Lynis security controls

Empty output of RPM command

This control shows up when there are update for systems running pacman.

This control checks the configuration of pacman, a package manager used on Arch Linux.

To determine which packages have a known vulnerability, consider using a tool like arch-audit.

The arch-audit tool may have discovered some vulnerable packages.

When this Lynis control is triggered, vulnerable software packages have been found on the system.

While not directly a security concern, unpurged packages are not installed but still have remains left on the system (e.g. configuration files). In case software is reinstalled, an old configuration might be applied. Proper cleanups are therefore advised.

Lynis tests for unused distfiles on FreeBSD systems

Install the debsums utility for additional checks.

Vulnerable packages are a serious risk for the stability and security of a system. When this control shows up, one or more vulnerable software packages have been found. These packages, especially when listening on a network interface, might be abused by attackers.

Portaudit tests packages on FreeBSD based systems and determines what software is vulnerable. Discovered software is a security risk and should be investigated.

For systems using the yum package manager, a repolist is being checked. If not found, this might indicate that the system is not properly configured to receive updates. Check if yum is properly functioning and receiving package updates. Registration might be needed to fix this problem.

Install package 'yum-utils' for better consistency checking of the package database

Install package yum-plugin-security to maintain security updates easier

This control test if the software repositories via YUM are available. If not, it might be due to bad configuration (e.g. missing registration with RHN).

This control tests for the presence of a security repository in the updates. On most Debian based systems this line is there by default, to allow the installation of security patches. When this line is not available, it might indicate that this system does not receive security patches. An alternative is that it uses a merged tree, in that case this control should be ignored for this particular system.

Lynis tests for vulnerable packages, packages with known security flaws and which already have an update available.

This controls checks for vulnerable packages on Gentoo based systems

This control tests for available upgrades on Ubuntu. Depending on your software upgrade policy, determine if this control is too strict.

Most operating systems provide a tool to check for security packages, to fix vulnerable versions of installed software. When possible, install such tool.

Most Linux distributions use a kernel package to easily allow upgrading it when bugs or security flaws were found. This test determines the number of installed packages.

This Lynis test determines if there is a toolkit installed to automatically download and apply upgrades.