Linux Security Scanning Learn your weaknesses with Lynis Michael - - PowerPoint PPT Presentation

▶
linux security scanning
SMART_READER_LITE
LIVE PREVIEW

Linux Security Scanning Learn your weaknesses with Lynis Michael - - PowerPoint PPT Presentation

Oct 27, 2023 38 likes •560 views

Linux Security Scanning Learn your weaknesses with Lynis Michael Boelen michael.boelen@cisofy.com Nijmegen, 2016-05-10 Meetup: Linux Usergroup Nijmegen Goals 1. Perform a security audit 2. Learn what to protect 3. Determine why 2 Agenda

slide-1
SLIDE 1

Linux Security Scanning

Learn your weaknesses with Lynis

Nijmegen, 2016-05-10 Meetup: Linux Usergroup Nijmegen

Michael Boelen

michael.boelen@cisofy.com

slide-2
SLIDE 2

Goals

  • 1. Perform a security audit
  • 2. Learn what to protect
  • 3. Determine why

2

slide-3
SLIDE 3

Agenda

Today

  • 1. System Hardening
  • 2. Security Auditing
  • 3. Lynis

3

slide-4
SLIDE 4

Michael Boelen

  • Open Source Security

○ rkhunter (malware scan) ○ Lynis (security audit)

  • 170+ blog posts at Linux-Audit.com
  • Founder of CISOfy

4

slide-5
SLIDE 5

System Hardening

slide-6
SLIDE 6

6

slide-7
SLIDE 7
slide-8
SLIDE 8

8

slide-9
SLIDE 9

9

slide-10
SLIDE 10

10

slide-11
SLIDE 11

Hardening Basics

slide-12
SLIDE 12

Hardening 101

  • New defenses
  • Existing defenses
  • Reduce weaknesses

(= attack surface)

12

Photo Credits: http://commons.wikimedia.org/wiki/User:Wilson44691

slide-13
SLIDE 13

Hardening 101

  • Security is an ongoing process
  • It is never finished
  • New attacks = more hardening

○ POODLE ○ Hearthbleed

13

slide-14
SLIDE 14

Hardening 101

Operating System

  • Packages
  • Processes
  • Configuration

14

slide-15
SLIDE 15

Linux Security

15

Areas Core Resources Services Environment System Hardening Boot Process Containers Frameworks Kernel Service Manager Virtualization Accounting Authentication Cgroups Cryptography Logging Namespaces Network Software Storage Time Database Mail Middleware Monitoring Printing Shell Web Forensics Incident Response Malware Risks Security Monitoring System Integrity Security Auditing Compliance

slide-16
SLIDE 16

Technical Auditing

slide-17
SLIDE 17

Auditing

Why audit?

  • Checking defenses
  • Assurance
  • Quality Control

17

slide-18
SLIDE 18

Auditing

Who?

  • Auditors
  • Security Professionals
  • System Engineers

18

slide-19
SLIDE 19

Auditing

How?

  • 1. Focus
  • 2. Audit
  • 3. Focus
  • 4. Harden
  • 5. Repeat!

19

slide-20
SLIDE 20

Resources

Guides

  • Center for Internet Security (CIS)
  • NIST / NSA
  • OWASP
  • Vendors

20

slide-21
SLIDE 21

Guides

Pros

Free to use Detailed You are in control

21

Cons

Time intensive Usually no tooling Limited distributions Delayed releases No follow-up

slide-22
SLIDE 22

Audit Tool: Lynis

slide-23
SLIDE 23

Lynis

23

slide-24
SLIDE 24

Lynis

2007

24

slide-25
SLIDE 25

Lynis

GPL v3

25

slide-26
SLIDE 26

Lynis

Shell script

26

slide-27
SLIDE 27

Lynis

Goal 1 In-depth security scan

27

slide-28
SLIDE 28

Lynis

Goal 2 Quick and easy to use

28

slide-29
SLIDE 29

Lynis

Goal 3 Define the next (hardening) step

29

slide-30
SLIDE 30

Differences with other tools

slide-31
SLIDE 31

Lynis

Simple

  • No installation needed
  • Run with simple commands
  • No configuration needed

31

slide-32
SLIDE 32

Lynis

Flexibility

  • No dependencies*
  • Can be easily extended
  • Custom tests

* Besides common tools like awk, grep, ps

32

slide-33
SLIDE 33

Lynis

Portability

  • Run on all UNIX platforms
  • Detect and use “on the go”
  • Usable after OS version upgrade

33

slide-34
SLIDE 34

Running Lynis

slide-35
SLIDE 35

How it works

  • Initialise → OS detection → Read profiles

→ Detect binaries

  • Run helpers / plugins / tests
  • Show audit results

35

slide-36
SLIDE 36

Running Lynis

  • 1. lynis
  • 2. lynis audit system
  • 3. lynis audit system --quick
  • 4. lynis audit system --quick --quiet

36

slide-37
SLIDE 37

Lynis Profiles

Optional configuration

  • Default profile (default.prf)
  • Custom profile (custom.prf)
  • Other profiles with --profile

37

slide-38
SLIDE 38

Lynis Profiles

Example: developer

38

slide-39
SLIDE 39

Plugins

An extension to Lynis Plugins are mostly for gathering facts

Customization: include/tests_custom or custom plugin

39

slide-40
SLIDE 40

Demo?

slide-41
SLIDE 41

Lessons Learned

slide-42
SLIDE 42

Lessons Learned

Simplicity

  • Keep it simple
  • First impression
  • Next step

42

slide-43
SLIDE 43

Lessons Learned

Less is better

  • Dependencies
  • Program arguments
  • Screen output

43

slide-44
SLIDE 44

Lessons Learned

Documentation

  • Understand its power
  • Focus on new users
  • Separate properly

44

slide-45
SLIDE 45

Lessons Learned

GitHub Stats: issues / pulls / stars / watchers

45

slide-46
SLIDE 46

Lessons Learned

Open Source = Business It needs PR, blog posts, attention (like a business)

46

slide-47
SLIDE 47

Future

slide-48
SLIDE 48

Future

  • Packages
  • More tests
  • Quality control
  • Linting
  • Unit tests
  • Software Development Kit

48

slide-49
SLIDE 49

Future

Want to help?

  • Submit patches
  • Provide feedback
  • Deploy Lynis

49

slide-50
SLIDE 50

You finished this presentation Success!

slide-51
SLIDE 51

Learn more?

Follow

  • Blog

Linux Audit (linux-audit.com)

  • Twitter

@mboelen

This presentation can be found on michaelboelen.com

51

slide-52
SLIDE 52