tyler.durden
/
lynis
mirror of https://github.com/CISOfy/lynis.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
3,396 Commits 2 Branches 62 Tags 17 MiB
Commit Graph

3396 Commits

Author SHA1 Message Date
Topi Miettinen c2cdf54d0c
Add myself as contributor 
As requested by Michael Boelen, add my humble name to the list of
contributors. Thank you Michael for this great software!

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-20 19:03:21 +02:00
Michael Boelen 1f8b5fafde
Add OS to 'show eol' and make output easier to parse 2020-03-20 14:57:56 +01:00
Michael Boelen 27cdcec741
Add CentOS 7 (Core) 2020-03-20 14:57:28 +01:00
Michael Boelen 38310223a6
Updated date/year 2020-03-20 14:50:25 +01:00
Michael Boelen 626e2a9ab9
Updated log 2020-03-20 14:13:21 +01:00
Michael Boelen 352910e026
Merge branch 'master' of https://github.com/CISOfy/lynis 2020-03-20 14:01:14 +01:00
Michael Boelen 8c0b42cdae
Merge pull request #861 from topimiettinen/enhance-selinux-check 
Enhance SELinux checks
 2020-03-20 14:00:57 +01:00
Michael Boelen 1f3467f69a
Updated log 2020-03-20 09:47:57 +01:00
Michael Boelen bf7bd1415b
Merge pull request #867 from topimiettinen/check-dnssec-resolvectl 
Check DNSSEC status with resolvectl when available
 2020-03-20 09:46:40 +01:00
Michael Boelen 8f37edb626
Update tests.db 
Corrected test ID
 2020-03-20 09:46:08 +01:00
Topi Miettinen 820d2ec607
Check DNSSEC status with resolvectl when available 
'resolvectl statistics' shows if DNSSEC is supported by
systemd-resolved and upstream DNS servers.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-19 23:56:24 +02:00
Topi Miettinen 6de9c31cf5
Fix journalctl output parsing for recent journalctls 
Process output from journalctl (v245) like: "Archived and active
journals take up xxx.xM in the file system."

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-19 21:25:50 +02:00
Topi Miettinen 34ec6a1edf pam: pam_selinux is known good module 
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-19 21:17:52 +02:00
Topi Miettinen 9087de0dac
pam: ignore leading dash 
PAM rules may have a leading '-' character to indicate that if the
module is missing, the error will be ignored, so let's ignore it in
the check.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-19 20:55:23 +02:00
Topi Miettinen fb9cdb5c43
Enhance SELinux checks 
Display and log: permissive types (rules are not enforced), unconfined
processes (not confined by rules) and processes with initrc_t
type (generic type with weak rules).

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-19 19:45:37 +02:00
Michael Boelen ddcf9bc713
[BOOT-5122] check for defined password in all GRUB configuration files 2020-03-19 15:52:03 +01:00
Topi Miettinen 72e8f572bf
Harden mount options for /var, check also /dev and /run 
There should not be any need for char/block devices in /var, so
propose nodev. Sockets are not affected.

Check also /dev for noexec,nosuid and /run for
nodev,nosuid. Historically there was /dev/MAKEDEV script but that's
long gone.

In case a file system is not found in /etc/fstab, check if they are
mounted otherwise (e.g. via systemd mount units).

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-19 16:39:02 +02:00
Michael Boelen 6d9ebe4136
Merge pull request #857 from topimiettinen/handle-kernel-img.conf 
Check if /vmlinuz is missing due to /etc/kernel-img.conf
 2020-03-19 15:33:47 +01:00
Michael Boelen 51d727d611
Merge pull request #858 from topimiettinen/fix-enabled-running-processes 
Fix logging of running and enabled services
 2020-03-19 15:32:54 +01:00
Michael Boelen 00a31c6dbd
Updated log 2020-03-19 15:29:01 +01:00
Michael Boelen 0a5edf0ed7
Merge pull request #859 from topimiettinen/check-for-refind 
[BOOT-5109] Test presence rEFInd boot loader
 2020-03-19 15:27:44 +01:00
Topi Miettinen 3aaeeea856
Check for rEFInd boot loader 
Detect rEFInd boot loader (https://www.rodsbooks.com/refind/).

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-19 15:44:30 +02:00
Topi Miettinen 80a67914c3
Fix logging of running and enabled services 
Log lines for running and enabled services were mixed up, fix.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-19 15:25:59 +02:00
Topi Miettinen f15fbfa6ed
Check if /vmlinuz is missing due to /etc/kernel-img.conf 
If /etc/kernel-img.conf has the line do_symlinks=No, Debian (probably
also Ubuntu) kernel packages will not update /vmlinuz
etc. symlinks. In that case, guess the kernel from uname -r.

Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
 2020-03-19 15:16:37 +02:00
Michael Boelen e5c1f2f303
Updated log 2020-03-19 11:01:22 +01:00
Michael Boelen 671c443641
Merge pull request #845 from maczniak/master 
[SSH-7408] fix OpenSSH server version check
 2020-03-19 11:00:38 +01:00
Michael Boelen b523352a59
Merge pull request #830 from Schmuuu/fix/vmlinuz-check 
restructered test and fixed vmlinuz detection
 2020-03-19 10:58:27 +01:00
Michael Boelen bc4146555c
[PKGS-7388] Only perform test when all conditions are correct 2020-03-19 10:51:02 +01:00
Michael Boelen cc78713c6a
Updated log 2020-03-18 11:43:29 +01:00
Michael Boelen 8a42643373
Merge pull request #822 from pyllyukko/vmlinuz-raspbian 
KRNL-5788 in Raspi: don't complain about missing /vmlinuz
 2020-03-18 11:39:58 +01:00
Michael Boelen eaafbb642e
Updated log 2020-03-18 11:37:06 +01:00
Michael Boelen 6a5ea9471e
Merge pull request #828 from gfelkel/patch-1 
FILE-6310 for HP-UX
 2020-03-18 11:35:03 +01:00
Michael Boelen 6e3e93d585
[PKGS-7388] only perform check for Debian, Mint, Ubuntu 2020-03-17 16:05:14 +01:00
Michael Boelen 77dd0e0bbe
Merge pull request #853 from deltablot/php 
Skip the PHP cli configuration file when looking for expose_php
 2020-03-17 14:02:51 +01:00
Michael Boelen a012d75e78
Merge branch 'master' of https://github.com/CISOfy/lynis 2020-03-17 13:03:37 +01:00
Michael Boelen d1db448c51
Skip pacman when it is the game instead of package manager 2020-03-17 13:02:59 +01:00
Michael Boelen 70dc4c36a6
Merge pull request #854 from duck-rh/manpage_fix 
Fix quote syntax error in manpage
 2020-03-17 11:43:03 +01:00
Marc Dequènes (Duck) 7c01b9784b
Fix quote syntax error in manpage 
Quotes have a special meaning when used at the start of line.
 2020-03-17 12:01:21 +09:00
Michael Boelen 7a1719ef75
Updated log 2020-03-12 16:01:19 +01:00
Michael Boelen 0b0b0ea905
Style improvement 2020-03-12 16:01:11 +01:00
Michael Boelen 83a9470b72
Merge pull request #829 from gfelkel/patch-2 
AUTH-9228 for HP-UX
 2020-03-12 15:59:33 +01:00
Michael Boelen 30a456c5f4
Updated log 2020-03-11 15:56:32 +01:00
Michael Boelen 2f9f25a2bf
Merge pull request #842 from chifu1234/master 
add basic xbps/void support
 2020-03-11 15:53:57 +01:00
Michael Boelen efc591c791
Merge pull request #846 from Skactor/patch-2 
Update tests_shells
 2020-03-11 15:52:33 +01:00
Michael Boelen 73491ec850
Merge pull request #843 from Skactor/patch-1 
Update tests_ports_packages
 2020-03-10 15:21:08 +01:00
Nicolas CARPi 600cb84310 Use a POSIX implementation to check for substring 
This works with all shells, even busybox.
 2020-03-05 21:42:54 +01:00
Nicolas CARPi 0593c69f2f Skip the PHP cli configuration file when looking for expose_php 
The expose_php configuration option is only relevant for non-cli PHP and
thus lynis should not look for it in config files that are for cli

Fix #849
 2020-03-05 00:53:27 +01:00
Michael Boelen 24ca3c2045
Updated log 2020-03-04 19:38:22 +01:00
Michael Boelen 3f883106c9
Merge pull request #840 from deltablot/ssh 
Remove the test for ssh config VerifyReverseMapping
 2020-03-04 19:36:56 +01:00
Michael Boelen 28bd36d9c6
Added Fedora 2020-03-04 15:09:10 +01:00