Lynis

Lynis is an auditing tool.

This is an article I had for quite a while as a draft. As part of my yearly cleanup, I've published it without finishing it. It might not be finished or have other problems.

Installation

$ sudo apt-get install colorized-logs

Problems

could not find languages directory

https://github.com/CISOfy/lynis/issues/213

Ubuntu 18.04 Audit

$ sudo -H ./lynis audit system | ansi2html -la > ~/report.html

The lynis report of Ubuntu 18.04 is super long.

Hardening

$ sudo apt-get update
$ sudo apt-get upgrade
$ sudo apt-get install debsecan debsums rkhunter
$ sudo apt-get autoremove

Kernels

List Kernels:

$ dpkg --list | grep linux-image
rc  linux-image-4.15.0-20-generic    4.15.0-20.21    amd64    Signed kernel image generic
rc  linux-image-4.15.0-22-generic    4.15.0-22.24    amd64    Signed kernel image generic
rc  linux-image-4.15.0-23-generic    4.15.0-23.25    amd64    Signed kernel image generic
rc  linux-image-4.15.0-24-generic    4.15.0-24.26    amd64    Signed kernel image generic
rc  linux-image-4.15.0-29-generic    4.15.0-29.31    amd64    Signed kernel image generic
rc  linux-image-4.15.0-30-generic    4.15.0-30.32    amd64    Signed kernel image generic
rc  linux-image-4.15.0-32-generic    4.15.0-32.35    amd64    Signed kernel image generic
rc  linux-image-4.15.0-33-generic    4.15.0-33.36    amd64    Signed kernel image generic
rc  linux-image-4.15.0-34-generic    4.15.0-34.37    amd64    Signed kernel image generic
rc  linux-image-4.15.0-36-generic    4.15.0-36.39    amd64    Signed kernel image generic
rc  linux-image-4.15.0-39-generic    4.15.0-39.42    amd64    Signed kernel image generic
rc  linux-image-4.15.0-42-generic    4.15.0-42.45    amd64    Signed kernel image generic
rc  linux-image-4.15.0-43-generic    4.15.0-43.46    amd64    Signed kernel image generic
rc  linux-image-4.15.0-44-generic    4.15.0-44.47    amd64    Signed kernel image generic
rc  linux-image-4.15.0-45-generic    4.15.0-45.48    amd64    Signed kernel image generic
rc  linux-image-4.15.0-46-generic    4.15.0-46.49    amd64    Signed kernel image generic
rc  linux-image-4.15.0-47-generic    4.15.0-47.50    amd64    Signed kernel image generic
rc  linux-image-4.15.0-50-generic    4.15.0-50.54    amd64    Signed kernel image generic
rc  linux-image-4.15.0-51-generic    4.15.0-51.55    amd64    Signed kernel image generic
rc  linux-image-4.15.0-52-generic    4.15.0-52.56    amd64    Signed kernel image generic
rc  linux-image-4.15.0-54-generic    4.15.0-54.58    amd64    Signed kernel image generic
rc  linux-image-4.15.0-55-generic    4.15.0-55.60    amd64    Signed kernel image generic
rc  linux-image-4.15.0-58-generic    4.15.0-58.64    amd64    Signed kernel image generic
rc  linux-image-4.15.0-60-generic    4.15.0-60.67    amd64    Signed kernel image generic
rc  linux-image-4.15.0-62-generic    4.15.0-62.69    amd64    Signed kernel image generic
ii  linux-image-4.15.0-64-generic    4.15.0-64.73    amd64    Signed kernel image generic
ii  linux-image-4.15.0-65-generic    4.15.0-65.74    amd64    Signed kernel image generic
ii  linux-image-generic              4.15.0.65.67    amd64    Generic Linux kernel image

The one you currently use:

$ uname -r
4.15.0-65-generic

PHP

Change /etc/php/7.2/apache2/php.ini (e.g. with sublime) to contain the following lines:

allow_url_fopen = Off
expose_php = Off

Then restart:

# apache2ctl restart

Nameservers

Other Tools

rkhunter