Auditing Linux against CIS benchmarks: Lynis, OpenSCAP
You learn how international security benchmarks are read, measure a server with Lynis and OpenSCAP, fix the findings and prove compliance.
Level 301 · 16 lessons · 15 practice labs
Lessons
Understanding benchmarks
- What a security benchmark is: CIS, STIG and in-house standards
- Reading a benchmark item: rationale, audit, remediation
- Level 1 and level 2 profiles: which one when
- Manual auditing: checking five items with commands
- Short task: audit the file system section by hand
Lynis
- Running a system audit with Lynis
- Reading the Lynis report: warnings, suggestions, hardening index
- Adapting the audit to your organisation with Lynis profiles
- Short task: raise the hardening index by ten points
OpenSCAP
- SCAP content: XCCDF, OVAL and profiles
- Scanning with oscap and the HTML report
- Generating remediation scripts and applying them with care
- Tailoring a profile: excluding items with a justification
- Short task: fix ten failing items and rescan
Evidence and capstone
- Exception records and preparing evidence for an auditor
- Capstone: bring a server into line with the level 1 profile
Practice labs
- Audit a benchmark item by hand and record the result: Run the audit command of the given CIS item and record whether the server passes, with the reason.
- Audit five items in the password policy section: Check login.defs and the PAM settings against five items and save the evidence command for each item.
- Find the item the audit script wrongly marks as passing: Show that a ready-made audit script checks a different file from the effective setting and write the correct check.
- Clear the first three warnings in the Lynis report: Run Lynis, fix three of the warnings and show they are gone in a rescan.
- Rank the Lynis suggestions by risk: Parse the report, pull the suggestions out with their test IDs, choose the riskiest five and apply one.
- Skip the items your organisation has accepted in a Lynis profile: Write a custom profile for the justified exceptions, skip those tests and show the report no longer flags them.
- Raise the hardening index without breaking a service: Choose changes that raise the index by at least eight points and prove the web application still responds.
- Run a profile scan with oscap and find the most severe failure: Scan with the chosen profile, produce the HTML report and identify the high-severity failed rule.
- Do not run the generated remediation script blindly: Generate the remediation script, find the step that would cut SSH access, remove it and apply the rest.
- Re-evaluate a single rule on a Rocky server: Fix the failed rule and rescan only that rule without running the whole profile again.
- Tailor a profile and tie the exception to a justification: Exclude two rules that cannot be applied with a tailoring file, add the justification and show the scan comes back clean.
- Package scan evidence with date and version for the auditor: Gather the latest scan report, profile version and server details into one evidence folder.
- Find the expired exception records: Compare the exception list with scan results and pull out records that have expired or have no owner.
- Show what regressed between two scans: Compare two OpenSCAP results, find rules that went from pass to fail and match each to the change log.
- Prepare an organisation-specific tailoring file for OpenSCAP: Write a tailoring file that disables three accepted rules with justification and tightens the password length value, then run the scan with it and explain the score change.
About this course
You learn how international security benchmarks are read, measure a server with Lynis and OpenSCAP, fix the findings and prove compliance.
What you will learn
- Understanding benchmarks
- Lynis
- OpenSCAP
- Evidence and capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.