https://wikiold.home.tartarefr.eu/index.php?action=history&feed=atom&title=Security%2FAudit%2FLynis%2FBrief 2026-07-08T06:34:42Z Historique des versions pour cette page sur le wiki MediaWiki 1.43.8 https://wikiold.home.tartarefr.eu/index.php?title=Security/Audit/Lynis/Brief&diff=2625&oldid=prev 2014-03-21T07:54:58Z

<p>Page créée avec « == introduction == Lynis est un petit soft qui s’utilise en ligne de commande. Lynis n’est pas à proprement parler un outil de pentest (ce à quoi l’on pourrait s... »</p> <p><b>Nouvelle page</b></p><div>== introduction ==<br /> <br /> Lynis est un petit soft qui s’utilise en ligne de commande. Lynis n’est pas à proprement parler un outil de pentest (ce à quoi l’on pourrait s’attendre quand on parle d’audit).<br /> <br /> Il a pour but de vérifier via un scan, quasiment tous les paramètres du système avant de faire une synthèse complète et d&#039;afficher des suggestions qui vont permettre d’agir sur les points faibles de celui-ci.<br /> <br /> Il va analyser tout un tas de paramètres concernant entre-autres :<br /> <br /> * Les chargeurs et services de démarrage<br /> * La configuration du noyau, les modules chargés, ceux en cours d’exécution<br /> * La mémoire et les processus<br /> * Les utilisateurs et les groupes<br /> * Les points de montage et le système de fichiers racine<br /> * Les services NFS et BIND<br /> * Les mises à jour et les référentiels de vos logiciels<br /> * Les règles Iptables et la configurations SELinux<br /> * Les serveurs Web Apache et nginx<br /> * La configurations SSH<br /> * Le mot de passe root, MySQL et les services LDAP<br /> * Les options PHP<br /> * Les options crontab / cron et ATD<br /> * Le démon NTP<br /> * L’expiration du certificat SSL<br /> * La présence de malwares<br /> * Les répertoires personnels<br /> <br /> == Exemple d&#039;exécution ==<br /> <br /> &lt;pre&gt;<br /> lynis -Q -c<br /> <br /> [ Lynis 1.4.6 ]<br /> <br /> ################################################################################<br /> Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are<br /> welcome to redistribute it under the terms of the GNU General Public License.<br /> See the LICENSE file for details about using this software.<br /> <br /> Copyright 2007-2014 - Michael Boelen, http://cisofy.com<br /> Enterprise support and plugins available via CISOfy - http://cisofy.com<br /> ################################################################################<br /> <br /> [+] Initializing program<br /> ------------------------------------<br /> - Detecting OS... [ DONE ]<br /> - Clearing log file (/var/log/lynis.log)... [ DONE ]<br /> <br /> ---------------------------------------------------<br /> Program version: 1.4.6<br /> Operating system: Linux<br /> Operating system name: CentOS<br /> Operating system version: CentOS release 6.5 (Final)<br /> Kernel version: 2.6.32-431.el6.x86_64<br /> Hardware platform: x86_64<br /> Hostname: scapmaster<br /> Auditor: [Unknown]<br /> Profile: /etc/lynis/default.prf<br /> Log file: /var/log/lynis.log<br /> Report file: /var/log/lynis-report.dat<br /> Report version: 1.0<br /> Plugin directory: /usr/share/lynis/plugins<br /> ---------------------------------------------------<br /> - Checking profile file (/etc/lynis/default.prf)...<br /> - Program update status... [ NO UPDATE ]<br /> <br /> [+] System Tools<br /> ------------------------------------<br /> - Scanning available tools...<br /> - Checking system binaries...<br /> - Checking /bin... [ FOUND ]<br /> - Checking /sbin... [ FOUND ]<br /> - Checking /usr/bin... [ FOUND ]<br /> - Checking /usr/sbin... [ FOUND ]<br /> - Checking /usr/local/bin... [ FOUND ]<br /> - Checking /usr/local/sbin... [ FOUND ]<br /> - Checking /usr/local/libexec... [ FOUND ]<br /> - Checking /usr/libexec... [ FOUND ]<br /> - Checking /usr/sfw/bin... [ NOT FOUND ]<br /> - Checking /usr/sfw/sbin... [ NOT FOUND ]<br /> - Checking /usr/sfw/libexec... [ NOT FOUND ]<br /> - Checking /opt/sfw/bin... [ NOT FOUND ]<br /> - Checking /opt/sfw/sbin... [ NOT FOUND ]<br /> - Checking /opt/sfw/libexec... [ NOT FOUND ]<br /> - Checking /usr/xpg4/bin... [ NOT FOUND ]<br /> - Checking /usr/css/bin... [ NOT FOUND ]<br /> - Checking /usr/ucb... [ NOT FOUND ]<br /> - Checking /usr/X11R6/bin... [ NOT FOUND ]<br /> <br /> [+] Plugins (phase 1)<br /> ------------------------------------<br /> - Plugins enabled [ NONE ]<br /> <br /> [+] Boot and services<br /> ------------------------------------<br /> - Checking boot loaders<br /> - Checking presence GRUB... [ OK ]<br /> - Checking for password protection... [ OK ]<br /> - Checking presence LILO... [ NOT FOUND ]<br /> - Checking boot loader SILO [ NOT FOUND ]<br /> - Checking boot loader YABOOT [ NOT FOUND ]<br /> - Check services at startup (chkconfig)... [ DONE ]<br /> Result: found 19 services<br /> - Check startup files (permissions)... [ OK ]<br /> <br /> [+] Kernel<br /> ------------------------------------<br /> - Checking default run level... [ 3 ]<br /> - Checking CPU support (NX/PAE)<br /> CPU support: PAE and/or NoeXecute supported [ FOUND ]<br /> - Checking kernel version and release [ DONE ]<br /> - Checking kernel type [ DONE ]<br /> - Checking loaded kernel modules [ DONE ]<br /> Found 35 active modules<br /> - Checking Linux kernel configuration file... [ FOUND ]<br /> - Checking core dumps configuration... [ ENABLED ]<br /> - Checking setuid core dumps configuration... [ DEFAULT ]<br /> <br /> [+] Memory and processes<br /> ------------------------------------<br /> - Checking /proc/meminfo... [ FOUND ]<br /> - Searching for dead/zombie processes... [ OK ]<br /> - Searching for IO waiting processes... [ OK ]<br /> <br /> [+] Users, Groups and Authentication<br /> ------------------------------------<br /> - Search administrator accounts... [ OK ]<br /> - Checking consistency of group files (grpck)... [ OK ]<br /> - Checking non unique group ID&#039;s... [ OK ]<br /> - Checking non unique group names... [ OK ]<br /> - Checking password file consistency... [ OK ]<br /> - Query system users (non daemons)... [ DONE ]<br /> - Checking NIS+ authentication support [ NOT ENABLED ]<br /> - Checking NIS authentication support [ NOT ENABLED ]<br /> - Checking sudoers file [ FOUND ]<br /> - Check sudoers file permissions [ OK ]<br /> - Checking PAM password strength tools [ OK ]<br /> - Checking PAM configuration file (pam.conf) [ NOT FOUND ]<br /> - Checking PAM configuration files (pam.d) [ FOUND ]<br /> - Checking PAM modules [ FOUND ]<br /> - Checking user password aging [ OK ]<br /> - Checking Linux single user mode authentication [ OK ]<br /> - Determining default umask<br /> - Checking umask (/etc/profile) [ UNKNOWN ]<br /> - Checking umask (/etc/login.defs) [ OK ]<br /> - Checking umask (/etc/init.d/functions) [ OK ]<br /> - Checking LDAP authentication support [ NOT ENABLED ]<br /> <br /> [+] Shells<br /> ------------------------------------<br /> - Checking shells from /etc/shells...<br /> Result: found 6 shells (valid shells: 6).<br /> <br /> [+] File systems<br /> ------------------------------------<br /> - Checking mount points<br /> - Checking /home mount point... [ OK ]<br /> - Checking /tmp mount point... [ OK ]<br /> - Checking LVM volume groups... [ FOUND ]<br /> - Checking LVM volumes... [ FOUND ]<br /> - Checking for old files in /tmp... [ OK ]<br /> - Checking /tmp sticky bit... [ OK ]<br /> - ACL support root file system... [ ENABLED ]<br /> - Checking Locate database... [ FOUND ]<br /> <br /> [+] Storage<br /> ------------------------------------<br /> - Checking usb-storage driver (modprobe config)... [ NOT DISABLED ]<br /> - Checking firewire ohci driver (modprobe config)... [ NOT DISABLED ]<br /> <br /> [+] NFS<br /> ------------------------------------<br /> - Check running NFS daemon... [ NOT FOUND ]<br /> <br /> [+] Software: name services<br /> ------------------------------------<br /> - Checking default DNS search domain... [ NONE ]<br /> - Checking /etc/resolv.conf options... [ NONE ]<br /> - Searching DNS domain name... [ FOUND ]<br /> Domain name: didier.b2pweb.com<br /> - Checking nscd status... [ NOT FOUND ]<br /> - Checking BIND status... [ NOT FOUND ]<br /> - Checking PowerDNS status... [ NOT FOUND ]<br /> - Checking ypbind status... [ NOT FOUND ]<br /> - Checking /etc/hosts<br /> - Checking /etc/hosts (duplicates) [ OK ]<br /> - Checking /etc/hosts (hostname) [ OK ]<br /> - Checking /etc/hosts (localhost) [ OK ]<br /> <br /> [+] Ports and packages<br /> ------------------------------------<br /> - Searching package managers...<br /> - Searching RPM package manager... [ FOUND ]<br /> - Querying RPM package manager...<br /> - Checking YUM package management consistency [ OK ]<br /> - Checking package database duplicates... [ OK ]<br /> - Checking package database for problems... [ OK ]<br /> - Checking missing security packages... [ OK ]<br /> - Checking GPG checks (yum.conf) [ OK ]<br /> - Checking package audit tool... [ INSTALLED ]<br /> Found: yum-security<br /> <br /> [+] Networking<br /> ------------------------------------<br /> - Checking configured nameservers...<br /> - Testing nameservers...<br /> Nameserver: 192.168.122.1... [ OK ]<br /> - Minimal of 2 responsive nameservers... [ WARNING ]<br /> - Checking default gateway... [ DONE ]<br /> - Getting listening ports (TCP/TCP)... [ DONE ]<br /> * Found 4 ports<br /> - Checking promiscuous interfaces... [ OK ]<br /> - Checking waiting connections... [ OK ]<br /> - Checking status DHCP client... [ RUNNING ]<br /> <br /> [+] Printers and Spools<br /> ------------------------------------<br /> - Checking cups daemon... [ NOT FOUND ]<br /> <br /> [+] Software: e-mail and messaging<br /> ------------------------------------<br /> - Checking Exim status... [ NOT FOUND ]<br /> - Checking Postfix status... [ RUNNING ]<br /> - Checking Postfix configuration... [ FOUND ]<br /> - Checking Postfix banner... [ OK ]<br /> - Checking Dovecot status... [ NOT FOUND ]<br /> - Checking Qmail smtpd status... [ NOT FOUND ]<br /> <br /> [+] Software: firewalls<br /> ------------------------------------<br /> - Checking iptables kernel module [ FOUND ]<br /> - Checking for empty ruleset [ OK ]<br /> - Checking for unused rules [ WARNING ]<br /> Status pf [ NOT FOUND ]<br /> - Checking host based firewall [ ACTIVE ]<br /> <br /> [+] Software: webserver<br /> ------------------------------------<br /> - Checking Apache (binary /usr/sbin/httpd)... [ FOUND ]<br /> Info: Configuration file found (/etc/httpd/conf/httpd.conf)4C<br /> Info: No virtual hosts found<br /> * Loadable modules [ FOUND ]<br /> - Found 65 loadable modules<br /> mod_evasive: anti-DoS/brute force [ NOT FOUND ]<br /> mod_qos: anti-Slowloris [ NOT FOUND ]<br /> mod_spamhaus: anti-spam (spamhaus) [ NOT FOUND ]<br /> ModSecurity: web application firewall [ NOT FOUND ]<br /> - Checking nginx... [ NOT FOUND ]<br /> <br /> [+] SSH Support<br /> ------------------------------------<br /> - Checking running SSH daemon... [ FOUND ]<br /> - Searching SSH configuration... [ FOUND ]<br /> - Checking defined SSH options... [ DONE ]<br /> - SSH option: PermitRootLogin... [ DISABLED ]<br /> - SSH option: Protocol... [ OK ]<br /> - SSH option: StrictModes... [ OK ]<br /> - SSH option: AllowUsers... [ FOUND ]<br /> - SSH option: AllowGroups... [ NOT FOUND ]<br /> <br /> [+] SNMP Support<br /> ------------------------------------<br /> - Checking running SNMP daemon... [ NOT FOUND ]<br /> <br /> [+] Databases<br /> ------------------------------------<br /> - MySQL process status... [ NOT FOUND ]<br /> - PostgreSQL processes status... [ NOT FOUND ]<br /> - Oracle processes status... [ NOT FOUND ]<br /> <br /> [+] LDAP Services<br /> ------------------------------------<br /> - Checking OpenLDAP instance... [ NOT FOUND ]<br /> <br /> [+] Software: PHP<br /> ------------------------------------<br /> - Checking PHP... [ NOT FOUND ]<br /> <br /> [+] Squid Support<br /> ------------------------------------<br /> - Checking running Squid daemon... [ NOT FOUND ]<br /> <br /> [+] Logging and files<br /> ------------------------------------<br /> - Checking for a running log daemon... [ OK ]<br /> - Checking Syslog-NG status [ NOT FOUND ]<br /> - Checking Metalog status [ NOT FOUND ]<br /> - Checking RSyslog status [ FOUND ]<br /> - Checking RFC 3195 daemon status [ NOT FOUND ]<br /> - Checking minilogd instances [ NOT FOUND ]<br /> - Checking logrotate presence [ OK ]<br /> - Checking log directories (static list) [ DONE ]<br /> - Checking open log files [ DONE ]<br /> - Checking deleted files in use [ DONE ]<br /> <br /> [+] Insecure services<br /> ------------------------------------<br /> - Checking inetd status... [ NOT ACTIVE ]<br /> <br /> [+] Banners and identification<br /> ------------------------------------<br /> - /etc/motd... [ FOUND ]<br /> - /etc/motd permissions... [ OK ]<br /> - /etc/motd contents... [ OK ]<br /> - /etc/issue... [ FOUND ]<br /> - /etc/issue contents... [ OK ]<br /> - /etc/issue.net... [ FOUND ]<br /> - /etc/issue.net contents... [ WEAK ]<br /> <br /> [+] Scheduled tasks<br /> ------------------------------------<br /> - Checking crontab/cronjob [ DONE ]<br /> - Checking atd status [ NOT RUNNING ]<br /> <br /> [+] Accounting<br /> ------------------------------------<br /> - Checking accounting information... [ OK ]<br /> - Checking sysstat accounting data [ ENABLED ]<br /> - Checking auditd [ ENABLED ]<br /> - Checking audit rules [ OK ]<br /> - Checking audit configuration file [ OK ]<br /> - Checking auditd log file [ FOUND ]<br /> <br /> [+] Time and Synchronization<br /> ------------------------------------<br /> - Checking running NTP daemon (ntpd)... [ FOUND ]<br /> - Checking running NTP daemon (timed)... [ NOT FOUND ]<br /> - Checking running NTP daemon (dntpd)... [ NOT FOUND ]<br /> - Checking NTP client in crontab file (/etc/anacrontab)... [ NOT FOUND ]<br /> - Checking NTP client in crontab file (/etc/crontab)... [ NOT FOUND ]<br /> - Checking NTP client in cron.d files... [ NOT FOUND ]<br /> - Checking for a running NTP daemon or client... [ OK ]<br /> - Checking valid association ID&#039;s... [ FOUND ]<br /> - Checking high stratum ntp peers... [ OK ]<br /> - Checking unreliable ntp peers... [ NOTICE ]<br /> - Checking selected time source... [ OK ]<br /> - Checking time source candidates... [ OK ]<br /> - Checking falsetickers... [ OK ]<br /> - Checking NTP version... [ FOUND ]<br /> <br /> [+] Cryptography<br /> ------------------------------------<br /> - Checking SSL certificate expiration... [ OK ]<br /> <br /> [+] Virtualization<br /> ------------------------------------<br /> <br /> [+] Security frameworks<br /> ------------------------------------<br /> - Checking presence AppArmor [ NOT FOUND ]<br /> - Checking presence SELinux [ FOUND ]<br /> - Checking SELinux status [ ENABLED ]<br /> - Checking current mode and config file [ OK ]<br /> Current SELinux mode: enforcing<br /> - Checking presence grsecurity [ NOT FOUND ]<br /> - Checking for implemented MAC framework [ OK ]<br /> <br /> [+] Software: file integrity<br /> ------------------------------------<br /> - Checking file integrity tools...<br /> - AFICK... [ NOT FOUND ]<br /> - AIDE... [ FOUND ]<br /> - Osiris... [ NOT FOUND ]<br /> - Samhain... [ NOT FOUND ]<br /> - Tripwire... [ NOT FOUND ]<br /> - OSSEC (syscheck)... [ NOT FOUND ]<br /> - Checking presence integrity tool... [ FOUND ]<br /> <br /> [+] Software: Malware scanners<br /> ------------------------------------<br /> - Checking chkrootkit... [ FOUND ]<br /> - Checking Rootkit Hunter... [ FOUND ]<br /> - Checking ClamAV scanner... [ NOT FOUND ]<br /> - Checking ClamAV daemon... [ NOT FOUND ]<br /> <br /> [+] System Tools<br /> ------------------------------------<br /> - Starting file permissions check...<br /> /etc/lilo.conf [ NOT FOUND ]<br /> /root/.ssh [ OK ]<br /> <br /> [+] Home directories<br /> ------------------------------------<br /> - Checking shell history files... [ OK ]<br /> <br /> [+] Kernel Hardening<br /> ------------------------------------<br /> - Comparing sysctl key pairs with scan profile...<br /> - kernel.core_uses_pid (exp: 1) [ OK ]<br /> - kernel.ctrl-alt-del (exp: 0) [ OK ]<br /> - kernel.exec-shield (exp: 1) [ OK ]<br /> - kernel.sysrq (exp: 0) [ OK ]<br /> - net.ipv4.conf.all.accept_redirects (exp: 0) [ OK ]<br /> - net.ipv4.conf.all.accept_source_route (exp: 0) [ OK ]<br /> - net.ipv4.conf.all.bootp_relay (exp: 0) [ OK ]<br /> - net.ipv4.conf.all.forwarding (exp: 0) [ OK ]<br /> - net.ipv4.conf.all.log_martians (exp: 1) [ OK ]<br /> - net.ipv4.conf.all.mc_forwarding (exp: 0) [ OK ]<br /> - net.ipv4.conf.all.proxy_arp (exp: 0) [ OK ]<br /> - net.ipv4.conf.all.rp_filter (exp: 1) [ OK ]<br /> - net.ipv4.conf.all.send_redirects (exp: 0) [ OK ]<br /> - net.ipv4.conf.default.accept_redirects (exp: 0) [ OK ]<br /> - net.ipv4.conf.default.accept_source_route (exp: 0) [ OK ]<br /> - net.ipv4.conf.default.log_martians (exp: 1) [ OK ]<br /> - net.ipv4.icmp_echo_ignore_broadcasts (exp: 1) [ OK ]<br /> - net.ipv4.icmp_ignore_bogus_error_responses (exp: 1) [ OK ]<br /> - net.ipv4.tcp_syncookies (exp: 1) [ OK ]<br /> - net.ipv4.tcp_timestamps (exp: 0) [ DIFFERENT ]<br /> <br /> [+] Hardening<br /> ------------------------------------<br /> - Installed compiler(s)... [ FOUND ]<br /> - Installed malware scanner... [ FOUND ]<br /> <br /> [+] Custom Tests<br /> ------------------------------------<br /> - Running custom tests... [ NONE ]<br /> <br /> ================================================================================<br /> <br /> -[ Lynis 1.4.6 Results ]-<br /> <br /> Tests performed: 174 Plugins enabled: 0<br /> <br /> Warnings:<br /> ----------------------------<br /> - Couldn&#039;t find 2 responsive nameservers [NETW-2705]<br /> <br /> Suggestions:<br /> ----------------------------<br /> - Run chkconfig --list to see all services and disable unneeded services<br /> - Disable drivers like USB storage when not used, to prevent unauthorized storage or data theft [STRG-1840]<br /> - Disable drivers like firewire storage when not used, to prevent unauthorized storage or data theft [STRG-1846]<br /> - Check your resolv.conf file and fill in a backup nameserver if possible [NETW-2705]<br /> - Check iptables rules to see which rules are currently not used [FIRE-4513]<br /> - Install Apache mod_evasive to guard webserver against DoS/brute force attempts [HTTP-6640]<br /> - Install Apache mod_qos to guard webserver against Slowloris attacks [HTTP-6641]<br /> - Install Apache mod_spamhaus to guard webserver against spammers [HTTP-6642]<br /> - Install Apache modsecurity to guard webserver against web application attacks [HTTP-6643]<br /> - Add legal banner to /etc/issue.net, to warn unauthorized users [BANN-7130]<br /> - Check ntpq peers output for unreliable ntp peers and correct/replace them [TIME-3120]<br /> - One or more sysctl values differ from the scan profile and could be tweaked [KRNL-6000]<br /> - Harden the system by removing unneeded compilers. This can decrease the chance of customized trojans, backdoors and rootkits to be compiled and installed [HRDN-7220]<br /> - Harden compilers and restrict access to world [HRDN-7222]<br /> <br /> Follow-up:<br /> ----------------------------<br /> - Fix findings, see security controls overview and documentation<br /> - Upload data to Lynis Enterprise for further analysis<br /> - Create a report and implementation plan<br /> <br /> Enterprise support and plugins available via CISOfy - http://cisofy.com<br /> ================================================================================<br /> Hardening index : [89] [################# ]<br /> ================================================================================<br /> Files:<br /> - Test and debug information : /var/log/lynis.log<br /> - Report data : /var/log/lynis-report.dat<br /> ================================================================================<br /> Tip: Disable all tests which are not relevant or are too strict for the<br /> purpose of this particular machine. This will remove unwanted suggestions<br /> and also boost the hardening index. Each test should be properly analyzed<br /> to see if the related risks can be accepted, before disabling the test.<br /> ================================================================================<br /> Lynis 1.4.6<br /> Copyright 2007-2014 - Michael Boelen, http://cisofy.com<br /> ================================================================================<br /> &lt;/pre&gt;</div>

Didier