使用 Lynis 掃描 Linux 安全性
你有沒有想過你的 Linux 機(jī)器到底安全不安全?Linux 發(fā)行版眾多，每個(gè)發(fā)行版都有自己的默認(rèn)設(shè)置，你在上面運(yùn)行著幾十個(gè)版本各異的軟件包，還有眾多的服務(wù)在后臺(tái)運(yùn)行，而我們幾乎不知道或不關(guān)心這些。
要想確定安全態(tài)勢(shì)(指你的 Linux 機(jī)器上運(yùn)行的軟件、網(wǎng)絡(luò)和服務(wù)的整體安全狀態(tài))，你可以運(yùn)行幾個(gè)命令，得到一些零碎的相關(guān)信息，但你需要解析的數(shù)據(jù)量是巨大的。
如果能運(yùn)行一個(gè)工具，生成一份關(guān)于機(jī)器安全狀況的報(bào)告，那就好得多了。而幸運(yùn)的是，有一個(gè)這樣的軟件： Lynis 。它是一個(gè)非常流行的開源安全審計(jì)工具，可以幫助強(qiáng)化基于 Linux 和 Unix 的系統(tǒng)。根據(jù)該項(xiàng)目的介紹：
| “它運(yùn)行在系統(tǒng)本身，可以進(jìn)行深入的安全掃描。主要目標(biāo)是測(cè)試安全防御措施，并提供進(jìn)一步強(qiáng)化系統(tǒng)的提示。它還將掃描一般系統(tǒng)信息、易受攻擊的軟件包和可能的配置問題。Lynis 常被系統(tǒng)管理員和審計(jì)人員用來評(píng)估其系統(tǒng)的安全防御。” |
安裝 Lynis
你的 Linux 軟件倉庫中可能有 Lynis。如果有的話，你可以用以下方法安裝它：
- dnf install lynis
或
- apt install lynis
然而，如果你的倉庫中的版本不是最新的，你最好從 GitHub 上安裝它。(我使用的是 Red Hat Linux 系統(tǒng)，但你可以在任何 Linux 發(fā)行版上運(yùn)行它)。就像所有的工具一樣，先在虛擬機(jī)上試一試是有意義的。要從 GitHub 上安裝它：
- $ cat /etc/redhat-release
- Red Hat Enterprise Linux Server release 7.8 (Maipo)
- $
- $ uname -r
- 3.10.0-1127.el7.x86_64
- $
- $ git clone https://github.com/CISOfy/lynis.git
- Cloning into 'lynis'...
- remote: Enumerating objects: 30, done.
- remote: Counting objects: 100% (30/30), done.
- remote: Compressing objects: 100% (30/30), done.
- remote: Total 12566 (delta 15), reused 8 (delta 0), pack-reused 12536
- Receiving objects: 100% (12566/12566), 6.36 MiB | 911.00 KiB/s, done.
- Resolving deltas: 100% (9264/9264), done.
- $
一旦你克隆了這個(gè)版本庫，那么進(jìn)入該目錄，看看里面有什么可用的。主要的工具在一個(gè)叫 lynis 的文件里。它實(shí)際上是一個(gè) shell 腳本，所以你可以打開它看看它在做什么。事實(shí)上，Lynis 主要是用 shell 腳本來實(shí)現(xiàn)的：
- $ cd lynis/
- $ ls
- CHANGELOG.md CONTRIBUTING.md db developer.prf FAQ include LICENSE lynis.8 README SECURITY.md
- CODE_OF_CONDUCT.md CONTRIBUTORS.md default.prf extras HAPPY_USERS.md INSTALL lynis plugins README.md
- $
- $ file lynis
- lynis: POSIX shell script, ASCII text executable, with very long lines
- $
運(yùn)行 Lynis
通過給 Lynis 一個(gè) -h 選項(xiàng)來查看幫助部分，以便有個(gè)大概了解：
- $ ./lynis -h
你會(huì)看到一個(gè)簡(jiǎn)短的信息屏幕，然后是 Lynis 支持的所有子命令。
接下來，嘗試一些測(cè)試命令以大致熟悉一下。要查看你正在使用的 Lynis 版本，請(qǐng)運(yùn)行：
- $ ./lynis show version
- 3.0.0
- $
要查看 Lynis 中所有可用的命令：
- $ ./lynis show commands
- Commands:
- lynis audit
- lynis configure
- lynis generate
- lynis show
- lynis update
- lynis upload-only
- $
審計(jì) Linux 系統(tǒng)
要審計(jì)你的系統(tǒng)的安全態(tài)勢(shì)，運(yùn)行以下命令：
- $ ./lynis audit system
這個(gè)命令運(yùn)行得很快，并會(huì)返回一份詳細(xì)的報(bào)告，輸出結(jié)果可能一開始看起來很嚇人，但我將在下面引導(dǎo)你來閱讀它。這個(gè)命令的輸出也會(huì)被保存到一個(gè)日志文件中，所以你可以隨時(shí)回過頭來檢查任何可能感興趣的東西。
Lynis 將日志保存在這里：
- Files:
- - Test and debug information : /var/log/lynis.log
- - Report data : /var/log/lynis-report.dat
你可以驗(yàn)證是否創(chuàng)建了日志文件。它確實(shí)創(chuàng)建了：
- $ ls -l /var/log/lynis.log
- -rw-r-----. 1 root root 341489 Apr 30 05:52 /var/log/lynis.log
- $
- $ ls -l /var/log/lynis-report.dat
- -rw-r-----. 1 root root 638 Apr 30 05:55 /var/log/lynis-report.dat
- $
探索報(bào)告
Lynis 提供了相當(dāng)全面的報(bào)告，所以我將介紹一些重要的部分。作為初始化的一部分，Lynis 做的第一件事就是找出機(jī)器上運(yùn)行的操作系統(tǒng)的完整信息。之后是檢查是否安裝了什么系統(tǒng)工具和插件：
- [+] Initializing program
- ------------------------------------
- - Detecting OS... [ DONE ]
- - Checking profiles... [ DONE ]
- ---------------------------------------------------
- Program version: 3.0.0
- Operating system: Linux
- Operating system name: Red Hat Enterprise Linux Server 7.8 (Maipo)
- Operating system version: 7.8
- Kernel version: 3.10.0
- Hardware platform: x86_64
- Hostname: example
- ---------------------------------------------------
- <<截?cái)?/span>>>
- [+] System Tools
- ------------------------------------
- - Scanning available tools...
- - Checking system binaries...
- [+] Plugins (phase 1)
- ------------------------------------
- Note: plugins have more extensive tests and may take several minutes to complete
- - Plugin: pam
- [..]
- - Plugin: systemd
- [................]
接下來，該報(bào)告被分為不同的部分，每個(gè)部分都以 [+] 符號(hào)開頭。下面可以看到部分章節(jié)。(哇，要審核的地方有這么多，Lynis 是最合適的工具!)
- [+] Boot and services
- [+] Kernel
- [+] Memory and Processes
- [+] Users, Groups and Authentication
- [+] Shells
- [+] File systems
- [+] USB Devices
- [+] Storage
- [+] NFS
- [+] Name services
- [+] Ports and packages
- [+] Networking
- [+] Printers and Spools
- [+] Software: e-mail and messaging
- [+] Software: firewalls
- [+] Software: webserver
- [+] SSH Support
- [+] SNMP Support
- [+] Databases
- [+] LDAP Services
- [+] PHP
- [+] Squid Support
- [+] Logging and files
- [+] Insecure services
- [+] Banners and identification
- [+] Scheduled tasks
- [+] Accounting
- [+] Time and Synchronization
- [+] Cryptography
- [+] Virtualization
- [+] Containers
- [+] Security frameworks
- [+] Software: file integrity
- [+] Software: System tooling
- [+] Software: Malware
- [+] File Permissions
- [+] Home directories
- [+] Kernel Hardening
- [+] Hardening
- [+] Custom tests
Lynis 使用顏色編碼使報(bào)告更容易解讀。
- 綠色。一切正常
- 黃色。跳過、未找到，可能有個(gè)建議
- 紅色。你可能需要仔細(xì)看看這個(gè)
在我的案例中，大部分的紅色標(biāo)記都是在 “Kernel Hardening” 部分找到的。內(nèi)核有各種可調(diào)整的設(shè)置，它們定義了內(nèi)核的功能，其中一些可調(diào)整的設(shè)置可能有其安全場(chǎng)景。發(fā)行版可能因?yàn)楦鞣N原因沒有默認(rèn)設(shè)置這些，但是你應(yīng)該檢查每一項(xiàng)，看看你是否需要根據(jù)你的安全態(tài)勢(shì)來改變它的值：
- [+] Kernel Hardening
- ------------------------------------
- - Comparing sysctl key pairs with scan profile
- - fs.protected_hardlinks (exp: 1) [ OK ]
- - fs.protected_symlinks (exp: 1) [ OK ]
- - fs.suid_dumpable (exp: 0) [ OK ]
- - kernel.core_uses_pid (exp: 1) [ OK ]
- - kernel.ctrl-alt-del (exp: 0) [ OK ]
- - kernel.dmesg_restrict (exp: 1) [ DIFFERENT ]
- - kernel.kptr_restrict (exp: 2) [ DIFFERENT ]
- - kernel.randomize_va_space (exp: 2) [ OK ]
- - kernel.sysrq (exp: 0) [ DIFFERENT ]
- - kernel.yama.ptrace_scope (exp: 1 2 3) [ DIFFERENT ]
- - net.ipv4.conf.all.accept_redirects (exp: 0) [ DIFFERENT ]
- - net.ipv4.conf.all.accept_source_route (exp: 0) [ OK ]
- - net.ipv4.conf.all.bootp_relay (exp: 0) [ OK ]
- - net.ipv4.conf.all.forwarding (exp: 0) [ OK ]
- - net.ipv4.conf.all.log_martians (exp: 1) [ DIFFERENT ]
- - net.ipv4.conf.all.mc_forwarding (exp: 0) [ OK ]
- - net.ipv4.conf.all.proxy_arp (exp: 0) [ OK ]
- - net.ipv4.conf.all.rp_filter (exp: 1) [ OK ]
- - net.ipv4.conf.all.send_redirects (exp: 0) [ DIFFERENT ]
- - net.ipv4.conf.default.accept_redirects (exp: 0) [ DIFFERENT ]
- - net.ipv4.conf.default.accept_source_route (exp: 0) [ OK ]
- - net.ipv4.conf.default.log_martians (exp: 1) [ DIFFERENT ]
- - net.ipv4.icmp_echo_ignore_broadcasts (exp: 1) [ OK ]
- - net.ipv4.icmp_ignore_bogus_error_responses (exp: 1) [ OK ]
- - net.ipv4.tcp_syncookies (exp: 1) [ OK ]
- - net.ipv4.tcp_timestamps (exp: 0 1) [ OK ]
- - net.ipv6.conf.all.accept_redirects (exp: 0) [ DIFFERENT ]
- - net.ipv6.conf.all.accept_source_route (exp: 0) [ OK ]
- - net.ipv6.conf.default.accept_redirects (exp: 0) [ DIFFERENT ]
- - net.ipv6.conf.default.accept_source_route (exp: 0) [ OK ]
看看 SSH 這個(gè)例子，因?yàn)樗且粋€(gè)需要保證安全的關(guān)鍵領(lǐng)域。這里沒有什么紅色的東西，但是 Lynis 對(duì)我的環(huán)境給出了很多強(qiáng)化 SSH 服務(wù)的建議：
- [+] SSH Support
- ------------------------------------
- - Checking running SSH daemon [ FOUND ]
- - Searching SSH configuration [ FOUND ]
- - OpenSSH option: AllowTcpForwarding [ SUGGESTION ]
- - OpenSSH option: ClientAliveCountMax [ SUGGESTION ]
- - OpenSSH option: ClientAliveInterval [ OK ]
- - OpenSSH option: Compression [ SUGGESTION ]
- - OpenSSH option: FingerprintHash [ OK ]
- - OpenSSH option: GatewayPorts [ OK ]
- - OpenSSH option: IgnoreRhosts [ OK ]
- - OpenSSH option: LoginGraceTime [ OK ]
- - OpenSSH option: LogLevel [ SUGGESTION ]
- - OpenSSH option: MaxAuthTries [ SUGGESTION ]
- - OpenSSH option: MaxSessions [ SUGGESTION ]
- - OpenSSH option: PermitRootLogin [ SUGGESTION ]
- - OpenSSH option: PermitUserEnvironment [ OK ]
- - OpenSSH option: PermitTunnel [ OK ]
- - OpenSSH option: Port [ SUGGESTION ]
- - OpenSSH option: PrintLastLog [ OK ]
- - OpenSSH option: StrictModes [ OK ]
- - OpenSSH option: TCPKeepAlive [ SUGGESTION ]
- - OpenSSH option: UseDNS [ SUGGESTION ]
- - OpenSSH option: X11Forwarding [ SUGGESTION ]
- - OpenSSH option: AllowAgentForwarding [ SUGGESTION ]
- - OpenSSH option: UsePrivilegeSeparation [ OK ]
- - OpenSSH option: AllowUsers [ NOT FOUND ]
- - OpenSSH option: AllowGroups [ NOT FOUND ]
我的系統(tǒng)上沒有運(yùn)行虛擬機(jī)或容器，所以這些顯示的結(jié)果是空的：
- [+] Virtualization
- ------------------------------------
- [+] Containers
- ------------------------------------
Lynis 會(huì)檢查一些從安全角度看很重要的文件的文件權(quán)限：
- [+] File Permissions
- ------------------------------------
- - Starting file permissions check
- File: /boot/grub2/grub.cfg [ SUGGESTION ]
- File: /etc/cron.deny [ OK ]
- File: /etc/crontab [ SUGGESTION ]
- File: /etc/group [ OK ]
- File: /etc/group- [ OK ]
- File: /etc/hosts.allow [ OK ]
- File: /etc/hosts.deny [ OK ]
- File: /etc/issue [ OK ]
- File: /etc/issue.net [ OK ]
- File: /etc/motd [ OK ]
- File: /etc/passwd [ OK ]
- File: /etc/passwd- [ OK ]
- File: /etc/ssh/sshd_config [ OK ]
- Directory: /root/.ssh [ SUGGESTION ]
- Directory: /etc/cron.d [ SUGGESTION ]
- Directory: /etc/cron.daily [ SUGGESTION ]
- Directory: /etc/cron.hourly [ SUGGESTION ]
- Directory: /etc/cron.weekly [ SUGGESTION ]
- Directory: /etc/cron.monthly [ SUGGESTION ]
在報(bào)告的底部，Lynis 根據(jù)報(bào)告的發(fā)現(xiàn)提出了建議。每項(xiàng)建議后面都有一個(gè) “TEST-ID”(為了下一部分方便，請(qǐng)將其保存起來)。
- Suggestions (47):
- ----------------------------
- * If not required, consider explicit disabling of core dump in /etc/security/limits.conf file [KRNL-5820]
- https://cisofy.com/lynis/controls/KRNL-5820/
- * Check PAM configuration, add rounds if applicable and expire passwords to encrypt with new values [AUTH-9229]
- https://cisofy.com/lynis/controls/AUTH-9229/
Lynis 提供了一個(gè)選項(xiàng)來查找關(guān)于每個(gè)建議的更多信息，你可以使用 show details 命令和 TEST-ID 號(hào)來訪問：
- ./lynis show details TEST-ID
這將顯示該測(cè)試的其他信息。例如，我檢查了 SSH-7408 的詳細(xì)信息：
- $ ./lynis show details SSH-7408
- 2020-04-30 05:52:23 Performing test ID SSH-7408 (Check SSH specific defined options)
- 2020-04-30 05:52:23 Test: Checking specific defined options in /tmp/lynis.k8JwazmKc6
- 2020-04-30 05:52:23 Result: added additional options for OpenSSH < 7.5
- 2020-04-30 05:52:23 Test: Checking AllowTcpForwarding in /tmp/lynis.k8JwazmKc6
- 2020-04-30 05:52:23 Result: Option AllowTcpForwarding found
- 2020-04-30 05:52:23 Result: Option AllowTcpForwarding value is YES
- 2020-04-30 05:52:23 Result: OpenSSH option AllowTcpForwarding is in a weak configuration state and should be fixed
- 2020-04-30 05:52:23 Suggestion: Consider hardening SSH configuration [test:SSH-7408] [details:AllowTcpForwarding (set YES to NO)] [solution:-]
試試吧
如果你想更多地了解你的 Linux 機(jī)器的安全性，請(qǐng)?jiān)囋?Lynis。如果你想了解 Lynis 是如何工作的，可以研究一下它的 shell 腳本，看看它是如何收集這些信息的。
