It checks most (not all) of the items below and generates PASS, FAIL and INFO tags for various properties. The script makes NO CHANGES to the target system.
You can run this script LOCALLY on the machine in question, after signing on as the user that is used by Open-AudIT to perform the audit. If you are experiencing difficulty auditing remote Windows PCs, we have created a script called test_windows_client.vbs. It tends to either "just work" or some mystery item on the target requires changing. Windows has a notorious reputation where remote WMI is concerned. SNMP is also supported (as detailed below). On Windows, Open-AudIT uses WMI via VBscript as it's primary method of auditing. If this is your situation you can edit the /usr/local/open-audit/other/ discover_subnet.sh file and set consider_161_enough to “y" Windows If OA is only seeing UDP port 161 open OA will consider it a false positive and move on. OA needs to see more than just UDP port 161 open on a device to consider it a legitimate device. Why don't we simply scan every port TCP and UDP? On local networks this is usually OK to do, but on remote subnets this can take (literally) hours PER IP ADDRESS. Why do we not consider a UDP port 161 response enough? Because it is very common for firewalls separating network segments to respond with UDP 161 for a target IP regardless of there being an actual device present at that IP address. A target that responds to UDP 161 (SNMP) only and NO other ports (TCP or UDP 62078 / 161) is not considered to be responding. For Open-AudIT to consider a target IP to have a device responding, any of the Nmap Top 1000 TCP Ports must be responding or the UDP 62078.
Open-AudIT scans the Nmap top 1000 TCP ports, as well as UDP 62078 (Apple IOS) and UDP 161 (SNMP). Open-AudIT runs an Nmap discovery on each target IP address. Below are the requirements for the audit to work and some hints for items to configure when things are not working as planned. The audit function of Open-AudIT is designed to work "out of the box" as much as possible with the default settings of target devices.
0 kommentar(er)
