First of all this question is not a duplicate of this one.

What I'm asking for is an application agnostic security analyzer for a particular or all major Linux distributions. What it should do are the following:

  • check any unused port are opened (if some particular service is listening on a particular port it's OK)
  • make sure configuration files permissions for any main stream services in use are OK (e.g. setgid for bind configuration files etc.)
  • various OS hardening aspects: ssl keys are in the same folder (i.e. /etc/certs/) with right permissions, mount flags for /tmp and other partitions posses no or minimal threats, processes are bind to localhost, ssh is configured correctly (pass login disabled, root login disabled) etc.
  • monitoring configuration: root mail is forwarded to some other user, logs are stored/forwarded securely etc.

The purpose of a such tool would be validation of a freshly build packer AWS AMI or virtualbox image.

So what I'm looking for is a some kind of dynamic operating system configuration analyzer to make sure provisioning was done right and the base box used was not flawed security-wise.

Any suggestions?

  • 3
    what's an "unused open port"? – Jeff Schaller Jun 12 '17 at 13:20
  • You mean something like Microsoft Baseline Security Analyzer, just for Linux? The Center for Internet Security (CIS) provides the CAT tool to its members ($$$!) that automates the validation against their benchmarks. However, your requirements appear somewhat special, so I doubt you will find a tool that matches exactly what you asked for. – countermode Jun 12 '17 at 13:21
  • what are the "major Linux distributions" in scope? – Jeff Schaller Jun 12 '17 at 13:21
  • @JeffSchaller the service that should listen on this port is down but firewall keeps this port opened. It could cause some trouble if the service would up at some point by somebody while being not properly configured leaving security hole. Yep, the way I named it is a bit confusing. – ddnomad Jun 12 '17 at 13:27
  • Are you looking something like AppArmour – Krzysztof Stasiak Jun 12 '17 at 13:27

Lynis is a generic Linux security checker written as collection of shell scripts; it is free (GPLed) and it is designed to be extensible by site admins, so that might be the best match for what you seek for.

  • It looks quite similar to what I was searching for. Thanks a lot! – ddnomad Jun 12 '17 at 13:57

After some additional research in the same direction as the accepted answer I found one more option that might be a good choice to integrate into provision pipeline using Ansible/Chef/Puppet.

dev-sec provides ready-made Ansible playbooks (as well as Chef cookbooks and Puppet manifests) to make sure operating system complies with various security standards (NIST, ISO etc.).

The good thing about this solution is that it fixes configuration issues. The bad thing - it could be something you don't want to disable or configure in that particular way.

Not the answer you're looking for? Browse other questions tagged or ask your own question.