nmap-audit - Network auditing with nmap
nmap-audit --config filename [ --ips ip1,..,ipn ] [ --email-to addr ] [ --email-from addr ] [ --email-subject subject ] [ --nmap cmd ] [ --detail { none | low | med | high } ] [ --max-threads n ] [ --no-human ] [ --no-csv ] [ --scan-only | --process-only ] [ --dir-name dir[,dir2..] [ --no-csv-headings ] [ --version ] [ --help ] [ --quiet ]
nmap-audit is a PERL script which makes use of the nmap port scanning software to automate port scan audits. nmap produces a human readable report for each host that contains, among other things, the hostname being scanned and any open ports. Unfortunately, even for a moderately sized network, these reports contain far too much information to process, especially if the network is scanned on a regular basis.
To help mitigate this information overload, nmap-audit was designed to eliminate repeated human processing of any redundant information from one scan to the next. For example, all windows machines may have UDP port 137 open, and as such, the fact that this port is open should not be noted in the otherwise cluttered reports.
nmap-audit was designed to produce large, detailed reports on the first run, thereby forcing a complete audit of the open ports on the network. Following this, only ports which have not been ignored, most likely any newly opened ports, are returned.
Though the complete information from each run of nmap-audit isn't delivered in a typical report, this script provides the necessary functionality to extract this data from any point in time on record, a feature which may prove especially helpful for after-the-fact forensics and other troubleshooting.
nmap-audit and nmap are both highly configurable, and options may be specified in either a configuration file, on the command line, or as a combination of the two. Unfortunately, this configurability creates a relatively steep learning curve for a beginner. To help mitigate this, a well commented example configuration is included in the distribution and should be used as a reference in conjunction with the nmap man page
Below is a straightforward example configuration file for the nmap-audit script. Comments follow the same rules as in PERL; any text to the right of ``#'' is ignored.
The file consists of two primary types of configuration options: operational configuration and ignore configuration. Operational configuration, shown in in the first section, consists of directives which tell the nmap-audit program how to run and what limits should be placed on its execution.
Wildcards, denoted by a single asterisk, may be used in any part of the definition. Also, note that besides group restriction by operating system, groups may be separated by hostname or IP address.
############################################################## ######### nmap-audit config options ######
## IPS scanning definitions ## ips = 192.168.1.0/24
## report mailing info ## email-to = root@example.com email-subject = Host Vulnerability Scanning Results email-from = nmap-audit@example.com
## The maximum number of nmap threads to be run ## simultaneously. Please begin this with a small ## number and slowly increase it to keep your machine ## from getting overwhelmed from too many processes max-threads = 20
## The level of detail to report. Either low, medium, or high ## detail = low
## nmap command to be run. Note that appended to this ## is the option to direct the output to a human readable ## file. Therefore, using the '-oN filename' option will ## not work in conjunction with the nmap-audit script ## #nmap = nmap -sS -sU -v -O -T Polite -p 1-1024 # TCP and UDP scan nmap = nmap -sS -v -O -T Polite -p 1-1024 # TCP scan
## base directory name where all scanning data will be ## stored. To this name the date of the scan and a ## sequence number will be appended to prevent multiple ## scans on the same day from overwriting data. Use the ## complete path if executing via cron. dir-name = example
##############################################################
############################################################## ######### ignore options ######
## Group of all microsoft operating systems
group windows os = Windows
## RPC/DNS Administration ##
ignore = open 135 loc-srv tcp
ignore = open 135 loc-srv udp
## systems management over UDP ##
ignore = open 137 netbios-ssn udp # wins
ignore = open 138 netbios-ssn udp # netbios datagrams
ignore = open 139 netbios-ssn tcp # netbios datagrams
## Direct hosting of SMB over TCP/IP ##
ignore = open 445 microsoft-ds udp
ignore = open 445 microsoft-ds tcp
end group windows
## Group that contains all unix hosts
group unix os = Linux Kernel 2.4.0 - 2.5.20 os = Solaris 2.6 - 2.7 with tcp_strong_iss=2 os = Solaris 2.6 - 7 (SPARC) os = Solaris 8 early access beta through actual release os = Solaris 9 Beta through Release on SPARC
ignore = open 22 ssh tcp # SSH
end group unix
## group that matches all hosts place most general rules ## here
group all hostname = *
ignore = filtered * * *
ignore = closed * * *
end group all
Data from each scan completed by nmap is stored in the directory named in the dir-name variable.
nmap(1)
nmap must be run as root when performing some of its scans. Therefore, under many circumstances it may be necessary to run nmap-audit as root when performing a scan (though this should not be necessary when merely processing historical data).
Regular expressions work mostly like in standard PERL, but for a slight restriction on the use of ``*''. Since it has been somewhat overloaded, what would normally be written as ``.*'' in PERL should be written as ``*'' in nmap-audit configuration files. Unfortunately, there is no way to do something like ``\d*'' here, though ``\d+'' is valid.
Keith Resar <nmap-audit
| The latest release is available at: | |
| http://heavyk.org/nmap-audit/ |