lynis
lynis copied to clipboard
Published
20 hours ago •
CISOfy
CISOfy
Line translation question
I would like to translate the lynis output as much as possible. The problem is that some of the lines I want to translate are just missing. I can't just add the right line and its translation to the file, it won't work.
Is it even possible to translate all the lines? If so, how do I add the lines I want?
Thank you.
Hi @zaaurus - Thanks, some lines can not be translated yet. If you like you can suggest the specific lines that you see in the output, then we change those into variables. For generic items (like "OK") those can be suggested as well, in case they are not implemented yet.
Hi @mboelen.
List of unrealized strings:
Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
welcome to redistribute it under the terms of the GNU General Public License.
See the LICENSE file for details about using this software.
2007-2021, CISOfy - https://cisofy.com/lynis/
Enterprise support available (compliance, plugins, interface and tools)
Exception found!
Function/test: [GetHostID]
Message: Can't create hostid (no MAC addresses found)
Help improving the Lynis community with your feedback!
Steps:
- Ensure you are running the latest version (/usr/bin/lynis update check)
- If so, create a GitHub issue at https://github.com/CISOfy/lynis
- Include relevant parts of the log file or configuration file
Thanks!
=================================================================
=================================================================
Exception found!
Function/test: [GetHostID]
Message: Can't create HOSTID, command ip not found
Help improving the Lynis community with your feedback!
Steps:
- Ensure you are running the latest version (/usr/bin/lynis update check)
- If so, create a GitHub issue at https://github.com/CISOfy/lynis
- Include relevant parts of the log file or configuration file
Thanks!
Boot and services
[WARNING]: Test CORE-1000 had a long execution:
- Service Manager
- Checking UEFI boot
- Checking Secure Boot
- Checking systemd-boot presence
- Check running services (systemctl)
Result: found 16 running services
- Check enabled services at boot (systemctl)
Result: found 11 enabled services
- Check startup files (permissions)
- Running 'systemd-analyze security'
Kernel
- Checking CPU support (NX/PAE)
CPU support: PAE and/or NoeXecute supported
- Checking kernel version and release
- Checking kernel type
- Checking loaded kernel modules
Found 128 active modules
- Checking Linux kernel configuration file
- Checking default I/O kernel scheduler
- Checking core dumps configuration
- configuration in systemd conf files
- configuration in etc/profile
- 'hard' configuration in security/limits.conf
- 'soft' configuration in security/limits.conf
- Checking setuid core dumps configuration
- Check if reboot is needed
Memory and processes
- Checking /proc/meminfo
- Searching for dead/zombie processes
- Searching for IO waiting processes
- Search prelink tooling
Users group and authentication
- Administrator accounts
- Unique UIDs
- Consistency of group files (grpck)
- Unique group IDs
- Unique group names
- Password file consistency
- Password hashing methods
- Checking password hashing rounds
- Query system users (non daemons)
- NIS+ authentication support
- NIS authentication support
- Sudoers file(s)
- Permissions for directory: /etc/sudoers.d
- Permissions for: /etc/sudoers
- Permissions for: /etc/sudoers.d/pwfeedback
- PAM password strength tools
- PAM configuration file (pam.conf)
- PAM configuration files (pam.d)
- PAM modules
- LDAP module in PAM
- Accounts without expire date
- Accounts without password
- Locked accounts
- Checking user password aging (minimum)
- User password aging (maximum)
- Checking expired passwords
- Checking Linux single user mode authentication
- Determining default umask
- umask (/etc/profile and /etc/profile.d)
- umask (/etc/login.defs)
- LDAP authentication support
- Logging failed login attempts
Shells
- Checking shells from /etc/shells
Result: found 5 shells (valid shells: 5).
- Session timeout settings/tools
- Checking default umask values
- Checking default umask in /etc/bash.bashrc
- Checking default umask in /etc/profile
File systems
- Checking mount points
- Checking /home mount point
- Checking /tmp mount point
- Checking /var mount point
- Query swap partitions (fstab)
- Testing swap partitions
- Testing /proc mount (hidepid)
- Checking for old files in /tmp
- Checking /tmp sticky bit
- Checking /var/tmp sticky bit
- ACL support root file system
- Mount options of /
- Mount options of /boot
- Mount options of /dev
- Mount options of /dev/shm
- Mount options of /run
- Mount options of /tmp
- Total without nodev:6 noexec:11 nosuid:4 ro or noexec (W^X): 11 of total 25
- Disable kernel support of some filesystems
USB Devices
- Checking usb-storage driver (modprobe config)
- Checking USB devices authorization
- Checking USBGuard
Storage
- Checking firewire ohci driver (modprobe config)
NFS
- Check running NFS daemon
Name services
- Searching DNS domain name
- Checking /etc/hosts
- Duplicate entries in hosts file
- Presence of configured hostname in /etc/hosts
- Hostname mapped to localhost
- Localhost mapping to IP address
Ports and packages
- Searching package managers
- Searching pacman package manager
- Querying pacman package manager
- Searching update status (checkupdates)
- Checking package audit tool
Found: arch-audit
Networking
- Checking IPv6 configuration
Configuration method
IPv6 only
- Checking configured nameservers
- Testing nameservers
Nameserver: 127.0.0.1
- DNSSEC supported (systemd-resolved)
- Checking default gateway
- Getting listening ports (TCP/UDP)
- Checking promiscuous interfaces
- Checking waiting connections
- Checking status DHCP client
- Checking for ARP monitoring software
- Uncommon network protocols
Printers and Spools
- Checking cups daemon
- Checking lp daemon
Firewalls
- Checking iptables kernel module
- Checking host based firewall
SSH support
- Checking running SSH daemon
- Searching SSH configuration
- OpenSSH option: AllowTcpForwarding
- OpenSSH option: ClientAliveCountMax
- OpenSSH option: ClientAliveInterval
- OpenSSH option: Compression
- OpenSSH option: FingerprintHash
- OpenSSH option: GatewayPorts
- OpenSSH option: IgnoreRhosts
- OpenSSH option: LoginGraceTime
- OpenSSH option: LogLevel
- OpenSSH option: MaxAuthTries
- OpenSSH option: MaxSessions
- OpenSSH option: PermitRootLogin
- OpenSSH option: PermitUserEnvironment
- OpenSSH option: PermitTunnel
- OpenSSH option: Port
- OpenSSH option: PrintLastLog
- OpenSSH option: StrictModes
- OpenSSH option: TCPKeepAlive
- OpenSSH option: UseDNS
- OpenSSH option: X11Forwarding
- OpenSSH option: AllowAgentForwarding
- OpenSSH option: AllowUsers
- OpenSSH option: AllowGroups
SNMP support
- Checking running SNMP daemon
LDAP Services
- Checking OpenLDAP instance
PHP
- Checking PHP
Squid support
- Checking running Squid daemon
Logging and files
- Checking for a running log daemon
- Checking Syslog-NG status
- Checking systemd journal status
- Checking Metalog status
- Checking RSyslog status
- Checking RFC 3195 daemon status
- Checking minilogd instances
- Checking logrotate presence
- Checking remote logging
- Checking log directories (static list)
- Checking open log files
Insecure services
- Installed inetd package
- Installed xinetd package
- xinetd status
- Installed rsh client package
- Installed rsh server package
- Installed telnet client package
- Installed telnet server package
- Checking NIS client installation
- Checking NIS server installation
- Checking TFTP client installation
- Checking TFTP server installation
Banners and identification
- /etc/issue contents
Scheduled tasks
- Checking crontab and cronjob files
Accounting
- Checking accounting information
- Checking sysstat accounting data
- Checking auditd
Time and synchronization
- Checking for a running NTP daemon or client
Cryptography
- Checking for expired SSL certificates [0/3]
- Found 1 LUKS encrypted block devices.
- Found 0 encrypted and 1 unencrypted swap devices in use.
- Kernel entropy is sufficient
- HW RNG & rngd
- SW prng
- MOR variable not found
Security frameworks
- Checking presence AppArmor
- Checking AppArmor status
Found 101 unconfined processes
- Checking presence SELinux
- Checking presence TOMOYO Linux
- Checking presence grsecurity
- Checking for implemented MAC framework
Software: file integrity
- Checking file integrity tools
- dm-integrity (status)
- dm-verity (status)
- Checking presence integrity tool
System tooling
- Checking automation tooling
- Automation tooling
- Checking for IDS/IPS tooling
File permissions
- Starting file permissions check
File: /etc/group
File: /etc/group-
File: /etc/issue
File: /etc/motd
File: /etc/passwd
File: /etc/passwd-
File: /etc/ssh/sshd_config
Home directories
- Permissions of home directories
- Ownership of home directories
- Checking shell history files
Kernel hardening
- Comparing sysctl key pairs with scan profile
Hardening
- Installed compiler(s)
- Installed malware scanner
- Non-native binary formats
Custom tests
- Running custom tests...
Great, no warnings
Suggestions
Follow-up:
----------------------------
- Show details of a test (lynis show details TEST-ID)
- Check the logfile for all details (less /var/log/lynis.log)
- Read security controls texts (https://cisofy.com)
- Use --upload to upload data to central system (Lynis Enterprise users)
Lynis security scan details:
Hardening index : 65 [############# ]
Tests performed : 235
Plugins enabled : 0
Components:
- Firewall [V]
- Malware scanner [V]
Scan mode:
Normal [V] Forensics [ ] Integration [ ] Pentest [ ]
Lynis modules:
- Compliance status [?]
- Security audit [V]
- Vulnerability scan [V]
Files:
- Test and debug information : /var/log/lynis.log
- Report data : /var/log/lynis-report.dat
================================================================================
Lynis 3.0.5
Auditing, system hardening, and compliance for UNIX-based systems
(Linux, macOS, BSD, and others)
2007-2021, CISOfy - https://cisofy.com/lynis/
Enterprise support available (compliance, plugins, interface and tools)
================================================================================
[TIP]: Enhance Lynis audits by adding your settings to custom.prf (see /etc/lynis/default.prf for all settings)
and OUTDATED
Also, although these lines have a translation, they are displayed exclusively in English:
Initializing program
DONE
DEFAULT
WEAK
NON DEFAULT
