Lynis 2.5.0 – Security Auditing Tool for Unix/Linux Systems

We are excited to announce this major release of auditing tool Lynis. Several big changes have been made to core functions of Lynis. These changes are the next of simplification improvements we made. There is a risk of breaking your existing configuration.
Lynis is an open source security auditing tool. Used by system administrators, security professionals, and auditors, to evaluate the security defenses of their Linux and UNIX-based systems. It runs on the host itself, so it performs more extensive security scans than vulnerability scanners.

Supported operating systems

The tool has almost no dependencies, therefore it runs on almost all Unix based systems and versions, including:

AIX

FreeBSD

HP-UX

Linux

Mac OS

NetBSD

OpenBSD

Solaris

and others

It even runs on systems like the Raspberry Pi and several storage devices!

Installation optional
Lynis is light-weight and easy to use. Installation is optional: just copy it to a system, and use “./lynis audit system” to start the security scan. It is written in shell script and released as open source software (GPL).

How it works

Lynis performs hundreds of individual tests, to determine the security state of the system. The security scan itself consists of performing a set of steps, from initialization the program, up to the report.

Steps

Determine operating system

Search for available tools and utilities

Check for Lynis update

Run tests from enabled plugins

Run security tests per category

Report status of security scan

Besides the data displayed on screen, all technical details about the scan are stored in a log file. Any findings (warnings, suggestions, data collection) are stored in a report file.

Opportunistic scanning

Lynis scanning is opportunistic: it uses what it can find.

For example if it sees you are running Apache, it will perform an initial round of Apache related tests. When during the Apache scan it also discovers a SSL/TLS configuration, it will perform additional auditing steps on that. While doing that, it then will collect discovered certificates, so they can be scanned later as well.

In-depth security scans

By performing opportunistic scanning, the tool can run with almost no dependencies. The more it finds, the deeper the audit will be. In other words, Lynis will always perform scans which are customized to your system. No audit will be the same!

Use cases

Since Lynis is flexible, it is used for several different purposes. Typical use cases for Lynis include:

Security auditing

Compliance testing (e.g. PCI, HIPAA, SOx)

Vulnerability detection and scanning

System hardening

Resources used for testing

Many other tools use the same data files for performing tests. Since Lynis is not limited to a few common Linux distributions, it uses tests from standards and many custom ones not found in any other tool.

Best practices

CIS

NIST

NSA

OpenSCAP data

Vendor guides and recommendations (e.g. Debian Gentoo, Red Hat)

Lynis Plugins
lugins enable the tool to perform additional tests. They can be seen as an extension (or add-on) to Lynis, enhancing its functionality. One example is the compliance checking plugin, which performs specific tests only applicable to some standard.Changelog

Upgrade note

During the development of this release, the project got informed about a flawthat possibly could be abused by a local attacker. Even with the small risk ofsuccess, upgrading is highly recommended. See details on[CVE-2017-8108](http://ift.tt/2pvSDUS)This release is a special maintenance release with focus on cleaning up the codefor readability and future expansion.Changes:——–* Use ROOTDIR variable instead of fixed paths* Introduction of IsEmpty and HasData functions for readability of code* Renamed some variables to better indicate their purpose (counting, data type)* Removal of unused code and comments* Deleted unused tests from database file* Correct levels of identation* Support for older mac OS X versions (Lion and Mountain Lion)* Initialized variables for more binaries* Additional sysctls are testedTests:——* MALW-3280 – Extended test with Symantec components* PKGS-7332 – Detection of macOS ports tool and installed packages* TOOL-5120 – Snort detection* TOOL-5122 – Snort configuration file

Download Lynis 2.5.0 http://ift.tt/2p4Oxom http://ift.tt/2aM8QhC

Anúncios

Deixe um comentário

Preencha os seus dados abaixo ou clique em um ícone para log in:

Logotipo do WordPress.com

Você está comentando utilizando sua conta WordPress.com. Sair / Alterar )

Imagem do Twitter

Você está comentando utilizando sua conta Twitter. Sair / Alterar )

Foto do Facebook

Você está comentando utilizando sua conta Facebook. Sair / Alterar )

Foto do Google+

Você está comentando utilizando sua conta Google+. Sair / Alterar )

Conectando a %s