Security auditing your Linux OS with Lynis
Tags: security, tutorial, opensource, linux
Published: 2024-01-29 12:15:53

System hardening is a hard (hah!) thing to do: Every computer has loads of vulnerabilities that can compromise our security. From SSH brute-force attacks to weak passwords, misconfigurations, etc. Keeping track of each potential vulnerability is a difficult thing to do unless we use things like Lynis.

<table><tbody><tr><td><strong><span style="text-decoration: underline;">Table of contents</span></strong></td></tr><tr><td><a href="#intro">Introduction: What is hardening?</a></td></tr><tr><td><a href="#lynis">What is Lynis?</a></td></tr><tr><td><a href="#first-test">Downloading and running our first test</a></td></tr><tr><td><a href="#fixing-vulnerabilities">Fixing our vulnerabilities</a></td></tr><tr><td><a href="#testing">Testing our system after fixing it</a></td></tr><tr><td><a href="#final-thoughts">Final thoughts</a></td></tr><tr><td><a href="#resources">Resources</a></td></tr></tbody></table>

## Introduction: What is hardening?

Systems hardening is the process of securing a computer system or network by reducing its vulnerabilities and minimizing potential attack surfaces. The goal of systems hardening is to improve the overall security of a system, making it more resistant to various cyber threats and attacks. This involves configuring and managing the hardware, software, and network components in a way that minimizes security risks.

And we can do it easily with Lynis.

## What is Lynis?

[Lynis](https://github.com/CISOfy/lynis) is an open-source security auditing tool for [Unix-based systems](https://letslearnabout.net/hacking/linux-file-system/). First, it runs a series of tests and checks on your system and its configuration, then it gives you a score (from 0 to 100) based on your hardening level.

![Lynis initial test](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l6bak4hgi0pigpzj5hm8.png)

Then, it gives you a series of recommendations and tips to improve it even further.

Let's give it a try! First, we will download Lynis, run a first test, follow their recommendations, and then run another test to see if it improved our hardening index.

## Downloading and running our first test

First, we will clone the GitHub repo:

```
git clone https://github.com/CISOfy/lynis.git
```

Then, we will move to the **lynis** folder, then run our first test:

```
./lynis audit system --quick
```

We ran our test on a new Ubuntu Server 22.04.3 LTS computer. It is just a fresh install, where we only did **sudo apt update && sudo apt upgrade -y**, so no configurations nor hardening has been applied to it yet.

![Initializing Lynis](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/or8p3dz5mc1stwvn8kru.png)

After a minute or two, we will have a hardening score and a few recommendations about how to improve our score.

![Lynis initial scan](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l6bak4hgi0pigpzj5hm8.png)

As you can see, our score is only XX/100. That's too low! We need to pump those numbers up. If we scroll up or read the newly created **/var/log/lynis-report.dat** report file, we have a few suggestions and tips about how to fix them.

![Lynis warnings and suggestions](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uyuaeqwbotuagtaxb166.png)

## Fixing our vulnerabilities

Then, let's fix them!

Let's pick a few misconfigurations and fix them. For example, the [SSH-7408](https://cisofy.com/lynis/controls/SSH-7408/), tell us how to properly configure SSH to reduce known vulnerabilities:

![Lynis SSH suggestions](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kcj7r9689imzruonrp0p.png)

Let's edit **/etc/ssh/sshd\_config** with the following values:

![Fixing  /etc/ssh/sshd_config](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zle010y7r09k8hi8li6a.png)

![Fixing  /etc/ssh/sshd_config](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wibyeyi874zlma79s5q8.png)

Nice. This would improve our hardening score for sure. But if we remember, we had other vulnerabilities:

![Lynis package suggestion](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/af3td1sim0tzmt1a98gm.png)

This is an easy one. **apt-show-versions** is a Linux package that lists all available package versions with distribution. That's it. You just install this package, and then you improve your security.

Let's go for another one:

![Lynis password's age suggestions](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dv7cu1w88oi7hsp17hm1.png)

Seems like **we don't have a minimum nor a maximum password age**: This lets the users use the same password for years without changing it. If the password gets compromised, as they don't change it, an attacker could use it indefinitely. Let's also make **umask** (related to permissions) more strict.

Let's fix this problem by setting a minimum and maximum password age, and also restricting umask in the **/etc/login.defs** file:

![Fixing minimum and maximum password age errors in /etc/login.defs](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5yvy7fd5lqwrvf3mulcc.png)

That would do it!

## Testing our system after fixing it

We have hardened our SSH, installed a package, improved the password's ageing controls and more.

Could this have improved our starting 63/100 score?

![Lynis final test](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ek0bi7dr4bnkwopb9pdj.png)

It did! The hardening index increased its score by 10 points with just 5 minutes of hard work!

Yes, there is still work to do (or less work, if you use scripts to [automate the hardening process](https://github.com/konstruktoid/hardening)), but now our computer is more secure and harder to crack!

## Final thoughts

Lynis and systems hardening are crucial elements in improving cybersecurity. Lynis, as a security auditing tool, identifies and addresses vulnerabilities, offering recommendations for system fortification. By regularly running Lynis audits we can keep our systems updated.

Lynis minimizes a system's attack surface, creating a robust defence strategy by mitigating or even removing known vulnerabilities and common security weaknesses, improving the overall security of your operating system, and reducing the risk of security breaches.

And, as you saw, it is pretty addicting, as you want to keep increasing your score more and more!

## Resources
[Original post](https://letslearnabout.net/hardening/security-auditing-lynis/)

[GitHub: Lynis](https://github.com/CISOfy/lynis)

[GitHub: Hardening](https://github.com/konstruktoid/hardening)

[Linux File System](https://letslearnabout.net/hacking/linux-file-system/)