Lesson 4.1: Reading benchmark scanner results
One server can be hardened by hand; a hundred need a benchmark (such as the CIS Benchmarks) and a scanner that checks them. Lynis is a widely used open-source auditing tool for Linux: each run produces a hardening index, warnings and suggestions with test IDs, in a machine-readable report. Scores are easy to chase blindly. In the lab you read last night's Lynis report for Northwind's database server, separate urgent warnings from routine suggestions, verify the findings on the live system, fix the SSH and kernel items, and confirm the result.
16 min
You will learn to
- Explain benchmarks and scanners (CIS, Lynis)
- Read lynis-report.dat
- Prioritise warnings over suggestions
- Verify findings on the live system
- Apply and confirm fixes
Key terms
- CIS Benchmarks
- Consensus hardening guides for operating systems and software, with numbered, testable recommendations.
- Lynis
- Open-source security auditing tool for Linux and Unix that checks hundreds of settings.
- Hardening index
- Lynis's 0-100 summary score; useful for trends, not as a target.
- Warning / suggestion
- A finding Lynis considers a risk now / an improvement to consider.
- Configuration management
- Tools (Ansible, Puppet, Salt …) that apply the same settings to every server and keep them there.
← sudo rules that give away root · All lessons · Storing and checking passwords →