How to use the command 'lynis' (with examples)

Lynis is a popular open-source security auditing tool designed to assess and improve the security posture of Linux and Unix-based systems. It performs deep system scans to evaluate the security settings, software configurations, and overall system integrity. Lynis can be an invaluable tool for system administrators, security professionals, and anyone interested in maintaining the security health of their systems. It provides insights, suggests improvements, and generates detailed reports that serve as a roadmap for hardening and security enhancement.

Use case 1: Check that Lynis is up-to-date

Code:

sudo lynis update info

Motivation:

Keeping security tools like Lynis up-to-date is crucial to ensure accurate system assessments and to have the latest features and improvements. Regular updates may also include new security checks and vulnerability definitions, making it a key step in maintaining robust system security. By verifying that Lynis is updated, you ensure that the audits conducted are reliable and up-to-date with current security standards.

Explanation:

• sudo: The command requires superuser privileges, as it needs to interact with system files and possibly modify them during its operations.
• lynis: This is the name of the command-line tool we’ll be using.
• update: This specifies the operation we want Lynis to perform, in this case, checking for updates.
• info: This argument tells Lynis to retrieve update information instead of fully updating the tool. It provides details about the current version and check for newer versions available.

Example output:

[INFO] program version: 3.0.5
[INFO] running update check...
[INFO] no update available. your version is up-to-date.

Use case 2: Run a security audit of the system

Code:

sudo lynis audit system

Motivation:

Conducting regular security audits of your system is pivotal for ensuring the system’s robustness against various threats. A Lynis system audit is a comprehensive examination that checks configurations, software versions, and security settings, providing insights and recommendations for securing the environment further. This use-case is especially useful for identifying hidden vulnerabilities and compliance gaps.

Explanation:

• sudo: Necessary for performing a detailed and comprehensive audit since it needs access to protected areas of the system.
• lynis: Calls the Lynis tool.
• audit: Commands Lynis to perform an audit operation.
• system: Specifies that the audit target is the entire system, examining configuration files, installed packages, and various settings.

Example output:

[INFO] Starting audit...
...
[+] OS Security: OK
[+] Password strength: Weak (Recommendation: Use stronger passwords)
[+] Firewall: Not detected (Recommendation: Enable and configure firewall)
[+] Suggestions: 20+ items – check action log for details.

Use case 3: Run a security audit of a Dockerfile

Code:

sudo lynis audit dockerfile path/to/dockerfile

Motivation:

Container security is a growing concern, and ensuring that Dockerfiles are free of security vulnerabilities and misconfigurations is an essential part of maintaining secure containerized environments. By auditing a Dockerfile, Lynis will assess best practices, detect risky instructions, and suggest recommendations for improving container security. This is especially advantageous when preparing a Dockerfile for production environments where security is paramount.

Explanation:

• sudo: Required to ensure that the audit can accurately analyze and report on Docker-specific settings and interactions.
• lynis: Refers to the Lynis command-line tool.
• audit: Indicates the conduct of an audit operation.
• dockerfile: Specifies that the target of the audit is a Dockerfile, not the full system.
• path/to/dockerfile: A placeholder indicating where the actual Dockerfile is located; this needs to be replaced with the specific path of the Dockerfile to be audited.

Example output:

[INFO] Dockerfile found...
[+] Efficient Layering: OK
[+] Image User: Root (Recommendation: Avoid running containers as root)
[+] Exposed Ports: Specific IPs recommended for sensitive services
[+] Suggestions: Improve security instructions (5+ items)

Conclusion:

Lynis is an essential tool for automating and simplifying security audits across Linux, Unix, and containerized environments. By regularly using Lynis to check for updates, perform system audits, and assess docker configurations, users can tremendously enhance their security posture, mitigate vulnerabilities, and align with best security practices. The results and recommendations it provides serve as actionable insights for hardening systems and improving organizational security frameworks.