Linux Hack of the Week #10 - Lynis Security Audit Tool
hen you do a fresh install of Linux, you’ll find a lot software and services that can be improved to secure your system. There are helpful guides such as the DISA (Defense Information Systems Agency) Secure Technical Implementation Guidelines (STIGs), and others. However, if you want to run a tool to audit your system, it really is hard to beat Lynis. In this tip, I’ll do a fresh install of Fedora 28, and then run Lynis.
Lynis is in the Fedora repository, which makes for an easy install. Run the command: yum install lynis and Lynis is installed:
For this demo, I am using Fedora 28. With any luck, all of these steps should work on Red Hat, CentOS, and Fedora. To install the module run:
There are several options to run Lynis, including auditing docker files. For our purposes, we will just run the lynis audit system. You may wish to pipe it to more, although it does create a log in /var/log/lynis.log:
When it is finished, you will see a score. On this fresh Fedora install, it received a mediocre 70/100. That is a C-, and we are not C- people:
At this point, you should be looking through the log for ways to improve security. It is fairly lengthy so I use less, and then search for the word partial. Below are examples of a few things were performed to raise that pitiful security score:
- Set a max password age and min password age
- Tightened up the umask in /etc/profile
- FAILLOG_ENAB set in login.defs
- Added nodev noexec nosuid to /boot in fstab
- Installed RootKit Checker
- ...and few other things
After those steps were completed, I ran Lynis again and got a score of 82/100. There’s clearly much more to be done, but the machine now a solid B.
Lynis is not the only tool that can do this. That being said, as an open source free tool available in the Fedora repo, there is really no reason not to run it. Always verify the tool’s results and since you will be editing system files, make sure you have a test box to work on first. As always, if you have any questions feel free to reach out: firstname.lastname@example.org.
Facing growing threats and a rapidly expanding attack surface, understaffed and alert-fatigued organizations need more efficient ways to eliminate their exposure to vulnerabilities. Automox is a modern cyber hygiene platform that closes the aperture of attack by more than 80% with just half the effort of traditional solutions.
Cloud-native and globally available, Automox enforces OS & third-party patch management, security configurations, and custom scripting across Windows, Mac, and Linux from a single intuitive console. IT and SecOps can quickly gain control and share visibility of on-prem, remote and virtual endpoints without the need to deploy costly infrastructure.
Experience modern, cloud-native patch management today with a 15-day free trial of Automox and start recapturing more than half the time you're currently spending on managing your attack surface. Automox dramatically reduces corporate risk while raising operational efficiency to deliver best-in-class security outcomes, faster and with fewer resources.