Lynis – Security auditing and hardening tool, for Unix-based systems
1–10 of 24 posts
Re: Lynis – Security auditing and hardening tool, for Unix-based systems
#2Seems like a good thing. Anyone here has experience with this tool?
Re: Lynis – Security auditing and hardening tool, for Unix-based systems
#3Seems like a good thing. Anyone here has experience with this tool?
Doesn't offer much utility IMO as most distributions come with secure defaults ootb these days. Unfortunately it's checklist is not thorough enough to keep you ahead of the security curve.
Re: Lynis – Security auditing and hardening tool, for Unix-based systems
#4[deleted]
Re: Lynis – Security auditing and hardening tool, for Unix-based systems
#5Seems like a good thing. Anyone here has experience with this tool?
Useful if you walk in to an unknown environment, however if standing up your own infra, any competent sysadmin doesn't need this.
Re: Lynis – Security auditing and hardening tool, for Unix-based systems
#6Seems like a good thing. Anyone here has experience with this tool?
Doesn't offer much utility IMO as most distributions come with secure defaults ootb these days. Unfortunately it's checklist is not thorough enough to keep you ahead of the security curve.
We are looking for something to run as part of our ami/docker testing and as you say, stays fresh on standards (whatever soc2/iso, but ideally also FIPS) , any prefs?
Re: Lynis – Security auditing and hardening tool, for Unix-based systems
#7Seems like a good thing. Anyone here has experience with this tool?
Useful if you walk in to an unknown environment, however if standing up your own infra, any competent sysadmin doesn't need this.
If auditors are going to use this, it would benefit even the most competent sysadmin to know what it's gonna say. The average compliance analyst isn't going to understand why some enumerable risk isn't actually a threat because; your threat model makes said issue actually impossible. Even if you can prove it, they're still gonna include it in their needless risk findings. I'd postulate (for fun) that most competent sysadmins would be more likely to have that problem, because they've already identified it, and are using it as a makeshift 'honeypot'.
Re: Lynis – Security auditing and hardening tool, for Unix-based systems
#8Seems like a good thing. Anyone here has experience with this tool?
I just heard about this tool but someone else said it simply enumerates defaults already present in most distros.
I can tell you one thing that makes real changes to RHEL at least, CIS Benchmark. It hardens your system by tightening up file permissions, user logins, disables old protocols, sets partition flags and more.
But the best hardening imho doesn't follow any set standard, rather application dependent isolation using containers and MACs like SElinux and MCS (multi-category security).
https://docs.redhat.com/en/documentation/red_hat_enterprise_...
Re: Lynis – Security auditing and hardening tool, for Unix-based systems
#9Earlier quoted context omitted.
Doesn't offer much utility IMO as most distributions come with secure defaults ootb these days. Unfortunately it's checklist is not thorough enough to keep you ahead of the security curve.
We are looking for something to run as part of our ami/docker testing and as you say, stays fresh on standards (whatever soc2/iso, but ideally also FIPS) , any prefs?
This is great https://github.com/ComplianceAsCode/content
I use it for regular scanning, flagging potential issues, automatically making changes, aligning images to CIS Level 2, and for ongoing scanning to satisfy SOC2 auditors.
Re: Lynis – Security auditing and hardening tool, for Unix-based systems
#10Earlier quoted context omitted.
Doesn't offer much utility IMO as most distributions come with secure defaults ootb these days. Unfortunately it's checklist is not thorough enough to keep you ahead of the security curve.
We are looking for something to run as part of our ami/docker testing and as you say, stays fresh on standards (whatever soc2/iso, but ideally also FIPS) , any prefs?
[deleted]