操作系统安全：lynic安装及使用.docx

《操作系统安全：lynic安装及使用.docx》由会员分享，可在线阅读，更多相关《操作系统安全：lynic安装及使用.docx（6页珍藏版）》请在淘文阁 - 分享文档赚钱的网站上搜索。

1、lynic的安装和使用下载与安装1 .通过直接下载进行安装步骤一：建立下载的目录# mkdir -p /usr/local/lynis & cd /usr/local步骤二：下载lynis方式一:# wget 方式二:# curl 方式三：直接使用浏览器翻开页面： s:/cisofy /download/lynis/,然后选择下载步骤三：解压方式一:# 方式二：直接使用系统的解压软件直接进行解压（或者在win7解压，再拖入虚拟机）2 .通过Git进行安装克隆工程# cd /usr/local# git clone s:/github /CISOfy/lynis# cd lynis3 .通过包进

2、行安装Red Hat $ yum install lynisDebian $ a pt-get install lynisopenSUSE $ zypper install lynis4 .通过Homebrew进行安装对于Mac OS用户来说，Homebrew是可供选择的手工安装方式以及使用Git$ brew install lynis这里采用直接安装的方式，官方网站下载，解压rootlocal.host cd /usr/localrootOlocalhost local # Is bingamesliblibexecsbinsrcetcincludelib64lynis-2.7.0. tar

3、. gzsharerooWlocalhost local# tar xfvz lynis-2. 7. 0. tar. gz lynis/CHANGELOG. md lynis/CODE_OF_CONDUCT. mdlynis/CONTRIBUTING. md lynis/CONTRIBUTORS. mdrooWlocalhost local # Is bingamesliblibexeclynis-2.7.0. tar.gz shareetcincludelib64lynissbinsrcrootOlocalhost local # |运行运行查看帮助如果我们是通过包形式进行安装的话，我们可以

4、在任何目录调用lynis，例如# lynis -h , 否那么我们需要通过以下方式进行使用：# ./lynis -h #进入解压后的lynis目录，然后查看帮助信息;# ./lynis -man 该命 令查看详细使用帮助a va aw va va aw vi xzvat avtrooWlocalhost local # cd lynisrootlocalhost lynis# , /lynis -hLynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute

5、 it under the terms of the GNU General Public License. See the LICENSE file for details about using this software.2007-2018, CISOfy - s： /cisofy. com/lynis/Enterprise support available (compliance, plugins, interface and tools) # +Usage： lynis commandUsage： lynis commandauditaudit systemaudit system

6、 remote audit dockerfile audit systemaudit system remote audit dockerfile Perform local security scan Remote security scan Analyze Dockerfileshowshowshowshow versionshow helpupdateupdate inforootlocalhost lynis # . /lynis -manLynis(8)NAMEShow all commands Show Lynis version Show helpShow update deta

7、ilsUnix System Administrator s ManualLynis(8)Lynis - System and security auditing toolSYNOPSISlynis scan mode other optionsDESCRIPTIONLvnis is a security auditing tool for Linux, macOS, and other systemsOPTIONS-auditor Define the name of the auditor/pentester. When a full name is used, add double qu

8、otes, like ”Your Name.-cronjobPerform automatic scan with cron safe options (no colors, no questions, no breaks).-debugDisplay debug information to screen for troubleshooting purposes.-developerDisplay developer information when creating tests.-help Show available commands and most-used options.审计系统

9、# ./lynis audit system #该方式需要人工进行手动确认，确认后才能进行下一步检杳# ./lynis audit system -Q #该方式可以防止人工确认rootlocalhost lynis# . /lynis audit system -QLynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you welcome to redistribute it under the terms of the GNU General Public Li See the LICENSE file fo

10、r details about using this software.2007-2018, CISOfy - s： /cisofy. com/lynis/Enterprise support available (compliance, plugins, interface and tools) #+-Detecting OS. . . DONE -Checking profiles. DONE # ./lynis -c -Q#全部检直（最常用）-Checking for IDS/IPS tooling-Starting file permissions check /root/, ssh-

11、Checking shell history files-Comparing sysctl key pairs with scan profile- fs. suid_dumpable (exp： 0)- kernel. core_uses_pid (exp： 1)- kernel, ctrl-alt-del (exp: 0)DIFFERENT r ciz i- kernel. dmesg_restrict (exp: 1)# ./lynis -c -Q pentestrootlocalhost lynis# . /lynis -c -Q -pentestTIP Usage of option

12、 -c is deprecated. Please use： lynis audit system opti ns# Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under the terms of the GNU General Public License. See the LICENSE file for details about using this software.2007-2018, CISOfy - s： /ciso

13、fy. com/lynis/Enterprise support available (compliance, plugins, interface and tools)#+- Detecting OS. DONE - Checking profiles. DONE - Detecting lanquaqe and localization# ./lynis -c -Q -q auditor yy mm #只显示告警输出#./lynis -c -Q auditor yy mm cronjob /var/log/lynis/report.txt停止和暂停CTRL + C去停止该程序的运行；常用参

14、数参数说明auditor审计人员checkall,-c开始审查整个系统checkupdate检查lynis是告需要升级cronjob作为定时任务启动（includes -c-Q）-helpr-h显示帮助-manpage查看手册页nocolors不使用任何颜色pentest执行渗透测演描（非特权）-quick,-Q除错误外，不要等待用户输入-quiet仅显不警告（包括-quick,但不 辎reversecolors为浅色背景使用不同的配色方案-version,-V检查版本小技巧如果lynis不是通过带有man页面的包进行安装的话，可以输入# man lynis对于那些SHELL终端背景是浅色的某些系统，可以使用# lynis -nocolors后者# lynis -reverse-colors可以使用-h选项去显示所有可用参数，即是# lynis -h