111 lines
4.5 KiB
Python
111 lines
4.5 KiB
Python
"""
|
|
Management command to check security settings and vulnerabilities.
|
|
"""
|
|
from django.core.management.base import BaseCommand
|
|
from django.conf import settings
|
|
from django.contrib.auth import get_user_model
|
|
from accounts.models import FailedLoginAttempt, ActivityLog
|
|
from django.utils import timezone
|
|
from datetime import timedelta
|
|
|
|
User = get_user_model()
|
|
|
|
|
|
class Command(BaseCommand):
|
|
help = 'Check security settings and report potential vulnerabilities'
|
|
|
|
def handle(self, *args, **options):
|
|
self.stdout.write(self.style.SUCCESS('=' * 60))
|
|
self.stdout.write(self.style.SUCCESS('Security Audit Report'))
|
|
self.stdout.write(self.style.SUCCESS('=' * 60))
|
|
|
|
issues = []
|
|
warnings = []
|
|
|
|
# Check DEBUG mode
|
|
if settings.DEBUG:
|
|
warnings.append('DEBUG mode is enabled - disable in production!')
|
|
else:
|
|
self.stdout.write(self.style.SUCCESS('✓ DEBUG mode is disabled'))
|
|
|
|
# Check SECRET_KEY
|
|
if settings.SECRET_KEY == 'django-insecure-change-this-in-production':
|
|
issues.append('CRITICAL: Default SECRET_KEY is being used!')
|
|
else:
|
|
self.stdout.write(self.style.SUCCESS('✓ SECRET_KEY is set'))
|
|
|
|
# Check ALLOWED_HOSTS
|
|
if not settings.ALLOWED_HOSTS:
|
|
issues.append('ALLOWED_HOSTS is empty - set in production!')
|
|
else:
|
|
self.stdout.write(self.style.SUCCESS(f'✓ ALLOWED_HOSTS: {settings.ALLOWED_HOSTS}'))
|
|
|
|
# Check HTTPS settings
|
|
if not settings.DEBUG:
|
|
if not getattr(settings, 'SECURE_SSL_REDIRECT', False):
|
|
issues.append('SECURE_SSL_REDIRECT should be True in production')
|
|
else:
|
|
self.stdout.write(self.style.SUCCESS('✓ SSL redirect enabled'))
|
|
|
|
# Check password hashers
|
|
if 'argon2' in settings.PASSWORD_HASHERS[0].lower():
|
|
self.stdout.write(self.style.SUCCESS('✓ Using Argon2 password hasher'))
|
|
else:
|
|
warnings.append('Consider using Argon2 password hasher')
|
|
|
|
# Check session security
|
|
if settings.SESSION_COOKIE_HTTPONLY:
|
|
self.stdout.write(self.style.SUCCESS('✓ Session cookies are HTTP-only'))
|
|
else:
|
|
issues.append('SESSION_COOKIE_HTTPONLY should be True')
|
|
|
|
if settings.SESSION_COOKIE_SECURE or settings.DEBUG:
|
|
self.stdout.write(self.style.SUCCESS('✓ Session cookies are secure'))
|
|
else:
|
|
issues.append('SESSION_COOKIE_SECURE should be True in production')
|
|
|
|
# Check CSRF protection
|
|
if settings.CSRF_COOKIE_HTTPONLY:
|
|
self.stdout.write(self.style.SUCCESS('✓ CSRF cookies are HTTP-only'))
|
|
else:
|
|
issues.append('CSRF_COOKIE_HTTPONLY should be True')
|
|
|
|
# Check failed login attempts
|
|
recent_failures = FailedLoginAttempt.objects.filter(
|
|
timestamp__gte=timezone.now() - timedelta(hours=24)
|
|
).count()
|
|
|
|
if recent_failures > 0:
|
|
self.stdout.write(self.style.WARNING(f'⚠ {recent_failures} failed login attempts in last 24 hours'))
|
|
else:
|
|
self.stdout.write(self.style.SUCCESS('✓ No recent failed login attempts'))
|
|
|
|
# Check for users with weak passwords (if possible)
|
|
users_without_mfa = User.objects.filter(mfa_enabled=False).count()
|
|
total_users = User.objects.count()
|
|
if total_users > 0:
|
|
mfa_percentage = (users_without_mfa / total_users) * 100
|
|
if mfa_percentage > 50:
|
|
warnings.append(f'Only {100-mfa_percentage:.1f}% of users have MFA enabled')
|
|
else:
|
|
self.stdout.write(self.style.SUCCESS(f'✓ {100-mfa_percentage:.1f}% of users have MFA enabled'))
|
|
|
|
# Report issues
|
|
if issues:
|
|
self.stdout.write(self.style.ERROR('\n' + '=' * 60))
|
|
self.stdout.write(self.style.ERROR('CRITICAL ISSUES:'))
|
|
for issue in issues:
|
|
self.stdout.write(self.style.ERROR(f'✗ {issue}'))
|
|
|
|
if warnings:
|
|
self.stdout.write(self.style.WARNING('\n' + '=' * 60))
|
|
self.stdout.write(self.style.WARNING('WARNINGS:'))
|
|
for warning in warnings:
|
|
self.stdout.write(self.style.WARNING(f'⚠ {warning}'))
|
|
|
|
if not issues and not warnings:
|
|
self.stdout.write(self.style.SUCCESS('\n✓ No security issues found!'))
|
|
|
|
self.stdout.write(self.style.SUCCESS('\n' + '=' * 60))
|
|
|