4 ms·

As the author of the tool, I can share that these tools are still very much needed. Why? Upstream vendors will never set values that are strict. Because in that

by mboelen 11y ago

As the author of the tool, I can share that these tools are still very much needed. Why? Upstream vendors will never set values that are strict. Because in that case, people would have too much difficulty to get things working. The tool exists to simplify testing many individual tests. We don't simply use existing benchmarks or guides, but also have tests of our own. For example, if you have configured at least two name servers, or that your time is properly configured, and no false-tickers are present. Things which no upstream vendor even can configure for you. Another common use case: you are the new system administrator and have to deal with the "great" work of the previous one. The tool helps to determine the quality of the previous person, in just a matter of minutes.

PuffinBlue 11y ago
Don't worry, a lot of people use these types of tools for the right reasons and in the understanding that there is a bigger picture. They just don't feel the need to get all preachy about it. I've already got a use in mind for it where it could certainly help me save some time. Thanks for your work!
teddyh 11y ago
> Upstream vendors will never set values that are strict. Because in that case, people would have too much difficulty to get things working. If the upstream software author won’t fix it, and the Debian Maintainer (packager) won’t fix it, and if the Debian Technical Committee chooses not to overrule the Debian Maintainer, then it’s probably not actually a problem. > if you have configured at least two name servers, or that your time is properly configured, and no false-tickers are present. Things which no upstream vendor even can configure for you. This, on the other hand, does sound like a nice set of features, but this is then no longer a “Security audit” tool. Ideally, of course, these kinds of checks should be integrated into their respective programs/packages. > you are the new system administrator and have to deal with the "great" work of the previous one. Either you know that you can’t trust the previous sysadmin, in which case you have to reinstall anyway, or you start out trusting them, in which case you wait until you actually find something bad, and only then reinstall. I don’t really think this use case is very useful.
- mboelen 11y ago
  Not everyone comes with the same skill set or expertise. If you work at a big multinational, reinstalling hundreds or even thousands of systems, is no option. Lynis, free to use, simply helps you determining the sanity level in a quick way. The main focus of Lynis is security auditing. Since some parts are so important for integrity of the systems or forensics, we do check them. Proper timing is one of them, proper DNS configuration is another one. Some things you want to put into your monitoring system as a regular test, other will be handled by the tooling itself. What we find, is that Lynis often detects incorrect configurations. That is exactly the purpose of the tool. Helping those, who didn't know, or thought things were fine. Appreciate your stance, understand it and even agree with most of it. The tool is there to help to achieve what we both see as an ideal world: secure permissions by default, proper configurations, correct monitoring and integrity of data. Till the time we achieved that, I'm glad to see many were able to move up a few steps to this ideal world. Till then, happy hardening :)

by mboelen 11y ago

PuffinBlue 11y ago

Don't worry, a lot of people use these types of tools for the right reasons and in the understanding that there is a bigger picture. They just don't feel the need to get all preachy about it. I've already got a use in mind for it where it could certainly help me save some time. Thanks for your work!

teddyh 11y ago

> Upstream vendors will never set values that are strict. Because in that case, people would have too much difficulty to get things working. If the upstream software author won’t fix it, and the Debian Maintainer (packager) won’t fix it, and if the Debian Technical Committee chooses not to overrule the Debian Maintainer, then it’s probably not actually a problem. > if you have configured at least two name servers, or that your time is properly configured, and no false-tickers are present. Things which no upstream vendor even can configure for you. This, on the other hand, does sound like a nice set of features, but this is then no longer a “Security audit” tool. Ideally, of course, these kinds of checks should be integrated into their respective programs/packages. > you are the new system administrator and have to deal with the "great" work of the previous one. Either you know that you can’t trust the previous sysadmin, in which case you have to reinstall anyway, or you start out trusting them, in which case you wait until you actually find something bad, and only then reinstall. I don’t really think this use case is very useful.

mboelen 11y ago
Not everyone comes with the same skill set or expertise. If you work at a big multinational, reinstalling hundreds or even thousands of systems, is no option. Lynis, free to use, simply helps you determining the sanity level in a quick way. The main focus of Lynis is security auditing. Since some parts are so important for integrity of the systems or forensics, we do check them. Proper timing is one of them, proper DNS configuration is another one. Some things you want to put into your monitoring system as a regular test, other will be handled by the tooling itself. What we find, is that Lynis often detects incorrect configurations. That is exactly the purpose of the tool. Helping those, who didn't know, or thought things were fine. Appreciate your stance, understand it and even agree with most of it. The tool is there to help to achieve what we both see as an ideal world: secure permissions by default, proper configurations, correct monitoring and integrity of data. Till the time we achieved that, I'm glad to see many were able to move up a few steps to this ideal world. Till then, happy hardening :)