Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
security
lynis
lynis.changes
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File lynis.changes of Package lynis
------------------------------------------------------------------- Sun Mar 17 11:15:28 UTC 2024 - Robert Frohl <rfrohl@suse.com> - Update to 3.1.1: * Added - Detection of ArcoLinux * Changed - DBS-1882 - Redis configuration file path added for FreeBSD (/usr/local/etc/redis.conf) - DBS-1882 - Check /snap directory location for Redis configuration file ------------------------------------------------------------------- Mon Mar 11 10:21:40 UTC 2024 - Robert Frohl <rfrohl@suse.com> - Update to 3.1.0: * Added - Translation: Indonesian * Changed - MALW-3280 - Correction to detect com.avast.daemon - OS detection added for Guix System, macOS Ventura (13.x)/Sonoma (14.x), NXP LSDK, OpenEmbedded "nodistro", and The Yocto Projects distro "Poky" - Updated Amazon Linux EOL dates and addition of Amazon Linux 2023 - STATUS_NOT_ACTIVE variable added to translation files - End-of-life dates updated - Fixing missing or erroneous test number comments - Detection of SentinelOne corrected - Wazuh for file integrity and tooling - Updated parsing output of arch-audit - Added support for SentinelOne detection - Replacing deprecated option -i for xargs - Path detection for PostgreSQL improved - Updated additional_module_blacklist_locations.patch ------------------------------------------------------------------- Fri Mar 1 11:34:54 UTC 2024 - pgajdos@suse.com - Use %patch -P N instead of deprecated %patchN. ------------------------------------------------------------------- Sun Nov 12 09:54:02 UTC 2023 - Dirk Müller <dmueller@suse.com> - add missing gawk dependency ------------------------------------------------------------------- Thu Aug 3 12:56:11 UTC 2023 - Robert Frohl <rfrohl@suse.com> - Update to 3.0.9: * Changed - DBS-1820 - Added newer style format for Mongo authorization setting - FILE-6410 - Locations added for plocate - SSH-7408 - Only test Compression if sshd version < 7.4 - Improved fetching timestamp - Minor changes such as typos ------------------------------------------------------------------- Tue May 17 14:00:34 UTC 2022 - Robert Frohl <rfrohl@suse.com> - Update to 3.0.8: * Added - MALW-3274 - Detect McAfee VirusScan Command Line Scanner - PKGS-7346 Check Alpine Package Keeper (apk) - PKGS-7395 Check Alpine upgradeable packages - EOL for Alpine Linux 3.14 and 3.15 * Changed - AUTH-9408 - Check for pam_faillock as well (replacement for pam_tally2) - FILE-7524 - Test enhanced to support symlinks - HTTP-6643 - Support ModSecurity version 2 and 3 - KRNL-5788 - Only run relevant tests and improved logging - KRNL-5820 - Additional path for security/limits.conf - KRNL-5830 - Check for /var/run/needs_restarting (Slackware) - KRNL-5830 - Add a presence check for /boot/vmlinuz - PRNT-2308 - Bugfix that prevented test from storing values correctly - Extended location of PAM files for AARCH64 - Some messages in log improved - accepted upstream, removed additional_paths_security-limits.patch ------------------------------------------------------------------- Fri Feb 4 10:08:03 UTC 2022 - Robert Frohl <rfrohl@suse.com> - cover /usr/etc/security/limits.conf too (boo#1194446) added additional_paths_security-limits.patch ------------------------------------------------------------------- Tue Jan 18 13:29:42 UTC 2022 - Robert Frohl <rfrohl@suse.com> - Update to 3.0.7: * Added - MALW-3290 - Show status of malware components - OS detection for RHEL 6 and Funtoo Linux - Added service manager openrc * Changed - DBS-1804 - Added alias for MariaDB - FINT-4316 - Support for newer Ubuntu versions - MALW-3280 - Added Trend Micro malware agent - NETW-3200 - Allow unknown number of spaces in modprobe blacklists - PKGS-7320 - Support for Garuda Linux and arch-audit - Several improvements for busybox shell - Russian translation of Lynis extended - replace 0x429A566FD5B79251 with 0x9DE922F1C2FDE6C4 in lynis.keyring according to https://packages.cisofy.com/ - update additional_module_blacklist_locations.patch ------------------------------------------------------------------- Wed Oct 13 14:35:34 UTC 2021 - Johannes Segitz <jsegitz@suse.com> - Add additional_module_blacklist_locations.patch to check fo blacklisted modules under /usr/lib/modules.d ------------------------------------------------------------------- Mon Oct 11 06:45:59 UTC 2021 - Paolo Stivanin <info@paolostivanin.com> - Update to 3.0.6: * Added - OS detection: Artix Linux, macOS Monterey, NethServer, openSUSE MicroOS - Check for outdated translation files * Changed - DBS-1826 - Check if PostgreSQL is being used - DBS-1828 - Test multiple PostgreSQL configuration file(s) - KRNL-5830 - Sort kernels by version instead of modification date - PKGS-7410 - Don't show exception for systems using LXC - GetHostID function: fallback options added for Linux systems - Fix: show correct text when egrep is missing - Fix: variable name for PostgreSQL ------------------------------------------------------------------- Thu Sep 16 08:59:23 UTC 2021 - Johannes Segitz <jsegitz@suse.com> - Changed tests_binary_rpath to subtract points for files found with RPATH set, not add points for files that are configured correctly. This resulted in a huge number of points that skewed the overal result ------------------------------------------------------------------- Sat Jul 3 11:54:47 UTC 2021 - Andreas Stieger <andreas.stieger@gmx.de> - fix SLE 12 build ------------------------------------------------------------------- Fri Jul 2 12:56:40 UTC 2021 - Robert Frohl <rfrohl@suse.com> - Update to 3.0.5 * Added - OS detection of Arch Linux 32, BunsenLabs Linux, and Rocky Linux - CRYP-8006 - Check MemoryOverwriteRequest bit to protect against cold-boot attacks (Linux) * Changed - ACCT-9622 - Corrected typo - HRDN-7231 - When calling wc, use the short -l flag instead of --lines (Busybox compatibility) - PKGS-7320 - extended to Arch Linux 32 - Generation of host identifiers (hostid/hostid2) extended - Linux host identifiers are now using ip as preferred input source - Improved logging in several areas ------------------------------------------------------------------- Tue May 11 12:43:28 UTC 2021 - Johannes Segitz <jsegitz@suse.com> - Update to 3.0.4 * Added - ACCT-9670 - Detection of cmd tooling - ACCT-9672 - Test cmd configuration file - BOOT-5140 - Check for ELILO boot loader presence - OS detection of AlmaLinux, Garuda Linux, Manjaro (ARM), and others * Changed - BOOT-5104 - Add service manager detection support for runit - FILE-6430 - Report suggestion only when at least one kernel module is not in the blacklist - FIRE-4540 - Corrected nftables empy ruleset test - LOGG-2138 - Do not check for klogd when metalog is being used - TIME-3185 - Improved support for Debian stretch - Corrected issue when Lynis is not executed directly from lynis directory ------------------------------------------------------------------- Thu Jan 7 16:38:00 UTC 2021 - Alexandros Toptsoglou <atoptsoglou@suse.com> - Update to 3.0.3 * Added - Check for registered non-native binary formats - OS detection of Parrot GNU/Linux * Changed - Force test to check only password authentication - Support for NetBSD * Fixed: command 'configure settings' did not work as intended ------------------------------------------------------------------- Mon Jan 4 09:13:29 UTC 2021 - Robert Frohl <rfrohl@suse.com> - Update to 3.0.2 * Added - Scan for locked user accounts in /etc/passwd - Loghost configuration - Check for active Suricata daemon - OS detection of Flatcar, IPFire, Mageia, NixOS, ROSA Linux, SLES (extended), Void Linux, Zorin OS - OS detection of OpenIndiana (Hipster and Legacy), Shillix, SmartOS, Tribblix, and others - EOL dates for Alpine, macOS, Mageia, OmniosCE, and Solaris 11 - Support for Solaris svcs (service manager) - Enumeration of Solaris services * Changed - Detect sysstat systemd unit - Only fail if both SHA_CRYPT_MIN_ROUNDS and SHA_CRYPT_MAX_ROUNDS are undefined - Support for Solaris - Improved reboot test by ignoring known bad values - Ignore rescue kernel such as on CentOS systems - Detection of Alpine Linux kernel - Compatibility change for hostname check - Support for Solaris - Don't show exception if no kernels were found on the disk - Supports now checking files at multiple locations (systemd) - ParseNginx function: Support include on absolute paths - ParseNginx function: Ignore empty included wildcards - Set 'RHEL' as OS_NAME for Red Hat Enterprise Linux - HostID: Use first e1000 interface and break after match - Translations extended and updated - Test if pgrep exists before using it - Better support for busybox shell - Small code enhancements ------------------------------------------------------------------- Fri Nov 13 09:42:44 UTC 2020 - Johannes Segitz <jsegitz@suse.com> - Add a Requires for net-tools-deprecated, as legacy binary binaries are still used by some of the custom lynis tests we ship. Later on I'll port them to use current binaries and remove this again ------------------------------------------------------------------- Mon Oct 5 13:50:24 UTC 2020 - Robert Frohl <rfrohl@suse.com> - Update to 3.0.1 * Added - Detection of Alpine Linux - Detection of CloudLinux - Detection of Kali Linux - Detection of Linux Mint - Detection of macOS Big Sur (11.0) - Detection of Pop!_OS - Detection of PHP 7.4 - Malware detection tool: Microsoft Defender ATP - New flag: --slow-warning to allow tests more time before showing a warning - Test TIME-3185 to check systemd-timesyncd synchronized time - rsh host file permissions * Changed - Added option for LOCKED accounts and bugfix for older bash versions - Presence check for grub.d added - Added support for certificates in DER format - Added data to report - Redirect errors (e.g. when swap is not encrypted) - Don't grep nonexistant modprobe.d files - Set initial firewall state - Corrected text on screen - Handle zipped kernel configuration correctly - Improved version detection for non-symlinked kernel - Extended detection of BitDefender - Find more time synchronization commands - Corrected detection of time peers - Fix: hostid generation routine would sometimes show too short IDs - Fix: language detection - Generic improvements for macOS - German translation updated - End-of-life database updated ------------------------------------------------------------------- Thu Jun 18 12:17:36 UTC 2020 - Robert Frohl <rfrohl@suse.com> - Update to 3.0.0 * Security issues - CVE-2020-13882: incorrect Access Control because of a TOCTOU race condition (boo#1173141). - CVE-2019-13033: local disclosure of license key when data is uploaded (boo#1173142). * Breaking change: Non-interactive by default - Lynis now runs non-interactive by default, to be more in line with the Unix philosophy. So the previously used '--quick' option is now default, and the tool will only wait when using the '--wait' option. * Breaking change: Deprecated options - Option: -c - Option: --check-update/--info - Option: --dump-options - Option: --license-key * Breaking change: Profile options - The format of all profile options are converted (from key:value to key=value). You may have to update the changes you made in your custom.prf. * Security - An important focus area for this release is on security. We added several measures to further tighten any possible misuse. * New: DevOps, Forensics, and pentesting mode - This release adds initial support to allow defining a specialized type of audit Using the relevant options, the scan will change base on the intended goal. - Further features, bug fixes and details about the release listed in https://raw.githubusercontent.com/CISOfy/lynis/3.0.0/CHANGELOG.md ------------------------------------------------------------------- Tue Jun 25 07:32:29 UTC 2019 - Robert Frohl <rfrohl@suse.com> - Update to 2.7.5 Added: * Danish translation * Slackware end-of-life information * Detect BSD-style (rc.d) init in Linux systems * Detection of Bro and Suricata (IDS) Changed: * Corrected end-of-life entries for CentOS 5 and 6 * Change name to check in /etc/passwd file for QNAP devices * AIX enhancement to use correct find statement * Filter on correct field for AIX * Set ss command as preferred option for Linux and changed output format * List of PHP ini file locations has been extended * Removed several pieces of the code as part of cleanup and code health * Extended help ------------------------------------------------------------------- Mon Jun 3 11:20:11 UTC 2019 - Tuukka Pasanen <tuukka.pasanen@ilmi.fi> - Add more false-positive packages to Dbus database: tuned, autofs, lightdm, geoglue2, snapper and ModemManager ------------------------------------------------------------------- Wed May 29 11:47:34 UTC 2019 - Tuukka Pasanen <tuukka.pasanen@ilmi.fi> - Add these common false-positive packages to Dbus database whitelist: FirewallD, SystemD and Wicked ------------------------------------------------------------------- Tue Apr 23 07:24:21 UTC 2019 - Robert Frohl <rfrohl@suse.com> - Update to 2.7.4 Added * FILE-6324 - Discover XFS mount points * INSE-8000 - Installed inetd package * INSE-8100 - Installed xinetd package * INSE-8102 - Status of xinet daemon * INSE-8104 - xinetd configuration file * INSE-8106 - xinetd configuration for inactive daemon * INSE-8200 - Usage of TCP wrappers * INSE-8300 - Presence of rsh client * INSE-8302 - Presence of rsh server * Detect equery binary detection * New 'generate' command Changed * AUTH-9278 - Test LDAP in all PAM components on Red Hat and other systems * PKGS-7410 - Add support for DPKG-based systems to gather installed kernel packages * PKGS-7420 - Detect toolkit to automatically download and apply upgrades * PKGS-7328 - Added global Zypper option --non-interactive * PKGS-7386 - Only show warning when vulnerable packages were discovered * PKGS-7392 - Skip test for Zypper-based systems * Minor changes to improve text output, test descriptions, and logging * Changed CentOS identifiers in end-of-life database * AIX enhancement for IsRunning function * Extended PackageIsInstalled function * Improve text output on AIX systems * Corrected lsvg binary detection ------------------------------------------------------------------- Thu Mar 21 12:11:32 UTC 2019 - Robert Frohl <rfrohl@suse.com> - update to 2.7.3 Added * Detection for Lynis being scheduled (e.g. cronjob) Changed * HTTP-6624 - Improved logging for test * KRNL-5820 - Changed color for default fs.suid_dumpable value * LOGG-2154 - Adjusted test to search in configuration file correctly * NETW-3015 - Added support for ip binary * SQD-3610 - Description of test changed * SQD-3613 - Corrected description in code * SSH-7408 - Increased values for MaxAuthRetries * Improvements to allow tailored tool tips in future * Corrected detection of blkid binary * Minor textual changes and cleanups ------------------------------------------------------------------- Thu Mar 7 11:54:18 UTC 2019 - Robert Frohl <rfrohl@suse.com> - update to 2.7.2 * Added support for doas (OpenBSD) * Added test file permissions of doas configuration * Added support for systemd-boot boot loader * Added simplify service filter and allow multiple dots in service names * Added check OpenBSD boot daemons * Added test permissions for boot files and scripts * Added support for end-of-life detection of the operating system * Added new 'lynis show eol' command * Multiple changes and improvements ------------------------------------------------------------------- Fri Feb 1 10:28:13 UTC 2019 - Robert Frohl <rfrohl@suse.com> - update to 2.7.1 * Improve support for Red Hat and clones * Additional support for Hands Off!, LuLu, and Radio Silence * Added MariaDB filter for deleted files (tested on CentOS) * Added /etc/bash.bashrc.local to umask check * Removed shift statement that did not work on all operating systems * Minor cleanups and enhancements * Small improvements to logging * Added translation for Slovak ------------------------------------------------------------------- Sat Oct 27 02:36:44 UTC 2018 - sean@suspend.net - update to 2.7.0 * added detection of TOMOYO binary (MACF-6240) * Status of TOMOYO framework updated (MACF-6242) * OpenSSH server version detected (SSH-7406) * Check active OSSEC analysis daemon (TOOL-5160) * Changed several warning labels on screen * More generic sulogin for systemd rescue (AUTH-9308) * OS detection now ignores quotes for getting the OS ID ------------------------------------------------------------------- Tue Oct 9 08:20:47 UTC 2018 - Robert Frohl <rfrohl@suse.com> - update to 2.6.9 * Man page has been updated * Command 'lynis show options' provides up-to-date list * Option '--dump-options' is deprecated * Several options and commands have been extended with more examples * OS detection now supports openSUSE specific distribution names * Changed command output when using 'lynis audit system remote' * added /usr/local/redis/etc path and QNAP support * ignore exception when no vmlinuz file was discovered ------------------------------------------------------------------- Thu Sep 20 13:04:11 UTC 2018 - astieger@suse.com - update to 2.6.8: * improved parsing of boot parameters to init process * test all PHP files for expose_php and improved logging * Docker check now tests also for CMD, ENTRYPOINT, and USER configuration * Improved display in Docker output for showing which keys are used for signing - includes changes from 2.6.7: * Added busybox as a service manager * Limit PAE and no-execute test to AMD64 hardware only * Ignore /dev/zero and /dev/[aio] as deleted files * Changed classification of SSH root login with keys * Docker scan uses new format for maintainer value - includes chagnes from 2.6.6: * Improved log text about running kernel version * Under some condition no hostid2 value was reported * Solved 'extra operand' issue with tr command ------------------------------------------------------------------- Wed Jun 27 08:42:31 UTC 2018 - astieger@suse.com - update to 2.6.5: * mail: Exim configuration test * network: Use FQDN to test status of a nameserver instead of own IP address * ssh: Improved test to allow configurations with a Match block - includes changes from 2.6.4: * auth: Made 'sulogin' more generic for systemd rescue shell * dns: Initial work on DNSSEC validation testing * network: Added support for local resolver 127.0.0.53 * php: Suhosin test disbled * ssh: Removed 'DELAYED' from OpenSSH Compression setting * time: Improvements to detect step-tickers file and entries - includes changes from 2.6.3: * crypt: Do prevalidation for certificates before testing them * hardening: Enhanced compiler permission test * name: Improved test to filter out empty lines * packages: changes to detect yum-utils package and related tooling * plugins: cron file permissions - includes changes from 2.6.2: * Textual changes for several tests * Update of tests database ------------------------------------------------------------------- Fri Jan 26 17:00:07 UTC 2018 - astieger@suse.com - update to 2.6.1: * New group 'usb' for tests related to USB devices * Updated and enhanced tests * Many bug fixes * output and UI fixes ------------------------------------------------------------------- Thu Jun 8 19:36:22 UTC 2017 - astieger@suse.com - Lynis 2.5.1: * Improved detection of SSL certificate files * Minor changes to improve logging and results * Firewall tests: Determine if CSF is in testing mode - includes changes from Lynis 2.5.0: * CVE-2017-8108: symlink attack may have allowed arbitrary file overwrite or privilege escalation (bsc#1043463) * Deleted unused tests from database file * Additional sysctls are tested * Extended test with Symantec components * Snort detection * Snort configuration file ------------------------------------------------------------------- Tue Apr 4 09:35:48 UTC 2017 - tuukka.pasanen@ilmi.fi - Lynis 2.4.8 (Changelog from 2.4.1) * More PHP paths added * Minor changes to text * Show atomic test in report * Added FileInstalledByPackage function (dpkg and rpm supported) * Mark Arch Linux version as rolling release (instead of unknown) * Support for Manjaro Linux * Escape files when testing if they are readable * Code cleanups * Allow host alias to be specified in profile * Code readability enhancements * Solaris support has been improved * Fix for upload function to be used from profile * Reduce screen output for mail section, unless --verbose is used * Code cleanups and removed 'update release' command * Colored output can now be tuned with profile (colors=yes/no) * Allow data upload to be set as a profile option * Properly detect SSH daemon version * Generic code improvements * Improved the update check and display * Finish, Portuguese, and Turkish translation * Extended support and tests for DragonFlyBSD * Option to configure hostid and hostid2 in profile * Support for Trend Micro and Cylance (macOS) * Remove comments at end of nginx configuration * Used machine ID to create host ID when no SSH keys are available * Added detection of iptables-save to binaries Tests: BANN-7126 - Added more words to test for CUPS-2308 - Improve logging for CUPS configuration test, removed exception handler HTTP-6641 - Support detection for Apache module mod_reqtimeout PKGS-7388 - Minor change to detect security repositories CRYP-7902 - Test more certificates names, but only if they are not part of a package FILE-7524 - Reduce standard screen output for file permissions check MALW-3280 - Added Avira detection as a malware scanner NAME-4018 - Only perform name services test when resolv.conf file exists PKGS-7387 - Check all repositories if they use GPG signing SCHD-7704 - Permission checks TIME-3104 - Check permissions before open files AUTH-9328 - Add missing 0027 and 0077 umasks BOOT-5104 - Add initsplash and minor code enhancements DBS-1882 - Include Redis configuration file FIRE-4502 - Improved detection for iptables modules when using OpenVZ PKGS-7381 - Enhanced package audit for FreeBSD AUTH-9308 - Improved test for sulogin string (Debian systems) FILE-6372 - Properly deal with comment on lines in /etc/fstab MAIL-8817 - New test to check Postfix configuration for errors SSH-7408 - Corrected SSH check AUTH-9308 - Improved test for sulogin string MAIL-8818 - Test if Linux version is known before comparing in Postfix banner TIME-3116 - Skip stratum 16 items for time pools TIME-3148 - New test to detect TZ variable AUTH-9208 - Removed double logging AUTH-9222 - Improve logging for double groups AUTH-9226 - Improve logging for double groups BOOT-5177 - Sort systemctl unit files to make them unique DBS-1818 - New test to detect MongoDB DBS-1820 - New test for MongoDB authentication FIRE-4512 - Lowered minimum number of iptables firewall rules FIRE-4586 - Fix applied when searching for "-j LOG" HRDN-7222 - Changed reporting key of world executable compilers SSH-7408 - Added filtering for PermitRootLogin (prohibit-password, OpenSSH 7.0) FIRE-4586 - Check logging for firewall components KRNL-5788 - Remove exception and style improvements KRNL-5830 - Improved logging ------------------------------------------------------------------- Fri Nov 4 13:41:25 UTC 2016 - matthias.gerstner@suse.com - lynis 2.4.0 * Mainly improved support for macOS users * Support for CoreOS * Support for clamconf utility * Support for chinese translation * More sysctl values in the default profile * New commands: "upload-only", "show hostids", "show environment", "show os" ------------------------------------------------------------------- Wed Sep 28 11:45:44 UTC 2016 - astieger@suse.com - lynis 2.3.4 with various improvements, including: * Several tests have extended log details * Detection of nftables improved * Replaced cut, sed, tr and others commands with binary variable (for forensics and future intrusion checking capabilities) * OS detection improved ------------------------------------------------------------------- Thu Sep 15 14:44:27 UTC 2016 - astieger@suse.com - lynis 2.3.3 with many improvements and updates ------------------------------------------------------------------- Thu May 12 08:32:25 UTC 2016 - astieger@suse.com - lynis 2.2.0: * new features and tests, small enhancements * optimisation, better detection * dealing with OS quirks and unexcepted results * adjustments for supporting more compliance in-depth * Detection for CFEngine has been improved * now tries to determine if failed logins are properly logged * New plugin is introduced to analyze PAM settings * Initial support to test UEFI settings, including Secure Boot option. * Support added for Unbound DNS caching tool, configuration check * Record if a name caching utility is being used like nscd or Unbound. * Tests chains of iptables and their default policy (ACCEPT or DROP) * Support upcoming nftables technology (status check) * Test added to include osqueryd as a supported tool. * Detection of firewire is enhanced (both ohci and core detected). * Extended the test syslog-ng logging to remote systems. * ESET and LMD (Linux Malware Detect) have been added. * Discovered malware scanners are also logged to the report. * Eexpanded test for multiple common mount points and define best practice mount flags. * Best practices for IPv6 configuration on Linux are now collected. * Collect network interface names from most operating systems. * Password change test has been extended to both capture minimum and password age. * Add Proxu support * SystemV init is now detected. * Now information will be logged when vulnerable software packages were found. * Support for DNF (Dandified YUM) for Fedora systems has been added. * Multiple configuration tests of SSH merged. * Extend detection of virtual machines (VMware tools) * Machine state detection with Puppet, Facter, dmidecode, and lscpu * When using pentest mode, it will continue without any delays (=quick mode). * Improvements for automatic execution of Lynis * Upload improvements ------------------------------------------------------------------- Wed Jul 29 11:05:22 UTC 2015 - astieger@suse.com - lynis 2.1.1: * performance improvements * additional support for Linux distributions and external utilities * Apache module directory /usr/lib64/apache has been added, which is used on openSUSE. * various other improvements and bug fixes - update patches for contect changes: lynis_1.3.1_include_consts.diff, lynis_1.3.5_lynis.diff ------------------------------------------------------------------- Tue May 12 15:19:07 UTC 2015 - astieger@suse.com - lynis 2.1.0: * Screen output has been improved to provide additional information. * Core dump check on Linux is extended to check for actual values as well. * Software: + McAfee detection has been extended by detecting a running cma binary. + Security patch checking with zypper extended. * Session timeout: + Tests to determine shell time out setting have been extended + determine also if variable is exported as a readonly variable. + Related compliance section PCI DSS 8.1.8 has been extended. - includes changes from Lynis 2.0.0: * New feature: helpers * docker build file audit helper * Improved OS support * support systemd, docker, nftables * New parameters: + --dump-options (see all options) + --report-file (define a different location for the report file) - use tarball supplied default.prf - clean or silence rpmlint warnings ------------------------------------------------------------------- Tue Feb 17 12:32:20 UTC 2015 - astieger@suse.com - lynis 1.6.4: * New: + Boot loader detection for AIX + Detection of getcap and lsvg binary + Added filesystem_ext to report + Detect rootsh * Changes: + Hide errors when RPM database is faulty and show suggestion instead + Allow OpenBSD to gather information on listening network ports + Don't trigger warning for Shellshock when doing segfault test + Do not run Apache test on OpenBSD and strip control chars + Extended AIDE test with configuration validation test + Improved Shellshock test regarding non-Linux support + Added support for gathering volume groups on AIX + Properly parse PAM lines and add them to report + Support for boot loader detection on OpenBSD + Added uptime detection for OpenBSD systems + Support for volume groups on AIX + Redirect errors when searching for readlink binary - includes changes from 1.6.3: * New: + Added tests for Shellshock bash vulnerability + Added test to determine if Snoopy is used + New test for qdaemon configuration file + Test for GRUB boot loader password + New test for qdaemon printer jobs + Added ClamXav test for Mac OS X + Gentoo vulnerable packages test + New test for qdaemon status + Gentoo package listing + Running Lynis without root permissions will start non-privileged scan + Systemd service and timer example file added + Added grub2-install to binaries * Changes: + Adjustments so insecure SSL protocols are detected in nginx config + Directories will be skipped when searching for nginx log files + Only gather unique name servers from /etc/resolv.conf + Properly detect mod_evasive on Gentoo and others + Improved swap partition detection in /etc/fstab + Improvements to kernel detection (e.g. Gentoo) + Test for built-in security options in YUM + Improved boot loader detection for GRUB2 + Split GRUB test into two tests + Added Mac OS uptime check + Improved GetHostID function for systems having only ip binary + Improved testing for symlinked binary directories + Minor adjustments to log output + Renamed dev directory to extras - verify source signature - adjust permissions of items in /usr/share/lynis/include/consts to match those requested by main executable - run spec_cleaner ------------------------------------------------------------------- Sun Nov 16 00:39:00 UTC 2014 - Led <ledest@gmail.com> - fix bashisms in scripts ------------------------------------------------------------------- Wed Sep 24 16:36:21 UTC 2014 - citypw@gmail.com - Upgrade to version 1.6.2 - Remove files: * lynis_1.3.7_include-test-filesystem.diff( already fixed) * lynis-1.3.9.tar.gz ------------------------------------------------------------------- Thu Jan 9 18:45:44 UTC 2014 - saigkill@opensuse.org - updated to version 1.3.9 - removed patch * lynis_1.3.6_include-test-kernel.diff (fixed upstream) ------------------------------------------------------------------- Wed Dec 11 20:14:06 UTC 2013 - saigkill@opensuse.org - updated to version 1.3.7 - Changelog: * FileExists() and SearchItem() functions were added. The yum-security check and iptables binary check were improved, and the report was extended to show which tests have been executed or skipped - updated patch * lynis_1.3.7_include-test-filesystem.diff ------------------------------------------------------------------- Tue Dec 10 18:46:14 UTC 2013 - saigkill@opensuse.org - updated to version 1.3.6 - Removed patches (obsolete): * lynis_1.3.5_include_binaries.diff - Updated patches * lynis_1.3.6_include_osdetection.diff * lynis_1.3.6_include-test-kernel.diff ------------------------------------------------------------------- Sun Nov 24 14:29:06 UTC 2013 - saigkill@opensuse.org - updated to version 1.3.5 - Updated patches: o lynis_1.3.1_lynis.diff o lynis_1.3.1_include_binaries.diff o lynis_1.3.1_include-osdetection.diff o lynis_1.3.1_include-test-kernel.diff - Removed patches (obsolete) o lynis_1.3.1_include-test-databases.diff o lynis_1.3.1_include-test-storage.diff o lynis_1.3.1_include-test-homedirs.diff ------------------------------------------------------------------- Fri Jun 21 12:22:08 UTC 2013 - thomas@suse.com - fixed typo in prepare_for_suse.sh ------------------------------------------------------------------- Fri Jan 25 09:40:52 UTC 2013 - thomas@suse.com - fixed log message for dbus test - fixed bash variable incrementation that sneaked in the code ------------------------------------------------------------------- Mon Jan 14 14:57:15 UTC 2013 - thomas@suse.com - fixed tests_network_allowed_ports to increment index vars and not loop forever ------------------------------------------------------------------- Thu Jan 10 16:53:32 UTC 2013 - thomas@suse.com - fixed test_homedirs ------------------------------------------------------------------- Thu Jan 10 16:46:02 UTC 2013 - thomas@suse.com - some bugfixing for pathnames, didn't work with sudo - improved default.prf by adding more sysctl vars - fixed test_storage - generated fileperm.db and dbus-whitelist for 12.2 ------------------------------------------------------------------- Mon Dec 26 16:24:35 UTC 2011 - Sascha.Manns@open-slx.de - fixed conflict in spec ------------------------------------------------------------------- Mon Dec 26 16:18:01 UTC 2011 - Sascha.Manns@open-slx.de - updated to version 1.3.0 - from Changelog: - New: - Profile option: ignore_home_dir - TCP wrappers category added - Tooling category added - Initial extensions to support plugins in the future - Test for unpurged Debian packages [PKGS-7346] - Test for compiler permissions [HRDN-7222] - Changes: - Converted all dates to ISO format and updated copyright lines - Correct suggestion for file integrity tool [FINT-4350] - Added hint when RPM list is empty on DPKG based systems [PKGS-7308] - Changed logging for /etc/security/limits.conf file [KRNL-5820] - Fixed incorrect warning for single user mode [AUTH-9308] - Improved output for stratum 16 time servers [TIME-3116] - Added suggestion and screen output for kernel hardening [KRNL-6000] - Screen layout optimalizations and log file improvements - Improved list/layout of scan options - Improved binary check for compilers - Added configuration option in scan profile (show_tool_tips, default true) ------------------------------------------------------------------- Thu Apr 7 15:57:31 UTC 2011 - thomas@novell.com - added patch for apache2 and oracle detection ------------------------------------------------------------------- Fri Apr 1 22:00:13 UTC 2011 - saigkill@opensuse.org - removed rpmlintrc and fixed non-executable-script ------------------------------------------------------------------- Sun Dec 26 19:55:21 UTC 2010 - saigkill@opensuse.org - prettyfied spec file - NOTE: Please submit submitrequests to home:saigkill. This Package links to this Repository. ------------------------------------------------------------------- Fri Sep 3 05:41:52 UTC 2010 - thomas@novell.com - fixed %files section to include /etc/lynis ------------------------------------------------------------------- Fri Sep 3 05:12:43 UTC 2010 - thomas@novell.com - fixed %files section to reflect new default.prf location ------------------------------------------------------------------- Fri Sep 3 05:09:47 UTC 2010 - thomas@novell.com - added permdir /root/.gnupg to default.prf ------------------------------------------------------------------- Fri Sep 3 05:04:03 UTC 2010 - thomas@novell.com - copy default.prf to /etc/lynis/ instead of /etc/, otherwise lynis will not find it and hang ------------------------------------------------------------------- Thu Sep 2 11:32:50 UTC 2010 - thomas@novell.com - added %{_datadir}/%{name}/prepare_for_suse.sh ------------------------------------------------------------------- Thu Sep 2 10:56:55 UTC 2010 - thomas@novell.com - adjusted patch and spec file to make it build ------------------------------------------------------------------- Wed Sep 1 12:30:43 UTC 2010 - thomas@novell.com - put code from Matthias Weckbecker sec_check into lynis - adjusted lynis for opensuse - details: + tests_tmp_symlinks + tests_network_allowed_ports + tests_system_proc + tests_file_permissions_ww + tests_binary_rpath + tests_users_wo_password + tests_file_permissionsDB + tests_system_dbus ------------------------------------------------------------------- Wed Dec 16 05:19:37 UTC 2009 - saigkill@opensuse.org - updated to version 1.2.9 - added default.prf ------------------------------------------------------------------- Wed Dec 9 16:21:53 UTC 2009 - saigkill@opensuse.org - update to 1.2.8 ------------------------------------------------------------------- Mon Nov 2 18:16:38 UTC 2009 - saigkill@opensuse.org - update to 1.2.7 - This release adds AIX Support and several new tests related to SSH, logging, databases and SMTP. Many minor issues are solved or improved. ----------------------------------------------------------------- Mon Apr 6 09:04:05 CEST 2009 - saigkill@opensuse.org - update to 1.2.6 - This release has several new tests and test improvements, like a sudoers file permissions check, a core dumps configuration check for Linux, PHP tests, and an /etc/issue banner test. ----------------------------------------------------------------- Sat Mar 28 10:27:12 CET 2009 - saigkill@opensuse.org - update to 1.2.5 - This release adds 40+ new tests for services like Dovecot, BIND, PowerDNS, SSH, Exim, and nginx ----------------------------------------------------------------- Tue Mar 17 2009 20:32 CET - mrdocs@opensuse.org - added 1.2.4 release - This release adds more than 30 new tests, including NTP, auditd, PAM, NFS and ClamAV. ------------------------------------------------------------------ Mon Mar 02 22:32 CET 2009 - mrdocs@opensuse.org - 1.2.3 release see CHANGELOG for changes ------------------------------------------------------------------- Thu Feb 26 14:16:35 CET 2009 - pgajdos@suse.cz - removed patches: - passwd-args.patch - suppress-dpkg-error.patch - source repacked gz -> bz2 ------------------------------------------------------------------- Sun Feb 17 2009 - mrdocs@opensuse.org - 1.2.2 release - see CHANGELOG for changes ------------------------------------------------------------------ Mon Feb 16 03:15:44 CET 2009 - saigkill@opensuse.org - updated to Version 1.2.2 ------------------------------------------------------------------ Wed Jan 07 12:00:00 CET 2009 - saigkill@opensuse.org - fixed Rpmlint Errors - branched for Contrib ------------------------------------------------------------------ Wed Nov 10 12:00:00 CET 2008 - saigkill@opensuse.org - initial version using the buildservice
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
