Initial Commit
This commit is contained in:
Mark Gregory
@@ -0,0 +1,4 @@
|
||||
/dist/
|
||||
/.build/
|
||||
/PegasusMonitor.xcodeproj/
|
||||
.idea
|
||||
@@ -0,0 +1,194 @@
|
||||
// !$*UTF8*$!
|
||||
{
|
||||
archiveVersion = 1;
|
||||
classes = {
|
||||
};
|
||||
objectVersion = 56;
|
||||
objects = {
|
||||
|
||||
/* Begin PBXBuildFile section */
|
||||
0000000000000000000000C8 /* PHPGuardApp.swift in Sources */ = {isa = PBXBuildFile; fileRef = 000000000000000000000064 /* PHPGuardApp.swift */; };
|
||||
0000000000000000000000C9 /* Models.swift in Sources */ = {isa = PBXBuildFile; fileRef = 000000000000000000000065 /* Models.swift */; };
|
||||
0000000000000000000000CA /* SSHScanner.swift in Sources */ = {isa = PBXBuildFile; fileRef = 000000000000000000000066 /* SSHScanner.swift */; };
|
||||
0000000000000000000000CB /* AuditStore.swift in Sources */ = {isa = PBXBuildFile; fileRef = 000000000000000000000067 /* AuditStore.swift */; };
|
||||
0000000000000000000000CC /* ContentView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 000000000000000000000068 /* ContentView.swift */; };
|
||||
/* End PBXBuildFile section */
|
||||
|
||||
/* Begin PBXFileReference section */
|
||||
000000000000000000000030 /* PHPGuard.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = PHPGuard.app; sourceTree = BUILT_PRODUCTS_DIR; };
|
||||
000000000000000000000064 /* PHPGuardApp.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PHPGuardApp.swift; sourceTree = "<group>"; };
|
||||
000000000000000000000065 /* Models.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Models.swift; sourceTree = "<group>"; };
|
||||
000000000000000000000066 /* SSHScanner.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SSHScanner.swift; sourceTree = "<group>"; };
|
||||
000000000000000000000067 /* AuditStore.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AuditStore.swift; sourceTree = "<group>"; };
|
||||
000000000000000000000068 /* ContentView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ContentView.swift; sourceTree = "<group>"; };
|
||||
/* End PBXFileReference section */
|
||||
|
||||
/* Begin PBXGroup section */
|
||||
000000000000000000000010 = {
|
||||
isa = PBXGroup;
|
||||
children = (
|
||||
000000000000000000000011 /* PHPGuard */,
|
||||
000000000000000000000012 /* Products */,
|
||||
);
|
||||
sourceTree = "<group>";
|
||||
};
|
||||
000000000000000000000011 /* PHPGuard */ = {
|
||||
isa = PBXGroup;
|
||||
children = (
|
||||
000000000000000000000064 /* PHPGuardApp.swift */,
|
||||
000000000000000000000065 /* Models.swift */,
|
||||
000000000000000000000066 /* SSHScanner.swift */,
|
||||
000000000000000000000067 /* AuditStore.swift */,
|
||||
000000000000000000000068 /* ContentView.swift */,
|
||||
);
|
||||
path = PHPGuard;
|
||||
sourceTree = "<group>";
|
||||
};
|
||||
000000000000000000000012 /* Products */ = {
|
||||
isa = PBXGroup;
|
||||
children = (
|
||||
000000000000000000000030 /* PHPGuard.app */,
|
||||
);
|
||||
name = Products;
|
||||
sourceTree = "<group>";
|
||||
};
|
||||
/* End PBXGroup section */
|
||||
|
||||
/* Begin PBXNativeTarget section */
|
||||
000000000000000000000020 /* PHPGuard */ = {
|
||||
isa = PBXNativeTarget;
|
||||
buildConfigurationList = 000000000000000000000042 /* Build configuration list for PBXNativeTarget "PHPGuard" */;
|
||||
buildPhases = (
|
||||
000000000000000000000021 /* Sources */,
|
||||
);
|
||||
buildRules = (
|
||||
);
|
||||
dependencies = (
|
||||
);
|
||||
name = PHPGuard;
|
||||
productName = PHPGuard;
|
||||
productReference = 000000000000000000000030 /* PHPGuard.app */;
|
||||
productType = "com.apple.product-type.application";
|
||||
};
|
||||
/* End PBXNativeTarget section */
|
||||
|
||||
/* Begin PBXProject section */
|
||||
000000000000000000000001 /* Project object */ = {
|
||||
isa = PBXProject;
|
||||
attributes = {
|
||||
LastUpgradeCheck = 1600;
|
||||
TargetAttributes = {
|
||||
000000000000000000000020 = {
|
||||
CreatedOnToolsVersion = 16.0;
|
||||
};
|
||||
};
|
||||
};
|
||||
buildConfigurationList = 000000000000000000000041 /* Build configuration list for PBXProject "PHPGuard" */;
|
||||
compatibilityVersion = "Xcode 14.0";
|
||||
developmentRegion = en;
|
||||
hasScannedForEncodings = 0;
|
||||
knownRegions = (
|
||||
en,
|
||||
Base,
|
||||
);
|
||||
mainGroup = 000000000000000000000010;
|
||||
productRefGroup = 000000000000000000000012 /* Products */;
|
||||
projectDirPath = "";
|
||||
projectRoot = "";
|
||||
targets = (
|
||||
000000000000000000000020 /* PHPGuard */,
|
||||
);
|
||||
};
|
||||
/* End PBXProject section */
|
||||
|
||||
/* Begin PBXSourcesBuildPhase section */
|
||||
000000000000000000000021 /* Sources */ = {
|
||||
isa = PBXSourcesBuildPhase;
|
||||
buildActionMask = 2147483647;
|
||||
files = (
|
||||
0000000000000000000000C8 /* PHPGuardApp.swift in Sources */,
|
||||
0000000000000000000000C9 /* Models.swift in Sources */,
|
||||
0000000000000000000000CA /* SSHScanner.swift in Sources */,
|
||||
0000000000000000000000CB /* AuditStore.swift in Sources */,
|
||||
0000000000000000000000CC /* ContentView.swift in Sources */,
|
||||
);
|
||||
runOnlyForDeploymentPostprocessing = 0;
|
||||
};
|
||||
/* End PBXSourcesBuildPhase section */
|
||||
|
||||
/* Begin XCBuildConfiguration section */
|
||||
000000000000000000000051 /* Debug */ = {
|
||||
isa = XCBuildConfiguration;
|
||||
buildSettings = {
|
||||
CLANG_ENABLE_MODULES = YES;
|
||||
MACOSX_DEPLOYMENT_TARGET = 15.0;
|
||||
SDKROOT = macosx;
|
||||
SWIFT_VERSION = 5.0;
|
||||
};
|
||||
name = Debug;
|
||||
};
|
||||
000000000000000000000052 /* Release */ = {
|
||||
isa = XCBuildConfiguration;
|
||||
buildSettings = {
|
||||
CLANG_ENABLE_MODULES = YES;
|
||||
MACOSX_DEPLOYMENT_TARGET = 15.0;
|
||||
SDKROOT = macosx;
|
||||
SWIFT_VERSION = 5.0;
|
||||
};
|
||||
name = Release;
|
||||
};
|
||||
000000000000000000000053 /* Debug */ = {
|
||||
isa = XCBuildConfiguration;
|
||||
buildSettings = {
|
||||
CODE_SIGN_STYLE = Automatic;
|
||||
DEVELOPMENT_TEAM = 39R6U3437D;
|
||||
ENABLE_APP_SANDBOX = NO;
|
||||
GENERATE_INFOPLIST_FILE = YES;
|
||||
INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.developer-tools";
|
||||
MACOSX_DEPLOYMENT_TARGET = 15.0;
|
||||
PRODUCT_BUNDLE_IDENTIFIER = net.absdev.PHPGuard;
|
||||
PRODUCT_NAME = "$(TARGET_NAME)";
|
||||
SWIFT_VERSION = 5.0;
|
||||
};
|
||||
name = Debug;
|
||||
};
|
||||
000000000000000000000054 /* Release */ = {
|
||||
isa = XCBuildConfiguration;
|
||||
buildSettings = {
|
||||
CODE_SIGN_STYLE = Automatic;
|
||||
DEVELOPMENT_TEAM = 39R6U3437D;
|
||||
ENABLE_APP_SANDBOX = NO;
|
||||
GENERATE_INFOPLIST_FILE = YES;
|
||||
INFOPLIST_KEY_LSApplicationCategoryType = "public.app-category.developer-tools";
|
||||
MACOSX_DEPLOYMENT_TARGET = 15.0;
|
||||
PRODUCT_BUNDLE_IDENTIFIER = net.absdev.PHPGuard;
|
||||
PRODUCT_NAME = "$(TARGET_NAME)";
|
||||
SWIFT_VERSION = 5.0;
|
||||
};
|
||||
name = Release;
|
||||
};
|
||||
/* End XCBuildConfiguration section */
|
||||
|
||||
/* Begin XCConfigurationList section */
|
||||
000000000000000000000041 /* Build configuration list for PBXProject "PHPGuard" */ = {
|
||||
isa = XCConfigurationList;
|
||||
buildConfigurations = (
|
||||
000000000000000000000051 /* Debug */,
|
||||
000000000000000000000052 /* Release */,
|
||||
);
|
||||
defaultConfigurationIsVisible = 0;
|
||||
defaultConfigurationName = Debug;
|
||||
};
|
||||
000000000000000000000042 /* Build configuration list for PBXNativeTarget "PHPGuard" */ = {
|
||||
isa = XCConfigurationList;
|
||||
buildConfigurations = (
|
||||
000000000000000000000053 /* Debug */,
|
||||
000000000000000000000054 /* Release */,
|
||||
);
|
||||
defaultConfigurationIsVisible = 0;
|
||||
defaultConfigurationName = Debug;
|
||||
};
|
||||
/* End XCConfigurationList section */
|
||||
};
|
||||
rootObject = 000000000000000000000001 /* Project object */;
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<Workspace
|
||||
version = "1.0">
|
||||
<FileRef
|
||||
location = "self:">
|
||||
</FileRef>
|
||||
</Workspace>
|
||||
BIN
Binary file not shown.
+14
@@ -0,0 +1,14 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>SchemeUserState</key>
|
||||
<dict>
|
||||
<key>PHPGuard.xcscheme_^#shared#^_</key>
|
||||
<dict>
|
||||
<key>orderHint</key>
|
||||
<integer>0</integer>
|
||||
</dict>
|
||||
</dict>
|
||||
</dict>
|
||||
</plist>
|
||||
@@ -0,0 +1,59 @@
|
||||
import Foundation
|
||||
import SwiftUI
|
||||
|
||||
@MainActor final class AuditStore: ObservableObject {
|
||||
@Published var servers: [Server] = [] { didSet { saveServers() } }
|
||||
@Published var results: [AuditResult] = [] { didSet { saveResults() } }
|
||||
@Published var scanning: Set<UUID> = []
|
||||
@Published var lastError: String?
|
||||
|
||||
private var folder: URL {
|
||||
let base = FileManager.default.urls(for: .applicationSupportDirectory, in: .userDomainMask)[0]
|
||||
let path = base.appendingPathComponent("PHPGuard", isDirectory: true)
|
||||
try? FileManager.default.createDirectory(at: path, withIntermediateDirectories: true)
|
||||
return path
|
||||
}
|
||||
init() {
|
||||
servers = load("servers.json") ?? []
|
||||
results = load("results.json") ?? []
|
||||
}
|
||||
private func load<T: Decodable>(_ name: String) -> T? {
|
||||
guard let data = try? Data(contentsOf: folder.appendingPathComponent(name)) else { return nil }
|
||||
return try? JSONDecoder().decode(T.self, from: data)
|
||||
}
|
||||
private func save<T: Encodable>(_ value: T, as name: String) {
|
||||
guard let data = try? JSONEncoder().encode(value) else { return }
|
||||
try? data.write(to: folder.appendingPathComponent(name), options: .atomic)
|
||||
}
|
||||
private func saveServers() { save(servers, as: "servers.json") }
|
||||
private func saveResults() { save(Array(results.prefix(250)), as: "results.json") }
|
||||
func latest(for server: Server) -> AuditResult? { results.first { $0.serverID == server.id } }
|
||||
func scan(_ server: Server) {
|
||||
guard !scanning.contains(server.id) else { return }
|
||||
scanning.insert(server.id)
|
||||
Task {
|
||||
defer { scanning.remove(server.id) }
|
||||
do { results.insert(try await SSHScanner.scan(server), at: 0) }
|
||||
catch {
|
||||
var failed = AuditResult(serverID: server.id, serverName: server.name)
|
||||
failed.error = error.localizedDescription
|
||||
results.insert(failed, at: 0)
|
||||
lastError = "\(server.name): \(error.localizedDescription)"
|
||||
}
|
||||
}
|
||||
}
|
||||
func scanAll() { servers.forEach { scan($0) } }
|
||||
func export(_ result: AuditResult) {
|
||||
let panel = NSSavePanel()
|
||||
panel.allowedContentTypes = [.json]
|
||||
panel.nameFieldStringValue = "PHPGuard-\(result.serverName)-\(ISO8601DateFormatter().string(from: result.scannedAt)).json"
|
||||
if panel.runModal() == .OK, let url = panel.url {
|
||||
do {
|
||||
let encoder = JSONEncoder()
|
||||
encoder.outputFormatting = [.prettyPrinted, .sortedKeys]
|
||||
encoder.dateEncodingStrategy = .iso8601
|
||||
try encoder.encode(result).write(to: url)
|
||||
} catch { lastError = error.localizedDescription }
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,181 @@
|
||||
import SwiftUI
|
||||
|
||||
struct ContentView: View {
|
||||
@EnvironmentObject var store: AuditStore
|
||||
@State private var selection: UUID?
|
||||
@State private var showingEditor = false
|
||||
@State private var editing: Server?
|
||||
var body: some View {
|
||||
NavigationSplitView {
|
||||
List(selection: $selection) {
|
||||
Section("Servers") {
|
||||
ForEach(store.servers) { server in
|
||||
Label {
|
||||
HStack {
|
||||
Text(server.name)
|
||||
Spacer()
|
||||
if store.scanning.contains(server.id) { ProgressView().controlSize(.small) }
|
||||
else if store.latest(for: server)?.error != nil { Image(systemName: "exclamationmark.triangle").foregroundStyle(.orange) }
|
||||
}
|
||||
} icon: { Image(systemName: "server.rack") }
|
||||
.tag(server.id)
|
||||
.contextMenu {
|
||||
Button("Scan") { store.scan(server) }
|
||||
Button("Edit") { editing = server; showingEditor = true }
|
||||
Divider()
|
||||
Button("Remove", role: .destructive) {
|
||||
store.servers.removeAll { $0.id == server.id }
|
||||
if selection == server.id { selection = nil }
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Section("Navigation") {
|
||||
Label("Scan history", systemImage: "clock.arrow.circlepath").tag(UUID(uuidString: "00000000-0000-0000-0000-000000000001")!)
|
||||
}
|
||||
}
|
||||
.navigationTitle("PHPGuard")
|
||||
.toolbar {
|
||||
Button { editing = nil; showingEditor = true } label: { Image(systemName: "plus") }.help("Add server")
|
||||
}
|
||||
} detail: {
|
||||
if selection == UUID(uuidString: "00000000-0000-0000-0000-000000000001") {
|
||||
historyView
|
||||
} else if let server = store.servers.first(where: { $0.id == selection }) {
|
||||
serverView(server)
|
||||
} else { dashboard }
|
||||
}
|
||||
.sheet(isPresented: $showingEditor) {
|
||||
ServerEditor(existing: editing) { server in
|
||||
if let index = store.servers.firstIndex(where: { $0.id == server.id }) { store.servers[index] = server }
|
||||
else { store.servers.append(server) }
|
||||
selection = server.id
|
||||
}
|
||||
}
|
||||
.alert("Scan error", isPresented: Binding(get: { store.lastError != nil }, set: { if !$0 { store.lastError = nil } })) {
|
||||
Button("OK") { store.lastError = nil }
|
||||
} message: { Text(store.lastError ?? "") }
|
||||
}
|
||||
private var dashboard: some View {
|
||||
VStack(alignment: .leading, spacing: 24) {
|
||||
Text("Security overview").font(.largeTitle.bold())
|
||||
HStack(spacing: 16) {
|
||||
stat("Servers", "\(store.servers.count)", "server.rack")
|
||||
stat("Scanned", "\(Set(store.results.filter { $0.error == nil }.map(\.serverID)).count)", "checkmark.shield")
|
||||
stat("Findings", "\(store.results.filter { $0.error == nil }.prefix(store.servers.count).reduce(0) { $0 + $1.findings.count })", "exclamationmark.triangle")
|
||||
}
|
||||
Text("Audits are read-only. CVE matching, package backport verification, Docker inspection, and compromise detection are not implemented in this initial build.")
|
||||
.foregroundStyle(.secondary)
|
||||
Button("Scan all servers") { store.scanAll() }.buttonStyle(.borderedProminent).disabled(store.servers.isEmpty)
|
||||
Spacer()
|
||||
}.padding(30).frame(maxWidth: .infinity, maxHeight: .infinity, alignment: .topLeading)
|
||||
}
|
||||
private func stat(_ title: String, _ value: String, _ icon: String) -> some View {
|
||||
VStack(alignment: .leading, spacing: 12) {
|
||||
Label(title, systemImage: icon).foregroundStyle(.secondary)
|
||||
Text(value).font(.system(size: 36, weight: .bold))
|
||||
}.padding(20).frame(maxWidth: .infinity, alignment: .leading)
|
||||
.background(.quaternary.opacity(0.35), in: RoundedRectangle(cornerRadius: 14))
|
||||
}
|
||||
private func serverView(_ server: Server) -> some View {
|
||||
ScrollView {
|
||||
VStack(alignment: .leading, spacing: 20) {
|
||||
HStack {
|
||||
VStack(alignment: .leading) {
|
||||
Text(server.name).font(.largeTitle.bold())
|
||||
Text("\(server.user)@\(server.host):\(server.port)").foregroundStyle(.secondary)
|
||||
}
|
||||
Spacer()
|
||||
Button("Edit") { editing = server; showingEditor = true }
|
||||
Button("Scan now") { store.scan(server) }.buttonStyle(.borderedProminent)
|
||||
.disabled(store.scanning.contains(server.id))
|
||||
}
|
||||
if let result = store.latest(for: server) {
|
||||
if let error = result.error {
|
||||
Label(error, systemImage: "xmark.circle.fill").foregroundStyle(.red)
|
||||
} else {
|
||||
Text("Last scan: \(result.scannedAt.formatted())").foregroundStyle(.secondary)
|
||||
Text("OS: \(result.os) • Host: \(result.hostname)")
|
||||
dataSection("PHP installations", result.phpVersions)
|
||||
dataSection("PHP-FPM services", result.fpmServices)
|
||||
dataSection("Nginx FastCGI routes", result.nginxUpstreams)
|
||||
dataSection("Installed packages", result.packageVersions)
|
||||
Text("Findings").font(.title2.bold())
|
||||
ForEach(result.findings) { finding in
|
||||
VStack(alignment: .leading, spacing: 4) {
|
||||
Text("\(finding.severity): \(finding.title)").font(.headline)
|
||||
Text(finding.detail).foregroundStyle(.secondary)
|
||||
}.padding(12).frame(maxWidth: .infinity, alignment: .leading)
|
||||
.background(.quaternary.opacity(0.3), in: RoundedRectangle(cornerRadius: 10))
|
||||
}
|
||||
Button("Export JSON report") { store.export(result) }
|
||||
}
|
||||
} else { ContentUnavailableView("Not scanned", systemImage: "shield.lefthalf.filled", description: Text("Run a read-only SSH inventory scan.")) }
|
||||
}.padding(28).frame(maxWidth: .infinity, alignment: .leading)
|
||||
}
|
||||
}
|
||||
private func dataSection(_ title: String, _ values: [String]) -> some View {
|
||||
VStack(alignment: .leading, spacing: 6) {
|
||||
Text(title).font(.title2.bold())
|
||||
if values.isEmpty { Text("None detected").foregroundStyle(.secondary) }
|
||||
else { ForEach(values, id: \.self) { Text($0).font(.system(.body, design: .monospaced)).textSelection(.enabled) } }
|
||||
}
|
||||
}
|
||||
private var historyView: some View {
|
||||
List(store.results) { result in
|
||||
HStack {
|
||||
VStack(alignment: .leading) {
|
||||
Text(result.serverName).font(.headline)
|
||||
Text(result.scannedAt.formatted()).foregroundStyle(.secondary)
|
||||
if let error = result.error { Text(error).foregroundStyle(.red).lineLimit(2) }
|
||||
}
|
||||
Spacer()
|
||||
Button("Export") { store.export(result) }.disabled(result.error != nil)
|
||||
}.padding(.vertical, 4)
|
||||
}.navigationTitle("Scan history")
|
||||
}
|
||||
}
|
||||
|
||||
struct ServerEditor: View {
|
||||
@Environment(\.dismiss) private var dismiss
|
||||
let existing: Server?
|
||||
let onSave: (Server) -> Void
|
||||
@State private var server: Server
|
||||
init(existing: Server?, onSave: @escaping (Server) -> Void) {
|
||||
self.existing = existing
|
||||
self.onSave = onSave
|
||||
_server = State(initialValue: existing ?? Server(name: "", host: ""))
|
||||
}
|
||||
var body: some View {
|
||||
VStack(alignment: .leading, spacing: 18) {
|
||||
Text(existing == nil ? "Add server" : "Edit server").font(.title.bold())
|
||||
Form {
|
||||
TextField("Display name", text: $server.name)
|
||||
TextField("Hostname / IP", text: $server.host)
|
||||
TextField("SSH username", text: $server.user)
|
||||
TextField("SSH port", value: $server.port, format: .number)
|
||||
TextField("SSH private key path (optional)", text: $server.identityFile)
|
||||
}.formStyle(.grouped)
|
||||
Text("SSH uses your existing keys and known_hosts. Password prompts are disabled; first connect using Terminal to trust the host key.")
|
||||
.font(.caption).foregroundStyle(.secondary)
|
||||
HStack {
|
||||
Spacer()
|
||||
Button("Cancel") { dismiss() }
|
||||
Button("Save") { onSave(server); dismiss() }.buttonStyle(.borderedProminent)
|
||||
.disabled(server.name.isEmpty || server.host.isEmpty || server.user.isEmpty)
|
||||
}
|
||||
}.padding(24).frame(width: 520)
|
||||
}
|
||||
}
|
||||
|
||||
struct SettingsView: View {
|
||||
var body: some View {
|
||||
Form {
|
||||
LabeledContent("SSH", value: "System OpenSSH, key-only")
|
||||
LabeledContent("Host verification", value: "Strict")
|
||||
LabeledContent("Scan mode", value: "Read-only")
|
||||
Text("Server inventory and reports are stored locally in Application Support/PHPGuard.")
|
||||
.foregroundStyle(.secondary)
|
||||
}.padding(24).frame(width: 500, height: 220)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
import Foundation
|
||||
|
||||
struct Server: Codable, Identifiable, Hashable {
|
||||
var id = UUID()
|
||||
var name: String
|
||||
var host: String
|
||||
var user: String = "mag"
|
||||
var port: Int = 22
|
||||
var identityFile: String = ""
|
||||
}
|
||||
|
||||
struct Finding: Codable, Identifiable {
|
||||
var id = UUID()
|
||||
var severity: String
|
||||
var title: String
|
||||
var detail: String
|
||||
}
|
||||
|
||||
struct AuditResult: Codable, Identifiable {
|
||||
var id = UUID()
|
||||
var serverID: UUID
|
||||
var serverName: String
|
||||
var scannedAt = Date()
|
||||
var hostname = ""
|
||||
var os = ""
|
||||
var phpVersions: [String] = []
|
||||
var fpmServices: [String] = []
|
||||
var nginxUpstreams: [String] = []
|
||||
var packageVersions: [String] = []
|
||||
var findings: [Finding] = []
|
||||
var rawOutput = ""
|
||||
var error: String? = nil
|
||||
}
|
||||
@@ -0,0 +1,11 @@
|
||||
import SwiftUI
|
||||
|
||||
@main
|
||||
struct PHPGuardApp: App {
|
||||
@StateObject private var store = AuditStore()
|
||||
var body: some Scene {
|
||||
WindowGroup("PHPGuard") { ContentView().environmentObject(store) }
|
||||
.defaultSize(width: 1120, height: 720)
|
||||
Settings { SettingsView().environmentObject(store) }
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,97 @@
|
||||
import Foundation
|
||||
|
||||
enum ScanError: LocalizedError {
|
||||
case invalidServer, commandFailed(String)
|
||||
var errorDescription: String? {
|
||||
switch self {
|
||||
case .invalidServer: return "Invalid SSH host, username, port or identity file."
|
||||
case .commandFailed(let message): return message
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
enum SSHScanner {
|
||||
// Commands are fixed and read-only. User-supplied strings are passed as SSH arguments, never shell source.
|
||||
static let script = #"""
|
||||
printf '===HOST===\n'; hostname
|
||||
printf '===OS===\n'; ( . /etc/os-release && printf '%s\n' "$PRETTY_NAME" ) 2>/dev/null || uname -s
|
||||
printf '===PHP===\n'
|
||||
for p in /usr/bin/php /usr/bin/php[0-9]* /usr/local/bin/php; do
|
||||
if [ -x "$p" ] && [ ! -d "$p" ]; then "$p" -r 'echo PHP_BINARY," ",PHP_VERSION,PHP_EOL;' 2>/dev/null; fi
|
||||
done | sort -u
|
||||
printf '===FPM===\n'; systemctl list-units --all --type=service --no-legend --no-pager 2>/dev/null | grep -E 'php[0-9.]+-fpm' || true
|
||||
printf '===NGINX===\n'; grep -Rh 'fastcgi_pass' /etc/nginx/sites-enabled/ 2>/dev/null | sort -u || true
|
||||
printf '===PACKAGES===\n'; dpkg-query -W -f='${Package} ${Version}\n' 'php*-fpm' 'php*-cli' 2>/dev/null || true
|
||||
printf '===END===\n'
|
||||
"""#
|
||||
|
||||
static func scan(_ server: Server) async throws -> AuditResult {
|
||||
try await Task.detached(priority: .userInitiated) { try run(server) }.value
|
||||
}
|
||||
|
||||
private static func run(_ server: Server) throws -> AuditResult {
|
||||
let validName = /^[a-zA-Z0-9_][a-zA-Z0-9_.-]*$/
|
||||
let validHost = /^[a-zA-Z0-9][a-zA-Z0-9.:-]*$/
|
||||
guard server.user.wholeMatch(of: validName) != nil,
|
||||
server.host.wholeMatch(of: validHost) != nil,
|
||||
(1...65535).contains(server.port),
|
||||
!server.identityFile.contains("\n") else { throw ScanError.invalidServer }
|
||||
let process = Process()
|
||||
process.executableURL = URL(fileURLWithPath: "/usr/bin/ssh")
|
||||
var args = ["-T", "-o", "BatchMode=yes", "-o", "ConnectTimeout=8", "-o", "StrictHostKeyChecking=yes", "-p", String(server.port)]
|
||||
if !server.identityFile.isEmpty {
|
||||
args += ["-i", (server.identityFile as NSString).expandingTildeInPath]
|
||||
}
|
||||
args += ["--", "\(server.user)@\(server.host)", "sh -s"]
|
||||
process.arguments = args
|
||||
let input = Pipe(), output = Pipe(), errors = Pipe()
|
||||
process.standardInput = input
|
||||
process.standardOutput = output
|
||||
process.standardError = errors
|
||||
try process.run()
|
||||
input.fileHandleForWriting.write(Data(script.utf8))
|
||||
try? input.fileHandleForWriting.close()
|
||||
// Both pipes are drained concurrently to avoid deadlocks on large output.
|
||||
let group = DispatchGroup()
|
||||
var stdout = Data(), stderr = Data()
|
||||
group.enter()
|
||||
DispatchQueue.global().async { stdout = output.fileHandleForReading.readDataToEndOfFile(); group.leave() }
|
||||
group.enter()
|
||||
DispatchQueue.global().async { stderr = errors.fileHandleForReading.readDataToEndOfFile(); group.leave() }
|
||||
process.waitUntilExit()
|
||||
group.wait()
|
||||
guard process.terminationStatus == 0 else {
|
||||
throw ScanError.commandFailed(String(data: stderr, encoding: .utf8) ?? "SSH failed (\(process.terminationStatus))")
|
||||
}
|
||||
return parse(String(decoding: stdout, as: UTF8.self), server: server)
|
||||
}
|
||||
|
||||
static func parse(_ raw: String, server: Server) -> AuditResult {
|
||||
var result = AuditResult(serverID: server.id, serverName: server.name)
|
||||
result.rawOutput = raw
|
||||
var section = ""
|
||||
var fields: [String: [String]] = [:]
|
||||
for line in raw.components(separatedBy: .newlines) {
|
||||
if line.hasPrefix("===") && line.hasSuffix("===") { section = String(line.dropFirst(3).dropLast(3)); continue }
|
||||
if !line.trimmingCharacters(in: .whitespaces).isEmpty { fields[section, default: []].append(line) }
|
||||
}
|
||||
result.hostname = fields["HOST"]?.first ?? "Unknown"
|
||||
result.os = fields["OS"]?.first ?? "Unknown"
|
||||
result.phpVersions = fields["PHP"] ?? []
|
||||
result.fpmServices = fields["FPM"] ?? []
|
||||
result.nginxUpstreams = fields["NGINX"] ?? []
|
||||
result.packageVersions = fields["PACKAGES"] ?? []
|
||||
if result.phpVersions.isEmpty {
|
||||
result.findings.append(Finding(severity: "Info", title: "No PHP CLI detected", detail: "No PHP binary found in standard paths; this does not exclude bundled runtimes or containers."))
|
||||
}
|
||||
for line in result.phpVersions {
|
||||
let parts = line.split(separator: " ")
|
||||
guard let version = parts.last, let major = Int(version.split(separator: ".").first ?? "") else { continue }
|
||||
if major < 8 {
|
||||
result.findings.append(Finding(severity: "Warning", title: "Legacy PHP detected", detail: "\(line). Verify vendor support and distribution security maintenance."))
|
||||
}
|
||||
}
|
||||
result.findings.append(Finding(severity: "Info", title: "CVE assessment not performed", detail: "Installed package versions must be checked against current vendor advisories and backported fixes. A version string alone cannot establish vulnerability."))
|
||||
return result
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
# PHPGuard — macOS PHP Inventory Auditor (Phase 1)
|
||||
|
||||
Native SwiftUI macOS application for **read-only** PHP inventory scans over SSH.
|
||||
|
||||
## Open and run
|
||||
|
||||
1. Unzip and open `PHPGuard.xcodeproj` in Xcode 16 or later.
|
||||
2. Select the PHPGuard scheme and **My Mac** destination.
|
||||
3. Set your signing team in Signing & Capabilities if required.
|
||||
4. Build and Run (⌘R).
|
||||
5. Add a server (SSH hostname, username, port and optional identity file).
|
||||
6. Ensure you can first connect from Terminal using SSH and that its host key is in `~/.ssh/known_hosts`.
|
||||
7. Click **Scan now**. Scan history and JSON export are available.
|
||||
|
||||
The app uses `/usr/bin/ssh` with `BatchMode=yes` and strict host key checking. It does not store passwords or change remote systems. SSH keys must already be configured. For the initial release, the app runs unsandboxed so it can invoke the system SSH executable and access existing SSH configuration.
|
||||
|
||||
## Implemented
|
||||
|
||||
- Native macOS SwiftUI navigation and dashboard
|
||||
- Add/edit/remove SSH servers; optional private-key path
|
||||
- Concurrent read-only scans of PHP CLI binaries, PHP-FPM services, Nginx FastCGI routes, Debian/Ubuntu PHP package inventory
|
||||
- Local JSON persistence and history
|
||||
- JSON report export
|
||||
- SSH error reporting and strict host key checking
|
||||
|
||||
## Not yet implemented
|
||||
|
||||
- Live CVE feeds, Ubuntu package backport verification or definitive vulnerability status
|
||||
- Docker and Apache scans
|
||||
- Intrusion detection and web-log investigation
|
||||
- PDF reports, scheduled scans, notifications, automated patching
|
||||
- Integration with PegasusMonitor
|
||||
|
||||
**Important:** This version is an inventory tool, not a complete vulnerability or compromise scanner. It intentionally does not label a server secure solely from a version string.
|
||||
|
||||
## Privacy
|
||||
|
||||
Server definitions and scan results are stored in `~/Library/Application Support/PHPGuard/`. Scan reports may contain internal hostnames and package inventory. Do not publish them publicly.
|
||||
Reference in New Issue
Block a user