1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
|
================================================================================
Lynis - To Do
================================================================================
Author: Michael Boelen (michael@rootkit.nl)
Description: Security and system auditing tool
Website: http://www.rootkit.nl/projects/lynis.html
Support policy: See section 'Support' (README file)
Documentation: See web site, README, FAQ and CHANGELOG file
================================================================================
[+] Open issues
-------------------------------
[+] Project
-------------------------------
[+] General
-------------------------------
- Activate warning when default profile is being used
- Add list of manual audit items, depending on performed tests
- Replace awk instances with ${AWKBINARY}
[+] Forensics
-------------------------------
- Add MD5/SHA1 database
[+] Generic Tests
-------------------------------
- NFS: Check if there is no localhost line in the /etc/export file
- Check /etc/crontab entries (permissions, locations)
- Search for all setuid/setgid files and compare against baseline
- Skel: Red Hat files are hidden, check with ls -al?
- Add MacOS X test for /tmp dir (or redirect location of symlink)
- Samba: make sure it does listen only at one interface (not at WAN)
- Cleanup some tests by combining options (like NETW-3006)
- Check for latest versions of programs
- Check if multiple users have group '0'
- When using --quiet, use long warnings instead of default lines
- Don't show section headers when using --tests
- Show Last logon dates for user accounts
- Show passwords 30 days or older / trivial passwords / password shadowing
- Show duplicate usernames, UIDs and GIDs
- System wide policies including: default files creation mask, login timeout intervals, lockout durations...
- Permissions on selected sensitive files / directories
[+] Applications
-------------------------------
- Debian/Ubuntu: check if apt-listbugs is installed
[+] Databases
-------------------------------
- Warn if MySQL is running on a network interface
- Check for empty root login
- Check Oracle things (tm)
[+] Programming languages/interfaces
-------------------------------
- Paranoid option: set binaries to 750 for perl, python, ruby, cc, gcc, *cc* etc
[+] DNS
-------------------------------
- Bind: check if version is disabled
[+] Firewalls
-------------------------------
- iptables: show chain numbers when rules are unused
[+] Shell/interface/X
-------------------------------
- Check for autolog or timeoutd package
[+] MTA
-------------------------------
- Sendmail: check banner, check file permissions of configuration files
- Exim: check banner
- SMTP (if running): check if a version shows up in banner
[+] Printers/spools
-------------------------------
- Printcap consistency check for Linux/Solaris/MacOS
[+] Tomcat
-------------------------------
- Check if iptables has rules for port 8080, 8009, 8443
- Check if /WEB-INF/ and /META-INF/ are denied in httpd.conf
[+] Reporting
-------------------------------
- Add possibility to mail directly (instead of log to file)
- Find audit templates for reporting (direct post to webserver?)
- Allow bonus points, however check a maximum index score of 100
================================================================================
Lynis - Copyright 2007-2013, Michael Boelen - The Netherlands
http://www.rootkit.nl
|
