UNPKG

netsec-analyzer

Version:

Network Security CLI: Scan ports, check TLS settings, and harden Linux systems

86 lines (59 loc) • 3.8 kB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
# netsec-analyzer `netsec-analyzer` is a powerful command-line utility designed to assist DevOps engineers, cybersecurity professionals, and system administrators in identifying network vulnerabilities and improving server hardening practices. This tool offers rapid scanning of commonly used ports, audits TLS/SSL configurations for misconfigurations or weak ciphers, and provides actionable security recommendations for strengthening Linux-based server deployments. ## Key Features - Open Port Scanner Scans a set of well-known and commonly targeted ports (e.g., 22, 80, 443, 3306, 5432) on the specified host to detect potentially exposed services. This helps you identify unnecessary or misconfigured services that might be vulnerable to attacks. - TLS/SSL Configuration Inspector Connects securely to the server via TLS and inspects the encryption suite in use. It reports protocol versions (e.g., TLS 1.2, TLS 1.3) and cipher algorithms (e.g., AES-256-GCM), enabling you to verify if strong encryption is enforced and deprecated standards are avoided. - Linux Hardening Recommendations Offers a curated list of best practices for improving the baseline security posture of your Linux server. These include enforcing strong cipher policies, disabling unused services, applying patches, and securing SSH and firewall configurations. # Installation Install `netsec-analyzer` globally using NPM: ``` npm install -g netsec-analyzer ``` This makes the `netsec-analyzer` CLI available system-wide. # Usage Once installed, simply run the tool against a target host: ``` netsec-analyzer scan <host> ``` ### This command will: - Scan a predefined list of TCP ports on example.com to detect open services. - Initiate a secure TLS handshake with port 443 to extract cipher suite and protocol version information. - Output a list of system hardening tips relevant to Linux environments. ## Scanning common ports on example.com... - Port 22 is open - Port 443 is open - Checking TLS config on example.com... - ipher: TLS_AES_256_GCM_SHA384, Version: TLSv1.3 ## Hardening Suggestions: - Disable deprecated protocols (e.g., TLS 1.0/1.1) - Enforce strong cipher suites only - Enable SSH key-based login; disable root login - Close unused ports using iptables or firewalld - Apply OS patches and audit user access regularly ## Use Cases - Audit your Linux servers before production deployment. - Periodically verify TLS security postures and cipher hygiene. - Educate junior DevOps/SRE team members on system hardening. - Integrate into CI/CD pipelines as a security gate. ## Security Considerations `netsec-analyzer` performs non-intrusive, read-only scans and does not attempt to exploit any vulnerabilities. It is intended solely for authorized internal use and ethical security auditing. ## License ``` MIT License Copyright (c) 2025 Raghava Chellu Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES O ```