Skip to content

what-it-checks.md

Latest commit

 

History

History
147 lines (102 loc) · 7.28 KB

what-it-checks.md

File metadata and controls

147 lines (102 loc) · 7.28 KB
Raw

What a server audit with server_audit_notify.sh checks

The script runs Lynis, then checks failed SSH logins, listening ports, disk usage, large files and recent package installs. It saves each result to /var/log/server_audit and emails a summary.

Source: https://serverauditing.com/what-it-checks/

Checks at a glance

All files go to /var/log/server_audit (or the --report-dir you set), and every file name ends with the start time of the run in the form _YYYY-MM-DD_HH-MM-SS.

Check Command Output file In the email
Security audit lynis audit system --no-colors --quiet lynis_<time>.log, lynis-report_<time>.dat Up to 20 warnings
Failed SSH logins grep "Failed password" on the SSH log ssh_failures_<time>.log Count and top 5 IPs
Large files find / -type f -size +100M large_files_<time>.log At the thorough level
Disk usage df -h disk_usage_<time>.log Yes, without tmpfs and udev
Listening ports ss -tuln or netstat -tuln listening_ports_<time>.log Count and notable ports
Recent packages /var/log/dpkg.log or yum history recent_packages_<time>.log At the thorough level

Lynis security audit

Lynis is an open-source security auditing tool for Linux, macOS and other Unix systems. The script runs lynis audit system --no-colors --quiet and saves the console output. It also passes --report-file, so Lynis writes its findings to lynis-report_<time>.dat. The script copies the last 20 warning[] entries from that file into the summary, each with its Lynis test ID.

If Lynis exits with an error, the script logs the exit status and carries on with the other checks.

The --level option changes what runs:

Level Lynis options Other differences
basic --tests-from-group "authentication ssh firewalls networking ports_packages" Skips the large file search
standard none (all test groups) The default
thorough none (all test groups) Adds Lynis suggestions, large files and recent packages to the email

The standard and thorough levels run the same Lynis audit, as root, with every test group. The thorough level adds detail to the email. The script does not use the Lynis --pentest option, which the Lynis documentation describes as "Perform a penetration test scan (non-privileged)" and which skips tests that need root.

Failed SSH logins

The script reads the last 50 lines that contain "Failed password" from the first source it finds:

  1. /var/log/auth.log (Debian and Ubuntu with rsyslog)
  2. /var/log/secure (Red Hat style systems)
  3. The systemd journal, through journalctl -u ssh -u sshd

The summary names the source, shows how many lines it found (at most 50), and lists the five IP addresses that appear most often. If none of the sources exists, the section says "Source: none" and reports zero.

Listening ports

The script saves the output of ss -tuln, or netstat -tuln when ss is not installed. Both list listening TCP and UDP sockets with numeric addresses. The summary counts lines in the LISTEN state, which covers TCP only, and prints any socket on ports 22 (SSH), 25 (SMTP), 80 (HTTP), 443 (HTTPS), 3306 (MySQL) or 5432 (PostgreSQL).

If neither tool is installed, the script skips this check and says so in the summary.

Disk usage

The script saves df -h and copies it into the summary without tmpfs and udev lines. If any other file system shows 90% use or more, including 100%, the recommendations include "Free up disk space on partitions with 90% or more usage".

Large files

The script lists up to 20 files larger than 100 MB, largest first. It searches from / and skips /proc, /sys, /dev and /run, so it can take a while on large disks. The basic level skips this search.

Recent package installs

On systems with apt, the script saves the last 50 install lines from /var/log/dpkg.log. On systems with yum, it saves the first 20 lines of yum history.

What the emailed summary looks like

The email body has a short header and then the summary file. The layout below comes from the script at the standard level; values in angle brackets are filled in at run time.

Server Audit Notification
=========================

SERVER AUDIT SUMMARY
====================
Date: <date>
Hostname: <hostname>
IP Address: <first address from hostname -I>
Audit Level: standard
Issues Found: <yes or no>

SYSTEM INFORMATION
------------------
OS: <PRETTY_NAME from /etc/os-release>
Kernel: <uname -r>
Uptime: <uptime -p>

SECURITY WARNINGS
-----------------
- <Lynis warning text> [<Lynis test ID>]

FAILED SSH ATTEMPTS
-------------------
Source: <log file or journalctl>
<N> failed SSH login attempts found (last 50 at most)
Top IP addresses:
<count> <IP address>

DISK USAGE
----------
<df -h without tmpfs and udev>

LISTENING PORTS
---------------
Source: <ss -tuln or netstat -tuln>
<N> listening TCP sockets found
Notable ports:
<lines for ports 22, 25, 80, 443, 3306, 5432>

RECOMMENDATIONS
---------------
1. Review all security warnings
2. Investigate any suspicious failed login attempts
3. Check for unauthorized listening ports
4. Address Lynis security warnings
5. Free up disk space on partitions with 90% or more usage

For detailed information, see the full audit logs in /var/log/server_audit

Generated by server_audit_notify.sh
Powered by Forward Email - https://forwardemail.net

"Issues Found" is yes when there are Lynis warnings, failed SSH logins, or a file system at 90% or more. Recommendations 1 to 3 appear every time; number 4 appears when there are Lynis warnings, and number 5 when a file system is 90% full or more. The thorough level adds LYNIS SUGGESTIONS, LARGE FILES and RECENT PACKAGES sections.

The subject line is Server Audit Report: <hostname> - <YYYY-MM-DD>. By default the email goes out after every run; with --only-on-issues it goes out only when "Issues Found" is yes.

Files written on each run

File Contents
audit_<time>.log Progress messages of the script and any curl error, with timestamps
summary_<time>.txt The summary shown above
email_<time>.txt The email that was sent, with headers
lynis-report_<time>.dat The Lynis report file with all warnings and suggestions
Six check files One file per check, listed in the table at the top

The script creates the report directory with mode 700. It does not write the SMTP password to any file.

What the script does not check

The script reports. It does not change system settings or fix findings, apart from installing lynis and curl when they are missing. It also does not check:

  • Pending security updates. Lynis may report some package findings, but the script itself only lists past installs.
  • Firewall rules, user accounts or sudo rights, beyond what Lynis covers.
  • File integrity. The script keeps no baseline and does not compare files between runs.
  • Whether the server runs the code you expect. Attestium and Audit Status from the Forward Email team address that question with remote attestation.

The Linux server audit checklist covers these areas with commands and sources.