Linux 伺服器安全加固：用 Lynis 做自動化安全審計

# 加入 Lynis 嘅 repository
sudo apt update
sudo apt install lynis -y

# 或者直接從 GitHub 下載最新版
git clone https://github.com/CISOfy/lynis
cd lynis

# 啟用 EPEL repository
sudo yum install epel-release -y
sudo yum install lynis -y

# 基本系統審計
sudo lynis audit system

# 只檢查特定類別（例如網絡安全）
sudo lynis audit system --tests-from-group networking

# 非特權模式（唔用 sudo，檢查範圍有限）
lynis audit system --pentest

# 睇返上次掃描結果
sudo lynis show details

# 睇特定建議
sudo lynis show details | grep -A5 "Suggestion"

# 檢查當前 kernel 參數
sudo sysctl -a | grep kernel.randomize_va_space

# 啟用 ASLR（Address Space Layout Randomization）
echo "kernel.randomize_va_space=2" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

# 編輯 SSH 設定檔
sudo vim /etc/ssh/sshd_config

# 建議設定：
# PermitRootLogin no
# PasswordAuthentication no
# MaxAuthTries 3
# Protocol 2

# 重啟 SSH 服務
sudo systemctl restart sshd

# 檢查 world-writable 檔案
sudo find / -type f -perm -o+w 2>/dev/null

# 檢查 SUID/SGID 檔案
sudo find / -type f \( -perm -4000 -o -perm -2000 \) 2>/dev/null

# 每星期日晚 2AM 自動掃描
sudo crontab -e

# 加入以下行：
0 2 * * 0 /usr/sbin/lynis audit system --cronjob > /var/log/lynis-weekly.log 2>&1

# Plugin 放喺呢度
/etc/lynis/plugins/

# 例如自訂一個檢查 nginx config 嘅 plugin
cat > /etc/lynis/plugins/custom_nginx.sh << 'EOF'
#!/bin/bash
# 檢查 nginx 係咪隱藏版本號
if grep -q "server_tokens off" /etc/nginx/nginx.conf; then
    echo "OK: Nginx server_tokens is off"
else
    echo "WARNING: Nginx server_tokens is on - consider disabling"
fi
EOF
chmod +x /etc/lynis/plugins/custom_nginx.sh