利用lynis如何進(jìn)行l(wèi)inux漏洞掃描詳解
更新時間：2018年06月25日 08:36:13 作者：暗無天日
這篇文章主要給大家介紹了關(guān)于利用lynis如何進(jìn)行l(wèi)inux漏洞掃描的相關(guān)資料，文中通過示例代碼介紹的非常詳細(xì)，對大家的學(xué)習(xí)或者工作具有一定的參考學(xué)習(xí)價值，需要的朋友們下面隨著小編來一起學(xué)習(xí)學(xué)習(xí)吧
前言
lynis 是一款運行在 Unix/Linux 平臺上的基于主機(jī)的、開源的安全審計軟件。Lynis是針對Unix/Linux的安全檢查工具，可以發(fā)現(xiàn)潛在的安全威脅。這個工具覆蓋可疑文件監(jiān)測、漏洞、惡意程序掃描、配置錯誤等。下面一起來看看使用lynis進(jìn)行l(wèi)inux漏洞掃描的相關(guān)內(nèi)容吧
安裝lynis
在 archlinux 上可以直接通過 pacman 來安裝
sudo pacman -S lynis --noconfirm
resolving dependencies... looking for conflicting packages... Packages (1) lynis-2.6.4-1 Total Installed Size: 1.35 MiB Net Upgrade Size: 0.00 MiB :: Proceed with installation? [Y/n] (0/1) checking keys in keyring [----------------------] 0% (1/1) checking keys in keyring [######################] 100% (0/1) checking package integrity [----------------------] 0% (1/1) checking package integrity [######################] 100% (0/1) loading package files [----------------------] 0% (1/1) loading package files [######################] 100% (0/1) checking for file conflicts [----------------------] 0% (1/1) checking for file conflicts [######################] 100% (0/1) checking available disk space [----------------------] 0% (1/1) checking available disk space [######################] 100% :: Processing package changes... (1/1) reinstalling lynis [----------------------] 0% (1/1) reinstalling lynis [######################] 100% :: Running post-transaction hooks... (1/2) Reloading system manager configuration... (2/2) Arming ConditionNeedsUpdate...
使用lynis進(jìn)行主機(jī)掃描
首先讓我們不帶任何參數(shù)運行 lynis, 這會列出 lynis 支持的那些參數(shù)
[lujun9972@T520 linux和它的小伙伴]$ lynis [ Lynis 2.6.4 ] ################################################################################ Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under the terms of the GNU General Public License. See the LICENSE file for details about using this software. 2007-2018, CISOfy - https://cisofy.com/lynis/ Enterprise support available (compliance, plugins, interface and tools) ################################################################################ [+] Initializing program ------------------------------------ Usage: lynis command [options] Command: audit audit system : Perform local security scan audit system remote <host> : Remote security scan audit dockerfile <file> : Analyze Dockerfile show show : Show all commands show version : Show Lynis version show help : Show help update update info : Show update details Options: --no-log : Don't create a log file --pentest : Non-privileged scan (useful for pentest) --profile <profile> : Scan the system with the given profile file --quick (-Q) : Quick mode, don't wait for user input Layout options --no-colors : Don't use colors in output --quiet (-q) : No output --reverse-colors : Optimize color display for light backgrounds Misc options --debug : Debug logging to screen --view-manpage (--man) : View man page --verbose : Show more details on screen --version (-V) : Display version number and quit Enterprise options --plugindir <path> : Define path of available plugins --upload : Upload data to central node More options available. Run '/usr/bin/lynis show options', or use the man page. No command provided. Exiting..
從上面可以看出，使用 lynis 進(jìn)行主機(jī)掃描很簡單，只需要帶上參數(shù) audit system 即可。 Lynis在審計的過程中,會進(jìn)行多種類似的測試,在審計過程中會將各種測試結(jié)果、調(diào)試信息、和對系統(tǒng)的加固建議都被寫到 stdin 。 我們可以執(zhí)行下面命令來跳過檢查過程,直接截取最后的掃描建議來看。
sudo lynis audit system |sed '1,/Results/d'
lynis將掃描的內(nèi)容分成幾大類，可以通過 show groups 參數(shù)來獲取類別
lynis show groups
accounting
authentication
banners
boot_services
containers
crypto
databases
dns
file_integrity
file_permissions
filesystems
firewalls
hardening
homedirs
insecure_services
kernel
kernel_hardening
ldap
logging
mac_frameworks
mail_messaging
malware
memory_processes
nameservices
networking
php
ports_packages
printers_spools
scheduling
shells
snmp
squid
ssh
storage
storage_nfs
system_integrity
time
tooling
usb
virtualization
webservers
若指向掃描某幾類的內(nèi)容，則可以通過 –tests-from-group 參數(shù)來指定。
比如我只想掃描 shells 和 networking 方面的內(nèi)容，則可以執(zhí)行
sudo lynis --tests-from-group "shells networking" --no-colors
[ Lynis 2.6.4 ] ################################################################################ Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under the terms of the GNU General Public License. See the LICENSE file for details about using this software. 2007-2018, CISOfy - https://cisofy.com/lynis/ Enterprise support available (compliance, plugins, interface and tools) ################################################################################ [+] Initializing program ------------------------------------ [2C- Detecting OS... [41C [ DONE ] [2C- Checking profiles...[37C [ DONE ] [2C- Detecting language and localization[22C [ zh ] [4CNotice: no language file found for 'zh' (tried: /usr/share/lynis/db/languages/zh)[0C --------------------------------------------------- Program version: 2.6.4 Operating system: Linux Operating system name: Arch Linux Operating system version: Rolling release Kernel version: 4.16.13 Hardware platform: x86_64 Hostname: T520 --------------------------------------------------- Profiles: /etc/lynis/default.prf Log file: /var/log/lynis.log Report file: /var/log/lynis-report.dat Report version: 1.0 Plugin directory: /usr/share/lynis/plugins --------------------------------------------------- Auditor: [Not Specified] Language: zh Test category: all Test group: shells networking --------------------------------------------------- [2C- Program update status... [32C [ NO UPDATE ] [+] System Tools ------------------------------------ [2C- Scanning available tools...[30C [2C- Checking system binaries...[30C [+] Plugins (phase 1) ------------------------------------ [0CNote: plugins have more extensive tests and may take several minutes to complete[0C [0C [0C [2C- Plugins enabled[42C [ NONE ] [+] Shells ------------------------------------ [2C- Checking shells from /etc/shells[25C [4CResult: found 5 shells (valid shells: 5).[16C [4C- Session timeout settings/tools[25C [ NONE ] [2C- Checking default umask values[28C [4C- Checking default umask in /etc/bash.bashrc[13C [ NONE ] [4C- Checking default umask in /etc/profile[17C [ WEAK ] [+] Networking ------------------------------------ [2C- Checking IPv6 configuration[30C [ ENABLED ] [6CConfiguration method[35C [ AUTO ] [6CIPv6 only[46C [ NO ] [2C- Checking configured nameservers[26C [4C- Testing nameservers[36C [6CNameserver: 202.96.134.33[30C [ SKIPPED ] [6CNameserver: 202.96.128.86[30C [ SKIPPED ] [4C- Minimal of 2 responsive nameservers[20C [ SKIPPED ] [2C- Getting listening ports (TCP/UDP)[24C [ DONE ] [6C* Found 11 ports[39C [2C- Checking status DHCP client[30C [ RUNNING ] [2C- Checking for ARP monitoring software[21C [ NOT FOUND ] [+] Custom Tests ------------------------------------ [2C- Running custom tests... [33C [ NONE ] [+] Plugins (phase 2) ------------------------------------ ================================================================================ -[ Lynis 2.6.4 Results ]- Great, no warnings Suggestions (1): ---------------------------- * Consider running ARP monitoring software (arpwatch,arpon) [NETW-3032] https://cisofy.com/controls/NETW-3032/ Follow-up: ---------------------------- - Show details of a test (lynis show details TEST-ID) - Check the logfile for all details (less /var/log/lynis.log) - Read security controls texts (https://cisofy.com) - Use --upload to upload data to central system (Lynis Enterprise users) ================================================================================ Lynis security scan details: Hardening index : 33 [###### ] Tests performed : 13 Plugins enabled : 0 Components: - Firewall [X] - Malware scanner [X] Lynis Modules: - Compliance Status [?] - Security Audit [V] - Vulnerability Scan [V] Files: - Test and debug information : /var/log/lynis.log - Report data : /var/log/lynis-report.dat ================================================================================ Lynis 2.6.4 Auditing, system hardening, and compliance for UNIX-based systems (Linux, macOS, BSD, and others) 2007-2018, CISOfy - https://cisofy.com/lynis/ Enterprise support available (compliance, plugins, interface and tools) ================================================================================ [TIP]: Enhance Lynis audits by adding your settings to custom.prf (see /etc/lynis/default.prf for all settings)
查看詳細(xì)說明
在查看審計結(jié)果時,你可以通過 show details 參數(shù)來獲取關(guān)于某條警告/建議的詳細(xì)說明。其對應(yīng)的命令形式為:
lynis show details ${test_id}
比如，上面圖中有一個建議
* Consider running ARP monitoring software (arpwatch,arpon) [NETW-3032]
我們可以運行命令：
sudo lynis show details NETW-3032
2018-06-08 18:18:01 Performing test ID NETW-3032 (Checking for ARP monitoring software) 2018-06-08 18:18:01 IsRunning: process 'arpwatch' not found 2018-06-08 18:18:01 IsRunning: process 'arpon' not found 2018-06-08 18:18:01 Suggestion: Consider running ARP monitoring software (arpwatch,arpon) [test:NETW-3032] [details:-] [solution:-] 2018-06-08 18:18:01 Checking permissions of /usr/share/lynis/include/tests_printers_spools 2018-06-08 18:18:01 File permissions are OK 2018-06-08 18:18:01 ===---------------------------------------------------------------===
查看日志文件
lynis在審計完成后會將詳細(xì)的信息記錄在 /var/log/lynis.log 中.
sudo tail /var/log/lynis.log
2018-06-08 17:59:46 ================================================================================ 2018-06-08 17:59:46 Lynis 2.6.4 2018-06-08 17:59:46 2007-2018, CISOfy - https://cisofy.com/lynis/ 2018-06-08 17:59:46 Enterprise support available (compliance, plugins, interface and tools) 2018-06-08 17:59:46 Program ended successfully 2018-06-08 17:59:46 ================================================================================ 2018-06-08 17:59:46 PID file removed (/var/run/lynis.pid) 2018-06-08 17:59:46 Temporary files: /tmp/lynis.sGxCR0hSPz 2018-06-08 17:59:46 Action: removing temporary file /tmp/lynis.sGxCR0hSPz 2018-06-08 17:59:46 Lynis ended successfully.
同時將報告數(shù)據(jù)被保存到 /var/log/lynis-report.dat 中.
sudo tail /var/log/lynis-report.dat
另外需要注意的是，每次審計都會覆蓋原日志文件.
檢查更新
審計軟件需要隨時進(jìn)行更新從而得到最新的建議和信息，我們可以使用 update info 參數(shù)來檢查更新:
lynis update info --no-colors
== [1;37mLynis[0m == Version : 2.6.4 Status : [1;32mUp-to-date[0m Release date : 2018-05-02 Update location : https://cisofy.com/lynis/ 2007-2018, CISOfy - https://cisofy.com/lynis/
自定義lynis安全審計策略
lynis的配置信息以 .prf 文件的格式保存在 /etc/lynis 目錄中。 其中，默認(rèn)lynis自帶一個名為 default.prf 的默認(rèn)配置文件。
不過我們無需直接修改這個默認(rèn)的配置文件，只需要新增一個 custom.prf 文件將自定義的信息加入其中就可以了。
關(guān)于配置文件中各配置項的意義，在 default.prf 中都有相應(yīng)的注釋說明,這里就不詳述了。
想了解lynis的更多信息，可以訪問它的官網(wǎng).
總結(jié)
以上就是這篇文章的全部內(nèi)容了，希望本文的內(nèi)容對大家的學(xué)習(xí)或者工作具有一定的參考學(xué)習(xí)價值，如果有疑問大家可以留言交流，謝謝大家對腳本之家的支持。
相關(guān)文章
Linux實現(xiàn)實時監(jiān)控磁盤空間的命令詳解
在日常的系統(tǒng)管理和維護(hù)中,磁盤空間的管理是一個非常重要的環(huán)節(jié),本文主要來和大家介紹一下Linux實現(xiàn)實時監(jiān)控磁盤空間的相關(guān)命令的使用,需要的可以了解下2025-03-03
這篇文章主要介紹了centos6編譯及安裝ZLMediaKit,需要的朋友可以參考下2019-11-11
yum是基于RPM包管理器、為了提高RPM軟件包安裝性而開發(fā)的一種軟件包管理器。它能夠從指定的服務(wù)器自動下載.rpm包并自動安裝，可以自動處理依賴性關(guān)系，并一次性安裝所有依賴的軟體包。本文就詳細(xì)介紹了YUM軟件包管理工具與yum命令。有需要的朋友們下面來一起看看吧。2017-01-01
這篇文章主要介紹了Linux 邏輯卷管理(LVM)的使用方法，文中命令十分詳細(xì)，幫助大家更好的學(xué)習(xí)，感興趣的小伙伴快來參考下2020-06-06
CentOS下搭建Sendmail郵件服務(wù)器步驟詳解
本篇文章主要介紹了CentOS下搭建Sendmail郵件服務(wù)器步驟詳解，小編覺得挺不錯的，現(xiàn)在分享給大家，也給大家做個參考。一起跟隨小編過來看看吧2016-12-12
Linux虛擬機(jī)無網(wǎng)絡(luò)問題的解決方案(yum無法使用)
在下載虛擬機(jī)后,由于網(wǎng)絡(luò)沒有配置好,會遇到?jīng)]網(wǎng)問題,導(dǎo)致yum無法使用,下載不了軟件,當(dāng)我們安裝軟件時出現(xiàn)下面情況：could not retrieve mirrorlist,所以本文給大家介紹了Linux虛擬機(jī)無網(wǎng)絡(luò)問題的解決方案(yum無法使用),需要的朋友可以參考下2024-11-11
CentOS(Linux)下的apache服務(wù)器配置與管理方法分享
CentOS(Linux)下的apache服務(wù)器配置與管理方法分享，需要的朋友可以參考下。2011-04-04
這篇文章主要介紹了【Linux】Linux中常用操作命令總結(jié)，Linux，免費開源，多用戶多任務(wù)系統(tǒng)。本文總結(jié)了一些實用常用命令,需要的朋友可以參考下。2016-11-11
Centos7.3安裝部署最新版Zabbix3.4的方法(圖文)
這篇文章主要介紹了Centos7.3安裝部署最新版Zabbix3.4的方法(圖文)，小編覺得挺不錯的，現(xiàn)在分享給大家，也給大家做個參考。一起跟隨小編過來看看吧2018-03-03
這篇文章主要介紹了學(xué)習(xí)Vim合并行的方法以及代碼實現(xiàn)過程，值得參考，一起來學(xué)習(xí)下。2017-11-11