开源安全审计工具Lynis

开源安全审计工具Lynis简单介绍
Lynis是一款Linux系统的安全审计以及加固工具,能够进行深层次的安全扫描,其目的是检测潜在的时间并对未来的系统加固提供建议。

这款软件会扫描一般系统信息,脆弱软件包以及潜在的错误配置,执行全面的运行状况扫描,以支持系统强化和合规性测试

官网:https://cisofy.com/lynis/

CentOS7下使用开源安全审计工具Lynis
下面介绍使用Lynis扫描CentOS7系统并进行安全加固
1、配置lynis的源,并安装lynis

1
vi /etc/yum.repos.d/cisofy-lynis.repo
1
2
3
4
5
6
7
[lynis]
name=CISOfy Software - Lynis package
baseurl=https://packages.cisofy.com/community/lynis/rpm/
enabled=1
gpgkey=https://packages.cisofy.com/keys/cisofy-software-rpms-public.key
gpgcheck=1
priority=2
1
yum install lynis

CentOS7下使用开源安全审计工具Lynis

CentOS7下使用开源安全审计工具Lynis

2、使用用lynis扫描系统

1
lynis -h
1
lynis audit system

CentOS7下使用开源安全审计工具Lynis

1
2
3
4
Warnings (1):
----------------------------
! Found some information disclosure in SMTP banner (OS or software name) [MAIL-8818]
https://cisofy.com/lynis/controls/MAIL-8818/

3、根据上面安全加固建议进行安全加固

例如扫描出来的SSH的加固建议有如下加固项

CentOS7一键安全加固及系统优化脚本

修改成如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
sec_ssh() {
echo "============= sec ssh =============" >> ${LOCK} 2>&1
echo -en "${RGB_WAIT}Configuring...${RGB_END}"
sed -i 's/#UseDNS.*$/UseDNS no/' /etc/ssh/sshd_config
sed -i 's/^#LoginGraceTime.*$/LoginGraceTime 60/' /etc/ssh/sshd_config
sed -i 's/^#PermitEmptyPasswords.*$/PermitEmptyPasswords no/' /etc/ssh/sshd_config
sed -i 's/^#PubkeyAuthentication.*$/PubkeyAuthentication yes/' /etc/ssh/sshd_config
sed -i 's/^#MaxAuthTries.*$/MaxAuthTries 3/' /etc/ssh/sshd_config
sed -i "s/#ClientAliveInterval 0/ClientAliveInterval 30/g" /etc/ssh/sshd_config
sed -i "s/#ClientAliveCountMax 3/ClientAliveCountMax 3/g" /etc/ssh/sshd_config
sed -i "s/X11Forwarding yes/X11Forwarding no/g" /etc/ssh/sshd_config
sed -i "s/#AllowAgentForwarding yes/AllowAgentForwarding no/g" /etc/ssh/sshd_config
sed -i "s/#AllowTcpForwarding yes/AllowTcpForwarding no/g" /etc/ssh/sshd_config
sed -i "s/#TCPKeepAlive yes/TCPKeepAlive no/g" /etc/ssh/sshd_config
sed -i "s/#Compression delayed/Compression no/g" /etc/ssh/sshd_config
sed -i "s/#MaxSessions 10/MaxSessions 2/g" /etc/ssh/sshd_config
sed -i "s/#LogLevel INFO/LogLevel VERBOSE/g" /etc/ssh/sshd_config
sed -i "s/#Banner none/Banner \/etc\/issue.net/g" /etc/ssh/sshd_config
echo "Authorized users only. All activity may be monitored and reported.">/etc/issue.net
systemctl restart sshd.service >> ${LOCK} 2>&1
cat /etc/ssh/sshd_config >> ${LOCK} 2>&1
echo -e "\r${RGB_SUCCESS}Configuration Success${RGB_END}"
}

然后执行CentOS7安全加固脚本后,再进行lynis扫描

CentOS7下使用开源安全审计工具Lynis

可以看到目前SSH安全基线只剩下3个安全加固建议

一辈子很短,努力的做好两件事就好;
第一件事是热爱生活,好好的去爱身边的人;
第二件事是努力学习,在工作中取得不一样的成绩,实现自己的价值,而不是仅仅为了赚钱;

继开 wechat
欢迎加我的微信,共同交流技术