Friday, 17 May 2024
InfoSec Pentesting Tools Vulnerability Analysis

Lynis – Security Auditing Tool for Unix/Linux

75 0

Lynis is a security auditing tool for Unix and Linux based systems. It performs in-depth security scans, with almost no configuration, This tool commonly used by network administrator/system admin, security professionals and pentester/auditor to evaluate linux/unix system.
Requirements: Shell and basic utilities
Permissions: Root permissions or normal user
Operating System Supported:

  • AIX
  • FreeBSD
  • HP-UX
  • Linux
  • Mac OS
  • NetBSD
  • OpenBSD
  • Solaris

 
The new version of Lynis  Security Auditing Tool was already release: Lynis 2.1.0
Changelog:

Security Auditing Tool= Lynis 2.1.0 (2015-04-16) 
General:
---------
Screen output has been improved to provide additional information.
OS support:
------------
CUPS detection on Mac OS has been improved. AIX systems will now use csum
utility to create host ID. Group check have been altered on AIX, to include
the -n ALL. Core dump check on Linux is extended to check for actual values
as well.
Software:
----------
McAfee detection has been extended by detecting a running cma binary.
Improved detection of pf firewall on BSD and Mac OS. Security patch checking
with zypper extended.
Session timeout:
-----------------
Tests to determine shell time out setting have been extended to account for
AIX, HP-UX and other platforms. It will now determine also if variable is
exported as a readonly variable. Related compliance section PCI DSS 8.1.8
has been extended.
Documentation:
---------------
- New document: Getting started with Lynis
https://cisofy.com/documentation/lynis/get-started/
Plugins (Enterprise):
----------------------
- Update to file integrity plugin
Changes to PLGN-2606 (capabilities check)
- New configuration plugins:
PLGN-4802 (SSH settings)
PLGN-4804 (login.defs)

1. Installation via direct download
Create a Directory

mkdir -p /usr/local/lynis
cd /usr/local

2. Download Lynis here: https://cisofy.com/download/lynis/

 wget https://cisofy.com/files/lynis-.tar.gz
curl https://cisofy.com/files/lynis-.tar.gz -o lynis-version.tar.gz

3. Unpack the tarball

.tar.gz

4. After unpacking, it is time to run Lynis for the first time.

 ./lynis

Lynis can run without any preconfiguration. Configuration and fine-tuning is possible though and will be covered in later sections. For now we will run a basic scan:

lynis audit system

Common parameters:
Below the most commonly used parameter when running Lynis.
 

Parameter Abbreviated Description
–auditor “Given name Surname” Assign an auditor name to the audit (report)
–checkall -c Start the check
–check-update Check if Lynis is up-to-date
–cronjob Run Lynis as cronjob (includes -c -Q)
–help -h Shows valid parameters
–manpage View man page
–nocolors Do not use any colors
–pentest Perform a penetration test scan (non-privileged)
–quick -Q Don’t wait for user input, except on errors
–quiet Only show warnings (includes –quick, but doesn’t wait)
–reverse-colors Use a different color scheme for lighter backgrounds
–version -V Check program version (and quit)

Tips

  • If Lynis is not installed as package (with included man page), use –man or nroff -man ./lynis.8
  • For systems where the shell background is light, use –nocolors or –reverse-colors
  • Use –dump-options to see all available parameters of Lynis

Post Comment