文章目录

lynis简介
- Lynis受众与用例
- 支持的系统
- Audit步骤
- Lynis插件
- - Available plugins
- 审查示例
- - 审查恶意软件
  - 审计一致性
- 审计模块明细表
- - Test-ID 详细

lynis简介

Lynis是一款Unix系统的安全审计以及加固工具，能够进行深层次的安全扫描，其目的是检测潜在的时间并对未来的系统加固提供建议。这款软件会扫描一般系统信息，脆弱软件包以及潜在的错误配置。扫描完成后，Lynis还会为我们生成一份包含所有扫描结果的安全报告。
Get Started with Lynis - Installation Guide - CISOfy
https://cisofy.com/documentation/lynis/get-started/#first-run

Lynis受众与用例

1） Lynis的典型用例包括：

安全审核
一致性测试（例如，PCI，HIPAA，SOx）
渗透测试
漏洞检测
系统强化

2）受众和用例

开发人员：测试该Docker映像，或改善已部署Web应用程序的强化。
系统管理员：运行日常运行状况扫描，以发现新的漏洞。
IT审核员：向同事或客户展示可以采取哪些措施来提高安全性。
渗透测试人员：发现客户端系统上的安全漏洞，最终可能导致系统受损。
支持的操作系统

支持的系统

Lynis几乎可以在所有基于UNIX的系统和版本上运行，包括：
1） AIX
2） FreeBSD
3） HP-UX
4） Linux
5） macOS
6） NetBSD
7） NixOS
8） OpenBSD
9） Solaris
10） and others
同样也可以在Raspberry Pi，IoT设备和QNAP存储设备等系统上运行。

Audit步骤

使用Lynis进行的典型扫描过程：
1）初始化
2）执行基本检查，例如文件所有权
3）确定操作系统和工具
4）搜索可用的软件组件
5）检查最新的Lynis版本
6）运行启用的插件
7）按类别运行安全测试
8）执行您的自定义测试（可选）
9）报告安全扫描状态

除了屏幕上显示的报告和信息外，有关扫描的所有技术细节都存储在日志文件（lynis.log）中。警告和建议之类的结果存储在单独的报告文件（lynis-report.dat）中。

Lynis执行数百项单独的测试。大多数测试是用Shell脚本编写的，并且具有唯一的标识符（例如KRNL-6000）。使用唯一标识符，可以调整安全扫描。

Lynis是模块化的，可以运行您自己创建的测试。您甚至可以用其他脚本或编程语言创建它们。

Lynis插件

插件是Lynis的模块化扩展。借助插件，Lynis将执行附加测试并收集更多系统信息。

每个插件都有收集特定数据的目的。此数据存储在Lynis报告文件（lynis-report.dat）中。根据您对Lynis的使用情况，收集的数据可能会提供系统之间或各个扫描之间的宝贵见解。为了确保持续的开发，作者Michael Boelen创建了一个使用Lynis扫描输出的基于Web的付费解决方案。此解决方案称为Lynis Enterprise，并同时利用Lynis和插件。

该插件在拥有10个以上系统的环境中提供最大的价值。下载部分提供了一些插件。

插件网址：
Lynis plugins - CISOfy

自定义插件
可以通过利用通用的shell脚本来创建自定义插件，运行自己创建的测试。
Lynis Plugins - Development Guide - CISOfy

Available plugins

Plugin	Tests	Community	Customers
Accounting	2	No	Yes
Compliance	2	No	Yes
Configuration	1	No	Yes
Cryptography	0	No	Yes
Docker	2	No	Yes
File systems	0	No	Yes
Firewalls	0	No	Yes
Memory	0	No	Yes
PAM	1	Yes	Yes
Processes	0	No	Yes
Software	8	No	Yes
Software: systemd	16	Yes	Yes
System integrity	8	No	Yes
Total:	40

1.5 支持的标准

CIS benchmarks
NIST
NSA
OpenSCAP data Vendor guides and
recommendations (e.g. Debian Gentoo, Red Hat)

2 Lynis审计模块介绍
命令行输入lynis show groups后可查看扫描类别.共有41个大类

审查示例

可以参考我这篇博客：
Centos7|Lynis安装与使用_我是一块小石头-CSDN博客_centos下lynis安装步骤

系统审查

lynis audit system

单独模块审查

lynis --tests-from-group "group name"

审查恶意软件

lynis --tests-from-group “hardening malware”，需要安装malware scanner才能完成这个功能

Lynis control HRDN-7230: Presence malware scanner - CISOfy

审计一致性

审计模块明细表

输入指令 lynis show tests，实际只有39个大类
Lynis security controls: Accounting - CISOfy

Test-ID 详细

ACCT-2754    FreeBSD Check for available FreeBSD accounting information (security)
ACCT-2760   OpenBSD Check for available OpenBSD accounting information (security)
ACCT-9622   Linux   Check for available Linux accounting information (security)
ACCT-9626   Linux   Check for sysstat accounting data (security)
ACCT-9628   Linux   Check for auditd (security)
ACCT-9630   Linux   Check for auditd rules (security)
ACCT-9632   Linux   Check for auditd configuration file (security)
ACCT-9634   Linux   Check for auditd log file (security)
ACCT-9636   Linux   Check for Snoopy wrapper and logger (security)
ACCT-9650   Solaris Check Solaris audit daemon (security)
ACCT-9652   Solaris Check auditd SMF status (security)
ACCT-9654   Solaris Check BSM auditing in /etc/system (security)
ACCT-9656   Solaris Check BSM auditing in module list (security)
ACCT-9660   Solaris Check location of audit events (security)
ACCT-9662   Solaris Check Solaris auditing stats (security)
AUTH-9204       Check users with an UID of zero (security)
AUTH-9208       Check non-unique accounts in passwd file (security)
AUTH-9212       Test group file (security)
AUTH-9216       Check group and shadow group files (security)
AUTH-9218   FreeBSD Check harmful login shells (security)
AUTH-9222       Check for non unique groups (security)
AUTH-9226       Check non unique group names (security)
AUTH-9228       Check password file consistency with pwck (security)
AUTH-9234       Query user accounts (security)
AUTH-9240       Query NIS+ authentication support (security)
AUTH-9242       Query NIS authentication support (security)
AUTH-9250       Checking sudoers file (security)
AUTH-9252       Check sudoers file (security)
AUTH-9254   Solaris Solaris passwordless accounts (security)
AUTH-9262       Checking presence password strength testing tools (PAM) (security)
AUTH-9264       Checking presence pam.conf (security)
AUTH-9266       Checking presence pam.d files (security)
AUTH-9268       Checking presence pam.d files (security)
AUTH-9278       Checking LDAP pam status (security)
AUTH-9282       Checking password protected account without expire date (security)
AUTH-9283       Checking accounts without password (security)
AUTH-9286       Checking user password aging (security)
AUTH-9288       Checking for expired passwords (security)
AUTH-9304   Solaris Check single user login configuration (security)
AUTH-9306   HP-UX   Check single boot authentication (security)
AUTH-9308   Linux   Check single user login configuration (security)
AUTH-9328       Default umask values (security)
AUTH-9340   Solaris Solaris account locking (security)
AUTH-9402       Query LDAP authentication support (security)
AUTH-9406       Query LDAP servers in client configuration (security)
AUTH-9408       Logging of failed login attempts via /etc/login.defs (security)
AUTH-9409   OpenBSD Check for doas file (security)
AUTH-9410   OpenBSD Check for doas file permissions (security)
AUTH-9489   DragonFly   Check login shells for passwordless accounts (security)
BANN-7113   FreeBSD Check COPYRIGHT banner file (security)
BANN-7124       Check issue banner file (security)
BANN-7126       Check issue banner file contents (security)
BANN-7128       Check issue.net banner file (security)
BANN-7130       Check issue.net banner file contents (security)
BOOT-5102   AIX Check for AIX boot device (security)
BOOT-5104       Determine service manager (security)
BOOT-5106   MacOS   Check EFI boot file on macOS (security)
BOOT-5108   Linux   Test Syslinux boot loader (security)
BOOT-5116       Check if system is booted in UEFI mode (security)
BOOT-5117   Linux   Check for systemd-boot boot loader (security)
BOOT-5121       Check for GRUB boot loader presence (security)
BOOT-5122       Check for GRUB boot password (security)
BOOT-5124   FreeBSD Check for FreeBSD boot loader presence (security)
BOOT-5126   NetBSD  Check for NetBSD boot loader presence (security)
BOOT-5139       Check for LILO boot loader presence (security)
BOOT-5142       Check SPARC Improved boot loader (SILO) (security)
BOOT-5155       Check for YABOOT boot loader configuration file (security)
BOOT-5159   OpenBSD Check for OpenBSD boot loader presence (security)
BOOT-5165   FreeBSD Check for FreeBSD boot services (security)
BOOT-5177   Linux   Check for Linux boot and running services (security)
BOOT-5180   Linux   Check for Linux boot services (Debian style) (security)
BOOT-5184   Linux   Check permissions for boot files/scripts (security)
BOOT-5202       Check uptime of system (security)
BOOT-5260       Check single user mode for systemd (security)
BOOT-5261   DragonFly   Check for DragonFly boot loader presence (security)
BOOT-5262   OpenBSD Check for OpenBSD boot daemons (security)
BOOT-5263   OpenBSD Check permissions for boot files/scripts (security)
CONT-8004   Solaris Query running Solaris zones (security)
CONT-8102       Checking Docker status and information (security)
CONT-8104       Checking Docker info for any warnings (security)
CONT-8106       Gather basic stats from Docker (security)
CONT-8107       Check number of unused Docker containers (performance)
CONT-8108       Check file permissions for Docker files (security)
CORE-1000       Check all system binaries (performance)
CRYP-7902       Check expire date of SSL certificates (security)
DNS-1600        Validating that the DNSSEC signatures are checked (security)
DBS-1804        Checking active MySQL process (security)
DBS-1816        Checking MySQL root password (security)
DBS-1818        MongoDB status (security)
DBS-1820        Check MongoDB authentication (security)
DBS-1826        Checking active PostgreSQL processes (security)
DBS-1840        Checking active Oracle processes (security)
DBS-1860        Checking active DB2 instances (security)
DBS-1880        Checking active Redis processes (security)
DBS-1882        Redis configuration file (security)
DBS-1884        Redis configuration (requirepass) (security)
DBS-1886        Redis configuration (CONFIG command renamed) (security)
DBS-1888        Redis configuration (bind on localhost) (security)
FILE-6310       Checking /tmp, /home and /var directory (security)
FILE-6311       Checking LVM volume groups (security)
FILE-6312       Checking LVM volumes (security)
FILE-6323   Linux   Checking EXT file systems (security)
FILE-6329       Checking FFS/UFS file systems (security)
FILE-6330   FreeBSD Checking ZFS file systems (security)
FILE-6332       Checking swap partitions (security)
FILE-6336       Checking swap mount options (security)
FILE-6344   Linux   Checking proc mount options (security)
FILE-6354       Searching for old files in /tmp (security)
FILE-6362       Checking /tmp sticky bit (security)
FILE-6363       Checking /var/tmp sticky bit (security)
FILE-6368   Linux   Checking ACL support on root file system (security)
FILE-6372   Linux   Checking / mount options (security)
FILE-6374   Linux   Checking /boot mount options (security)
FILE-6376   Linux   Determine if /var/tmp is bound to /tmp (security)
FILE-6410       Checking Locate database (security)
FILE-6430       Disable mounting of some filesystems (security)
FILE-6439   DragonFly   Checking HAMMER PFS mounts (security)
FILE-7524       Perform file permissions check (security)
FINT-4310       AFICK availability (security)
FINT-4314       AIDE availability (security)
FINT-4315       Check AIDE configuration file (security)
FINT-4318       Osiris availability (security)
FINT-4322       Samhain availability (security)
FINT-4326       Tripwire availability (security)
FINT-4328       OSSEC syscheck daemon running (security)
FINT-4330       mtree availability (security)
FINT-4334       Check lfd daemon status (security)
FINT-4336       Check lfd configuration status (security)
FINT-4338       osqueryd syscheck daemon running (security)
FINT-4350       File integrity software installed (security)
FINT-4402       Checksums (SHA256 or SHA512) (security)
FIRE-4502   Linux   Check iptables kernel module (security)
FIRE-4508       Check used policies of iptables chains (security)
FIRE-4512       Check iptables for empty ruleset (security)
FIRE-4513       Check iptables for unused rules (security)
FIRE-4518       Check pf firewall components (security)
FIRE-4520       Check pf configuration consistency (security)
FIRE-4524       Check for CSF presence (security)
FIRE-4526   Solaris Check ipf status (security)
FIRE-4530   FreeBSD Check IPFW status (security)
FIRE-4532   MacOS   Check macOS application firewall (security)
FIRE-4534   MacOS   Check for outbound firewalls (security)
FIRE-4536   Linux   Check nftables status (security)
FIRE-4538   Linux   Check nftables basic configuration (security)
FIRE-4540   Linux   Test for empty nftables configuration (security)
FIRE-4586       Check firewall logging (security)
FIRE-4590       Check firewall status (security)
FIRE-4594       Check for APF presence (security)
HOME-9302       Create list with home directories (security)
HOME-9310       Checking for suspicious shell history files (security)
HOME-9350       Collecting information from home directories (security)
HRDN-7220       Check if one or more compilers are installed (security)
HRDN-7222       Check compiler permissions (security)
HRDN-7230       Check for malware scanner (security)
HTTP-6622       Checking Apache presence (security)
HTTP-6624       Testing main Apache configuration file (security)
HTTP-6626       Testing other Apache configuration file (security)
HTTP-6632       Determining all available Apache modules (security)
HTTP-6640       Determining existence of specific Apache modules (security)
HTTP-6641       Determining existence of specific Apache modules (security)
HTTP-6643       Determining existence of specific Apache modules (security)
HTTP-6702       Check nginx process (security)
HTTP-6704       Check nginx configuration file (security)
HTTP-6706       Check for additional nginx configuration files (security)
HTTP-6708       Check discovered nginx configuration settings (security)
HTTP-6710       Check nginx SSL configuration settings (security)
HTTP-6712       Check nginx access logging (security)
HTTP-6714       Check for missing error logs in nginx (security)
HTTP-6716       Check for debug mode on error log in nginx (security)
HTTP-6720       Check Nginx log files (security)
INSE-8000       Installed inetd package (security)
INSE-8002       Status of inet daemon (security)
INSE-8004       Presence of inetd configuration file (security)
INSE-8006       Check configuration of inetd when it is disabled (security)
INSE-8016       Check for telnet via inetd (security)
INSE-8050   MacOS   Check for insecure services on macOS systems (security)
INSE-8100       Installed xinetd package (security)
INSE-8116       Insecure services enabled via xinetd (security)
INSE-8200       Usage of TCP wrappers (security)
INSE-8300       Presence of rsh client (security)
INSE-8302       Presence of rsh server (security)
KRNL-5622   Linux   Determine Linux default run level (security)
KRNL-5677   Linux   Check CPU options and support (security)
KRNL-5695   Linux   Determine Linux kernel version and release number (security)
KRNL-5723   Linux   Determining if Linux kernel is monolithic (security)
KRNL-5726   Linux   Checking Linux loaded kernel modules (security)
KRNL-5728   Linux   Checking Linux kernel config (security)
KRNL-5730   Linux   Checking disk I/O kernel scheduler (security)
KRNL-5745   FreeBSD Checking FreeBSD loaded kernel modules (security)
KRNL-5770   Solaris Checking active kernel modules (security)
KRNL-5788   Linux   Checking availability new Linux kernel (security)
KRNL-5820   Linux   Checking core dumps configuration (security)
KRNL-5830   Linux   Checking if system is running on the latest installed kernel (security)
KRNL-5831   DragonFly   Checking DragonFly loaded kernel modules (security)
KRNL-6000       Check sysctl key pairs in scan profile (security)
LDAP-2219       Check running OpenLDAP instance (security)
LDAP-2224       Check presence slapd.conf (security)
LOGG-2130       Check for running syslog daemon (security)
LOGG-2132       Check for running syslog-ng daemon (security)
LOGG-2134       Checking Syslog-NG configuration file consistency (security)
LOGG-2136       Check for running systemd journal daemon (security)
LOGG-2138   Linux   Checking kernel logger daemon on Linux (security)
LOGG-2142   Linux   Checking minilog daemon (security)
LOGG-2146       Checking logrotate.conf and logrotate.d (security)
LOGG-2148       Checking logrotated files (security)
LOGG-2150       Checking directories in logrotate configuration (security)
LOGG-2152       Checking loghost (security)
LOGG-2154       Checking syslog configuration file (security)
LOGG-2160       Checking /etc/newsyslog.conf (security)
LOGG-2162       Checking directories in /etc/newsyslog.conf (security)
LOGG-2164       Checking files specified /etc/newsyslog.conf (security)
LOGG-2170       Checking log paths (security)
LOGG-2180       Checking open log files (security)
LOGG-2190       Checking for deleted files in use (security)
LOGG-2192       Checking for opened log files that are empty (security)
LOGG-2210       Check for running metalog daemon (security)
LOGG-2230       Check for running RSyslog daemon (security)
LOGG-2240       Check for running RFC 3195 compliant daemon (security)
MACF-6204       Check AppArmor presence (security)
MACF-6208       Check if AppArmor is enabled (security)
MACF-6232       Check SELINUX presence (security)
MACF-6234       Check SELINUX status (security)
MACF-6240       Detection of TOMOYO binary (security)
MACF-6242       Status of TOMOYO MAC framework (security)
MACF-6290       Check for implemented MAC framework (security)
MAIL-8802       Check Exim status (security)
MAIL-8804       Exim configuration (security)
MAIL-8814       Check postfix process status (security)
MAIL-8816       Check Postfix configuration (security)
MAIL-8817       Check Postfix configuration errors (security)
MAIL-8818       Postfix banner (security)
MAIL-8820       Postfix configuration (security)
MAIL-8838       Check dovecot process (security)
MAIL-8860       Check Qmail status (security)
MAIL-8880       Check Sendmail status (security)
MAIL-8920       Check OpenSMTPD status (security)
MALW-3275       Check for chkrootkit (security)
MALW-3276       Check for Rootkit Hunter (security)
MALW-3278       Check for LMD (security)
MALW-3280       Check if anti-virus tool is installed (security)
MALW-3282       Check for clamscan (security)
MALW-3284       Check for clamd (security)
MALW-3286       Check for freshclam (security)
MALW-3288       Check for ClamXav (security)
NAME-4016       Check /etc/resolv.conf default domain (security)
NAME-4018       Check /etc/resolv.conf search domains (security)
NAME-4020       Check non default options (security)
NAME-4024   Solaris Solaris uname -n output (security)
NAME-4026   Solaris Check /etc/nodename (security)
NAME-4028       Check domain name (security)
NAME-4032       Check nscd status (security)
NAME-4034       Check Unbound status (security)
NAME-4036       Check Unbound configuration file (security)
NAME-4202       Check BIND status (security)
NAME-4204       Search BIND configuration file (security)
NAME-4206       Check BIND configuration consistency (security)
NAME-4210       Check DNS banner (security)
NAME-4230       Check PowerDNS status (security)
NAME-4232       Search PowerDNS configuration file (security)
NAME-4236       Check PowerDNS backends (security)
NAME-4238       Check PowerDNS authoritive status (security)
NAME-4304       Check NIS ypbind status (security)
NAME-4306       Check NIS domain (security)
NAME-4402       Check duplicate line in /etc/hosts (security)
NAME-4404       Check /etc/hosts contains an entry for this server name (security)
NAME-4406       Check server hostname mapping (security)
NAME-4408       Check localhost to IP mapping (security)
NETW-2600   Linux   Checking IPv6 configuration (security)
NETW-2704       Basic nameserver configuration tests (security)
NETW-2705       Check availability two nameservers (security)
NETW-3001       Find default gateway (route) (security)
NETW-3004       Search available network interfaces (security)
NETW-3006       Get network MAC addresses (security)
NETW-3008       Get network IP addresses (security)
NETW-3012       Check listening ports (security)
NETW-3014       Checking promiscuous interfaces (BSD) (security)
NETW-3015   Linux   Checking promiscuous interfaces (Linux) (security)
NETW-3028       Checking connections in WAIT state (security)
NETW-3030       Checking DHCP client status (security)
NETW-3032   Linux   Checking for ARP monitoring software (security)
PHP-2211        Check php.ini presence (security)
PHP-2320        Check PHP disabled functions (security)
PHP-2368        Check PHP register_globals option (security)
PHP-2372        Check PHP expose_php option (security)
PHP-2374        Check PHP enable_dl option (security)
PHP-2376        Check PHP allow_url_fopen option (security)
PHP-2378        Check PHP allow_url_include option (security)
PHP-2379        Check PHP suhosin extension status (security)
PKGS-7301       Query NetBSD pkg (security)
PKGS-7302       Query FreeBSD/NetBSD pkg_info (security)
PKGS-7303       Query brew package manager (security)
PKGS-7304       Querying Gentoo packages (security)
PKGS-7306   Solaris Querying Solaris packages (security)
PKGS-7308       Checking package list with RPM (security)
PKGS-7310       Checking package list with pacman (security)
PKGS-7312       Checking available updates for pacman based system (security)
PKGS-7314       Checking pacman configuration options (security)
PKGS-7320   Linux   Check presence of arch-audit for Arch Linux (security)
PKGS-7322   Linux   Discover vulnerable packages on Arch Linux (security)
PKGS-7328       Querying Zypper for installed packages (security)
PKGS-7330       Querying Zypper for vulnerable packages (security)
PKGS-7332       Detection of macOS ports and packages (security)
PKGS-7334       Detection of available updates for macOS ports (security)
PKGS-7345       Querying dpkg (security)
PKGS-7346       Search unpurged packages on system (security)
PKGS-7348   FreeBSD Check for old distfiles (security)
PKGS-7350       Checking for installed packages with DNF utility (security)
PKGS-7352       Checking for security updates with DNF utility (security)
PKGS-7354       Checking package database integrity (security)
PKGS-7366       Checking for debsecan utility (security)
PKGS-7370       Checking for debsums utility (security)
PKGS-7378       Query portmaster for port upgrades (security)
PKGS-7380   NetBSD  Check for vulnerable NetBSD packages (security)
PKGS-7381       Check for vulnerable FreeBSD packages with pkg (security)
PKGS-7382       Check for vulnerable FreeBSD packages with portaudit (security)
PKGS-7383       Check for YUM package Update management (security)
PKGS-7384       Check for YUM utils package (security)
PKGS-7386       Check for YUM security package (security)
PKGS-7387       Check for GPG signing in YUM security package (security)
PKGS-7388       Check security repository in Debian/ubuntu apt sources.list file (security)
PKGS-7390   Linux   Check Ubuntu database consistency (security)
PKGS-7392   Linux   Check for Debian/Ubuntu security updates (security)
PKGS-7393       Check for Gentoo vulnerable packages (security)
PKGS-7394   Linux   Check for Ubuntu updates (security)
PKGS-7398       Check for package audit tool (security)
PKGS-7410       Count installed kernel packages (security)
PKGS-7420       Detect toolkit to automatically download and apply upgrades (security)
PRNT-2302   FreeBSD Check for printcap consistency (security)
PRNT-2304       Check cupsd status (security)
PRNT-2306       Check CUPSd configuration file (security)
PRNT-2307       Check CUPSd configuration file permissions (security)
PRNT-2308       Check CUPSd network configuration (security)
PRNT-2314       Check lpd status (security)
PRNT-2316   AIX Checking /etc/qconfig file (security)
PRNT-2418   AIX Checking qdaemon printer spooler status (security)
PRNT-2420   AIX Checking old print jobs (security)
PROC-3602   Linux   Checking /proc/meminfo for memory details (security)
PROC-3604   Solaris Query prtconf for memory details (security)
PROC-3612       Check dead or zombie processes (security)
PROC-3614       Check heavy IO waiting based processes (security)
RBAC-6272       Check grsecurity presence (security)
SCHD-7702       Check status of cron daemon (security)
SCHD-7704       Check crontab/cronjobs (security)
SCHD-7718       Check at users (security)
SCHD-7720       Check at users (security)
SCHD-7724       Check at jobs (security)
SHLL-6202   FreeBSD Check console TTYs (security)
SHLL-6211       Checking available and valid shells (security)
SHLL-6220       Checking available and valid shells (security)
SHLL-6230       Perform umask check for shell configurations (security)
SINT-7010       System Integrity Status (security)
SNMP-3302       Check for running SNMP daemon (security)
SNMP-3304       Check SNMP daemon file location (security)
SNMP-3306       Check SNMP communities (security)
SQD-3602        Check for running Squid daemon (security)
SQD-3604        Check Squid daemon file location (security)
SQD-3606        Check Squid version (security)
SQD-3610        Check Squid version (security)
SQD-3613        Check Squid file permissions (security)
SQD-3614        Check Squid authentication methods (security)
SQD-3616        Check external Squid authentication (security)
SQD-3620        Check Squid access control lists (security)
SQD-3624        Check Squid safe ports (security)
SQD-3630        Check Squid reply_body_max_size option (security)
SQD-3680        Check Squid version suppression (security)
SSH-7402        Check for running SSH daemon (security)
SSH-7404        Check SSH daemon file location (security)
SSH-7406        Detection of OpenSSH server version (security)
SSH-7408        Check SSH specific defined options (security)
SSH-7440        AllowUsers and AllowGroups (security)
STRG-1840   Linux   Check if USB storage is disabled (security)
STRG-1842   Linux   Check USB authorizations (security)
STRG-1846   Linux   Check if firewire storage is disabled (security)
STRG-1902       Check rpcinfo registered programs (security)
STRG-1904       Check nfs rpc (security)
STRG-1906       Check nfs rpc (security)
STRG-1920       Checking NFS daemon (security)
STRG-1926       Checking NFS exports (security)
STRG-1928       Checking empty /etc/exports (security)
STRG-1930       Check client access to nfs share (security)
TIME-3104       Check for running NTP daemon or client (security)
TIME-3106       Check systemd NTP time synchronization status (security)
TIME-3112       Check active NTP associations ID's (security)
TIME-3116       Check peers with stratum value of 16 (security)
TIME-3120       Check unreliable NTP peers (security)
TIME-3124       Check selected time source (security)
TIME-3128       Check preffered time source (security)
TIME-3132       Check NTP falsetickers (security)
TIME-3136   Linux   Check NTP protocol version (security)
TIME-3148   Linux   Check TZ variable (performance)
TIME-3160   Linux   Check empty NTP step-tickers (security)
TIME-3170       Check configuration files (security)
TOOL-5002       Checking for automation tools (security)
TOOL-5102       Check for presence of Fail2ban (security)
TOOL-5104       Enabled tests for Fail2ban (security)
TOOL-5120       Presence of Snort IDS (security)
TOOL-5122       Snort IDS configuration file (security)
TOOL-5160       Check for active OSSEC analysis daemon (security)
TOOL-5190       Check presence of available IDS/IPS tooling (security)
USB-3000    Linux   Check for presence of USBGuard (security)

Lynis介绍与使用相关推荐

linux 安全审计以及加固工具 lynis 使用介绍
0x00 概述 Lynis是一款Unix系统的安全审计以及加固工具,能够进行深层次的安全扫描,其目的是检测潜在的时间并对未来的系统加固提供建议.这款软件会扫描一般系统信息,脆弱软件包以及潜在的错误配置 ...
Linux系统安全审计工具Lynis
你是否怀疑你的Linux服务器遭到******,或是已经被***植入了***/rootkit后门,或者是存在可疑的系统账户和守护进程.这里推荐一款可以对Linux系统进行全面安全检查的工具,可以发现系 ...
【十年网络安全工程师整理】—100渗透测试工具使用方法介绍
渗透测试是指渗透人员在不同的位置(比如从内网.从外网等位置)利用各种手段对某个特定网络进行测试,以期发现和挖掘系统中存在的漏洞,然后输出渗透测试报告, 并提交给网络所有者.网络所有者根据渗透人员提供 ...
Lynis – 用于Linux服务器的自动安全审计工具
介绍 Lynis是Unix/Linux等操作系统的一款安全审计工具,它可以发现基于Linux系统中的恶意软件和安全漏洞.Lynis是免费开源的服务器审计工具,一旦审计完成,我们可以审查结果.警告和建议 ...
简单介绍互联网领域选择与营销方法
在我看来,互联网领域的选择是"安家",而营销方法的不同则表现了"定家"的方式多种多样,只有选对了,"家"才得以"安定". ...
常用开源协议介绍以及开源软件规范列表
1. 开源协议介绍 GPL: General Public License,开源项目最常用的许可证,衍生代码的分发需开源并且也要遵守此协议.该协议也有很多变种,不同变种要求会略微不同. MPL: MP ...
python：Json模块dumps、loads、dump、load介绍
20210831 https://www.cnblogs.com/bigtreei/p/10466518.html json dump dumps 区别 python:Json模块dumps.load ...
pytorch学习笔记（九）：PyTorch结构介绍
PyTorch结构介绍对PyTorch架构的粗浅理解,不能保证完全正确,但是希望可以从更高层次上对PyTorch上有个整体把握.水平有限,如有错误,欢迎指错,谢谢! 几个重要的类型和数值相关的 T ...
Python字节码介绍
了解 Python 字节码是什么,Python 如何使用它来执行你的代码,以及知道它是如何帮到你的. 如果你曾经编写过 Python,或者只是使用过 Python,你或许经常会看到 Python 源代 ...

Lynis介绍与使用