Question : has anyone evaluated their Proxmox box with Lynis ?

[Glowsome]

Just a general question, as the topic said.

I myself have both a cluster and a standalone machine for testing purposes.
This machine is the result of a debian-install-move to proxmox based on the Wiki and Buster distro, running the latest 6.x version.

When running Lynis security audit https://downloads.cisofy.com/lynis/lynis-3.0.5.tar.gz it kind of scared me, as the default score was well below what i had expected on the box.
I started out with an index of like 52, i reconfigured some, and installing some tools stuff gaining me on a rerun to 68, stil some (imho is there to be done)



As some things are quite easily repaired/hardened some are like way beyond my understanding ( as in kernel hardening ) as i dont know the impact to ProxMox itself.
So in this i seek guidance.

In essence i am looking for a MINIMAL score of 80, so i need to gain atleast 12 points in hardening without compromising functionality.

- Glowsome

 

[ness1602]

Is there some GUI or parser for reading lynis files? This is really a bunch of lines.

 

[guletz]

In essence i am looking for a MINIMAL score of 80, so i need to gain atleast 12 points in hardening without compromising functionality

Hi,

Lynis is a great tool. But security is not a tool, is much more like a process. It is also about the probability that a security problem to be exploited by enemys, and wat will be the impact in this case.

Sometimes, like you said, functionality is important, so you can not hardened your server. But you can minimize your attack surface with a good firewall (layer3 and/or layer7) as a simple example.

Good luck /Bafta !

 

[Glowsome]

Is there some GUI or parser for reading lynis files? This is really a bunch of lines.

In essence every program is a bunch of lines...

 

[ness1602]

Yes, but those lines are not that readable.

 

[greg]

Greetings
Did you make any progress on this topic? I'd be interested in the results.
Regards