1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920
1921
1922
1923
1924
1925
1926
1927
1928
1929
1930
1931
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946
1947
1948
1949
1950
1951
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982
1983
1984
1985
1986
1987
1988
1989
1990
1991
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055
2056
2057
2058
2059
2060
2061
2062
2063
2064
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077
2078
2079
2080
2081
2082
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111
2112
2113
2114
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124
2125
2126
2127
2128
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168
2169
2170
2171
2172
2173
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199
2200
2201
2202
2203
2204
2205
2206
2207
2208
2209
2210
2211
2212
2213
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225
2226
2227
2228
2229
2230
2231
2232
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248
2249
2250
2251
2252
2253
2254
2255
2256
2257
2258
2259
2260
2261
2262
2263
2264
2265
2266
2267
2268
2269
2270
2271
2272
2273
2274
2275
2276
2277
2278
2279
2280
2281
2282
2283
2284
2285
2286
2287
2288
2289
2290
2291
2292
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311
2312
2313
2314
2315
2316
2317
2318
2319
2320
2321
2322
2323
2324
2325
2326
2327
2328
2329
2330
2331
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345
2346
2347
2348
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362
2363
2364
2365
2366
2367
2368
2369
2370
2371
2372
2373
2374
2375
2376
2377
2378
2379
2380
2381
2382
2383
2384
2385
2386
2387
2388
2389
2390
2391
2392
2393
2394
2395
2396
2397
2398
2399
2400
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412
2413
2414
2415
2416
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426
2427
2428
2429
2430
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454
2455
2456
2457
2458
2459
2460
2461
2462
2463
2464
2465
2466
2467
2468
2469
2470
2471
2472
2473
2474
2475
2476
2477
2478
2479
2480
2481
2482
2483
2484
2485
2486
2487
2488
2489
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499
2500
2501
2502
2503
2504
2505
2506
2507
2508
2509
2510
2511
2512
2513
2514
2515
2516
2517
2518
2519
2520
2521
2522
2523
2524
2525
2526
2527
2528
2529
2530
2531
2532
2533
2534
2535
2536
2537
2538
2539
2540
2541
2542
2543
2544
2545
2546
2547
2548
2549
2550
2551
2552
2553
2554
2555
2556
2557
2558
2559
2560
2561
2562
2563
2564
2565
2566
2567
2568
2569
2570
2571
2572
2573
2574
2575
2576
2577
2578
2579
2580
2581
2582
2583
2584
2585
2586
2587
2588
2589
2590
2591
2592
2593
2594
2595
2596
2597
2598
2599
2600
2601
2602
2603
2604
2605
2606
2607
2608
2609
2610
2611
2612
2613
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624
2625
2626
2627
2628
2629
2630
2631
2632
2633
2634
2635
2636
2637
2638
2639
2640
2641
2642
2643
2644
2645
2646
2647
2648
2649
2650
2651
2652
2653
2654
2655
2656
2657
2658
2659
2660
2661
2662
2663
2664
2665
2666
2667
2668
2669
2670
2671
2672
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687
2688
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699
2700
2701
2702
2703
2704
2705
2706
2707
2708
2709
2710
2711
2712
2713
2714
2715
2716
2717
2718
2719
2720
2721
2722
2723
2724
2725
2726
2727
2728
2729
2730
2731
2732
2733
2734
2735
2736
2737
2738
2739
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753
2754
2755
2756
2757
2758
2759
2760
2761
2762
2763
2764
2765
2766
2767
2768
2769
2770
2771
2772
2773
2774
2775
2776
2777
2778
2779
2780
2781
2782
2783
2784
2785
2786
2787
2788
2789
2790
2791
2792
2793
2794
2795
2796
2797
2798
2799
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810
2811
2812
2813
2814
2815
2816
2817
2818
2819
2820
2821
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833
2834
2835
2836
2837
2838
2839
2840
2841
2842
2843
2844
2845
2846
2847
2848
2849
2850
2851
2852
2853
2854
2855
2856
2857
2858
2859
2860
2861
2862
2863
2864
2865
2866
2867
2868
2869
2870
2871
2872
2873
2874
2875
2876
2877
2878
2879
2880
2881
2882
2883
2884
2885
2886
2887
2888
2889
2890
2891
2892
2893
2894
2895
2896
2897
2898
2899
2900
2901
2902
2903
2904
2905
2906
2907
2908
2909
2910
2911
2912
2913
2914
2915
2916
2917
2918
2919
2920
2921
2922
2923
2924
2925
2926
2927
2928
2929
2930
2931
2932
2933
2934
2935
2936
2937
2938
2939
2940
2941
2942
2943
2944
2945
2946
2947
2948
2949
2950
2951
2952
2953
2954
2955
2956
2957
2958
2959
2960
2961
2962
2963
2964
2965
2966
2967
2968
2969
2970
2971
2972
2973
2974
2975
2976
2977
2978
2979
2980
2981
2982
2983
2984
2985
2986
2987
2988
2989
2990
2991
2992
2993
2994
2995
2996
2997
2998
2999
3000
3001
3002
3003
3004
3005
3006
3007
3008
3009
3010
3011
3012
3013
3014
3015
3016
3017
3018
3019
3020
3021
3022
3023
3024
3025
3026
3027
3028
3029
3030
3031
3032
3033
3034
3035
3036
3037
3038
3039
3040
3041
3042
3043
3044
3045
3046
3047
3048
3049
3050
3051
3052
3053
3054
3055
3056
3057
3058
3059
3060
3061
3062
3063
3064
3065
3066
3067
3068
3069
3070
3071
3072
3073
3074
3075
3076
3077
3078
3079
3080
3081
3082
3083
3084
3085
3086
3087
3088
3089
3090
3091
3092
3093
3094
3095
3096
3097
3098
3099
3100
3101
3102
3103
3104
3105
3106
3107
3108
3109
3110
3111
3112
3113
3114
3115
3116
3117
3118
3119
3120
3121
3122
3123
3124
3125
3126
3127
3128
3129
3130
3131
3132
3133
3134
3135
3136
3137
3138
3139
3140
3141
3142
3143
3144
3145
3146
3147
3148
3149
3150
3151
3152
3153
3154
3155
3156
3157
3158
3159
3160
3161
3162
3163
3164
3165
3166
3167
3168
3169
3170
3171
3172
3173
3174
3175
3176
3177
3178
3179
3180
3181
3182
3183
3184
3185
3186
3187
3188
3189
3190
3191
3192
3193
3194
3195
3196
3197
3198
3199
3200
3201
3202
3203
3204
3205
3206
3207
3208
3209
3210
3211
3212
3213
3214
3215
3216
3217
3218
3219
3220
3221
3222
3223
3224
3225
3226
3227
3228
3229
3230
3231
3232
3233
3234
3235
3236
3237
3238
3239
3240
3241
3242
3243
3244
3245
3246
3247
3248
3249
3250
3251
3252
3253
3254
3255
3256
3257
3258
3259
3260
3261
3262
3263
3264
3265
3266
3267
3268
3269
3270
3271
3272
3273
3274
3275
3276
3277
3278
3279
3280
3281
3282
3283
3284
3285
3286
3287
3288
3289
3290
3291
3292
3293
3294
3295
3296
3297
3298
3299
3300
3301
3302
3303
3304
3305
3306
3307
3308
3309
3310
3311
3312
3313
3314
3315
3316
3317
3318
3319
3320
3321
3322
3323
3324
3325
3326
3327
3328
3329
3330
3331
3332
3333
3334
3335
3336
3337
3338
3339
3340
3341
3342
3343
3344
3345
3346
3347
3348
3349
3350
3351
3352
3353
3354
3355
3356
3357
3358
3359
3360
3361
3362
3363
3364
3365
3366
3367
3368
3369
3370
3371
3372
3373
3374
3375
3376
3377
3378
3379
3380
3381
3382
3383
3384
3385
3386
3387
3388
3389
3390
3391
3392
3393
3394
3395
3396
3397
3398
3399
3400
3401
3402
3403
3404
3405
3406
3407
3408
3409
3410
3411
3412
3413
|
# Lynis Changelog
## Lynis 3.0.0 (not released yet)
This is a major release of Lynis and includes several big changes.
Some of these changes may break your current usage of the tool, so test before
deployment!
### Breaking change: Non-interactive by default
Lynis now runs non-interactive by default, to be more in line with the Unix
philosophy. So the previously used '--quick' option is now default, and the tool
will only wait when using the '--wait' option.
### Breaking change: Deprecated options
- Option: -c
- Option: --check-update/--info
- Option: --dump-options
- Option: --license-key
### Breaking change: Profile options
The format of all profile options are converted (from key:value to key=value).
You may have to update the changes you made in your custom.prf.
### Security
An important focus area for this release is on security. We added several
measures to further tighten any possible misuse.
## New: DevOps, Forensics, and pentesting mode
This release adds initial support to allow defining a specialized type of audit.
Using the relevant options, the scan will change base on the intended goal.
### Added
- Security: test PATH and warn or exit on discovery of dangerous location
- Security: additional safeguard by testing if common system tools are available
- Security: test parameters and arguments for presence of control characters
- Security: filtering out unexpected characters from profiles
- Security: test if setuid bit is set on Lynis binary
- New function: DisplayException
- New function: DisplayWarning
- New function: Equals
- New function: GetReportData
- New function: HasCorrectFilePermissions
- New function: Readonly
- New function: SafeFile
- New function: SafeInput
- New option: --usecwd - run from the current working directory
- New profile option: disable-plugin - disables a single plugin
- New profile option: ssl-certificate-paths-to-ignore - ignore a path
- New test: AUTH-9229 - check used password hashing methods
- New test: AUTH-9230 - check group password hashing rounds
- New test: BOOT-5109 - test presence rEFInd boot loader
- New test: BOOT-5264 - run systemd-analyze security
- New test: CRYP-7930 - test for LUKS encryption
- New test: CRYP-8004 - presence of hardware random number generator
- New test: CRYP-8005 - presence of software random number generator
- New test: DBS-1828 - PostgreSQL configuration files
- New test: FILE-6394 - test virtual memory swappiness (Linux)
- New test: FINT-4316 - presence of AIDE database and size test
- New test: FINT-4340 - check dm-integrity status (Linux)
- New test: FINT-4341 - verify status of dm-verity (Linux)
- New test: INSE-8314 - test for NIS client
- New test: INSE-8316 - test for NIS server
- New test: NETW-2706 - check DNSSEC (systemd)
- New test: NETW-3200 - determine enabled network protocols
- New test: PROC-3802 - check presence of prelink tooling
- New test: TIME-3180 - report if ntpctl cannot communicate with OpenNTPD
- New test: TIME-3181 - check status of OpenNTPD time synchronisation
- New test: TIME-3182 - check OpenNTPD has working peers
- New report key: openssh_daemon_running
- New command: lynis generate systemd-units
- Sending USR1 signal to Lynis process will show active status
- Measure timing of tests and report slow tests (10+ seconds)
- Initial support for Clear Linux OS
- Initial support for PureOS
- Support for X Binary Package (xbps)
- Added end-of-life data for Arch Linux and Debian
- Detection and end-of-life data added for Amazon Linux
- Detection of linux-lts on Arch Linux
### Changed
- Function: CheckItem() now returns only exit code (ITEM_FOUND is dropped)
- Function: IsRunning supports the --user flag to define a related user
- Function: PackageIsInstalled extended with pacman support
- Profiles: unused options removed
- Profiles: message is displayed when old format "key:value" is used
- Binaries: skip pacman when it is the game instead of package manager
- Security: the 'nounset' (set -u) parameter is now activated by default
- AUTH-9228 - HP-UX support
- AUTH-9234 - NetBSD support
- AUTH-9252 - corrected permission check
- AUTH-9266 - skip .pam-old files in /etc/pam.d
- AUTH-9268 - Perform test also on FreeBSD and NetBSD
- AUTH-9282 - fix: temporary variable was overwritten
- AUTH-9408 - added support for pam_tally2 to log failed logins
- BANN-7126 - additional words for login banner are accepted
- BOOT-5122 - check for defined password in all GRUB configuration files
- CONT-8106 - support newer 'docker info' output
- CRYP-8002 - gather kernel entropy on Linux systems
- FILE-6310 - support for HP-UX
- FILE-6374 - changed log and allow root location to be changed
- FILE-6374 - corrected condition to find 'defaults' flag in /etc/fstab
- FILE-6430 - minor code improvements and show suggestion with more details
- FILE-7524 - optimized file permissions testing
- FINT-4328 - corrected text in log
- FINT-4334 - improved process detection for lfd
- HOME-9304 - improved selection for normal users
- HOME-9306 - improved selection for normal users
- INSE-8050 - added com.apple.ftp-proxy and improved text output
- INSE-8050 - corrected function call for showing suggestion
- INSE-8116 - added rsync service
- INSE-8314 - changed text of suggestion
- INSE-8318 - test for TFTP client tools
- INSE-8320 - test for TFTP server tools
- INSE-8342 - renamed to INSE-8304
- KRNL-5788 - don't complain about missing /vmlinuz for Raspi
- KRNL-5820 - extended check to include limits.d directory
- KRNL-5830 - skip test partially when running non-privileged
- LOGG-2154 - added support for rsyslog configurations
- MACF-6234 - SELinux tests extended
- MAIL-8804 - replaced static strings with translation-aware strings
- MALW-3280 - Kaspersky detection added
- MALW-3280 - CrowdStrike falcon-sensor detection added
- NAME-4402 - check if /etc/hosts exists before performing test
- NAME-4404 - improved screen and log output
- NAME-4408 - corrected Report function call
- NETW-3032 - small rewrite of test and extended with addrwatch
- PHP-2372 - don't look in the cli configuration files
- PKGS-7388 - only perform check for Debian/Ubuntu/Mint
- PKGS-7410 - use multiple package managers when available
- PKGS-7410 - added support for Zypper to test number of kernels
- PROC-3602 - allow different root directory
- PROC-3612 - show 'Not found' instead of 'OK'
- PROC-3614 - show 'Not found' instead of 'OK'
- PROC-3802 - limit to Linux only (prelink package check)
- SCHD-7702 - removed hardening points
- SINT-7010 - limit test to only macOS systems
- SSH-7402 - detect other SSH daemons like dropbear
- SSH-7406 - strip OpenSSH patch version and remove characters (carriage return)
- SSH-7408 - changed text in suggestion and report
- SSH-7408 - added forced-commands-only option
- SSH-7408 - VerifyReverseMapping removed (deprecated)
- SSH-7408 - corrected OpenSSH server version check
- STRG-1840 - renamed to USB-1000
- STRG-1842 - added default authorized devices and renamed to USB-2000
- TIME-3104 - use find to discover files in cron directories
- TOOL-5002 - differentiate between a discovered binary and running process
- TOOL-5160 - added support for OSSEC agent daemon
- Perform additional check to ensure pacman package manager is used
- Use 'pre-release/release' (was: 'dev/final') with 'lynis show release'
- Use only locations from PATH environment variable, unless it is not defined
- Show tip to use 'lynis generate hostids' when host IDs are missing
- The 'show changelog' command works again for newer versions
- Several code cleanups, simplification of commands, and code standardization
- Tests using lsof may ignore individual threads (if supported)
- Corrected end-of-life detection for CentOS 7 and CentOS 8
- Do not show tool tips when quiet option is used
- Improved screen output in several tests
- Extended output of 'lynis update info'
- Improved support for NetBSD
- Test if profiles are readable
- systemd service file adjusted
- bash completion script extended
- Updated man page
---------------------------------------------------------------------------------
## Lynis 2.7.5 (2019-06-24)
### Added
- Danish translation
- Slackware end-of-life information
- Detect BSD-style (rc.d) init in Linux systems
- Detection of Bro and Suricata (IDS)
### Changed
- Corrected end-of-life entries for CentOS 5 and 6
- AUTH-9204 - change name to check in /etc/passwd file for QNAP devices
- AUTH-9268 - AIX enhancement to use correct find statement
- FILE-6310 - Filter on correct field for AIX
- NETW-3012 - set ss command as preferred option for Linux and changed output format
- List of PHP ini file locations has been extended
- Removed several pieces of the code as part of cleanup and code health
- Extended help
---------------------------------------------------------------------------------
## Lynis 2.7.4 (2019-04-21)
This is a bigger release than usual, including several new tests created by
Capashenn (GitHub). It is a coincidence that it is released exactly one month
after the previous version and on Easter. No easter eggs, only improvements!
### Added
- FILE-6324 - Discover XFS mount points
- INSE-8000 - Installed inetd package
- INSE-8100 - Installed xinetd package
- INSE-8102 - Status of xinet daemon
- INSE-8104 - xinetd configuration file
- INSE-8106 - xinetd configuration for inactive daemon
- INSE-8200 - Usage of TCP wrappers
- INSE-8300 - Presence of rsh client
- INSE-8302 - Presence of rsh server
- Detect equery binary detection
- New 'generate' command
### Changed
- AUTH-9278 - Test LDAP in all PAM components on Red Hat and other systems
- PKGS-7410 - Add support for DPKG-based systems to gather installed kernel packages
- PKGS-7420 - Detect toolkit to automatically download and apply upgrades
- PKGS-7328 - Added global Zypper option --non-interactive
- PKGS-7330 - Added global Zypper option --non-interactive
- PKGS-7386 - Only show warning when vulnerable packages were discovered
- PKGS-7392 - Skip test for Zypper-based systems
- Minor changes to improve text output, test descriptions, and logging
- Changed CentOS identifiers in end-of-life database
- AIX enhancement for IsRunning function
- Extended PackageIsInstalled function
- Improve text output on AIX systems
- Corrected lsvg binary detection
---------------------------------------------------------------------------------
## Lynis 2.7.3 (2019-03-21)
### Added
- Detection for Lynis being scheduled (e.g. cronjob)
### Changed
- HTTP-6624 - Improved logging for test
- KRNL-5820 - Changed color for default fs.suid_dumpable value
- LOGG-2154 - Adjusted test to search in configuration file correctly
- NETW-3015 - Added support for ip binary
- SQD-3610 - Description of test changed
- SQD-3613 - Corrected description in code
- SSH-7408 - Increased values for MaxAuthRetries
- Improvements to allow tailored tool tips in future
- Corrected detection of blkid binary
- Minor textual changes and cleanups
---------------------------------------------------------------------------------
## Lynis 2.7.2 (2019-03-07)
### Added
- AUTH-9409 - Support for doas (OpenBSD)
- AUTH-9410 - Test file permissions of doas configuration
- BOOT-5117 - Support for systemd-boot boot loader added
- BOOT-5177 - Simplify service filter and allow multiple dots in service names
- BOOT-5262 - Check OpenBSD boot daemons
- BOOT-5263 - Test permissions for boot files and scripts
- Support for end-of-life detection of the operating system
- New 'lynis show eol' command
- Korean translation
### Changed
- AUTH-9252 - Adds support for files in sudoers.d
- AUTH-9252 - Test extended to check file and directory ownership
- BOOT-5122 - Use NONE instead of WARNING if no password is set
- FIRE-4540 - Modify test to better measure rules
- KRNL-5788 - Resolve false positive warning on missing /vmlinuz
- NETW-2704 - Ignore inline comments in /etc/resolv.conf
- PKGS-7388 - Improve detection for security archive
- RPi/Raspian path to PAM_FILE_LOCATIONS
---------------------------------------------------------------------------------
## Lynis 2.7.1 (2019-01-30)
### Added
- Support for macOS Mojave
- Translation: Slovak
### Changed
- AUTH-9282 - Improve support for Red Hat and clones
- FIRE-4534 - Additional support for Hands Off!, LuLu, and Radio Silence
- LOGG-2190 - Added MariaDB filter for deleted files (tested on CentOS)
- SHLL-6230 - Add /etc/bash.bashrc.local to umask check
- Removed shift statement that did not work on all operating systems
- Minor cleanups and enhancements
- Small improvements to logging
---------------------------------------------------------------------------------
## Lynis 2.7.0 (2018-10-26)
### Added
- MACF-6240 - Detection of TOMOYO binary
- MACF-6242 - Status of TOMOYO framework
- SSH-7406 - OpenSSH server version detection
- TOOL-5160 - Check active OSSEC analysis daemon
### Changed
- Changed several warning labels on screen
- AUTH-9308 - More generic sulogin for systemd rescue.service
- OS detection now ignores quotes for getting the OS ID.
---------------------------------------------------------------------------------
## Lynis 2.6.9 (2018-09-19)
### Changed
- Man page has been updated
- Command 'lynis show options' provides up-to-date list
- Option '--dump-options' is deprecated
- Several options and commands have been extended with more examples
- OS detection now supports openSUSE specific distribution names
- Changed command output when using 'lynis audit system remote'
- DBS-1882 - added /usr/local/redis/etc path and QNAP support
- PKGS-7322 - updated solution text
- KRNL-5788 - ignore exception when no vmlinuz file was discovered
- TIME-3104 - extended logging for test
---------------------------------------------------------------------------------
## Lynis 2.6.8 (2018-08-23)
### Changed
- BOOT-5104 - improved parsing of boot parameters to init process
- PHP-2372 - test all PHP files for expose_php and improved logging
- Alpine Linux detection for Docker audit
- Docker check now tests also for CMD, ENTRYPOINT, and USER configuration
- Improved display in Docker output for showing which keys are used for signing
---------------------------------------------------------------------------------
## Lynis 2.6.7 (2018-08-09)
### Changed
- BOOT-5104 - Added busybox as a service manager
- KRNL-5677 - Limit PAE and no-execute test to AMD64 hardware only
- LOGG-2190 - Ignore /dev/zero and /dev/[aio] as deleted files
- SSH-7408 - Changed classification of SSH root login with keys
- Docker scan uses new format for maintainer value
- New URL structure on CISOfy website implemented for Lynis controls
---------------------------------------------------------------------------------
## Lynis 2.6.6 (2018-07-06)
### Changed
* New format of changelog (https://keepachangelog.com/en/1.0.0/)
* KRNL-5830 - Improved log text about running kernel version
### Fixed
* Under some condition no hostid2 value was reported
* Solved 'extra operand' issue with tr command
---------------------------------------------------------------------------------
Lynis 2.6.5 (2018-06-26)
Tests:
------
* [MAIL-8804] - Exim configuration test
* [NETW-2704] - Use FQDN to test status of a nameserver instead of own IP address
* [SSH-7402] - Improved test to allow configurations with a Match block
---------------------------------------------------------------------------------
Lynis 2.6.4 (2018-05-02)
Changes:
--------
* Several contributions merged, including grammar improvements
* Initial support for Ubuntu 18.04 LTS
* Small enhancements for usage
Tests:
------
* [AUTH-9308] - Made 'sulogin' more generic for systemd rescue shell
* [DNS-1600] - Initial work on DNSSEC validation testing
* [NETW-2704] - Added support for local resolver 127.0.0.53
* [PHP-2379] - Suhosin test disbled
* [SSH-7408] - Removed 'DELAYED' from OpenSSH Compression setting
* [TIME-3160] - Improvements to detect step-tickers file and entries
---------------------------------------------------------------------------------
Lynis 2.6.3 (2018-03-07)
Changes:
--------
* Change in routine for host identifiers
Tests:
------
* [CRYP-7902] - Do prevalidation for certificates before testing them
* [HRDN-7222] - Enhanced compiler permission test
* [NAME-4402] - Improved test to filter out empty lines
* [PKGS-7384] - Changes to detect yum-utils package and related tooling
Plugins:
--------
* [PLGN-2680] - cron file permissions
---------------------------------------------------------------------------------
Lynis 2.6.2 (2018-02-13)
Changes:
--------
* Bugfix for Arch Linux (binary detection)
* Textual changes for several tests
* Update of tests database
---------------------------------------------------------------------------------
Lynis 2.6.1 (2018-01-26)
Changes:
--------
* Tests can have more than 1 required OS (e.g. Linux OR NetBSD)
* Added 'system-groups' option to profile (Enterprise users)
* Overhaul of default profile and migrate to new style (setting=value)
* Show warning if old profile options are used
* Improved detection of binaries
* New group 'usb' for tests related to USB devices
Tests:
------
* [FILE-6363] - New test for /var/tmp (sticky bit)
* [MAIL-8802] - Added exim4 process name to improve detection of Exim
* [NETW-3030] - Changed name of dhcp client name process and added udhcpc
* [SSH-7408] - Restored UsePrivilegeSeparation
* [TIME-3170] - Added chrony configuration file for NetBSD
---------------------------------------------------------------------------------
Lynis 2.6.0 (2018-01-18)
Changes:
--------
* Binary paths are now sorted
* Greek language added
* systemd detection improved
* VirtualBox detection extended
* Several code enhancements
Tests:
------
* [PHP-2379] - Small enhancement to resolve error on screen in some cases
* [MALW-3280] - Improved detection for BitDefender tooling
---------------------------------------------------------------------------------
Lynis 2.5.9 (2018-01-12)
Changes:
--------
* Don't show upgrade notice when being quiet/silent
* Added --noplugins as an alias to skip execution of plugins
* Use PATH variable for path detection, with predefined list as a backup
Tests:
------
* [KRNL-6000] - Multiple values are now allowed per sysctl key
* [KRNL-6000] - Individual tests can be skipped (skip-test=KRNL-6000:<sysctl-key>)
* [KRNL-6000] - Solution text has been added
---------------------------------------------------------------------------------
Lynis 2.5.8 (2017-12-28)
Changes:
--------
* Check for empty files improved on several locations
* New allow-auto-purge setting in profile for short-lived systems
* Additional checks for log and report file
* Changes to support time synchronization in old and newer systemd releases
* Enhanced output for systems other than Linux
Plugins:
--------
* New class (hardware) added and enabled in default profile
---------------------------------------------------------------------------------
Lynis 2.5.7 (2017-10-29)
Changes:
--------
* Update of Portuguese translation
* Added --silent as alias for --quiet
* Reduced screen output when running non-privileged
* IsRunning function now allows full name process match
---------------------------------------------------------------------------------
Lynis 2.5.6 (2017-10-27)
Changes:
--------
* Added additional keywords for banners
* DirectAdmin extensions
* Enhancements to process detection
* Spanish translation extended
* Extended HP-UX support
* Only show relevant messages in report
Tests:
------
* [NETW-2705] - Allow local resolvers to bypass requirement for 2+ name servers
* [SSH-7408] - Define default 'delayed' compression as a sane value for SSH tests
* [SHLL-6220] - Improved detection of shell settings
---------------------------------------------------------------------------------
Lynis 2.5.5 (2017-09-07)
Changes:
--------
* Minor release to solve errors on screen
Tests:
------
* CRYP-7902 - certificate validation changed
---------------------------------------------------------------------------------
Lynis 2.5.4 (2017-09-05)
Changes:
--------
* Improve systemd detection
* Detect Linux Mint version
* Older versions of Mac OS X are detected as well
* Norwegian translation added
* PAM plugin extended
Tests:
------
* CRYP-7902 - certificate validation changed
* FIRE-4508 - Improved screen output
* PKGS-7380 - NetBSD vulnerability detection adjusted
* TOOL-5002 - Improved detection of Ansible directories and files
---------------------------------------------------------------------------------
Lynis 2.5.3 (2017-08-17)
Changes:
--------
* DirectAdmin location added
* Small adjustments to text
* Enhanced detection for LXC and LXC
* Added /opt/apache as a target location
* Default log directory set for HP-UX
* Screen output improvements
Tests:
------
* CRYP-7902 - Prevent test from showing error on screen
* FILE-6310 - Detection of mount point now match exact name
* HRDN-7230 - Show single line when no malware scanner was detected
* NETW-3006 - Updated detection of MAC addresses on Linux
* PKGS-2379 - Improvement for OpenBSD usage of PHP suhosin
* TOOL-5002 - Detection capabilities for Ansible added
---------------------------------------------------------------------------------
Lynis 2.5.2 (2017-07-10)
Changes:
--------
- Support for PHP on CloudLinux
- Check for presence of locale binary
- Suhosin detection improvements
- Generic code improvements
- Changed 'lynis audit system remote' routine
- Support for macOS High Sierra
- French translation updated
Lynis Enterprise:
-----------------
- Allow 'tags' and 'system-customer-name' to be specified via Lynis client
Tests:
------
* CONT-8102 - Check for dockerd instead of docker -d
* FIRE-4594 - Check for presence Advanced Policy Firewall (APF)
* PKGS-2379 - New test for PHP suhosin extension status
* PKGS-7370 - Only use debsums on Debian
* KRNL-6000 - Added kernel.dmesg_restrict testing
---------------------------------------------------------------------------------
Lynis 2.5.1 (2017-05-31)
Changes:
--------
- Hebrew translation by Dolev Farhi
- Improved detection of SSL certificate files
- Minor changes to improve logging and results
Tests:
------
* BOOT-5104 - Added support for macOS
* FIRE-4524 - Determine if CSF is in testing mode
* HTTP-6716 - Improved log message
---------------------------------------------------------------------------------
Lynis 2.5.0 (2017-05-03)
During the development of this release, the project got informed about a flaw
that possibly could be abused by a local attacker. Even with the small risk of
success, upgrading is highly recommended. See details on
[CVE-2017-8108](https://cisofy.com/security/cve/cve-2017-8108/)
This release is a special maintenance release with focus on cleaning up the code
for readability and future expansion.
Changes:
--------
* Use ROOTDIR variable instead of fixed paths
* Introduction of IsEmpty and HasData functions for readability of code
* Renamed some variables to better indicate their purpose (counting, data type)
* Removal of unused code and comments
* Deleted unused tests from database file
* Correct levels of identation
* Support for older mac OS X versions (Lion and Mountain Lion)
* Initialized variables for more binaries
* Additional sysctls are tested
Tests:
------
* MALW-3280 - Extended test with Symantec components
* PKGS-7332 - Detection of macOS ports tool and installed packages
* TOOL-5120 - Snort detection
* TOOL-5122 - Snort configuration file
---------------------------------------------------------------------------------
Lynis 2.4.8 (2017-03-29)
Changes:
* More PHP paths added
* Minor changes to text
* Show atomic test in report
Tests:
------
* MAIL-8820 - New Postfix configuration check
* TOOL-5002 - Extended Puppet detection
---------------------------------------------------------------------------------
Lynis 2.4.7 (2017-03-22)
Changes:
* Minor code cleanups
Tests:
------
* BANN-7126 - Added more words to test for
* CUPS-2308 - Improve logging for CUPS configuration test, removed exception handler
* HTTP-6641 - Support detection for Apache module mod_reqtimeout
* PKGS-7388 - Minor change to detect security repositories
---------------------------------------------------------------------------------
Lynis 2.4.6 (2017-03-15)
Changes:
--------
* Added FileInstalledByPackage function (dpkg and rpm supported)
* Mark Arch Linux version as rolling release (instead of unknown)
* Support for Manjaro Linux
* Escape files when testing if they are readable
* Code cleanups
Tests:
------
* CRYP-7902 - Test more certificates names, but only if they are not part of a package
* FILE-7524 - Reduce standard screen output for file permissions check
* MALW-3280 - Added Avira detection as a malware scanner
* NAME-4018 - Only perform name services test when resolv.conf file exists
* PKGS-7387 - Check all repositories if they use GPG signing
* SCHD-7704 - Permission checks
* TIME-3104 - Check permissions before open files
---------------------------------------------------------------------------------
Lynis 2.4.5 (2017-03-09)
Changes:
--------
* Allow host alias to be specified in profile
* Code readability enhancements
* Solaris support has been improved
Tests:
------
* AUTH-9328 - Add missing 0027 and 0077 umasks
* BOOT-5104 - Add initsplash and minor code enhancements
* DBS-1882 - Include Redis configuration file
* FIRE-4502 - Improved detection for iptables modules when using OpenVZ
* PKGS-7381 - Enhanced package audit for FreeBSD
---------------------------------------------------------------------------------
Lynis 2.4.4 (2017-03-01)
Changes:
--------
* Fix for upload function to be used from profile
* Reduce screen output for mail section, unless --verbose is used
* Code cleanups and removed 'update release' command
Tests:
------
* AUTH-9308 - Improved test for sulogin string (Debian systems)
* FILE-6372 - Properly deal with comment on lines in /etc/fstab
* MAIL-8817 - New test to check Postfix configuration for errors
* SSH-7408 - Corrected SSH check
---------------------------------------------------------------------------------
Lynis 2.4.3 (2017-02-22)
Changes:
--------
* Colored output can now be tuned with profile (colors=yes/no)
* Allow data upload to be set as a profile option
Tests:
------
* AUTH-9308 - Improved test for sulogin string
* MAIL-8818 - Test if Linux version is known before comparing in Postfix banner
* TIME-3116 - Skip stratum 16 items for time pools
* TIME-3148 - New test to detect TZ variable
---------------------------------------------------------------------------------
Lynis 2.4.2 (2017-02-15)
Changes:
--------
* Properly detect SSH daemon version
Tests:
------
* AUTH-9208 - Removed double logging
* AUTH-9222 - Improve logging for double groups
* AUTH-9226 - Improve logging for double groups
* BOOT-5177 - Sort systemctl unit files to make them unique
* DBS-1818 - New test to detect MongoDB
* DBS-1820 - New test for MongoDB authentication
* FIRE-4512 - Lowered minimum number of iptables firewall rules
* FIRE-4586 - Fix applied when searching for "-j LOG"
* HRDN-7222 - Changed reporting key of world executable compilers
* SSH-7408 - Added filtering for PermitRootLogin (prohibit-password, OpenSSH 7.0)
---------------------------------------------------------------------------------
Lynis 2.4.1 (2017-02-09)
Changes:
--------
* Generic code improvements
* Improved the update check and display
* Finish, Portuguese, and Turkish translation
* Extended support and tests for DragonFlyBSD
* Option to configure hostid and hostid2 in profile
* Support for Trend Micro and Cylance (macOS)
* Remove comments at end of nginx configuration
* Used machine ID to create host ID when no SSH keys are available
* Added detection of iptables-save to binaries
Tests:
------
* FIRE-4586 - Check logging for firewall components
* KRNL-5788 - Remove exception and style improvements
* KRNL-5830 - Improved logging
---------------------------------------------------------------------------------
Lynis 2.4.0 (2016-10-27)
Exactly one month after previous release, the Lynis project is proud to announce
a new release. This release had the specific focus to improve support for macOS
users. Thanks to testers and contributors to make this possible.
New:
----
* New group "system integrity" added
* Support for clamconf utility
* Chinese translation (language=cn)
* New command "upload-only" to upload just the data instead of a full audit
* Enhanced support for macOS, including HostID2 generation for macOS
* Support for CoreOS
* Detection for pkg binary (FreeBSD)
* New command: lynis show hostids (show host ID)
* New command: lynis show environment (hardware, VM, or container type)
* New command: lynis show os (show operating system details)
Changes:
--------
* Several new sysctl values have been added to the default profile
* Existing tests have been enhanced to support macOS
Tests:
------
* AUTH-9234 - Support for macOS user gathering
* BOOT-5139 - Support for machine roles in LILO test
* BOOT-5202 - Improve uptime detection for macOS and others
* FIRE-4518 - Improve pf detection and mark as root-only test
* FIRE-4530 - Don't show error on screen for missing IPFW sysctl key
* FIRE-4534 - Check Little Snitch on macOS
* INSE-8050 - Test for insecure services on macOS
* MACF-6208 - Allow non-privileged execution and filter permission issues
* MALW-3280 - Detection for Avast and Bitdefender daemon on macOS
* NETW-3004 - Support for macOS
* PKGS-7381 - Improve test for pkg audit on FreeBSD
* TIME-3104 - Chrony support extended
Plugins (community and commercial):
-----------------------------------
* PLGN-1430 - Gather installed software packages for macOS
* PLGN-4602 - Support for Clam definition check on macOS
---------------------------------------------------------------------------------
Lynis 2.3.4 (2016-09-27)
Changes:
--------
* Skip update message when using the 'show' helper
* Instead of opening the log file, you can now use 'lynis show details' followed
by the test ID. It will show the relevant section.
* Several tests have extended log details
* Many style improvements as part of ongoing refactoring of the code
* Detection of nftables improved
* Replaced cut, sed, tr and others commands with binary variable (for forensics
and future intrusion checking capabilities)
* Swedish translation provided by Peter Carlsson
* Support for arch-audit to scan for presence of vulnerable packages on Arch Linux
* OS detection improved
Tests:
------
* CONT-8107 - New test checking number of Docker containers
* CRYP-7902 - Gather more details regarding certificates
* DBS-1816 - Define skip reason
* FILE-6344 - Adjusted /proc test for hidepid option
* FILE-6362 - Removed warning and add skip reason
* FIRE-4520 - Change test to use detected binary
* FIRE-4520 - New test to check for empty nftables ruleset
* KRNL-5820 - Corrected function and style improvements
* LOGG-2146 - Textual change
* NAME-4408 - Check localhost to IP mapping
* PKGS-7320 - Test for arch-audit tool
* PKGS-7322 - Check vulnerable packages on Arch Linux
* PKGS-7381 - Extended vulnerable package detection for FreeBSD
* TIME-3104 - timedatectl test now detects NTP synchronization properly
---------------------------------------------------------------------------------
Lynis 2.3.3 (2016-08-23)
Upgrade note
------------
Customized profiles that included sysctl settings need to be altered. See
default.prf for the correct format of the lines.
Additions
---------
* OpenStack detection
* Option to disable automatic refresh of software repository
Languages
---------
* Japanese translation added, contributed by Yukio Takahara
Fixes
-----
* Some tests did not show a warning text
* Typo in man page for tests-from-group
Parameters
----------
* New --bin-dirs to define binary directories to scan
* New option --root-dir to specify a different file system to scan
Nginx
-----
* Rewrite of configuration parsing
PHP
---
* Support for PHP 5.6
Redis
-----
* Redis test to detect configuration files
* Test Redis configuration for several best practices
* Perform permission check on Redis configuration files
Experimental features (in development)
--------------------------------------
* --bin-dirs - set what directories should be scanned for binaries
* --root-dir - define the root of the file system, to allow forensics
Settings
--------
* Many settings have a new alias (with dashes instead underscores)
* New setting 'show-report-solution' to show solution in report
Functions
---------
* ExitFatal can now exit program with optional text
* IsNotebook can detect if system is a notebook (or not)
* ShowSymlinkPath and FileIsReadable test for at least one argument
* StoreNginxSettings will save parsed nginx configuration
Tests
-----
* BOOT-5108 - Support for Syslinux bootloader
* DBS-1882 - Redis configuration detection
* DBS-1884 - Redis 'requirepass' check
* DBS-1886 - Redis 'rename-command CONFIG' check
* DBS-1888 - Redis 'bind localhost' check
* FILE-6374 - Improved logging
* KRNL-5830 - Improved logging for detected Linux kernels
* KRNL-6000 - Support for multiple profiles and new format style
* LOGG-2190 - Ignore MySQL files in /tmp from early MySQL 5.x releases
* LOGG-2192 - New test to check opened log files that are empty
Lynis Enterprise integration
----------------------------
* Tag 'redis-server' is added for systems running Redis
---------------------------------------------------------------------------------
Lynis 2.3.2 (2016-08-09)
Categories and Groups
---------------------
Tests are now grouped by their focus area and named 'groups' accordingly.
Besides groups, each test will belong to a category (performance, privacy, or
security).
Commands: lynis show categories, lynis show groups
Options: --tests-from-category, --tests-from-group
Note: You might need to change your scripts if you previously defined the group
of tests to scan.
Development
-----------
A new 'strict' option is available in the profiles and by default enabled for
the initialization phases of Lynis. It will perform a strict code check for the
tests, to detect any uninitialized variables, improving code quality.
Helpers
-------
With 'lynis update check' you can now check for updates. This is the preferred
new method.
The command 'lynis show changelog' allows reviewing the changes. Optionally a
release can be specified as additional argument.
Languages
---------
Initial translation for German has been contributed by Kai Raven. The Italian
translation by Stefano Marty (stefanomarty). Hungarian translation by Zoltan
Paldi (paldiz)
Profiles
--------
Parsing of the profiles has been improved, which prevented some settings from
overriding default settings.
Tests
------
* AUTH-9212 - Added prerequisite to log
* AUTH-9216 - Simplified test and make it more efficient
* AUTH-9218 - Clean ups and improve readability
* AUTH-9226 - Style, text, and removed warning
* AUTH-9228 - Provide just a suggestion instead of warning
* AUTH-9268 - Improve test for readability
* AUTH-9328 - Test /etc/profile.d for umask setting
* AUTH-9406 - Readability and code style changes
* CONT-8102 - Determine if all Docker tests should be performed
* DBS-1880 - Initial support for Redis server
* HTTP-6720 - Readability improvement of test
* KRNL-5830 - Readability and style improvements, ignore rescue images
* MAIL-8818 - Style and refactoring
* PHP-2211 - Readability improvement and code style changes
* PHP-2374 - Changed text and cleanups
* PHP-2376 - Log result to log file instead of report
* PKGS-7383 - Simplified test
* PKGS-7388 - Style and readability improvements
* TIME-3106 - Corrected string to test for status
* TOOL-5102 - Split of fail2ban tests
* TOOL-5104 - Test for enabled fail2ban jails
Languages
---------
Translation of Spanish (es) added
Proper display of text strings when accented characters are used
More text strings added
General
-------
* Added bold and header as new colors
* Changed header and footer of screen output
* Allow atomic tests to be skipped (e.g. SSH-7408)
* Extended tests database with category (lynis show tests)
* By default Lynis will now run in 'quick mode' and not break after each
section. You can get this behavior by adding the --wait option.
Functions
---------
* RemoveColors - New test to clear colors
* DisplayError - Display error on screen in uniform format and colors
Use an optional exit code to quit the program
* SkipAtomicTest - This function is now properly working with lowercase strings
Website
-------
Several controls on the website are added or updated, including:
* FILE-6344
* FINT-4315
* FINT-4402
* HTTP-6714
* MACF-6234
* NAME-4018
* NAME-4402
* PHP-2374
* PROC-3612
* TIME-3106
---------------------------------------------------------------------------------
Lynis 2.3.1 (2016-07-14)
-----------------------------------------------
This is a minor patch to improve upon findings in version 2.3.0.
Changes:
- Convert all skipped tests to uppercase
- Only add license key when it is defined
- Updated French translation
- Exclude custom.prf from tarball (download via website)
--------------------------------------------------------------
Lynis 2.3.0 (2016-07-13)
-----------------------------------------------
We are excited to announce this major release of auditing tool Lynis. Several big
changes have been made to core functions of Lynis. These changes are the next of
simplification improvements we made. There is a risk of breaking your existing
configuration. See the tips below to upgrade.
This release will soon also be available in our software repository. For more
details see https://packages.cisofy.com to install and upgrade Lynis.
Upgrade tips
============
Default profile and custom profiles:
Settings of multiple profiles can now be merged. Instead of making changes to
default.prf, copy your changes to custom.prf. Use 'lynis show profiles' to show
any detected profiles. Only include your changes in custom.prf, to keep the
configuration clean and tidy. They will then overwrite the defaults. Use
'lynis show settings' to see if they are applied.
Check your cron jobs:
When using --quiet, the output will be really quiet now. Use --show-warnings-only
if you still want to see the warnings. Lynis will now exit with error 0, even
when warnings have been found. Use option error-on-warnings=yes (custom.prf) to
exit with code 78 when it has any warnings.
Details
=======
Ansible
-------
New Ansible examples for deployment: https://github.com/CISOfy/lynis-ansible
Databases
---------
Lynis will check also for DB2 instances and report the status.
Developer Mode
--------------
With this release the developer mode is introduced. It can be activated with the
--developer option, or developer-mode=yes in profile. In development mode, some
details are displayed on screen, to help testing of existing or new tests.
To get easy access, a new profile has been added (developer.prf).
Examples:
lynis audit system --profile developer.prf
lynis audit system --developer
A new software development kit (SDK) for Lynis is available on GitHub. This will
help contributors and developers to test software quality, including linting and
running unit tests. The devkit also supports building DEB and RPM files for easy
deployment. The repository can be found on https://github.com/CISOfy/lynis-sdk
Documentation
-------------
Template files have been updated to provide better examples on how to create
custom tests and plugins.
To simplify the usage of Lynis, a new helper utility has been added: show.
This helper will show help, or values (e.g. version, plugin directories, etc).
Some examples include: lynis show options, lynis show commands, lynis show
version, etc. See lynis show for all available details.
File Systems
------------
The XFS file system detection has been added. Mount points /dev/shm and /var/tmp
are now checked for their options. Comparison of the mount options has been
improved. A new test has been added to check if /var/tmp has been bound to /tmp.
Language Support
----------------
Lynis now supports language translations, with the language profile option.
Initial languages: Dutch (nl), English (en), French (fr).
You can help by translating the language files in the db directory.
Mac OS X Improvements
---------------------
Package manager Brew has been added
nginx
-----
Show suggestion when weak protocol is used, like SSLv2 or SSLv3. The protocols
are now also parsed and stored as details in the report file.
Packages
--------
Systems running CentOS, Debian, openSUSE, RHEL, Ubuntu and others, may now use
our own software repository: https://packages.cisofy.com
Performance
-----------
Several performance improvements have been implemented. This includes rewriting
tests to invoke less commands and enhanced hardware detection at the beginning.
Plugins
-------
You can set the plugin directory now also via a profile. First match wins.
Priority: 1) argument, 2) profile, 3) default
--plugindir is now an alias for --plugin-dir
Profiles
--------
Lynis now support multiple profiles. By using a file 'custom.prf', it allows to
inherit values first from default.prf, then merge it with custom.prf.
Several tests have been altered to support multiple profiles.
New profile options:
quick=yes|no (similar to --quick)
developer (see Developer section)
check-value
Remote scanning
---------------
Although Lynis is a aimed on running on local hosts, there is still an ongoing
demand for running remote scans. With 'lynis audit system remote' tips are now
provides to perform such a scan via SSH.
Software
--------
Zypper calls are now marked with a non-interactive flag to prevent it waiting for
any interactive input.
Solaris
-------
Improve execution for Solaris systems.
SSH
---
The configuration of SSH is now parsed from the SSH daemon directly. This enables
handling with new defaults more easily, as OpenSSH sometimes introduces new keys,
or change their default value between versions.
Systemd
-------
Added support for detecting systemd and reporting it as a service manager. The
systemd plugin has been released as a community plugin.
Uploads
-------
Solved a bug which added the proxy configuration twice.
Profile options: upload-tool and upload-tool-arguments
General Improvements
--------------------
The screen output has been improved, to show more meaningful things when some
parameters are missing. Several old variables and lines have been cleaned up.
The Display function now allows the --debug flag. This helps in showing some
lines on screen, which would normally be hidden (e.g. items not found or
matched).
Logging has been improved in different areas, like cleaning up and add more
relevant messages where needed.
The interface colors have been changed, to make it more obvious how the software
can be used. Also the wait line between categories have been altered, to properly
display on systems with a white background.
When no auditor name has been specified, it will say that instead of unknown.
Functions file has been cleaned up, including adding developer debug information
when old functions are still be used. Later on these functions will be deleted,
and therefore placed at the bottom.
Program Options
---------------
* --developer - Enable developer mode
* --verbose - Show more details on screen, reduce in normal mode
* --show-warnings-only - Only show warnings on screen
* --skip-plugins - Disable running any plugins (alias: --no-plugins)
* --quiet - Changed: become really quiet
* --config - Removed: use 'lynis show profiles' instead
Functions
---------
* AddSetting - New function to store settings (lynis show settings)
* ContainsString - New function to search for a string in another one
* Display - Added --debug, showing details on screen in debug mode
- Reset identation for lines which are too long
* DisplayToolTip - New function to display tooltips
* IsDebug - Check for usage of --debug
* IsDeveloperMode - Status for development and debugging (--developer)
* IsDeveloperVersion - Check if release is still under development
* IsRunning - Added return state
* IsVerbose - Check for usage of --verbose
* IsOwnedByRoot - Check ownership of files and directories
* IsWorldWritable - Improved test with additional details
* PortIsListening - Check if a service it listening to a specified port
* SkipAtomicTest - Allow smaller tests to be skipped (e.g. SSH-7408)
Tests
-----
* AUTH-9234 - Test for minimal UID in /etc/login.defs when available
* AUTH-9254 - Allow allow root to use this test, due to permissions
* AUTH-9262 - Restructure of test, support for pwquality PAM
* AUTH-9288 - Only check for accounts which have a maximum password age set
* AUTH-9308 - Check for systemd targets
* BANN-7119 - /etc/motd test disabled
* BANN-7122 - /motd content test disabled
* BOOT-5122 - Extended GRUB password check
* BOOT-5184 - Improve file permissions check for CentOS 7 machines
* DBS-1860 - Check for status of DB2
* CRYP-7902 - Improved logging
* FILE-6354 - Restrict searching in /tmp to mount point only
* FILE-6372 - Properly checking for /etc/fstab now, ignore comments
* FILE-6374 - Added /dev/shm and /var/tmp
* FILE-6374 - New test for /var/tmp
* FILE-6430 - New test for detecting specific filesystems
* FILE-7524 - Support for multiple profiles
* HTTP-6632 - Fix for proper detection of Apache modules
* HTTP-6642 - Test disabled
* HTTP-6710 - Trigger suggestion when weak protocols SSLv2/SSLv3 are used
* KRNL-5788 - Support for kernel with grsecurity patches (linux-image-grsec)
* KRNL-5820 - Improved logging for test
* KRNL-6000 - Allow multiple profiles to be used, store more details
* LOGG-2190 - Improvements for Fail2Ban and cron-related files
* NETW-3014 - Support for multiple profiles
* PKGS-7303 - Added Brew package manager
* PKGS-7354 - Test for DNF repoquery plugin before using it
* PKGS-7381 - Check for vuln.xml file
* PRNT-2306 - Check if files are readable before parsing them
* PROC-3612 - Removed wchan output to prevent grsecurity issues
* SCHD-7702 - Test for running cron daemon
* SCHD-7704 - Test ownership of cronjob files
* SSH-7408 - Show weak configurations of SSH on screen as a suggestion
* TOOL-5102 - Test for Fail2ban tooling
* TOOL-5190 - Test for intrusion detection or prevention system
Plugins
-------
* PLGN-1602 - Marked as root-only
* PLGN-2612 - Marked as root-only
* PLGN-2804 - Marked as root-only
* PLGN-3202 - Marked as root-only
--------------------------------------------------------------
Lynis 2.2.0 (2016-03-18)
We are proud to present this new release of Lynis. It is a major upgrade, and the
result of many months of work. This version includes new features and tests, and
many small enhancements. We encourage all to test and upgrade to this latest
release.
* Highlights
------------
The biggest change in this release is the optimization of several functions. It
allows for better detection, and dealing with the quirks, of every single
operating system. Some functions were fortified to handle unexcepted results
better, like missing a particular binary, or not returning the hostname.
This release also enables tests to be shorter, by adding new functions. Some
functions were renamed or slightly changed, to provide more value to the tooling.
Another big change in this release is a wide set of optimizations and quality
testing. Outdated pieces were removed, or rewritten, to support features seen in
newer distributions.
In the area of compliance, adjustments have been made to start supporting more
in-depth testing for this. Ideal for companies who have a particular compliance
need, or want to test and enforce the system hardening levels of their systems.
Last but not least, many small changes make this software easier to use. On
our website we added new guides to provide help and support.
We like to thank our contributors, in particular Kamil Boratyński, Steve Bosek,
and Eric Light. Their contributions helped us greatly shaping this release.
Below are the changes per category:
* Automation tools
------------------
Detection for CFEngine has been improved. Also additional logging and reporting
of automation tools.
* Authentication
----------------
Depending on the operating system, Lynis now tries to determine if failed logins
are properly logged. This includes checking for /etc/login.defs file [AUTH-9408].
Merged previous password check for Solaris into test AUTH-9228. User ids on AIX
will be gathered and added to the report [AUTH-9234].
New plugin is introduced to analyze PAM settings. It including items like:
- Two-factor authentication methods
- Minimum password length, password strength and protection status against brute
force cracking
- Password history
Report option: auth_failed_logins_logged
* Boot
------
Added detection for Mac OSX boot loader. Initial support to test UEFI settings,
including Secure Boot option. Options boot_uefi_booted and
boot_uefi_booted_secure added to report file
* Compliance
------------
This release prepares for upcoming extensions to assist with compliance testing.
The profile has a new option, which can be used to define what standards should
be tested for, if any test is available. The related option is:
compliance_standards
Right now these standards can be selected:
- CIS benchmarks
- HIPAA
- ISO27001/ISO27002
- PCI DSS
Note that additional tests will be implemented in future releases and then tagged
to these particular standards.
* DNS and Name services
-----------------------
Support added for Unbound DNS caching tool [NAME-4034], including a configuration
check [NAME-4036].
Record if a name caching utility is being used like nscd or Unbound. Also logging
to report as field name_cache_used
* Firewalls
-----------
Test for IPFW firewall on FreeBSD has been improved: status of pflogd will no
longer be displayed, when pf is not available.
New test FIRE-4532 introduced for detection of the Mac OS X application firewall.
Also, the status of application firewalls is audited now.
FIRE-4508 is another new test, which tests chains of iptables and their default
policy (ACCEPT or DROP). This release also supports the upcoming nftables
technology with new test FIRE-4536. It is expected that it will replace iptables
later on, so this test will perform a status check. Additional FIRE-4548 will
perform a version detection of the userland utility nft and determine if there
are any rules configured.
Renamed FIRE-4511 to FIRE-4502.
* File Integrity Monitoring
---------------------------
Test added to include osqueryd as a supported tool.
* Hardware
----------
Detection of firewire is enhanced (both ohci and core detected).
* Logging
---------
Extended the test syslog-ng logging to remote systems. The log Lynis itself
produces is also enhanced, to be more detailed for several tests.
* Malware
---------
ESET and LMD (Linux Malware Detect) have been added. Discovered malware scanners
are also logged to the report.
* Mount points
--------------
FILE-6374 is expanded to test for multiple common mount points and define best
practice mount flags.
* Networking
------------
Best practices for IPv6 configuration on Linux are now collected. Also network
interface names from most operating systems.
* Operating systems
-------------------
Improved support for Debian 8 systems, and displaying Gentoo for Gentoo-based
systems. Detection of VMware release has been added. Boot loader exception is not
longer displayed when only a subset of tests is performed. FreeBSD systems can
now use service command to gather information about enabled services.
Several paths have been added to allow better detection on systems running
FreeBSD and others.
* Passwords
-----------
AUTH-9286 change has been extended to both capture minimum and password age.
* Proxy support
---------------
A proxy can now be specified in the profile, to allow uploads via a HTTP or SOCKS
proxy.
* Service Managers
------------------
SystemV init is now detected.
* Software and Packages
-----------------------
Now information will be logged when vulnerable software packages were found.
Support for DNF (Dandified YUM) for Fedora systems has been added. This is done
in several tests: PKGS-7350 (installed packages), PKGS-7352 (security notices),
PKGS-7354 (integrity tests).
* SSH
-----
Multiple configuration tests of SSH are now merged into SSH-7408. This enables
easier testing later on and reduces repetition.
* Virtual machines and Containers
---------------------------------
Detection of virtual machines has been extended in several ways. Now VMware tools
(vmtoolsd) are detected and machine state is improved with tools like Puppet
Facter, dmidecode, and lscpu. Properly detect Docker on CoreOS systems, where it
before gave error as it found directory /usr/libexec/docker. Check file
permissions for Docker files, like the socket file [CONT-8108].
* Individual tests
------------------
[AUTH-9204] Exclude NIS entries to avoid false positives
[AUTH-9230] Removed test as it was merged into AUTH-9228
[AUTH-9234] Support for AIX added
[AUTH-9288] Test for expired passwords
[AUTH-9328] Show correct message when no umask is found in /etc/profile. It also
includes improved logging, and support for other operating systems.
[BOOT-5104] Rewrote test to detect SysV init and other service managers
[BOOT-5106] New test to test boot loader on Mac OS X
[BOOT-5180] Only gets executed if runlevel 2 is found
[CONT-8108] New test to test for Docker file permissions
[DBS-1816] Removed suggestion
[FILE-6310] Add more details to test when a symlinked path has been found
[FILE-6410] Added /var/lib/locatedb as search path
[FINT-4338] Added osquery test
[FIRE-4508] Added chains test for iptables
[FIRE-4511] Renamed to FIRE-4502
[FIRE-4536] Support for nftables detection
[FIRE-4538] Basic configuration check for for nftables
[HOME-9310] Use POSIX compatible flags to avoid errors on BusyBox
[HTTP-6622] Determine Apache version and log to report
[HTTP-6624] Ignore wildcard and default entries as ServerName for Apache
[LOGG-2154] Additional support for log destinations for syslog-ng
[MALW-3278] New test to detect LMD (Linux Malware Detect)
[NAME-4406] Changed logic for localhost check and more detailed logging
[NETW-2600] IPv6 configuration check for Linux
[NETW-3032] Added ARP monitoring software test
[PKGS-7308] Split package name and version for RPM based package manager
[PKGS-7350] Support for installed packages via Fedora DNF package manager (Dandified YUM)
[PKGS-7352] Query security notices for DNF
[PKGS-7354] Perform integrity tests for package database (DNF)
[SHLL-6230] Test for umask values in shell configuration files (e.g. rc files)
[STRG-1842] New test for checking authorized USB devices
[TIME-3104] Show only suggestion on FreeBSD systems if ntpdate is configured
[TIME-3170] New test to check NTP configuration files
* Functions
-----------
[CreateTempFile] Create a temporary file
[DigitsOnly] New function to extract only numbers from a text string
[DisplayManual] New function to show text on screen without any markup
[ExitCustom] New function to allow program to exit with a different exit code, depending on outcome
[GetHostID] If no MAC address is found, use SSH keys for creation of a host identifier
[IsWordWritable] Changed return codes for easier usage of the function
[LogText] Replaces the older logtext function
[RandomString] Creates a random string of characters
[RemoveTempFiles] Remove any created temporary files
[Report] Replaces the older report function
[ReportSuggestion] Allows two additional parameters to store details
(text and external reference to a solution)
[ReportWarning] Like ReportSuggestion() has additional parameters
[ShowComplianceFinding] Display compliance findings
[ShowSymlinkPath] Ensure readlink is available
* General improvements
----------------------
- When using pentest mode, it will continue without any delays (=quick mode).
- Plugins execution is improved, with improved logged and counting of active
plugins.
- Data uploads: provide help when self-signed certificates are used.
- Improved output for tests which before showed results as a warning, instead of
just as a suggestion.
- Lynis now uses different exit codes, depending on errors or finding warnings.
This helps with automation and any custom scripting you want to apply.
- Preparations to allow compressing the Lynis report file and enhance uploads.
- Added --config option to show what settings file or profile is used.
- Tool tips are displayed, to make Lynis even easier to use.
- Show a warning if the release is older than four months.
- PID file has additional checks, including cleanups.
* Plugins
---------
[PAM] New plugin available in all versions of Lynis
[PLGN-2602] Replaced mktemp commands with CreateTempFile function
[PLGN-2804] Limit report output of EXT file systems to 1 item per line
--------------------------------------------------------------
Lynis 2.1.1 (2015-07-22)
This release adds a lot of improvements, with focus on performance, and
additional support for common Linux distributions and external utilities.
We recommend to use this latest version.
* Operating system enhancements
-------------------------------
Support for systems like CentOS, openSUSE, Slackware is improved.
* Performance
-------------
Performance tuning has been applied, to speed up execution of the audit on
systems with many files. This also includes code cleanups.
* Automatic updates
-------------------
Initial work on an automatic updater has been implemented. This way Lynis
can be scheduled for automatic updating from a trusted source.
* Internal functions
--------------------
Not all systems have readlink, or the -f option of readlink. The
ShowSymlinkPath function has been extended with a Python based check, which
is often available.
* Software support
------------------
Apache module directory /usr/lib64/apache has been added, which is used on
openSUSE.
Support for Chef has been added.
Added tests for CSF's lfd utility for integrity monitoring on directories and
files. Related tests are FINT-4334 and FINT-4336.
Added support for Chrony time daemon and timesync daemon. Additionally NTP
sychronization status is checked when it is enabled.
Improved single user mode protection on the rescue.service file.
* Other
-------
Check for user permissions has been extended.
Python binary is now detected, to help with symlink detection.
Several new legal terms have been added, which are used for usage in banners.
In several files old tests have been removed, to further clean up the code.
* Bug fixes
---------
Nginx test showed error when access_log had multiple parameters.
Tests using locate won't be performed if not present.
Fix false positive match on Squid unsafe ports [SQD-3624].
The hardening index is now also inserted into the report if it is not displayed
on screen.
* Functions
---------
Added AddSystemGroup function
* New tests
---------
Several new tests have been added:
* [PKGS-7366] Scan for debsecan utility on Debian systems
* [PKGS-7410] Determine amount of installed kernel packages
* [TIME-3106] Check synchronization status of NTP on systemd based systems
* [CONT-8102] Docker daemon status and gather basic details
* [CONT-8104] Check docker info for any Docker warnings
* [CONT-8106] Check total, running and unused Docker containers
* Plugins
---------
* [PLGN-2602] Disabled by default, as it may be too slow for some machines
* [PLGN-3002] Extended with /sbin/nologin
* Documentation
---------------
A new document has been created to help with the process of upgrading Lynis.
It is available at https://cisofy.com/documentation/lynis/upgrading/
--------------------------------------------------------------
Lynis 2.1.0 (2015-04-16)
* General
---------
Screen output has been improved to provide additional information.
* OS support
------------
CUPS detection on Mac OS has been improved. AIX systems will now use csum
utility to create host ID. Group check have been altered on AIX, to include
the -n ALL. Core dump check on Linux is extended to check for actual values
as well.
* Software
----------
McAfee detection has been extended by detecting a running cma binary.
Improved detection of pf firewall on BSD and Mac OS. Security patch checking
with zypper extended.
* Session timeout
-----------------
Tests to determine shell time out setting have been extended to account for
AIX, HP-UX and other platforms. It will now determine also if variable is
exported as a readonly variable. Related compliance section PCI DSS 8.1.8
has been extended.
* Documentation
---------------
- New document: Getting started with Lynis
https://cisofy.com/documentation/lynis/get-started/
* Plugins (Enterprise)
----------------------
- Update to file integrity plugin
Changes to PLGN-2606 (capabilities check)
New configuration plugins:
* PLGN-4802 (SSH settings)
* PLGN-4804 (login.defs)
Download link: https://cisofy.com/download/lynis/
--------------------------------------------------------------
Lynis 2.0.0 (2015-02-25)
The first release within the 2.x branch! It includes several new features, to
simplify or improve auditing on Unix based systems, including BSD, Linux,
Mac OS and more traditional systems like AIX, HPUX and Solaris.
New features and many improvements are the reason for the bump to a major
release, also a beginning of a new era. Many tools to audit or harden systems
have being released, yet none have been maintained over a long period of time.
Lynis Support and Feedback
--------------------------
This software is supported and under development by CISOfy. By providing a
dual license, this software is kept up-to-date and enhanced. Both customers
and the community, benefit from this licensing. This release is available
thanks to your input and feedback.
Lynis Helpers
-------------
New in this release is the support for helpers. Small utilities which enhance
Lynis by providing a single goal. The first helper available is to audit
Docker build files.
Lynis Improved OS support
-------------------------
Many changes have been implemented to better support Linux, FreeBSD, NetBSD
DragonBSD and OpenBSD in particular. Upcoming releases will include smaller
"improvement rounds" for other systems as well.
Lynis New technologies
----------------------
More utilities and technologies are supported now. Technologies and tools
like systemd, Docker, nftables.
Lynis Lynis Enterprise
----------------------
As this code is shared, customers have an additional option to define to
what server they want to upload the audit results. Also, commercial plugins
have been bundled.
Lynis New parameters
--------------------
Several new options have been added:
* --dump-options (see all options)
* --report-file (define a different location for the report file)
Lynis General
-------------
Documentation on the website has been extended: https://cisofy.com/support/
The man page, Lynis binary and several tests have improved texts.
This release is exceptional in that it includes many changes. We have done
a lot of testing on different platforms. You could expect this software to be
stable. Still, an assumption is no guarantee and especially no substitution
for testing in your own environment. If you encounter issues, please report
them via one of the links above in this changelog.
Enjoy this new release!
================================================================================
Lynis 1.6.4 (2014-11-04)
New:
- Boot loader detection for AIX [BOOT-5102]
- Detection of getcap and lsvg binary
- Added filesystem_ext to report
- Detect rootsh
Changes:
- Hide errors when RPM database is faulty and show suggestion instead [PKGS-7308]
- Allow OpenBSD to gather information on listening network ports [NETW-3012]
- Don't trigger warning for Shellshock when doing segfault test [SHLL-6290]
- Do not run Apache test on OpenBSD and strip control chars [HTTP-6624]
- Extended AIDE test with configuration validation test [FIND-4314]
- Improved Shellshock test regarding non-Linux support [SHLL-6290]
- Added support for gathering volume groups on AIX [FILE-6311]
- Properly parse PAM lines and add them to report [AUTH-9264]
- Support for boot loader detection on OpenBSD [BOOT-5159]
- Added uptime detection for OpenBSD systems [BOOT-5202]
- Support for volume groups on AIX [FILE-6312]
- Redirect errors when searching for readlink binary
---------------------------------------------------------------------------------
Lynis 1.6.3 (2014-10-14)
New:
- Added tests for Shellshock bash vulnerability [SHLL-6290]
- Added test to determine if Snoopy is used [ACCT-9636]
- New test for qdaemon configuration file [PRNT-2416]
- Test for GRUB boot loader password [BOOT-5122]
- New test for qdaemon printer jobs [PRNT-2420]
- Added ClamXav test for Mac OS X [MALW-3288]
- Gentoo vulnerable packages test [PKGS-7393]
- New test for qdaemon status [PRNT-2418]
- Gentoo package listing [PKGS-7304]
- Running Lynis without root permissions will start non-privileged scan
- Systemd service and timer example file added
- Added grub2-install to binaries
Changes:
- Adjustments so insecure SSL protocols are detected in nginx config [HTTP-6710]
- Directories will be skipped when searching for nginx log files [HTTP-6720]
- Only gather unique name servers from /etc/resolv.conf [NAME-2704]
- Properly detect mod_evasive on Gentoo and others [HTTP-6640]
- Improved swap partition detection in /etc/fstab [FILE-6336]
- Improvements to kernel detection (e.g. Gentoo) [KRNL-5830]
- Test for built-in security options in YUM [PKGS-7386]
- Improved boot loader detection for GRUB2 [BOOT-5121]
- Split GRUB test into two tests [BOOT-5122]
- Added Mac OS uptime check [BOOT-5202]
- Improved GetHostID function for systems having only ip binary
- Improved testing for symlinked binary directories
- Minor adjustments to log output
- Renamed dev directory to extras
---------------------------------------------------------------------------------
Lynis 1.6.2 (2014-09-22)
New:
- IsVirtualMachine function to check if system is running in VM
VM types: Bochs CPU emulation, IBM z/VM, KVM, Linux Containers,
libvirt LXC driver (Linux Containers), Microsoft Virtual PC, OpenVZ,
Oracle VM VirtualBox, QEMU, Systemd Namespace container,
User-Mode Linux (UML), VMware products, XEN
- Detection for SaltStack configuration management tooling
- ShowSymlinkPath function to check path behind a symlink
- Check of configuration options of pacman [PKGS-7314]
- Support for drill binary to check for Lynis update
- FileIsEmpty function to check for empty files
- Detect updates for Arch Linux [PKGS-7312]
- Add detection for machine ID (systemd)
- Added linux_config_file to report
- Bash completion script for Lynis
- Added detection of ss binary
Changes:
- Extended system reboot check, to enable it for most Linux versions[KRNL-5830]
- Improved inetd test to avoid false positive with xinetd process [INSE-8002]
- Permissions check has been adjusted to allow packaging and pentest mode
- Added detection for compressed Linux config file [KRNL-5728]
- Added support for compressed Linux config file [KRNL-5730]
- Store PID file in home directory of the user, if needed
- Added usage of ss to gather listening ports [NETW-3012]
- Additional permission added to CUPS check [PRNT-2307]
- Extended telnet in inetd test [INSE-8016]
- Fix for reading at.deny file [SCHD-7720]
- Removed individual warnings [BOOT-5184]
- Several improvements for Arch Linux
---------------------------------------------------------------------------------
Lynis 1.6.1 (2014-09-09)
New:
- Added --pentest parameter to run a non-privileged scans (e.g. for pentesting)
- Show skipped tests in report if they require root and scan is non-privileged
Changes:
- Improved vulnerable packages test on Debian based systems (apt-check) [PKGS-7392]
- Don't show warnings for 'swap' in 4th column fstab file [FILE-6336]
- Remove warning for old files in /tmp [FILE-6354]
- CheckUpdates function will have better output when no connection is available
- Changes to parameters and functions, to allow penetration tests with Lynis
- Test for actual files in /etc/modprobe.d before grepping in it
- Improved chown command when file permissions are incorrect
- Changed output of update test, show when status is unknown
- No scanning of symlinked directories (binaries test)
- Extended SafePerms function to also check for UID
- Several tests will have root-only bit set now
- Improved netstat tests on Arch Linux
---------------------------------------------------------------------------------
Lynis 1.6.0 (2014-08-27)
New:
- Added several new plugins to default profile
- HostID detection for AIX
Changes:
- Improvements for log file
- GetHostID function improved
- Improved detection of security repository for Debian based systems [PKGS-7388]
- Set default values for update check, to avoid error message on screen
- Cleanup for mail section, adding IMAP and POP3 protocols
---------------------------------------------------------------------------------
Lynis 1.5.9 (2014-07-31)
New:
- New NetBSD test for vulnerable software packages [PKGS-7380]
- Test if Debian based systems need a reboot [KRNL-5830]
- Test for running Sendmail daemon [MAIL-8880]
- Test for availability of mtree [FINT-4330]
- Check for lp daemon (printing) [PRNT-2314]
- Added Qmail status detection [MAIL-8860]
- New NetBSD boot loader test [BOOT-5126]
- Added test for automation tools like Cfengine and Puppet [TOOL-5002]
- Added KRNL-5830 control to website
- Added detection for Puppet
- Added tooling category
Changes:
- Security repository test extended with /etc/apt/sources.list.d [PKGS-7388]
- Added exception case for CUPS configuration (listen statement) [PRNT-2308]
- Improved detection of TMOUT setting in shell profile file [SHLL-6220]
- Perform promiscuous interfaces test for NetBSD as well [NETW-3014]
- Perform swap partition parameters test on all systems [FILE-6336]
- Also check password file on DragonFlyBSD and NetBSD [AUTH-9208]
- Show message regarding toor user for all systems [AUTH-9204]
- Check for available interfaces on NetBSD as well [NETW-3004]
- Extended UFS file system test with FFS support [FILE-6329]
- Improvements for step-tickers file test [TIME-3160]
- Perform sockstat test for NetBSD [NETW-3012]
- Gather IP addresses for NetBSD [NETW-3008]
- Test MAC addresses on NetBSD [NETW-3006]
- Added /usr/X11R7/bin directory to search for binaries
- Improved full qualified domain name (FQDN) check for Linux
- Don't show follow-up hints when there are no warnings or suggestions
- Improved IsRunning function to better target processes
- Several smaller adjustments in text and descriptions
- Extended ReportException function with logging text
- Improved GetHostID function for NetBSD and Solaris
- Added printing_daemon and mail_daemon to report
- Binaries extended with tools like kstat, puppet
---------------------------------------------------------------------------------
Lynis 1.5.8 (2014-07-24)
New:
- Testing for commercial anti-virus solutions like McAfee and Sophos [MALW-3280]
- New control text for MALW-3280 - http://cisofy.com/controls/MALW-3280/
Changes:
- Extended GRUB test with encrypted password (SHA1) [BOOT-5121]
- Check /etc/profile for multiple umask values [AUTH-9328]
- Extended PHP disabled functions test [PHP-2320]
- Add gpgcheck parameter to YUM test [PKGS-7387]
- Squid configuration file permissions test adjusted and control added to website [SQD-3613]
- Logging has been extended and exceptional event text adjusted
---------------------------------------------------------------------------------
Lynis 1.5.7 (2014-07-09)
New:
- Implementation of SafePerms function
- Added notification when exceptions are found
Changes:
- Fix for error_log handling in nginx
---------------------------------------------------------------------------------
Lynis 1.5.6 (2014-06-12)
New:
- Test for PHP binary and PHP version
- Don't perform register_global test for systems running PHP 5.4.0 and later [PHP-2368]
- Debug function (can be activated via --debug or profile)
Changes:
- Extended IsRunning function
- Removed suggestion from secure shell test [SHLL-6202]
- Check for idle session handlers [SHLL-6220]
- Also check for apache2 binary (file instead of directory)
- New report values: session_timeout_enabled and session_timeout_method
- New report value for plugins: plugins_enabled
- Fixed test to determine active TCP sessions on Linux [NETW-3012]
---------------------------------------------------------------------------------
Lynis 1.5.5 (2014-06-08)
New:
- Check for nginx access logging [HTTP-6712]
- Check for missing error logs in nginx [HTTP-6714]
- Check for debug mode in nginx [HTTP-6716]
Changes:
- Extended SSL test for nginx when using listen statements
- Allow debugging via profile (config:debug:yes)
- Check if discovered httpd file is actually a file
- Improved temporary file creation related to security notice
- Adjustments to screen output
Security Note:
This releases solves two issues regarding the usage of temporary
files (predictability of the file names). You are advised to upgrade
to this version as soon as possible. For more information see the
our blog post: http://linux-audit.com/lynis-security-notice-154-and-older/
---------------------------------------------------------------------------------
Lynis 1.5.4 (2014-06-04)
New:
- Check additional configuration files for nginx [HTTP-6706]
- Analysis of nginx settings [HTTP-6708]
- New test for SSL configuration of nginx [HTTP-6710]
Changes:
- Altered SMBD version check for Mac OS
- Small adjustments to report for readability
---------------------------------------------------------------------------------
Lynis 1.5.3 (2014-05-19)
New:
- Support for zypper package manager
- Gather installed packages with Zypper on SuSE systems [PKGS-728]
- Check for vulnerable packages with Zypper package manager [PKGS-7330]
Changes:
- Check for aide.conf also in /etc [FINT-4315]
- Adjusted screen output for unreliable NTP peers [TIME-3120]
- Adjusted check kernel test for non-Linux systems [KRNL-5730]
- Improved screen output on AIX systems with echo command
---------------------------------------------------------------------------------
Lynis 1.5.2 (2014-05-05)
New:
- Support for runlevel in binaries test
Changes:
- Added suggestion for kernel availability check [KRNL-5788]
- Added suggestion for services at startup and proper binary call [BOOT-5180]
- Added suggestion to configure accounting on FreeBSD [ACCT-2754]
- Added suggestion to configure Linux process accounting [ACCT-9622]
- Several new controls listed on website
- Adjusted hardening index if total score was zero
- Added suggestion for auditd.conf file [ACCT-9632]
- Removed suggestion for audit log file [ACCT-9634]
- Removed warning from NTP falsetickers test, added data to report [TIME-3132]
- Removed warning from NTP selected time source test [TIME-3124]
---------------------------------------------------------------------------------
Lynis 1.5.1 (2014-04-22)
Changes:
- Extended reporting with running databases and frameworks
- Adjusted Oracle status in test [DBS-1840]
- Extended grsecurity test [RBAC-6272]
- Redirect rpcinfo errors to /dev/null
- Adjusted color scheme
---------------------------------------------------------------------------------
Lynis 1.5.0 (2014-04-10)
New:
- Support for Amazon Linux
- NTP check for step-tickers file (Red Hat and clones) [TIME-3160]
Changes:
- Minor textual changes in description of several controls
- Removed several warnings (usage of suggestions instead)
- Website has now more information for several controls
- Extended detection for Oracle Linux
- Updated the FAQ and README files
---------------------------------------------------------------------------------
Lynis 1.4.9 (2014-04-03)
New:
- Added links in report to related control documentation on website
- Detect Linux I/O kernel scheduler [KRNL-5730]
Changes:
- Check for non-unique accounts on several platforms [AUTH-9208]
- Set initial discover value for PAM modules to zero [AUTH-9268]
---------------------------------------------------------------------------------
Lynis 1.4.8 (2014-03-27)
Changes:
- Adjusted resolv.conf domain setting in report [NAME-4016]
- Extend account test with /var/log/pacct [ACCT-9620]
- Added suggestion to DNS domain name test [NAME-4028]
- Changed text strings of ZFS test [FILE-6330]
- Extend LILO password test [BOOT-5139]
- Set default value for pf firewall
---------------------------------------------------------------------------------
Lynis 1.4.7 (2014-03-21)
New:
- New configuration item to set group name
- Search for AIDE configuration file (aide.conf) [FINT-4315]
- Check for usage of SHA256/SHA512 in AIDE configuration [FINT-4316]
- Added grep to list of binaries
Changes:
- Added suggestion when using NIS or NIS+ [NAME-4302]
- Clean-up of unneeded plugin section
- Small typo fix
---------------------------------------------------------------------------------
Lynis 1.4.6 (2014-03-14)
New:
- Check for GPG signing in yum.conf [PKGS-7387]
- Check CUPS configuration file permissions [PRNT-2307]
Changes:
- Screen cleanup
---------------------------------------------------------------------------------
Lynis 1.4.5 (2014-03-08)
New:
- Support for Chakra Linux
- Support for pacman binary (package manager)
- Query installed packages on systems with pacman [PKGS-7310]
Changes:
- Avoid logging to screen when falsetickets are found [TIME-3132]
- Skipping FIFO file on Solaris systems when checking for cron jobs [TIME-3104]
- Extended uptime test for Solaris systems [BOOT-5202]
- Added /usr/lib/security to PAM locations to scan
- Report cronjobs to report [SCHD-7704]
- HostID support for Solaris
- Improved color scheme
- Extended logging
---------------------------------------------------------------------------------
Lynis 1.4.4 (2014-03-03)
New:
- Detect tune2fs binary
- Added ExitFatal() function
- Added egrep binary to binaries
- Initial plugin support (phase 1)
- Added InsertPluginSection() function
Changes:
- Adjusted disabled functions tests to properly find functions [PHP-2320]
- Extended time test with egrep binary replace for Solaris [TIME-3104]
- Adjusted color for SNMP test when warning is found [SNMP-3306]
- Adjusted text for PHP risky functions [PHP-2320]
- Refer to discovered binaries for ifconfig, lsmod, tune2fs
- Test plugin directory when provided by --plugin-dir
- Scan report extended with plugin information
- Extended help for Enterprise options
- Improved IsRunning() function
- Extended color scheme
---------------------------------------------------------------------------------
Lynis 1.4.3 (2014-02-23)
New:
- Support for ClearOS
- Data upload for Lynis Enterprise users (--upload)
- Added debug variable for troubleshooting purposes
- Scan profile option license_key
Changes:
- Skip password check for Red Hat or clones [AUTH-9282]
- Extended single user login protection [AUTH-9308]
- Adjusted repolist check for yum based systems [PKGS-7383]
- Inserted sleep time when update is found
- Extended report output
---------------------------------------------------------------------------------
Lynis 1.4.2 (2014-02-19)
Changes:
- Ignore interfaces aliases for HostID
- Extended umask tests with pam_umask entries [AUTH-9328]
- Check for supressed version on Squid [SQD-3680]
---------------------------------------------------------------------------------
Lynis 1.4.1 (2014-02-15)
New:
--plugin-dir parameter
Changes:
- Added 64 bits locations for Apache modules
- Add start of new category to logfile
- Extended sysstat test with /etc/cron.d/sysstat [ACCT-9626]
- Extended cron job tests with entries start with asterix (*) [SCHD-7704]
- Additional check for multiple umask entries (like RHEL 6.x) [AUTH-9328]
- Adjusted PHP test for register_globals (explicit test) [PHP-2368]
- Small adjustments for upcoming plugin support
- Extended man page
---------------------------------------------------------------------------------
Lynis 1.4.0 (2014-01-29)
Changes:
- Removed some warnings, to prevent double messages
- Extended accounting check for Linux [ACCT-9622]
- Added consistency check to time test [TIME-3124]
- Added support for anacron jobs [SCHD-7704]
- Rewrite of YUM repository test [PKGS-7383]
- Use binary variables for hostid creation
- AIX version detection changed
- Added rpcinfo to binaries check
- Ignore LANG global setting
- Improved logging
---------------------------------------------------------------------------------
Lynis 1.3.9 (2014-01-09)
Changes:
- Additional support for Mac OS
- Support for shasum binary
- Performance adjustment for lsof tests
- Extended interface check for hostid creation
- Improved NSCD detection [NAME-4032]
- Bug fix for passwdqc [AUTH-9262]
- Extended vulnerable packages test [PKGS-7392]
- Hide possible sysctl errors [KRNL-5820]
---------------------------------------------------------------------------------
Lynis 1.3.8 (2013-12-25)
New:
- New parameter --view-categories to display available test categories
- Added /etc/hosts check (duplicates) [NAME-4402]
- Added /etc/hosts check (hostname) [NAME-4404]
- Added /etc/hosts check (localhost mapping) [NAME-4406]
- Portmaster test for possible port upgrades [PKGS-7378]
- Check for SPARC improve boot loader (SILO) [BOOT-5142]
- NFS client access test [STRG-1930]
- Check system uptime [BOOT-5202]
- YUM repolist check [PKGS-7383]
- Contributors file added
Changes:
- Improved locate database check and reporting [FILE-6410]
- Improved PAE/No eXecute test for Linux kernel [KRNL-5677]
- Disabled NIS domain name from test [NAME-4028]
- Extended NIS domain test to check BSD sysctl value [NAME-4306]
- Extended PAM tools check with PAM paths [AUTH-9262]
- Adjusted Apache check to avoid skipping it [HTTP-6622]
- Extended USB state testing [STRG-1840]
- Extended Firewire state testing [STRG-1846]
- Extended core dump test [KRNL-5820]
- Added /lib/i386-linux-gnu/security to PAM directories
- Added /usr/X11R6/bin directory to binary paths
- Improved readability of screen output
- Improved logging for several tests
- Improved Debian version detection
- Added warning to BIND test [NAME-4206]
- Extended binaries with showmount and yum
- Updated man page
---------------------------------------------------------------------------------
Lynis 1.3.7 (2013-12-10)
New:
- Function FileExists() and SearchItem()
Changes:
- Adjusted yum-security check [PKGS-7386]
- Improved check for iptables binary check
- Extended report with the tests executed and skipped
---------------------------------------------------------------------------------
Lynis 1.3.6 (2013-12-03)
New:
- Support for the dntpd time daemon
- New Apache test for modules [HTTP-6632]
- Apache test for mod_evasive [HTTP-6640]
- Apache test for mod_qos [HTTP-6641]
- Apache test for mod_spamhaus [HTTP-6642]
- Apache test for ModSecurity [HTTP-6643]
- Check for installed package audit tool [PKGS-7398]
- Added initial support for new pkgng and related tools [PKGS-7381]
- Check for ssh-keyscan binary
- ZFS support for FreeBSD [FILE-6330]
- Test for passwordless accounts [AUTH-9283]
- Initial OS support for DragonFly BSD
- Initial OS support for TrueOS (FreeBSD based)
- Initial OS support for elementary OS (Luna)
- GetHostID for DragonFly, FreeBSD, NetBSD and OpenBSD
- Check for DHCP client [NETW-3030]
- Initial support for OSSEC (system integrity) [FINT-4328]
- New parameter --log-file to adjust log file location
- New function IsRunning() to check status of processes
- New function RealFilename() to determine file name
- New function CheckItem() for parsing files
- New function ReportManual() and ReportException() to simplify code
- New function DirectoryExists() to check existence of a directory
- Support for dntpd [TIME-3104]
Changes:
- Extended pf checks for FreeBSD/OpenBSD and others [FIRE-4518]
- Extended test to gather listening network ports for Linux [NETW-3012]
- Adjusted lsof statement to ignore warnings (e.g. fuse) [LOGG-2180] [LOGG-2190]
- Added suggestion for discovered shells on FreeBSD [AUTH-9218]
- Extended core dump test with additional details [KRNL-5820]
- Properly display suggestion if portaudit is not installed [PKGS-7382]
- Ignore message if no packages are installed (pkg_info) [PKGS-7320]
- Also try using apt-check on Debian systems [PKGS-7392]
- Adjusted logging for RPM binary on systems not using it [PKGS-7308]
- Extended search in cron directories for rdate/ntpdate [TIME-3104]
- Adjusted PHP check to find ini files [PHP-2211]
- Skip Apache test for NetBSD [HTTP-6622]
- Skip test http version check for NetBSD [HTTP-6624]
- Additional check to supress sort error [HTTP-6626]
- Improved the way binaries are checked (less disk reads)
- Adjusted ReportWarning() function to skip impact rating
- Improved report on screen by leaving out date/time and type
- Redirect errors while checking for OpenSSL version
- Extended reporting with firewall status and software
- Adjusted naming of some operating systems to make them more consistent
- Extended update check by using host binary if dig is not installed
- Count number of installed binaries/packages and report them
- Report about log rotation tool and status
- Updated man page
---------------------------------------------------------------------------------
Lynis 1.3.5 (2013-11-19)
New:
- OS detection for Mageia Linux, PCLinuxOS, Sabayon Linux and Scientific Linux
- Added some initial systemd support (e.g. boot services)
- Test to display if any known MAC framework is implemented [MACF-6290]
Changes:
- Improved support for Slackware Linux (OS and version detection)
- Added systemd support (boot and running services) for Linux systems [BOOT-5177]
- Added systemd support (default runlevel) for Linux systems [KRNL-5622]
- Extended USB storage check in modprobe.d directory [STRG-1840]
- Improved output, reporting and check for kernel update [KRNL-5788]
- Optimized code and output of test to check writable scripts [BOOT-5184]
- Fixed detection for writable scripts [BOOT-5184]
- Improved detection IPv6 addresses for Slackware and others [NETW-3008]
- Minor addition to SSH PermitRootLogin check [SSH-7412]
- Extended cronjob tests, reporting and logging [SCHD-7704]
- Extended umask check in /etc/profile [AUTH-9328]
- Added suggestion about BIND version [NAME-4210]
- Merged test NTP daemon test TIME-3108 into TIME-3104
- Improved support for Arch Linux (output, detection)
- Extended common list of directories with SSL certifcates in profile
- New function GetHostID() to determine an unique identifier of the machine
- Added a tests_custom file template
- Perform file permissions test on tests_custom file
- Improved OS detection and extended logging on several tests
- Several layout improvements
- Extended update check functions and output
- Cleaned up reporting and extended it with exceptions
---------------------------------------------------------------------------------
Lynis 1.3.4 (2013-11-08)
New:
- OS detection support for Arch Linux
- Support for systemd journal
Changes:
- Test for files in /etc/modprobe.d directory [STRG-1840]
- Extended log daemon detection with systemd journal [LOGG-2130]
- Adjusted hardening value for compiler GCC [HRDN-7222]
- Extended IsWorldWritable and IsWorldExecutable functions to support symlinks
- Adjusted PHP test for disabled functions [PHP-2320]
- Extended testing for PHP files in other directories [PHP-2211]
- Improved screen output for several tests and extended logging
---------------------------------------------------------------------------------
Lynis 1.3.3 (2013-10-24)
New:
- Added NTP configuration type to report [TIME-3104]
Changes:
- Do not warn on empty shells for FreeBSD systems [AUTH-9218]
- Extended checks for presence NTP client or daemon [TIME-3104]
- Extended logging
---------------------------------------------------------------------------------
Lynis 1.3.2 (2013-10-09)
New:
- Test for PowerDNS authoritive servers (master/slave status) [NAME-4238]
Changes:
- CUPS test extended with hardening rules [PRNT-2308]
- Added hardening points to sticky bit on /tmp [FILE-6362]
- Extended Ubuntu security packages check [PKGS-7392]
- Improved update check, show when no check is performed
- Added additional check for binaries, so checks on CentOS work correctly
- Added word 'restricted' to banner strings
- Adjusted wording for Debian packages purge [PKGS-7346]
- Corrected listing of purgable packages [PKGS-7346]
- Adjusted yum-plugin-security check due to package changes [PKGS-7386]
---------------------------------------------------------------------------------
Lynis 1.3.1 (2013-10-02)
Changes:
- Updated generic references in files
- Fixed detection of several binaries (AFICK/awk)
- Performance tweaks when checking for binaries
- Fixed core dump check and dumpable sysctl [KRNL-5820]
- Force test to always to check for binaries [FILE-7502]
- Changed detection to egrep [DBS-1840]
- Adjusted variable checking for Solaris [HOME-9310]
- Adjusted search in modprobe directory [STRG-1840] [STRG-1846]
---------------------------------------------------------------------------------
Lynis 1.3.0 (2011-12-25)
New:
- Profile option: ignore_home_dir
- TCP wrappers category added
- Tooling category added
- Initial extensions to support plugins in the future
- Test for unpurged Debian packages [PKGS-7346]
- Test for compiler permissions [HRDN-7222]
Changes:
- Converted all dates to ISO format and updated copyright lines
- Correct suggestion for file integrity tool [FINT-4350]
- Added hint when RPM list is empty on DPKG based systems [PKGS-7308]
- Changed logging for /etc/security/limits.conf file [KRNL-5820]
- Fixed incorrect warning for single user mode [AUTH-9308]
- Improved output for stratum 16 time servers [TIME-3116]
- Added suggestion and screen output for kernel hardening [KRNL-6000]
- Screen layout optimalizations and log file improvements
- Improved list/layout of scan options
- Improved binary check for compilers
- Added configuration option in scan profile (show_tool_tips, default true)
---------------------------------------------------------------------------------
Lynis 1.2.9 (2009-12-15)
New:
- Support for Squid3
- Added Squid unsafe ports check [SQD-3624]
- Added Squid configuration file permission check [SQD-3613]
- Added Squid test: reply_body_max_size option [SQD-3630]
- Added /etc/init.d/rc and /etc/init.d/rcS to umask test [AUTH-9328]
- Check PHP option allow_url_include [PHP-2378]
Changes:
- Extended possible Squid configuration file locations
- Added additional sysctl keys to default profile
- Fixed typo in squid.conf checks
- Improved descriptions, logging and reporting for several tests
- Corrected /etc/security/limits.conf path in test [KRNL-5820]
- Updated man page, limited lines to 80 chars
---------------------------------------------------------------------------------
Lynis 1.2.8 (2009-12-08)
New:
- Squid support added
- Squid daemon detection [SQD-3602]
- Squid configuration file search [SQD-3604]
- Squid version detection [SQD-3606]
- Check /etc/motd banner [BANN-7122]
- Check /etc/issue.net file [BANN-7128]
- Check contents in /etc/issue.net [BANN-7130]
- Solaris single user mode login check (/etc/default/sulogin) [AUTH-9304]
- HP-UX boot authentication check [AUTH-9306]
- Linux single user mode authentication check [AUTH-9308]
- Solaris account locking policy check [AUTH-9340]
Changes:
- Added prerequisite to SSH test, so the test is skipped properly [SSH-7440]
- Check for /etc/issue symlink [BANN-7124]
- Added file check for possible harmful shells found [AUTH-9218]
- Add user home directories to report [HOME-9302]
- Extended Linux run level test with support for Debian/Ubuntu [KRNL-5622]
- Added /lib64/security to PAM test [AUTH-9262]
- Extended security repository check [PKGS-7388]
- Iptables check should not check for a module in a Linux config [FIRE-4511]
- Ignore APC ups daemon when scanning for CUPS [PRNT-2304]
- Improved kernel logger daemon check [LOGG-2138]
- Added auditctl to binary check [ACCT-9630]
- Log used auditd ruleset [ACCT-9630]
- Corrected logging of Solaris c2audit module [ACCT-9656]
- Fixed warning function for Solaris passwordless accounts [AUTH-9254]
- Commented kern.randompid in default profile
- For sysctl the parameter -n will be used on Linux systems
- Changed syslog daemon detection and state
- Extended report file
---------------------------------------------------------------------------------
Lynis 1.2.7 (2009-11-01)
New:
- Added Kernel Hardening section
- Sysctl audit support in scan profile and related test [KRNL-6000]
- SSH option StrictModes test [SSH-7416]
- Password aging limit check [AUTH-9286]
- Ubuntu packages check (apt-show-versions) [PKGS-7394]
- Check for metalog daemon [LOGG-2210]
- USB storage driver state check [STRG-1840]
- Firewire storage driver state check [STRG-1846]
- PostgreSQL process check [DBS-1826]
- Oracle process check [DBS-1840]
- Default umask check [AUTH-9328]
- Check for rsyslog daemon [LOGG-2230]
- RFC 3195 compliant daemon check [LOGG-2240]
- Qmail SMTP daemon check [MAIL-8940]
- Test for separation of /tmp and /home from root file system [FILE-6310]
- SSH AllowUsers and AllowGroups usage check [SSH-7440]
- AIX support, thanks to Michael Smerdka
Changes:
- Fixed crontabs path [SCHD-7704]
- Extended locate database paths for Linux and FreeBSD [FILE-6410]
- pflog detection fix [FIRE-4518]
- Skip /proc/meminfo for non Linux systems [PROC-3602]
- Extended text with rsyslogd [LOGG-2130]
- Ignore comment and empty lines for group tests [AUTH-9222/9226]
- Show firewall as active when iptables is available in config file [FIRE-4511]
- Variable fix for SNMP daemon configuration file [SNMP-3304]
- Freshclam check fix [MALW-3286]
- Fixed waiting search for NIS domain [NAME-4306]
- Check for a maximum of 1 search statement in /etc/resolv.conf [NAME-4018]
- Apache test improved [HTTP-6622]
- Skip klogd test if rsyslogd is available [LOGG-2138]
- Added additional CUPS location to search paths
- Only execute PAM test for systems with PAM [AUTH-9268]
- Fixed logging of sudoers file location [AUTH-9250]
- Improved FreeBSD support for NTP client check [TIME-3104]
- Redirect warning "Unknown host" when DNS domain name is empty [NAME-4028]
- Redirect warning when host name is empty
- Fixed warning color [AUTH-9226]
- Fixed FreeBSD COPYRIGHT file test [BANN-7113]
- Changed text for sudoers text [AUTH-9250]
- Improved text for DNS search domain [NAME-4016]
- Skip nginx configuration test if nginx is not available [HTTP-6704]
- Removed portsclean suggestion [PKGS-7348]
- Fixed non unique IDs
- Fixed cosmetic issue when using Debian with default dash shell
- Improved hostname detection for HP-UX
- Added additional php.ini file locations
- Moved Linux default shell check to OS detection functions
- Fixed CUPS daemon test [PRNT-2304]
- Also check for uppercase chars in issue file [BANN-7126]
---------------------------------------------------------------------------------
Lynis 1.2.6 (2009-04-05)
New:
- Sudoers file permissions check [AUTH-9252]
- Core dumps configuration check for Linux [KRNL-5820]
- PHP disabled functions check [PHP-2320]
- PHP enable_dl function check [PHP-2374]
- PHP allow_url_fopen function check [PHP-2376]
- OpenBSD smtpd status check [MAIL-8920]
- /etc/issue check [BANN-7124]
- /etc/issue legal keywords check [BANN-7126]
- Show suggestions in report
Changes:
- Extended support for Red Hat, CentOS and Fedora
- Extended ACL test to test for default mount options as well [FILE-6368]
- Exim status test fixed [MAIL-8812]
- Corrected yum security check [PKGS-7386]
- Replaced LDAP test AUTH-9238 with [AUTH-9402]
- Removed backquotes when locate database is not available [FILE-6410]
- Added /etc/openldap to search path for OpenLDAP
- Fixed typo in crontab path [SCHD-7704]
- Don't show message "No volume groups found" if LVM isn't used [FILE-6310]
- Corrected Syslog-NG status [LOGG-2132]
- Moved TODO to dev directory
---------------------------------------------------------------------------------
Lynis 1.2.5 (2009-03-27)
New:
- slapd.conf check [LDAP-2224]
- atd status test [SCHD-7718]
- Check LDAP module in PAM [AUTH-9278]
- Check Dovecot status check [MAIL-8838]
- Check log directories from newsyslog.conf [LOGG-2162]
- Check log directories from static list [LOGG-2170]
- Check log directories from logrotate configuration [LOGG-2150]
- syslog check for remote logging [LOGG-2154]
- Open log files check [LOGG-2180]
- Deleted file check [LOGG-2190]
- Solaris active kernel modules check [KRNL-5770]
- Solaris audit daemon status check [ACCT-9650]
- Solaris audit daemon service status [ACCT-9652]
- Solaris audit daemon BSM check [ACCT-9654]
- Solaris audit logging location check [ACCT-9662]
- Solaris audit statistics check [ACCT-9672]
- Check for installed compiler [HRDN-7202]
- BIND process check [NAME-4202]
- BIND configuration file check [NAME-4204]
- BIND configuration consistency check [NAME-4206]
- BIND version check via DNS [NAME-4210]
- Default domain check (/etc/resolv.conf) [NAME-4016]
- Search domains in /etc/resolv.conf check [NAME-4018]
- Parse /etc/resolv.conf options [NAME-4020]
- Solaris /etc/nodename check [NAME-4026]
- DNS domain checks [NAME-4028]
- NSCD status check [NAME-4032]
- PowerDNS presence check [NAME-4230]
- PowerDNS configuration file check [NAME-4232]
- PowerDNS backend check [NAME-4236]
- ypbind status check [NAME-4302]
- Log specific defined SSH daemon options [SSH-7408]
- SSH protocol version check [SSH-7414]
- NIS domain checks [NAME-4304]
- Check pending at jobs [SCHD-7724]
- LVM volume group scan [FILE-6310]
- LVM volumes check [FILE-6312]
- Locate database check [FILE-6410]
- nginx configuration file check [HTTP-6704]
- Exim status check [MAIL-8802]
- Postfix status check [MAIL-8814]
Changes:
- atd needs to run before testing at files [SCHD-7720]
- Removed Solaris OS requirement from logrotate test [LOGG-2148]
- Sanitized output from logrotate test [LOGG-2148]
- Skip comment fields in loghost check [LOGG-2152]
- Changed auditd tests to Linux only
- Binary scan optimized and partially combined with other check
- Only perform iptables tests if kernel module is active
- Don't show message when /etc/shells can't be found [SHLL-6211]
- Check /var/spool/cron/crontabs first, if it exists [SCHD-7704]
- Renumbered FreeBSD test SHLL-7225 [SHLL-6202]
- Renumbered malware test MALW-3292 [HRDN-7230]
- Improved grep on process status [PRNT-2304]
- Ignore comment lines for nginx log file check [HTTP-6720]
- Added file check for nginx log files [HTTP-6720]
- Display IP addresses only of NTP tests [TIME-3124]
- Fixed Postfix configuration directory path [MAIL-8816]
- Redirected output of yum package duplicate check [PKGS-7384]
- Ignore comment lines for lilo test [BOOT-5139]
- Fixed incorrect iptables status and correct logging [FIRE-4511]
- Check SNMP configuration only if SNMP daemon runs [SNMP-3304]
- Don't scan PAM directories which are symlinks [AUTH-9268]
- Changed hardening category to hardening_tools
- Adjusted hardening points of several tests
- Log and display improvements for several tests
---------------------------------------------------------------------------------
Lynis 1.2.4 (2009-03-17)
New:
- NTP daemon process test [TIME-3108]
- NTP association ID's check from peer list [TIME-3112]
- NTP time source candidates test [TIME-3128]
- NTP falseticker check [TIME-3132]
- NTP protocol version check [TIME-3136]
- Stratum 16 ntp peers check [TIME-3116]
- Unreliable ntp peers check [TIME-3120]
- Preferred NTP time source test [TIME-3124]
- auditd presence check [ACCT-9628]
- auditd rules check [ACCT-9630]
- auditd configuration file check [ACCT-9632]
- auditd log file location check [ACCT-9634]
- cupsd status check [PRNT-2304]
- cupsd configuration file check [PRNT-2306]
- cupsd address configuration test [PRNT-2308]
- pam.conf configuration check [AUTH-9264]
- pam.d configuration file scan [AUTH-9266]
- PAM modules check [AUTH-9268]
- rpcinfo query [STRG-1902]
- NFS version number check [STRG-1904]
- NFS protocol and port number check [STRG-1906]
- NFS status check [STRG-1920]
- NFS exports check [STRG-1926]
- NFS empty /etc/exports [STRG-1928]
- SSH PermitRootLogin option check [SSH-7412]
- at.allow and at.deny check [SCHD-7720]
- File integrity tool check [FINT-4350]
- nginx process check [HTTP-6702]
- nginx log file test [HTTP-6720]
- ClamAV clamscan presence test [MALW-3282]
- ClamAV daemon check [MALW-3284]
- ClamAV freshclam check [MALW-3286]
- Check for presence malware scanner [MALW-3292]
- clamscan, ntpq binary check
- NTP daemon role and profile option
- Parameter --tests-category, to scan one or more categories
- Category added (Storage: NFS)
- Added hardening points to tests
- Display hardening index to report
Changes:
- Extended logrotate test [LOGG-2148]
- Added check for inetd.conf before performing test [INSE-8016]
- Added /var/spool/crontabs to search path [TIME-3104]
- Added log line to sysstat test [ACCT-9626]
- Improved screen output on Solaris
- Checking for both rdate and ntpdate in cron files [TIME-3104]
- Changed yum-security package check [PKGS-7386]
- Change output if dig isn't available [NETW-2705]
- Added IPv6 support and output adjustment [NETW-2704]
- Cosmetic change for host based firewall check [FIRE-4590]
- Corrected output in log file [PKGS-7388]
- Corrected passwd options for Red Hat [AUTH-9282]
- Changed text if everything is ok (no warnings)
- Log improvements
---------------------------------------------------------------------------------
Lynis 1.2.3 (2009-03-02)
New:
- Added syslog-NG daemon check [LOGG-2132]
- Added klogd status test [LOGG-2138]
- Added check to determine minilogd presence [LOGG-2142]
- Added logrotate configuration test [LOGG-2146]
- Added check for loghost entry on Solaris machines [LOGG-2152]
- Added ipf test for Solaris [FIRE-4526]
- Added uname -n test (Solaris) [NAME-4024]
- Added ssh daemon configuration file check [SSH-7404]
- Added BSD newsyslog.conf file check [LOGG-2160]
- Added inetd status check [INSE-8002]
- Added inetd.conf configuration check [INSE-8004]
- Added check for inetd.conf when inetd is not active [INSE-8006]
- Added telnet check via inetd [INSE-8016]
- Added ACL check on root file system [FILE-6368]
- Added check for firewall/packet filter on system [FIRE-4590]
- Added lograte file check [LOGG-2148]
- Added snmp daemon status test [SNMP-3302]
- Added snmp configuration file test [SNMP-3304]
- Added default snmp community strings test [SNMP-3306]
- Added categories: Insecure services and SNMP
- Added binary searches for awk, ipf
Changes:
- Changed profile name in default profile
- Added path /usr/ucb to binary paths
- Changed color to white if slapd is not running [LDAP-2219]
- Changed test PKG-7345 into PKGS-7345
- Changed logging for several tests [PKGS-7302] [NETW-3004]
- Extended FAQ
- Changed default profile header
Fixes:
- Hostname detection under Solaris
- Disabled tests PROC-3612 PROC3614 for Solaris machines
- Disabled NTP check in cron.d directory on Solaris [TIME-3104]
- Added result at line when querying system users [AUTH-9234]
- Counters (N+1) fixed for some shells, like Solaris
- Removed unneeded line for Solaris test [PROC-3604]
- Disabled grsecurity test for Solaris [RBAC-6272]
- Correct display of files with spaces [FILE-6354]
- Changed several tests so they work correctly with Solaris
---------------------------------------------------------------------------------
Lynis 1.2.2 (2009-02-15)
New:
- Support for MySQL client
- New test: Test for empty MySQL root password [DBS-1816]
- New test: SSH daemon status test [SSH-7402]
- New test: sysstat account information [ACCT-9626]
- New test: connections in WAIT state [NETW-3028]
- Lynis displays a warning now, if current version is really outdated
- New parameter option (log_tests_incorrect_os) to minimize logging
Changes:
- Several adjustments to default profile
- Fixed option 'skip_test_always' to let it function properly
- Fixed passwd check for SuSE systems [AUTH-9282]
- Added error redirect for dpkg test [PKG-7345]
- Improved NTP test and messages, excluded check when using xen [TIME-3104]
- Extended DNS nameserver check with local resolver [NETW-2704]
- Skip double nameserver check when a local resolver is found [NETW-2705]
- Renamed tests_nameserver to tests_nameservices
- Improved log output [AUTH-9218]
Notes:
- Custom profiles should be compared to the default profile, due small changes
in the structure.
---------------------------------------------------------------------------------
Lynis 1.2.1 (2008-09-05)
New:
- Added support for Samba
- Added support for SELinux framework
- New test: SELinux presence test [MACF-6232]
- New test: SELinux status checks [MACF-6234]
- New test: password PAM availability check [AUTH-9262]
- New test: expire date check for accounts [AUTH-9282]
- Added new option --tests, to run a small set of tests only
Changes:
- Report and logging messages improved
- Output reduced when using --tests
- Added suggestion to PHP expose_php option [PHP-2372]
- Improved log message for PHP register_globals option [PHP-2368]
- Added virtual host count to log file [HTTP-6626]
- Improved Red Hat and clones detection and display
- Fix: Improved promiscuous detection for Linux [NETW-3015]
- Fix: AUTH-9204 test triggered on group ids as well
- Fix: Only display unique MAC addresses [NETW-3006]
- Extended Postfix test [MAIL-8818]
- Don't show /proc/meminfo if not present [PROC-3602]
- Don't show YABOOT information if not present [BOOT-5155]
- Improved portaudit test (FreeBSD) [PKGS-7382]
- Improved portsclean test (FreeBSD) [PKGS-7348]
- Added --quiet and --tests options to help and man page
---------------------------------------------------------------------------------
Lynis 1.2.0 (2008-08-26)
New:
- New test: Passwordless Solaris accounts test [AUTH-9254]
- New test: AFICK file integrity [FINT-4310]
- New test: AIDE file integrity [FINT-4314]
- New test: Osiris file integrity [FINT-4318]
- New test: Samhain file integrity [FINT-4322]
- New test: Tripwire file integrity [FINT-4326]
- New tests: NIS and NIS+ authentication test [AUTH-9240/42]
- Initial support added for AFICK, AIDE, Osiris, Samhain, Tripwire
Changes:
- Changed text of grsecurity test [RBAC-6272]
- Optimized FreeBSD boot services test [BOOT-5165]
- Optimized UID 0 test [AUTH-9204]
- Extended login shells test [AUTH-9218]
- PID file message extended and small output improvement
- A log entry will be written when PID files are removed
- Added operating system name to log file when a test is skipped
- Added file available check when using --view-manpage
- Most program variables are initialized now for future additions
---------------------------------------------------------------------------------
Lynis 1.1.9 (2008-08-09)
New:
- New test: AppArmor framework check [MACF-6204]
- New test: FreeBSD boot loader test [BOOT-5124]
- New test: PHP option register_globals [PHP-2368]
- New test: Promiscuous network interfaces (Linux) [NETW-3015]
- Report option 'bootloader' added to several tests
- Added readlink binary check
Changes:
- Extended file check (IsWorldWritable) for symlinks
- Show result if no default gateway is found [NETW-3001]
- Added /usr/local/etc to sudoers test [AUTH-9250]
- Improved FreeBSD banner output [BANN-7113]
- Removed incorrect line at promiscuous interface test [NETW-3014]
- Fix: Show only once the GRUB test output [BOOT-5121]
- Fix: Typo in NTP test [TIME-3104]
- Fix: Skip NTP test in /etc/cron.d if empty [TIME-3104]
- Fix: Initialize values when performing an update check without connection
- Fix: Solaris id function has been fixed
- Disabled FreeBSD double packages tests, due minor issues [PKGS-7303]
- Changed LDAP/MySQL running states [LDAP-2219] [DBS-1804]
- Replaced ifconfig calls with IFCONFIGBINARY
- Renamed tests_auditing to tests_mac_frameworks
- Several tests improved with extended logging
---------------------------------------------------------------------------------
Lynis 1.1.8 (2008-07-16)
New:
- Mac OS X support extended and new options added
Changes:
- Extended default profile
- Improved several screen output lines
- User ID check improved, so it works better with older Solaris versions
- Hostname in output and reports will contain only host now, not FQDN
- Added extra php.ini locations to tests_php
- Replaced 'ps' in tests with PSBINARY value for better support
- Added output to zones test [VIRT-1902]
- Updated description [AUTH-9218]
- Extended ntp daemon/ntpdate check [TIME-3104]
- Added suggestion to bootable scripts check [BOOT_5184]
- Bugfix and improvement for FreeBSD portsclean test [PKGS-7348]
- Added Mac OS support to MAC address gathering test [NETW-3006]
- Added MAC OS support to inet and inet6 addresses test [NETW-3008]
- Extended PHP expose_php test to support additional options [PHP-2372]
- Improved LDAP test so it skips correctly on Mac OS AUTH-9238]
- Bugfix: MySQL status check gave incorrect output [DBS-1804]
---------------------------------------------------------------------------------
Lynis 1.1.7 (2008-06-28)
New:
- New test: check for unused iptables rules [FIRE-4513]
- New test: checking for dead and zombie processes [PROC-3612]
- New test: checking for heavy IO waiting processes [PROC-3614]
- Initial HP-UX support (untested)
- Initial AIX support (untested)
- Added iptables binary check
- Added dig check, for DNS related tests
- Added option --no-colors to remove all colors from screen output
- Added option --reverse-colors for optimizing output at light backgrounds
(Konsole, MacOS terminal etc)
Changes:
- Improved grpck test for SuSE [AUTH-9216]
- Added dig availability check to DNS test [NETW-2704]
- Bugfix: Fixed iptables test if the binary is not located in /sbin [FIRE-4512]
- Bugfix: Improved yum-utils check to display suggestions correctly [PKGS-7384]
- Bugfix: Fixed prerequisites for grpck test [AUTH-9216]
- Improved MySQL check [DBS-1804]
- Changed color at chkconfig boot services test [BOOT-5177]
- Added missing prerequisites output to portaudit test [PKGS-7382]
- Test output for FreeBSD mounts (UFS) improved [FILE-6329]
- Extended OpenLDAP test to avoid finding itself in ps output [LDAP-2219]
- Several tests have their warning reporting improved
- Improved SuSE Linux detection
- Improved syslog-ng detection
- Adjusted README with link to online (extended) documentation
---------------------------------------------------------------------------------
Lynis 1.1.6 (2008-06-19)
New:
- New test: Check writable startup scripts [BOOT-5184]
- New test: Syslog-NG consistency check [LOGG-2134]
- New test: Check yum-utils package and scanning package database [PKGS-7384]
- New test: Test for empty ruleset when iptables is loaded [FIRE-4512]
- New test: Check for expired SSL certificates [CRYP-7902]
- New test: Check for LDAP authentication support [AUTH-9238]
- New test: Read available crontab/cron files [SCHD-7704]
- New test: Query Solaris running zones [VIRT-1902]
- New test: Check availability sudoers file for future tests [AUTH-9250]
- New test: Query all home directories from passwd file [HOME-9302]
- Syslog-NG support added (binary and version check)
- Added new sections: Scheduling, Time and Synchronization, Virtualization
Changes:
- Extended several tests with suggestions and warnings
- Extended GRUB test with GRUB2 check [BOOT-5121]
- Extended iptables firewall test [FIRE-4511]
- Fixed incorrect variable at Linux kernel config display [KRNL-5728]
- Fixed display for file system test [FILE-6023]
- Reassigned some ID's to match others in category
- Improvement of several logging sections and profile options
- Assigned ID to Ubuntu security update check
- Assigned ID to pwck test for Solaris [AUTH-9230]
- Assigned ID to FreeBSD unused distfiles check [PKGS-7348]
- Assigned ID to RPM package query test [PKGS-7308]
- Assigned ID to /tmp sticky bit test [FILE-6362]
- Assigned ID to old temporary files check [FILE-6354]
- Assigned ID to passwd ID 0 test [AUTH-9204]
- Assigned ID to FreeBSD swap partitions [FILE-6332]
- Assigned ID to FreeBSD swap mount options [FILE-6336]
- Assigned ID to nameserver tests [NETW-2704 and NETW-2705]
- Assigned ID to pf consistency check [FIRE-4520]
- Assigned ID to Postfix configuration check [MAIL-8816]
- Assigned ID to Postfix banner check [MAIL-8818]
- Assigned ID to FreeBSD promiscuous port test [NETW-3014]
- Assigned ID to file permissions check [FILE-7524]
---------------------------------------------------------------------------------
Lynis 1.1.5 (2008-06-10)
New:
- Assigned ID to Apache configuration file test [HTTP-6624]
- Added pause_between_tests to profile file, to regulate the speed of a scan
- Assigned ID to dpkg test and solved issue with colon in package names [PKG-7345]
- Assigned ID to Solaris package test [PKG-7306]
- New test: which gathers virtual hosts from Apache configuration files [HTTP-6626]
- New test: read all loaded kernel modules (Linux) [KRNL-5726]
- New test: query available FreeBSD network interfaces [NETW-3004]
- New test: query available IPv4 and IPv6 network addresses [NETW-3008]
- New test: for MAC addresses [NETW-3006]
- New test: check if a Linux kernel configuration file is available [KRNL-5728]
- New test: check boot services for Debian/Ubuntu [BOOT-5180]
- Added Lynx, Nmap, Wget version to log file
- Added support for Oracle enterprise Linux (Unbreakable Linux)
- Added new function ReportWarning for better logging to report file
Changes:
- Improved FreeBSD pkg_info output, logging output and report data [PKG-7302]
- Changed shell history file test, searching files with maxdepth 1 [HOME-9310]
- Extended iptables test, to check Linux kernel configuration file [FIRE-4511]
- Added report warning to promicuous test [NETW-3014]
- Fixed yellow color when being used at text display
- Several logging improvements and cleanups
---------------------------------------------------------------------------------
Lynis 1.1.4 (2008-05-31)
New:
- Added option to disable Lynis upgrade availability test (profile option)
- Added new option --check-update, to display (update) information
- Added stub for malware and file permissions database
- New section 'LDAP Services'
- Support for OpenLDAP added
- Place holders for new tests are added
- Default profile extended
- [FILE-6023] Added test for Linux ext2, ext3, ext4 file systems
- [BOOT-5155] Added check for YABOOT boot loader
Changes:
- [BANN-7119] Improved MOTD banner check
- Improved Apache tests for SuSE and Debian systems
- Debian/Ubuntu file tests improved
- Extended man page
---------------------------------------------------------------------------------
Lynis 1.1.3 (2008-05-21)
New:
- Added security updates check for Fedora, RHEL 5.x, CentOS 5.x
- Added Linux kernel version check
- Most stable tests have an unique ID now
- Skipped tests have their reason to skip logged
- Added /etc/lynis/plugins to searchable plugin directory targets
- Added Register() function, to handle tests, prerequisites and counter
- Added new crypto tests
- Added profile option "test_skip_always" to blacklist a specific test
Changes:
- Extended default profile location for FreeBSD
- Extended accounting test to include pacct as well
- Improved tests from categories: shells
- Disabled skel tests
- Several tests log their warnings into the report file now
- Changed Linux default runlevel test
- Extended man page
Fixes:
- Auditor name didn't get logged properly to report file.
- Changed Debian/Ubuntu kernel update test, so it won't be tested on others
- Exim test failed, due to using an incorrect variable name
---------------------------------------------------------------------------------
Lynis 1.1.2 (2008-05-11)
New:
- Added memory test for Solaris (tested on OpenSolaris)
- Password file consistency check for Solaris
- 32/64 bits OS mode check for Solaris
- Added Slackware detection
- Plugin support (see documentation)
- Added monolithic/modular test for Linux kernels
Changes:
- Improved LILO test and removed double message
- Fixed incorrect message when using --help parameter
- Improved portaudit test (FreeBSD) to show unique packages only
- Updated man page, FAQ, extended documention with plugin information
- Added several php.ini file locations (MacOS X, OpenBSD, OpenSuSE)
** Special release notes [package/ports]: **
- Added several default paths to check for usuable an INCLUDE directory. This
should make packaging Lynis easier for downstream package providers.
- When no profile is set, Lynis will check first /etc/lynis/default.prf,
before setting default.prf (in current work directory) as profile to use.
- New directory added to be installed for future versions: plugins
---------------------------------------------------------------------------------
Lynis 1.1.1 (2008-04-13)
New:
- Added Solaris package manager (pkginfo) to obtain installed packages
- Added new option to profile to whitelist promiscuous interfaces (if_promisc)
- Added vulnerable packages check for Debian/Ubuntu
- Added package database consistency check for Debian/Ubuntu
Changes:
- Only perform boot.conf check for OpenBSD when running on i386
- Changed RemovePIDFile to prevent incorrect file presence check (ie on OpenBSD)
- Better OS detection and display output for Ubuntu systems
- Improved text alignment (display) and logging
- Commented out some of the default profile options
- Updated FAQ, readme, man page
Bug fixes:
- Added missing space at OS detection function
- Fixed /etc/group tests to ignore commented lines
- Fixed sticky bit checking on /tmp, so it won't give incorrect results on
SuSE/Debian systems
---------------------------------------------------------------------------------
Lynis 1.1.0 (2008-04-09)
New:
- Added test: default gateway (Linux/BSD)
- Added boot tasks to report file (boottask)
- Added vulnerable packages to report file (vulnerable_package)
Changes:
- Fixed some typos
- Several improvements in log output
- Changed display of operating system version (Linux)
- Fixed PHP check
---------------------------------------------------------------------------------
Lynis 1.0.9 (2008-03-24)
New:
- Added --quiet option (currently not 100% quiet yet)
- Added a spec file to the project page (see web site)
- Added small INSTALL document
Changes:
- Changed check for PHP (php.ini location)
- Added available shells from /etc/shells to report file
- Updated man page
- Fixed option in main help window for --man option
- Code improvement, splitting up sections to seperated files
---------------------------------------------------------------------------------
Lynis 1.0.8 (2008-02-10)
New:
- Added pf filter rule test
- Added our PID to PID file
- Added warnings, real users, mount points, total tests to report file
Changes:
- Changed Apache configuration file test
- Changed old temporary files check
- Changed test to include ubuntu security repository
- Moved UID check to avoid PID creation as non root user
- Moved most functions to seperated files and several code cleanups
- Improved logging output
- Extended FreeBSD (Copyright file) test
- Changed indentation for many tests
- Changed some typos in notice/warning messages
---------------------------------------------------------------------------------
Lynis 1.0.7 (2008-01-28)
New:
- Test: UFS mount point check (FreeBSD)
- Test: Check swap partitions (FreeBSD)
- Test: find old files in /tmp
- Test: check presence iptables
- Test: check CPU PAE/NX support (Linux)
- Added profile options check
- Added option to skip Debian security repository check (profile option)
- Support for Red Hat and CentOS
Changes:
- Changed report log location to /var/log instead of current work directory
- Changed --help (and -h) to display general help, instead of man page
- Renamed -man option to --man
- Extended profile file (see default.prf)
- Cleaned up code (rewritten several parts of static code to dynamic
functions)
- Added more comments to the program, for curious auditors, developers and
users. Also regrouped parts of text and cleaned useless white spaces.
- General program output improved (spaces, indentation)
- Logging extended
- Updated lynis.spec file (contrib)
- FAQ and README files extended and updated
Bugfixes:
- Changed postfix banner check (thanks to Henk Bokhoven for reporting)
- Extended skel directory test, with -A (ls) option to check hidden files
(used with most Linux variants)
Development:
- Added new mirror
- Updated year number in program and support files
- Added new function Display, to use indentation within lines
- Added function RemovePIDFile before some exit routines, to clean up PID file
- Extracted profile support, parameter support to seperated files
- Created file tests_ports_packages for Ports and Packages
- Deleted lynis.spec file, since it was not working and will be rewritten later
---------------------------------------------------------------------------------
Lynis 1.0.6 (2007-12-26)
New:
- Added Solaris real users test
- Added hostname check
Changes:
- Added chkconfig binary test and changed related services test
- Added 'xargs' to version checks, to replace unwanted chars
- Added more breaks to log file.
- Added sorting to rpm/dpkg listings
- FAQ extended
---------------------------------------------------------------------------------
Lynis 1.0.5 (2007-12-02)
New:
- Test: unique group names
- Test: unique group IDs
- Added check for rpm, chkrootkit and rkhunter binary
- Added function to cleanup at manual interrupt (INT)
- Support added to run Lynis as cronjob (--cronjob)
- Fedora support added
- Added umask 027, to tighten up file permissions
Changes:
- Changed FreeBSD ttys test
- Changed grpck test, to operate in read-only mode
- Changed Postfix test, to check for mail_name value as well
- Changed GPL line in script which said GPL v2
- Extended README
- Show latest update version, if available, at the end of the screen output
- Lots of code cleanup (see Development)
- Some log improvements
- Changed date notation in changelog to preferred European format (with dots
instead of slashes)
Development:
- New function (ShowResult) to avoid repeating the same result line
within the script for standard status values
- Moved program consts to file (include/consts)
- Moved functions to file (include/functions)
- Moved OS detection to file (include/osdetection)
- Added NEVERBREAK to avoid user input (cronjob support)
---------------------------------------------------------------------------------
Lynis 1.0.4 (2007-11-27)
New:
- Test: query real system users (FreeBSD/Linux)
- Added PID file usage, to warn for unclean program states.
- Added SSHd version test
Changes:
- Updated documentation
- Changed sticky bit test (/tmp), to skip symlinks
- Changed /etc/motd test, to skip symlinks
- More code cleanup
- Logging extended and improved
- Screen output slightly changed
---------------------------------------------------------------------------------
Lynis 1.0.3 (2007-11-19)
New:
- Added check for sockstat
- Test: added test for GRUB and password option
- Test: query listening ports (sockstat)
Changes:
- Fixed NTPd check (bug)
- Extended help for 'double installed package' check (BSD systems, pkg_info)
- Extended Debian kernel update check
- Improved OpenBSD support
- Improved Linux specific detection support (Cobalt, CPU Builders, Debian,
E-Smith, Slackware, SuSE/OpenSuSE, Turbo Linux, Yellowdog and others)
- Improved screen output
- Extended logging, with status/impact flags
- [Bugfix] chkconfig test improved
- [Bugfix] Fixed sticky bit test at Debian
- Extended documentation and changelog file
---------------------------------------------------------------------------------
Lynis 1.0.2 (2007-11-15)
New:
- Test: Added check for NTP daemon or client
- Test: file permissions (profile option)
- Added -Q (--quick) parameter, to run the program without needing user
input after every few sections.
Changes:
- Extended documentation (README file) and performed spell check
- Improved screen output (colors, parameter handling and display)
- Cleaned up source code and fixed some bad typos
- Added much more delimiter lines to logfile
- Added version numbers to logfile for used binaries/tools
- Updated list of parameters within Lynis help
---------------------------------------------------------------------------------
Lynis 1.0.1 (2007-11-12)
New:
- Test: check Exim configuration file location
- Test: added memory check (/proc/meminfo)
- Test: run grpck to check group files (if available)
- Test: boot option check for OpenBSD boot loader
- Test: check if pf (Software: firewall) is active
- Test: check LILO password
- Test: check presence of old distfiles (FreeBSD)
- Added check for binaries: httpd, kldstat, openssl, (s)locate
- Added version check for: exim, openssl
- Added -V (--version) parameter, to show version number
- Added breaks between tests
Changes:
- [bug] Changed skel directory check
- Fixed display Apache configuration file
---------------------------------------------------------------------------------
Lynis 1.0.0 (2007-11-08)
New:
- Support for CentOS (Tested: 5 Final)
- Support for Debian (Tested: 4.0)
- Support for FreeBSD (Tested: 6.2)
- Support for Mac OS X (Tested: 10.4)
- Test: Apache (ServerTokens option)
- Test: PHP (expose_php option)
- Test: Postfix (smtpd_banner option)
- Test: check valid shells
- Test: query pkg_info/RPM based systems
- Test: query pkg_info for double installed packages
- Test: query chkprintcap (FreeBSD)
- Test: scan binary directories
- Test: check administrator accounts
- Test: check permissions /etc/motd
- Test: read nameservers from /etc/resolv.conf
- Test: query nameservers and test connectivity
- Test: check promiscuous interfaces (FreeBSD)
- Test: check sticky bit on /tmp directory
- Test: check debian.org security brance in /etc/apt/sources.list
- Test: check kernel update on Debian
- Test: query default Linux run level
- Test: query chkconfig to see which services start at boot
- Test /etc/COPYRIGHT banner check for FreeBSD
- Support for program parameters
- Builtin integrity checks
- Color enhanced output for readability
- Support for profiles/templates
- Report file creation (for reporting/monitoring)
- Extended logfile creation (with system suggestions)
- Added lynis.spec file for RPM creation
- Created project page at website
- Added documentation (README), ToDo list (TODO)
- Man page lynis(8)
Changes:
- No changes
Bugfixes:
- No bugfixes
==========================================================================================
Lynis - Security Auditing and System Hardening for Linux and UNIX - https://cisofy.com
|