如何在 CentOS 中安装 Lynis Linux 审计工具
information technologylinux
Lynis 是一款开源且功能强大的类 Unix 操作系统审计工具。它可以扫描系统，检查安全漏洞、常用方法、预装软件和可用信息、配置错误、安全问题、无密码用户帐户、不当文件权限、防火墙审计等等。
了解 Lynis
Lynis 会执行各种测试用例来保护您的 Linux 系统。
要显示测试报告，请按照以下步骤操作:确定操作系统
搜索可用工具和实用程序
检查 Lynis 更新
运行已启用插件的测试
按类别运行安全测试
报告安全扫描状态
在测试用例执行期间，所有扫描详细信息都存储在日志文件中，所有警告和错误都存储在报告文件中。
安装 Lynis
要安装 Lynis，请使用以下命令:
# yum install lynis
示例输出应如下所示–
Loaded plugins: fastestmirror, langpacks base | 3.6 kB 00:00 elrepo | 2.9 kB 00:00 epel/x86_64/metalink | 3.2 kB 00:00 epel | 4.3 kB 00:00 extras | 3.4 kB 00:00 google-chrome | 951 B 00:00 updates | 3.4 kB 00:00 (1/2): epel/x86_64/updateinfo | 501 kB 00:02 (2/2): epel/x86_64/primary_db | 3.9 MB 00:02 Loading mirror speeds from cached hostfile * base: ftp.iitm.ac.in * elrepo: mirrors.ircam.fr * epel: mirrors.hustunique.com * extras: ftp.iitm.ac.in * updates: ftp.iitm.ac.in Resolving Dependencies --> Running transaction check ---> Package lynis.noarch 0:2.1.0-1.el7 will be installed .......
请注意，运行 Lynis 需要 root 权限。
运行 Lynis 命令
运行 Lynis 之前，您应该了解以下参数。
--checkall 或 -c - 开始扫描
--check-update - 检查 Lynis 更新
--cronjob - 以 cron 作业方式运行 Lynis(包含 -c -Q)
--help 或 -h - 显示有效参数
--quick 或 -Q -除非出现错误，否则不要等待用户输入。
--version 或 -V 显示 Lynis 版本。
要运行 Lynis，请使用以下命令 -
# lynis -c --auditor "tutorialspoint"
建议使用 -c 参数。-c 参数表示执行所有测试以检查系统。如果要指定审计员名称，只需添加 -auditor 参数。
在上面的示例中，`tutorialspoint` 是审计员名称。上述命令的示例输出应如下所示。
[+] Initializing program ------------------------------------ - Detecting OS... [ DONE ] --------------------------------------------------- Program version: 2.1.0 Operating system: Linux Operating system name: CentOS Operating system version: CentOS Linux release 7.2.1511 (Core) Kernel version: 3.10.0 Hardware platform: x86_64 Hostname: linux Auditor: “tutorialspoint” Profile: /etc/lynis/default.prf Log file: /var/log/lynis.log Report file: /var/log/lynis-report.dat Report version: 1.0 Plugin directory: /usr/share/lynis/plugins --------------------------------------------------- - Checking profile file (/etc/lynis/default.prf)... - Program update status... [ UPDATE AVAILABLE ] .......
以上结果表明了Lynis的初始化程序。
[+] Users, Groups and Authentication ------------------------------------ - Search administrator accounts [ OK ] - Checking for non-unique UIDs [ OK ] - Checking consistency of group files (grpck) [ OK ] - Checking non unique group ID's [ OK ] - Checking non unique group names [ OK ] - Checking password file consistency [ OK ] - Query system users (non daemons) [ DONE ] - Checking NIS+ authentication support [ NOT ENABLED ] - Checking NIS authentication support [ NOT ENABLED ] - Checking sudoers file [ FOUND ] - Check sudoers file permissions [ OK ] - Checking PAM password strength tools [ OK ] - Checking PAM configuration file (pam.conf) [ NOT FOUND ] - Checking PAM configuration files (pam.d) [ FOUND ] - Checking PAM modules [ FOUND ] - Checking user password aging [ DISABLED ] - Checking Linux single user mode authentication [ WARNING ] - Determining default umask - Checking umask (/etc/profile) [ SUGGESTION ] - Checking umask (/etc/login.defs) [ OK ] - Checking umask (/etc/init.d/functions) [ SUGGESTION ] - Checking LDAP authentication support [ NOT ENABLED ] ......
以上输出显示了用户、组和身份验证信息。
[+] File systems ------------------------------------ - Checking mount points - Checking /home mount point [ OK ] - Checking /tmp mount point [ SUGGESTION ] - Checking /var mount point [ OK ] - Checking LVM volume groups [ FOUND ] - Checking LVM volumes [ FOUND ] - Querying FFS/UFS mount points (fstab) [ NONE ] - Query swap partitions (fstab) [ OK ] - Testing swap partitions [ WARNING ] - Checking for old files in /tmp [ OK ] - Checking /tmp sticky bit [ OK ] - ACL support root file system [ DISABLED ] - Checking Locate database [ FOUND ] ........
以上结果指向文件系统。
[+] Ports and packages ------------------------------------ - Searching package managers - Searching RPM package manager [ FOUND ] - Querying RPM package manager - Checking YUM package management consistency [ OK ] - Checking package database duplicates [ OK ] - Checking package database for problems [ OK ] - Checking missing security packages [ OK ] - Checking GPG checks (yum.conf) [ OK ] - Checking package audit tool [ INSTALLED ] Found: yum-security .......
以上结果显示了Linux系统的端口和软件包。
[+] Networking ------------------------------------ - Checking configured nameservers - Testing nameservers Nameserver: 192.168.1.1 [ OK ] - Minimal of 2 responsive nameservers [ WARNING ] - Checking default gateway [ DONE ] - Getting listening ports (TCP/UDP) [ DONE ] * Found 22 ports - Checking promiscuous interfaces [ OK ] - Checking waiting connections [ OK ] - Checking status DHCP client .....
以上结果显示了网络信息。
[+] Printers and Spools ------------------------------------ - Checking cups daemon [ RUNNING ] - Checking CUPS configuration file [ OK ] - File permissions [ OK ] - Checking CUPS addresses/sockets [ FOUND ] - Checking lp daemon ......
以上结果显示了打印机和假脱机信息。
创建 Lynis 定时任务
要创建系统每日扫描，请使用以下命令 -
# crontab -e
添加以下带有选项 -e的定时任务。所有特殊字符都将从输出中忽略，扫描将自动运行。
3022***root /path/to/lynis -c -Q --auditor "automated" --cronjob
以上示例 cron 作业将在每天晚上 10:30 运行，并在 /var/log/lynis.log 文件中生成每日报告。
更新 Lynis
要更新 Lynis，请使用以下命令 -
# lynis --check-update
恭喜!现在，您已经了解如何在 CentOS 中安装 Lynis(Linux 审计工具)。我们将在下一篇 Linux 文章中学习更多此类命令。敬请期待!
相关文章
有用资源
linux 参考教程 - 该教程包含有关 linux 的更多信息:https://www.cainiaomax.com/linux/
