利用lynis如何进行linux漏洞扫描详解

sudo pacman -S lynis --noconfirm

resolving dependencies...looking for conflicting packages... Packages (1) lynis-2.6.4-1 Total Installed Size: 1.35 MiBNet Upgrade Size:  0.00 MiB :: Proceed with installation? [Y/n] (0/1) checking keys in keyring      [----------------------] 0%(1/1) checking keys in keyring      [######################] 100%(0/1) checking package integrity     [----------------------] 0%(1/1) checking package integrity     [######################] 100%(0/1) loading package files      [----------------------] 0%(1/1) loading package files      [######################] 100%(0/1) checking for file conflicts     [----------------------] 0%(1/1) checking for file conflicts     [######################] 100%(0/1) checking available disk space    [----------------------] 0%(1/1) checking available disk space    [######################] 100%:: Processing package changes...(1/1) reinstalling lynis       [----------------------] 0%(1/1) reinstalling lynis       [######################] 100%:: Running post-transaction hooks...(1/2) Reloading system manager configuration...(2/2) Arming ConditionNeedsUpdate...

[lujun9972@T520 linux和它的小伙伴]$ lynis [ Lynis 2.6.4 ] ################################################################################ Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under the terms of the GNU General Public License. See the LICENSE file for details about using this software.  2007-2018, CISOfy - https://cisofy.com/lynis/ Enterprise support available (compliance, plugins, interface and tools)################################################################################  [+] Initializing program------------------------------------   Usage: lynis command [options]   Command:  audit  audit system     : Perform local security scan  audit system remote <host> : Remote security scan  audit dockerfile <file>  : Analyze Dockerfile  show  show       : Show all commands  show version     : Show Lynis version  show help      : Show help  update  update info     : Show update details   Options:  --no-log       : Don't create a log file --pentest       : Non-privileged scan (useful for pentest) --profile <profile>    : Scan the system with the given profile file --quick (-Q)      : Quick mode, don't wait for user input  Layout options --no-colors      : Don't use colors in output --quiet (-q)      : No output --reverse-colors     : Optimize color display for light backgrounds  Misc options --debug       : Debug logging to screen --view-manpage (--man)   : View man page --verbose       : Show more details on screen --version (-V)     : Display version number and quit  Enterprise options --plugindir <path>    : Define path of available plugins --upload       : Upload data to central node  More options available. Run '/usr/bin/lynis show options', or use the man page.  No command provided. Exiting..

sudo lynis audit system |sed '1,/Results/d'

lynis show groups

sudo lynis --tests-from-group "shells networking" --no-colors

[ Lynis 2.6.4 ] ################################################################################ Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under the terms of the GNU General Public License. See the LICENSE file for details about using this software.  2007-2018, CISOfy - https://cisofy.com/lynis/ Enterprise support available (compliance, plugins, interface and tools)################################################################################  [+] Initializing program------------------------------------- Detecting OS...  [ DONE ]- Checking profiles... [ DONE ]- Detecting language and localization [ zh ]Notice: no language file found for 'zh' (tried: /usr/share/lynis/db/languages/zh)  --------------------------------------------------- Program version:   2.6.4 Operating system:   Linux Operating system name:  Arch Linux Operating system version: Rolling release Kernel version:   4.16.13 Hardware platform:   x86_64 Hostname:     T520 --------------------------------------------------- Profiles:     /etc/lynis/default.prf Log file:     /var/log/lynis.log Report file:    /var/log/lynis-report.dat Report version:   1.0 Plugin directory:   /usr/share/lynis/plugins --------------------------------------------------- Auditor:     [Not Specified] Language:     zh Test category:    all Test group:    shells networking ---------------------------------------------------- Program update status...  [ NO UPDATE ] [+] System Tools------------------------------------- Scanning available tools...- Checking system binaries... [+] Plugins (phase 1)------------------------------------Note: plugins have more extensive tests and may take several minutes to complete - Plugins enabled [ NONE ] [+] Shells------------------------------------- Checking shells from /etc/shellsResult: found 5 shells (valid shells: 5).- Session timeout settings/tools [ NONE ]- Checking default umask values- Checking default umask in /etc/bash.bashrc [ NONE ]- Checking default umask in /etc/profile [ WEAK ] [+] Networking------------------------------------- Checking IPv6 configuration [ ENABLED ]Configuration method [ AUTO ]IPv6 only [ NO ]- Checking configured nameservers- Testing nameserversNameserver: 202.96.134.33 [ SKIPPED ]Nameserver: 202.96.128.86 [ SKIPPED ]- Minimal of 2 responsive nameservers [ SKIPPED ]- Getting listening ports (TCP/UDP) [ DONE ]* Found 11 ports- Checking status DHCP client [ RUNNING ]- Checking for ARP monitoring software [ NOT FOUND ] [+] Custom Tests------------------------------------- Running custom tests...  [ NONE ] [+] Plugins (phase 2)------------------------------------ ================================================================================  -[ Lynis 2.6.4 Results ]-  Great, no warnings  Suggestions (1): ---------------------------- * Consider running ARP monitoring software (arpwatch,arpon) [NETW-3032]  https://cisofy.com/controls/NETW-3032/  Follow-up: ---------------------------- - Show details of a test (lynis show details TEST-ID) - Check the logfile for all details (less /var/log/lynis.log) - Read security controls texts (https://cisofy.com) - Use --upload to upload data to central system (Lynis Enterprise users) ================================================================================  Lynis security scan details:  Hardening index : 33 [######    ] Tests performed : 13 Plugins enabled : 0  Components: - Firewall    [X] - Malware scanner  [X]  Lynis Modules: - Compliance Status  [?] - Security Audit   [V] - Vulnerability Scan  [V]  Files: - Test and debug information  : /var/log/lynis.log - Report data      : /var/log/lynis-report.dat ================================================================================  Lynis 2.6.4  Auditing, system hardening, and compliance for UNIX-based systems (Linux, macOS, BSD, and others)  2007-2018, CISOfy - https://cisofy.com/lynis/ Enterprise support available (compliance, plugins, interface and tools) ================================================================================  [TIP]: Enhance Lynis audits by adding your settings to custom.prf (see /etc/lynis/default.prf for all settings)

lynis show details ${test_id}

* Consider running ARP monitoring software (arpwatch,arpon) [NETW-3032]

sudo lynis show details NETW-3032

2018-06-08 18:18:01 Performing test ID NETW-3032 (Checking for ARP monitoring software)2018-06-08 18:18:01 IsRunning: process 'arpwatch' not found2018-06-08 18:18:01 IsRunning: process 'arpon' not found2018-06-08 18:18:01 Suggestion: Consider running ARP monitoring software (arpwatch,arpon) [test:NETW-3032] [details:-] [solution:-]2018-06-08 18:18:01 Checking permissions of /usr/share/lynis/include/tests_printers_spools2018-06-08 18:18:01 File permissions are OK2018-06-08 18:18:01 ===---------------------------------------------------------------===

sudo tail /var/log/lynis.log

2018-06-08 17:59:46 ================================================================================2018-06-08 17:59:46 Lynis 2.6.42018-06-08 17:59:46 2007-2018, CISOfy - https://cisofy.com/lynis/2018-06-08 17:59:46 Enterprise support available (compliance, plugins, interface and tools)2018-06-08 17:59:46 Program ended successfully2018-06-08 17:59:46 ================================================================================2018-06-08 17:59:46 PID file removed (/var/run/lynis.pid)2018-06-08 17:59:46 Temporary files: /tmp/lynis.sGxCR0hSPz2018-06-08 17:59:46 Action: removing temporary file /tmp/lynis.sGxCR0hSPz2018-06-08 17:59:46 Lynis ended successfully.

sudo tail /var/log/lynis-report.dat

lynis update info --no-colors

== Lynis ==  Version   : 2.6.4 Status    : Up-to-date Release date  : 2018-05-02 Update location : https://cisofy.com/lynis/  2007-2018, CISOfy - https://cisofy.com/lynis/