安装Lynis系统安全审计扫描工具

1. 介绍lynis

lynis是一款开源的unix-based平台的审计工具。能够帮助审计员扫描Linux/Unix系统以及可用的软件。支持本地扫描，网络主机扫描，dockerfile文件的扫描。程序主要探测，系统上安装的程序包，配置上的错误，以及安全问题和系统信息。

1. 安装lynis

官网下载：https://cisofy.com/lynis/

# wget https://downloads.cisofy.com/lynis/lynis-2.6.4.tar.gz

解压缩后能够直接执行lynis脚本，不须要额外的安装工做。

把lynis目录移动到/opt目录来运行

# mv lynis /opt/

1. 使用lynis审计扫描

audit

    audit system               : Perform local security scan 本地扫描

    audit system remote <host>   : Remote security scan         扫描网络主机

    audit dockerfile <file>       : Analyze Dockerfile       扫描dockfile文件

本地扫描：

# ./lynis audit system

远程扫描：

# ./lynis audit system remote 172.21.20.1

  How to perform a remote scan:

  =============================

  Target  : 172.21.20.1

  Command : ./lynis audit system --quick 172.21.20.1

 

  * Step 1: Create tarball

    mkdir -p ./files && cd .. && tar czf ./lynis/files/lynis-remote.tar.gz --exclude=files/lynis-remote.tar.gz ./lynis && cd lynis

 

  * Step 2: Copy tarball to target 172.21.20.1

    scp -q ./files/lynis-remote.tar.gz 172.21.20.1:~/tmp-lynis-remote.tgz

 

  * Step 3: Execute audit command

    ssh 172.21.20.1 "mkdir -p ~/tmp-lynis && cd ~/tmp-lynis && tar xzf ../tmp-lynis-remote.tgz && rm ../tmp-lynis-remote.tgz && cd lynis && ./lynis audit system --quick 172.21.20.1"

 

  * Step 4: Clean up directory

    ssh 172.21.20.1 "rm -rf ~/tmp-lynis"

 

  * Step 5: Retrieve log and report

    scp -q 172.21.20.1:/tmp/lynis.log ./files/172.21.20.1-lynis.log

    scp -q 172.21.20.1:/tmp/lynis-report.dat ./files/172.21.20.1-lynis-report.dat

 

  * Step 6: Clean up tmp files (when using non-privileged account)

    ssh 172.21.20.1 "rm /tmp/lynis.log /tmp/lynis-report.dat"