安裝Lynis系統安全審計掃描工具

1. 介紹lynis

lynis是一款開源的unix-based平臺的審計工具。能夠幫助審計員掃描Linux/Unix系統以及可用的軟件。支持本地掃描，網絡主機掃描，dockerfile文件的掃描。程序主要探測，系統上安裝的程序包，配置上的錯誤，以及安全問題和系統信息。

1. 安裝lynis

官網下載：https://cisofy.com/lynis/

# wget https://downloads.cisofy.com/lynis/lynis-2.6.4.tar.gz

解壓縮後能夠直接執行lynis腳本，不須要額外的安裝工做。

把lynis目錄移動到/opt目錄來運行

# mv lynis /opt/

1. 使用lynis審計掃描

audit

    audit system               : Perform local security scan 本地掃描

    audit system remote <host>   : Remote security scan         掃描網絡主機

    audit dockerfile <file>       : Analyze Dockerfile       掃描dockfile文件

本地掃描：

# ./lynis audit system

遠程掃描：

# ./lynis audit system remote 172.21.20.1

  How to perform a remote scan:

  =============================

  Target  : 172.21.20.1

  Command : ./lynis audit system --quick 172.21.20.1

 

  * Step 1: Create tarball

    mkdir -p ./files && cd .. && tar czf ./lynis/files/lynis-remote.tar.gz --exclude=files/lynis-remote.tar.gz ./lynis && cd lynis

 

  * Step 2: Copy tarball to target 172.21.20.1

    scp -q ./files/lynis-remote.tar.gz 172.21.20.1:~/tmp-lynis-remote.tgz

 

  * Step 3: Execute audit command

    ssh 172.21.20.1 "mkdir -p ~/tmp-lynis && cd ~/tmp-lynis && tar xzf ../tmp-lynis-remote.tgz && rm ../tmp-lynis-remote.tgz && cd lynis && ./lynis audit system --quick 172.21.20.1"

 

  * Step 4: Clean up directory

    ssh 172.21.20.1 "rm -rf ~/tmp-lynis"

 

  * Step 5: Retrieve log and report

    scp -q 172.21.20.1:/tmp/lynis.log ./files/172.21.20.1-lynis.log

    scp -q 172.21.20.1:/tmp/lynis-report.dat ./files/172.21.20.1-lynis-report.dat

 

  * Step 6: Clean up tmp files (when using non-privileged account)

    ssh 172.21.20.1 "rm /tmp/lynis.log /tmp/lynis-report.dat"