Lynis commands work the same regardless of which operating system that you want to scan. The only difference is that if you're running it from the archive file that you downloaded from the website, you would cd into the lynis directory and precede the lynis commands with a ./. (That's because, for security reasons, your own home directory isn't in the path setting that allows the shell to automatically find executable files.)
To scan your system that has Lynis installed, follow this:
sudo lynis audit system
To scan a system on which you just downloaded the archive file, follow this:
cd lynis
sudo ./lynis audit system
Running Lynis from the shell script in your home directory presents you with this message:
donnie@ubuntu:~/lynis$ sudo ./lynis audit system
[sudo] password for donnie:
[!] Change ownership of /home/donnie/lynis/include/functions to 'root' or similar (found: donnie with UID 1000).
Command:
# chown 0:0 /home/donnie/lynis/include/functions
[X] Security check failed
Why do I see this error?
-------------------------------
This is a protection mechanism to prevent the root user from executing user created files. The files may be altered, or including malicious pieces of script.
What can I do?
---------------------
Option 1) Check if a trusted user created the files (e.g. due to using Git, Homebrew or similar).
If you trust these files, you can decide to continue this run by pressing ENTER.
Option 2) Change ownership of the related files (or full directory).
Commands (full directory):
# cd ..
# chown -R 0:0 lynis
# cd lynis
# ./lynis audit system
[ Press ENTER to continue, or CTRL+C to cancel ]
That's not hurting anything, so you can just hit Enter to continue. Or, if seeing this message really bothers you, you can change ownership of the Lynis files to the root user, as the message tells you. For now, I'll just press Enter.
Running a Lynis scan in this manner is similar to running an OpenSCAP scan against a generic security profile. The major difference is that OpenSCAP has an automatic remediation feature, but Lynis doesn't. Lynis tells you what it finds and suggests how to fix what it perceives to be a problem, but it doesn't fix anything for you.
Space doesn't permit me to show the entire scan output, but I can show you a couple of example snippets:
[+] Boot and services
------------------------------------
- Service Manager [ systemd ]
- Checking UEFI boot [ DISABLED ]
- Checking presence GRUB [ OK ]
- Checking presence GRUB2 [ FOUND ]
- Checking for password protection [ WARNING ]
- Check running services (systemctl) [ DONE ]
Result: found 21 running services
- Check enabled services at boot (systemctl) [ DONE ]
Result: found 28 enabled services
- Check startup files (permissions) [ OK ]
The warning message shows that I don't have password protection for my GRUB2 bootloader. That may or may not be a big deal because the only way someone can exploit that is to gain physical access to the machine. If it's a server that's locked away in a room that only a few trusted personnel can access, then I'm not going to worry about it, unless rules from an applicable regulatory agency dictate that I do. If it's a desktop machine that's out in an open cubicle, then I would definitely fix that. (We'll look at GRUB password protection in Chapter 10, Security Tips and Tricks for the Busy Bee.)
In the File systems section, we see some items with the SUGGESTION flag:
[+] File systems
------------------------------------
- Checking mount points
- Checking /home mount point [ SUGGESTION ]
- Checking /tmp mount point [ SUGGESTION ]
- Checking /var mount point [ SUGGESTION ]
- Query swap partitions (fstab) [ OK ]
- Testing swap partitions [ OK ]
- Testing /proc mount (hidepid) [ SUGGESTION ]
- Checking for old files in /tmp [ OK ]
- Checking /tmp sticky bit [ OK ]
- ACL support root file system [ ENABLED ]
- Mount options of / [ NON DEFAULT ]
- Checking Locate database [ FOUND ]
- Disable kernel support of some filesystems
- Discovered kernel modules: cramfs freevxfs hfs hfsplus jffs2 udf
Exactly what Lynis suggests comes near the end of the output:
. . .
. . .
* To decrease the impact of a full /home file system, place /home on a separated partition [FILE-6310]
https://cisofy.com/controls/FILE-6310/
* To decrease the impact of a full /tmp file system, place /tmp on a separated partition [FILE-6310]
https://cisofy.com/controls/FILE-6310/
* To decrease the impact of a full /var file system, place /var on a separated partition [FILE-6310]
https://cisofy.com/controls/FILE-6310/
. . .
. . .
The last thing we'll look at is the scan details section at the end of the output:
Lynis security scan details:
Hardening index : 67 [############# ]
Tests performed : 218
Plugins enabled : 0
Components:
- Firewall [V]
- Malware scanner [X]
Lynis Modules:
- Compliance Status [?]
- Security Audit [V]
- Vulnerability Scan [V]
Files:
- Test and debug information : /var/log/lynis.log
- Report data : /var/log/lynis-report.dat
For Components, there's a red X by Malware Scanner. That's because I don't have ClamAV or maldet installed on this machine, so Lynis couldn't do a virus scan.
For Lynis Modules, we see a question mark by Compliance Status. That's because this feature is reserved for the Enterprise version of Lynis, which requires a paid subscription. As we saw in the previous chapter, you have OpenSCAP profiles to make a system compliant with several different security standards, and it doesn't cost you anything. With Lynis, you have to pay for the compliance profiles, but you have a wider range from which to choose. In addition to the compliance profiles that OpenSCAP offers, Lynis also offers profiles for HIPAA and Sarbanes-Oxley compliance.
Having said that, if you work in the healthcare industry, even if you're not in the United States, the HIPAA profile can give you guidance about how to protect private data for patients.
The last thing I want to say about Lynis is about the Enterprise version. In this screenshot from their website, you can see the current pricing and the differences between the different subscription plans:
As you can see, you have choices.
https://cisofy.com/pricing/.
That pretty much wraps it up for our discussion of Lynis. Next, let's look at an external vulnerability scanner.