mirror of https://github.com/CISOfy/lynis.git
178 lines
4.9 KiB
Groff
178 lines
4.9 KiB
Groff
.TH Lynis 8 "18 Aug 2016" "1.25" "Unix System Administrator's Manual"
|
|
|
|
|
|
.SH "NAME"
|
|
\fB
|
|
\fB
|
|
\fB
|
|
Lynis \fP\- System and security auditing tool
|
|
\fB
|
|
.SH "SYNOPSIS"
|
|
.nf
|
|
.fam C
|
|
|
|
\fBlynis\fP [scan mode] [other options]
|
|
.fam T
|
|
.fi
|
|
.SH "DESCRIPTION"
|
|
|
|
\fBLynis\fP is a security auditing tool for Linux, Mac OSX, and UNIX systems. It
|
|
checks the system and the software configuration, to see if there is any room for
|
|
improvement the security defenses. All details are stored in a log file. Findings
|
|
and other discovered data is stored in a report file. This can be used to compare
|
|
differences between audits. \fBLynis\fP can run interactively or as a cronjob. Root permissions (e.g. sudo)
|
|
are not required, however provide more details during the audit.
|
|
.PP
|
|
The following system areas may be checked:
|
|
.IP
|
|
\- Boot loader files
|
|
.IP
|
|
\- Configuration files
|
|
.IP
|
|
\- Software packages
|
|
.IP
|
|
\- Directories and files related to logging and auditing
|
|
.IP
|
|
|
|
.SH "FIRST TIME USAGE"
|
|
When running \fBLynis\fP for the first time, run: lynis audit system
|
|
|
|
.SH "COMMON SCAN TYPES"
|
|
.IP "audit system"
|
|
Performs a system audit, which is the most common audit.
|
|
.IP "audit system remote \<host\>"
|
|
Provide commands to do a remote scan.
|
|
.PP
|
|
For more scan modes, see the helper utilities.
|
|
|
|
.SH "OPTIONS"
|
|
|
|
.TP
|
|
.B \-\-auditor <full name>
|
|
Define the name of the auditor/pen-tester. When a full name is used, add double
|
|
quotes, like "Your Name".
|
|
.TP
|
|
.B \-\-checkall (or \-c)
|
|
\fBLynis\fP performs a full check of the system, printing out the results of
|
|
each test to stdout. Additional information will be saved into a log file
|
|
(default is /var/log/lynis.log). This option invokes scan mode "audit system".
|
|
.IP
|
|
In case the outcome of a scan needs to be automated, use the report file.
|
|
.TP
|
|
.B \-\-config
|
|
Show which settings file or profile is being used, then quit.
|
|
.TP
|
|
.B \-\-cronjob
|
|
Perform automatic scan with cron safe options (no colors, no questions, no
|
|
breaks).
|
|
.TP
|
|
.B \-\-debug
|
|
Display debug information to screen for troubleshooting purposes.
|
|
.TP
|
|
.B \-\-developer
|
|
Display developer information when creating tests.
|
|
.TP
|
|
.B \-\-dump\-options
|
|
Show all available parameters.
|
|
.TP
|
|
.B \-\-logfile </path/to/logfile>
|
|
Defines location and name of log file, instead of default /var/log/lynis.log.
|
|
.TP
|
|
.B \-\-no\-colors
|
|
Do not use colors for messages, warnings and sections.
|
|
.TP
|
|
.B \-\-no\-log
|
|
Redirect all logging information to /dev/null, prevent sensitive information to
|
|
be written to disk.
|
|
.TP
|
|
.B \-\-pentest
|
|
Run a non-privileged scan, usually for penetration testing. Some of the tests
|
|
will be skipped if they require root permissions.
|
|
.TP
|
|
.B \-\-plugin\-dir </path/to/plugins>
|
|
Define location where plugins can be found.
|
|
.TP
|
|
.B \-\-profile <file>
|
|
Provide alternative profile to perform the scan.
|
|
.TP
|
|
.B \-\-quick (\-Q)
|
|
Do a quick scan (don't wait for user input).
|
|
.TP
|
|
.B \-\-quiet (\-q)
|
|
Run quietly and do not show anything to the screen. Will also enable quick mode.
|
|
.TP
|
|
.B \-\-report\-file <file>
|
|
Provide an alternative name for report file.
|
|
.TP
|
|
.B \-\-reverse\-colors
|
|
Optimize screen output for light backgrounds.
|
|
.TP
|
|
.B \-\-skip\-plugins
|
|
Do not run plugins.
|
|
.TP
|
|
.B \-\-tests TEST-IDs
|
|
Only run the specific test(s). When using multiple tests, add quotes around the
|
|
line.
|
|
.TP
|
|
.B \-\-tests\-from\-group "<group>"
|
|
Only perform tests from particular group of tests. Use 'show groups' to determine
|
|
valid options.
|
|
.TP
|
|
.B \-\-upload
|
|
Upload data to Lynis Enterprise server.
|
|
.TP
|
|
.B \-\-wait
|
|
Wait for user to continue. This adds a break after each section (opposed of
|
|
\-\-quick).
|
|
.TP
|
|
.B \-\-warnings\-only
|
|
Run quietly, except warnings.
|
|
.RE
|
|
.PP
|
|
.RS
|
|
Multiple parameters are allowed, though some parameters can only be used together
|
|
with others. When running Lynis without any parameters, help will be shown and
|
|
the program will exit.
|
|
.RE
|
|
.PP
|
|
.SH "HELPERS"
|
|
Lynis has special helpers to do certain tasks. This way the framework of Lynis is
|
|
used, while at the same time storing most of the functionality in a separated
|
|
file. This speeds up execution and keeps the code clean.
|
|
|
|
.IP "audit"
|
|
Run audit on the system or on other targets
|
|
.IP "show"
|
|
Provide details about Lynis
|
|
.IP "update"
|
|
Run updater utility
|
|
.PP
|
|
To use a helper, run Lynis followed by the helper name.
|
|
|
|
.SH "EXIT CODES"
|
|
Lynis uses exit codes to signal any invoking script. Currently the following codes are used:
|
|
.IP 0
|
|
Program exited normally
|
|
.IP 1
|
|
Fatal error
|
|
.IP 64
|
|
An unknown parameter is used, or incomplete
|
|
.IP 65
|
|
Incorrect data encountered
|
|
.IP 66
|
|
Can't open file or directory
|
|
.IP 78
|
|
Lynis found 1 or more warnings or configurations errors (with error-on-warnings=yes)
|
|
|
|
.SH "BUGS"
|
|
Bugs can be reported via GitHub at https://github.com/CISOfy/lynis
|
|
|
|
.SH "DOCUMENTATION"
|
|
Supporting documentation can be found via https://cisofy.com/support/
|
|
|
|
.SH "LICENSING"
|
|
Lynis is licensed as GPL v3. It was created by Michael Boelen in 2007. Development has been taken over by CISOfy. Plugins may have a different license.
|
|
|
|
.SH "CONTACT INFORMATION"
|
|
Support requests and project related questions can be addressed via e-mail: lynis-dev@cisofy.com.
|