Lynis : セキュリティ監査2025/12/09 |
|
セキュリティ監査ツール Lynis のインストールと設定です。 |
|
| [1] | Lynis をインストールします。 |
|
dlp:~ # zypper -n install lynis
|
| [2] | Lynis の主な利用方法です。 |
|
# 初回実行時は以下のように指定してシステムをスキャン dlp:~ # lynis audit system
[ Lynis 3.1.4 ]
################################################################################
Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
welcome to redistribute it under the terms of the GNU General Public License.
See the LICENSE file for details about using this software.
2007-2024, CISOfy - https://cisofy.com/lynis/
Enterprise support available (compliance, plugins, interface and tools)
################################################################################
[+] Initializing program
------------------------------------
- Detecting OS... [ DONE ]
- Checking profiles... [ DONE ]
---------------------------------------------------
Program version: 3.1.4
Operating system: Linux
Operating system name: openSUSE
Operating system version: 16.0
Kernel version: 6.12.0
Hardware platform: x86_64
Hostname: no-hostname
---------------------------------------------------
Profiles: /etc/lynis/default.prf
Log file: /var/log/lynis.log
Report file: /var/log/lynis-report.dat
Report version: 1.0
Plugin directory: /usr/share/lynis/plugins
---------------------------------------------------
Auditor: [Not Specified]
Language: en
Test category: all
Test group: all
---------------------------------------------------
- Program update status... [ UPDATE AVAILABLE ]
===============================================================================
Lynis update available
===============================================================================
Current version is more than 4 months old
Current version : 314 Latest version : 316
Please update to the latest version.
New releases include additional features, bug fixes, tests, and baselines.
Download the latest version:
Packages (DEB/RPM) - https://packages.cisofy.com
Website (TAR) - https://cisofy.com/downloads/
GitHub (source) - https://github.com/CISOfy/lynis
===============================================================================
[+] System tools
------------------------------------
- Scanning available tools...
- Checking system binaries...
[+] Plugins (phase 1)
------------------------------------
Note: plugins have more extensive tests and may take several minutes to complete
- Plugins enabled [ NONE ]
[+] Boot and services
------------------------------------
- Service Manager [ systemd ]
- Checking UEFI boot [ DISABLED ]
- Checking presence GRUB2 [ FOUND ]
- Checking for password protection [ NONE ]
- Check running services (systemctl) [ DONE ]
Result: found 18 running services
- Check enabled services at boot (systemctl) [ DONE ]
.....
.....
================================================================================
Lynis security scan details:
Hardening index : 87 [################# ]
Tests performed : 249
Plugins enabled : 0
Components:
- Firewall [V]
- Malware scanner [X]
Scan mode:
Normal [V] Forensics [ ] Integration [ ] Pentest [ ]
Lynis modules:
- Compliance status [?]
- Security audit [V]
- Vulnerability scan [V]
Files:
- Test and debug information : /var/log/lynis.log
- Report data : /var/log/lynis-report.dat
================================================================================
Notice: Lynis update available
Current version : 314 Latest version : 316
================================================================================
Lynis 3.1.4
Auditing, system hardening, and compliance for UNIX-based systems
(Linux, macOS, BSD, and others)
2007-2024, CISOfy - https://cisofy.com/lynis/
Enterprise support available (compliance, plugins, interface and tools)
================================================================================
[TIP]: Enhance Lynis audits by adding your settings to custom.prf (see /etc/lynis/default.prf for all settings)
|
| [3] | レポートはチェック結果の最後の方に示されている通り、[/var/log/lynis-report.dat[ に保存されています。 [warning] や [suggestion] で検索すると、推奨される対応が確認できますので、可能な限り対応しておいた方がよいでしょう。 |
|
dlp:~ # grep -E "^warning|^suggestion" /var/log/lynis-report.dat suggestion[]=LYNIS|Version of Lynis outdated, consider upgrading to the latest version|-|-| suggestion[]=BOOT-5122|Set a password on GRUB boot loader to prevent altering boot configuration (e.g. boot in single user mode without password)|-|-| suggestion[]=BOOT-5264|Consider hardening system services|Run '/usr/bin/systemd-analyze security SERVICE' for each service|-| suggestion[]=KRNL-5820|If not required, consider explicit disabling of core dump in /usr/etc/security/limits.conf file|-|-| suggestion[]=AUTH-9229|Check PAM configuration, add rounds if applicable and expire passwords to encrypt with new values|-|-| suggestion[]=AUTH-9282|When possible set expire dates for all password protected accounts|-|-| suggestion[]=USB-1000|Disable drivers like USB storage when not used, to prevent unauthorized storage or data theft|-|-| suggestion[]=STRG-1846|Disable drivers like firewire storage when not used, to prevent unauthorized storage or data theft|-|-| suggestion[]=NAME-4028|Check DNS configuration for the dns domain name|-|-| suggestion[]=NAME-4404|Add the IP name and FQDN to /etc/hosts for proper name resolving|-|-| warning[]=PKGS-7330|Found one or more vulnerable packages installed|-|-| warning[]=NETW-2705|Couldn't find 2 responsive nameservers|-|-| suggestion[]=NETW-2705|Check your resolv.conf file and fill in a backup nameserver if possible|-|-| suggestion[]=NETW-3200|Determine if protocol 'dccp' is really needed on this system|-|-| suggestion[]=NETW-3200|Determine if protocol 'sctp' is really needed on this system|-|-| suggestion[]=NETW-3200|Determine if protocol 'rds' is really needed on this system|-|-| suggestion[]=NETW-3200|Determine if protocol 'tipc' is really needed on this system|-|-| suggestion[]=LOGG-2154|Enable logging to an external logging host for archiving purposes and additional protection|-|-| suggestion[]=LOGG-2190|Check what deleted files are still in use and why.|-|-| suggestion[]=BANN-7126|Add a legal banner to /etc/issue, to warn unauthorized users|-|-| suggestion[]=ACCT-9622|Enable process accounting|-|-| suggestion[]=ACCT-9626|Enable sysstat to collect accounting (no results)|-|-| suggestion[]=FINT-4350|Install a file integrity tool to monitor changes to critical and sensitive files|-|-| suggestion[]=TOOL-5002|Determine if automation tools are present for system management|-|-| suggestion[]=FILE-7524|Consider restricting file permissions|See screen output or log file|text:Use chmod to change file permissions| suggestion[]=KRNL-6000|One or more sysctl values differ from the scan profile and could be tweaked||Change sysctl value or disable test (skip-test=KRNL-6000:<sysctl-key>)| suggestion[]=HRDN-7230|Harden the system by installing at least one malware scanner, to perform periodic file system scans|-|Install a tool like rkhunter, chkrootkit, OSSEC, Wazuh| |
|
|