[ Lynis 1.2.

9 ]
################################################################################
Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
welcome to redistribute it under the terms of the GNU General Public License.
See LICENSE file for details about using this software.
Copyright 2007-2009 - Michael Boelen, http://www.rootkit.nl/
################################################################################
[+] Initializing program
------------------------------------
- Detecting OS... [ DONE ]
- Clearing log file (/var/log/lynis.log)... [ DONE ]
---------------------------------------------------
Program version: 1.2.9
Operating system: Linux
Operating system name: Ubuntu
Operating system version: 10.10
Kernel version: 2.6.35-28-generic
Hardware platform: i686
Hostname: infrati
Auditor: [Unknown]
Profile: /etc/lynis/default.prf
Log file: /var/log/lynis.log
Report file: /var/log/lynis-report.dat
Report version: 1.0
---------------------------------------------------
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
- Checking profile file (/etc/lynis/default.prf)...
- Program update status... [ NO UPDATE ]
[+] System Tools
------------------------------------
- Scanning available tools...
- Checking system binaries...
- Checking /bin... [ FOUND ]
- Checking /sbin... [ FOUND ]
- Checking /usr/bin... [ FOUND ]
- Checking /usr/sbin... [ FOUND ]
- Checking /usr/local/bin... [ FOUND ]
- Checking /usr/local/sbin... [ FOUND ]
- Checking /usr/local/libexec... [ NOT FOUND ]
- Checking /usr/libexec... [ NOT FOUND ]
- Checking /usr/sfw/bin... [ NOT FOUND ]
- Checking /usr/sfw/sbin... [ NOT FOUND ]
- Checking /usr/sfw/libexec... [ NOT FOUND ]
- Checking /opt/sfw/bin... [ NOT FOUND ]
- Checking /opt/sfw/sbin... [ NOT FOUND ]
- Checking /opt/sfw/libexec... [ NOT FOUND ]
- Checking /usr/xpg4/bin... [ NOT FOUND ]
- Checking /usr/css/bin... [ NOT FOUND ]
- Checking /usr/ucb... [ NOT FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Boot and services
------------------------------------
- Checking boot loaders
- Checking presence GRUB2... [ OK ]
- Checking presence LILO... [ NOT FOUND ]
- Checking presence YABOOT... [ NOT FOUND ]
- Check services at startup (rc2.d)... [ DONE ]
Result: found 29 services
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Kernel
------------------------------------
- Checking default run level... [ UNKNOWN ]
- Checking CPU support (NX/PAE)
CPU supports PAE and NoeXecute [ YES ]
- Checking kernel version [ DONE ]
- Checking kernel type [ DONE ]
- Checking loaded kernel modules [ DONE ]
Found 56 active modules
- Checking Linux kernel configuration file... [ FOUND ]
- Checking for available kernel update... [ OK ]
- Checking core dumps configuration... [ ENABLED ]
- Checking setuid core dumps configuration... [ DISABLED ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Memory and processes
------------------------------------
- Checking /proc/meminfo... [ FOUND ]
- Searching for dead/zombie processes... [ OK ]
- Searching for IO waiting processes... [ OK ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Users, Groups and Authentication
------------------------------------
- Search administrator accounts... [ OK ]
- Checking consistency of group files (grpck)... [ OK ]
- Checking non unique group ID's... [ OK ]
- Checking non unique group names... [ OK ]
- Checking password file consistency... [ OK ]
- Query system users (non daemons)... [ DONE ]
- Checking NIS+ authentication support [ NOT ENABLED ]
- Checking NIS authentication support [ NOT ENABLED ]
- Checking sudoers file [ FOUND ]
- Check sudoers file permissions [ OK ]
- Checking PAM password strength tools [ SUGGESTION ]
- Checking PAM configuration files (pam.conf) [ FOUND ]
- Checking PAM configuration files (pam.d) [ FOUND ]
- Checking PAM modules [ FOUND ]
- Checking LDAP module in PAM [ NOT FOUND ]
- Checking accounts without expire date [ SUGGESTION ]
- Checking user password aging [ DISABLED ]
- Determining default umask
- Checking umask (/etc/profile) [ SUGGESTION ]
- Checking umask (/etc/login.defs) [ SUGGESTION ]
- Checking umask (/etc/init.d/rc) [ SUGGESTION ]
- Checking LDAP authentication support [ NOT ENABLED ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Shells
------------------------------------
- Checking shells from /etc/shells...
Result: found 13 shells (valid shells: 5).
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] File systems
------------------------------------
- Checking mount points
- Checking /home mount point... [ OK ]
- Checking /tmp mount point... [ SUGGESTION ]
- Checking for old files in /tmp... [ OK ]
- Checking /tmp sticky bit... [ OK ]
- ACL support root file system... [ DISABLED ]
- Checking Locate database... [ FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Storage
------------------------------------
- Checking usb-storage driver (modprobe config)... [ NOT DISABLED ]
- Checking firewire ohci driver (modprobe config)... [ NOT DISABLED ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
- Check running NFS daemon... [ NOT FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Software: name services
------------------------------------
- Checking default DNS search domain... [ FOUND ]
- Checking search domains... [ FOUND ]
- Checking /etc/resolv.conf options... [ NONE ]
- Searching DNS domain name... [ UNKNOWN ]
- Checking nscd status... [ NOT FOUND ]
- Checking BIND status... [ NOT FOUND ]
- Checking PowerDNS status... [ NOT FOUND ]
- Checking ypbind status... [ NOT FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Ports and packages
------------------------------------
- Searching package managers...
- Searching dpkg package manager... [ FOUND ]
- Querying package manager...
- Checking security repository in sources.list file... [ OK ]
- Checking APT package database... [ OK ]
- Checking vulnerable packages... [ OK ]
- Checking upgradeable packages... [ SKIPPED ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Networking
------------------------------------
- Checking configured nameservers...
- Testing nameservers...
Nameserver: 172.19.10.3... [ OK ]
 Nameserver: 172.19.7.134... [ OK ]
- Minimal of 2 responsive nameservers... [ OK ]
- Checking default gateway... [ DONE ]
- Checking promiscuous interfaces... [ OK ]
- Checking waiting connections... [ OK ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Printers and Spools
------------------------------------
- Checking cups daemon... [ RUNNING ]
- Checking cups configuration file... [ OK ]
- Checking cups addresses/sockets... [ FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Software: e-mail and messaging
------------------------------------
- Checking Exim status... [ NOT FOUND ]
- Checking Postfix status... [ NOT FOUND ]
- Checking Qmail smtpd status... [ NOT FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Software: firewalls
------------------------------------
- Checking iptables kernel module... [ NOT FOUND ]
- Checking pf configuration... [ NOT FOUND ]
- Checking host based firewall [ NOT ACTIVE ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Software: webserver
------------------------------------
- Checking Apache... [ NOT FOUND ]
- Searching nginx process... [ NOT FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] SSH Support
------------------------------------
- Checking running SSH daemon... [ NOT FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] SNMP Support
------------------------------------
- Checking running SNMP daemon... [ NOT FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Databases
------------------------------------
- MySQL process status... [ FOUND ]
- Checking MySQL root password [ OK ]
- PostgreSQL processes status... [ FOUND ]
- Oracle processes status... [ NOT FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] LDAP Services
------------------------------------
- Checking OpenLDAP instance... [ NOT FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Software: PHP
------------------------------------
- Checking PHP... [ NOT FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Squid Support
------------------------------------
- Checking running Squid daemon... [ NOT FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Logging and files
------------------------------------
- Checking for a running syslog daemon... [ OK ]
- Checking Syslog-NG status [ NOT FOUND ]
- Checking Metalog status [ NOT FOUND ]
- Checking RSyslog status [ FOUND ]
- Checking RFC 3195 daemon status [ NOT FOUND ]
- Checking minilogd instances [ NONE ]
- Checking logrotate presence [ OK ]
- Checking log directories (static list) [ DONE ]
- Checking open log files [ DONE ]
- Checking deleted files in use [ FILES FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Insecure services
------------------------------------
- Checking inetd status... [ NOT ACTIVE ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Banners and identification
------------------------------------
- Checking banners...
- /etc/motd... [ FOUND ]
- /etc/issue... [ FOUND ]
- /etc/issue contents... [ WEAK ]
- /etc/issue.net... [ FOUND ]
- /etc/issue.net contents... [ WEAK ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Scheduled tasks
------------------------------------
- Checking crontab/cronjob [ DONE ]
- Checking atd status [ NOT RUNNING ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Accounting
------------------------------------
- Checking accounting information... [ NOT FOUND ]
 - Checking auditd [ NOT FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Time and Synchronization
------------------------------------
- Checking running NTP daemon... [ NOT FOUND ]
- Checking NTP client in crontab file... [ NOT FOUND ]
- Checking NTP client in cron.d files... [ NOT FOUND ]
- Checking for a running NTP daemon or client... [ WARNING ]
- Checking NTP daemon... [ NOT FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Cryptography
------------------------------------
- Checking SSL certificate expiration... [ OK ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Virtualization
------------------------------------
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Security frameworks
------------------------------------
- Checking presence AppArmor [ FOUND ]
- Checking AppArmor status [ ENABLED ]
- Checking presence SELinux [ NOT FOUND ]
- Checking presence grsecurity [ NOT FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Software: file integrity
------------------------------------
- Checking AFICK... [ NOT FOUND ]
- Checking AIDE... [ NOT FOUND ]
- Checking Osiris... [ NOT FOUND ]
- Checking Samhain... [ NOT FOUND ]
- Checking Tripwire... [ NOT FOUND ]
- Checking presence integrity tool... [ NOT FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Software: Malware scanners
------------------------------------
- Checking chkrootkit... [ NOT FOUND ]
- Checking Rootkit Hunter... [ NOT FOUND ]
- Checking ClamAV scanner... [ FOUND ]
- Checking ClamAV daemon... [ NOT FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] System Tools
------------------------------------
- Starting file permissions check...
/etc/lilo.conf [ NOT FOUND ]
/root/.ssh [ OK ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Home directories
------------------------------------
- Checking shell history files... [ OK ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Kernel Hardening
------------------------------------
- Comparing sysctl key pairs with scan profile...
- kernel.core_uses_pid (1) [ DIFFERENT ]
- kernel.ctrl-alt-del (0) [ OK ]
- kernel.exec-shield (1) [ OK ]
- kernel.sysrq (0) [ OK ]
- net.ipv4.conf.all.accept_redirects (0) [ DIFFERENT ]
- net.ipv4.conf.all.accept_source_route (0) [ OK ]
- net.ipv4.conf.all.bootp_relay (0) [ OK ]
- net.ipv4.conf.all.forwarding (0) [ OK ]
- net.ipv4.conf.all.log_martians (1) [ DIFFERENT ]
- net.ipv4.conf.all.mc_forwarding (0) [ OK ]
- net.ipv4.conf.all.proxy_arp (0) [ OK ]
- net.ipv4.conf.all.rp_filter (1) [ OK ]
- net.ipv4.conf.all.send_redirects (0) [ DIFFERENT ]
- net.ipv4.conf.default.accept_redirects (0) [ DIFFERENT ]
- net.ipv4.conf.default.accept_source_route (0) [ DIFFERENT ]
- net.ipv4.conf.default.log_martians (1) [ DIFFERENT ]
- net.ipv4.icmp_echo_ignore_broadcasts (1) [ OK ]
- net.ipv4.icmp_ignore_bogus_error_responses (1) [ OK ]
- net.ipv4.tcp_syncookies (1) [ OK ]
- net.ipv4.tcp_timestamps (0) [ DIFFERENT ]
- net.ipv6.conf.all.accept_redirects (0) [ DIFFERENT ]
- net.ipv6.conf.all.accept_source_route (0) [ OK ]
- net.ipv6.conf.default.accept_redirects (0) [ DIFFERENT ]
- net.ipv6.conf.default.accept_source_route (0) [ OK ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
[+] Hardening
------------------------------------
- Installed compiler(s)... [ FOUND ]
- Installed malware scanner... [ FOUND ]
[ Press [ENTER] to continue, or [CTRL]+C to stop ]
================================================================================
-[ Lynis 1.2.9 Results ]-
Tests performed: 137
Warnings:
----------------------------
- [23:01:29] Warning: No running NTP daemon or available client found [test:T
IME-3104] [impact:M]
Suggestions:
----------------------------
- [23:01:04] Suggestion: Install a PAM module for password strength testing l
ike pam_cracklib or pam_passwdqc [test:AUTH-9262]
- [23:01:04] Suggestion: When possible set expire dates for all password prot
ected accounts [test:AUTH-9282]
- [23:01:04] Suggestion: Configure password aging limits to enforce password
changing on a regular base [test:AUTH-9286]
- [23:01:04] Suggestion: Default umask in /etc/profile could be more strict l
ike 027 [test:AUTH-9328]
- [23:01:04] Suggestion: Default umask in /etc/login.defs could not be found
and defaults usually to 022, which could be more strict like 027 [test:AUTH-9328
]
- [23:01:04] Suggestion: Default umask in /etc/init.d/rc could be more strict
like 027 [test:AUTH-9328]
- [23:01:04] Suggestion: To decrease the impact of a full /tmp file system, p
lace /tmp on a separated partition [test:FILE-6310]
- [23:01:05] Suggestion: Disable drivers like USB storage when not used, to p
revent unauthorized storage or data theft [test:STRG-1840]
- [23:01:05] Suggestion: Disable drivers like firewire storage when not used,
to prevent unauthorized storage or data theft [test:STRG-1846]
- [23:01:21] Suggestion: Install package apt-show-versions for patch manageme
nt purposes [test:PKGS-7394]
- [23:01:22] Suggestion: Configure a firewall/packet filter to filter incomin
g and outgoing traffic [test:FIRE-4590]
- [23:01:29] Suggestion: Add legal banner to /etc/issue, to warn unauthorized
users [test:BANN-7126]
- [23:01:29] Suggestion: Add legal banner to /etc/issue.net, to warn unauthor
ized users [test:BANN-7130]
- [23:01:29] Suggestion: Enable auditd to collect audit information [test:ACC
T-9628]
- [23:01:29] Suggestion: Check if any NTP daemon is running or a NTP client g
ets executed daily, to prevent big time differences and avoid problems with serv
ices like kerberos, authentication or logging differences. [test:TIME-3104]
- [23:01:31] Suggestion: Harden the system by removing unneeded compilers. Th
is can decrease the chance of customized trojans, backdoors and rootkits to be c
ompiled and installed [test:HRDN-7220]
================================================================================
Files:
- Test and debug information : /var/log/lynis.log
- Report data : /var/log/lynis-report.dat
================================================================================
Hardening index : [48] [######### ]
================================================================================
Lynis 1.2.9
Copyright 2007-2009 - Michael Boelen, http://www.rootkit.nl/
================================================================================