 58

def missing_policy_kex
  target_kex = @result[:key_algorithms]
  outliers = []

  @policy.kex.each do |kex|
    if target_kex.include?(kex) == false
      outliers << kex
    end
  end
  return outliers
end

#missing_policy_macs ⇒ Object 



37
38
39
40
41
42
43
44
45
46
47
 
# File 'lib/ssh_scan/policy_manager.rb', line 37

def missing_policy_macs
  target_macs = @result[:mac_algorithms_server_to_client] | @result[:mac_algorithms_client_to_server]
  outliers = []

  @policy.macs.each do |mac|
    if target_macs.include?(mac) == false
      outliers << mac
    end
  end
  return outliers
end

#out_of_policy_compression ⇒ Object 



70
71
72
73
74
75
76
77
 
# File 'lib/ssh_scan/policy_manager.rb', line 70

def out_of_policy_compression
  target_compressions = @result[:compression_algorithms_server_to_client] | @result[:compression_algorithms_client_to_server]
  outliers = []
  target_compressions.each do |target_compression|
    outliers << target_compression unless @policy.compression.include?(target_compression)
  end
  return outliers
end

#out_of_policy_encryption ⇒ Object 



8
9
10
11
12
13
14
15
 
# File 'lib/ssh_scan/policy_manager.rb', line 8

def out_of_policy_encryption
  target_encryption = @result[:encryption_algorithms_client_to_server] | @result[:encryption_algorithms_server_to_client]
  outliers = []
  target_encryption.each do |target_enc|
    outliers << target_enc unless @policy.encryption.include?(target_enc)
  end
  return outliers
end

#out_of_policy_kex ⇒ Object 



49
50
51
52
53
54
55
56
 
# File 'lib/ssh_scan/policy_manager.rb', line 49

def out_of_policy_kex
  target_kexs = @result[:key_algorithms]
  outliers = []
  target_kexs.each do |target_kex|
    outliers << target_kex unless @policy.kex.include?(target_kex)
  end
  return outliers
end

#out_of_policy_macs ⇒ Object 



28
29
30
31
32
33
34
35
 
# File 'lib/ssh_scan/policy_manager.rb', line 28

def out_of_policy_macs
  target_macs = @result[:mac_algorithms_server_to_client] | @result[:mac_algorithms_client_to_server]
  outliers = []
  target_macs.each do |target_mac|
    outliers << target_mac unless @policy.macs.include?(target_mac)
  end
  return outliers
end

#recommendations ⇒ Object 



102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
 
# File 'lib/ssh_scan/policy_manager.rb', line 102

def recommendations
  recommendations = []

  # Add these items to be compliant
  recommendations << "Add these Key Exchange Algos: #{missing_policy_kex.join(", ")}" unless missing_policy_kex.empty?
  recommendations << "Add these MAC Algos: #{missing_policy_macs.join(", ")}" unless missing_policy_macs.empty?
  recommendations << "Add these Encryption Ciphers: #{missing_policy_encryption.join(", ")}" unless missing_policy_encryption.empty?
  recommendations << "Add these Compression Algos: #{missing_policy_compression.join(", ")}" unless missing_policy_compression.empty?

  # Remove these items to be compliant
  recommendations << "Remove these Key Exchange Algos: #{out_of_policy_kex.join(", ")}" unless out_of_policy_kex.empty?
  recommendations << "Remove these MAC Algos: #{out_of_policy_macs.join(", ")}" unless out_of_policy_macs.empty?
  recommendations << "Remove these Encryption Ciphers: #{out_of_policy_encryption.join(", ")}" unless out_of_policy_encryption.empty?
  recommendations << "Remove these Compression Algos: #{out_of_policy_compression.join(", ")}" unless out_of_policy_compression.empty?
  return recommendations
end