When you do a fresh install of Linux, you’ll find a lot software and services that can be improved to secure your system.
There are helpful guides such as the DISA (Defense Information Systems Agency) Secure Technical Implementation Guidelines (STIGs), and others.
However, if you want to run a tool to audit your system, it really is hard to beat Lynis. In this tip, I’ll do a fresh install of Fedora 28, and then run Lynis.
Lynis and installation
Lynis is in the Fedora repository, which makes for an easy install. Run the command: yum install lynis and Lynis is installed:
For this demo, I am using Fedora 28. With any luck, all of these steps should work on Red Hat, CentOS, and Fedora. To install the module run:
Execution
There are several options to run Lynis, including auditing docker files. For our purposes, we will just run the lynis audit system. You may wish to pipe it to more, although it does create a log in /var/log/lynis.log:
When it is finished, you will see a score. On this fresh Fedora install, it received a mediocre 70/100. That is a C-, and we are not C- people:
At this point, you should be looking through the log for ways to improve security. It is fairly lengthy so I use less, and then search for the word partial. Below are examples of a few things were performed to raise that pitiful security score:
- Set a max password age and min password age
- Tightened up the umask in /etc/profile
- FAILLOG_ENAB set in login.defs
- Added nodev noexec nosuid to /boot in fstab
- Installed RootKit Checker
- ...and few other things
After those steps were completed, I ran Lynis again and got a score of 82/100. There’s clearly much more to be done, but the machine now a solid B.
Lynis security scan for Linux
Lynis is not the only tool that can do this. That being said, as an open-source free tool available in the Fedora repo, there is really no reason not to run it. Always verify the tool’s results and since you will be editing system files, make sure you have a test box to work on first. As always, if you have any questions feel free to reach out: support@automox.com.
