mboelen

That is exactly why Lynis was created, to make it easier for both a sysadmin and auditor to validate things. At the same time, not every system needs the security level of a bank, so that is why it provides suggestions. Is something too strict for your needs? No problem, just disable the test. What I learned is that often auditors and system administrators like it when they an independent tool that helps to set some middle ground. The sysadmin benefits from a validation tool, while the auditor benefits from the fact that the sysadmin has the ability to validate their systems. IMHO that is better than auditors who force companies to use CIS benchmarks, simply because that is what they found and think was a good idea. Lynis does not enforce things, but allows both the sysadmin and auditor to implement things along the risk level and risk appetite. Disclaimer: I'm the author of the tool.

That is also why Lynis does not follow a specific set, but applies generic principles from multiple sources. Yes, some of the items may be default (now) in Linux distributions, but often they are still aren't. For example, most systemd services definitely can use more strict defaults. The distribution is typically not making the changes, to avoid breaking things for the end-user. This is where Lynis comes in, being independent of any big commercial organization (yes, looking at you Red Hat). While working on Lynis for 17 years now, I can say some things definitely improved in Linux distributions, but still so many things that could be much better secured out-of-the-box.

Lynis author here. While some defaults definitely became better, often due to the kernel itself being better protected, there is still a lot of room for improvement. The distribution often can't make things too strict, to prevent common issues. Keep also in mind that it is not just the OS itself, but especially the parts that get added over time (users, software, configuration file changes) that introduce the biggest flaws. The aim of Lynis is to do a regular health check, giving the sysadmin the chance to tighten things where needed or correct those things that got out of spec.

Did you try Lynis as an alternative?

It almost does all that you ask. There is a big downside of the toolkit: it is filled with abbreviations, XML files, and binaries. For that reason, I still develop an alternative project focused on Linux, macOS, and Unix-derivatives. It is named Lynis and was founded in 2007.

GitHub link: https://github.com/CISOfy/lynis

You might like Lynis (https://github.com/CISOfy/lynis). A lightweight security scanner that can be integrated as well.

Hi HN!

This is Michael, a tool author myself. I created this project to have an up-to-date database source for Linux security topics. Starting with security tools and have them categorized and ranked. The goal is to allow people find the right security tool and information for the job, quick and easy.

Sharing the project here to ask for feedback and ideas on how to further improve it. Anything that you love to see?

Disclaimer: to ensure the project stays around and continues to receive development, we put in company resources (hence the footer and training). The paid training will help will fuel the development and pay for the hosting costs.

Someone submitted my security tool Lynis during Black Hat Europe: https://github.com/CISOfy/lynis (original link https://news.ycombinator.com/item?id=12870753).

The result was a spike in GitHub stars, more users and feedback. So a great way to increase an open source project.

Most Linux distributions have to make a compromise between performance, easy of use, security, and more. In the end, you will have to do tuning, and that includes tuning for performance and security.

As one of the developers of Lynis, I can suggest picking up a auditors mindset. So just use the distribution you like the most, then become good in evaluating what can be improved. As you already discovered, automation is the key. A tool like Lynis will simplify that greatly: https://cisofy.com/lynis/

Happy hardening :)

* Project name: Lynis (https://github.com/CISOfy/lynis/), GPLv3

* Project description: security auditing tool for Linux, macOS, and UNIX-derivatives. The primary goal is to assist in security assessments and help with system hardening. Written in shell script and project is mature (almost 9 years).

* Upcoming goals: More application specific tests (like MongoDB, Redis, Tomcat, nginx), so we can provide more value as a project.

* Needed skills: application knowledge and able to write some basic shell script.

* Contributors link: https://github.com/CISOfy/lynis/blob/master/CONTRIBUTIONS.md

* Your license(s): GPLv3

At our company (CISOfy) we created a solution around our existing open source project Lynis (https://github.com/CISOfy/lynis). This way the tool in itself provides value, yet the separate Enterprise offering as well. Lynis itself is useful for a single system, yet companies might be attracted by Enterprise features (like collecting all data centrally, dashboards, reports, compliance reporting).

A similar way might work for your web application, by making two different products, each with their own audience.

My tip as founder: start testing the viability of your product/business first. Consider the reasons why people would or would not pay. Ask people in your field who might use it and if they would be willing to pay (and how much).

Thanks for sharing your intrusion story. Although it is always painful for the person to experience, it gives good insights on what happens in the wild. As the author of security tools rkhunter and Lynis, it is still a sign that basic (and advanced) system hardening remains needed for a long time.

The other comments show that there are so many things you could do. But some are more relevant than others. That is something we want to test for in Lynis with upcoming updates. One focus area will be detecting Drupal/Joomla/WordPress installations. If anyone wants to help out the open source project and make the web a safer place, this is your chance to help: https://github.com/CISOfy/lynis

Thanks again for sharing!

You are welcome (even without thanking) :)

Step 1: Try to get in contact with the person and see if he/she is willing to help you share details on entering your systems. Thank this person and see if you can provide a reward.

Step 2: Next step is setting up new systems, and start from scratch. Install the systems, start with basic system hardening and up-to-date software packages. Use https://github.com/CISOfy/lynis to validate your configuration.

Do not have any interaction or data exchange with the old (compromised) systems.

Step 3: Save all running systems to learn from the event. See if you can find the main cause why this happened.

Step 4: Learn about security, hire someone on your team with security knowledge.

Step 5: Do regular (technical) audits.

Not everyone comes with the same skill set or expertise. If you work at a big multinational, reinstalling hundreds or even thousands of systems, is no option. Lynis, free to use, simply helps you determining the sanity level in a quick way.

The main focus of Lynis is security auditing. Since some parts are so important for integrity of the systems or forensics, we do check them. Proper timing is one of them, proper DNS configuration is another one. Some things you want to put into your monitoring system as a regular test, other will be handled by the tooling itself. What we find, is that Lynis often detects incorrect configurations. That is exactly the purpose of the tool. Helping those, who didn't know, or thought things were fine.

Appreciate your stance, understand it and even agree with most of it. The tool is there to help to achieve what we both see as an ideal world: secure permissions by default, proper configurations, correct monitoring and integrity of data. Till the time we achieved that, I'm glad to see many were able to move up a few steps to this ideal world. Till then, happy hardening :)

Appreciate the honest opinion. While you have valid points, not everyone wants to install SCAP for example. Besides that, the related SCAP might even not be available for your OS version. If the OS has a great compliance checker built-in, we definitely will advise using that as well.

As the author of the tool, I can share that these tools are still very much needed. Why? Upstream vendors will never set values that are strict. Because in that case, people would have too much difficulty to get things working.

The tool exists to simplify testing many individual tests. We don't simply use existing benchmarks or guides, but also have tests of our own. For example, if you have configured at least two name servers, or that your time is properly configured, and no false-tickers are present. Things which no upstream vendor even can configure for you.

Another common use case: you are the new system administrator and have to deal with the "great" work of the previous one. The tool helps to determine the quality of the previous person, in just a matter of minutes.