lynis.yml

# https://packages.cisofy.com/community/#debian-ubuntu
- name: Install Lynis into Debian
  become: true
  tags:
    - packages
    - lynis
    - debian
  when: ansible_distribution == "Debian" or ansible_distribution == "Kali" or ansible_distribution == "Ubuntu"
  block:
    - name: Install apt-transport-https & gnupg2
      ansible.builtin.apt:
        name: ['apt-transport-https', 'gnupg2']
        update_cache: true
    - name: Add Lynis signing key (Debian)
      ansible.builtin.get_url:
        url: https://packages.cisofy.com/keys/cisofy-software-public.key
        dest: "{{ cisofy_keyring }}"
        owner: root
        group: root
        mode: '0644'
    - name: Add Lynis repository (Debian)
      ansible.builtin.apt_repository:
        repo: "deb [signed-by={{ cisofy_keyring }}] https://packages.cisofy.com/community/lynis/deb/ stable main"
        state: present
    - name: Install Lynis (Debian)
      ansible.builtin.apt:
        name: lynis
        update_cache: true
    # As we install Lynis directly from CISOfy we need to get this separately
    - name: Download Debian plugin for Lynis
      ansible.builtin.get_url:
        url: https://salsa.debian.org/debian/lynis/-/raw/master/debian/plugin_debian_phase1
        dest: /usr/share/lynis/plugins/plugin_debian_phase1
        owner: root
        group: root
        mode: '0600'
#- name: Install Lynis into CentOS
#  when: ansible_distribution == "CentOS"
#  become: true
#  tags:
#    - packages
#    - lynis
#    - centos
#  block:
#    - name: Add Lynis repository (RH)
#      ansible.builtin.yum_repository:
#        name: lynis
#        description: CISOfy Software - Lynis package
#        baseurl: https://packages.cisofy.com/community/lynis/rpm/
#        gpgkey: https://packages.cisofy.com/keys/cisofy-software-rpms-public.key
#        gpgcheck: true
#        priority: 2
#        enabled: true
#    - name: Install Lynis (RH)
#      ansible.builtin.yum:
#        name: lynis
#        update_cache: true
- name: Configure Lynis
  tags:
    - configuration
    - lynis
  become: true
  block:
    - name: Configure Lynis to skip certain tests
      ansible.builtin.blockinfile: # noqa yaml[line-length]
        path: /etc/lynis/custom.prf
        create: true
        owner: root
        group: root
        mode: '0644'
        block: |
          # Changing port number is just security through obscurity
          skip-test=SSH-7408:port
          # Pre-authentication compression was removed from OpenSSH 7.4 (https://www.openssh.com/txt/release-7.4)
          # and Lynis accepts "delayed", which was an option to use compression only after authentication.
          skip-test=SSH-7408:compression
          # These aren't security issues
          # Also SSHD_CONFIG(5): "Note that disabling agent forwarding does not improve security unless users are also denied shell access,
          #                       as they can always install their own forwarders."
          skip-test=SSH-7408:tcpkeepalive
          skip-test=SSH-7408:allowagentforwarding
          # Even though this is true, partitioning is usually done during install and not necessarily that easy afterwards
          skip-test=FILE-6310
          # Attackers can get their tools into hosts in any case
          skip-test=HRDN-7220
          skip-test=HRDN-7222
          # We have tooling and it's called Ansible :)
          skip-test=TOOL-5002
          # Locked accounts are perfectly normal and removing users might introduce unowned files and dirs
          skip-test=AUTH-9284
          # Allow SAK
          config-data=sysctl;kernel.sysrq;4;1;Disable magic SysRQ;sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security;
          # 2 should be enough as the kernel documentation doesn't even have >= 3 documented
          config-data=sysctl;kernel.perf_event_paranoid;2;1;Restrict unprivileged access to the perf_event_open() system call.;sysctl -a;url:https;//kernel.org/doc/Documentation/sysctl/kernel.txt;category:security;
    # https://github.com/CISOfy/lynis/issues/967
    - name: Configure /etc/cron.{allow,deny} permissions in /etc/lynis/default.prf
      when: ansible_distribution == "Debian" or ansible_distribution == "Kali"
      tags: debian
      ansible.builtin.replace:
        path: /etc/lynis/default.prf
        regexp: '^(permfile=/etc/{{ item.key }}):rw-------:root:-:WARN:'
        replace: '\g<1>:{{ item.value }}:WARN:'
        validate: '/bin/grep "^permfile=/etc/{{ item.key }}:{{ item.value }}:WARN:$" %s'
      with_dict:
        cron.allow: rw-r-----:root:crontab
        cron.deny: rw-r-----:root:crontab
    - name: Configure /etc/at.{allow,deny} permissions in /etc/lynis/default.prf
      when: ansible_distribution == "Debian" or ansible_distribution == "Kali" or ansible_distribution == "Slackware"
      ansible.builtin.replace:
        path: /etc/lynis/default.prf
        regexp: '^(permfile=/etc/{{ item.key }}):rw-------:root:-:WARN:'
        replace: '\g<1>:{{ item.value }}:WARN:'
        validate: '/bin/grep "^permfile=/etc/{{ item.key }}:{{ item.value }}:WARN:$" %s'
      with_dict:
        at.allow: rw-r-----:root:daemon
        at.deny: rw-r-----:root:daemon
    - name: Configure Lynis to skip RPM related tests
      ansible.builtin.blockinfile:
        path: /etc/lynis/custom.prf
        marker: "# {mark} ANSIBLE MANAGED BLOCK - Skip RPM related tests"
        block: |
          skip-test=PKGS-7308
          skip-test=PKGS-7383
          skip-test=PKGS-7384
          skip-test=PKGS-7386
          skip-test=PKGS-7387
      when: ansible_os_family != "RedHat"
    - name: Configure Slackware specific tests to skip
      ansible.builtin.blockinfile:
        path: /etc/lynis/custom.prf
        marker: "# {mark} ANSIBLE MANAGED BLOCK - Slackware"
        block: |
          skip-test=PKGS-7398
      when: ansible_distribution == "Slackware"
      tags: slackware
    - name: Lynis systemd service
      when: ansible_distribution == "Debian" or ansible_distribution == "Kali" or ansible_os_family == "RedHat"
      tags:
        - services
        # This is not idempotent
        - molecule-idempotence-notest
      block:
        - name: Download lynis.{service,timer}
          ansible.builtin.get_url:
            url: https://raw.githubusercontent.com/CISOfy/lynis/master/extras/systemd/{{ item }}
            dest: /etc/systemd/system/
            owner: root
            group: root
            mode: '0644'
          with_items:
            - lynis.service
            - lynis.timer
        - name: Fix Lynis path into lynis.service
          ansible.builtin.replace:
            path: /etc/systemd/system/lynis.service
            regexp: '^(ExecStart=)/path/to/lynis( audit system --cronjob)$'
            replace: '\g<1>{{ lynis_location }}\g<2>'
        - name: Enable Lynis systemd unit
          ansible.builtin.systemd:
            name: lynis.timer
            daemon_reload: true
            enabled: true
            state: started
          # "System has not been booted with systemd as init system (PID 1)."
          tags: molecule-notest
    - name: Create daily cron job to run Lynis
      when: ansible_distribution == "Slackware"
      tags: slackware
      ansible.builtin.copy:
        dest: /etc/cron.daily/run_lynis
        owner: root
        group: root
        mode: '0700'
        content: |
          #!/bin/bash

          set -e
          if ! hash lynis 2>/dev/null
          then
            exit 1
          fi
          lynis audit system -Q -q --slow-warning 200
          tests_performed="$(gawk '/Tests performed:/{print$5}' /var/log/lynis.log)"
          hardening_index="$(sed -n 's/^.\+\(Hardening index : .\+\)$/\1/p' /var/log/lynis.log)"
          lynis_version="$(gawk '$3=="Lynis" && $4 ~ /^[0-9.]+$/{print$4}' /var/log/lynis.log)"
          /usr/bin/logger -t lynis "Lynis ${lynis_version} Tests performed: ${tests_performed} ${hardening_index}"