{"id":324,"date":"2021-01-01T23:42:42","date_gmt":"2021-01-01T22:42:42","guid":{"rendered":"https:\/\/nissel.it\/?p=324"},"modified":"2022-01-22T09:55:10","modified_gmt":"2022-01-22T08:55:10","slug":"server-absichern-mit-lynis","status":"publish","type":"post","link":"https:\/\/nissel.it\/index.php\/2021\/01\/01\/server-absichern-mit-lynis\/","title":{"rendered":"Server absichern mit lynis"},"content":{"rendered":"\n<p>Mithilfe von lynis k\u00f6nnen einige Sicherheitstests durchgef\u00fchrt werden die dann auch erl\u00e4utert werden.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>wget -qO- https:\/\/downloads.cisofy.com\/lynis\/lynis-3.0.7.tar.gz | tar xvz<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>cd lynis &amp;&amp; .\/lynis update check &amp;&amp; .\/lynis audit system<\/code><\/pre>\n\n\n\n<!--more-->\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"550\" height=\"594\" src=\"https:\/\/nissel.it\/wp-content\/uploads\/2021\/01\/grafik.png\" alt=\"\" class=\"wp-image-326\" srcset=\"https:\/\/nissel.it\/wp-content\/uploads\/2021\/01\/grafik.png 550w, https:\/\/nissel.it\/wp-content\/uploads\/2021\/01\/grafik-278x300.png 278w\" sizes=\"auto, (max-width: 550px) 100vw, 550px\" \/><figcaption><code>lynis<\/code> Ausgabe<\/figcaption><\/figure>\n\n\n\n<p>Jede Warnung und Hinweis muss nat\u00fcrlich bewertet werden. z.B: legt Plesk f\u00fcr weitere FTP Benutzer einen Benutzer mit identischer UID an. Darauf wei\u00dft lynis z.B: hin.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">lynis regelm\u00e4\u00dfig ausf\u00fchren<\/h2>\n\n\n\n<p>Die Ausf\u00fchrung kann als cronjob eingerichtet werden.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cd \/root\/lynis &amp;&amp; .\/lynis update check --cronjob --no-log &amp;&amp; .\/lynis audit system --no-log --cronjob --warnings-only<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"774\" height=\"815\" src=\"https:\/\/nissel.it\/wp-content\/uploads\/2021\/01\/grafik-1.png\" alt=\"\" class=\"wp-image-331\" srcset=\"https:\/\/nissel.it\/wp-content\/uploads\/2021\/01\/grafik-1.png 774w, https:\/\/nissel.it\/wp-content\/uploads\/2021\/01\/grafik-1-285x300.png 285w, https:\/\/nissel.it\/wp-content\/uploads\/2021\/01\/grafik-1-768x809.png 768w\" sizes=\"auto, (max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 543px, 580px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">SMTP Banner anpassen<\/h2>\n\n\n\n<p>Das Programm aus der SMTP &#8222;Begr\u00fc\u00dfung&#8220; heraus zu nehmen macht es evtl. ein paar scripten auf der Suche nach Sicherheitsl\u00fccken etwas schwerer. Dazu muss die \/etc\/postfix\/main.cf angepasst werden.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>smtpd_banner = $myhostname ESMTP<\/code><\/pre>\n\n\n\n<p>Und postfix neu gestartet werden.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>service postfix restart<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Alte Zertifikate entfernen<\/h2>\n\n\n\n<p>In der Kostenlosen Variante gibt lynis nicht preis wo veraltete Zertifikate liegen. Ein m\u00f6glicher Ort ist \/opt\/psa\/var\/certificates. Mit folgenden skript wird gepr\u00fcft ob ein Zertifikat gel\u00f6scht werden kann:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#!\/bin\/bash\n\nfor filename in \/opt\/psa\/var\/certificates\/*; do\n    if ! openssl x509 -checkend 0 -noout -in ${filename} &amp;&gt;\/dev\/null; then\n        if ! grep --quiet -R \"${filename}\" \/etc\/nginx\/plesk.conf.d\/*; then\n            if ! grep --quiet \"${filename}\" \/etc\/apache2\/plesk.conf.d\/server.conf; then\n                echo \"${filename} can be deleted\"\n            else\n                echo \"${filename} is expired but still in use by apache (default cert)\"\n            fi\n        else\n            echo \"${filename} is expired but still in use by nginx\"\n        fi\n    fi\ndone<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Warnungen ignorieren<\/h2>\n\n\n\n<p>Damit nur eine Mail verschickt wird, wenn ein neuer Fehler auftaucht, m\u00fcssen alle Warnungen die ignoriert werden sollen deaktiviert werden. Dazu muss die default.prf editiert werden.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>profile-name=Plesk Audit Template\nskip-test=TIME-3185\n...<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">SSH Konfiguration h\u00e4rten<\/h2>\n\n\n\n<p>Es gibt einige Einstellungen die von lynis empfohlen werden. Dazu die \/etc\/ssh\/sshd_config editieren:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PermitRootLogin without-password\nMaxAuthTries 3\nLogLevel VERBOSE\nClientAliveCountMax 2\nAllowAgentForwarding no\nAllowTcpForwarding no\nX11Forwarding no<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Kernel<\/h2>\n\n\n\n<p>Unterbinden eines core dumps \u00fcber die \/etc\/security\/limits.conf<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>*            hard    core            0<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">System Passwort Einstellungen<\/h2>\n\n\n\n<p>Auf heutiger Hardware k\u00f6nnen deutlich mehr Runden als der default 5000 f\u00fcr die Generierung von Passwort Hashes verwendet werden. Dazu in der Datei \/etc\/login.defs folgende Werte anpassen:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SHA_CRYPT_MIN_ROUNDS 50000\nSHA_CRYPT_MAX_ROUNDS 500000<\/code><\/pre>\n\n\n\n<p>Es sollte daf\u00fcr gesorgt werden, dass die Passw\u00f6rter nicht ewig g\u00fcltig sind:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PASS_MAX_DAYS   356\nPASS_WARN_AGE   30<\/code><\/pre>\n\n\n\n<p>Mit dem Befehl chage k\u00f6nnen die G\u00fcltigkeitsdauer von bestehenden Benutzern angezeigt und ge\u00e4ndert werden.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>chage -l username\nchage -M 365 -m 365 -W 30 username<\/code><\/pre>\n\n\n\n<p>Passend dazu die Plesk Einstellungen f\u00fcr Passwort St\u00e4rke<\/p>\n\n\n\n<figure class=\"wp-block-image size-thumbnail\"><img loading=\"lazy\" decoding=\"async\" width=\"150\" height=\"150\" src=\"https:\/\/nissel.it\/wp-content\/uploads\/2021\/01\/grafik-2-150x150.png\" alt=\"\" class=\"wp-image-337\" srcset=\"https:\/\/nissel.it\/wp-content\/uploads\/2021\/01\/grafik-2-150x150.png 150w, https:\/\/nissel.it\/wp-content\/uploads\/2021\/01\/grafik-2-100x100.png 100w\" sizes=\"auto, (max-width: 150px) 100vw, 150px\" \/><figcaption>Tools &amp; Settings -&gt; Security Policy<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Links<\/h2>\n\n\n\n<p><a href=\"https:\/\/cisofy.com\/lynis\/\">https:\/\/cisofy.com\/lynis\/<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/cisofy.com\/lynis\/controls\/MAIL-8818\/\">https:\/\/cisofy.com\/lynis\/controls\/MAIL-8818\/<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/support.plesk.com\/hc\/en-us\/articles\/115000269754-How-to-change-the-hostname-and-SMTP-banner-in-Postfix-on-a-Plesk-server\">https:\/\/support.plesk.com\/hc\/en-us\/articles\/115000269754-How-to-change-the-hostname-and-SMTP-banner-in-Postfix-on-a-Plesk-server<\/a><\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-wp-embed is-provider-tecmint-linux-howtos-tutorials-amp-guides wp-block-embed-tecmint-linux-howtos-tutorials-amp-guides\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/www.tecmint.com\/scan-linux-for-malware-and-rootkits\/\n<\/div><\/figure>\n\n\n\n<p><a href=\"https:\/\/talk.plesk.com\/threads\/ssl-certificate-files-location.336076\/\">https:\/\/talk.plesk.com\/threads\/ssl-certificate-files-location.336076\/<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/stackoverflow.com\/questions\/21297853\/how-to-determine-ssl-cert-expiration-date-from-a-pem-encoded-certificate\">https:\/\/stackoverflow.com\/questions\/21297853\/how-to-determine-ssl-cert-expiration-date-from-a-pem-encoded-certificate<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/askubuntu.com\/questions\/449364\/what-does-without-password-mean-in-sshd-config-file\">https:\/\/askubuntu.com\/questions\/449364\/what-does-without-password-mean-in-sshd-config-file<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/linux-audit.com\/understand-and-configure-core-dumps-work-on-linux\/\">https:\/\/linux-audit.com\/understand-and-configure-core-dumps-work-on-linux\/<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/blog.sys4.de\/rounds-and-iterations-for-ssh-and-other-keys-en.html\">https:\/\/blog.sys4.de\/rounds-and-iterations-for-ssh-and-other-keys-en.html<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/www.cyberciti.biz\/faq\/linux-howto-check-user-password-expiration-date-and-time\/\">https:\/\/www.cyberciti.biz\/faq\/linux-howto-check-user-password-expiration-date-and-time\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Mithilfe von lynis k\u00f6nnen einige Sicherheitstests durchgef\u00fchrt werden die dann auch erl\u00e4utert werden.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[11],"class_list":["post-324","post","type-post","status-publish","format-standard","hentry","category-webserver","tag-sicherheit"],"_links":{"self":[{"href":"https:\/\/nissel.it\/index.php\/wp-json\/wp\/v2\/posts\/324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nissel.it\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nissel.it\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nissel.it\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nissel.it\/index.php\/wp-json\/wp\/v2\/comments?post=324"}],"version-history":[{"count":11,"href":"https:\/\/nissel.it\/index.php\/wp-json\/wp\/v2\/posts\/324\/revisions"}],"predecessor-version":[{"id":455,"href":"https:\/\/nissel.it\/index.php\/wp-json\/wp\/v2\/posts\/324\/revisions\/455"}],"wp:attachment":[{"href":"https:\/\/nissel.it\/index.php\/wp-json\/wp\/v2\/media?parent=324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nissel.it\/index.php\/wp-json\/wp\/v2\/categories?post=324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nissel.it\/index.php\/wp-json\/wp\/v2\/tags?post=324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}