forked from CISOfy/lynis
-
Notifications
You must be signed in to change notification settings - Fork 0
/
CHANGELOG
2009 lines (1649 loc) · 73.2 KB
/
CHANGELOG
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
================================================================================
Lynis - Changelog
================================================================================
Author: Michael Boelen (michael.boelen@cisofy.com)
Description: Security and system auditing tool
Website: https://cisofy.com/lynis/
GitHub: https://github.com/CISOfy/lynis
Support policy: See section 'Support' in README file
Commercial support and plugins available via CISOfy
Documentation: See web site, README, FAQ and CHANGELOG file
================================================================================
= Lynis 2.1.x (development version for 2.2.x) =
*** THIS CHANGELOG IS IN PREPARATION FOR THE NEW 2.2.0 RELEASE ***
We are proud to present this new release of Lynis. It is a major upgrade, and the
result of many months of work. This version includes new features and tests, and
many small enhancements, to improve the tool. We encourage all to test and
upgrade to this latest release.
* Automation tools
------------------
CFEngine detection has been further extended. Additional logging and reporting of automation tools.
* Authentication
----------------
Depending on the operating system, Lynis now tries to determine if failed logins are properly logged. This includes
checking for /etc/login.defs [AUTH-9408]. Merged previous password check for Solaris into test AUTH-9228.
New plugin is introduced to analyze PAM settings. It including items like:
- Two-factor authentication methods
- Minimum password length, password strength and protection status against brute force cracking
- Password history
Report option: auth_failed_logins_logged
* Compliance
------------
This release prepares for upcoming extensions to assist with compliance testing. The profile has a new option, which can b
Added new compliance_standards option to default.prf. This defines if compliance testing should be performed in future, and for which standards.
Right now these standards can be selected:
- CIS benchmarks
- HIPAA
- ISO27001/ISO27002
- PCI DSS
* DNS and Name services
-----------------------
Support added for Unbound DNS caching tool [NAME-4034]
Configuration check for Unbound [NAME-4036]
Record if a name caching utility is being used like nscd or Unbound. Also logging to report as field name_cache_used
* Firewalls
-----------
Test for IPFW firewall on FreeBSD has been improved: status of pflogd will no
longer be displayed, when pf is not available.
New test FIRE-4532 introduced for detection of the Mac OS X application firewall.
Also the status of application firewalls is audited now.
FIRE-4508 is another new test, which tests chains of iptables and their default
policy (ACCEPT or DROP). This release also supports the upcoming nftables
technology with new test FIRE-4536. It is expected that it will replace iptables
later on, so this test will perform a status check. Additional FIRE-4548 will
perform a version detection of the userland utility nft and determine if there
are any rules configured.
Renamed FIRE-4511 to FIRE-4502.
* Hardware
----------
Detection of firewire is enhanced (both ohci and core detected).
* Logging
---------
Extended the test syslog-ng logging to remote systems
* Malware
---------
ESET and LMD (Linux Malware Detect) are recognized as a malware scanner. Discovered malware scanners are also logged to the report.
* Mount points
--------------
FILE-6374 is expanded to test for multiple common mount points and define best practice mount flags.
* Networking
------------
NETW-2600 collects IPv6 configuration and best practices for Linux.
NETW-3004 now collects network interface names from most common operating systems.
* Operating systems
-------------------
Improved support for Debian 8 systems. Detection for VMware release has been added.
Boot loader exception is not longer displayed when only a subset of tests is performed.
FreeBSD systems can now use service command to gather information about enabled services.
Support for boot loader detection on Mac OS X
* Passwords
-----------
AUTH-9286 change has been extended to both capture minimum and password age.
* Software and Packages
-----------------------
Log when vulnerable software packages were found
* SSH
-----
Multiple configuration tests of SSH are now merged into SSH-7408. This enables easier testing later on and reduces repetition.
* UEFI and Secure Boot
----------------------
Initial support to test UEFI settings, including Secure Boot option
Options boot_uefi_booted and boot_uefi_booted_secure added to report file
* Virtual machines and Containers
---------------------------------
Detection of virtual machines has been extended in several ways. Now VMware tools (vmtoolsd) are detected and machine state is improved with tools
like Puppet Facter, dmidecode, and lscpu. Properly detect Docker on CoreOS systems, where it before gave error as it found directory /usr/libexec/docker.
Check file permissions for Docker files, like socket file [CONT-8108]
* Individual tests
------------------
[AUTH-9204] Exclude NIS entries to avoid false positives
[AUTH-9230] Removed test as it was merged into AUTH-9228
[AUTH-9288] Test for expired passwords
[AUTH-9328] Show correct message when no umask is found in /etc/profile. It also includes improved logging, and support for /etc/login.conf on systems like FreeBSD.
[BOOT-5106] New test to test boot loader on Mac OS X
[BOOT-5180] Only gets executed if runlevel 2 is found
[CONT-8108] New test to test for Docker file permissions
[FILE-6410] Added /var/lib/locatedb as search path
[FIRE-4508] Added chains test for iptables
[FIRE-4511] Renamed to FIRE-4502
[FIRE-4536] Support for nftables detection
[FIRE-4538] Basic configuration check for for nftables
[HOME-9310] Use POSIX compatible flags to avoid errors on BusyBox
[LOGG-2154] Additional support for log destinations for syslog-ng
[PKGS-7308] Split package name and version for RPM based package manager
[MALW-3278] New test to detect LMD (Linux Malware Detect)
[NETW-2600] IPv6 configuration check for Linux
[NETW-3032] Added ARP monitoring software test
[SHLL-6230] Test for umask values in shell configuration files (e.g. rc files)
[TIME-3104] Show only suggestion on FreeBSD systems if ntpdate is configured, yet ntpd isn't running
[TIME-3170] New test to check NTP configuration files and determine if any of them are world writable
* Functions
-----------
[DigitsOnly] New function to extract only numbers from a text string
[DisplayManual] New function to show text on screen without any markup
[ExitCustom] New function to allow program to exit with a different exit code, depending on outcome
[GetHostID] If no MAC address is found, use SSH keys for creation of a host identifier
[IsWordWritable] Changed return codes for easier usage of the function
[LogText] Replaces the older logtext function
[RandomString] Creates a random string of characters
[Report] Replaces the older report function
[ReportSuggestion] Allows two additional parameters to store details (text and external reference to a solution)
[ReportWarning] Like ReportSuggestion() has additional parameters
[ShowComplianceFinding] Display compliance findings
[ShowSymlinkPath] Ensure readlink is available
* General improvements
----------------------
- When using pentest mode, it will continue without any delays (=quick mode).
- Data uploads: provide help when self-signed certificates are used.
- Improved output for tests which before showed results as a warning, while actually are just suggestions.
- Lynis now uses different exit codes, depending on errors or finding warnings. This helps with automation and any custom scripting you want to apply.
- Preparations to allow compressing the Lynis report file and enhance uploads.
- Tool tips are displayed, to make Lynis even easier to use.
- PID file has additional checks, including cleanups.
* Special thanks
----------------
We like to specifically thank Kamil Boratyński for his contributions to this release.
* Plugins
---------
[PAM] New plugin available in all versions of Lynis
[PLGN-2804] Limit report output of EXT file systems to 1 item per line
--------------------------------------------------------------
= Lynis 2.1.1 (2015-07-22) =
This release adds a lot of improvements, with focus on performance, and
additional support for common Linux distributions and external utilities.
We recommend to use this latest version.
* Operating system enhancements
-------------------------------
Support for systems like CentOS, openSUSE, Slackware is improved.
* Performance
-------------
Performance tuning has been applied, to speed up execution of the audit on
systems with many files. This also includes code cleanups.
* Automatic updates
-------------------
Initial work on an automatic updater has been implemented. This way Lynis
can be scheduled for automatic updating from a trusted source.
* Internal functions
--------------------
Not all systems have readlink, or the -f option of readlink. The
ShowSymlinkPath function has been extended with a Python based check, which
is often available.
* Software support
------------------
Apache module directory /usr/lib64/apache has been added, which is used on
openSUSE.
Support for Chef has been added.
Added tests for CSF's lfd utility for integrity monitoring on directories and
files. Related tests are FINT-4334 and FINT-4336.
Added support for Chrony time daemon and timesync daemon. Additionally NTP
sychronization status is checked when it is enabled.
Improved single user mode protection on the rescue.service file.
* Other
-------
Check for user permissions has been extended.
Python binary is now detected, to help with symlink detection.
Several new legal terms have been added, which are used for usage in banners.
In several files old tests have been removed, to further clean up the code.
* Bug fixes
---------
Nginx test showed error when access_log had multiple parameters.
Tests using locate won't be performed if not present.
Fix false positive match on Squid unsafe ports [SQD-3624].
The hardening index is now also inserted into the report if it is not displayed
on screen.
* Functions
---------
Added AddSystemGroup function
* New tests
---------
Several new tests have been added:
[PKGS-7366] Scan for debsecan utility on Debian systems
[PKGS-7410] Determine amount of installed kernel packages
[TIME-3106] Check synchronization status of NTP on systemd based systems
[CONT-8102] Docker daemon status and gather basic details
[CONT-8104] Check docker info for any Docker warnings
[CONT-8106] Check total, running and unused Docker containers
* Plugins
---------
[PLGN-2602] Disabled by default, as it may be too slow for some machines
[PLGN-3002] Extended with /sbin/nologin
* Documentation
---------------
A new document has been created to help with the process of upgrading Lynis.
It is available at https://cisofy.com/documentation/lynis/upgrading/
--------------------------------------------------------------
= Lynis 2.1.0 (2015-04-16) =
* General
---------
Screen output has been improved to provide additional information.
* OS support
------------
CUPS detection on Mac OS has been improved. AIX systems will now use csum
utility to create host ID. Group check have been altered on AIX, to include
the -n ALL. Core dump check on Linux is extended to check for actual values
as well.
* Software
----------
McAfee detection has been extended by detecting a running cma binary.
Improved detection of pf firewall on BSD and Mac OS. Security patch checking
with zypper extended.
* Session timeout
-----------------
Tests to determine shell time out setting have been extended to account for
AIX, HP-UX and other platforms. It will now determine also if variable is
exported as a readonly variable. Related compliance section PCI DSS 8.1.8
has been extended.
* Documentation
---------------
- New document: Getting started with Lynis
https://cisofy.com/documentation/lynis/get-started/
* Plugins (Enterprise)
----------------------
- Update to file integrity plugin
Changes to PLGN-2606 (capabilities check)
- New configuration plugins:
PLGN-4802 (SSH settings)
PLGN-4804 (login.defs)
Download link: https://cisofy.com/download/lynis/
--------------------------------------------------------------
= Lynis 2.0.0 (2015-02-25) =
The first release within the 2.x branch! It includes several new features, to
simplify or improve auditing on Unix based systems, including BSD, Linux,
Mac OS and more traditional systems like AIX, HPUX and Solaris.
New features and many improvements are the reason for the bump to a major
release, also a beginning of a new era. Many tools to audit or harden systems
have being released, yet none have been maintained over a long period of time.
* Support and Feedback
This software is supported and under development by CISOfy. By providing a
dual license, this software is kept up-to-date and enhanced. Both customers
and the community, benefit from this licensing. This release is available
thanks to your input and feedback.
* Helpers
New in this release is the support for helpers. Small utilities which enhance
Lynis by providing a single goal. The first helper available is to audit
Docker build files.
* Improved OS support
Many changes have been implemented to better support Linux, FreeBSD, NetBSD
DragonBSD and OpenBSD in particular. Upcoming releases will include smaller
"improvement rounds" for other systems as well.
* New technologies
More utilities and technologies are supported now. Technologies and tools
like systemd, Docker, nftables.
* Lynis Enterprise
As this code is shared, customers have an additional option to define to
what server they want to upload the audit results. Also, commercial plugins
have been bundled.
* New parameters
Several new options have been added:
--dump-options (see all options)
--report-file (define a different location for the report file)
* General
Documentation on the website has been extended: https://cisofy.com/support/
The man page, Lynis binary and several tests have improved texts.
This release is exceptional in that it includes many changes. We have done
a lot of testing on different platforms. You could expect this software to be
stable. Still, an assumption is no guarantee and especially no substitution
for testing in your own environment. If you encounter issues, please report
them via one of the links above in this changelog.
Enjoy this new release!
================================================================================
* 1.6.4 (2014-11-04)
New:
- Boot loader detection for AIX [BOOT-5102]
- Detection of getcap and lsvg binary
- Added filesystem_ext to report
- Detect rootsh
Changes:
- Hide errors when RPM database is faulty and show suggestion instead [PKGS-7308]
- Allow OpenBSD to gather information on listening network ports [NETW-3012]
- Don't trigger warning for Shellshock when doing segfault test [SHLL-6290]
- Do not run Apache test on OpenBSD and strip control chars [HTTP-6624]
- Extended AIDE test with configuration validation test [FIND-4314]
- Improved Shellshock test regarding non-Linux support [SHLL-6290]
- Added support for gathering volume groups on AIX [FILE-6311]
- Properly parse PAM lines and add them to report [AUTH-9264]
- Support for boot loader detection on OpenBSD [BOOT-5159]
- Added uptime detection for OpenBSD systems [BOOT-5202]
- Support for volume groups on AIX [FILE-6312]
- Redirect errors when searching for readlink binary
--
* 1.6.3 (2014-10-14)
New:
- Added tests for Shellshock bash vulnerability [SHLL-6290]
- Added test to determine if Snoopy is used [ACCT-9636]
- New test for qdaemon configuration file [PRNT-2416]
- Test for GRUB boot loader password [BOOT-5122]
- New test for qdaemon printer jobs [PRNT-2420]
- Added ClamXav test for Mac OS X [MALW-3288]
- Gentoo vulnerable packages test [PKGS-7393]
- New test for qdaemon status [PRNT-2418]
- Gentoo package listing [PKGS-7304]
- Running Lynis without root permissions will start non-privileged scan
- Systemd service and timer example file added
- Added grub2-install to binaries
Changes:
- Adjustments so insecure SSL protocols are detected in nginx config [HTTP-6710]
- Directories will be skipped when searching for nginx log files [HTTP-6720]
- Only gather unique name servers from /etc/resolv.conf [NAME-2704]
- Properly detect mod_evasive on Gentoo and others [HTTP-6640]
- Improved swap partition detection in /etc/fstab [FILE-6336]
- Improvements to kernel detection (e.g. Gentoo) [KRNL-5830]
- Test for built-in security options in YUM [PKGS-7386]
- Improved boot loader detection for GRUB2 [BOOT-5121]
- Split GRUB test into two tests [BOOT-5122]
- Added Mac OS uptime check [BOOT-5202]
- Improved GetHostID function for systems having only ip binary
- Improved testing for symlinked binary directories
- Minor adjustments to log output
- Renamed dev directory to extras
--
* 1.6.2 (2014-09-22)
New:
- IsVirtualMachine function to check if system is running in VM
VM types: Bochs CPU emulation, IBM z/VM, KVM, Linux Containers,
libvirt LXC driver (Linux Containers), Microsoft Virtual PC, OpenVZ,
Oracle VM VirtualBox, QEMU, Systemd Namespace container,
User-Mode Linux (UML), VMware products, XEN
- Detection for SaltStack configuration management tooling
- ShowSymlinkPath function to check path behind a symlink
- Check of configuration options of pacman [PKGS-7314]
- Support for drill binary to check for Lynis update
- FileIsEmpty function to check for empty files
- Detect updates for Arch Linux [PKGS-7312]
- Add detection for machine ID (systemd)
- Added linux_config_file to report
- Bash completion script for Lynis
- Added detection of ss binary
Changes:
- Extended system reboot check, to enable it for most Linux versions[KRNL-5830]
- Improved inetd test to avoid false positive with xinetd process [INSE-8002]
- Permissions check has been adjusted to allow packaging and pentest mode
- Added detection for compressed Linux config file [KRNL-5728]
- Added support for compressed Linux config file [KRNL-5730]
- Store PID file in home directory of the user, if needed
- Added usage of ss to gather listening ports [NETW-3012]
- Additional permission added to CUPS check [PRNT-2307]
- Extended telnet in inetd test [INSE-8016]
- Fix for reading at.deny file [SCHD-7720]
- Removed individual warnings [BOOT-5184]
- Several improvements for Arch Linux
--
* 1.6.1 (2014-09-09)
New:
- Added --pentest parameter to run a non-privileged scans (e.g. for pentesting)
- Show skipped tests in report if they require root and scan is non-privileged
Changes:
- Improved vulnerable packages test on Debian based systems (apt-check) [PKGS-7392]
- Don't show warnings for 'swap' in 4th column fstab file [FILE-6336]
- Remove warning for old files in /tmp [FILE-6354]
- CheckUpdates function will have better output when no connection is available
- Changes to parameters and functions, to allow penetration tests with Lynis
- Test for actual files in /etc/modprobe.d before grepping in it
- Improved chown command when file permissions are incorrect
- Changed output of update test, show when status is unknown
- No scanning of symlinked directories (binaries test)
- Extended SafePerms function to also check for UID
- Several tests will have root-only bit set now
- Improved netstat tests on Arch Linux
--
* 1.6.0 (2014-08-27)
New:
- Added several new plugins to default profile
- HostID detection for AIX
Changes:
- Improvements for log file
- GetHostID function improved
- Improved detection of security repository for Debian based systems [PKGS-7388]
- Set default values for update check, to avoid error message on screen
- Cleanup for mail section, adding IMAP and POP3 protocols
--
* 1.5.9 (2014-07-31)
New:
- New NetBSD test for vulnerable software packages [PKGS-7380]
- Test if Debian based systems need a reboot [KRNL-5830]
- Test for running Sendmail daemon [MAIL-8880]
- Test for availability of mtree [FINT-4330]
- Check for lp daemon (printing) [PRNT-2314]
- Added Qmail status detection [MAIL-8860]
- New NetBSD boot loader test [BOOT-5126]
- Added test for automation tools like Cfengine and Puppet [TOOL-5002]
- Added KRNL-5830 control to website
- Added detection for Puppet
- Added tooling category
Changes:
- Security repository test extended with /etc/apt/sources.list.d [PKGS-7388]
- Added exception case for CUPS configuration (listen statement) [PRNT-2308]
- Improved detection of TMOUT setting in shell profile file [SHLL-6220]
- Perform promiscuous interfaces test for NetBSD as well [NETW-3014]
- Perform swap partition parameters test on all systems [FILE-6336]
- Also check password file on DragonFlyBSD and NetBSD [AUTH-9208]
- Show message regarding toor user for all systems [AUTH-9204]
- Check for available interfaces on NetBSD as well [NETW-3004]
- Extended UFS file system test with FFS support [FILE-6329]
- Improvements for step-tickers file test [TIME-3160]
- Perform sockstat test for NetBSD [NETW-3012]
- Gather IP addresses for NetBSD [NETW-3008]
- Test MAC addresses on NetBSD [NETW-3006]
- Added /usr/X11R7/bin directory to search for binaries
- Improved full qualified domain name (FQDN) check for Linux
- Don't show follow-up hints when there are no warnings or suggestions
- Improved IsRunning function to better target processes
- Several smaller adjustments in text and descriptions
- Extended ReportException function with logging text
- Improved GetHostID function for NetBSD and Solaris
- Added printing_daemon and mail_daemon to report
- Binaries extended with tools like kstat, puppet
--
* 1.5.8 (2014-07-24)
New:
- Testing for commercial anti-virus solutions like McAfee and Sophos [MALW-3280]
- New control text for MALW-3280 - http://cisofy.com/controls/MALW-3280/
Changes:
- Extended GRUB test with encrypted password (SHA1) [BOOT-5121]
- Check /etc/profile for multiple umask values [AUTH-9328]
- Extended PHP disabled functions test [PHP-2320]
- Add gpgcheck parameter to YUM test [PKGS-7387]
- Squid configuration file permissions test adjusted and control added to website [SQD-3613]
- Logging has been extended and exceptional event text adjusted
--
* 1.5.7 (2014-07-09)
New:
- Implementation of SafePerms function
- Added notification when exceptions are found
Changes:
- Fix for error_log handling in nginx
--
* 1.5.6 (2014-06-12)
New:
- Test for PHP binary and PHP version
- Don't perform register_global test for systems running PHP 5.4.0 and later [PHP-2368]
- Debug function (can be activated via --debug or profile)
Changes:
- Extended IsRunning function
- Removed suggestion from secure shell test [SHLL-6202]
- Check for idle session handlers [SHLL-6220]
- Also check for apache2 binary (file instead of directory)
- New report values: session_timeout_enabled and session_timeout_method
- New report value for plugins: plugins_enabled
- Fixed test to determine active TCP sessions on Linux [NETW-3012]
--
* 1.5.5 (2014-06-08)
New:
- Check for nginx access logging [HTTP-6712]
- Check for missing error logs in nginx [HTTP-6714]
- Check for debug mode in nginx [HTTP-6716]
Changes:
- Extended SSL test for nginx when using listen statements
- Allow debugging via profile (config:debug:yes)
- Check if discovered httpd file is actually a file
- Improved temporary file creation related to security notice
- Adjustments to screen output
Security Note:
This releases solves two issues regarding the usage of temporary
files (predictability of the file names). You are advised to upgrade
to this version as soon as possible. For more information see the
our blog post: http://linux-audit.com/lynis-security-notice-154-and-older/
--
* 1.5.4 (2014-06-04)
New:
- Check additional configuration files for nginx [HTTP-6706]
- Analysis of nginx settings [HTTP-6708]
- New test for SSL configuration of nginx [HTTP-6710]
Changes:
- Altered SMBD version check for Mac OS
- Small adjustments to report for readability
--
* 1.5.3 (2014-05-19)
New:
- Support for zypper package manager
- Gather installed packages with Zypper on SuSE systems [PKGS-728]
- Check for vulnerable packages with Zypper package manager [PKGS-7330]
Changes:
- Check for aide.conf also in /etc [FINT-4315]
- Adjusted screen output for unreliable NTP peers [TIME-3120]
- Adjusted check kernel test for non-Linux systems [KRNL-5730]
- Improved screen output on AIX systems with echo command
--
* 1.5.2 (2014-05-05)
New:
- Support for runlevel in binaries test
Changes:
- Added suggestion for kernel availability check [KRNL-5788]
- Added suggestion for services at startup and proper binary call [BOOT-5180]
- Added suggestion to configure accounting on FreeBSD [ACCT-2754]
- Added suggestion to configure Linux process accounting [ACCT-9622]
- Several new controls listed on website
- Adjusted hardening index if total score was zero
- Added suggestion for auditd.conf file [ACCT-9632]
- Removed suggestion for audit log file [ACCT-9634]
- Removed warning from NTP falsetickers test, added data to report [TIME-3132]
- Removed warning from NTP selected time source test [TIME-3124]
--
* 1.5.1 (2014-04-22)
Changes:
- Extended reporting with running databases and frameworks
- Adjusted Oracle status in test [DBS-1840]
- Extended grsecurity test [RBAC-6272]
- Redirect rpcinfo errors to /dev/null
- Adjusted color scheme
--
* 1.5.0 (2014-04-10)
New:
- Support for Amazon Linux
- NTP check for step-tickers file (Red Hat and clones) [TIME-3160]
Changes:
- Minor textual changes in description of several controls
- Removed several warnings (usage of suggestions instead)
- Website has now more information for several controls
- Extended detection for Oracle Linux
- Updated the FAQ and README files
--
* 1.4.9 (2014-04-03)
New:
- Added links in report to related control documentation on website
- Detect Linux I/O kernel scheduler [KRNL-5730]
Changes:
- Check for non-unique accounts on several platforms [AUTH-9208]
- Set initial discover value for PAM modules to zero [AUTH-9268]
--
* 1.4.8 (2014-03-27)
Changes:
- Adjusted resolv.conf domain setting in report [NAME-4016]
- Extend account test with /var/log/pacct [ACCT-9620]
- Added suggestion to DNS domain name test [NAME-4028]
- Changed text strings of ZFS test [FILE-6330]
- Extend LILO password test [BOOT-5139]
- Set default value for pf firewall
--
* 1.4.7 (2014-03-21)
New:
- New configuration item to set group name
- Search for AIDE configuration file (aide.conf) [FINT-4315]
- Check for usage of SHA256/SHA512 in AIDE configuration [FINT-4316]
- Added grep to list of binaries
Changes:
- Added suggestion when using NIS or NIS+ [NAME-4302]
- Clean-up of unneeded plugin section
- Small typo fix
--
* 1.4.6 (2014-03-14)
New:
- Check for GPG signing in yum.conf [PKGS-7387]
- Check CUPS configuration file permissions [PRNT-2307]
Changes:
- Screen cleanup
--
* 1.4.5 (2014-03-08)
New:
- Support for Chakra Linux
- Support for pacman binary (package manager)
- Query installed packages on systems with pacman [PKGS-7310]
Changes:
- Avoid logging to screen when falsetickets are found [TIME-3132]
- Skipping FIFO file on Solaris systems when checking for cron jobs [TIME-3104]
- Extended uptime test for Solaris systems [BOOT-5202]
- Added /usr/lib/security to PAM locations to scan
- Report cronjobs to report [SCHD-7704]
- HostID support for Solaris
- Improved color scheme
- Extended logging
--
* 1.4.4 (2014-03-03)
New:
- Detect tune2fs binary
- Added ExitFatal() function
- Added egrep binary to binaries
- Initial plugin support (phase 1)
- Added InsertPluginSection() function
Changes:
- Adjusted disabled functions tests to properly find functions [PHP-2320]
- Extended time test with egrep binary replace for Solaris [TIME-3104]
- Adjusted color for SNMP test when warning is found [SNMP-3306]
- Adjusted text for PHP risky functions [PHP-2320]
- Refer to discovered binaries for ifconfig, lsmod, tune2fs
- Test plugin directory when provided by --plugin-dir
- Scan report extended with plugin information
- Extended help for Enterprise options
- Improved IsRunning() function
- Extended color scheme
--
* 1.4.3 (2014-02-23)
New:
- Support for ClearOS
- Data upload for Lynis Enterprise users (--upload)
- Added debug variable for troubleshooting purposes
- Scan profile option license_key
Changes:
- Skip password check for Red Hat or clones [AUTH-9282]
- Extended single user login protection [AUTH-9308]
- Adjusted repolist check for yum based systems [PKGS-7383]
- Inserted sleep time when update is found
- Extended report output
--
* 1.4.2 (2014-02-19)
Changes:
- Ignore interfaces aliases for HostID
- Extended umask tests with pam_umask entries [AUTH-9328]
- Check for supressed version on Squid [SQD-3680]
--
* 1.4.1 (2014-02-15)
New:
--plugin-dir parameter
Changes:
- Added 64 bits locations for Apache modules
- Add start of new category to logfile
- Extended sysstat test with /etc/cron.d/sysstat [ACCT-9626]
- Extended cron job tests with entries start with asterix (*) [SCHD-7704]
- Additional check for multiple umask entries (like RHEL 6.x) [AUTH-9328]
- Adjusted PHP test for register_globals (explicit test) [PHP-2368]
- Small adjustments for upcoming plugin support
- Extended man page
--
* 1.4.0 (2014-01-29)
Changes:
- Removed some warnings, to prevent double messages
- Extended accounting check for Linux [ACCT-9622]
- Added consistency check to time test [TIME-3124]
- Added support for anacron jobs [SCHD-7704]
- Rewrite of YUM repository test [PKGS-7383]
- Use binary variables for hostid creation
- AIX version detection changed
- Added rpcinfo to binaries check
- Ignore LANG global setting
- Improved logging
--
* 1.3.9 (2014-01-09)
Changes:
- Additional support for Mac OS
- Support for shasum binary
- Performance adjustment for lsof tests
- Extended interface check for hostid creation
- Improved NSCD detection [NAME-4032]
- Bug fix for passwdqc [AUTH-9262]
- Extended vulnerable packages test [PKGS-7392]
- Hide possible sysctl errors [KRNL-5820]
--
* 1.3.8 (2013-12-25)
New:
- New parameter --view-categories to display available test categories
- Added /etc/hosts check (duplicates) [NAME-4402]
- Added /etc/hosts check (hostname) [NAME-4404]
- Added /etc/hosts check (localhost mapping) [NAME-4406]
- Portmaster test for possible port upgrades [PKGS-7378]
- Check for SPARC improve boot loader (SILO) [BOOT-5142]
- NFS client access test [STRG-1930]
- Check system uptime [BOOT-5202]
- YUM repolist check [PKGS-7383]
- Contributors file added
Changes:
- Improved locate database check and reporting [FILE-6410]
- Improved PAE/No eXecute test for Linux kernel [KRNL-5677]
- Disabled NIS domain name from test [NAME-4028]
- Extended NIS domain test to check BSD sysctl value [NAME-4306]
- Extended PAM tools check with PAM paths [AUTH-9262]
- Adjusted Apache check to avoid skipping it [HTTP-6622]
- Extended USB state testing [STRG-1840]
- Extended Firewire state testing [STRG-1846]
- Extended core dump test [KRNL-5820]
- Added /lib/i386-linux-gnu/security to PAM directories
- Added /usr/X11R6/bin directory to binary paths
- Improved readability of screen output
- Improved logging for several tests
- Improved Debian version detection
- Added warning to BIND test [NAME-4206]
- Extended binaries with showmount and yum
- Updated man page
--
* 1.3.7 (2013-12-10)
New:
- Function FileExists() and SearchItem()
Changes:
- Adjusted yum-security check [PKGS-7386]
- Improved check for iptables binary check
- Extended report with the tests executed and skipped
--
* 1.3.6 (2013-12-03)
New:
- Support for the dntpd time daemon
- New Apache test for modules [HTTP-6632]
- Apache test for mod_evasive [HTTP-6640]
- Apache test for mod_qos [HTTP-6641]
- Apache test for mod_spamhaus [HTTP-6642]
- Apache test for ModSecurity [HTTP-6643]
- Check for installed package audit tool [PKGS-7398]
- Added initial support for new pkgng and related tools [PKGS-7381]
- Check for ssh-keyscan binary
- ZFS support for FreeBSD [FILE-6330]
- Test for passwordless accounts [AUTH-9283]
- Initial OS support for DragonFly BSD
- Initial OS support for TrueOS (FreeBSD based)
- Initial OS support for elementary OS (Luna)
- GetHostID for DragonFly, FreeBSD, NetBSD and OpenBSD
- Check for DHCP client [NETW-3030]
- Initial support for OSSEC (system integrity) [FINT-4328]
- New parameter --log-file to adjust log file location
- New function IsRunning() to check status of processes
- New function RealFilename() to determine file name
- New function CheckItem() for parsing files
- New function ReportManual() and ReportException() to simplify code
- New function DirectoryExists() to check existence of a directory
- Support for dntpd [TIME-3104]
Changes:
- Extended pf checks for FreeBSD/OpenBSD and others [FIRE-4518]
- Extended test to gather listening network ports for Linux [NETW-3012]
- Adjusted lsof statement to ignore warnings (e.g. fuse) [LOGG-2180] [LOGG-2190]
- Added suggestion for discovered shells on FreeBSD [AUTH-9218]
- Extended core dump test with additional details [KRNL-5820]
- Properly display suggestion if portaudit is not installed [PKGS-7382]
- Ignore message if no packages are installed (pkg_info) [PKGS-7320]
- Also try using apt-check on Debian systems [PKGS-7392]
- Adjusted logging for RPM binary on systems not using it [PKGS-7308]
- Extended search in cron directories for rdate/ntpdate [TIME-3104]
- Adjusted PHP check to find ini files [PHP-2211]
- Skip Apache test for NetBSD [HTTP-6622]
- Skip test http version check for NetBSD [HTTP-6624]
- Additional check to supress sort error [HTTP-6626]
- Improved the way binaries are checked (less disk reads)
- Adjusted ReportWarning() function to skip impact rating
- Improved report on screen by leaving out date/time and type
- Redirect errors while checking for OpenSSL version
- Extended reporting with firewall status and software
- Adjusted naming of some operating systems to make them more consistent
- Extended update check by using host binary if dig is not installed
- Count number of installed binaries/packages and report them
- Report about log rotation tool and status
- Updated man page
--
* 1.3.5 (2013-11-19)
New:
- OS detection for Mageia Linux, PCLinuxOS, Sabayon Linux and Scientific Linux
- Added some initial systemd support (e.g. boot services)
- Test to display if any known MAC framework is implemented [MACF-6290]
Changes:
- Improved support for Slackware Linux (OS and version detection)
- Added systemd support (boot and running services) for Linux systems [BOOT-5177]
- Added systemd support (default runlevel) for Linux systems [KRNL-5622]
- Extended USB storage check in modprobe.d directory [STRG-1840]
- Improved output, reporting and check for kernel update [KRNL-5788]
- Optimized code and output of test to check writable scripts [BOOT-5184]
- Fixed detection for writable scripts [BOOT-5184]
- Improved detection IPv6 addresses for Slackware and others [NETW-3008]
- Minor addition to SSH PermitRootLogin check [SSH-7412]
- Extended cronjob tests, reporting and logging [SCHD-7704]
- Extended umask check in /etc/profile [AUTH-9328]
- Added suggestion about BIND version [NAME-4210]
- Merged test NTP daemon test TIME-3108 into TIME-3104
- Improved support for Arch Linux (output, detection)
- Extended common list of directories with SSL certifcates in profile
- New function GetHostID() to determine an unique identifier of the machine
- Added a tests_custom file template
- Perform file permissions test on tests_custom file
- Improved OS detection and extended logging on several tests
- Several layout improvements
- Extended update check functions and output
- Cleaned up reporting and extended it with exceptions
--
* 1.3.4 (2013-11-08)
New: